Simon Whatley » United States

Google Announces Plans to Offer a Google Analytics Opt-Out

Simon — Fri, 19 Mar 2010 11:06:49 +0000

Yesterday Google announced that it had been developing opt-out functionality for its Analytics product, seemingly in response to growing unease with United States and European regulators.

As an enterprise-class web analytics solution, Google Analytics not only provides site owners with information on their website traffic and marketing effectiveness, it also does so with high regard for protecting user data privacy. Over the past year, we have been exploring ways to offer users more choice on how their data is collected by Google Analytics. We concluded that the best approach would be to develop a global browser based plug-in to allow users to opt out of being tracked by Google Analytics. Our engineers are now hard at work finalizing and testing this opt-out functionality. We look forward to make it globally available to our users in the coming weeks.

This was an unexpected move, but possibly a very smart one by Google, which aspires to turn its Analytics product into an “enterprise-class web analytics solution.” Many analysts will see the creation of a browser plugin to opt-out of Analytics counterintuitive. Rationalising web analytics is already hard enough, but if you now need to factor in a proportion of people who may have opted-out, it will create a minefield of doubt. Furthermore, if people are able to opt-out of Google Analytics, will enterprises want to use it as an analytics solution?

It is safe to assume that Google do not want to kill one of their key products, which sits neatly between their search and advertising businesses. Indeed Google aren’t the first to create and opt-out, with Omniture and Webtrends having already created a cookie-based solution.

So why shouldn’t you be too worried about Google’s plugin?

Opt-out does not signal a death knell for data gathering. Although some people will undoubtedly be concerned about tracking and therefore download the plugin, the vast majority of users will not. Furthermore, it is the trends in analytics that are important rather than absolute numbers. Analysts will simply need to study, manage and quantify the resulting bias. Such issues are analagous with a user deleting cookies or disabling JavaScript in their browser.
Good privacy management reinforces trust in a brand that has been under attack over the amount of data it collects on its users. This in turn will drive long-term acceptance of Google products and enhance its earning potential. As mentioned at the beginning of this article, this move shows good faith to regulators and sets the stage for Google Analytics to operate safely within the containts of more stringent privacy regulations in the United States and more importantly Europe. If Google Analytics is allowed to operate freely on this basis, it may boost usage and advertising revenues, which in turn will maintain it as an important product for Google.
Opt-in customers are better customers because they provide an accurate picture of how they use your website and therefore are key in helping you improve the user experience. Focusing your efforts on those who are willing to be measured may enhance the achievement of site goals.

How should you prepare for the launch of the plugin?

Benchmark your data (traffic, visitors etc) before and after the release of the opt-out plugin. That way, you will be able to determine the potential bias between the figures and adjust the reports accordingly.
Understand how to accommodate the opt-out bias in your reports and determine which reports may need recalibration.
Understand how the change in your Google Analytics metrics may compare to or impact upon 3rd party metrics, for example those used to calculate advertising revenue.
Determine whether announcing the possibility of your users opting out will enhance the trust of your website, with the view to potentially alerting to your users that they have such an opportunity.

This move by Google is likely to set the trend amongst Analytics providers since online privacy is a major issue. Most modern browsers include an “incognito” setting, which allows for private browsing, therefore it stands to reason that the analytics providers will follow Google’s lead, even if it is only a cynical attempt to reassure users and maintain market share.

What's In Google Chrome's User-Agent String

Simon — Fri, 12 Sep 2008 12:10:43 +0000

With the advent Google Chrome there has been a lot of media coverage regarding the browser’s uptake and how it will compete with Internet Explorer, Firefox and Safari. This is where the User Agent becomes most valuable. It can be used in analytics software to determine the browser share and consequently aid the development of the website.

But what is a User Agent? A User Agent is the client application used with a particular network protocol; the phrase is most commonly used in reference to those which access the Web. Web user agents range from web browsers and e-mail clients to search engine crawlers (spiders), as well as mobile phones, screen readers and braille browsers used by people with disabilities. When Internet users visit a web site, a text string is generally sent to identify the user agent to the server. This forms part of the HTTP request, prefixed with user-agent: and typically includes information such as the application name, version, host operating system, and language. Bots, such as web crawlers, often also include a URL and/or e-mail address so that the webmaster can contact the operator of the bot.

