Salmagundi for Thursday, December 15, 2011

salmagundi smallSalmagundi? That’s the word for a seventeenth-century English dish made of an assortment of wildly varying ingredients. Typically, they include some cut-up hard-boiled egg, but then after that, anything goes: meat, seafood, fruits and veg, nuts and flowers and all manner of dressings and sauces. The term comes from the French “salmigondis”, which translates as “hodgepodge”.

In this case, I’m using “salmagundi” as a term for a mixed bag of new items that you might find interesting as a developer.

The Tangled Web: A Guide to Securing Modern Web Applications

tangled web

I’m currently in the middle of reading Michal Zalewski’s new book, The Tangled Web: A Guide to Securing Modern Web Applications and it’s been a fascinating, enlightening and enjoyable read. At first glance, you might be tempted to simply sum it up as a “security book”; I think it’s more accurate to describe it as “a great review of how browsers, their protocols, programming languages and security features work, and how to write secure apps given this knowledge”. Given that web security is a rapidly moving target, especially with the browser vendors – even the formerly-pokey Microsoft – cranking out versions at a faster rate, Zalewski’s approach to the topic is the right one: make sure the reader is clear on the basic principles, and then derive the security maxims from them, giving the knowledge contained within the book a much longer “shelf life”.

The Tangled Web is divided into three parts:

  1. Anatomy of the web. A tour of the web’s building blocks, from URL structure, HTTP and HTML to how it’s all rendered: CSS, client-side scripting languages, non-HTML documents and plug-ins.
  2. Browser security features. All the mechanisms that keep the malware from 0wnz0ring your system – the same-origin policy, frames and cross-domain content, content recognition mechanisms, dealing with rogue scripts and extrinsic site privileges (that is, privileges that aren’t derived from the web content, but from settings within the browser).
  3. A glimpse of things to come. A look at some of the proposed security mechanisms and approaches that may or not become standard parts of the web.

Each chapter except the last ends with a “Security Engineering Cheat Sheet”, which functions as both a summary of the material within the chapter and a security checklist. The last chapter is titled Common Web Vulnerabilities and lists vulnerabilities specific to web application, problems to keep in mind when designing web apps and common problems unique to server-side code.

I’m going to be showing The Tangled Web around the office (especially now, since I’m physically in Shopify’s headquarters this week). I’m sure the developers know a lot of this stuff, but they’re a bunch who are always eager to learn, review and “sharpen the saw”, so I think they’ll find it useful. If you develop web apps, whether for fun or to pay the rent, you’ll want to check out this book as well.

CUSEC 2012: Montreal, January 19 – 21

turing complete

Ah, CUSEC: the Canadian University Software Engineering Conference. This for-students-by-students conference punches well above its weight class. I’ve been to tech conferences put on by so-called full-time “professionals” that can’t hold a candle to what the students behind CUSEC do every year in addition to their course loads.

Better yet is the caliber of speakers they’ve been able to bring in: Kent Back, Joel Spolsky, David Parnas, Greg Wilson, Chad Fowler, Kathy Sierra, Dave Thomas, Venkat Subramanian, Jeff Atwood, Tim Bray, John Udell, Avi Bryant, Dan Ingalls, Giles Bowkett, Leah Culver, Francis Hwang, Doug Crockford, Matt Knox, Jacqui Maher, Thomas Ptacek, Reg Braithwaite, Yehuda Katz, of course Richard M. Stallman, in whose auction I made the winning bid for a plush gnu, which I paid with my Microsoft credit card.

alan turingThis year’s CUSEC theme is “Turing Complete” in honor of 2012 being the 100th anniversary of Alan Turing. He established his place in history as the father of computer science by formalizing concepts like “algorithm” and “computation” with the concept of the Turing Machine, proposing the Turing Test in an attempt to answer the question “Can machines think?”, working as a codebreaker at Bletchley Park (I like to say “He beat the Nazis…with math!”) and coming up with one of the first designs for a stored-program computer. He even found his way into pop culture by getting name-checked in Cryptonomicon and The Social Network.

