Take this clip as an example:

WebM (94KB) & H.264 (141KB) Video

Animated GIF (1741KB)

The fancy HTML video loads in a fraction of the time, and plays more smoothly. Note that, in this example, there’s no quality difference because I converted an existing GIF into a video. (This is the same process GfyCat uses.)

This is a pretty big deal in a world with slow connection speeds and puny cellular data caps. Watching about a thousand GIFs the size of this one (which is fairly modest as far as GIF file sizes ago) would easily put you over a 2GB data cap.

If you’re interested in converting GIFs to a proper image format, I made a fun command-line tool called GIFnuke. You can run it on a file, or a URL, and it will use ffmpeg to produce a tiny WebM file automatically. (No MP4 version yet, you’ll have to do that manually if you need it.)

How it Works

SSL/TLS, the encryption protocol commonly used for securing traffic between web browsers and servers, has a feature called a “heartbeat.” Every now and then, an exchange like this happens between the client and the server:

Client: You still there? If so, send back “ALIVE,” which is five characters.

Server: ALIVE

If the heartbeat succeeds, the connection stays open. This keeps happening, over and over, with a different value being passed each time.

Now here’s what happens if someone exploits the Heartbleed bug:

Client: You still there? If so, send back “KITTEN,” which is 300 characters.

Server: KITTEN, and here’s a block of random memory from RAM!

In this manner, an attacker can get a random 64KB chunk of data from memory every time a heartbeat is sent, thanks to a lack of validation of the length parameter. (So an attacker can just repeatedly make attempts.) Eventually, they’d get lucky and find something interesting. Such as the SSL certificate or users’ passwords and data.

Exploiting this bug is trivial. (There were people posting scripts to test for the vulnerability minutes after it was announced. Just imagine how quickly malicious types got to work implementing exploits for the bug!) It’s also possible that someone knew about it months or even a couple years ago, and has been exploiting it ever since. Bloomberg even suggests that the NSA has known about it for two years, and has been exploiting it rather than disclosing the problem.

Is it Fixed?

Yes! Your Linux distro should already have patched builds in their package manager, so it’s just a simple manner of running a couple of commands to update your openssl and libssl1.0.0 packages, then restarting any services that depend on SSL. (Or just do a full reboot if you’re paranoid.) In the case of Ubuntu, you’d just do something like this to update the packages:

sudo apt-get update
sudo apt-get dist-upgrade

You should now revoke any SSL certificates and issue new ones, in case they were leaked in an exploit of the bug.

What Should I Do, as a User?

Change your passwords! For anything important—email, banking, etc.—you should consider picking a new password.

The commands to know are:

• q — Start or stop macro recording. When starting, it should be used with a letter from a to z, which is the register it will record into. (So you can have more than one macro in memory at once.) The command is used singularly to end recording.
• @ — Play back the macro. Use it in the form of @a to play the macro in register a.
• @@ — Play the last-played macro again.

Rather than explain it in textual form, I recorded a short screencast that illustrates the basics of using macros in vim.

With this update out of the way, we’re one closer to seeing the plugin API. That’s currently scheduled for version 0.5 (to be released sometime this spring).

The ability to extend Ghost is, in my opinion, what will make it a truly excellent platform. I really like the editor—which is reason enough to start using Ghost—but I can’t switch any of my sites over (not even my personal blog) until it’s possible for me to add in some features Ghost is missing. I do a bit of linkblogging on my personal blog (Daring Fireball style, with headlines that link to external sites), and Ghost doesn’t offer the ability to do that out of the box. I also have a couple posts on the blog that feature image galleries, originally with WordPress and later through my Jekyll plugin.

The book makes the assumption that you’re already somewhat familiar with programming and the JavaScript language in particular. Instead of wasting time with absolute basics, it dives right in to Node. The first two chapters explain what exactly Node is, and how the the event loop works. It covers the differences between synchronous and asynchronous tasks, illustrating the reason you want to avoid blocking I/O. The next two chapters deal with sockets, serializing data and message queues. Other sections deal with databases (using CouchDB as an example), unit tests, building and consuming RESTful APIs and single-page web apps.

If you work your way through the examples in the book, you’ll end up building a reasonably complex web app and batch-importing a bunch of data from Project Gutenberg.

Node.js the Right Way is the best introduction to Node that I’ve seen so far. It’s concise enough it won’t take up a lot of your time, covers things more thorougly than a 500-word blog post or hour-long screencast, and there’s no magic “just copy and paste this, I’m not going to bother explaining it.” You should come out of it knowing where to go to keep learning. It’s easy enough to think “I used Express for this, and Grunt for that. Maybe I should search for more information about those tools.”

What sort of arguments does it support? The most common are probably ! and i, which reverse the sort order and ignore case, respectively. It supports some more advanced pattern-matching stuff, but I haven’t had cause to experiment with it yet.

<p>The most famous keyboard shortcut is probably <kbd>ctrl</kbd>+<kbd>alt</kbd>+<kbd>del</kbd>.</p>

The browser (by default) renders the kbd tags in a monotype font, just like code and pre. But if you’re already going to mark up keys like that for semantic reasons, why not apply a little styling and make it fancy? (I’ve seen a few sites do this, Stack Overflow being one of them.)

kbd {
	display: inline-block;
	border: 1px solid #ccc;
	border-radius: 3px;
	padding: 0.1em 0.5em;
	margin: 0 0.2em;
	box-shadow: 0 1px 0px rgba(0, 0, 0, 0.2), 0 0 0 2px #ffffff inset;
	background-color: #f7f7f7;
}

While the tag isn’t solely meant for this use case—it can also be used for any user input, such as something you intend the reader to search on Google—I think it’s a great use. The code element tends to be used for the latter case more often, whether it’s considered appropriate or not, so styling it like so shouldn’t get in the way in most cases.

If you have need to display keyboard shortcuts periodically, it’s definitely a nice touch.

To install it on OS X, with Homebrew:

brew install tree

On Ubuntu/Debian, or other Linux distros that use Debian packages:

apt-get install tree

To use it, just navigate to a directory and type tree. It has various options (visible with tree --help), so you can limit how many levels down it will go, exclude items that match a pattern, adjust sorting, etc.. You get a spiffy diagram that looks something like this:

.
├── application.rb
├── boot.rb
├── database.yml
├── environment.rb
├── environments
│   ├── development.rb
│   ├── production.rb
│   └── test.rb
├── initializers
│   ├── backtrace_silencers.rb
│   ├── filter_parameter_logging.rb
│   ├── inflections.rb
│   ├── mime_types.rb
│   ├── secret_token.rb
│   ├── session_store.rb
│   └── wrap_parameters.rb
├── locales
│   └── en.yml
└── routes.rb

Is that cool or what? This should be quite useful for writing tutorials, since a plain-text directory tree is more accessible than a screenshot of a file manager window.

It also includes a templating system that makes it possible to allow the addition and editing of items, a pagination plugin, and a plugin that adds fuzzy search. (Also, they get bonus points for using characters from The Secret of Monkey Island as an example.)

The script looks very promising, though there is one caveat about the file size claim: the minified version is 5kb when served with gzip compression. If, for whatever reason, your server is not configured to do so, then it’s more to the order of 15kb. Still small, but not quite as amazingly so.

List.js [listjs.com]