Ebay Facilitates Fraud Thursday, 18 March 2010

Won an auction of eBay for:

"You Won eBay Item:DELL E1705 INTEL DUO 2 GHZ, WINDOWS VISTA ULTIMATE (290295125189)"

I got that laptop nearly two weeks after I paid for it.

Shortly thereafter, I got it in to a local tech who, after about four days, informed me that the copy of windows that was installed was unlicensed.

It turns out MS Office, which was also advertised as being included in the auction, is also pirated.

Paypal Claim

I immediately filed a complaint with the payment system, Paypal "Item significantly not as described". The claim was requesting the seller to provide a license key for Windows.

The seller could not provide a license key for windows because he does not have one. He decided to make the irrelevant excuse "I lost the CD" to paypal, and somehow, that worked.

On March 20, 2009, I receieved the email from paypal stating:

We will notify you if further action is required.

I called paypal and the representative said I would receive contact from paypal by April 17 (IIRC), however that never happened and Payapl closed the claim on May 24, 2009, notifying me with the following:

Paypal Case Details

We have concluded our investigation into this case. Unfortunately, 
at this time we are unable to decide this claim in your favor.

-----------------------------------
Case Details
-----------------------------------


As you can see, there are no "case details" there; the entire section is completely blank.

As soon as I received this, I called Paypal to ask why the case had been closed. The Paypal representative could not provide a reason, nor could he state what, if anything, paypal had done. He reopened the case and stated that a Paypal representative would contact me.

Paypal did not contact me, but instead closed the case again.

I went through the process of calling Paypal again, waiting on hold for a long time, and again talking to a rep. The case was reopened, and then once again re-closed, without any evidence that paypal had actually done anything to investigate the claim.

I have saved all of the email communications with Paypal. The responses from Paypal indicate that the paypal representatives failed to read my messages and failed to read the auction title which was included in the message.

Paypal has provided no evidence to having done anything to investigate my claim.

Back to Ebay

After Paypal failed, I called ebay. I made many calls to ebay, each time having to restate everything from the beginning. I received follow-up email from rswebhelp@ebay.com stating that I should contact the police, file a complaint with IC3, and file a mail fraud complaint with USPS.

Ebay Action

Like paypal, Ebay ignored many, if not most of my emails. Of the emails that I received a reply to, the responses do not include answers to the questions. They are a top-reply of mostly irrelevant parroting of what appears to be copy'n'pasted information on how to call the police, file a claim with the post office, or contact IC3. I have done all of those things.

Ebay stated that they work closely with the police. I provided rswebhelp with the police report number and requested for them to call the police but the request was ignored. What ebay says and what ebay does do not match.

The San Francisco Police officer I reported to told me that the case would be only paperwork for them. He would not even look at the URL. I cannot force them to change how they operate.

The Seller

I followed up with Dave Kaercher by sending email and by calling. The phone message I left was not replied to and the email (all emails I have sent him) was ignored. I did get through a week later and told Dave the problem and that I was seeking a refund of money I paid. Dave said "we don't have a deal" and that was the end of the conversation.

The computer has not provided me with the use that could be expected out of a computer with legal, licensed versions of Windows Office.

Instead of using Windows, I have been hobbling with a cracked OS for 1 year. The OS frequently restarts (in failed attempts to run important security updates).

Instead of the expected use of Microsoft Office, Launching Office errs with: "

Microsoft Office Genuine Advantage

  [logo] This copy of Microsoft Office is not genuine.
  Please excuse this interruption. This copy of Office did not 
  pass validation. Click Learn More for online details and help 
  identifying the best way to get genuine Microsoft Office.
              [Learn More] [Remind Me Later]

Clicking "Learn More" leads the web page: Genuine Microsoft Software

I have actively pursued this for over a year, with several emails and calls to ebay, paypal, and Dave Kaercher. I am posting the seller's personal information on my site.

Dave Kaercher

Dave Kaercher: I told you I would do this. I clearly requested licensed copies of what I paid for. I stated this in emails to you and in the paypal claim. You made excuses and ignored those.

