OpenGL ES 2.0 Book

I've been getting a lot of questions lately about the status of my OpenGL ES 2.0 book for PragProg. What I've been telling people is: "it's about half done but I have no idea when I'll be able to finish it". To say I've been busy lately would be an understatement of epic proportions. As a part-owner of a business in its first year, being too busy is a great problem to have, but it does take its tolls in both subtle and not-so-subtle ways.

When you combine how busy I am with the fact that I've been completely unable to get even ballpark information about when Xcode 4 will go GM (the book is heavily based on Xcode 4), it means I simply cannot nail down a production schedule for the book. Even if I had time to finish the book right now, it can't be published until the Xcode 4 NDA drops. It also makes no sense to revise the book to a version of Xcode which is soon to become obsolete.

As a result, today, I made the difficult decision, along with my editor at Prags, to indefinitely shelve the OpenGL ES 2.0 book project. I would have liked to keep the project open and work on it whenever I have time, but that wouldn't have been fair to my publisher. They have to plan their production pipeline very carefully and a book with no set timeline throws a real monkey wrench into that process, which I really don't want to do. The door has been left open for me pick the book up in the future if and when I have time, but for now, it's coming off the production schedule to free up resources for other authors' books.

I have requested permission to post the existing seven chapters of the manuscript to my blog (tweaked so I'm not violating the Xcode 4 NDA, of course). From a contractual and legal point of view, I cannot just post what I've written without the the permission of my publisher. Prags has been nothing but fair, patient, and a pleasure to deal with and I want to make sure I'm just as fair to them and also comply fully with my contract.

However, if I can find a path to posting the chapters that's legal, ethical, and doesn't harm my relationship with Prags, I will do so.

Read more »

Complaining About Success

If you want to see how little sympathy you can get from those around you, try complaining about being successful. It just doesn't tend to be a problem over which people shed tears on your behalf. But I'm actually not here to complain. I'm really thrilled that MartianCraft is growing steadily and, more importantly, that we're getting interesting work.

I did think it was worth popping in here to explain my absence of late, however. I've got several partially written posts sitting in MarsEdit, including a couple for my recently-started and just-as-lonely personal blog. But time has become a scarce commodity for me, and will likely remain that way for at least the next month or two, possibly even longer. Even my OpenGL ES book for prags has suffered lately as I've been basically working double-time trying to catch up on my workload. Even the move to Florida is being affected, as we probably won't get our house on the market now until the new year.

The fact that I've been doing so much coding does mean that I've got some great ideas for blog posts, so hopefully once the dust settles, I'll have some goodies for you, but bear with me in the meantime.

Oh, and a somewhat related note. A client of MartianCraft is looking for a really mobile developer to work in New York City. They'll be happy with any mobile experience, with preference for iPhone or Android experience. Having both is ideal. This client is a very large media company and you'd basically be responsible for leading one division's mobile efforts, starting with maintaining their existing apps, but eventually eventually extending them and building new ones. It's a great opportunity for the right person. If you're in New York or willing to relocate there and have some good mobile chops, drop me an e-mail with your resume (my main e-mail is my twitter name at mac dot com or you can send them to jeff at martiancraft dot com) and I'll put it in front of the hiring manager.

Read more »

Happy New Year! Closing Out 2009

Well, Happy New Year!

Thus ends (almost) my first full calendar year working exclusively with Apple technologies and also my first full calendar year as a published book author. I started working on Beginning iPhone Development in March of 2008, but because of the NDA and very beta-status of the early SDK releases, didn't start full-time writing on it until after WWDC 2008.

It's been a hell of a year. We finished the year on a positive note: More iPhone 3 Development shipped out a few days ago and some people have received it already. I've also heard that Beginning iPhone Development is fairly close to breaking 100,000 copies sold between the two editions. It's hard to say for sure if that has happened because of the way books are inventoried and sold, but our sell-through (books known to be in the hands of consumers) was over 75,000 several months ago. When you consider that Apress' expectation for our book when we contracted with them was that it would probably sell between 4,000 and 5,000 copies, that's really something. We were told before the book went to press that Apress would consider it huge success if it sold 10,000 copies.

