See you there!

From php changelog:

2012-01-03 : security / trunk - Added php-5.2-max-input-vars patch max_input_vars directive to prevent attacks based on hash collisions - CVE-2011-4885


Why we have so much form fields is a subject for different post. The main problem is that even php site says this update is available from PHP version 5.3.9. The fact is we have 5.3.2-1ubuntu4.14 and the update is there.

So… you know… beware. :)

Yesterday we have finished the last step in the great migration of Kolektiva away from us. Exported databases, switched everything, and closed this case. Yes, Kolektiva is no longer our client, at least not in the way it used to be.

We have started working on Kolektiva almost two years ago with Jeffrey Treichel and Martina Usmiani. They were Kolektiva, we were the full service agency supporting their project. Couple of months later, first Kolektiva version hit the web and it turned out to be a success. The Kolektiva general idea was nothing new, it was a Groupon clone, but it was the first clone in this region, and among the first ones in Europe (at the moment there is over 20 clones just in Croatia, which all followed and often unsuccessfully copied Kolektiva). We had no idea what we are building, how will the market react and how should it scale. Everything we did had to be super flexible in order to properly scale later, both server-side and design/front-side.

Kolektiva started with one daily offer in one city, and it quickly grew into more cities with more than one offer per city, from 2 employees to dozens of them. Then it went regional, outside Croatia, and even further, outside the Balkans. This growth was made possible by our flexible and customizable approach to our work. Everything is scalable, everything is upgradeable, everything is modifiable.

As Kolektiva was growing, they required outside financing to support branching to other countries. It really takes manpower to scout for the good deals in distant countries as well as good lawyers to bind everything together. Financing was found, and with it came the demands of the financiers. One crucial demand was that Kolektiva should be switched to the open-source solution for the backend. From their perspective, this is a logical requirement. First, this ensures that the project can continue even if the bubonic plague decimates everyone in Nivas – there will always be someone else that could open up the open-source backend and continue to work. Second – should anyone ever want to buy Kolektiva, the project needs to be one neat package which can be sold without ties to the outside Agency; us.

We nurtured Kolektiva to its full potential through scalable solutions, and now that it is full blown and it’s specifications are well known, it can detach from custom built solution and go to adequate open-source platform. This could not be done from the start as in the start no one knew what would the project look like few months in the future. The future was uncertain, so everything had to be custom to support incoming situations, which sometimes were borderline paranormal.

As with all in life, you win some – you lose some. Kolektiva required open-source. Some of our other clients required closed proprietary system. Our backend is our closed proprietary solution which runs all of our projects. Although it’s running on open source stack, our policy is that we keep our system closed; we do not give away the source code nor allow clients to write plugins or modify our code. For those, and many other reasons there will always be a need for open-source as well as custom built systems. We are here to offer custom built solutions with security and scalability when clients have no idea what the future will actually hold.

Kolektiva, through our joint efforts, bumped up a notch regional online shopping awareness as well as woken up some banks and institutions. During first year of Kolektiva’s life, almost a third of the people who bought something on Kolektiva stated that this was their first online shopping experience. Kolektiva was Croatian online shopping enabler. A year ago, the amount of daily credit card transactions reached daily limits, which bank and credit card processor has never seen before. When the number of transactions reached certain limits bank just shut the gateway down for fraud protection prevention. Well, that wasn’t fraud what happened, but pure Kolektiva success. Afterwards, this repeated twice more and we hope that will repeat in future as well.

So long Kolektiva, it was a fun ride while it lasted, we had a great time working with you guys.

xoxo Nivas crew loves you! :)

Payment processing isn’t something new in Croatia, but PayPal is. On-line stores were able for years to process user credit cards via some of our local popular credit card processing services like T-Com Pay Way or Webteh – WebPay (or directly through connections with each bank – less popular method). But only recently (a year ago), with arrival of Kolektiva and similar sites oriented to wider online consumer public, online payments started to become more popular, widely accepted and less frightened to a regular Joe.

In our e-commerce web development work so far, we had chance to work in close with following regional internet payment service providers:

• T-Com Pay Way (Croatia)
• Webteh – WebPay payment gateway (Croatia)
• PBZ MyCheckout (Croatia)
• EMS (Serbia)
• qVoucher (Serbia)
• Telemach – EON MegaPOS (Slovenia)
• direct connection with various banks in the region

And just recently – the PayPal.

No matter PayPal is mature product, integration was not walk in the park. From developers standpoint, I would definitely commend T-Com Pay Way, Webteh and qVoucher services for ease of integration and support they have. In contrast to PayPal’s undocumented features (or lack of documentation and examples) or EMS’s infinite redirects to 3rd party pages (enforced by other parties) in payment process.

