Why I hate web developers...

Attachment 14323

Why I hate web developers.
A cautionary tale

Disclaimers:
1. Of course there are web developers who don't really follow this pattern. But there are plenty who do. And frankly, they are very likely the majority, judging from the web content.

2. This is a cautionary tale not because I somehow feel my needs are above the others. But this is a cry for common sense and for a functional web in lieu of a pretty web.

3. I don't really hate web developers. But if you happen to be like specimen AR-45/08 above, I can't answer for myself.

So anyways, I'm starting with an anecdote.

A couple of weeks ago, at Khan Academy, they decided to introduce a new video control bar that replaced the usual one that is displayed with the HTML5 player. This new control bar had the essential video playback controls; play, pause, volume control, a button to set captions on and off and another to make the video fullscreen or not. They also removed the HTML5 player controls and you could only use the new ones.

This new video control bar was introduced apparently to streamline the overall look of the page. The new controls where stylized in the same general theme of the webpage where the Khan Academy displays videos.

What obviously didn't cross their minds was how non-functional these new controls really were, compared to the default ones. Gone was the option to change the video quality format, gone was the option to see snapshots of a frame at any given point of the video. Gone was the option to decide when a video should start buffering or playing (they now played automatically and you had no idea how far ahead the buffer was at any moment in time).

For some people, these are really important features. Over here, at ~32 USD per 2GB, you bet I don't want to be watching the hundreds of Khan Academy videos in anything other than 240p. For a rough idea, a typical 5 minute video there will cost me 5 Mb at 240p, or 86Mb at 720p. And for some strange reason, google has yet to provide the WebM container they themselves developed for the 240p playback format on YouTube (they only do for 360p and above), which would further reduce the size to somewhere around 3 Mb.

And with the low bandwidth and expensive plans typical of a third-world countries derived from their almost complete lack of internet infrastructure, you should also expect slow connection speeds. So the ability to control when a video should start buffering and when it should start playing after enough buffering occurs, is also important for a good playback experience.

And no, this isn't about MY needs only. Khan Academy is an educational website with far reaching impact around the world. It is particularly helpful to exactly these type of countries where the educational system is frankly so bad, even Salman Khan with his constant mistakes, leaps of logic and a panache for explaining procedures instead of concepts, makes a better teacher than most of the poorly educated high school graduates teaching in high schools (no kidding) over here. It's developed countries that DON'T need Salman Khan, despite what Bill Gates says.

After two weeks with that pretty bar, complaints finally had them remove it. For now, Khan Academy is back at supplying the HTML5 player default controls.

----

The thing that bothers me most about the general practice of web development as it has turned out to be, is the excessive focus on form over function. Web developers simply can't seem to be able to avoid it. More often than not, if some function stands in the way of presentation, the function will be sacrificed or will be presented in such a distorted way as to become difficult to use ad lose any of its practical benefits. Rarely we can see web developers putting function over form.

It's a disease. A virus that spreads like the Spanish Flu and ends up affecting almost all web developers. They want to look at themselves as first an artist and only then a programmer. They care and boast more about some pretty effect and a nice choice of color combinations, than they will about an optimization to their bloated CSS or some new feature that breaks with the traditional format but offers an advantage to the users. In fact, breaking with the traditional format is seen as a designer sin.

The 'B' Ark is where I want to put all web developers. Douglas Adams forgot about them. I didn't.

But in all reality, it's not that I can blame them. Particularly the newcomers. Without proper guidance, they will just follow what they are told. And the matter of fact is that Web Development is largely practiced at a professional level by the undergrad. There's not much going on in terms of formal education concerning web development. Web developers working on companies or for themselves are essentially folks that knew how to use a search engine and had some time on their hands. The actual rules and best practices of design were lost to them and presented only in soundbites that often conflict with what they are being told elsewhere by some "veteran" (who knows jack about design) web developer.

