The Rob Report

2009-04-19T00:34:00.002-04:00

I've moved from this blog to my new location: Cocoaphony.

2008-07-07T17:15:00.003-04:00

Neil Mix from Pandora contacted me today about the troubles I've had with the notification system. He showed me the code they use to text the API, and using that code has fixed a ton of problems. Anything based on knowing the current track is fixed in the 0.5.2. That includes growl, console log entries and Applescript. I'll have it out shortly.

2008-06-29T22:03:00.001-04:00

I'm back into PandoraBoy development. Looks like Pandora changed something with their last UI update, and it's broken PB and maybe also Pandora.FM (who uses the same API as we do). We're just not getting events anymore from the API. So I've dropped a note to their support list and we'll see if they can help us out at all. This is why Growl is broken; Pandora doesn't know when tracks change.

2008-06-20T10:50:00.000-04:00

I move between VS and XCode a bit without shuddering or fussing, which seems to make me a strange creature. In general, shocking as it is to say on a Cocoa list, VS is actually a much more powerful environment. Most who love XCode have little used VS (at least VS2005 or later, VS.NET is clunky IMO). But learning what actually is better about VS requires using XCode for quite some time. Most of the initial complaints are simply small differences between the two; many of which I prefer the XCode way. But then, XCode is a Mac app, and I generally prefer Mac UI.

As a regular user of both, here are some advantages of VS that do not wear off when you get used to XCode:

Much deeper integration with its debugger. XCode and gdb play together, but they're not integrated the way VS is with its debugger. There are many important gdb features that can't easily be reached from XCode, and some (debugging with a core file) that you pretty much can't run XCode at all if you want to accomplish.
The multi-tab interface makes it much easier to manage moving between many files, and the debugger is better integrated with the editor. XCode encourages you to have an explosion of windows, and the debugger is inconsistently integrated with the editor. The AllInOne interface for XCode goes too far the other way and makes moving between files a real pain.
Mouse-over gives much better information in VS when editing. VS is always compiling your code, and so can give you access to information in the editor that is only available in the debugger for XCode. XCode technically also is always compiling your code (or it claims to), but it doesn't really make use of this fact.
VS is better in nearly every conceivable way if you're programming in C++. XCode hates C++. If you use wstrings in C++, XCode will actually come out of the computer and slap you around (who knows, maybe it should). I dream of being able to easily display wstrings in the debugger. Yes, I've built the formatting plugins and from time to time they even work. Probably the biggest missing feature in XCode is good code completion for C++, especially with overloads, which VS does very well.

All that said, I still much prefer to work in XCode, but mostly because I prefer coding in Cocoa to .NET (.NET is actually pretty nice, but Cocoa is nicer). Apple's help documentation for Cocoa is far superior to Microsoft's documentation for .NET (which is infuriating to work with), and getting to the help in XCode is much more effective than in VS.

So to VS guys I say: Give XCode a chance. It's better than you think once you are used to Mac interfaces and if you're working on Cocoa apps (which XCode is highly optimized for). To XCode guys I say: until you've used VS for a while, don't assume that XCode has all the features it should. In the programming editor world, XCode is still kind of primitive.

2008-05-30T09:39:00.003-04:00

A fie on useless attempts to stop hacking... At least that's my current assumption on why Microsoft did this. I'm a Cocoa guy, but I actually like .NET and hack a bit of it now and then. It's a pretty good framework, though you can see some of the seams where Microsoft didn't quite think it through when they were designing it and had to tack on later (the whole System.Text.Encoding namespace that's made up of methods that should exist on String; but then C# doesn't have ObjC-style categories so they probably also being more careful about throwing 10k methods on a single class the way Cocoa does, but I'm running off on a tangent here).

The point today is the headache that is the HttpWebRequest.Date property. What HttpWebRequest.Date property you might ask? That's right; there isn't one. It's a magical protected property that you can neither set nor meaningfully read. The system sets it for you when you make the connection and you can't do anything about it. Why? Most likely because messing with your date is a part of many kinds of attacks on web servers. But maybe they were just too lazy to implement it such that it would be automatically set only if you hadn't automatically set it. I'll assume for now that some misguided hope of improving security guided them on this. But it's a stupid approach.