Once again, Shopify will be there as a sponsor and once again, I will be hosting the DemoCamp at CUSEC. If you’re a university student studying computer science or computer engineering, you should come to Montreal from January 19th through 21st and catch one of the best conferences you’ll ever attend. Bring your resume: we’re looking for talented programmers who want to work us!



Cat pictures meet motivational posters meet HTTP status codes! It’s the Perfect Storm!


This article also appears in the Shopify Technology Blog.


Your Faithful Scribes are Working Away at Fixing the Docs

Woodcutting of a scribe working on a text, with the thought bubble "WTF?"

This is just a quick update to let you know that yes, we know that the Shopify developer documentation needs work. There’s a fair bit of information there, but it could stand some improvement. There’s some missing information, it could be organized better, there are parts of it that are confusing and there need to be examples in languages and frameworks other than Ruby and Rails.

This update is also here to let you know that we’re actively working on it, bit by bit, every day. As I write this, David Underwood and are are working on a wholesale reorganization of the developer sections of the wiki and clear writeups of all the API resources, including explanations of the parameters they expect and the attributes they return as well as how they relate to other resources and what effects they have on shops. We’re also working on more example code, in more languages.

If you’ve got comments, questions and suggestions about the docs or what we’re doing with them, please let us know — feel free to leave a comment or drop me a line.

This article also appears in the Shopify Technology Blog.


Featured Shopify App: Custard

Custard icon

One of the 100-plus apps in the Shopify App Store is Custard, which lets your customers talk – as in voice, not “chat” as in typing or email, but actually talk – to someone in your shop. Custard lets customers start a voice call using only the computer they’re using to browse your shop without the need for a phone or extra software. They just click the “Click to Call” button. Sometimes it’s nice to hear a human voice, and being able to talk to someone and ask questions can be the difference between your customer heading somewhere else and making that sale.

We talked with the people behind Custard and asked them a few questions about their app, and we’ve shared their answers in this article.

What does Custard do?

custard diagram

click-to-callWe created Custard because we want to improve the buying experience online. In brick and mortar stores we are used to having sales reps at our disposal to answer any of our questions, but when it comes to e-commerce we can feel pretty isolated. Sometimes email and text chat is just too slow. We want to eliminate loneliness from e-commerce sites and make it super easy for stores to connect with their customers in a fast and effective way. With Custard, your store comes to life and your visitors can get the instant gratification they want at the click of a button.

What are Custard’s key features?

custard screenshots

  • Click to Call: 79% of your visitors prefer phone support over anything else.
  • Widget Customization: You can customize your Click to Call widget to your liking and place it where you want it on your store.
  • Call Recording: We allow you to record each call so that you can review and improve your sales process.

There’s a a new feature called Custard Connect. Visitors to your store are extremely valuable and we want to help store owners extract that value. We also want to provide a seamless user experience. With Custard Connect, you can watch people navigate around your store in real-time right from your dashboard. With the click of a button you can initiate a call with your visitors and help them find exactly what they are looking to buy. We think this will be a great way for ecommerce stores to get more sales and to effectively engage with their customers like never before. Custard Connect will be rolling out this week.

Why should shopowners use your app?

79% of your store visitors prefer phone support over anything else. With Custard "Click to Call" we help you increase sales and improve customer satisfaction. We also believe the telephone is one of the best branding mediums out there. Not only can you instantly answer questions, but you have customer’s undivided attention. The customer remembers the experience you provide for a long time and tells his or her friends about it. The instant gratification you can provide with Custard has very positive returns.

Tell us a little bit about yourself.

custard wordmark

We are a fresh startup based in San Francisco, CA. We want to maximize the value of customer conversations for online businesses. There are some really interesting developments we are making in the sales and support space so stay tuned :). You can find us on twitter:

How can I find out more about Custard?

custard on shelf

You can find out more about Custard on its page in the Shopify App Store.