I have to say that I love what I'm doing now much more than anything else I've ever done for a living, and infinitely more than what I was doing when I started writing the first book. I'm really glad I've been able to do this. I used to travel 48 or 50 weeks a year doing large-scale Enterprise software implementations. That was a realm where most of the challenges came not from the complexity of the algorithms (most of the work was pretty easy stuff), but the complexity of the social landscape and the politics of working in a large organization. As regular readers know, I'm not shy about giving my opinion even when it's unpopular, so you can imagine what I was like in highly-politically charged corporate environments. Yeah. I was miserable, even though I was good at it and it paid well. But the schedule was brutal. I'd leave my house like 2:00 or 3:00 am Monday morning or sometimes even Sunday night, and I'd get back late Friday night every week. I lived in hotel rooms and ate in hotel bars, and missed most of my kids' birthdays and other special events.

This is so much better. In many ways, this is the life. But, there's a downside to it as well, one that I've been aware of for a while but am only now coming fully to grips with: Even a "best selling" programming book doesn't really put the money on the table the way consulting does, and the blog doesn't generate any income worth mentioning. Some year-end financial calculations have made me realize that I've got some tough decisions to make about how I spend my time in 2010.

Books

At this point, I'm going to go out on a limb and say that I won't be writing any books in 2010. I really enjoy writing books, and have a couple knocking around in my head that I'd love to get out on paper, including a soup-to-nuts OpenGL ES book, but I really need to focus on projects that bring in money more effectively and more immediately (royalties take no less than six-months, and often longer to start rolling in).

Dave and I both have similar philosophies about writing books, and neither of us are willing to rush a book out just to capitalize on a trend or hot market. But that, combined with the way we work, means writing books is incredibly time-intensive for us and there's no way to avoid that without compromising what we believe. I'm not comfortable writing about something I don't fully understand, and it simply takes time to wrap my head around something well enough to explain it to others.

That being said, if someone came along and offered a huge advance for a book I wanted to write, I could be tempted. But given the reality of the tech book market, the chances of somebody offering the kind of money it would take to make it worthwhile are slim at best.

If 2010 goes well for me financially, though, I'd like to write another book in 2011.

The Blog

I have no intention of stopping work on my blog. I enjoy it, and some of you seem to as well. I will be more focused in 2010 and will mostly stick to technical subjects and covering things directly relevant to Mac and iPhone programmers. Writing lengthy opinion pieces is time-consuming and tends to provoke people in ways that I don't necessarily intend, even if I do get a lot of page hits from them. But I definitely do plan to continue posting installments of the OpenGL ES from the Ground Up as well as more virtual chapters for our existing books and code snippets that I write that might be useful to others.

The pace of new installments may not be as frequent as it was this past year, at least the part of last year when I wasn't actively working on a book, but the posts will definitely continue.

Teaching

I'm still thinking about whether I want to continue teaching workshops. It's decent money, and I rather enjoy it, but I'm not sure I want to get into doing regular travel again and I don't want the workshops to interfere with my ability to take on contracting work. I'll probably continue to teach, but probably not more than every other month or so. We'll see, though.

Conferences

I'm planning on doing a handful of conferences this year. I'm speaking at both NSConferences in 2010 and, of course, plan to attend WWDC assuming I can scrape together the money. I'd really, really hate to miss WWDC - it's my absolute favoritest week of the year - but unfortunately, it's not a sure thing at the moment. I've also been accepted as a speaker at 360|iDev San Jose.

Contracting

This is what I really need to focus on for the next year. It is my intention to stay working within the Mac and iPhone space if at all possible, so if you know of anybody looking to contract or subcontract an experienced iPhone or Mac developer, please do feel free to send them my way. Though I'm willing to travel occasionally, I am not interested in contracts that would require full-time travel or anything close to it. I'm also available for corporate training or reviewing code or application architecture. I'm a very experienced troubleshooter and have spent a lot of time investigating how to architect iPhone applications, so if you've got projects that are running into problems, I may be able to help get you back on track. As a general rule, I'm not currently looking for full-time employment, though there's a small handful of jobs (primarily at Apple) that I'd definitely consider if they opened up.

If you want to reach me about anything, you can send e-mail to jeff underscore lamarche at mac dot com.

So, on that note, I'm going to go enjoy my New Year's even and forget about anything to do with finances or the iPhone for a few hours. I wish you all a prosperous and enjoyable 2010, and I'll be back to posting in a few days.

