Why are there ads on web sites?

On August 1st there was an article on ReadWrite.com that urged users to install AdBlock on their web browsers.  I think that is horrible.

It is an unspoken agreement between content provider and content consumer that the provider can attempt to make money from the consumer as long as it is not too obvious or painful for the consumer.  This balance between income for the provider and comfort of the consumer is essential to maintain.  Too much discomfort for the user and they will not visit, and too much comfort for the consumer and the provider will not make any money.

Extreme examples of this exist.  My kids are adept at visiting web pages which are nothing  but "clickholes" that provide malware and ads with the occasional funny video or picture.  These sites are evil and should be avoided.  But just because one site spews malware and popup ads does not mean another site with reasonable ads should be maligned.

There is nothing wrong with having ads on a web page.

The television and radio are full of ads, ad-free radio still includes station identification, self promotion, and other interruptions which might as well be ads.  Content is not free, people create content for a reason and should be rewarded for the time to create and provide that content.  Nothing is truly free, it costs someone something.

Ads are therefore inescapable and necessary.

Well, that is not true.  This page, this text, could be behind a paywall where only premium subscribers could read the content (otherwise all the data would be missing the vowels and you would have to pay for each a,e,i,o,u, and sometimes y.)  But I feel paywalls and subscriptions are best kept toward newspapers and porn.  They are poor solutions to the problem and prevent the exchange of ideas and information.  All the consumer hast to do is see an ad on a page (the horror!)

As long as ads are going to be on pages, they might as well reflect the interests of the consumer.  This is why you are tracked by Google.  Not to be spied upon but to be offered things advertisers hope you would like.  This might be creepy but I think it is far less creepy than the viagra, catheter, wheelchair, and adult diaper commercials on the evening news.  There is a market for such things but when I watch the news with my kids I have to explain not only geopolitical issues but also what erectile dysfunction is.  Targeted ads mean that you don't have to know about the latest in self-lubricating catheters, unless that is something interests you.

When you click on ads that interest you it only helps both you and the content provider. You will then see ads that more closely match ads that interest you and the content provider will make some money and be encouraged to make more content you like/need/want.  This is thanks to tracking and targeting of ads.

The tracking implemented by Google is a passive fingerprint of you which is shared across multiple web sites.  Your IP address, username on your computer, the type of browser and the configuration of that browser create this fingerprint.  Microsoft's jealousy sparked the "scroogled" campaign but rest assured that Bing tracks you too (that is why they have a rewards program, to encourage you to be tracked).  The tracking will happen no matter what, the technology is so simple that it is silly to not incorporate it into any web site.

So, ads and targeting are necessary for content providers to make money on the content they provide.  How much money are we talking here?  Shouldn't content providers not be so greedy and display less ads or have other options?  Well, the sad truth is that the viewing of an ad by a content consumer is literally a penny.  A click can be a dime, but most people don't click.  A popular post of mine generated over a hundred page views in a month, for that I was given $.04.  The total views of all of my pages over the last year might have resulted in a few dollars.

It is literally nothing for a content consumer to see an ad. But it means a lot more for a content provider.  Don't block ads, click on ads that truly interest you on sites that truly help you.  It is the same as putting a penny, nickel, or dime in a jar.

Railo 4.2.1.0 Install on Windows with Apache (not IIS) Problem

I will have a longer post soon on this (I hope).

If you are installing a new copy of Railo on a Windows server with Apache (not IIS) using the Railo installer which comes with tomcat, and at the end of the installation your web browser only comes up with a "not found" 404 error, then you might be having the same problem I was having.  The Railo service starts, but then stops (like the Railo service crashes with no errors).

If you look in the railo\tomcat\logs folder you will see the commons-daemon.yyy-mm-dd.log, in that you will see a few errors that look like: "Commons Daemon procrun failed with exit value: 4 (failed to run service)" and "The service process could not connect to the service controller."  These errors don't lead far, but the next place to look is the catalina.yyyy-mm-dd.log.