The work around is to build a raw TcpClient that talks HTTP, which is a pain for legitimate developers, but not so much of a pain that it would barely slow down attackers. It's a pain if you want to talk HTTP correctly, because especially HTTP 1.1 is actually a bit tricky. But if you just want to replay a forged session, then it's not so bad.

But why would you want to screw with your date? For security reasons.... authentication in particular. I don't actually need to change my date; I just need to know what it is *before* I send the POST. When talking to Cerberus Web-API, the HTTP date header is one of the things they hash in their authentication token. That's a pretty good model; provides a decent defense against certain kinds of replay attacks. But it requires that you know exactly what time will be listed in your Date: header. If you guess using Datetime.Now, you can probably build a system that works most of the time. But if the second ticks over between the time you grab it and the time .NET assigns the Date header, you miss and don't authenticate. Classic race condition.

So I'm back to writing a full TcpClient so I can write all my headers, which isn't the end of the world, but is much more fragile and complicated than an HttpWebRequest. I'm going to have to dig into whether HTTP 1.0 will allow a Date header when talking to IIS. If it does (and it probably does because headers outside the standard are generally legal), then at least that will simplify things and I don't have to worry about GetChunked or any of the other little things you need to do to be a proper 1.1 client. As long as 1.0 will also work with virtual hosts and the Host header.... It's always something.

2008-05-25T13:13:00.003-04:00

It's been a busy few weeks for PandoraBoy... well, for PandoraBoy's mailbox. I've been incredibly busy getting my day-to-day work out for months now and have barely looked at PandoraBoy since about February. The backlog of Issues has grown to a troubling level, and it's probably another few weeks before I'll be able to get back into PB development. But in the meantime I've been amazed at how much mail I've been getting on the subject. Mostly small bugs people are running into, but then, this just in:

PandoraBoy in French. Yes, Pierre Rudloff, out of the blue, sends me a fully translated lproj. I really appreciate it. I'll make sure to get it integrated into the next release. I probably won't get started on PB development until after WWDC because of other projects, but after WWDC it's top of my list. Especially all the annoying little bugs that have been creeping in (I suspect because of some backend Pandora changes).

2008-04-04T16:31:00.002-04:00

The $10,000 Mac Hack

I recently read a comment about this hack wondering how long the author had sat on the exploit rather than reporting it to Apple. It's a very important point.

My opinion of these "security researchers" is well known: there's a difference between bird watching and research. Finding yet another buffer overflow isn't "research." Creating a new way to secure systems is research. Coming up with whole new classes of attack might be research (along the lines of bioweapon research). Those who hunt new instances of old bugs are collectors of exotic animals, weapon manufacturers, volunteer quality testers, or a half-dozen other categories that have little to do with science or research.

That said, it's not surprising that these guys would sit on the exploits they've found, and there are many lessons to be found in there. Reporting a defect to a vendor, at best, will get a terse "we'll look at it" and at worst will get federal agents at your door. There's no upside except that you might feel good about yourself and might not be punished for it. On the other hand, 0days are the currency of the underground. Even if you're just a collector, you need 0days in order to get other 0days. Every time you report one, you have less to trade.

Those who sell their services as pen testers need a cache of 0days so they can break in with undisclosed vulnerabilities when all else fails. If they disclose, then their customers' systems might actually be hard to break into and you don't look like a good pen tester. There is profit in showing you can break into systems. There's little profit in making everyone's systems safer.

Actual criminals of course aren't going to report that they've learned how to break into your system.

All of this is very important to keep in mind whenever you begin think a system is secure just because there aren't a lot of widely publicized exploits. The guys you most worry about are the least likely to tell you what they know.

2008-03-28T09:11:00.002-04:00

Researchers at the University of Illinois at Urbana-Champaign build a new browser from scratch to help keep hackers at bay.