I told you two weeks ago by email (which you ignored) and by phone call two weeks ago that I would post your information on my site.

Dave Kaercher's Personal Info

Dave Kaercher GRI, QSC User ID: redbirds04 Name: Dave Kaercher website: wesellmore.com City: Colorado Springs State: CO Country: United States Phone: (719) 282-1681

Lesson Learned

Don't buy things off eBay!

EBay knowingly facilitates fraud. EBay makes money by helping criminals defraud consumers and as such, is guilty of fraud.

Dave Kaercher is in good standing with ebay, probably defrauding other victims. He continues to promote auctions for various things including fake steroids over the past year. It is clear that eBay does not care to take this seriously.

Anyone shopping for items should consider that what is sold on ebay might be illegitimate (pirated, counterfeit, etc). In the case that the item is illegitimate, ebay probably won't do anything about it.

Technorati Tags:

Posted by default at 11:00 AM in Uncategorized

JavaScript Trends Friday, 30 May 2008

I came across a blog post yesterday that had a lot of misinformation. The post had received several comments and trackbacks thanking and commending the author for his "helpful" post. At first I was mad. "How can these people give this guy credit for misinformation," I thought. I wrote up a comment correcting on various points, intending to publish it on the author's blog.

Thankfully, my comment could not be posted due to some problem with the weblog. I am thankful of this because I ended up thinking about the problem on a greater depth.

I decided to respond here, providing a review below. I was more bothered by the phenomenon of people eager to learn misinformation. The more I thought about that phenomenon, the more I realized that it's not the author's fault, it's just the way things are. I discovered a part of the web that I want to change.

The expert, in this case, is Alex Russell, of Dojo fame, as Ajaxian likes to call it. It doesn't really matter who it is. In fact, it could have been me several years ago, when my JavaScript knowlegde was not as strong. I have written some really awful javascript that fortunately did not become famous.

My initial technical responses to the blog entry, which I have cut and snipped, are interspersed below. I have done my best to not take the author out of context and provide clear, relevant feedback. My real "response" starts below the proceeding technical response.

Technical Response

alex:

Everything in JavaScript is an Object. Even functions

Not true.

Fact: There are primitive values, too: undefined, null, true, 3, and "foo" are all primitive values. Not objects.

alex:

Every object is always mutable

Fact: An EcmaScript object itself is always mutable, but property-setting will not be always successful and error-free.

  1. Host objects do not need to implement setters for each property. For purpose of providing a relevant example to back up my claim:

    function fixEvent(e) {
      e=e||event;
      e.pageX = 1; // getEventPageX(e);
    }

    - will cause an error in Firefox. The pageX property actually needs a patch, because creating events, the pageX property doesn't get set correctly (bug 411031). So the argument "every object is always mutable" leads to developers doing things like writing a "fixEvent" function. It is not safe to do so.

  2. Some properties are tagged ReadOnly. A String or Function object's length property, for example.
alex:

The dot operator is equivalent to de-referencing by hash (e.g., foo.bar === foo["bar"])

Fact: The two property access operators .<Identifier> and [<identifier-string>] perform identical operations.

alex:

The new keyword creates an object that class constructors run inside of, thereby imprinting them

False.

Fact: There are no class constructors. No classes in the current release of EcmaScript 262 r3.

The new operator (an operator) creates a new object in context of the function on which its called. Nothing gets imprinted.

alex:

Functions are always closures (combine w/ previous rule to create OOP)

If used very carefully, closures can be used to mimic some of the constructs found in OO languages. However, to say that closures "create OOP" is false and misleading.

alex:

The this keyword is relative to the execution context, not the declaration context

There is no "declaration context". You seem to have made this up as a way to describe the way you think JavaScript works.

alex:

The prototype property is mutable

Not informative.

Fact: A property is a reference.

If the property's value is a native EcmaScript object, then it will be mutable. It goes without saying that this is true even if the name of the property is prototype.