By simply typing about:version into Chrome’s address bar you will be presented with the following information:

Google Chrome
0.2.149.29 (1798)
Official Build
Google Inc.
Copyright © 2006-2008 Google Inc. All Rights Reserved.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13

As you can see Chrome’s version information provides limited detail about the browser. The last line is the important one. It is the HTTP User-Agent header:

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13.

If you know the RFC 2616 specification on the HyperText Transfer Protocol — which incidentally, I gladly don’t — you would know that the User Agent, or more formally, product token, should be short and to the point:

Product tokens SHOULD be short and to the point. They MUST NOT be used for advertising or other non-essential information. Although any token character MAY appear in a product-version, this token SHOULD only be used for a version identifier (i.e., successive versions of the same product SHOULD only differ in the product-version portion of the product value).

Clearly this isn’t the case! One of Google’s reason’s behind creating the Chrome browser was to start afresh. It would have therefore been truely amazing if they had made the string simply Chrome/0.2.149.27.

Unfortunately, browser sniffing makes an ever-growing UA string the path of least resistance for browser vendors.

So, what does Chrome’s User Agent string actually mean:

Mozilla/ – This means that browser has the kind of capabilities that Netscape 1.1 had compared to Mosaic and Lynx.
5.0 – This means that the browser engine is from the post-Browser War Web Standards era as opposed to being from the Browser War era.
(Windows; – This means that general windowing system flavor the browser runs on is Windows (as opposed to, for example, Apple and X11).
U; – This means that the browser has at least the level of cryptographic capability / encryption strength that U.S. versions of browsers had in the late 1990s.
Windows NT 6.0; – This indicates the operating system the browser is running on. In this instance, the browser is running on Vista.
en-US) – This indicates the user interface language of the browser (U.S. English in this case). This may be used to choose between different content languages even though HTTP has a different header for that purpose.
AppleWebKit/ – This indicates that the engine of the browser is WebKit as opposed to being Gecko. Developers should not do user agent sniffing as a rule, but if they still do, this is what they should be sniffing.
525.13 – This is the WebKit version from which Chrome branched its copy. Site admins could use this to detect old versions with known bugs.
(KHTML, like Gecko) – This introduces the substring Gecko into the UA string while pointing out to human readers that Webkit was forked from KHTML. Without this substring, Chrome might be put in the same category as IE and Netscape 4.
Chrome/ – This string identifies the browser as actually Google Chrome.
0.2.149.27 – This is the Chrome version. This could be used to detect old versions with known bugs.
Safari/ – This means that the browser is like Safari as opposed to being like Firefox.
525.13 – This just repeats the WebKit version in order to have some version but not the irrelevant Safari.app version.

Preventing SQL Injection in an AIR Application

Simon — Mon, 01 Sep 2008 10:41:20 +0000

SQLite is a mostly ACID-compliant relational database management system contained in a relatively small (~500kB) C programming library. The Adobe AIR runtime includes the SQLite embedded database for use by Adobe AIR applications. This allows applications to run and store data locally and or synchronise the datastore with online repositories.

Applications that depend on user input to create a SQL statement — concatenating the user input to the SQL query — can become vulnerable to SQL Injection attacks, much like those common to web applications.

SQL Injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

Fortunately, there is a simple solution to the problem: use parameterised SQL Statements. Parameterised statements not only make your applications more secure and run more efficiently, but they also enable you to use objects, rather than literal values, in your queries. SQL injection can’t happen because the parameter values are treated explicitly as substituted values, rather than becoming part of the literal statement text.

Parameters in a SQL statement can be either named or unnamed. Below are examples of both types of statement in ActionScript and JavaScript.

Named Parameters

A named parameter has a specific name that is used to match the parameter value to its placeholder location in the SQL statement text. A parameter name consists of the colon (:) or an at (@) character followed by the variable’s name:

ActionScript 3

var conn:SQLConnection = new SQLConnection();
var stmt:SQLStatement = new SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO user VALUES(@title, @firstname, @lastname)";
stmt.parameters["@title"] = "Mr";
stmt.parameters["@firstname"] = "Simon";
stmt.parameters["@lastname"] = "Whatley";
stmt.execute()

JavaScript

var conn = new air.SQLConnection();
var stmt = new air.SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO user VALUES(@title, @firstname, @lastname)";
stmt.parameters["@title"] = "Mr";
stmt.parameters["@firstname"] = "Simon";
stmt.parameters["@lastname"] = "Whatley";
stmt.execute()

Unnamed Parameters

As an alternative to using explicit named parameters, you can also use implicit unnamed parameters. To use an unnamed parameter you simply designate a parameter in the SQL statement using a question mark (?) character. Each parameter is assigned a numeric index, according to the order in which the parameters appear in the SQL statement, starting with index 0 (zero) for the first parameter.

