Forem: ihucos

Tailwind CSS is pretty cool

ihucos — Sat, 18 Jul 2020 08:24:00 +0000

I am a backend developer with usually only limited love for frontend stuff. Bootstrap did make frontend bearable for me - use the column based layout, stick to the components like tables, cards, buttons, etc and you will be OK. I still sometimes spend hours trying to center something and then using the <center> tag still not understanding why this marvellous tag was deprecacted for some puristic reasons but you don't care because it's just HTML.

Anyway, that was my background. I did fiddle with raw CSS before but never came too far with that, it was a too step learning curve and I shot myself constantly in the foot. But now, just one week ago, I started using this Tailwind CSS. It's amazing! It is more low level than Bootstrap and you are not stuck to the given compontents. I can do buttons with different styles instead of just choosing from different colors. Yes, you can overwrite things in bootstrap too, but it feels kind of fighting against it. Development with Tailwind CSS is slower than Bootstrap at first, but you are compensated with the freedom of doing things how you actually want them and achieving something that does not cry "I am made with Bootstrap". It also forced me to finally comprehend new things about CSS instead of just hitting against it until it makes what I want. In any case, use it :-). At least I am happy with it and can recommend :-D

That is the landing page I did: https://simple-web-analytics.com

My Project is now Open Source

ihucos — Tue, 30 Jun 2020 14:40:43 +0000

I am very happy to announce that the Project I have been silently or not so silently mentioning here on dev.to is now Open Source.

It took some reasoning for me to decide if to publish the Source Code or not and now I feel naked. The License is AGPL, here is the page on GitHub

Please allow me to make some obligatory advertising statement about the product here and stay with us for one sentence more. Simple Web Analytics is a Free web analytics app that just makes what you would expect from such a product and nothing more or less. That was it.

Thank you for reading and Goodbye :-)

My dev.to listings experience

ihucos — Wed, 24 Jun 2020 17:48:53 +0000

After writing some posts, dev.to got me 5 credits, which I spend on a listing. Doing a dev.to listings is simple and fast.

The results so far:

So it's definitely not bad to tell about your pet project, find contributors and so on.

If you have the credits on your profile and don't know about it, go spend that with something :-)

Demystifying Containers

ihucos — Tue, 16 Jun 2020 09:44:50 +0000

Container’s consists of the following not too hard to grasp parts.

Chroot

You probably know the chroot program, it’s basically a wrapper to the kernel’s chroot system call, which prepends a given path to all following path related system calls. Or to quote it’s man page: this call changes an ingredient in the pathname resolution process and does nothing else. If called on a root filesystem - that is all files and directories that make up an operating system - the called process and all it’s future child processes will - in simple terms - think they are on a different linux distribution. In practice most containerization platforms will use the slightly more complex pivot_root call, which follows the same basic concept.

Mountpoints

While chroot changes the root filesystem of the calling process, it does nothing about “special” filesystems like /dev or /proc. These have to be set up at gusto by the given containerization platform with the mount system call. You probably already used the corresponding wrapper binary. “Volumes” are accomplished with nothing more than a bind mount.

Linux namespaces

With chroot and mountpoints we’d already have something usable but it would still not feel like a seperate operating system. Many resources are still coupled between our primitive “container” in progress and the rest of the system. Linux has an interesting concept to solve this called namespaces. Instead of decoupling an entire process at once to have something like a separate “virtual machine”, with Linux you can fine tune what exactly should get it’s own namespaces. For example: to make top not show processes from the main system, the PID namespaces is unshared. If it is desired that mount calls inside your container shall not screw up the main system (= parent processes), you’d do that "unsharing" the MOUNT namespace. It is even possible to “fake” being the root user with USER namespaces. Here is a list of available namespaces that a process can decouple from with the unshare system call. Linux namespaces is a functionality provided by the linux kernel and not supported by other Unix like operating systems.

Isolation

I will not go too deep on this one because it’s not my expertise. But with this three ingredients - Chroot, Mountpoint and Linux namespaces - we already have something that feels like a separate Linux box running on our host operating system. Neat, but making this isolated well enough from a security perspective is another story. An attacker could still “escape” our self baked virtualization quite easily. Chroot for example does not provide any guarantees that a process will stay in it’s chroot compartment.

