Check out my tour schedule here.

Lest this turn into a self-promoting, self-congratulating garbage post, I should probably get to the point why I’m listing all this: To succeed in today’s digital world, I believe you need to learn to do more than one thing. Hit the jump for more…

When I was a kid, I was going to be a scientist someday. Then a writer. Then a movie director. Then a computer programmer. Given my proclivity for pushing plastic keys and messing with calculators, the latter came pretty naturally. But then college: the computer engineering program I entered was focused on compilers and shrink-wrapped software; this whole ‘internet’ and ‘hypertext’ thing seemed a bit faddish. But that’s what I was interested in. So I switched to English where, not only did I get to read books and write, but the profs there were actually psyched about HTML — they saw it as a new future where everyone in the world would read their manifesto on “British colonial attitudes between the years of 1862 and 1864.”

Yeah, so, fast-forward to today.

Film industry is changing.

Music is changing.

And now publishing is changing.

Not to mention newspapers, magazines, and everything else related to the printed word. So the question you have to ask yourself, as a programmer, or a writer, or a graphic designer is: am I learning new things that will help me leverage my top skills in other verticals (to use some biz-speak)?

To come at it another way — you can do one of the aforementioned things, and that’s great, and you can probably get people to pay you to do it. But if you’re a programmer, why not learn to write and kick out a self-pubbed book on programming related to your particular specialty? Or polish up some design skills: at the least, learn some color theory and basic front-end HTML 5. If you’re a graphic designer, you damn well better be learning HTML and CSS or you’re sunk as the ad agencies all start going digital/interactive. If you’re a writer and you’re still poking your typewriter and ignoring the world of social media, internet publishing, and design, then you’re going to end up spending a lot of money paying guys like me to do stuff for you when you either (A) self-publish or (B) your Big Publishing publisher tells you “do the marketing your damn self because we’re cutting budgets.”

And I’m not saying that this secondary or tertiary skill you pick up needs to be polished to diamond clarity. You don’t need to become Mario Llosa to add some oomph to your programming skills. You don’t need to become Van Gogh to learn to make website designs that are better than this. And you don’t need to know the ins-and-outs of Ruby’s eigenclass if you want to improve your ability to do internet marketing for your book.

But you do owe it to yourself to push the boundaries of your comfort zone and go beyond your expertise. It will pay off in dividends.

It’s a supernatural thriller about demons, angels, poker, and armageddon, set in Las Vegas. If you like Tim Powers or Dean Koontz, you’ll probably dig this.

It’s only $2.99 for e-readers. $11.95 if you want a for-reals paperback.

ebook for Kindle/Kindle App: http://amzn.to/dhkindle
ebook for Nook: http://bit.ly/dhnook
paperback: http://amzn.to/qxQEgw

And if you buy it, read it, and like it, please drop by Amazon and give it a quick review. Every review helps get it more exposure to readers that might not otherwise ever hear about the novel. Thanks!

In my opinion, this debate is like having a debate about cars vs. pickup trucks. There are valid pros/cons to buying cars and valid pros/cons to buying pickup trucks. In fact, it’s totally valid for one person to own both a car and a pickup truck! Gasp! I know, it’s mind-blowing!

I’ll add that, as a proponent of MongoDB, I definitely think the right NoSQL database is a better solution in many ways for much of the web-app databasing that was previously handled by relational DBs. But my saying that in no way indicates that I think SQL is dead, relational is dead, or anything of that sort. This is a classic ‘right tools for the job’ discussion.

If there’s any debate at all, maybe it’s around what, specifically, the best use cases are for each type of database, but I’d prefer that we stop referring to that as a debate and instead just see it as an ongoing evolution and discussion. Creating conflict where there doesn’t need to be any solves nothing and makes us all look bad.

• Linux Malware Detector on a daily scan
• mod_security for Apache
• moving /tmp to a non-executable partition
• daily scan with ClamAV’s clamscan utility
• moving SSH to a nonstandard port
• removing the ability for root to login through SSH
• (even better) making SSH auth-key-based only, so no user/password logins at all!

This setup will at the very least harden your server against the bulk of irritating script-based assaults.  There’s lots more that can (and should) be done, but I’m starting to think that most of the things I’ve just listed are required nowadays (certainly the SSH ones are).