And so this general ad-hoc education in web development results in folks like the Khan Academy team. Trick treaters with a penchant for the visual and futile, with very little interest in practicing proper project analysis, and so can't even distinguish heads from tails before their users actually start complaining.

I don't mean to pick at Khan Academy. This is widespread. It's in fact so bad, that many web developers who really do care to strike an healthy balance between function and form, end up having no other choice than to reluctantly give in to the pop culture of visually-oriented web development, once they get a job. And boy, is the web development world full of visual gospel! I still laugh (or cringe, depending on the day) at the discussions of what is the ideal number of words per line.

----

So, hmm... right. This post had a point, other than just ranting. I can't recall anymore. Maybe it was... DON'T DO IT!

Before I read this wall of text I have to ask, does this have anything to do with my two most recently started threads?

Edit :

Okay, I read it. Phew. It's not about me.

One thing that I even found myself doing before Elysia slapped it out of me was, AJAX goes everywhere! I kind of felt like Oprah, talking to each web page I would design, repeatedly shouting to each one, "And you get some AJAX! And you get some AJAX!"

Quote:

---

Originally Posted by Mario F.

The thing that bothers me most about the general practice of web development as it has turned out to be, is the excessive focus on form over function.

---

A client is more likely to complain about your table's margin being a pixel too wide than they are about a missing feature that a lot of people would want, but they can do without. My guess is that it's so pervasive in the culture simply because it's bled in from pop culture.

Quote:

---

Why I hate web developers...

---

O_o

Who doesn't?

Quote:

---

So, hmm... right. This post had a point, other than just ranting. I can't recall anymore. Maybe it was... DON'T DO IT!

---

Maybe it was "Fashionistas shouldn't be allowed on design teams."?

Soma

Well, I would argue most of these crappy design choices are being made by the so called "UX experts" rather than your Joe Web Developer who writes JS/PHP/JSP/whatever.. Unfortunately, making a thing cute, rounded and shiny is becoming more important in the web nowadays than the functionality that thing used to represent. If only these "experts" learnt to think from the end user perspective rather than just pure aesthetics.. Another famous example of UI changes backfiring would be Slashdot beta. The audience made it very *clear* what they wanted in that case.

Quote:

---

Well, I would argue most of these crappy design choices are being made by the so called "UX experts" rather than your Joe Web Developer who writes JS/PHP/JSP/whatever.

---

O_o

I disagree. I see what you are saying, but I only blame the "UX Guru" lot for starting the trend.

All the websites throwing massive slideshow banners and infinite scrolling at every page can't afford on of the "UX Guru" lot.

The website owners are just using the flashy-first nonsense because the "UX Guru" lot give each other awards to say how awesome the design looks.

Soma

Doesn't this also apply to Desktop applications which, once their core functionality has matured, undergo weird redesign efforts that are supposed to streamline the user experience but end up being hated by productive (power) users?

I'm currently taking an edX course and they too have custom controls laid over YouTube's HTML5 player. They also don't work properly (buffering hangs when seeking manually) so I always watch the videos on YouTube directly.

Quote:

---

Doesn't this also apply to Desktop applications which, once their core functionality has matured, undergo weird redesign efforts that are supposed to streamline the user experience but end up being hated by productive (power) users?

---

O_o

I agree; the flashy-first nonsense is frustrating no matter where found.

Soma

Quote:

---

Originally Posted by Guest

Doesn't this also apply to Desktop applications which, once their core functionality has matured, undergo weird redesign efforts that are supposed to streamline the user experience but end up being hated by productive (power) users?

---

Indeed. It's only marginally better. That goes in tandem with another thread I posted here on telemetry (emphasis just for you phantom :p ). I wanted to eventually understand the value of automatic collection of usage data as a means to perceive user productiveness, since I'm a critic of this method. But I went all wrong in the way I tried to introduce the discussion and gave up on it. Maybe later.

I think that is one of the problems in the desktop world. Along with a series of highly debatable new controls and UI designs supposed to introduce better productivity, there's this terribly wrong idea that you get better knowledge of how your program should look like by collecting usage data automatically and running some statistics on it. Gone are the days actual observation and a more close feedback with real users was the norm.

