mySears Community, the place to go to get questions about your appliances and products answered.

The pitch

The Sears and Kmart Community is a place where customers can go to get their questions answered by product experts – whether it is about that weird noise their drier is making, or just a simple question about that TV they’ve had their eye on after seeing it in a weekly ad.  The Community also gives a customer the perfect opportunity to no only get their questions answered, but weigh in on another customer’s questions, or just read up on what is new in whatever field interests them, or find information about what the products they are interested in.

The nitty gritty

The Community sites are sitting on an nginx/MySQL framework with WordPress Networks doing the heavy lifting.  The sites boast well over 1.5 million users, and the ability to add much, much more with Sears and Kmart single sign on capabilities, as well as well as facebook, yahoo, and google single sign on connectivity.  This site will sync all user information across all Sears websites, allowing a returning user – regardless of which web property they visit – the ability to sign on without having to handle new user registration.  As I said above, this site uses networks, and shares many common elements – including themes, database tables, and plugins – all on one system.

This site utilizes a revolutionary “Section Front” implementation – created by Eddie Moya - allowing site editors the ability to create custom category pages with an easy to use and fully customizable click and drag interface.

The Hash Table generated using this method of authentication.

After coming across this article on Reddit today, and chatting with a good friend and colleague about the benefits and issues of using the authentication method outlined by the author, we both came to the conclusion that we were not fans of the way the author handled the hash table comparisons for users, so I decided to work on it a little bit at home and try to make it better.

Before I go into details, here are the database tables I created to get this authentication to work:

mysql> DESCRIBE hashes;
+_______+_____________+______+_____+_________+_______+
| FIELD  | TYPE         | NULL  | KEY | DEFAULT  | Extra |
+_______+_____________+______+_____+_________+_______+
| hash  | VARCHAR(64)   | NO   | PRI | NULL    |       |
| salt  | VARCHAR(64)   | NO   |     | NULL    |       |
+_______+_____________+______+_____+_________+_______+
2 ROWS IN SET (0.01 sec)
 
mysql> DESCRIBE users;
+__________+_____________+______+_____+_________+________________+
| FIELD     | TYPE         | NULL | KEY  | DEFAULT | Extra           |
+__________+_____________+______+_____+_________+________________+
| uid      | INT(11)       | NO   | PRI | NULL    | AUTO_INCREMENT  |
| username | VARCHAR(30)   | NO   |     | NULL    |                |
| hash     | VARCHAR(64)   | NO   |     | NULL    |                |
| salt     | VARCHAR(64)   | NO   |     | NULL    |                |
+__________+_____________+______+_____+_________+________________+
4 ROWS IN SET (0.00 sec)

I set the hash field in the hashes table to an indexed column to allow quick(er) searching through the table, trying to alleviate the issues we might run into if this table becomes too large. Without the user’s password, there is no connection between these two tables, as it is required to generate the data within the hash column in the hashes table. Creating a user would happen like so:

// note, this uses my database class, which can be found at http://code.imyourdeveloper.com/database.txt
function create($applicationSalt, $user) {
	//generate salts
	$userSalt = hash("sha256", $applicationSalt.rand().time());
	$hashesSalt = hash("sha256", $applicationSalt.rand().time().$applicationSalt);
 
	//generate hashes
	$userHash = hash("sha256", $applicationSalt.$user->password.$hashSalt);
	$hashesHash = hash("sha256", $applicationSalt.$user->password.$userSalt);
 
	//create queries
	$user = 'insert into users (uid, username, hash, salt) values (null, "'.$user->username.'", "'.$userHash.'", "'.$userSalt.'")';
	$hash = 'insert into hashes (hash, salt) values ("'.$hashesHash.'", "'.$hashesSalt.'")';
 