PayPal
After some headache & time spent at the PayPal sandbox (self-contained environment within which you can prototype and test PayPal features and APIs) we finally managed to get it working.

We used widely used HTML way to integrate Website Payments Standard with our shopping cart (please see “Third-Party Shopping Carts – The Cart Upload Command”) since integration via API has been proven to be more complex and undocumented than Facebook’s SDK.

For security we used Encrypted Website Payments (please see “Protecting Payment Buttons by Using Encrypted Website Payments”.

Encrypted Website Payments relies on public-key cryptography using OpenSSL which is available both as external program that can be executed from PHP and as php extension. Prepare to enter world of pain with this one, since most of examples use executable file to do actual encoding.

Using OpenSSL as extension with PayPal is not straightforward, best example can be found at PayPal SDK in php toolkit.

We implemented support for both IPN and PDT notifications:

• PDT (Payment Data Transfer) – is secure method to retrieve details about PayPal transaction after (and if) user chooses to return to our site after paying on the PayPal. It should be used only to display information to the user. Our system is not depending on it since there is no guarantee that this action will be executed.
• IPN(Instant Payment Notification) – is direct PayPal to our system communication. In order to verify authenticity of IPN data received from PayPal should be checked and then sent back to PayPal in exact order it was received. PayPal should respond with “VERIFIED”.

Please note that although PayPal send newline as CR+LF (%0D%0A), PHP returns these new lines as LF (%0A) – so, newlines transformed by PHP into LF must be replaced with CR+LF before data is sent back to PayPal. This bug can easily be reproduced if you enter both Address line 1 and Address line 2 during payment, because those two lines PayPal combines into one field separated with CR+LF.

You can try all all this, or you can just contact us for consulting and/or implementation services. :)

Name subject to change. Or not. Maybe. =)

So we decided it is time to build our own service to track time. You could now ask “why not just use one of the existing ones available online?”. And that question is perfectly valid, there are some great time-tracking products available! However, there is this little thing called – Croatia, and Croatian laws. You see, our law system is out of the touch with reality therefore out of touch with how time tracking should really work. They passed a law for time tracking in companies that requires very specific things to be tracked in case of inspections. Commercial available systems do not have all those details built in, as they were designed to do one thing only, and do it good – track time spent on projects/clients.

You can read all about it here in full bizarre detail. Even if you do not understand Croatian, you can just quickly scroll and see the number of bullets, that will give you the clue.

Nivas Time is in use here locally for the last 3 months, and it is going heavy development and beta testing. It is “Soon” ready to be released into world as invite-only beta. After that, it will be released into public with two way model – free for small users (one-two man forces), and subscription based for bigger companies. It will be available with English and Croatian interface, of course.

A small preview:

—- Time Dashboard

—- Smart Client/Project search

—- List of clients

If you are interested to be in the first batch of invite-only testers, send us a mail, we will keep you in mind.

Keep on tracking!

update1 (16.1.2011.): Time is now online at time.nivas.hr address and we are preparing test accounts for all of you who contacted us.

Hrvoje Dorešić (executive editor of online edition) accepted golden statue:

Two of our projects won three awards. We won special Grand Prix award and two Jury awards. Respects to everybody who made this possible!

1. Grand Prix (Grand pri festivala) – MTV (www.mtv.rs)
2. Information/news (Informativni) – 24sata.hr (HR)
3. Entertainment (Zabavni) – mtv.rs (RS)

Mediakit, press release.

Also, congrats to friends from Web Burza and Bruketa&Žinic for their winnings.

WEB FEST is the largest regional Internet festival dedicated to the selection of the best regional web projects and education, promotion and popularization of Internet.

Vlada takes one for the team:

Thanks to everybody for such a nice feedback:

• tportal.hr – Centrala hrvatskih medija
• net.hr – Ručno izabrane vijesti
• totalportal.hr – Centrala.hr – novi informativni portal
• kroativ.com
• 3kolone.com – Sto mu gromova! Centrala.hr
• Plan B
• webmajstori.net

Go check out new Nivas banner portfolio page, and write us angry comments if some of those banners harassed you too much on Croatian cyberspace.

We have been real busy lately. So busy that we didn’t have time to share with the rest of the world what have we been working on this summer. Be hold!

• Donacije.info
• Friendzii Facebook Application
• Magmont
• Središnja agencija za financiranje i ugovaranje programa i projekata EU (SAFU)

More new projects coming soon. Meanwhile, you can read more about recently released projects on our corporate one-pager web site (yes, it is getting too heavy to load, but we are working on that too). :)

I remember Google Toolbar back in the days Firefox wasn’t so hot. It added nice web search ability to Internet Explorer and many IE bundles had him preinstalled. Google Toolbar is installed by default for Windows/IE users whenever Flash is installed or updated from Adobe’s website, and the penetration of Adobe Flash appears to be around 99% so I suspect Google Toolbar penetration is quite good. With all this in mind we decided to try extending Google Toolbar.