This article also appears in the Shopify Technology Blog.


Featured Shopify App: Assistly

"Help is on the way" indicator on an elevator's control panel

If you go into certain elevators, you might notice an indicator on the panel that reads “Help is on the way”. In the event of an emergency, someone at the other end lights it up to let the passengers know that assistance is forthcoming.

Large Assistly "featured app" icon in the App Store

Assistly, one of the 100+ apps in the Shopify App Store adds a customer service help desk to your Shopify shop so that customers can easily reach you when they’re having problems, and so that you can reassure them that help is on the way. We had a Q & A session with the people behind Assistly about their app and we’re sharing their answers in this article.

What does Assistly do?

Assistly Logo

Assistly helps you deliver better customer service, which is critical to online retailing. It’s a free-to-start customer-service help desk that gives you everything you need to set up and deliver world-class customer service in minutes. With Assistly, customers can contact you through your website, email, Facebook, Twitter, phone and live chat and it’s all integrated for your team inside Assistly so no customer falls through the cracks. Start by installing Assistly through the Shopify app store and signing up for a free account. You can be wowing your customers in very short order.

What are the key features of your app?

  • We’re built for your social customer. Assistly brings in all your support requests and comments from traditional channels (email, chat, phone) and social channels (Facebook and Twitter) and collects them in a single, collaborative desktop where nothing falls through the cracks.

agent desktop

Pictured above: Assistly’s agent desktop.

  • We make you more productive — and faster. Our tools are user friendly, so you can take care of business efficiently and quickly.
  • Assistly comes with an out-of-the-box Help Center for your customers to find answers on their own. Add content as you grow, and watch your service requests drop.

help center

Pictured above: Assistly’s out-of-the-box Help Center.

  • We do the heavy lifting. Assistly is entirely “cloud-based,” which means that you don’t have any costly IT infrastructure. Everything is managed on our end.
  • We’re priced for small business. Assistly has fair and simple pricing (every account gets one FREE full-time seat!), and part-time “flex” users can participate for only $1 per hour of use. This means that if you only need one agent, Assistly will be entirely free for you. We are betting that great service will help you grow, and we will be there to support your success.

Why should shopowners use Assistly?

Today’s social customer expects to receive a high-touch and personal customer experience. Assistly turns customer service into Customer Wow. It coordinates all of the different ways your customers may try to reach you, and ensures every customer gets the service they deserve. Especially important for online retailers with a seasonal product line: Assistly is flexible, so you can easily and affordably add part time help, adjusting for your busiest seasons.

Assistly is designed for the online retailer who wants a quick and affordable way to provide spectacular customer service. Online retailers wear many hats and shouldn’t have to bother with complicated, expensive software that is hard to learn and difficult to use. Assistly is easy to use and affordable. Since time is your most valuable commodity, we make every product decision with your workflow in mind.

Tell us a little about yourself.

assistly siteAssistly, now a company, is a pioneer in the new world of instant customer-service help desk applications that can be set up in minutes. The application provides an all-in-one customer support system that turns customer service into Customer Wow.

Now even small and mid-sized companies can face massively complex support challenges. With Assistly, customers can request support from anywhere—website, email, phone, live chat, Twitter, and Facebook—and companies can deliver that support instantly, and in real time.

Here’s how you can get in touch with us:

How can I find out more about Assistly?

assistly icon

You can find out more about the Assistly app (as well as over 100 others) at the Shopify App Store.

This article also appears in the Shopify Technology Blog.


Introducing Shopify Experts

Screenshot of the "Shopify Experts" main page

What is Shopify Experts?

Shopify Experts is an online directory of ecommerce experts who can help you get started with your Shopify shop, make it look and work better and get the most out of it. It’s where you can go to find designers to build themes, developers to make custom apps, marketers to boost your sales and other people with the skills, know-how and experience to help you with all things Shopify.