Considering a prototype property of a function, where the prototype's value is an EcmaScript object: {}, then it is mutable (as discussed above).

alex:

Jeremy: great clarifications. Thanks.

Jeremey provided a false statement with code that was confusing. Jeremey wrote:

y = new Foo();
assert(y.gimme() == 2);

But:

button.onclick = "alert(y.gimme())" will error rather than alerting "2", because in an event handler, "this" refers to the elm which sourced the event.

Fact: This is a perfectly valid assignment of a string value to an onclick property of a button object.

Jeremy's example of a button object with an onclick property assigned to a string value:-

button.onclick = "alert(y.gimme())"

- the string "alert(y.gimme())" is not eval'd.

(Continuing Jeremy's post)

because in an event handler, "this" refers to the elm which sourced the event.

Has relevant meaning in a script:-

// assign function to onclick.
button.onclick = y.gimme;

Definitely not in:

<body>
<script>

function Foo() {
this.x = 1;

this.gimme = function() {
return this.x + 1;
}
}

y = new Foo();
</script>

<button onclick="alert(y.gimme())">click me</button>

</body>
Result

When the button is clicked, the method gimme is called with y as the thisArg. The number is returned and displayed as a string in the alert box.

Thanking Jeremy for Jeremy's mistake and calling the mistake a clarification does not make Jeremy correct. It is not helpful to Jeremy or anyone else.

alex: (To Dethe):

My statement about objects (variables whose .constructor property in some way descends from Object) was correct.

Fact: No, it was not correct. Now you've made another misstatement.

Fact: (new function(){}) - is an object, not a variable. Its - constructor - property doesn't "descend" from Object, either.

Fact: var i = 0, len; - is an example of two variables that do not have a .constructor property.

Fact: The term "descend" has no meaning in context of describing a constructor property; it is fictitious terminology to describe the way you imagine JavaScript works.

(alex: To Dethe, continued):

Also, the hash deference is exactly equivalent. That there's no way to have a JS lexer handle an variable name with spaces in it in no way detracts from the equivalence, it just means that the dot operator has to follow the rules of thing that aren't string literals.

Fact: There is no "dot operator."

Fact: The fullstop, "." also has meaning in numbers, for example, 4.2.toString().

Fact: There are two property access operators: "." and "[]". There are many "things that are not string literals." The "." property access operator can be used only for valid identifiers.

I think you were using the term "de-reference" to try to describe getting a value. Now your using "deference". I'm not sure what to make of that.

The Real "Response"

My real "response" in the larger sense, is that I'm taking a stance. I'm going to try and change the web.

Think 2.0

A who's-who in web 2.0 is destructive to the web, in a way. The idea should win, not the individual. The popular libraries have spread ideas for web development across the web but they have also played a big part in the "whos-who" trend that I see.

What I see demonstrated in the blog entry that I replied to is a misunderstaning of JavaScript that received positive acknowledgement and review. The question is: Why? Is it because the entry is simple and clear?

Ask Why

If a "famed" individual can be commended for teaching JavaScript facts that are false and inaccurate, what does that say about what web developers value in the web? Where are we headed? I am hoping that this trend will reverse itself. The reversal of this trend starts by questioning things. I question things and you should, too.

Angry, Bitter, and Vile?

As much as I've pointed out bad parts of Dojo and Google (And jQuery and PrototypeJS and YUI), I probably sound like a bitter, angry person. In fact, there are people who would love to have you believe that I am nothing more than that. I've made my observations and shared them, even at the expense of sounding mean and bitter. I want the web to change, and in my next entry, I'll clearly explain the direction I want the web to turn.

Technorati Tags:

Posted by default at 1:53 PM in Uncategorized

The JavaScript Guru Tuesday, 6 May 2008

Programming is not "wizardry." I am not a "JavaScript Ninja" or an "Ajax Guru."

What, no Sword?

Programming is a scientific discipline. It requires zero mystical powers (although I have been known to "disappear" before long meetings). Programming is hard work. If you want a guru, go climb a mountain (results not guaranteed).

