In my talk, I am looking at two math problems from Project Euler. For each of them, I am contrasting an intuitive solution with one that is, arguably, faster/better/uses less memory. But is it actually a better solution and an optimization worth spending time and effort on?

Check it out and let me know what you think!

Download video as MP4, WebM, or Ogg.

Twitter published yesterday that they are now capable of reactively blocking certain tweets for the users from certain countries only, should they be required to censor certain content in one country but not others. Previously, they were only able to remove tweets globally, whether or not certain content was illegal in all affected countries or not. As an example, they mention tweets promoting Nazism, which is illegal in Germany and France.

Mark Gibbs at forbes.com smells the opportunity for outrage and paints a grim vision of proactive, automated censorship at Twitter, and he even announces the beginning of the end of Twitter itself. Sadly, the article teems with outrageous yet wrong claims:

For example, Gibbs states that Twitter was considering, let alone be forced, to employ preventive, automated censorship using fuzzy statistical algorithms. This is in no way backed by the original source he’s commenting on nor the laws that spawned this in the first place. For instance, while denying the Holocaust is illegal in most of Europe and many other countries across the globe, pre-censorship is usually illegal, in Germany even unconstitutional. Only “post-censorship” (i.e., keeping an existing publication from being distributed after the fact) is, by way of court order, legal — much like in many other countries including the US.

This and only this way of reacting to illegal content after the fact is what Twitter claims to be able to do in their press release. To be more precise: Twitter was already required to follow the laws in the countries it operates in. I am not aware of a case when this might have previously happened, but if they were required to remove an incendiary tweet previously, they would have to delete it globally due to technical restrictions, not only in the area where a law was being violated — only now, Twitter will not have to settle for the lowest common denominator anymore. Arguably, that’s an improvement.

That said, I am as sensitive to the dangers to freedom of speech as the next guy, and I am a passionate opponent of certain legislation in my home country. Any sort of censorship, whether it may be deemed legitimate or not, is a restriction of free speech and bears the potential for abuse. Consequently, the biggest problem here is not the removal of tweets that directly violate laws protecting the democratic order of certain countries–our biggest worry, instead, should be the Chilling Effect this may cause (Chilling Effect, or “the scissors in the head” as it was termed over a century earlier in the 1840s in Germany, refers to the preemptive self-muting by a person fearing punishment when expressing their opinion). Therefore, I am quite happy that Twitter (along with Google and others) is publishing any block requests it receives on chillingeffects.org, thus exposing such requests to public scrutiny and political discussion.

Alex writes:

I would LOVE to see PyPI become a place that Mozilla felt confident it could use to deploy Python software.

I am happy about this conversation-starter and would like to contribute some of our reasoning for using a “vendor library” over pip requirements files. I, too, am not a huge fan of the vendor library, but understand how it solves some of the problems we’ve been having with plain PyPI at Mozilla.

Let’s discuss some of our main concerns and how the vendor library solves (or does not solve) them for us.

Risky dependence on PyPI and other third-party servers

In the past, PyPI has not always been the most stable of services. Even though PyPI has been vastly improved meanwhile, not all libraries we use can be pulled from PyPI, some come from code repositories on various services. Pulling in files at deploy time from numerous places all over the Internet is a huge risk, particularly if your deployment requires downtime and you need to be done as soon as possible. In other words: A setup that doesn’t allow us to (mostly) bundle one neat package before actually performing the deployment to our servers is a huge risk we’re not willing to take lightly.

Some, but not all of this, could be mitigated with a private PyPI mirror, though that comes with a maintenance overhead and does not help for non-PyPI libraries at all.

We deploy to, potentially, many servers

Second part of the “one neat package” issue: Running pip install on one server is fun and games. On 50? Not so much. It takes a long time, even if you run it on all of them in parallel. Quite possibly, a few of them will have hiccups (network trouble, for example) in the process, so good luck finding out which ones failed and manually fixing those before moving on.

Package “migrations”

Imagine an upgrade to an already-deployed application. How do you add two libraries, remove three, and upgrade five existing ones? Installing and upgrading might work with pip, for uninstalling we’d (probably?) need to write some sort of migration script, hope it all runs smoothly on all servers, then carry on. Or we blow away the virtualenv altogether for every push and reinstall all libraries from scratch.

This is many things, none of which is elegant.

Contributors

We want it to be reasonably easy for contributors to set up our code and start developing. With the vendor library, it basically boils down to a few git commands, while pip install is a much longer process. In addition, the “migration problem” is present here too: The developer has to constantly monitor changes to the requirements files (or realize that the source of an unexpected, new error is a missing library) and run pip as appropriate. In contrast, updating the vendor library is part of the regular pull-from-git process any developer has to do anyway to stay up to date with the main repository.

Vagrant mitigates some of these concerns by automating the setup process, but not all.