	//run queries
	$db->query($user);
	$db->query($hash);
}

This was a little bit of a pain, and took some staring at my monitor to wrap my head around, trying to remember what went where, but I eventually got it working. The application salt is your secret salt set in the application that you will use to salt data going to the database, and user passes through any data you want to write about the user to the database. A combination of the user salt, the application hash, and the user’s password is used to generate the user hash and the authentication lookup hash in the hashes table. When the user types in a password, it runs through the algorithm creating a hash, looks up that hash in the hashes table, recalculates another hash using a randomly generated salt in the hashes table, the user’s password, and the application salt, then compares with the hash in the Users table. If this matches, then the user is who he says he is, and is logged in. This happens like so:

function lookup($applicationSalt, $user) {
	GLOBAL $db;
 
	$userLookup = $db->getObj('select * from Users where username = "'.$user->username.'"');
	$check = $applicationHash.$user->password.$userLookup->salt;
	$hash = hash("sha256", $check);
 
	$hashSalt = $db->getObj("select * from Hashes where hash = '$hash'")->salt;
	if ($userLookup->hash == hash("sha256", $applicationSalt.$user->password.$hashSalt)) {
		return true; // logged in
	} else {
		return false; // login failed
	}
}

This may not be a perfect implementation of this code, but I wasn’t a fan of the way it was being handled in the other article; and this was a neat little problem to work on, so expect updates in the future.. The mathematical probability of you being able to brute force the user’s password was astronomically low before, but it was nothing more than a one-way relation. This way, you not only need to brute force the users password to go one way (towards the hashes table), but the password you get is likely not going to work, as another hash is checked going in reverse, ensuring the only string that is accepted is the user’s.

If you have any better ideas of how to implement this, please feel free to post it below. Click here for a full version of the code above.

Kenmore Connect

A couple months ago, I was borrowed out to the Ruby team here at Sears to help them with the Kenmore Connect project; a project that was, at that point, running a bit behind and needed a bit of help.  I’ve had some experience with Rails in the past, and I didn’t have a whole lot on my plate at the time, so I was chosen as the person that could probably help the most.  My role was primarily front-end, dealing with heavily responsive HAML/SCSS and a whole lot of jQuery, but I did do some work with rails – including building some device-based helpers that would help determine what environments are being used on page-load.

I am not terribly proficient with Rails, as I haven’t had much of a chance to work with it in any real projects; but it is projects like this that make me want to pick it up and run with it, as it is a very fun language to work with.

The coolest bits of this project

There were a few firsts for me in this project.  The coolest by far was probably the responsiveness of the site.  We had to create everything while keeping a responsive design in mind – that is, always thinking about the desktop view, tablet view, and mobile view.  This kept us on our toes resulted in an amazingly usable site, no matter the device you are using it on.  Also, I’ve never worked with HAML/SCSS, and this project opened me up to the amazing possibilities of programatic CSS.  it really seems like a huge piece of the CSS engine that is just missing.  Just the ability to set and use variables was a godsend, and really made it incredibly powerful.

Kenmore was an awesome client, and this was an awesome project.  It really makes me look forward to rails work in the future, since the language is incredibly fun to write and work with.

Happy coding!

My role was mostly front-end oriented with HAML/SCSS/jQuery with only a bit of Rails work required of me, but I took the opportunity to get more comfortable with Rails, and took as many back-end tickets as I could (and that I thought I was capable of handling on my own without causing more work for someone else later on).  But I honestly have to say that the most impressive thing about this site is likely the responsive nature of it.  It is completely responsive, and scales based on the screen that is seeing it using media queries.  Apparently this is the first project of it’s kind at Sears, and we were setting a standard for the rest of the company to follow with our work – laying the foundation, if you will.

Stay tuned for images, the link to the live site, and a much more detailed synapsis of the work I did for Kenmore.

KMart's Birthday Club

I recently finished working on KMart’s Birthday Club website, a wordpress-based children’s site that is geared towards parents looking to make their child’s special day memorable.  My role was handling all the social media aspects required in the project plan.

One of the bigger problems I ran into with this – I really didn’t like any of the existing facebook plugins for WordPress, so I ended up building my own.  It was really an interesting learning experience.  This gave me the opportunity to dig deeper into the new facebook Graph API than I have in the past, and it wasn’t as terrible as the facebook API once was.