A central repository server

For practical reasons, it would be nice to not need to manually download a new e.G. Ubuntu Operating System from the internet every time we want to use that as our guest system. Good we have our central repository server where we can download whatever we want and upload our own alterations. Oh and of course it has to support layers or overlays, explained in the next section.

Overlay Filesystems

A guest system - we don’t have containers yet - like Ubuntu with a lamp stack and some other stuff can easily take a couple of gigabytes of space on the hard drive. While it would be possible to upload, download, copy, delete and conduct other operations on that, it’s impractical. That is why containerization platforms manage root filesystem (all files and directories of an operating system) bit by bit as layers. It’s quite simple actually: multiple files and directories are overlayed on top of each other in order to make up the “complete” view that the user will see. “Special” files are used to signal a deleted file. Another interesting approach to solve this could involve reflinks - provided the used filesystem supports that. As all other interfaces described in this post, Overlay File Systems can also be used separately for whatever other use case. There is a Overlay Filesystem baked in into the kernel named “OverlayFS”. There’s also a fuse based implementation called “fuse-overlayfs”.

A build language

Last but not least a big part of containerization platforms is to let users build their own root filesystems in order to distribute or deploy them. A simple shell script would most probably not honor the layers and other “special” features like build time arguments or volumes.

Conclusion

Voilà, this is how to create a containerization platform. From my understanding all this described parts are already available since decades. But together it makes something special. That being said, please don’t try to build your own containerization platform over the weekend. It’s highly addictive and of course will take longer than you think. Here is what I came up with, it’s called plash :-)

Web Analytics Comparison Table

ihucos — Mon, 15 Jun 2020 11:40:44 +0000

Name	Payment	Min Monthly Payment	Script Size	Session Tracking	Open Source	Claims "GDPR Compliant"	Comment
Google Analytics	Free	-	73kb	Cookie based session			The most used.
Simple Web Analytics	Free	-	0kb	HTTP Cache based	X		Fastest setup. No external script.
GoatCounter	Freemium	-	2.5kb	Elaborate hashed IP based session	X	X	Detailed per page access.
StatCounter	Freemium	-	35kb	Cookie based session			Your data is statistically evaluated.
Splitbee	Freemium (Steep pricing)	-	8kb	Cookie based session			Specialized in A/B testing with all common features.
Kindmetrics	Paid but currently free Beta	6€	2kb	Hashed IP based session	X	X	Straightforward Interface. Still Beta.
Plausible	Paid	6$	4kb	Hashed IP based session	X	X	Clean Interface.
Gauges	Paid	6$	4kb	Cookie based session			Seems alrighty. But I got daily unsubscribable mails.
Fathom	Paid	14$	7kb	Hashed IP based session	X	X	Good overview with bad color contrast.
Matamo	Paid	19$	84kb	Cookie based session	X		Most advanced open source solution.
Simple Analytics	Paid	19$	4kb	Inspects the referrer		X	Best overview, I like the clean interface.

Left Out	Reason.
Clicky	Not able to use the user interface.
AWStats	Log based.
W3Perl	Log based.
GoAccess	Log based (and looks nice).
Yandex Metrica	[...] we process huge amount of anonymous data on users' behavior [...]
Open Web Analytics	Only self hosting is supported, no service offering.
KISSmetrics	For enterprise cosumters.
Etracker	Webdesign does not awaken my trust (personal opinion).
Adobe Analytics	I belive enterprise focused. User Interface looks convoluted.
Mint	Officially discountinued.
Woopra	Looks like it's for an enterprise audience.
Chiffre	Not launched yet.