More Yellow Flags

I sometimes get job descriptions and do interviews that can put me off. "JavaScript Ninja" is one flag.

"We want someone who can Hit the Ground Running and Work Independently," is another more subtle flag.

This usually means they want someone to work alone, not with the team.

They Don't Want what's Good for Them

Projects where the team doesn't want to deal with the "details" (actual problem-solving "work"), can sometimes lead to hiring a contractor to "just get it done." (offload tasks) This can be harmful.

If carried out, this can lead to the team not understanding the code as well. It can also make it very difficult for the contractor to get his job done.

"Hiring a guru" can be like deciding to use a library (Prototype JS, jQuery, et c) as a Golden Hammer. There are no magic solutions.

Not surprisingly, the desire for a "JavaScript Ninja" often goes hand-in-hand with a request for one of these libraries.

Teamwork and Ownership

The reality is that the more successful projects have better cooperation and communication. Hiring a "guru" or "wizard" contractor is usually carried out for the worst reasons ("we're behind"), and with the worst process ("let's have the contractor own this part"). Hiring new people takes time. Even a contractor. It also takes time integrating the new person, explaining the problem space, tried solutions, project status, and workflow. So hiring a contractor to "catch up" isn't generally a good idea.

Having code in the project that is owned by the contractor gets the company in technical debt. It accomplishes this by leaving the company with code that they do not understand.

Having the contractor sit and work apart from the team often makes it much harder for the contractor to do a proper job.

Change

When [x_new_feature] is introduced, it might require change to the existing code. If it's a new feature, then it often means that the requirements changed in some way. Often the existing code is not designed to accommodate the new change (normal). If the contractor is asked to build [x_new_feature], and he is working alone, well, then he either has to step outside his role and change existing code (can get him fired) or the new feature will get built in a hackish way around the other non-changing code that is owned by the team.

It is beneficial for the company employees to understand as much of the company code as possible. A contractor should be working with the team, trying to understand their problem with them, collaboratively, and helping them to find solutions to the problems.

Hire a Ninja?

I am very cautious of anyone who presents himself as a "ninja" or a "guru". Posting an ad for "JavaScript Guru Wanted," is asking for someone who is both overconfident and underqualified, and that is disastrous combination of characteristics in a potential newhire.

Pair programming, metaphor/ubiquitous language, daily standups should include the contractor. With complicated applications, TDD and Pair can be practiced in a way that can significantly benefit the successful outcome of the project and collective understanding of the code. Even with a contractor.

Let the contractor know how your team works and how he's expected to fit in. This will help avoid misunderstandings and can help your team find the right contractor for the job.

Technorati Tags:

Posted by default at 8:15 PM in Uncategorized

APE JavaScript Library Monday, 5 May 2008

Frustrated with every other JavaScript framework, I have decided to write something better.

Points

  • Minimal Framework, mainly used for AOP and OOP functionality
  • All code is tested using YUI Test (TDD)
  • AOP Event System with asynchronous error handling
  • Namespacing
  • Modularity, Cohesion, Packaging
  • No browser detection
  • JSDoc

Here it is: APE JavaScript Library

Testing

By using a test driven approach, I was able to avoid problems that I found in other libraries.

APE Core

The core of APE is so small that the overhead of adding APE to a project is significantly less than that of other libraries.

I generally don't like a lot of the libraries that use a "GOD" object approach. These objects can be recognized by being undefinable by more than a few words. The approach is quite popular and annoys me to no end. How do you describe the dojo object, for example?

The APE object itself is defined in APE.js, providing only the most basic things that a framework would need: 1) Object creational features, and 2) a core namespace. Although some might argue that a library core needs more than that.

The APE object is only 3k minified and less than 1k gzipped. The size is not the point. The point is that APE is not a kitchen-sink, or God object.

Help Wanted

You can join, too! Here's what APE needs:

New Features

There is much more that can be added. For example, some ADT's: Resizable (croppers, windows), FormSerializer.