First, you gotta setup Mongoid with Carrierwave and all that junk.  I’m not going to explain how all that works.  It’s not terribly difficult.  Figure it out.  The salient point is that you should go ahead and get your model and controller all wired up so that Carrierwave processes the file upload and attaches it to your Mongoid model correctly.  For now, ignore the virus-scanning bit and just get that working.  Once you’re there, read on…

THE CONTROLLER

The first trick is that you don’t want to just attach the file to the model anymore, since you want to verify it’s cleanliness first.  So we need to shunt it to the file system in a temp directory where we can scan it.

Your ‘create’ method on the controller might look something like this (using InheritedResources here for simplicity):

So what we’re saying is that we shunt the manuscript off before we create the project and save the object to mongo. Obviously.

Here’s that method (I’ve removed some extra code that’s not relevant to the discussion):

Okay, so that last line takes us to the next awesome. We’ve got a project. It has a manuscript. We’ve shunted it off and written to the filesystem, then deleted the param so it doesn’t get attached via Carrierwave (yet). Now we call process_manuscript_upload for that project against that file. (NOTE: obviously we call this same shunt method in the update action on the controller too)

CLAM AV

Before we can go about willy-nilly virus-scanning things, we ought to have a virus scan solution. Enter ClamAV for Linux. Suppose you could use any virus scanner you want here, as long as it can be called via command-line and returns reasonable exit codes that differentiate between success (clean) and failure (has virus).

I’ll leave it up to you to figure out how to install ClamAV on your system.

THE MODEL

So in our Project model, we’ve added an instance method that gets called after someone has attempted to upload a file through our projects controller. It does our dirty work using the virus scanner we just installed.

Seriously, this is not really complicated at all. I’ll break it down:

1. figure out the path to file we want to scan. scan it using system() shelling out to the ‘clamscan’ executable and giving it the tmp path of our file.
2. if it’s clean, assign it to manuscript by just opening up the file (carrierwave takes over here — in my case, I have it write the file to cloud storage, but you could write it locally, or to the database, or whatever), change the Project object so it doesn’t think it has a pending manuscript anymore, and save
3. if it’s got a virus, similarly update the pending attribute, but instead of attaching, we log a big warning, send the user a nasty email, and delete the filthy thing from our filesystem.

Easy, right? And if you don’t know what that very last line is all about, it’s DelayedJob. I like the fork from collectiveidea. Really, you want to background this somehow. Generally ClamAV is fast as hell, but you don’t want that process blocking the saving of the user’s Project. And that’s what the ‘pending’ attribute is all about. On my Project new form, I only show the manuscript upload file field if pending is false. If it’s true, I instead show a message with a little spinner saying “Your manuscript is being scanned for viruses” or something like that.

So hopefully that wasn’t too tough to follow. I was delighted at how straightforward it ended up being. And I’m sure there’s some variations on the theme you could use, or wrap all this up in a nice include that just gets stuck on the model (i.e. include VirusScanner or something). But this is my quick-and-dirty implementation.

Enjoy!

I still love you Haml, but you’ve grown a bit slow. I like Slim‘s sexier benchmarks. And it turns me on not to need to type % anymore. I mean, look at this:

Anyway, I know and love you, Haml. I won’t stop using you for all sorts of stuff. And I can tell you’ve had a lot of influence on Slim. But Slim’s the templating language for me. At least for right now.

It’s not you, it’s me…

But that’s okay, I’m going to do you a kindness, Tony, and give you the config setup I used that’s giving me a good set of results per the above requirements:

Make sure this is what your <analyzer> section looks like in the /solr/conf/schema.xml file:

Now, let the commenting commence! I’m sure some folks out there would be happy to explain why the above is non-performant at large scales or that there’s a much better way to achieve my above requirements with some other method. I’d love to hear it! Lay it on me!

But for now, this is totally satisfying my requirements, and I ain’t gonna change it until I need to. And I hope the tip helps someone else get on the right path faster than I did.

Now, I’m expecting to stick a Hash into ‘filters’ in the form:

So, the idea is, the object that is saved with the above filters Hash provides a context for searching through another collection of objects (let’s call it OtherThings) using the filters. (think email rules in Outlook). Anyway, don’t worry too much about that. It’ll become more clear once I launch BigAuthor in a few weeks or so.