Read more »

OpenGL ES Update

I know there's probably one or two people out there who would like to see another entry in the OpenGL ES from the Ground Up series.

The good news is, I started one a while back, right after WWDC. It's a fairly extensive introduction to OpenGL ES 2.0 and shaders.

The bad news is, I have no idea when I'll have time to finish it. I'm behind on writing the next book, plus I'm frantically trying to get ready for the iPhone Boot Camp NYC this weekend (boy, that snuck up on me). I will finish it at some point, though.

Read more »

Upgrading etc.

Sorry for the quiet week. Been suffering from the post-WWDC blues, a combination of being massively behind on my workload and massively tired.

I have updated several of my iPhone projects that don't work after upgrading to 3.0 so that they do, including a completely new version of the OpenGL ES Xcode template. The only problem is, I did all the udpating on a pre-release version of Xcode under Snow Leopard. I need to find some time to install the release version of SDK3 and "downgrade" the Xcode projects before I can post them without violating the NDA.

The next two installments of the OpenGL ES from the Ground Up series are, tentatively, drawing text and hit testing, although I may push those off and insert a OpenGL ES 2.0-specific posting in there first, because I know a lot of people are interested in the ES 2. stuff. Perhaps I'll write an introduction to shaders as my next one. In any case, I'm unlikely to get another OpenGL ES posting done until I've got a few more chapters under my belt, so probably two weeks or so.

In completely unrelated news, the inimitable Wil Shipley tweeted about an interesting blog post by somebody from the Microsoft camp today.

I can only assume this is the latest in their recent ham-fisted campaign to win back marketshare for their products. Other parts of it include a page of outright silly assertions labeled as "facts" and a $10,000 bribe to use IE8.

In this blog post, Guy Claperton insinuates that the twitterverse burst into flames over problems with the iPhone OS 3.0 upgrade. Now, it may be a little immodest to say this, but I think I probably have my finger a little closer to the pulse of the iPhone community than a "freelance journalist" who specializes in small business who is on Microsoft's payroll, and I didn't witness anything close to a meltdown from the 3.0 rollout. There were a few complaints here and there, sure, but that's to be expected with a major OS upgrade, and make no mistake, this was a major upgrade, and it's been only one year since 2.0, so that's pretty impressive. How long did Vista take, again?

Guy then goes on to insinuate that Microsoft users are smarter because they don't upgrade immediately.

How's that again? Really? I don't think I've seen a more blatant form of apologism out of anybody ever, including Microsoft. Right, people didn't upgrade to Vista because they were responsible and cautious.

Bullshit.

People didn't upgrade to Vista because it was a huge flaming pile of dog shit, and instead of fixing it, Microsoft spent millions justifying and defending it, essentially telling their customers they were wrong in the process. Advertising can do a lot, but it can't force people to buy dog shit that is currently on fire. Corporations didn't upgrade to Vista because it was expensive, required hardware upgrades, in many cases also required software upgrades, and offered no compelling new features.

Guy writes off "twitter going crazy for a few hours" to the "fan mentality".

Wow. Yeah, Microsoft doesn't want fans. Seriously, do Microsoft bloggers believe the stuff they write, or are they given an agenda from Marketing and then have to craft something that fits it, like some eighth-grade homework assignment, only in hell?

The fact is, fans are an indication that a company is doing something right. Every company has their fan-boys (and girls) - people who love that company regardless of what they do. But a critical mass of true fans - people who love a company's products so much they wait in line for them - is what companies strive for. It's an indication of success, and there's just no way to spin that to make it look bad.

The 3.0 SDK offered some very neat and very desired new functionality. People wanted the upgrade. Plus, the upgrade was free except for iPod Touch users, for whom it cost a small amount (about $10, if I remember correctly). A few upgrade glitches does not a Vista make, and it's hard to imagine that iPhone OS 3.0 could be labelled anything other than a success.