It is thus no wonder that in more critical environments, windows 2000-like controls or even console like environments are the norm.

At Fedex, for instance, at the end of the day when the plane leaves for the package collecting center (in Europe this is Paris), a Fedex representative center has between roughly 18 pm and 2 am to input into the system all outbound packages it collected that day. These can number in the tens of thousands, so a highly productive interface must be built to both input this data and validate it. By 2 am, planes from Paris will be lifting off to Fedex distribution centers across the world and so by this time all packages that arrived in Paris must have been recorded on the system(*). You wouldn't expect such a mission critical system to be coded with all the latest UI fanfarre, such as WPF. And it isn't. All Fedex data entry sub-systems are coded in highly productive console-like environments in C ( for those that have already migrated from more ancient languages). An user with standard typing skills is clocked at about 20 seconds per entry. Even the data entry subsystems that are less bound to time limitations are coded in classic UIs (windows 2000-like interfaces).

I personally always took a dim look at UI developments over the years. I honestly think we hit a sweet spot we developed what we call today the classic UI, which in addition to the console UIs really represented a boom in productivity. And since then I have seen no actual good development in productivity with the new UIs developed since then. And the proof really is the mission critical businesses that have clearly not adopted any of them.

A note also to touchscreen interfaces... these do seem to represent an important development. Unfortunately none of what we see being done seem to make them particularly attractive. Vertical positioned monitors have a tendency to tire the user quickly by forcing his arm(s) to be constantly moving. I had the opportunity to participate in an experiment when we embedded a monitor in a desk that was cut to allow it to sit on a 10 degree angle with the desk surface and the experience was fantastic. Another problem is that touchscreen interfaces tend to abuse of whatever new UI gospel you have at the moment. So no dice if you are expecting a fast productive interface. Finally, for some reason, it has became mandated that touchscreens shouldn't have keyboards. But the fact is that a keyboard tactile experience (particularly how we can feel the gaps between the keys) is one of features most responsible for the ability to fast typing and develop a more accurate muscle memory. On that experience that we ran we had a small keyboard in front of the user and the laid down touchscreen in front of the keyboard. I must say it worked wonders and the ability to fast type and take advantage of touchscreen features without that horrendous virtual keyboard was a blessing. Now... if only people cared about building good and really productive touchscreen interfaces...

Quote:

---

Finally, for some reason, it has became mandated that touchscreens shouldn't have keyboards.

---

O_o

I might honestly kill for a mobile using the design of the early offset-flips with simple slate top and a physical keyboard bellow.

The Kyocera vendor was even going to make one before they sadly went with a touchscreen for the keyboard.

Soma

Quote:

---

Originally Posted by phantomotap

I might honestly kill for a mobile using the design of the early offset-flips with simple slate top and a physical keyboard bellow.

---

I have yet to buy my first smartphone after all these years. I stubbornly cling to the past. The one thing that saddened me greatly was that right before the smartphones, the classic cellphones were becoming increasingly sophisticated. Their operating systems and the software was becoming top notch. Some of these phones are still amazingly productive and useful today. The Motorolla E1000 or the Nokia E70 were great phones that I remember and used. But they are gone. You can hardly find them anywhere, discontinued as they are. And the cellphones being done today are a mere shadow of the past; technologically much inferior. My current phone is a Nokia something. It doesn't even display it's model name unless you take the battery out. It is also a piece of crap. The only thing going for it, I only need to charge it every 5 days. But I still refuse to buy a smartphone.

