OpenRoad acquires creative agency Mod7

Photo of OpenRoad+mod7 logos in white

Today is a big day for OpenRoad. I am excited to announce our acquisition of Mod7 Communications Inc. We've partnered with Mod7 on many projects over the years and now they're part of the OpenRoad team. You could say that we've been dating for a long time, and now it's time to get married.

Wil Arndt will be joining OpenRoad as our new Creative Director. I've known Wil for many years and have worked alongside him on projects for clients such as Pokémon, The World Bank, Electronic Arts, and TReO. There are very few people that bring together a great sense of design, the ability to articulate a creative vision, and empathy for the user like he can.

For OpenRoad, this means we now have a lot more creative brain power. We can now provide a complete end-to-end experience, covering all aspects of strategy, user experience, visual design, development, and ongoing continuous improvement under one roof. This means digital experiences that are well built, easy to use, and visually stunning. It also means we have more awards than we know what to do with (seriously - over 150! Where are we going to put them all?)

For ThoughtFarmer it means an increased focus on visual design for our clients. Beautiful intranets are just as important as compelling public websites and this will allow us to improve the product and continue to deliver stunning custom designs for our clients.

Please join me in welcoming our new Creative Director Wil Arndt, designer Daryl Claudio and developer Tyler Egeto. I have the utmost respect for the business and the team Wil has built, and I can't wait to see what we can accomplish together. I'm looking forward to introducing you to Wil and his team and letting you see them in action on your next project.

Here's to the future!

Darren Gibbons, President

Read more about our story

Six tips to minimize web security vulnerabilities

2013 has been a tough year already for security vulnerabilities with two high-profile web application development frameworks hit by remote code execution attacks.

On January 8, a remote code execution vulnerability in the Ruby on Rails framework was posted. Last week, a vulnerability was posted for the Java-based Spring Framework. The Spring Framework issue is less severe than the Ruby on Rails exploit because it is not present in the current (3.1) release of Spring. However, it does impact the previous versions of Spring, which are still used by many projects.

As attacks go, remote code execution is one of the worst type of attacks; it allows for malicious users to potentially take over your server. Impacts of the hack could include the theft of customer data (including credit cards) and the use of your server for malicious purposes.

Further increasing the impact of the vulnerability, the Ruby on Rails hack was "weaponized" by integrating it into the Metasploit vulnerability scanner. Metasploit provides a simple point and click interface for finding and potentially exploiting vulnerable systems.

If you're not using Java or Ruby, it's tempting to ignore these types of reports and carry on. This is the digital equivalent of whistling past the graveyard. However, if you are managing systems that are connected to the Internet (regardless of technology), you must have an approach in place to ensure these issues are caught and resolved as quickly as possible.

What can you do?

  1. Educate yourself. Keep on top of security vulnerabilities. The National Vulnerability Database is the canonical source of all software vulnerabilities.
  2. Have a maintenance plan. Make sure you have the budget and staff to keep the servers up to date in case a vulnerability comes out. If a 0-day hack came out tomorrow, who will fix it.
  3. Audit your network. Still have an ancient copy of Redmine you were evaluating running on a server? Time to shut it down or upgrade it.
  4. Minimize the impact. If your server was compromised, what is the impact? By hardening the server, you can reduce the impact of security breaches by minimizing the capabilities of a compromised system.
  5. Use automated security scanners. Metasploit is just as useful for IT admins as for malicious hackers or drive-by bots when it comes to finding vulnerable systems on your network.
  6. Move to the cloud. Rather than hosting the service yourself, offload the headaches to someone else. When evaluating providers, make sure they have a security plan in place and review it.

Bottom line: No technology stack is perfect, all will have security vulnerabilities sooner or later. However, with the right plans in place, you can sleep a little easier.

Further Reading:

Designing interoperable web services

Lawrence Chan and Jeff Pennal recently spoke at the Vancouver Tech Fest on Designing Interoperable Web Services. This year's event was the first ever, and given the great turnout I'm sure it will continue in the future.

Here are Lawrence and Jeff's slides:

View more presentations from dgibbons.

Thanks to Medhat for inviting us out as well as the rest of the TechFest team for putting on a great event.

