Serving Python Web Apps

Newcomers to the world of Python are faced with a bewildering array of options for developing and serving their web apps. Python’s official documentation does little to cut through the clutter.

Enter Graham Dumpleton. I’ve never met him, but he appears to be the Python community’s unsung web hosting ninja. I highly recommend reading his recent Hosting Python Web Apps slide deck — it cuts through all the clutter. (You can find video of the talk on Youtube, too.)

The bottom line:

  • There are approximately a million different Python web frameworks. All of them speak WSGI. Choose one. For today, at least, use WSGI rather than FASTCGI/uWSGI/what not.

  • The most common architecture for serving python web apps is Apache + mod_wsgi running in Daemon Mode. Apache should be used to serve static content.

  • The second most common architecutre is nginx + gunicorn + supervisor. Nginx should serve static content.

I’ll go further and say that, while it’s fun to explore the vast world of web frameworks, it’s probably not necessary. Start with Django 1.4 and if it really doesn’t work for you, look further afield. Also: Apache is a rock-solid option — gunicorn feels like the flavor du jour to me. Properly configured, Apache runs very nicely even on memory-starved VPS instances.

Kibitzing Samurai

In the past few months, I’ve had the pleasure of working with several friends on projects they’re thinking about. I’m merely a glorified kibitzer, but the opportunity to think through a variety of apps and business models has proven immensely educational.

From past experience, I know this process can get a little torqued. Feedback is taken personally that shouldn’t be. When it comes to this, here’s what I say:

I respect you immensely, otherwise I wouldn’t work with you. But I have no respect for ideas. Not yours, not mine, not anybody’s. Think of me as a samurai that cuts down ideas no matter who holds them dear. The ideas that manage to survive? Those ideas I have respect for.

This notion informs all the product work that I do. It causes an immense amount of pain. But I believe it leads to better products. After all, ideas are worth little except to the extent that they inform and guide our execution. The wrong ideas guide us nowhere.

AWS: Acoustica (♫)

Last night’s Alarm Will Sound concert at Town Hall Seattle was epic. They performed several tracks from Acoustica, their album of Aphex Twin covers. It’s amazing what a 20-piece classical music ensemble can pull off when they are artistically fearless.

The SpaceX cost record

Here’s to the crazy ones.

The latest from Cloakland

Updates and goings on in the world of Cloak, my primary project-of-the-moment.

24/192 Music Downloads

This, a thousand times.

There is no reason to distribute 24-bit, 192kHz music to listeners. No sound system, and no ear, could ever benefit. There are reasons, in ultra-high-end recording sessions, to use a 24/192 workflow.

TODO Review?

Does anyone know of a review that compares Things, OmniFocus, Flow, Sprintly, Asana, Trello, Pivotal Tracker, Basecamp, Clear, Producteev, GitHub Issues, Firetask, Remember the Milk, Toodledo, Tadalist, 2Do, reQall, Put Things Off, Nubi Do, Orchestra, Do.com, and Google Tasks?

Because I sure could use one. ;–)

Why does nobody use SSL client certificates?

We we started thinking about Cloak, we realized that users don’t “do the right security things” because, at least today, security interfaces (when they exist) are confusing and obscure. By bringing beautiful design to the tough technical problem of network security, we figured we could make true security available to a much broader audience.

SSL client certificates are another great example of low-hanging security design fruit.

Destroy All Software Screencasts

When I build software, I mostly think about the problem I want to solve and the experience I want my users to have. This is to say: I tend to pay less attention to the nuts and bolts of writing great code.

Enter Gary Bernhardt’s excellent Destroy All Software Screencasts. For $9/month, I get a wealth of deep thinking about the art of software development, delivered in weekly bite-sized chunks.

A good example is DAS’s four-part series on testing untested software. Gary takes a rails app he’s never seen before and focuses on writing tests for a single controller method. In some sense, tests are dual to the code they’re testing. However, when testing in isolation, tests can often reveal structure and dependencies that aren’t readily apparent in the code itself. Gary uses the tests he writes to motivate a refactoring of the original controller; the series ends with both elegant and well-tested code.

See you at PyCon!

Cloak was selected as “Judge’s Pick” from a large field of great Python-using startups. We’ll be presenting at PyCon’s Startup Row on March 9th. We’re excited to be there — if you’re around, stop by and say hi!