There are a few keyboard smartphones. But they are crap. At least the ones I tried. Motorolla has the Droid line, but every single one of them was bad. My brother got one for himself some years back and it just broken down on him after 1 year. Maybe newer models are better, I don't know. But the brand has dropped tremendously in quality, so I wouldn't expect it. The current portable phone scenario is a complete disaster from a consumer point of view. Smartphones are of subpar quality compared to the later cellphones, have a much smaller life expectancy, their batteries get consumed at a much faster rate, they are much more expensive (you really buy cellphones today at a much higher price than you would buy a blackberry then. It's nuts, when you consider not many people had blackberries because of it) and the added connectivity and the operating systems have become disastrous from both a security and privacy point of view. It's really that in terms of portable communications we are worse today than we were in the past.

And don't tell me you can read emails on your cellphone or connect to netflix, or talk to your lover on Ashley Madison or whatever crap. We endured life pretty happily without any of those things. A desktop, a laptop, even an iPad is today always just a few minutes or hours away. Saving the rare exception, we don't really internet-ready cellphones in our lives. It's a constructed need. A false need. I manage a moderately successful business, family and friends who love me and I love them back, without a smartphone. And even if we did need it, there was nothing stopping classic cellphones to have it. They had. But in our rush to buy the new toys and make them popular, we didn't realize we were being herded towards a much worse level of quality. And we destroyed the great models of the past in favor of this crap they are selling today.

Quote:

---

But in our rush to buy the new toys and make them popular, we didn't realize we were being herded towards a much worse level of quality.

---

O_o

The dash for the bottom hits everything!

You only have to look back a few years to find a Thinkpad with incredible durability and an extremely pleasing keyboard.

I haven't replaced a now ancient laptop with a bleached screen because every keyboard feels remarkably off and the paraphernalia feels fragile even if the actual case feels solid.

*shrug*

You really shouldn't even get me started on televisions. Why in f..k do I have to patch my television to... watch television?

Soma

Mario, my 84 year old grandma just bought an iPad. Step up your game, bro.

Actually, smartphones are incredibly amazing for a few features.

PDF renderer. You can read PDFs on your phone. I literally have all my meshing research (various academic papers) on my phone at all times now. If I get bored I can just whip out my phone and start reading about how CGAL approaches parallel triangulations or how someone devised a clever order to points for mesh construction.

Check your email from anywhere. This is useful.

Navigation. Navigation apps are so amazing it's absurd. If you think a paper map is better, you're deluding yourself. The fact that you can just have an app calculate your route for you is kind of amazing. Granted, I'm the type who gets lost easily...

I guess that's about it, actually. I have some other apps for trolling Reddit and GameFAQs but that's about it. Texting is nice on a smartphone but I agree, the keyboard is horrible and my fingers are fat.

Quote:

---

PDF renderer. You can read PDFs on your phone.

---

O_o

You think a reader for PDF files is "incredibly amazing"?

o_O

I can read PDF files on my arguably ancient Nokia I keep around for demonstration.

Soma

Quote:

---

Originally Posted by MutantJohn

Mario, my 84 year old grandma just bought an iPad. Step up your game, bro.

---

I'm sure she will make a great use of it. (yes that is sarcasm)

Quote:

---

Actually, smartphones are incredibly amazing for a few features.

---

There we go...

Quote:

---

Originally Posted by MutantJohn

PDF renderer. You can read PDFs on your phone. I literally have all my meshing research (various academic papers) on my phone at all times now. If I get bored I can just whip out my phone and start reading about how CGAL approaches parallel triangulations or how someone devised a clever order to points for mesh construction.

---

You should also try a Playboy subscription. Less boring.
I do all my PDF reading on a mini tablet that cost me the amazing price of just 90 USD. The screen is bigger, I can actually read and don't have to zoom in and keep dragging my finger inside a single page to read it. So your apparent habit of reading technical papers on your smartphone is actually something I laugh at. Your first amazing feature isn't convincing. Moving on...

Quote:

---

Originally Posted by MutantJohn

Check your email from anywhere. This is useful.

---

I can check emails on my non smart cellphone. So, this amazing feature isn't cutting it either...