Using InheritedResources + Formtastic gives you a big advantage in creating resourceful controllers and their associated semantic forms really, really quickly.

The controller:

Seriously. It’s that empty.

The ‘new’ form page (in HAML, of course):

Again, that’s it. Really. The checkboxes that are checked get put into Arrays within a params['thing']['filters'] Hash and persist naturally to MongoDB through MongoMapper. No extra work needed.

In fact, the only extra thing I did was to write a short override into the create/update methods so that it strips the blanks from the internal filter arrays. (formtastic’s checkboxes post an empty string for every checkbox that is not checked, which in this case wasn’t what I wanted, but it might be fine or even required for your purposes)

BONUS!

Using Sunspot and Solr for your search solution in your MongoMapper app? Here’s a sample of the search method that my OtherThing class has for creating a search result set based on the filters:

Exactly how my Sunspot/Solr is setup, I’ll leave for the reader to imagine, but don’t overthink it… it’s not complicated and the above works fast… really, really fast. So fast, that instead of pre-creating and caching the results sets, I just re-generate them on the fly, thereby ensuring they’re always up-to-the-second with the latest OtherThings that have been added to the database.

Once again, Mongo and MongoMapper blows me away with its simplicity, further supported by the brilliant inherited_resources and formtastic!

Take it for what it is: a point of discussion.

Of course, the skeleton of any Rails app will vary from project to project, depending on needs.  Agile approach is to only add it to your framework if you actually need it right now, though some stuff tends to be easier to use (like authentication systems and databases) if you build it in up-front.  That tends to be my approach for green-fielding Rails apps.

If you’ve got some favorites that you use, feel free to post in the comments about it! I’m always interested in hearing about new stuff that makes my life easier/more fun.

FOR MY ACTIVERECORD-BASED APPS

• inherited_resources
  • for building clean, simple resource-oriented controllers.  the Rails 3.0 guys recommend you start using this with Rails 2.3.5 apps because Rails 3.0′s new controller syntax is basically derived from inherited_resources (and jose valim is on the rails core team now)
• authlogic
  • the reigning champ (in my opinion) for a while in terms of a really simple, basic user authentication solution.  i’ve also tried clearance, lockdown, ye olde restful_authentication, and others.  I still like authlogic alot, but the new Devise system seems to be really solid and might be good enough to get me to switch for new apps
• searchlogic
  • really handy extra methods for activerecord queries
• haml / sass
  • blah blah blah http://blog.digimonkey.com/2010/02/why-use-haml-and-sass-i-already-know-html/
• formtastic — http://github.com/justinfrench/formtastic
  • if you intend to produce semantically-correct, standards-compliant xhtml, your biggest enemy is trying to get forms to both look right and be semantic xhtml.  formtastic takes you a long way towards that goal, while also cleaning up your views significantly. and if you need to do something weird for a form that doesn’t quite work with formtastic, it doesn’t get in your way.
• compass + blueprint
  • blueprint is just a CSS framework for laying out 950px wide fixed layouts in a clean way; particularly great for multi-column layouts, which can be notoriously tricky to get right and cross-browser
  • compass adds a layer on top of blueprint + Sass to make html/css design really easy and slick; saves you a TON of time and makes it easier to get the cross-browser stuff working (or 99% working) on the first try, instead of spending a whole day fighting IE 7
• hoptoad
  • exception notification to a third-party service that integrates with lighthouse, github, et al
• acts_as_state_machine
  • self-explanatory
• acts_as_taggable_on_steroids
• acts_as_rateable_with_weights (mine) – http://github.com/mepatterson/acts_as_rateable_with_weights
  • forked my own version of acts_as_rateable to add weighted ratings and bayesian averages
• will_paginate
  • makes it much easier to handle pagination on any enumerable object collection (ActiveRecord objects or not)
• ssl_requirement
  • allows you to lock down controller methods so they won’t work unless the requestor is hitting them through SSL
• statistics – http://github.com/acatighera/statistics
  • have used this exactly once.  liked it, but didn’t use a ton of its features.  seems pretty robust though.
• jrails plugin (+ nuke the prototype stuff and replace with jquery)
  • self-explanatory; prototype is dead. long live jquery.
• xapian or thinking_sphinx
  • i’ve gone through so many different search engines for so many projects.  I think I’m the only one using Xapian.  It actually works pretty well, but is lacking in a lot of ways.  Thinking sphinx is similar; easier Rails integration, but missing some stuff, though it’s highlighting and excerpting work nicely.
• paperclip
  • super-simple file attachments on ActiveRecord models
• carmen — http://github.com/jim/carmen
  • “helpful collection of geographic names and abbreviations for Rails apps (includes replacements for country_select and state_select)”
• stringex — http://github.com/rsl/stringex
  • helpful assortment of extra string methods
• admin-data — http://github.com/neerajdotname/admin_data
  • every app ends up needing some sort of admin backend to rifle through the data layer, at the very least in development mode; pretty useful
• bullet — http://github.com/flyerhzm/bullet
  • stupid-simple plugin that helps you find N+1 queries and other query performance problems
• factory_girl, shoulda, faker
  • i liked factory_girl a lot until my company started using machinist, so now I think I like that better.  shoulda is great.  faker is indispensable, imho.
• db-populate – http://github.com/ffmike/db-populate
  • i’ve been using this in my older AR-backed apps.  probably won’t need it in 2.3.5 or 3.0 apps, though i do like how ffmike did db-populate.  i think it might still be more robust than the db:seed thing built-in to Rails