Notes

If I forgot something, write it in the comments so I can update it. The sorting is by ascending price, with free services on top. This listing was carefully researched by me and it took quite some time actually. Being the author of Simple Web Analytics I wanted to get an overview of the market, especially on free of charge services, here there are really only a handful of alternatives. Although the comparison table does track if services claim to be "GDPR Compatible", that information has to be taken with some grains of salts. In my personal opinion services that do not use any kind of session at all (Simple Analytics and Simple Web Analytics) are the more privacy friendly. Next comes - in my opinion - GoatCounter, which puts a lot of effort in making something session based being more privacy friendly. A service that I actually do want to highlight due to a great overview with only one glance is Simple Analytics. Although strictly comparing features it is quite expensive and tracking unique users by inspecting the referrer I find very elegant also from a privacy perspective, I'd love to know which accuracy can be achieved with this method. I hope this gives an overview of existing Web Analytics services, let me know in the comments if I forgot something.

Avoiding Cookie Banners

ihucos — Tue, 09 Jun 2020 09:01:13 +0000

One thing I was researching for is a Web Analytics solutions - preferably free - that does not require any consent of it's users. I really want to archive a sane and clutter free user experience on my web projects. The attention span of users today is - a number in my head right now - 5 seconds. It already takes 2 seconds for a consent banner to load on your users browser and for the user to fully get over the distraction that there is something directly asking for its attention. After that there are only 3 seconds left to the user to decide if she is staying on that site or not. So in my opinion consent banners are really, really expensive. They eat up one of the most important resources: User attention.

This is not a defenitive list but comments on (preferably free) Web Analytics that could possibly be used without consent banners.

Google Analytics

The first product you think of when you hear about Web Analytics is Google Analytics. While you can at least disable cookies on Google Analytics with some efforts, the devil is in the details. So I will not go into that and just unfairly state that Google will always be Google. I actually did not manage to definitively find out how exactly to use Google Analytics without a consent banner or if this is possible at all. But I want to list it here because it is still today one of the obvious choices to consider.

Plausible

While it is not a Free product, it at first sight seems quite interesting to me and claims on the front page "No cookie banners or GDPR/CCPA consent needed". It is open source, has a public road map and I actually do like the product itself. At first sight this product clearly seems to be the solution to avoid a cookie banner. Well I am afraid not. I am no lawyer and will only present apparently contradictory information from Plausible and another source and also ask Plausible to clarify after publishing this post.

Here is a really good article. According to that source, asking for consent is only needed if you are only collection anonymized data. For pseudonymized data you still need consent. To quote the linked Article

In layman’s terms, the main difference is that while pseudonymous data still allows for some form of re-identification, anonymous data can’t be re-identified. That’s why the former is still considered personal data, while the latter isn’t.

While Plausible has good explanations of it's internal workings it is actually quite nice that we can transparently look directly into the source code: On each Pageview, there is a user_id saved to the database as attribute of an event here. The user id is a hash of the user's ip with her user agent and the website domain. That is also explained in plain words here. There possibly may lie other consequences in saving the hashed ip address but for this blog post my interpretation and claim is the following: This does not qualify as anomyzation, it’s pseudonimization and therefore a consent banner is still needed when using this product. I hope Plausible can clarify on this and if applicable, remove all corresponding claims about it's product.

Simple Web Analytics

After not finding anything Free with no cookie banner needed and not wanting to somehow figure out how exactly Google Analytics can fit the bill, I really just wrote my own analytics service and this is it. One of the biggest differences to other products is that it is really only a bunch of counters for the date, browser, country and so on. There are no cookies and no sessions (user ids) at all. I still do not claim that it is "GDPR compliant" anywhere at this point in time due to the complexity of the topic.

I conclusion this is the comparison of three products that could possibly fit the requirement of Web Analytics without a consent banner - and that preferably free of charge. Maybe only partly satisfying and I hope the internet and me will gain more clarity about the DSGVO with some time but I hope, I could clarify some points. I'd be happy to discuss more trough the comments!

Install any package with ZPKG

ihucos — Fri, 05 Jun 2020 13:13:27 +0000

There is a really cool (meta) package manager I wrote. Usually you are kind of bound to specific package managers depending on your Linux distribution of choice. With ZPKG you can just use any package manager on any Linux distribution. It is still alpha/beta but already works fairly well. Let's take a look.

Let's take the exemplary use case that you are on Ubuntu Linux and want to do some quick image editing with Gimp. You totally could install that with apt or snap, for example:

apt-get install gimp

While that is the "official" way of doing that and apt does a fairly good job, there are still some things I don't like so much.

