Django

Large file uploads: Revision 7814 finally lands the patch from ticket 2070 and finally allows Django to handle arbitrarily-sized file-uploads.

Ruby's security vulnerabilities

Man, I'm late to that particular party, but some serious vulnerabilities have been found in the main Ruby interpreter. Unfortunately it seems that the official maintainers messed up as well and only 3^rd-party patches are available right now, because there's no known stable release code in the codebase that a quick patch release could be based off.

I think the most important lesson that can be learned from this, as Simon Willison points out, is that you need to keep release tags around in your SCM system, but also that you should never blindly trust any part of a system. At least it makes me wonder what surprises lurk in the Java VM or CPython.

Diablo III

Has been announced. Userfriendly pretty much hits the nail on the head.

I have to say that I'm really impressed with it. There's a project (the Ajax Toolkit Framework) in Eclipse incubation that promises to provide pretty much the same capabilities for Eclipse, but it's not there yet. ActiveState's Komodo has some good support, but it's not really free (there's a free version without debugging support).

The only problem left now is that Netbeans' is missing a widely advertised Python plug-in, so I don't know if good Python support is available, but if it is, then it would be enough reason to leave Eclipse+Pydev behind. I'll try JPyDbg and see if I get anywhere.

One more reason to support Obama for America: he wants to build a database that lets every citizen, every news outlet and anyone else track every dollar that goes through congress. Well, of course, it probably would miss a huge chunk of "secret money", but it would be a step in the right direction.

Germany is currently missing from the report, though.

This is one area where direct access means: having access to a lot of information that falls through the cracks, because CNN would never report on it, or the New York Times would never print it. It seems that we have again stumbled upon something that can be disintermediated by the internet. I, for one, would love to hear the spin that the campaigns put on recent events without the additional spin and filters that the main-stream media put on it when they decide what to report. Simply because I

• care a lot about politics and

• more importantly: it's an area where in my opinion the media has time and again proven that they don't serve society in any kind of meaningful way besides dumbing down the process

In particular, listening to the one recording from the Clinton campaign that Dave has put online so far, the key difference is that the campaign perceives the journalists as intelligent people and talk to them like they are. What a huge change to their normal mode of communication that is. I'm anxious to hear the new recordings that Dave put up on Pownce today (no need to check, though, they're private items). He also said that there will be a public RSS feed with enclosures soon, because he found a media partner that will provide the recordings.

I hope! I sincerely hope that something similar can be established in Germany in time for the next elections. I would have loved to have this kind of information back in 2005 when Angela Merkel became chancellor.

• maurusnet_geoip_amazon

  A plug-in that helps to embed Amazon partner links into your site by using MaxMind's GeoIP database to find the right Amazon site (country-wise) for your user.

• maurusnet_archive_widget

  A plug-in that makes Wordpress' default "Archives" sidebar widget more accessible by putting it in a <form>-tag and making it work if JavaScript is disabled. You can see this plug-in in action right next to this post under "Archives"

I hope you find these helpful. If you use them, feel free to drop me a line, or a comment on the plug-in's page. I'd appreciate it.

Also, don't forget that the sourcecode of my bookmark search engine is also available on its help page

Of course, I don't have nearly as much material on Java and Python like I had on PHP, but you never know, perhaps I'll even receive a few suggestions :-).

While Django-0.96.1, the current stable version, has no real integrated Unicode support, the Unicode-branch was merged into Trunk on the July, 4^th 2008 in changeset 5609. With that patch Django gained full Unicode support and it also is finally possible to use legacy databases. There's an ongoing discussion about allowing UTF-8 characters in usernames on the developer mailing-list in Django's authentication. Also a lot of "general functionality that's necessary for a real website"-patches have become available over the 12 months:

• FileFields and ImageFields now work as expected in newforms since changeset 5819

• There's a pretty stable patch for large file uploads available that passes all tests, but has not been committed yet in ticket 2070

The newforms-admin branch that aims to align Django's excellent administration application with the newforms library tracks Trunk pretty closely and Michael Trier has a screencast that shows how to convert an application to newforms-admin, so that might also be a good place to start if you want to use the newforms-admin application.

The GeoDjango branch that integrates Django's ORM with GIS support also seems to have become quite stable and was recently featured on the excellent This Week In Django podcast #8. This Podcast by Michael Trier has replaced the "This week in Django"-posts on the Django weblog. I liked "reading the news" better, but Michael does an excellent job, so tracking this Podcast is important if you're serious about using Django!

So there you have it :-), things have come a long way since 2006. Even more information can be found in the excellent (and freely available) Django book.

How do I forward emails from an account and change the envelope sender?

If you want to forward bob@test.com's emails to alice@example.com, you just put "alice@example.com" into /home/bob/.qmail and /home/bob/.qmail-default and that's it, right?

A small cave-at of this technique is that it retains the original email's envelope sender. So Bob's email addresses (bob and bob-ext) are now permanently redirected to Alice, but if someone still sends mail from Bob's email-account, Alice might receive a bounce. If that happens the forwarding might break, because in qmail's case, the envelope sender will be "#@[]" (a null-envelope sender is explicitly allowed in RFC 2821, it was intended for bounces and such). However, simple spam-checkers, like the MFCHECK-patch for qmail, will refuse envelope senders without a valid MX record. So the bounce will never get through to Alice.

As it turns out, you can avoid qmail-local's forwarding in a .qmail file and pipe the message directly into qmail-inject, providing an explicit envelope sender using the QMAILSUSER and QMAILSDOMAIN environment variables like this:

|env QMAILSUSER='forward' QMAILSDOMAIN='test.com' \
   /var/qmail/bin/qmail-inject -a alice@example.com

The "-a" parameter is important, because it prevents qmail-inject from resending the forwarded mail to everybody listed in the email's "To:", "Cc:" and "Bcc:" headers. By using "-a" the email will only be sent to Alice.

Usually qmail-local would put the forwarded mail directly into the queue again, by bypassing this and going through qmail-inject we get more control over that process.

My qmail recipes:

03/02/2008: The second recipe is online here: Integrating qmail with nixspam and spamassassin