SoC: AtomPub Week 8 Status

Week 8 of the Summer of Code was nothing short of a roller coaster ride. At some points I wanted to tear my hair out, other times I was jumping for joy. Here is what went down this week:

Bad: Regular Expressions Are Not My Thing

While working towards media importing this week, I had to write a few regex statements. I’ll admit it, I completely suck at regular expressions. They bring me back to my not so fond days of Discrete Mathmatics; days I would rather forget. Regardless, I managed to get through them and ended with some working code.


Good: Faster Response Times From TypePad

I noticed while working on media importing, TypePad’s server have greatly increased in speed this week. I found that importing took roughly half the time it did in the previous week, with no code optimizations on my part. The speed increases managed to stay consistent through the week, so I’m hoping the changes are here to stay.

Bad: Media Importing is Near Impossible

Wednesday came to a grinding halt when I noticed there was no way to reliably import media by parsing images from posts. There are several reasons to this:

  • TypePad has two different methods for uploading images.
  • The markup TypePad generates for images is unclean and is not standardized. Users have the ability to modify the output code template.
  • TypePad puts the full size image on a separate HTML page that is linked to via a URL that tells nothing about the original file. Due to this, it is near impossible to link the full size image with the originating link.

So, media importing is unfortunately looking very glum. I will try to come up with something since importing media is a crucial feature in my book, but I’m not sure what. More on this in the coming weeks.

Good: WordPress 2.6 Released

The new version of WordPress was released this week, and I was happy for several reasons. First off, I was able update my blog and take advantage of the new features, but more importantly, trunk is going bleeding again. Hopefully in the next week or so the TypePad importer should land in trunk. Stay on the lookout!

Good/Bad: Headway Made on Movable Type Authentication Issue

I managed to get in touch with the developer over at Six Apart who originally wrote Movable Type’s Atom API implementation. The good news is he confirmed I’m not crazy and MT is authenticating differently than TypePad. The bad news is he couldn’t remember off hand what is different with the implementation.

From what it sounds like, MT is not following the RFC 5023 spec in regards to WSSE, simply because the specification was not standardized when the original code was written. I’m not sure where this leaves me, because I don’t really know what is different with authentication at the moment. Also, I’m unsure if Movable Type will correct the authentication difference in the near future.

At the moment, it appears I will be brushing up on my Perl skills and looking at the source code for Movable Type next week. With a little luck, this issue will finally be ironed out. Who knows, maybe I’ll even figure out something for media importing next week as well. Right now, I’m just hoping next week is the week of miracles.

4 Comments

  1. 1 Joseph Scott on Jul 22, 2008 at 2:18 pm (Quote):

    They are using WSSE? Does that mean they are storing user passwords in plain text in the database? That would be a bad idea.

  2. 2 Ronald Heft on Jul 22, 2008 at 2:22 pm (Quote):

    Joseph Scott: They are using WSSE? Does that mean they are storing user passwords in plain text in the database? That would be a bad idea.

    Yes, I just looked at my MT database and indeed all passwords are stored in plain text.

  3. 3 Joseph Scott on Jul 22, 2008 at 2:44 pm (Quote):

    That’s not good.

    As far as I know the only way to support WSSE is store the passwords in plain text on the server, which is one of the reasons why I said WP won’t be supporting WSSE:

    http://joseph.randomnetworks.com/archives/2007/09/19/http-basic-authentication-a-tale-of-atompub-wordpress-php-apache-cgi-and-ssltls/

  4. 4 Ronald Heft on Jul 22, 2008 at 3:21 pm (Quote):

    Yeah, I didn’t think about that as a limitation, but you’re completely right. I can’t see any way of generating the authentication key without using the plain text password.

    I guess that’s why MT uses a special API key, but looking at the database, even the regular password is in plain text. That’s certainly a security vulnerability right there.

One Trackback/Pingback

  1. [...] pm on July 18, 2008 | # | Tags: atompub importer, weekly Week 8 status report is now available. [...]

Post a Comment

If you have the urge to code, run it through Postable and <pre><code>wrap it up</code></pre>.