With over 16,000 shops powered by Shopify and more and more being added to that number each day, it’s not surprising that a community of experts who’ve mastered the in and outs of designing, customizing, running and promoting an online shop has grown around Shopify. Shopify Experts makes it easy for shopowners to find these people and tap into their expertise.

I want to hire a Shopify Expert to help me with my shop. What do I do?

That’s easy: just go to the Shopify Experts site at and start looking around! We’ve designed the site so browsing through experts, whether designer, developer, marketer or something else, is as easy as browsing through a Shopify shop’s catalog.

You can browse through our entire catalog of experts or search by area of expertise, geographic location and price…

Search controls for Shopify Experts: "I'm looking for a Developer in New York for a max of Any Price"

…and you’ll see a listing of experts that tell you who they are, what they do, where they’re located, thumbnails of their portfolio and a rough figure of how much they charge.

Screenshot of results from a Shopify Experts search

You can click on any expert’s View Expert Profile button to get a more in-depth view of what they do, see their experience with the Shopify platform, read reviews from shopowners who’ve hired them, see more of their portfolio and contact them.

Screenshot of a profile page for a Shopify Expert

Right now, you can find designers, developers and marketers in Shopify Experts. We’re going to expand the categories soon to include photographers, accountants, legal assistance and more.

We’re making it easy to find the help you need to make your shop successful.

I have design/development/marketing skills and want to be listed in Shopify Experts. What do I do?

To join Shopify Experts, you need to:

I’m thinking about becoming a Shopify Expert. Is it worth it?

Woodcut artwork of a hand pointing to the leftWe think it’s worth it. Everyone at Shopify, from the development team to sales and marketing to support and Gurus, treat Shopify Experts as the go-to people. If you ask any of us for a recommendation for a developer, designer, marketer or other person to help you with your shop, we’ll direct you to a Shopify Expert. It only makes sense: Shopify Experts are by definition people we’ve vetted and have proven track records.

Shopowners think it’s worth it. In Shopify Experts’ four-week beta period, which we ran quietly, without any marketing, there were nearly 1,000 shopowner-to-Expert communications. Shopowners want your expertise, and Shopify Experts is how they’ll find you.

Shopify Experts think it’s worth it. Here’s what some Experts who participated in our beta program had to say:

“Since the day Experts soft-launched I’ve received at least a handful of enquiries a week. All of them have been excited, about setting up their online presence, and about using Shopify to do it. I’ve been loving it! I have one full project done and paid, two more are mid-way through and I am discussing several others.”

“Connecting shop owners with Shopify experts is yet another brilliant idea from Shopify. Experts bridges the gap, making it that much easier for shop owners to find help and for contractors like myself to find Shopify projects. In the first few weeks of it’s release alone I was contacted 50% more than usual through the experts website. As always, I love everything about Shopify and this is just another feature that customers will benefit from as well as designers, developers, etc.”

“Shopify Experts has brought about a significant increase in enquires since the beta launch. I have received approx 30 requests for quotes, ranging from small theme updates to larger projects that cover branding, design and quite complication integrations. I have closed on several projects already, generating in the region of $18,000 worth of business. Not bad for a 4 week beta(!)”

Sign up now!

Monitor displaying the Shopify Experts page

Shopify Experts is now out of beta and in full swing. If you’ve got expertise that Shopify shopowners need, sign up, get listed and get found!

This article also appears in the Shopify Technology Blog.


RailsInstaller: The Easy Way to Install Rails on Windows

Although the video below is from 2006 (it’s from the first Railsconf), it’s still pretty representative of the Ruby on Rails development world: most of it seems to happen on Macs. From the Supreme Overlord DHH down to the newest newbie typing “rails s” on the console for the first time, it looks as though most Rails projects out there start their lives on computers with Apple logos:

Rails and Windows 7 logos

(That’s me going “Mac…Mac…Mac…” as I tally each laptop. I can’t be certain, but I believe that the guy in the brown zip-up sweater at the 0:09 mark is Tobias Lütke, Shopify’s CEO and the guy who offered me my current job. Strange how things work out.)