In there you will see errors like: "SEVERE: A child container failed during start" above that error is the issue, if you are using Apache (like you should on a Windows server) you don't have a "C:\inetpub\wwwroot" folder.

The installer defaults the server.xml to contain the following entry: "<context path="" docbase="C:\inetpub\wwwroot\">".  Simply edit the c:\railo\tomcat\conf\server.xml file with notepad and change the entry to read "docBase="C:\apache\htdocs\" instead.  Save the server.xml file and restart the railo service and you should be able to browse to http://127.0.0.1:8888/index.cfm to see the "Welcome to the Railo World" page.

To have your Apache web site in htdocs be able to handle ColdFusion pages, you need to make an entry in the server.xml file for the default web site on Apache.  To do this, add the following before the "</Engine>" tag toward the bottom:
<Host name="[your ip address or DNS name for Apache]" appbase="webapps" >
    <context docbase="C:\apache\htdocs\" path="" />
</Host>


Now you should be able to add a index.cfm page to your htdocs folder and have it display properly.

Issues Connecting to OpenShift on a new system

Well, there were additional issues when connecting a new system.  Somehow the new system lacked permission to the .ssh folder in the user profile.  When "rhc setup" ran, it created the .ssh folder under root with no permission for the user.  After a quick "chown" so that the user had the proper permission, all was well. For all to consider, the error was as follows:

Cloning into 'foobar'...
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.

First Steps in OpenShift

OpenShift is a Platform as a Service (PaaS) provided by the Linux gurus at Red Hat.  It is like Amazon Web Services (AWS) but not as confusing for a newbie.  For free (truly free, no CC required or worries about utilization based billing) they give you three "small gears", or three servers with 512 MB of RAM and 1 GB of hard drive space each.  After you sign up for a free account, you can host "applications" on your "gears".  The "applications" can have additional components added by installing "cartridges".  So, I have hosted a PHP "application" and added a MySQL "cartridge" to one of my "gears".  ((I hate the lingo, sorry but this type of jargon drives me nuts and I only have it here to provide you with an orientation to the platform.))

After you sign up for that free account the documentation kind of tapers off and people who are super nerds tell you how easy things are without actually explaining anything.  That is why I am writing this, to provide some context and explanation which will hopefully let someone understand this great platform.

Here are two things that had me stuck once I got started:

1. Install the "rhc" tools.  The process is simple and well documented on ( https://www.openshift.com/get-started ), with more details on ( https://www.openshift.com/developers/rhc-client-tools-install ).  

These tools are important as the platform is tightly bound to local files on your computer using Git (rather than copying files with FTP to/from the server).  With the tools installed and a basic PHP application, you can now use Git to make a nice web page with basic PHP.  If you want to add MySQL, things are a bit more complex.

2. Adding MySQL is easy but connecting to it is a little... different.  OpenShift uses environment variables to connect to your database.  They give you the normal credentials just in case, but it is best to use the environment variables so that your PHP code does not contain sensitive information which could get your site hacked.  As I am rusty on PHP, it gave me a few hours of head scratching before I got things to work right.  But here is some code to save you a lot of time:

define('DB_HOST',getenv('OPENSHIFT_MYSQL_DB_HOST'));
define('DB_PORT',getenv('OPENSHIFT_MYSQL_DB_PORT'));
define('DB_USER',getenv('OPENSHIFT_MYSQL_DB_USERNAME'));
define('DB_PASS',getenv('OPENSHIFT_MYSQL_DB_PASSWORD'));
define('DB_NAME',getenv('OPENSHIFT_GEAR_NAME'));
$con = mysqli_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME, DB_PORT);

This will set the "$con" variable as your database connection so that you can do select and insert queries.

A longer tutorial is in the works, but I hope this can get just one newbie up and going with OpenShift.