I was incredibly skeptical from the headline. It read to me like "team builds near-useless browser that is probably a bit harder to hack than an unpatched Windows box." But it's actually an interesting architecture. I like their early consideration of plugin issue. Rather than banning plugins, sandboxing them till they can't do anything, or bemoaning that plugin writers will probably be stupid and break security but it won't be the browser's fault, these guys actually seem to have considered how to compartmentalize such that the plugin can be compromised without losing the farm. That's a good security lesson for us all. It's not about making sure nothing bad ever happens or banning everything that could ever let something bad happen. It's about making sure that when bad things do happen (and they will), that the damage is contained to the piece that was compromised. And to this feature, wow:

The UIUI team has also designed a browser-level information-flow tracking system to enable post-mortem analysis of browser-based attacks.

That's a team that "gets it." You will get hacked. Designing for what you do *after* you get hacked is a sign of great security thinking.

2008-03-08T11:23:00.004-05:00

Two posts in a day... but this was a completely different topic.

I'm beginning work on my first Leopard-only application, and so I'm trying out garbage collection. Sure, I'm excited about garbage collection. Sure, I have no great love of keeping track of my retain counts and autorelease pools. But....

It feels really, really weird to not release my variables. I tend to rely on autorelease a lot. I know there are some disadvantages, but I like the fact that it notes your intention when you allocate the memory. Consider this:

NSMenuItem *mi = [[[NSMenuItem alloc] initWithTitle:@"" action:NULL keyEquivalent:@""] autorelease];
[menu addItem:mi];

versus

NSMenuItem *mi = [[NSMenuItem alloc] initWithTitle:@"" action:NULL keyEquivalent:@""];
[menu addItem:mi];
[mi release]

It's not the extra line of code that bothers me. It's the fact that the release is separated, such that if you move the assignment of mi into another method, you have to remember to move the release as well (and and that point, you'd *have* to switch to autorelease). Remember that there can be a lot more code between the alloc and the addItem. This makes the Extract Method refactor more complicated. autorelease makes this easy, and at very small cost. Beyond that, it emphasizes at the init that I won't be holding onto this memory myself. Of course that's also implied by the use of a temporary variable, but the point remains. It also helps me find memory leaks more easily. Since I always do it this way, I know that if I've used alloc on a local variable with no autorelease, I've almost certainly got a bug.

Of course the point of this posting is that my long-developed opinions on this matter are now irrelevant. You just assign mi any old way you like and it'll get garbage collected when appropriate. Great. Easy. Who could not love that?

But I am having a very hard time getting used to not having an autorelease at the end of that initialization. There's an alloc on a local variable with no autorelease. Bug! It's hard for me even to type it; I always lead with three open brackets....

I'll get over it.

2008-03-08T10:59:00.002-05:00

It's a lazy day for me. That means I'll probably hack stuff all day.

One of my best friends in the world just sent me a note asking for a good Cocoa reference. I thought I'd pass on the same advice I gave him:

This is the book on learning Cocoa:

Cocoa Programming for Mac OS X by Aaron Hillegass

Third edition is supposed to come out this summer. I've read the proofs of the 3rd edition, and it does add some good stuff, but if you're anxious to get started, I'd get 2nd edition and get started.

I may sound like a terrible shill for Aaron, who also happens to be a very nice guy and an excellent instructor, but this really is the book on the subject. Poll any group of Cocoa developers and it'll come up over and over again either as the book they used or the book they would have used if it had existed when they started.

Do not just sit down and read this book in bed. Get our XCode and work through the projects. Even just re-typing code out of the book will teach you a lot. You'll learn how to get around XCode and how Objective-C "feels" to type. That may sound silly, but Obj-C doesn't type like other languages. The method names are very long and multi-part, so using the built-in code completion is much more useful than it may be in Java or C++.

The one problem with starting with 2nd Edition is that its written for Interface Builder 2, and 10.5 moved to IB3. You have several choices: wait for 3rd edition (don't. get started learning this week, you'll thank yourself later); download XCode 2.5 from Apple and learn using that (not a bad solution); or read the IB help, particularly "Interface Builder Workflow Tools."