But by the way, exactly what use do you make of your email that makes it useful to read it at any moment and at any time? One of the things that we have been witnessing over the years, wth all this crap about social web is that the email is a dying species. It mostly serves as a means to get notifications when your boring facebook friends post new boring pictures of them wearing a new set of boring clothes. Communications are otherwise being primarily conducted through the social web. Even I who conduct a business, rarely have a need to be notified in real-time of some email. And I'm one of the rare few that still uses it, other than business, to actually talk with people (being that I don't use the social media).

Quote:

---

Originally Posted by MutantJohn

Navigation. Navigation apps are so amazing it's absurd. If you think a paper map is better, you're deluding yourself. The fact that you can just have an app calculate your route for you is kind of amazing. Granted, I'm the type who gets lost easily...

---

ermm... I... well,.... Amazing feature number three is actually useful, because you don't have a mouth to ask for directions.

Quote:

---

Originally Posted by MutantJohn

I guess that's about it, actually.

---

I'm disappointed. I thought you were going to talk about amazing features that would justify negating all that was said before.

Apparently, I'm waaaaaaay less tough to impress than you guys XD

Granted, I had low expectations for my phone so everything it does pleasantly surprises me.

One cool thing is that you can easily port music to it and most cars now have cables that connect to external devices so you can easily use your phone to play music on long car trips. I know my gf just loves when I play such smash hits.

Also, how do you run a business without email? O_o

Do you legit conduct business with social media sites? No wonder you've been sounding so jaded lately...

Quote:

---

One cool thing is that you can easily port music to it and most cars now have cables that connect to external devices so you can easily use your phone to play music on long car trips. I know my gf just loves when I play such smash hits.

---

O_o

If you had said wireless standards, I'd probably have to give you music.

The features that let me listen to good music from the device I always have with me instead of whatever garbage happens to be on the radio without paying for internet or whatever satellite radio is available is really, really nice.

Soma

Quote:

---

Originally Posted by MutantJohn

One cool thing is that you can easily port music to it and most cars now have cables that connect to external devices so you can easily use your phone to play music on long car trips. I know my gf just loves when I play such smash hits.

---

I suppose then your car didn't come with a stereo device with an USB port where you can plug in a simple USB pen and save your phone from usage hours that will only shorten its life and of the life its battery.

Quote:

---

Originally Posted by MutantJohn

Also, how do you run a business without email? O_o

Do you legit conduct business with social media sites? No wonder you've been sounding so jaded lately...

---

Smartphones are messing with your reading skills. Must be all that tiny pdf reading.

Quote:

---

Originally Posted by phantomotap

O_o

If you had said wireless standards, I'd probably have to give you music.

The features that let me listen to good music from the device I always have with me instead of whatever garbage happens to be on the radio without paying for internet or whatever satellite radio is available is really, really nice.

Soma

---

But there's so many other amazing songs!!!

Quote:

---

Originally Posted by Mario F.

I suppose then your car didn't come with a stereo device with an USB port where you can plug in a simple USB pen and save your phone from usage hours that will only shorten its life and of the life its battery.



Smartphones are messing with your reading skills. Must be all that tiny pdf reading.

---

That's true BUT one has to remember to transport the USB to and from the car which my girlfriend and I are very prone to forgetting to do...

Quote:

---

But there's so many other amazing songs!!!

---

O_o

I know.

Soma

Quote:

---

Originally Posted by MutantJohn

Granted, I had low expectations for my phone so everything it does pleasantly surprises me.

---

Never mind my tongue in cheek replies. They aren't really meant as a way to play you down. I'm denigrating the devices instead. The quote above is where it all eventually flows to and deserves a more serious answer.

That is exactly the problem MutantJohn. Consumer expectations are at an all-time low. And what people don't realize is that no matter how good they may feel about a certain product, they are doing it from their position as a consumer. So it actually pays to remain constantly critic of it. That is what eventually drives quality up.