Mountain Lion

Today’s surprise announcement of OS X 10.8 is welcome news to the Apple developer community. It’s a clear signal that Apple continues to see the Mac as a core asset. Better: the new annual release cycle shows that Apple has resolved long-standing engineering bottlenecks.

There’s a lot of great press today; it’s worth reading both Daring Fireball’s behind-the-scenes take and Macworld’s extensive coverage.

Mountain Lion is an unsurprising but welcome progression from Lion. It brings Apple one step closer to having a truly unified ecosystem across all its devices. We get Messages and Reminders today; will it be surprising when iTunes is broken into Music, Video, and Store apps tomorrow?

There are some important considerations for indie devs. For starters, we’re going to have to revisit our platform support strategies. At the moment, perhaps 30% of my users are still on Snow Leopard. When Mountain Lion ships this summer, my gut feeling is that Snow Leopard users will stay put, while Lion users will probably quickly upgrade. It wouldn’t surprise me to see a 65% Mountain Lion/5% Lion/30% Snow Leopard distribution, although time will tell. For the foreseeable future, I plan to support the latest OS X along with the previous two releases.

Mountain Lion gives developers several reasons to revisit their relationship with the App Store. In addition to being a welcome new security feature, Gatekeeper also signals Apple’s commitment to supporting apps not acquired through the App Store. This is great news for my latest app, Cloak, which fundamentally cannot meet the new app sandbox requirements. On the other hand, Mountain Lion introduces several new APIs, like iCloud Storage, that are only available to App Store apps. I expect this trend to continue. Today these APIs are a carrot; tomorrow they could become a stick. Developers who want to keep their apps on the cutting edge will almost certainly have to buy into the App Store ecosystem. Developers contemplating entirely new apps would do well to make sure they can live in that ecosystem.

✝ Gatekeeper is actually present in OS X 10.7.3, but there is no GUI exposure. In addition, the latest XCode for Lion supports acquiring Developer ID Certificates, a new kind of certificate for apps that aren’t targeting the App Store. To turn on Gatekeeper in Lion, use sudo spctl --enable; the spctl man page has more details. One last piece of the puzzle: Gatekeeper only applies to quarantined files. The easiest way I know to quarantine a binary is to mail it to yourself with Mail.app.

OK Go 'Needing/Getting' Video

They outdo themselves yet again. I assume their next collaboration will be with Burt Rutan aboard SpaceShipOne?

Girl Walk // All Day

The notorious Jesse Chan-Norris sent this my way. It shows in Seattle this weekend. Mind still blown.

Fujiya & Miyagi: Transparent Things (♫)

When you need excellent Krautrock, Fujiya & Miyagi’s Transparent Things delivers. Never fear: they’re only pretending to be Japanese.

The seedy side of software

I’m getting older. Booth babes, apparently, are not.

For the most part, MacWorld Expo was family friendly; there were only a few booths where flesh was more present than product. The most egregious of these was run by ZeoBit, the makers of MacKeeper.

MacKeeper has always struck me as seedy. It’s billed as a bundle of essential privacy and security tools; I’m skeptical of its merits. Much of the bundle seems to duplicate standard OS X features: why do you need Internet Security when Safari already has anti-phishing, or Backup when Lion already has Time Machine? ZeoBit would have you believe that, sold separately, their apps are worth over a thousand dollars. Thankfully, you can have it all at the low, low price of $38.95.

ZeoBit engages in scummy marketing tactics, many of which were pioneered by malware authors. They purchase dubious ad space on low-rent web property — the kind of property a naïve surfer might be unlucky enough to visit. They work hard to break pop-up blockers. They try to make their ads look like content or native security warnings. At expos, they apparently use a different kind of pop-up to draw attention.

I had the pleasure of meeting several above-board security and privacy companies at MacWorld. Guys like SecureMac are out there fighting the good fight. With Cloak, we’ve tried to raise the bar on several fronts. We’ve tried to make it easy and elegant to stay safe. Moreover, we’ve tried to be as open and transparent about what we do as possible. But MacKeeper? I don’t think I trust them. Not one bit.

✝ I feel dirty mentioning this product by name; I won’t honor it with a link. If there were a hypertext equivalent of “unasking the question,” I’d unlink the link in a hurry.