Here is the one huge secret that will make things easier moving from IB2 to IB3: If you want to instantiate a custom class, the IB2 way was to go into the class browser, find the class you wanted and select "Instantiate" for it. There is no class browser in IB3, so you'll hunt forever.... The answer is to drag an NSObject or NSView from the library onto your object window (the one with "File's Owner" in it), then go to the Identity pane of the Inspector and set the Class. This is a really unintuitive way to do a very common operation. It took me ages to figure it out with my background in IB2. Yes, it makes sense, but you shouldn't have to click that much to find it.

If you have any interest in being a Cocoa programmer, go do it. A great book is available at a reasonable price. All the same tools that the professionals use are available for free with the OS. There's nothing stopping you from building little (but useful) Cocoa apps a month from now.

2008-03-05T10:03:00.003-05:00

To all you aspiring Cocoa developers....

If you want to make a private framework, you need to remember to set the install path for it to @executable_path/../Frameworks. Just copying it into your bundle isn't good enough. Otherwise your app is going to think it's in (~)/Library/Frameworks once you package it up and give it to other people.

In related news, PandoraBoy 0.5.1a is now released.

2008-03-04T22:39:00.005-05:00

Yes it is true, a new version of PandoraBoy is up, 0.5.1. I haven't put it into Sparkle yet, and probably will skip it because it only fixes a couple of things (most notably, paid accounts now work correctly). Technically there's an entire full-screen mode in there now with a plug-in architecture and public framework, but I've disabled it because it's still kind of flakey and doesn't work very well. I'm going to focus for a while instead on some of the bugs that have been reported and get those cleaned up.

Maybe I'll play with the new version of ShortcutRecorder that just came out thanks to OmniGroup's contributions (great company, great products). Hopefully I can get rid of my IB2 dependencies and finally move 100% into XCode3.

And of course I've been promising improvements in Sparkle that will help PandoraBoy a little bit, and I more deeply need for my day job. I've been mostly working on those during what I consider "day job" hours, but right now core product features are far more pressing than automatic updates. And #1 on my list: collapse the current branch back down to trunk! Ah, subversion, thou viper. Linus was right. There's no such thing as "CVS done right." But in truth, it isn't so terrible, it just isn't so good either....

2008-02-12T16:08:00.000-05:00

No, I haven't forgotten about PandoraBoy, but I have been exceedingly busy of late. Of course it comes in the middle of my work on a large feature (Full Screen plugins), so I've done a lot of PB work, but haven't made a new release. I'm about to the point of releasing what I have (which works but isn't pretty) and rolling some critical bug fixes out in the not too distant future.

2008-01-13T17:38:00.000-05:00

Well, I'm spending a little more time hacking PandoraBoy today. It now will compile under XCode3 for anyone playing along at home. I'm hoping to learn a lot this week to move things forward even more. Right now I'm here, getting ready for this. Sometimes I think I picked a good life this time.

Now if I can just get back into my home computer to get my PB todo list.... Back into full-screen mode stuff.

2008-01-08T16:49:00.000-05:00

I haven't forgotten about PandoraBoy, but I've been very busy these last couple of weeks. I'm now a full-time Mac programmer, and so I've been spending most of my time doing "real" hacking. Next week I go to Big Nerd Ranch for training, so I'll take PB with me to hack on.

I just built my first kernel extension and begun trying it out. Kernel programming is a whole different world... When it doesn't work, Gray Screen/Reboot. I'm glad that (a) OSX boots quick, and (b) I have a lot of computers...

2007-12-30T22:19:00.000-05:00

Full-screen PandoraBoy has been a major learning experience. Quartz Composer is an incredible tool, but it took me a long time to get rid of the random noise in the picture. First secret: spend some time and read through every patch available, particularly the ones in Tools. It's important to know what's available so you don't spend hours trying to reinvent the basics. And don't forget that "transparent" defaults to meaning "whatever random memory happens to be on the video card."

I'll be spend quite a bit of time trying to improve the interface for the full-screen plugins. I'm trying to make it as easy to write new full-screen modes as to write new screen savers. Once I've gotten a second full-screen plugin written, I think I'll better know how to structure the interface.