Compiled packages

One thing neither PyPI nor vendor solve is the deployment of packages with binary components (usually: C libraries with a Python wrapper). For that reason, we keep those libraries to a bare minimum and prefer pure Python variants wherever feasible. The few unavoidable compiled libraries (such as Jinja2 or py-bcrypt) we deploy to our servers through RPM packages (by sticking these requirements into a common Puppet file shared by all our webservers). That’s not too elegant, but as these cases are somewhat rare, it works. In any case, a server running the actual pip command to install these packages needs to have a full compiler toolchain, which production web servers are unlikely to have.

What it boils down to

The base concerns here circle around robustness and scalability, both for deployments to real-world servers and for various, globally distributed developers.

Really, the key is minimal human involvement: We love our developers, and we love our sysadmins. Any part of a requirements system with a high chance of repeatedly requiring human involvement is broken and needs fixed.

If you have any suggestions on how to improve this setup, I am all ears. As always, Mozilla’s code and processes are Open Source so we are happy to listen to your ideas!

This is me, reading a Firefox-themed QR Code with my cell phone.

After getting the idea from this excellent blog post, I made a QR code pointing to mozilla.org/firefox, sporting a nice little Firefox logo in the middle.

For the geeks among you who would like the 411, this works because QR codes have a certain degree of redundancy for error correction. The logo in the middle is considered an “error” and thus, the rest of the code is used to puzzle together the information in the code anyway.

Try it out with your smart phone (on Android, with an app like Barcode Scanner), it really works!

My Facebook session is SSL-encrypted by default, but Words with Friends requires me to disable this encryption. This is wrong on many levels. Most notably, if I disable “secure browsing” on Facebook altogether, even only for this session, my session cookie will be sent in plain text over the wire (or worse, on Wifi, over the air). If I do this at a coffee shop or airport, this is a great invitation for every evildoer in the general vicinity to hijack my Facebook account.

While I appreciate Facebook’s transparency in the matter, I find it upsetting that companies like Zynga wouldn’t account for Facebook users on SSL. By encouraging people to access Facebook over an unencrypted connection, they are foolishly endangering user data and are demonstrating an utter disregard for user privacy.

I wish Facebook enabled SSL encryption by default, and furthermore required third party apps to be served over SSL. You can’t have it both ways: Either you don’t handle user data, then you don’t need to care about encryption. Or you do handle user data (and yes, a session cookie counts!), then you need to properly secure it. I am tired of software makers weaseling themselves out of their self-imposed responsibility.

Update: As pointed out in the comments, moving to HTTPS for apps is on Facebook’s developer roadmap. I appreciate it!

“What, Mozilla makes websites? I thought all you did was Firefox.”

It’s usually followed by a second question: “what, your websites are open source, too?”

The basic misconception here is that Firefox is Mozilla’s mission. This is not true. Mozilla’s mission is outlined, in broad strokes, in the Mozilla Manifesto, and the core of Mozilla’s mission is to make the Internet better for the users (which goes beyond the Web and includes technologies like email, for example). And we believe that the best Internet for the users is one that inherently supports openness and choice.

Now don’t get me wrong. Firefox is important. Because the Web is the most visible thing that people like you and I are using the Internet for nowadays, Firefox is our most important tool to make the Internet better for the users. But it is not enough. The Web is not television. On the Web, the users are also the producers.

And this is why Mozilla’s mission goes beyond Firefox, beyond Thunderbird, deeply into the development and privacy space. A participatory Web based on Open standards, powerful APIs, along with the inherent freedom of choice and users’ control over their own personal data are what Mozilla is all about. Apart from Firefox, don’t be surprised to see Mozilla write state-of-the art, open source web applications and developer tools, be involved in the development of various open standards and play an important role in many other spaces that are relevant to the Internet today.

Oh no! Yesterday was the first day in 85 days of “Project 365″ that I failed to take and post a picture that same day. I blame Minecraft: During the day I was busy, but usually catch up on the photo taking before the end of day. But then I gave Minecraft a shot: It’s a fantastic little game about converting a world made of blocks into something awesome (and all the while staying safe from the monsters that come out at night). I like the gameplay and how–in this xbox and PS3-saturated world of ours–it’s a game that totally pulls off the 8-bit graphics.

Apologies for the delayed post and I’ll try to be on top of it again (unless I get sucked into the game agai………

Twitter’s fail whale has a little friend, a fail robot. Not sure how the two relate to each other, but it seems the whale comes out when twitter struggles under the sheer load of tweets, while the fail robot denotes service errors not caused by load?

Now, evil tongues would claim that there’s so much fail at Twitter that a single fail pet just doesn’t do it justice… But, knowing how challenging it is to scale a service to millions of users, I wouldn’t quite dare to say so — and therefore, I welcome the poor injured robot to my fail pet collection. Quick! To the fail pet emergency room!

Thanks to jabba for taking a screenshot for me!

What’s awesome is that Tumblr actually did end up using his artwork on their error page. This is what it looks like:

Mad props to the Oatmeal and Tumblr for this stellar addition to my fail pet collection!

And thanks to michaelk for pointing it out to me!

In the wake of a little server outage here at Mozilla, here’s my version of the comic:

(Based on the above xkcd web comic. Licensed under a CC by-nc license.)