In related news, I am NOT standing in line for a 3Gs today, as much as I'd like to be. I'm being responsible and waiting for my next royalty check before upgrading my phone. This has been a crazy month for finances, between WWDC, a problem with my wife's car that set us back well over $1k. Also, our clothes dryer blew, our dishwasher blew, and a huge silver maple in our backyard fell down. Because of the latter, we had to hire first an arborist to asses the situation, then a tree removal company to come remove the fallen tree from our neighbor's yard, and then to remove a few other standing trees that posed similar threat of falling. Plus, my wife is taking my daughters on a weeklong trip to Florida to celebrate their birthdays.

So, as you're playing with your new iPhone 3Gs with all its wonderful features, extra memory, and extra speed, please think of me sitting at my desk working with my first generation iPhone.

Read more »

iPhone 3.0 OS upgrade video

Here's the link.

Get copy and paste, stereo bluetooth, landscape keyboard, peer to peer gaming and more. SV




Video presentation

Apple

Read more »

iPod Touch 3.0 OS upgrade video

Here's the link.

Get copy and paste, stereo bluetooth, landscape keyboard, peer to peer gaming and more. SV

Video presentation

Apple

Read more »

iPhone update 1.1.1. now available

We'd like to hear from the adventurous hackers, if "bricking" has occurred. SV

iPhone v1.1.1 Update

*

Bluetooth

CVE-ID: CVE-2007-3753

Impact: An attacker within Bluetooth range may be able to cause an unexpected application termination or arbitrary code execution

Description: An input validation issue exists in the iPhone's Bluetooth server. By sending maliciously-crafted Service Discovery Protocol (SDP) packets to an iPhone with Bluetooth enabled, an attacker may trigger the issue, which may lead to unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of SDP packets. Credit to Kevin Mahaffey and John Hering of Flexilis Mobile Security for reporting this issue.

*

Mail

CVE-ID: CVE-2007-3754

Impact: Checking email over untrusted networks may lead to information disclosure via a man-in-the-middle attack

Description: When Mail is configured to use SSL for incoming and outgoing connections, it does not warn the user when the identity of the mail server has changed or cannot be trusted. An attacker capable of intercepting the connection may be able to impersonate the user's mail server and obtain the user's email credentials or other sensitive information. This update addresses the issue by properly warning when the identity of the remote mail server has changed.

*

Mail

CVE-ID: CVE-2007-3755

Impact: Following a telephone ("tel:") link in Mail will dial a phone number without confirmation

Description: Mail supports telephone ("tel:") links to dial phone numbers. By enticing a user to follow a telephone link in a mail message, an attacker can cause iPhone to place a call without user confirmation. This update addresses the issue by providing a confirmation window before dialing a phone number via a telephone link in Mail. Credit to Andi Baritchi of McAfee for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3756

Impact: Visiting a malicious website may lead to the disclosure of URL contents

Description: A design issue in Safari allows a web page to read the URL that is currently being viewed in its parent window. By enticing a user to visit a maliciously crafted web page, an attacker may be able to obtain the URL of an unrelated page. This update addresses the issue through an improved cross-domain security check. Credit to Michal Zalewski of Google Inc. and Secunia Research for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3757

Impact: Visiting a malicious website may lead to unintended dialing or dialing a different number than expected

Description: Safari supports telephone ("tel:") links to dial phone numbers. When a telephone link is selected, Safari will confirm that the number should be dialed. A maliciously crafted telephone link may cause a different number to be displayed during confirmation than the one actually dialed. Exiting Safari during the confirmation process may result in unintentional confirmation. This update addresses the issue by properly displaying the number that will be dialed, and requiring confirmation for telephone links. Credit to Billy Hoffman and Bryan Sullivan of HP Security Labs (formerly SPI Labs) and Eduardo Tang for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3758

Impact: Visiting a malicious website may lead to cross-site scripting

Description: A cross-site scripting vulnerability exists in Safari that allows malicious websites to set JavaScript window properties of websites served from a different domain. By enticing a user to visit a maliciously crafted website, an attacker can trigger the issue, resulting in getting or setting the window status and location of pages served from other websites. This update addresses the issue by providing improved access controls on these properties. Credit to Michal Zalewski of Google Inc. for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3759

Impact: Disabling JavaScript does not take effect until Safari is restarted

Description: Safari can be configured to enable or disable JavaScript. This preference does not take effect until the next time Safari is restarted. This usually occurs when the iPhone is restarted. This may mislead users into believing that JavaScript is disabled when it is not. This update addresses the issue by applying the new preference prior to loading new web pages.