Starting around the early 00s, I seem to think we quickly shifted into a tech consumerist society in the span on just 5 years. The rapid massification(sp?) of processor-based gadgets, more than ever before introduced into the market the idea of technology as being at the service of the common man. The problem is that not many people really cared to properly weight in these so-called new features and advantages against what they were losing in quality and price. Consumerism is an enemy to the consumer. It lays down their defenses and it lowers their expectations.

But when you remain an eternal critic, when you are never publicly impressed and when more is never enough, you are guaranteeing a better future product. As you can understand, when you are just happy because your expectations are low, you are just contributing for a lower quality future product, even when your expectations start to increase (and they will). In the end you will only be able to blame yourself and your lack of consumer awareness.

And don't feel bad about never feeling happy with what you have and always wanting it to be better. After all, that is precisely how the companies trying to sell you a product operate. They are also always never happy with the profits they have. They will always want more.

So i'll throw your words back at you: Step up your game, bro. Be a consumer and stop being the company little (b)itch

Quote:

---

Originally Posted by phantomotap

O_o

I know.

Soma

---

This -

Quote:

---

Originally Posted by Mario F.

Step up your game, bro. Be a consumer and stop being the company little (b)itch

---

And this just had me laughing. Oh my God. My Saturday was just made lol.

Quote:

---

This - And this just had me laughing. Oh my God. My Saturday was just made lol.

---

>_<

I don't know why you are laughing.

The songs examination of the ideas presented in the book is a very serious subject.

Soma

Quote:

---

Originally Posted by MutantJohn

Mario, my 84 year old grandma just bought an iPad. Step up your game, bro.

---

Then your grandma just wasted a ton of money on a useless device.

Quote:

---

Originally Posted by Mario F.

The thing that bothers me most about the general practice of web development as it has turned out to be, is the excessive focus on form over function. Web developers simply can't seem to be able to avoid it. More often than not, if some function stands in the way of presentation, the function will be sacrificed or will be presented in such a distorted way as to become difficult to use ad lose any of its practical benefits.

---

Well, the web has always been mainly about *presenting* information in a most pleasant way. Okay, not *always*, but definitely since the late 1990s. And it's always been trying to achieve so by exploring every dead end you can think of (animated GIFs, anyone?). Go out on the streets and ask people randomly about the profession title of the guys that make web pages. Count how many times they will answer your question with the term 'web designer', and how many times they will give you the term 'web developer'. The vast majority will use the term 'web designer', and even those who know both will probably not even be aware of the difference.

Quote:

---

Originally Posted by spaghetticode

The vast majority will use the term 'web designer', and even those who know both will probably not even be aware of the difference.

---

It doesn't really matter what people say on the streets when I ask them about web developers or designers. Just the other day I was trying to convince MutantJohn that here is no such thing as Data Scientists. That's a stupid name for Statisticians. What matters is what people really do. And the fact we may conform to some notion that web programming has to become a fashion business because web designers, only serves to underlie the fact we will keep progressing away from a functional web in the name of some abstract idea of beauty, despite the fact the web is still primarily a tool and not an accessory.

They can be web designers if they want, but that's the low end of the web developer community. The type of people that don't need to even write a single line of code. Web designers are those that will decide it is time for a website overall redesign because reasons. And then will hide their complete lack of functional direction by stating the new design is better (the abstract "better"). We removed the tools bar on the right, that you have been using for the past 3 years, and moved it to the top of the screen. We believe you will like it more now.

Quote:

---

Originally Posted by MutantJohn

Apparently, I'm waaaaaaay less tough to impress than you guys XD

Granted, I had low expectations for my phone so everything it does pleasantly surprises me.

One cool thing is that you can easily port music to it and most cars now have cables that connect to external devices so you can easily use your phone to play music on long car trips. I know my gf just loves when I play such smash hits.

Also, how do you run a business without email? O_o

Do you legit conduct business with social media sites? No wonder you've been sounding so jaded lately...

---

We are just all old codgers. I think it comes from the fact that because we've been around tech for quite awhile we aren't seeing anything new or groundbreaking. Its all the same stuff repackaged in a different form. It isn't new, isn't revolutionary and definitely isn't going to further us along. IMO mobile has stagnated us while we concentrate on making a mobile device do what a PC already can while also removing attention from the one platform that can launch us into the future.