FOR MY MONGO_MAPPER APPS

• mongo
  • [GEM] the base MongoDB ruby driver
• mongo_ext
  • [GEM] C-extensions for the above to make it perform better
• mongo_mapper
  • [GEM] John Nunemaker’s thin ORM layer for Mongo.  fairly young and poorly documented, but it’s such a thin wrapper that it hasn’t been a problem for me.  just gives you some basic ActiveRecord-ish relationships and conveniences for using Mongo Documents and EmbeddedDocuments with standard Ruby models.
  • http://railstips.org/blog/archives/2009/06/27/mongomapper-the-rad-mongo-wrapper/
  • http://railstips.org/blog/archives/2009/12/18/why-i-think-mongo-is-to-databases-what-rails-was-to-frameworks/
  • http://rdoc.info/projects/jnunemaker/mongomapper
• sunspot[GEM] + sunspot_rails[GEM] (with custom config for mongo support) – http://github.com/outoftime/sunspot
  • found that sunspot integrates the solr search engine more easily with mongo than anything else out there.  has a lot of nice features, and it does automatic indexing on the fly, rather than requiring some sort of nasty cron job or handrolled delta-indexing solution
• handrolled auth system derived in part from authlogic
  • so, i probably should start using Devise, since it apparently has native mongo_mapper support.  but for the two mongo apps I’ve built thus far, i just handrolled a simple authentication system by adapting the core code from authlogic and removing all the ActiveRecord-specific bits.  works fine, easy to add on custom stuff.  but Devise is probably better for the future.
• machinist, shoulda, faker
  • see above
• acts_as_mongo_rateable (mine) — http://github.com/mepatterson/acts_as_mongo_rateable
  • I wrote this from scratch, inspired by the basic architecture of the acts_as_rateable plugin for ActiveRecord
• acts_as_mongo_taggable (mine) – http://github.com/mepatterson/acts_as_mongo_taggable
  • I wrote this from scratch, inspired by the basic architecture of the acts_as_taggable_on_steroids plugin for ActiveRecord
• will_paginate
  • works fine with any enumerable object, so works with Mongo
• compass + blueprint
  • see above
• haml / sass
  • see above
• jrails plugin (+ jquery instead of prototype)
  • see above
• inherited_resources
  • this works largely the same with Mongo, since your resource-based controller shouldn’t really have any direct dependence on your database ORM
• hoptoad
  • see above

STUFF I’D LIKE TO USE/WANT TO INVESTIGATE FURTHER

• devise – http://github.com/plataformatec/devise
  • has mongo support baked in!  looks really cool and has a lot of robust functionality.
  • example using with mongomapper – http://github.com/theshortcut/devise_mongomapper_example
• easy ESI — http://github.com/grosser/easy_esi
  • haven’t looked at it much; seems like an interesting approach
• aegis – http://github.com/makandra/aegis
  • seems like a really nice way to do complicated roles and permissions.  haven’t used it though.  dunno if it will work with any of the good auth systems like devise, clearance, authlogic, etc.  in most cases, might just be easier to write your own simple roles system (which is what i’ve done in ALL cases)