*

Safari

CVE-ID: CVE-2007-3760

Impact: Visiting a malicious website may result in cross-site scripting

Description: A cross-site scripting issue in Safari allows a maliciously crafted website to bypass the same-origin policy using "frame" tags. By enticing a user to visit a maliciously crafted web page, an attacker can trigger the issue, which may lead to the execution of JavaScript in the context of another site. This update addresses the issue by disallowing JavaScript as an "iframe" source, and limiting JavaScript in frame tags to the same access as the site from which it was served. Credit to Michal Zalewski of Google Inc. and Secunia Research for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3761

Impact: Visiting a malicious website may result in cross-site scripting

Description: A cross-site scripting issue in Safari allows JavaScript events to be associated with the wrong frame. By enticing a user to visit a maliciously crafted web page, an attacker may cause the execution of JavaScript in the context of another site. This update addresses the issue by associating JavaScript events to the correct source frame.

*

Safari

CVE-ID: CVE-2007-4671

Impact: JavaScript on websites may access or manipulate the contents of documents served over HTTPS

Description: An issue in Safari allows content served over HTTP to alter or access content served over HTTPS in the same domain. By enticing a user to visit a maliciously crafted web page, an attacker may cause the execution of JavaScript in the context of HTTPS web pages in that domain. This update addresses the issue by limiting access between JavaScript executing in HTTP and HTTPS frames. Credit to Keigo Yamazaki of LAC Co., Ltd. (Little eArth Corporation Co., Ltd.) for reporting this issue.

Installation note:

This update is only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an internet connection and have installed the latest version of iTunes from www.apple.com/itunes

iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting "Don't install" will present the option the next time you connect your iPhone.

Apple

Read more »

iPhone security update version 1.01 now available!

"Click on Get iPhone Software Version 1.0.1" SV



Apple support

iPhone v1.0.1 Update
*
Safari

CVE-ID: CVE-2007-2400

Available for: iPhone v1.0

Impact: Visiting a malicious website may allow cross-site scripting

Description: Safari's security model prevents JavaScript in remote web pages from modifying pages outside of their domain. A race condition in page updating combined with HTTP redirection may allow JavaScript from one page to modify a redirected page. This could allow cookies and pages to be read or arbitrarily modified. This update addresses the issue by correcting access control to window properties. Credit to Lawrence Lai, Stan Switzer, and Ed Rowe of Adobe Systems, Inc. for reporting this issue.

*

Safari

CVE-ID: CVE-2007-3944

Available for: iPhone v1.0

Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution

Description: Heap buffer overflows exist in the Perl Compatible Regular Expressions (PCRE) library used by the JavaScript engine in Safari. By enticing a user to visit a maliciously crafted web page, an attacker may trigger the issue, which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller and Jake Honoroff of Independent Security Evaluators for reporting these issues.

*

WebCore

CVE-ID: CVE-2007-2401

Available for: iPhone v1.0

Impact: Visiting a malicious website may allow cross-site requests

Description: An HTTP injection issue exists in XMLHttpRequest when serializing headers into an HTTP request. By enticing a user to visit a maliciously crafted web page, an attacker could trigger a cross-site scripting issue. This update addresses the issue by performing additional validation of header parameters. Credit to Richard Moore of Westpoint Ltd. for reporting this issue.

*

WebKit

CVE-ID: CVE-2007-3742

Available for: iPhone v1.0

Impact: Look-alike characters in a URL could be used to masquerade a website

Description: The International Domain Name (IDN) support and Unicode fonts embedded in Safari could be used to create a URL which contains look-alike characters. These could be used in a malicious web site to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by through an improved domain name validity check.

*

WebKit

CVE-ID: CVE-2007-2399

Available for: iPhone v1.0

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: An invalid type conversion when rendering frame sets could lead to memory corruption. Visiting a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution. Credit to Rhys Kidd of Westnet for reporting this issue.

Read more »

iPhone software update is coming soon

Let's hope their heard our requests.
Let us (and them know what would be on your wishlist. SV

Speaking to analysts for RBC Capital Markets this week, Apple's Vice President of iPod Product Marketing, Greg Joswiak, said the first software update for his company's iPhone handset is due to arrive shortly.

Appleinsider

Read more »