It used to take a fair bit of jiggery-pokery to set up a Rails development environment on Windows. That’s not the case anymore, thanks to RailsInstaller, a single double-clickable setup program.

Screenshot of Rails installer site

RailsInstaller installs the following on your Windows machine:

I used RailsInstaller to set up my Windows laptop for Rails development this weekend, and it worked like a charm. I took some screenshots along the way and present them below.

Double-clicking on the RailsInstaller executable gives you a familiar welcome window:

RailsInstaller wizard: "Welcome to RailsInstaller!"

Blah blah blah legal stuff. Just give me the software and I’ll worry about compliance later, okay?

RailsInstaller wizard, License Agreement screen

By default, RailsInstaller installs all its software into the C:\RailsInstaller directory, creating it first if necessary. I broke away from the default and instead specified that the software should go into a new directory called C:\Rails, a name that I thought made a little more sense:

RailsInstaller wizard, "Installation Destination and Options" screen

And we’re off!

RailsInstaller wizard, "Installing" screen, with progress bar showing about 1/10 done

Less than two minutes later:

RailsInstaller wizard, "Installing screen", with progress bar about 90% done

And finally:

RailsInstaller wizard, "Completing the RailsInstaller Setup Wizard" screen

With the install wizard complete, we get kicked into command line mode to set up git and SSH:

RailsInstaller wizard, configuring git

And that’s it! I checked to make sure it was working by creating a new Rails app:

Console showing creation a new rails app.

…we have lift-off!

Console showing launch of the newly-created app

The first time you run Rails on Windows, you might get a message from Windows Firewall asking if you’re cool with Ruby communicating with the outside world on private and/or public networks. I said “yes” to both:

Screenshot of the "Windows Firewall has blocked some features of your program" window.

So far, Rails on Windows, as installed by RailsInstaller, has been working like a charm for me.


This article also appears in the Shopify Technology Blog.


Over 100 App Proposals Submitted to the Shopify Fund

"Over 100 Submissions": graphic featuring 100 Shopify "bag" logos

The deadline for submissions to the Shopify Fund passed at the stroke of midnight, and in the end, over 100 Shopify app proposals were received and two dozen developers threw their name in the hat to build an app from our App Wishlist. These are better numbers than we expected; thanks to everyone who applied!

And now, it’s our turn. We’ll be spending the next few weeks reviewing all these submissions, choosing the apps that we think will best serve Shopify shopowners and development teams whom we think will best be able to build apps from our Wishlist. If you submitted an app or offered your services to build something from the Wishlist, we might be contacting you shortly to ask for more details about your app submission or credentials.

Then, in January, we’ll start funding the first series of apps. If your app gets selected, or if you get selected to write an app from our Wishlist, here’s what happens:

  1. At the start of the project, we’ll pay you the first half of the funding, which I like to describe as being “like a literary  advance, but nicer”. Keep reading to find out why.
  2. You work on your app. We’ll check in with you regularly during this time.
  3. When the app’s done, you’ll get the second half of the funding.
  4. Your app goes into the Shopify App Store. Shopowners will be able to purchase and install your app. For every sale of the app, the revenue share between you and Shopify will be 50/50; you receive 50% and we receive 50%.
  5. Until Shopify’s total of the 50% share equals the funding given to you, the 50/50 rev share will be in effect. You’ll still make money on each sale!
  6. Once Shopify’s 50% share is equal to the funding given to you, the revenue share changes to Shopify’s standard 80/20 ratio for sales in the Shopify App Store: you receive 80% and we receive 20%.

As I said earlier, the deadline for submissions to the Shopify Fund has come and gone, but as always, we like to leave the communications lines open. If you have any questions or comments about the Shopify Fund, feel free to use the form on the Shopify Fund page or drop us a line at

This article also appears in the Shopify Technology Blog.