Offline/Airgapped Adobe ColdFusion Updates

Recently, I tweeted some stuff that got the goat of some prominent ColdFusion gurus.  I am not normally in a mood to attack the things that I love (and I love ColdFusion) but Adobe has been kicking that baby and stuff must be said.  ColdFusion is not secure by default, you should not just install it and hook that server to the Internet.  We, web developers/sysadmins/security people, have grown fat/dumb/happy with modern servers which are updated automagically and are (relatively) secure after install.  Adobe's track record with Flash and PDF should tell us differently, but we install CF and expect it to behave like Apache/PHP or IIS/ASP.NET.  It is not like them, you have to get into the time machine to 2003 and manually lock down the CF server and then manually apply the patches as soon as your Internet facing CF server picks them up.  The CF lockdown guide in all of it 58 pages of wisdom is available here:( http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/cf10-lockdown-guide.pdf )

But what about offline/airgapped servers?  ColdFusion 10 (and I assume 11) can only be updated online.  If you are so unlucky as to have an airgapped CF server then you have to spoof the Adobe update servers.  Here is how you can do that:

1. Download the Updates.xml file from: ( http://download.adobe.com/pub/adobe/coldfusion/xml/updates.xml ) and save it to a thumb drive.

2. Open the downloaded Updates.xml file with notepad (or Sublime Text) and search for the "cfhf_filename" tags.  Each of those is a hotfix you need to download and put onto the thumb drive.  Basically, if you scroll to the top, you will see that the latest hotfix is like "hotfix_013.jar".  You will then enter the url for it into the browser: ( http://download.adobe.com/pub/adobe/coldfusion/hotfix_013.jar ) and save the jar to your thumb drive.  If you know you need to implement older hotfixes, repeat with all of the hotfixes in the Updates.xml file.

3. You will now need to choose a location to host the updates.  Go to the server (don't copy the files yet) and create a folder accessible via a URL. I created a folder on my server which only was open as http://127.0.0.1 but there is no harm in putting the updates in your normal document root folder.  No matter where you will place the updates, they must be accessible via a URL (since this is a web server I will assume you know how to set up a folder on a web server and what the URL for that folder will be).  For me this was http://127.0.0.1/cfupdates. 

4. Don't copy the files yet. Now that you have the folder and know what the URL for that folder will be, edit the updates.xml file (in the editor of your choice) and edit the "cfhf_downloadlink" tag to be the full URL to each of the files once you copy them to the server.  For me this changed from "http://download.adobe.com/pub/adobe/coldfusion/hotfix_013.jar" to "http://127.0.0.1/cfupdate/hotfix_013.jar".  Save the updated updates.xml to the thumb drive and copy all the contents to the server folder you created.

5. Open the ColdFusion Administrator console and hit the Server Update tab, and then the Updates item under the main tree.  In the main dialog area, click the settings item in the top tabs.  Toward the bottom of the screen you will see the "Update Site" area, enter your update URL (to include the path to the updated updates.xml file).  Mine is "http://127.0.0.1/cfupdates/updates.xml".  Click Submit Changes.

6. You should then be able to click the "Available Updates" tab on the top, then "Check for Updates" and have the lower window populate with updates to be applied.

The updates appear to be cumulative (I have not fully tested them and the file sizes are confusing if they were cumulative -- they don't grow with each update).  Once I applied Hot Fix 13, the lower hot fixes disappeared from my dialog.  You also need to install the "Mandatory Update" for ColdFusion 10 ( http://helpx.adobe.com/coldfusion/kb/coldfusion-10-mandatory-update.html ) before attempting this process.  Yes you will need to do this for each new hotfix.  Maybe there is a way to manually execute the jar on the server so that you don't have to mess with this update URL mess.

Your mileage may vary, this is an Adobe product after all.  

It has been a long time since I have posted to this blog.  There are so many things I want to say and share but have not had the time to discuss them properly.  I guess I have been too busy.  While that is a good thing, it limits my ability to contribute in the only way I can, share what I have learned the hard way.  Since I rely upon people doing the same, sharing is something that I see as critical to our combined success.  So, please forgive my lack of contributions... and please continue sharing your knowledge and experiences!