SVN and Bugzilla

I still need to add hosted SVN to the directories and install bugzilla.

Performance Tests

I've always been big on performance, and not just for JavaScript but all areas of life, and I am very competitive in nature.

APE needs benchmarks to compare with other libraries. This will provide useful analysis for other library authors who aspire to have code that is as performant as that in APE.

Anyone interested in joining this project contact dhtmlkitchen - at - gmail - dot - com.

Technorati Tags:

Posted by default at 7:26 PM in Uncategorized

Event Notification System Friday, 4 January 2008

An Event Notification System is an object that manages notification of events to multiple callbacks. The Event Notification System uses an Event Registry to store the callbacks as bound methods. When the event fires, the callbacks are invoked.

Event Registry

An Event Registry is a store of bound methods. An Event Registry is used by an Event Notification System. The Event Notification System is tightly coupled with the Event Registry. Sometimes it is referred to as the Registry. In reality, the Registry is just a data structure and the Event Notification System is a behavioral object.

Almost Every JavaScript library has an Event Registry, or at least some way of dealing with event notification.

For example:

// YUI:
YAHOO.util.Event.addListener( link, "click", linkClickHandler, thisArg );

// Prototype: (not a registry, but the old 'addEvent' function renamed).
Event.observe( link, "click", linkClickHandler ); 

// Dojo:
dojo.connect( link, "onclick", window, "linkClickHandler" );

They're all different in how they work.

The Event Registry is useful for a few reasons.

  • It allows multiple callbacks to be assigned to a function call.
  • Provides a usable alternative to attachEvent. Internet Explorer 7 and below has attachEvent/detachEvent. The callback function for attachEvent executes in global context (this is window), not the object it was attached to.

A good Event Registry solves these problems. A good Event Registry also allows for context resolution with an optional thisArg. A good Event Registry also allows custom events to be registered using the same interface.

A poorly designed Event Registry concerns itself with things related to native events (DOMContentLoaded, keyPress, et c). A poorly designed Event Registry does not pass an event object to the callback (perhaps trying to use eval to pass varargs).

Error Handling in an Event Notification System

Callback Errors Should not Break the Registry

A good Event Registry does not allow any callback to break the registry.

One common problem in most Event Notification Systems (such as Dojo, Mochikit, YUI, and jQuery) is that they allow the callback to break the System. If a callback fails, it prevents subsequent callbacks from firing. A callback should not be given the ability to break the Registry.

Here's how to break a Registry that doesn't consider errors:

var passed = false;
addCallback( link, "click", function(){ setTimeout(checkTitle, 500); } );
addCallback( link, "click", function(){ throw Error('bad'); } );
addCallback( link, "click", function(){ passed = true; } );

function checkTitle(){ 
    if(!passed) 
        alert("registry broken: second callback did not fire.");
    else 
        alert('passed');
}

Callbacks sometimes throw Errors. It is important for the Event Registry to consider this and take the responsibility to handle these errors properly. If an error occurs in a callback, it should not break the Registry.

It should be guaranteed that all callbacks fire, even when earlier callbacks throw errors. This is a natural expectation; it's exactly how DOM Events work:

DOM Events Test

(function(){
var s = document.getElementById('r-test');

var el = document.getElementById("registry-dom-event-button");
if(!window.hasDocumentListeners) {
    el.addEventListener( "click", setUpCheck, false );
    el.addEventListener("click", throwError, false );
    // setTitle must fire.
    el.addEventListener( "click", setTitle, false ); 

    window.hasDocumentListeners = true;
}
function setUpCheck(){ setTimeout(checkTitle, 500); }
function throwError(){ document.title = ""; throw Error('bad'); }
function setTitle(){ document.title += 'ok'; }
function checkTitle(ev) {
    if(document.title != "ok") {
        alert("DOM Events broken: setTitle did not fire. " + document.title );
    }
    else {
        alert("passed");
    }
}
})();

Result and Analysis

There should be 1 error and an alert passed. This indicates that after the error happened, the setTitle callback successfully fired.