ActionScript 3

var conn:SQLConnection = new SQLConnection();
var stmt:SQLStatement = new SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO address VALUES(?, ?, ?, ?)";
stmt.parameters[0] = "123 Main Street";
stmt.parameters[1] = "Sometown";
stmt.parameters[2] = "12345";
stmt.parameters[3] = "USA";
stmt.execute()

JavaScript

var conn = new air.SQLConnection();
var stmt = new air.SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO address VALUES(?, ?, ?, ?)";
stmt.parameters[0] = "123 Main Street";
stmt.parameters[1] = "Sometown";
stmt.parameters[2] = "12345";
stmt.parameters[3] = "USA";
stmt.execute()

Note: Use clearParameters() to empty the statement parameters array; e.g. stmt.clearParameters().

Advantages

Performance – A SQL statement that uses parameters can execute more efficiently compared to one that dynamically creates the SQL text each time it executes. The performance improvement is because the statement is prepared once and then executed multiple times using different parameter values, without needing to recompile the SQL statement. A comparison can be draw with database stored procedures.
Data Typing – Parameters are used to allow for typed-substitution of values that are unknown at the time the SQL statement is constructed. The use of parameters is the only way to guarantee the type (storage class) for a value passed to the database. Using paramters therefore, implies better performance and security. When parameters are not used, the runtime attempts to convert all values from their text representation to a type based on the associated column’s type.
Security – The AIR application is not vulnerable to SQL injections so common to web applications.

Launching Yourself as a Freelancer – Networking

Simon — Fri, 08 Aug 2008 11:43:26 +0000

In the first two parts of this series, I talked about setting up in business as a freelancer and publicising yourself via branding and blogging.

Creating a brand and blogging are two important steps to getting yourself known, but are of little use if you do not actively build relationships through networking.

A good friend of mine, Rob, has some great advice: Get to the pub. When a project comes up and someone wants a Flex developer, you want to be front-of-mind.

Of course networking is more than simply going to the pub, it’s talking to friends and colleagues online, it’s attending conferences and groups. In essence it’s about ‘getting out there’.

Build Online Relationships

Many of my contacts are not from the London area, but include locations such as Brighton, Edinburgh and Birmingham. Added to this, I have international contacts in countries such as Australia, Belgium, New Zealand and the United States.

Clearly it isn’t easy to call up these people and say ‘do you want to go to the pub’. Therefore, building online relationships is a must. There are a whole host of services that essentially let people understand me as a person, not just a work colleague.

I use, to varying degrees, services such as FriendFeed, SocialThing, BrightKite, Jaiku, Meebo, Bebo, MySpace, LinkedIn, Facebook, LibraryThing, Cork’d and Dopplr. Indeed, you can find links to my most-used services in the footer of my site.

Take a look at the links in the footer and get to know me. You may notice that all the services are registered under my brand name. Again, this allows people to draw association with the profile they are looking at and me. It also means that if you want to follow me on one or many services, it won’t be hard to find me.

Attend Local Meetings and User Groups

Attending local ‘geek’ meets is a great way to meet like-minded people, exchange thoughts and quite possibly find work. These meetings can be found on the Yahoo! service Upcoming.org and on Meetup.com.

On the odd occassion, I may be found at meetings such as the Web Standards Meetup, the ColdFusion User Group, London Geeks, the London Flash Platform User Group, the Flex London User Group etc. (I do have a life outside my work, honestly!)

Attend Conferences Related to Your Industry

Conferences are really an extension of local user groups and meetings, but they allow you to network with a wider, often international, audience. It is quite possible to spend a few days a month attending conferences, so chosing ones relevant to you are key.

In the past I have attended, Adobe MAX, Scotch-on-the-Rocks and CFDevCon, but there are a tranche of other conferences that could be equally relevant such as CFUnited Europe, 360Flex and Flash on the Beach.

Conferences provide a varying degree of networking and job opportunities, but if anything they provide a great sneak-peek into what other people are working on and in what direction the industry is heading.

What’s Next

In the final part of this series I will introduce methods by which you can advertise your business.