I just bought a smartphone and I have to say I'm not impressed. Sure it does this or that and blah blah blah but in the end its just an over hyped phone. It calls people and they call me on it. I will never look at it any different than that. Perhaps I'm showing my age or perhaps I'm frustrated with the stagnation that has entered into tech.

And touchscreens. Yeah those are smart. Stupid things are so imprecise, buttons are too small for my fingers and the UI for the keyboards is simply awful. The worst UI design ever purported upon a consumer. Good designs make complex things simple not the other way around.

And yeah the last thing I want anyone doing at my desk is touching my screen. Hands off. Use the keyboard and mouse please. :)

Quote:

---

Originally Posted by VirtualAce

And touchscreens. Yeah those are smart. Stupid things are so imprecise, buttons are too small for my fingers and the UI for the keyboards is simply awful. The worst UI design ever purported upon a consumer. Good designs make complex things simple not the other way around.

And yeah the last thing I want anyone doing at my desk is touching my screen. Hands off. Use the keyboard and mouse please. http://im.cprogramming.com/images/smilies/smile.png

---

I used to like the idea of touch-screens, but the reality is they are impossible to keep clean, and work about as well as a laptop touch-pad. The only time I've ever bought a touch-screen on purpose was when setting up a laptop for one of my nephews, but that's because he's too young to read still.

In fact I don't think any of the fancy new input devices can beat a mouse and keyboard. Touch devices tend to be error prone unless you shut off half of the features like tapping and whatnot (IMO). Also game controllers that are experimenting with new input methods like motion controls are becoming ridiculously expensive just to make a few gimmicks available to game developers. Still, these things might have a place, like for instance on phones or maybe for certain types of disabilities they can make it easier to interact, I just don't consider most of the new stuff general purpose.

I was stunned to see the title at first but personally, it makes sense.

It's true though. I did receive some awesome code from the PHP forums (I call it "awesome" lol) and while there were some kinks to work out, the poster had clearly spent a good amount of time styling the page. In fact, on a per-line basis, I think there was more CSS than there was PHP.

I'm awful at styling though so maybe I'm biased but that just seems weird. So much CSS...

Also while I'm here, you guys know what's a good way to stop brute force hacking attempts for login systems?

I realized I was being silly by printing whether or not a username or password was incorrect but I caught myself and changed it to "Username/password are incorrect" but now I'm just wondering, what's a good way to stop a constant stream of attempts?

I actually thought back to this site and how it gives you 5 tries before you have to wait 15 minutes. I think I want to do this. I figure I can just use a database to store the IP address and time of the attempt and if there are more than 5 entries, block that IP for 15 minutes. I guess the hacker would then have to mask their IP somehow but I think I saw something about seeing if an address was forwarded through a proxy using PHP so I'm not sure if I can get even more sophisticated...

Use exponential backoff for that user. If the user gets the password wrong X times, wait for N minutes. If the user gets the password wrong X + Y times, wait for N + M minutes, and so on. If the user gets it wrong too many times, require manual unlocking via customer service. 'Course, this annoys people, so use with care.

You might want to extend it to blocking by IP too if some IP is trying a lot of different user combinations. Problem with that is basically that you might be under a DDoS attack and they're not easy to protect against.

Quote:

---

Originally Posted by MutantJohn

I'm awful at styling though so maybe I'm biased but that just seems weird. So much CSS...

---

Well, in all fairness CSS biggest power comes from its user-defined classes feature. And that requires you to tag your HTML with their names. Inline CSS however is a no-no, despite so many people still thinking it is a good idea.

Quote:

---

Originally Posted by MutantJohn

I realized I was being silly by printing whether or not a username or password was incorrect

---

If you are referring to the last code you posted, there was nothing wrong with it other than perhaps an excessive use of if-else statements. You could have probably set default values for some of those variables and avoid the if/else clutter. PHP is already a burden to maintain without you adding more code to it unnecessarily.