My largest, and most interesting task, was to pull down photo-galleries and create a taxonomy for each one.  The interaction with facebook for pretty much everything I had to do was fairly simple:

/**
 * Fetches data from facebook API
 *
 * @author Jason Corradino
 *
 * @param $path (required) facebook query path
 * @param $format (optional) format data is returned as either an object or json [obj|json]
 * @param $attr (optional) Adds additional attributes to the URL
 *
 * @return returns object of facebook data by default, json if 'format' parameter is set to json
 *
 */
static function getData($path, $format="obj", $attr="") {
	$pluginOptions = get_option('facebook_gallery_options');
	$token = $pluginOptions["token"] ? $pluginOptions["token"] : FACEBOOK_APP_TOKEN;
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, "https://graph.facebook.com/".$path."?access_token=".$token."&api_key=".FACEBOOK_API_KEY."&".$attr);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	$return = curl_exec($ch);
	curl_close($ch);
	return ($format == "json") ? $return : json_decode($return);
}

The above code will use your facebook application token to open up a curl with the facebook graph API, pulling down the requested data set within the URL, returning in the format set within the function call — defaulting to an object, but allowing a JSON response.

There will be a more detailed post about this down the line, and I am considering releasing the plugin I built to wordpress.org extend. So look forward to that.

Happy coding

Step 1

And select privacy settings

Step 2

Scroll down to Apps and Websites and click Edit Settings

Step 3

Select “Remove unwanted or spammy apps”

Step 4

Now we just need to select the application

and then remove it

And that’s it, now just repeat step 4 until you’ve removed all of the apps you don’t want.

This, my friends, is the internet (or at least a small bit of it)

After seeing this stuff spread across the internet, I thought I would interject, and explain to everyone how the internet “actually” works.

Recently, I have started seeing more and more internet service providers claiming that a small percentage of their users are “hogging” all the bandwidth. That a small group of users are using the networks so much, it is bogging down the system for everyone else.

Shenanigans.

There is a small modicum of truth in that idea, but you need to understand how networks actually work before seeing how garbage that claim actually is. Lets say I go out and start up an ISP in Chicago. I put up one “data path” (connection to the internet as a whole) for my soon-to be customers, and eventually get my first customer. He thinks it is great, it is fast as hell, and he is happy. So happy, in fact, that he goes out and tells all his friends how awesome my service is. A few weeks down the line, 10 of his friends decided to try me out, so signed up. Now instead of one person on that data path, there are 11.

Imagine this as a group of cars on the highway merging into a single lane of traffic. When there is one car, everything is all fine, and he goes on like there are no problems. What happens when there are 11 cars? The cars start to jam up, and some get forced to wait their turn to merge into the proper lane. This is what is happening.

Now customer 1 is calling and complaining that his internet service is sluggish, and not nearly as fast as it was when he signed up. Who’s fault is this? Is this the fault of the customers – regardless of how much information they are using up, it is nothing more than one more car on the hypothetical highway above doing the same speed as everyone else, or is it the fault of the system operator – the entity that is in charge of making sure there are enough lanes available on the highway so that users can get through without long wait times.

Go back to the highway scenario… do you blame the car in front of you for the traffic jam… or the entity that caused the jam in the first place?

Next time you hear someone say that the dirty users are using up too much data and ruining a good thing for everyone… call shenanigans on them, and tell them that the ISP is just being cheap, and using users as a fall-guy instead of upgrading their networks to provide a level of service they promised you when you signed up (and are more than happy to charge you for getting)

My most recent project was for Sears Holdings alongside a coworker and friend of mine, Eddie Moya.  My role was completing the front-end goodness for this—and future—lookbooks, achieving an easy-to-use and polished experience for the user. Was a pretty cool project, and allowed me to toy around with jquery animations—always a fun thing to play with.

My new pet-project (as yet unnamed) will allow you to feed in brand-specific keywords, then watch for people mentioning your keywords on twitter, auto-following those that are talking about you.  This may be a stand-alone script, or a dedicated site.  I will update when I have a bit more information.  Keep a lookout, it is on it’s way.