AOL search privacy breach

On August 6th, AOL Research released the raw search logs of over 650,000 AOL users from a three month period. The data was released ostensibly for research purposes, but the privacy breach in releasing the data has been the main story. While the data was "anonymized" by replacing usernames with numeric ids, it is still possible to determine the identity of a user by reviewing the terms they searched, as the New York Times demonstrated.

AOL quickly pulled the data, but not before many users had downloaded it and made it available in both the original format as well as an easy to use web interface. It's more than a little bit strange to be viewing other people's search results—some are humourous, some are sad, and not surprisingly, some are quite disturbing.

Needless to say, the fallout has been significant. AOL apologized, two of the researches were fired and the CTO of AOL stepped down last week.

In the aftermath of this release, more people are realizing the risks involved in the massive amounts of data they reveal about themselves when they perform seemingly anonymous activities such as searching and browsing the Internet. Google logs your searches and your browsing history, as well as your email, your instant messaging and your photos. Google's even made rumblings that their long term goal is to store all your data. Combine this with government requests for access to search information and it's not hard to understand the concerns of privacy advocates when they speak of the risks involved in collecting this massive amount of information in one spot.

John Battelle, in his book titled "The Search" coins the term "Database of Intentions" to describe these risks:

"The Database of Intentions is simply this: the aggregate results of every search ever entered, every result list ever tendered, and every path taken as a result... Taken together this information represents a real-time history of post-Web culture—a massive clickstream database of desires, needs, wants, and preferences that can be discovered, subpoenaed, archived, tracked and exploited for all sorts of ends."

So what can be done, as users, to reduce our footprints in this massive database?

There are a number of tools that can be used, including the GoogleAnon bookmarklet to anonymize your Google cookie, as well TrackMeNot, a Firefox extension that periodically issues random queries with fake data in the background.

Ultimately it's important to remember that the information we enter into search boxes is not anonymous, and not only is it being logged, it is also being transmitted unencrypted across the Internet.

Canada on Rails

A couple of us attended the sold out Canada on Rails last week, the first ever Ruby on Rails conference. It was a good conference, and I was surprised to see how far people had come for a relatively small event.

The conference was two days long, and most of the core Ruby on Rails luminaries were there, including script.aculo.us and RJS author Thomas Fuchs, MeasureMap co-architect Michael Buffington, and of course David Heinemeier Hansson, the author of Ruby on Rails himself. BCIT was a bit tight for a conference of this size—the keynote was overcrowded and the ventilation was having trouble keeping up with that many Ruby hackers in one spot.

For the uninitiated, Ruby on Rails (RoR) is an Open Source web application framework, originally developed by 37Signals for their Basecamp product. It uses the Ruby dynamic scripting language, and has solid support for the AJAX techniques that are popular with the so-called "Web 2.0" sites.

RoR follows the Model-View-Controller (MVC) architecture. In this aspect, it is similar to many other web development frameworks such as Struts, but it has a strong emphasis on handling infrastructure components auto-magically, allowing developers to focus on the core business logic, rather than the plumbing required to support the application.

While nearly every web development framework has this as its goal, Ruby on Rails actually does a good job of turning it into reality. The combination of a dynamic, object-oriented scripting language (Ruby) and a flexible object-relational database layer (ActiveRecord) allows developers to quickly put together web applications. While there's no such thing as a silver bullet, that hasn't stopped a lot of people from making impressive productivity claims.

We've done a couple of in-house projects using Ruby on Rails and are currently working on a client project, and I like what I see. We're not going to become an all Ruby shop overnight, but this is a useful tool for projects that fall into RoR's sweet spot.

Regardless of the platform you develop with, Ruby on Rails is definitely worth watching closely. It's clear that RoR's mantra of Don't Repeat Yourself and Convention over Configuration has won a lot of converts, and given the way that new techniques are quickly adopted you can expect to see similar approaches in future versions of web technology platforms.

Hello world!

Welcome to if/then, the OpenRoad weblog. This will be a place for us to discuss topics on software, information architecture, design and anything bright and shiny that happens to capture our attention. Watch this space!