I've also finally gotten rid of an old, nagging bug where PB would fail to respond to keyboard shortcuts or Applescript. WebKit is a bit funny about plugins (i.e. Flash). I finally tracked down a weird race condition that causes hitTest: to sometimes return the Flash view and sometimes to return the view that contains the Flash view. PB was only handling the more common case, so sometimes you'd get a stray "ERROR: Could not find webNetscapePluggin" error in your logs. Hopefully that's now fixed.

Should post a 0.6 (or at least 0.6 beta) sometime after the New Year.

2007-12-24T23:18:00.000-05:00

Huge changes in PandoraBoy on the way. I'm working on full-screen mode, so you can run PandoraBoy from across the room and still see what's currently playing. Building a smooth transition from window to full-screen without interrupting playback has taken my a couple of days, but I think it's a pleasing effect. Right now it doesn't do a lot more than be a full-screen Pandora window (which isn't very exciting in itself, though much harder than it sounds), but next I'll work on a plug-in architecture to let you put various information on the bottom portion of the screen. Then it'll actually be useful.

Why is it so hard to go full-screen you may ask? Afterall, it's just a webpage. But the mini-player is a web page that assumes the window is a specific size. Getting the background gradient to look right at any size is the main problem, since there is no direct way to scale a background in CSS2. repeat-x handles left-to-right scaling, but the pandora background isn't tileable vertically. My final solution was to build an NSImageView which holds a flipped version of the Pandora background, and then placed it immediately underneath the pandora webview. It handles all vertical stretching and gives a nice darker area at the bottom rather than just fading to white.

I'll also investigate a black-screen mode with the pandora player standing with no background. I had that working at one point, but it's been hard to recreate it in a way to zooms cleanly. CSS2 and Javascript just aren't nearly as powerful as Cocoa....

If you're feeling insanely adventurous, it's all checked in on truck in subversion....

2007-12-17T22:40:00.000-05:00

PandoraBoy 0.5 is live. Go forth.

I may not get to work on PB for a few days at least. One-way call paths will be my life for a little while I suspect. Or maybe it's just USB audio input failing in some strange way... ah telephony.

2007-12-16T10:56:00.001-05:00

PB 0.5 is in my final testing. Just going to let it run a few hours before I post it on Monday. Adds station changing (finally) from menu, applescript or hotkeys. It's actually a much larger change than it looks. There was a lot of under-the-covers restructuring while I got that working.

Next plans: either investigate how to masquerade as iTunes (so that stuff that works with iTunes will transparently work with PandoraBoy), or work on some eye-candy features (full-screen mode, floating semi-transparent windows, etc.)

2007-12-15T17:53:00.000-05:00

Why is it when I want to test PandoraBoy with an album that has no artwork available, suddenly Pandora becomes so good at having every piece of artwork on every track for 7 different stations until I run out of hourly skips?

Well, at least I finally fixed that stupid "thumbs-up in the lower left of the Pandora window" bug that's been driving me crazy for so long. Check for nil returns people!

I'm still trying to understand how Pandora manages skip tracking. I'm not planning on circumventing it, I just want to mark skipped tracks in the track listing (Cmd-T). Skips don't seem to generate traffic back to the server or unique API events, so it seems that the client keeps track of skip counts. But it also seems persistent across Pandora restart, so I guess they're storing it in Flash local storage. I swear they didn't used to keep track of skips if you switched stations and then switched back, but then they also didn't used to keep track of your place in the song when you switched stations. Curiouser and curiouser.

2007-12-15T12:09:00.000-05:00

I'm switching jobs over this weekend from information security to Mac development. In the process, I'm also moving mostly to work-from-home, taking over a corner of my wife's workrooms and turning it into a decent home office/lab. In the process of copying huge files around, I think I pushed my Linksys over the edge and it stopped talking on its WAN (PPPoE) port. In my researching trying to fix it, I learned that the Westell modems that Bellsouth gives you for FastAccess are in fact full routers. And actually I'd say it's a bit nicer router than the Linksys. So project #3 in the the "get ready for new job" turned out to be "completely reorganize home network." I like the new setup, though. I can get to the Westell directly now (192.168.1.254) for diagnostics. And the Westell has a nice NAT setup system.