I have done exhaustive research regarding Google Toolbar and after couple of hours of prototyping I came to conclusion that we CANNOT reproduce desired behavior from our Firefox extension. Only way we could “port” Firefox plugin is by writing ActiveX Internet Explorer Addon control.

I have used Google toolbar v5 beta since earlier versions of the toolbar are completely useless. The idea was to setup the feed to reload every X seconds and to say to SplinQ server an URL of the website where user is right now, and based on that, toolbar button/gadget would know should it show alerts and notifications by icon change or not.

I tried to simulate events by using Google toolbar RSS feed feature which enables toolbar gadget to load a remote RSS feed in certain interval times. Interval can’t be less than 20 seconds (another Google limitation). This feed can:

• change the dropdown menu icons (when clicked)
• replace icon in toolbar
• add alert texts beneath the toolbar icon

The main reason for a failure is security feature from Google toolbar that prevents developers to automatically send in any way URL of current site user is browsing. That is off course serious security hazard, and I completely understand why Google doesn’t allow this. Malicious user could be able to track all sites you are visiting and record that into his log files. Big fail!

However, Google toolbar can send current URL, but only if user:

• used search option within the toolbar
• pressed toolbar button

Both ways don’t enable us to have seamless way of user notification. What we need here are events, which will trigger upon user visit of new site in browser. Google toolbar doesn’t support this.

You can send some data from user by using two mentioned methods by using special tags (more on this on Google toolbar variables reference and scopes):

{query} - <search> element
{url} - <search>, <site>, or <send> element
{url.host} - <search>, <site>, or <send> element
{url.noescape} - <search>, <site>, or <send> element
{domain} - <search>, <site>, <send>, or <feed> element
{locale} - <search>, <site>, or <send> element
{selection} - <send> element
{option1} - Must go in a URL in <search>, <site>, <send>, or <feed> element
{random} – all?


So, what now. This only leaves us with one option, and that is to start writing ActiveX Internet Explorer Addon control. :)

Screenshot 1 – Alternate search provider:

Screenshot 2 – RSS feed icon changes and alerts:

Screenshot 3 – clicked button / plugin config screen:

Until next post, enjoy this picture taken by me couple of weeks ago on island of Hvar. We had great time there, but it seems like it was 10 years ago.

After some thinking and pimping, you can get straight A out of yslow. That’s a fact. But then one day client comes and says – I need this banner here and that banner there and this tracking code and that tracking code…. 5 days later your straight A page becomes bullseye F. Why? Because you had to put tons and tons of inline javascript which not only broke your wonderful w3c compliant markup, but also completely f*cked up page loading/rendering time. Each page render now has to coup with inline javascript (even iframes) and loading of external javascript, images and flash files from different slow and overcrowded ad servers.

Until today I was mislead by thought that only we have that kind of problems, but my recent try to browse www.bbc.co.uk encouraged me to write this post.

Guys at BBC use (like many other) DoubleClick for banner management. There is nothing wrong with DoubleClick, or any other banner management software. In picture below you can see what timeout did to a bbc homepage. After 60 seconds or so, page eventually loaded, but was missing banners:

On our recent project, we didn’t liked the fact that ad server is slowing our page render time by 300-500%. OpenAds didn’t update their banner publishing scheme for at least 5 years so we did a little trick.

There is a placeholder that holds layout and displays “loading…” msg where banner should appear. Then we load the banner at the bottom of the page and once the banner is loaded we append it to the placeholder on top of the page .

This technique works well but can’t be used in every configuration. Btw, if you are using jQuery, just be sure to use v1.2 since appendTo later on contains a bug. Eventually you could patch your current with this fix.

This won’t solve all of your problems, and will off course introduce new ones but will help your page render time slightly and make your visitors not so annoyed. You should reconsider how to solve bottleneck to your ad server by making a farm or something.

We sold our computers:

We listened some pretty damn good music…

We accidentally uploaded on flickr some secret documents and schematics :)

We contemplated…

We had meetings…

We had presentations…

… and we had fun doing presentations!

We crashed cars on ice (damn you zagreb winter service)

We put some bling on our xmas tree

We had fun with our Christmas presents…

…lots…

… and lots of fun.

Hello Santa!

We did some pretty serious shit…

…and we had fun doing it.

See you all in 2008!

Checkout more strange moments from the office at nivas:random() flickr photo set!