Launching Yourself as a Freelancer – Publicity

Simon — Wed, 06 Aug 2008 11:44:05 +0000

In the first part of this series I talked about setting yourself up in business. The next step is to publicise yourself and your skills. At this point, it is helpful to know exactly what line of work you want to be focusing on, since you will need to target your efforts.

In the dim and distant past, the job of publicising yourself was extremely difficult. Can you imagine life without the Internet, mobile telephones and email? How did people ever do business? With the advent of the World Wide Web and in particular search engines and blogging, this all changed and a wealth of opportunity has become available, especially to the freelancer.

But where do you start?

Create a Brand

Creating a brand is a great way to market yourself. This does not have to be the same as your company, and through time you may set up different brands for different sectors or ideas you may have. Brands serve to create associations and therefore, expectations of products you create, so a good brand name is a great way to get recognised in your community.

You can register the brand in the UK, Europe and the US, although the latter requires a US address. It is also not a given that your brand registration will be successful, making it a costly exercise. Careful consideration is what is needed here.

Create an Avatar

Avatars are images or icons that represent you in the online world. They are an extension of your brand. For example, the header of my website is also my favicon and avatar on various online services. It is a great way for people to draw an association between your online presence and you.

Create a Blog

Blogs are a great way to get yourself known and therefore heard amongst your peer group. Your blog should really be an extension of your brand and is a great avenue to showcase your skills, demo example applications, code and designs, or simply give your opinion on a subject.

I use the excellent WordPress blogging application, in a self-hosted environment. You don’t need to do this since there is a hosted version at WordPress.com, or you could use Blogger, another popular blogging platform, provided by Google.

The key to blogging is talk about what you enjoy, don’t just keep it technical. Blogs should be an extension of you, not an avenue for pretentious comment; you’ll soon be found out!

If you go the self-hosted route, you’ll need a domain name, hosting provider and obviously a blog application. I have listed a few below that can get you started.

Domain Names:

Hosting Providers:

Blog Applications:

If going the self-hosted is all too complicated for you or you simply don’t want the hassle that is associated with self-hosting, all is not lost. WordPress.com and Blogger are for you.

Blog Hosting Providers:

Both services take the onus away from the user when it comes to management (backups, plugins etc). At the simplest level, all you need to do is create and publish the content.

Join feed aggregators

To get noticed in the blogosphere, you can’t simply rely on the Google, Yahoo! and Microsoft search engines ranking your site. You will need to alert your peers to the fact that you’ve created some content that is worth reading. You can achieve this with feed aggregators.

Below I list a few that I use:

If you use WordPress, then you’re in luck. WordPress has a service called Ping-o-matic, which updates different search engines when your blog has been updated. You can also add your own services to ping and therefore notify the service of new content.

Comment on Blogs

Commenting on blogs is another great way of getting yourself known as well as offering an opinion. Since comments allow you to include a link back to your website, try and comment as your brand.

One tip, try not to be defamatory towards the blog owner, or others unless you have a strong justification for doing so. It’s all about the karma!

Join Micro-Blogging Services

If blogging is not your thing or you don’t have time to write articles, there are a number of blogging and, more importantly, micro-blogging services available to you that allow you to get your thoughts out into the wide-world.

Such services include the not-always-venerable Twitter, the feature rich Pownce, the new kid on the block Plurk and the blogging service, Tumblr.

Building a following will allow you to announce to your followers important events and ask questions of them.

What’s Next

In the next part of this series, I’ll talk about networking, a natural extension to publicising yourself on the web.

Launching Yourself as a Freelancer

Simon — Mon, 04 Aug 2008 13:54:56 +0000

You’re an experienced designer or developer with aspirations to become a freelancer. Shrugging off the corporate cloak —”It’s cosy! It fits well! You’ve had it for years!” — is becoming more and more common.

Most creative people are unable to make a living from the sale of their work alone and therefore becoming self-employed as a freelancer enables you to manage your finances more effectively by earning additional money from short- or medium-term opportunities.

Graphic design, illustration, photography, journalism, writing, web design and development, training and copywriting are some of the sectors that use freelancers on a regular basis. Infact, many freelancers I know don’t simply work in one area. For example, my working month is a mixture of web development, writing and training and this is not uncommon among my peers as well.