On the annoying front, for some reason my Microsoft Laser Mouse 6000 which has worked so well for me for so long at the office, now doesn't reliably click. Moving it works fine, it just doesn't always recognize clicking. It's driving me nuts. I'm wondering what the change is. I'm on Leopard now, which might impact it. Just not certain.

Moving over to Leopard on my primary box also meant spending a lot of time trying to get PandoraBoy happy. I've been having trouble with the Shortcut Recorder pallet for a long time now where IB won't load the pallet. I think I've finally gotten it sane again. Definitely staying on Xcode 2.5 for now. I'll wait for SR to get their Leopard IB3 support solid before I consider moving. I've had requests to get PB running on 10.3.9, and I'm not ready to try that in XCode3.

Oh, and first impressions of moving to Leopard: wow, Leopard rocks.

2007-12-07T23:22:00.000-05:00

Have I mentioned recently how much I love Cocoa? Even when I hate Cocoa, I love working in it. And things that drive me nuts (like the lack of regexes) come along in due course (Leopard). I was listening to CocoaRadio today and there was a comment along these lines. Cocoa has been evolving for about 20 years now. Much of the core is carried over from NeXT. But rather than "showing its age" it keeps showing its wisdom, and those early guys thought it out well enough that Apple hasn't had to start over again and again as Windows has with Win32 to MFC/WTL to .NET. For how unusual Objective-C is, it's a constant rather than moving between C, C++, C#, and Java as the winds blow. (And the more I program in Objective-C, the more I enjoy it.)

Tonight I added a station-changing menu to PandoraBoy. There's still a lot to add to make it really useful (hotkey support and Applescript at least), but the core's there, and it wasn't hard. It forced me to simplify a slight duplication in the object model (PandoraControl and Controller were doing almost exactly the same work so I've merged them). That cleaned up a lot of redundant code. Even after merging the two objects, Controller is under 400 lines of code, so I don't think I need to worry about splitting Controller back up some other way.

2007-12-02T22:15:00.000-05:00

More hacking on station lists tonight. So far it's been as easy as I hoped, once I created a reliable way to watch all Pandora traffic (through NSURLProtocols). The station list comes back as an XML document, and I can copy that off into an easy array for later use. The only thing I need to work more on is QuickMix management, since those are magically pulled out of the main channel list, and I should probably do the same to avoid confusion.

I've talked often with folks about XML and how there are so many good ways to compress it quite effectively and it's strange that XML developers have chosen not to do that. Rather, real XML winds up being insanely verbose and bloated on the wire. I hereby take back my earlier complaints. The fact that I can read XML by sniffing the traffic without having to apply any decoding (not even gunzip), and can recognize XML easily when I come across it, is one of the biggest boons to reverse engineering I've ever encountered. Long live human readable data formats!

2007-12-02T17:27:00.001-05:00

I knew I'd run into this when I released PandoraBoy 0.4.0, and someone ran into Issue 17. Moving from MacOS 10.4.10 to 10.4.11 included a massive change to WebKit, and the 0.4 line was meant to address this. Unfortunately I no longer had a 10.4.10 box to test against, and so I figured that something would probably break. Hope against hope, I figured everyone would have upgraded by now.

Anyway, I will now undertake a series of "did this fix it" patches and we'll see if we can get it working again. Hopefully the entire problem was my removal of decidePolicyForNewWindowAction: which never seems to be called in the new WebKit under Pandora (but I should have kept for completeness anyway). But it's possible that the problem is deeper.

2007-12-01T15:30:00.001-05:00

It's been quite a while since I've updated the Rob Report, but I have some things to chat about on the technical front. Most of my work these days is on the Mac, and my main hobby project is PandoraBoy, which will probably dominate these blog posts for a while. It's been a great project for teaching me how to deal with some interesting parts of Cocoa, while being small enough to keep my brain around.