This example assumes:

  • Callbacks fire in the order in which they were registered.
  • The bad error in the first callback does not stop subsequent callbacks from firing.
  • The button supports the EventTarget interface (not in IE7).
  • The button supports onfocus (not in safari bug 16331).

Proper Callback Error-Handling

Throwing the error in a separate thread allows the callstack to continue without breaking. Any errors that are thrown are thrown in the correct order in the callstack. The Event Publisher's fire function would have something like this:

try {
// If an error occurs, continue the event fire,
// but still throw the error.
  callback.call( thisArg, ev );
}
catch( ex ) {
  setTimeout("throw ex;", 1); 
}

The one subtle issue is that setTimeout uses global scope, like the Function constructor, not like eval, which runs in the calling context's scope.

A closure must be used to preserve the ex variable.

try {
// If an error occurs, continue the event fire,
// but still throw the error.
  callback.call( thisArg, ev );
}
catch( ex ) {
  setTimeout(function(){ throw ex; }, 1); 
}

Event Registry Test

The remaining problem with the above code is that the error condition is untestable. Writing a test suite forced me to realize this and I changed the design.

try {
if(csi[0].call(csi[1], e) == false)
  preventDefault = true; // continue main callstack and return false afterwards.
}
catch(ex) {
  APE.deferError(ex);
}

Where APE.deferError is defined:

deferError : function(error) {		
  setTimeout(function deferError(){throw error;},1);
}

I have included the source code for my own Event Registry, along with this test, which shows how I managed to test APE.deferError.

Performance?

Wrapping each callback call in a try catch might seem to be bad for performance. I tried it with mousemove event on my drag code, dragging multiple drag objects at a time (example), and it seemed fast enough; I did not notice performance problems in any browser. There is most likely some performance overhead using this approach, but I did not find a need to write a benchmark.

src should never be a string. Although this may seem obvious, YUI actually allows src to be a string, where the string represents an element's ID. The document is polled regulary until the element with the id matching string is found and then the callback is attached to that element. If the element has been renamed, the document is still polled and silent failure occurs.

This can lead to silent failure or corrupted application state if the element is not found. It is not recommended.

Packaging and API Design

The Event Notification System is a low level component with no external dependencies.

Being a low level component, the Event Notification System should be maximally stable (no efferent couplings), and maximally abstract. In this case, the Event Notification system is maximally abstract because it can't be subclassed or used independently.

Stable Dependencies Principle

Depend in the direction of stability

Stable Abstractions Principle

A package should be as abstract as it is stable.

Reuse Equivalence Principle

The Granule of Reuse is the Granule of Release.

The Event Notification System is a low level component with no external dependencies. It is intentionally packaged as a single, tested unit. It amplifies the essential (event notification) and eliminates the irrelevant.

Creating special cases for handling DOM events (keyCode, et c), would reduce abstraction. These special cases are perfectly valid, but do not belong in the Registry. Special case needs can either be hard-coded into end-implementation code (using feature/capability detection) or, if the special-case logic is complex, programmed into an object that performs a task (such as an Adapter object).

An example of an Adapter object would be a Content Load Adapter or a KeyEvent Adapter (key events are highly inconsistent across platforms). Such objects would be slightly higher-level and, having at least one dependency, would be less stable (though this is not a bad thing).

Department Store JavaScript

[insert_popular_library_name_here] usually include more code than any one application could possibly use in an attempt to cover the needs of every application.

Libraries that add more functionality into one module than is usually needed, or create modules that are not cohesive do so in spite of commonly known software package design concepts. The one-stop library approach is appealing because it allows developers to "stop cobbling bits of javascript."

Performance (Again)

Load Time Performance problems can be acheived by creating custom javascript builds on the server. Hand-rolled "combination" files or utils files are fine for web sites with fewer pages. Sites that don't require 200k+ of additional javascript should not include such functionality.

Technorati Tags:

Posted by default at 9:42 PM in Uncategorized

 

*AnimTree
*Tabs
*GlideMenus
*DragLib