There are numerous other considerations. Freelancers can, when the market is buoyant, choose their contract location and duration. They can also decide the length of their holidays (although this isn’t always the case). This greater freedom brings a major responsibility; you have to find work. This can be easy when many projects are underway, but can be difficult at other times. Furthermore, you will have to manage your own finances, which may perhaps involve dealing with an accountant, filling in payroll, tax and VAT forms etcetera.

In this four-part series, I share some thoughts on what you may want to consider when setting up and ‘going it alone’. The detail is UK-centric, but much of what I say is transferable to other regions.

The first in the series is setting up a business.

Register a Company

To be a serious freelancer, you can’t simply do work ‘cash-in-hand’. Instead you will need to set up a company through which you will work. This is not a complicated task and there are a number of companies out there who will do all the hard work for you, albeit for a small fee.

You can check Companies House for the availability of your company name and submit the company formation directly through them if you wish.

Get an Accountant

If you’re like me and can’t be bothered (or indeed don’t have the time) to sit down every month to compile accounts, process payroll and submit VAT returns, it is a good idea to get yourself a trustworthy accountant who specialises in freelancing matters. Ask friends for recommendations, since it can be daunting task finding someone who will work for you.

The Inland Revenue in the UK and the Internal Revenue Service in the US will always want their money and on time, so it is important that you manage submissions correctly.

Join the PCG

The Professional Contractors Group (PCG) is an organisation set up to support contractors and freelancers. For a small fee per year, you can gain access to a huge knowledge base of articles on your chosen topic and they also provide support if the Inland Revenue come calling.

Get Insurance

Many companies oblige their freelancers to get Professional Indemnity (PI) insurance, which may, in some instances, also include equipment, Public Liability and Employer’s Liability insurance.

You can get away without having this insurance, especially if the company you work for has a dedicated QA team, which will soon catch any shoddy work before it is released live. However, it is always best to cover your back.

If you’re a member of the PCG, they can offer advice and discounts on PI insurance. This is quite good since the insurance can be relatively pricey!

What’s Next

The next post in the series will focus on publicising you and your company. This involves creating a brand, blogging and using 3rd-party services.

ColdFusion Is Hotting Up in the UK

Simon — Fri, 27 Jun 2008 11:56:10 +0000

In the past, the US has held a near monopoly not only in ColdFusion-based user groups, but also conferences, with CFUnited, cf.Objective() and the more general Adobe MAX leading the way.

But the landscape is changing and the UK is challenging for its share of the scene. 2008 is seeing a renaissance in the ColdFusion world following on from the buzz created around the release of ColdFusion 8 in 2007 and the eagerly anticipated future release of ColdFusion, codenamed Centaur. This buzz has resulted in not one but three conferences for 2008: CFUnited Europe was held in London in March, Scotch-on-the-Rocks was held in Edinburgh in June and soon we will see the return of CFDevCon.

The inaugural CFDevCon one-day-conference was held back in 2006, in Croydon, but in September 2008 it is heading down to what is arguably one of the creative capitals in the south of England, Brighton. The conference has not only become a two-day conference, but its scope has moved beyond simply Adobe-based products, with the introduction of Microsoft-based technologies, specifically IIS7.0, Silverlight and SQL Server 2008 and technology-agnostic topics such as Regular Expressions, Search Engine Optimisation (SEO) and Accessibility.

As with all great conferences, CFDevCon has a great line-up of speakers with the likes of Sean Corfield, Hal Helms, Peter Elst, Peter Bell, Aral Balkan and Simon Bailey, to name a few, all presenting sessions.

So, lets get excited people, support the conferences and user groups and evangelise ColdFusion.

Concorde

Simon — Fri, 30 Jun 2006 15:31:28 +0000

Aerospatiale-BAC Concorde supersonic transport (SST), along with the Tupolev Tu-144, was one of only two models of supersonic passenger airliners to have seen commercial service. First flown in 1969, her service spanned from 1976 to 2003. The 1973 oil crisis, along with political opposition and environmental controversy led British Airways (BA) and Air France to be the sole buyers. She flew most regularly from London Heathrow and Paris Charles de Gaulle to New York JFK. A crash north of Paris in 2000, caused by tyre debris piercing a fuel tank, grounded the fleet whilst modifications were carried out. This, along with her age, the unwillingness of Airbus to continue maintenance, and the downturn in US demand for flights in the light of the 11 September 2001 terrorist attacks, prompted BA and Air France to jointly decide to withdraw her from service in 2003. In retirement, Concorde remains an icon of aircraft history.