My current project for PandoraBoy is getting control of station changing. I now have a set of proxy NSURLProtocols that I can use to eavesdrop on the Pandora traffic (rather than having to post requests like listStations twice). That's how I grab album art. I'm using it to learn much more about how Pandora talks to its server, allowing me to provide more Mac-friendly ways to send those messages. I've demonstrated now that I can send launchStationFromId messages from Cocoa, so now I just need to collect the results of listStations so I have the IDs to send. Shouldn't be hard now.

In the process, I discovered FireBug, which is just incredible. Using it, I understand Pandora's code much better and am now mulling about what I could do with all this information. But my next project will probably be talking to Airport Express (after I fix a couple of new bugs in the 0.4 line). I'm pretty close to calling this thing 1.0....

2005-07-12T09:02:00.000-04:00

Here's the picture everyone's looking for.

2002-06-12T04:06:00.000-04:00

Outlook out, Mozilla in

Well what the heck. Figured I'd start blogging these Rob Reports.

I just can't be happy with anything.... Outlook finally pissed me off enough, mainly when my great hopes for configuring things with VBA were dashed. VBA is incredibly non-orthogonal. There's all kinds of things you just can't do with it (or even with COM plugins). It's pretty obvious that Microsoft did not build Outlook on top of their own API. For an interesting list of the various things that don't work the way you would think they do see the ever incredible Slipstick from Sue Mosher.

Anyway, I wanted to get In-Reply-To headers working with Outlook, and when I realized just how much work it was going to be (though it might actually be possible), I decided I needed to go try something else. So now we're trying Mozilla. I first tried Pegasus, but I didn't like it very much. I probably shouldl like it. It is a good product. But it just didn't quite do it for me. Probably more personal preference then and even some of my mood when I was looking at it. It just didn't feel like I could bend it to my will enough. :)

Anyway, all that to say that we're trying out Mozilla now. Kind of interesting. Lots of things tick me off about it. Very hard to run from the keyboard. At least one strange bug that's bit me. But all in all, it looks somewhat promising. Seems to be reasonably standards compliant, while still being feature-rich. And if they'll ever get a perl or python binding for XPCOM pre-compiled for Windows, I might even be able to script some of it. Who knows, I might even finish getting a Mozilla build environment put together on this Win2k box and then I could build up the perl or python binding myself. I just wish I could rebind the keyboard (not sure if xpcom is going to do that for me).

Anyway, so a little about Mozilla: it would have been a lot easier had I realized that it has a built-in "convert me from Outlook" tool. Instead, I tried to take all my local mailboxes in Outlook, copy them to my work IMAP server, and then copy them back down into Mozilla. Would have been fine, if it weren't for the aforementioned bug. Oh well. Finally got through it by moving each folder into INBOX, then copying it down to the local server. Worked ok, just tedious because I have a lot of mailboxes. Luckily I never moved all my old mutt mail over to Outlook. That's over 1G compressed. I doubt it will ever move off of my Solaris box.

So now I'm trying real IMAP. Outlook hates IMAP. It fights you all over the place. The major issue is that there's no automatic way to EXPUNGE. You have to do it by hand. Blah. Mozilla OTOH loves IMAP and is doing a very nice job. I'm not sure if it's doing offline mode as well as it should, but we'll see. I'm just not sure if it's actually downloading everything automatically.

IMAP is a two-edged sword, and I'm using it carefully. We only get 150M on the server, so I don't want to keep everything there. So for now I'm just keeping un-handled mail there and moving handled mail to local archive folders. Like I say, we'll see how that works out. I'm using the Mirapoint mail filtering system instead of local filtering. Definitely a different feel than I'm used to, logging into a separate web client to set up filters, but then you mostly set them up and leave them alone for quite a while.

As long as I'm changing everything and going IMAP, I figure I might as well separate my work mail from my personal mail. So I figure I'll set up an IMAP server on ranjan.org (which is just a fancy way of saying pinkbelly.org :). But I didn't want to mess with that today (more on that in tomorrow's blog if I get it working). So for the time being I'm plying with POPing off of employees.org and IMAPing with Cisco. All I can say is that Mozilla is doing a bang up job.