But in any case you were setting a new user account, not having the user log in. So there is nothing wrong with telling the users exactly what was their input errors.

Quote:

---

Originally Posted by MutantJohn

I actually thought back to this site and how it gives you 5 tries before you have to wait 15 minutes.

---

You don't actually need to complicate the life of your users because of security. And let this be your first lesson in security: It shouldn't come at the expense of the user or the UI.

3 or 5 seconds between subsequent attempts after the third is enough to defeat any brute force attack even on an offline application login form. Those 3 seconds will remove any chance of a malicious person running thousands of combinations per second over the web, which is the only way a brute-force attack can be reasonably expected to succeed.

But other methods include sending an email to the account owner after X failed attempts with a reactivation code. The account will stay otherwise disabled. Or employing a good captcha (they weren't designed exactly for this task, but they will work nicely for this too). Apache offers some options too in ModSecurity, but it essentially amounts to the same strategy of temporarily disabling or delaying further login attempts.

Also of note, by protecting yourself against DDoS you will be in fact also removing any chance of a brute force attack on your stored accounts (through the web interface only). So research also DDoS protection methods.

Quote:

---

If you are referring to the last code you posted, there was nothing wrong with it other than perhaps an excessive use of if-else statements. You could have probably set default values for some of those variables and avoid the if/else clutter. PHP is already a burden to maintain without you adding more code to it unnecessarily.

---

Interesting. How would you have rewritten it?

Also, I am not talking about the code I last posted. Now that I have registration functionality, it's time to add login functionality so I created a small login script.

I figured, it'd be best to just use the $_SESSION variable.

I'm trying to secure my sessions with some code like this :

Code:

---

define( "SECURE", false ); // no HTTPS for me!

function sec_session_start()
{
    $session_name = "sec_session_id"; // I'm not entirely sure how this helps, but it's whatever, right? XD


    $secure = SECURE;
    $httponly = true;


    ini_set( "session.use_only_cookies", 1 );


    $params = session_get_cookie_params();
    session_set_cookie_params( $params[ "lifetime" ],
                              $params[ "path" ],
                              $params[ "domain" ],
                              $secure,
                              $httponly );


    session_name( $session_name );
    session_start();
    session_regenerate_id( true );
}

---

And my login script does all the basic database querying and checking and I windup just doing this :

Code:

---

$_SESSION[ "username" ] = $username;

---

This is all I really need. All data is associated with just the user. I know I need to create a logout script and a timeout functionality as well.

Not gonna lie, frameworks are starting to look really attractive now...

Quote:

---

Originally Posted by MutantJohn

It's true though. I did receive some awesome code from the PHP forums (I call it "awesome" lol) and while there were some kinks to work out, the poster had clearly spent a good amount of time styling the page. In fact, on a per-line basis, I think there was more CSS than there was PHP.

I'm awful at styling though so maybe I'm biased but that just seems weird. So much CSS...

---

It's not really that unusual. Markup defines content, and CSS describes presentation. A lot of web development is presentation, and CSS is a lot better than trying to use various HTML layout and styling tools.

Quote:

---

Originally Posted by Cat

It's not really that unusual. Markup defines content, and CSS describes presentation. A lot of web development is presentation, and CSS is a lot better than trying to use various HTML layout and styling tools.

---

Oh, of course. Presentation is incredibly important. But for me, I prefer to develop from form to function. During development, it's all pure markup and sever-side code. Once that's done and working as it should, yes, it's time to style.

But I think what Mario hates (and I do too to a lesser extent) is the desire to put CSS before PHP, for example. I actually caught a few errors in the code that I was given which is fine (I mean, they're coding for free, right?) but it was clear that if half the effort they put into CSS was put into double-checking their PHP, there wouldn't have been any mistakes or at least, any obvious ones.

I always figured I'd just hire someone to do the CSS lol.