You have to use the root user. I personally try to avoid that.
The package integrates into the system and e.G. creates new users, installs services, configuration files etc. That could be desired, but causes "bloat" on the whole system.
Ubuntu packages are stable, but sometimes a little outdated (imho) in comparison to other distributions.
I find apt slow in comparison to e.G. apk from alpine. Big packages can take up quite some time.

So what I do in that specific use case of just quickly wanting Gimp to edit an image or so without putting too much weight on my global system installation, is to use ZPKG. Let's takes a look:

zpkg add gimp --from alpine:edge --apk gimp

Or a shorter less explicit invocation

zpkg add -A gimp

Note:
Make sure you have this directory in your PATH: $HOME/.local/bin

And voilà you can type gimp in any terminal in order to use it. Interestingly the whole installation is on your home folder and completely independent from the Linux Distribution or it's libc implementation. So you could do things like share your home folder across multiple Linux Distributions and still use the same programs.

Another thing that I think is pretty nice, is that with zpkg you can also package other packages. Let me explain:

$ zpkg package gimp gimp.zpkg  # that is the "gimp" we just installed
Install package locally:
tar -xf gimp.zpkg -C ~/.local 

Install package globally:
tar -xf gimp.zpkg -C /usr/local

ZPKG itself is distributed as a zpkg package, so this is how to actually install it:

curl -Lf https://github.com/ihucos/zpkg/releases/download/0.2.4/zpkg.zpkg | tar -xJf - -C ~/.local

So in other words, with ZPKG you can also create packages, that are completely distribution agnostic.

Of course you can also do stuff like upgrading installed packages, removing them, and so on. Check it out :-)

The implementation details include overlay filesystem, user namespaces, hard links and other interesting topics that I will hopefully follow up on more posts :-)

Here is the website and the GitHub page
http://zpkg.plash.io/
https://github.com/ihucos/zpkg

The cost of parsing http

ihucos — Tue, 02 Jun 2020 15:54:16 +0000

When creating Simple Web Analytics I tried to be able to scale from the beginning. Coming from the Python world one thing I hear a lot is "The database is the bottleneck". But for that specific use case that turned out to not be true. Apparently, my application code seemed not to weight in into how many requests per second the server can handle so much. And in the end I had to switch to go to be able to accomplish what I find acceptable results.

Let me explain and compare numbers. With a hello world flask application and gunicorn I can get 3343.95 trans/sec. Trying an asynchronous (gevent.pywsgi) based wsgi to http adapter did not help, here the numbers are something like 1003.65 trans/sec. Now let's throw golang into the comparison. Before boring you too much I will do an really completely unfair comparison and jump straight to this number 8765.15 trans/sec. That is also including the whole application code. And now just for completeness here is my unperfect measurement of what a simple hello world in golang can do: 12465.77 trans/sec.

In conclusion for my specific use case - doing optimized queries on a redis database - the bottleneck is clearly handling the http requests and not the application code. I wonder what exactly takes so long (in comparison with the application code). Is it parsing HTTP, is it handling the sockets, is it something else? Id' like to know!

Web Analytics for pet projects

ihucos — Mon, 25 May 2020 18:13:00 +0000

Some time ago I just used Google Analytics for my pet projects. But now with the DSGVO I don't know exactly how that is supposed to work. After some reading about that I came to the following conclusion: We need some quick and dirty way to just have basic tracking of users in web projects.

So here it is, a Cookieless, Free (not Freemium) service to track users. There is no user id assigned to traffic and I don't save IP addresses. Does this make it "DSGVO-Compliant"? I honestly don't know, but think it's pretty cool: https://simple-web-analytics.com/

The server is written in Go, there's some vanilla JavaScript and Bootstrap on the frontend, also Chart.js. And the database is redis. On my Cheap 5 Dollar Linode VPS it can handle ~ 2000 requests per second to track users. There is geolocation, referrer and top pages tracking and everything you would expect. HTTP Caching is used to ensure every user only (mostly) hits the server once per day per site being tracked.

Check it out :-)