I’m having a bit of a dilemma.

I’m a web developer, and as a web developer, I’m part of an industry that is forever evolving. New tools and techniques are being created all the time, and if you don’t keep up with the latest industry developments, you face being left behind.

In addition to this: I’m a PC – and very proud of that fact. Microsoft’s Windows platform might not have been at the top of its game at all times (I’m looking at you Windows Vista and Windows 8), but I think Windows 7 is a fantastic operating system – I’ll be the first to admit that Windows 7 isn’t perfect, but I like it.

It’s a lot like your favourite hoodie: the design might be faded, the stitching around the hem might be starting to come loose, and there might be other hoodies with cool, slick and stylish designs on them, but your like your favorite one because it has molded to your body shape and fits you perfectly – which is exactly the case with me and Windows 7.

So?

My dilemma is that, in my effort to try and keep up to date with the latest tools and techniques being developed for the web industry, I’m going to have to jump ship and start using a Mac.

I’m no fan of the Mac.

Unlike my favourite Windows-7-hoodie, a Mac-hoodie would be too short on the waist, too long in the sleeves, and things would keep falling out of the pockets.

Anything I’m able to do on a PC I’m equally able to do on a Mac (and vice versa – but more on this in a moment), but I prefer doing it on the PC as it fits my way of working better. More and more, however, I’m seeing people within the web industry ignore the PC and focus on the Mac. Tools such as CodeKit and Hammer are Mac exclusives, and even tools which support both platforms such as GitHub, tend to focus on the Mac features first.

Don’t get me wrong, I’m able to achieve the same goals as all of these Mac-only tools via the combination of my PC and Debian development server – but it never just works - there is always something that I need to configure or fix. One could make the argument that I’m better off doing things the hard way, and that I’m learning more by manually configuring everything, but I’m not a software engineer - I’m a web developer, and as such, so I don’t care how the tools I use work, I just care that they do work.

This isn’t to say that Macs are fundamentally better than PCs (they’re not) or that PCs are better than Macs (equally not). It also doesn’t mean that the tools in question can’t exist on the PC (they can, if only someone would build them). It simply means that the developers of said tools, for whatever reason, are choosing to build them exclusively for the Mac, and as such, if I want to take advantage of them, I also have to use a Mac.

Once bitten, twice shy

Anyone that knows me knows that I embraced Apple once before when purchasing an iPad, which I later regretted. I still have the iPad in question, but it currently exists as nothing more than a music player, pumping funky tunes out of its speaker dock, as all its other functionality has been superseded by my Android phones and tablet.

I also have access to a Mac at work, but don’t use it for anything more than checking email or reading documentation, as everything else I need to do is completed using an old Windows 7 laptop which I brought into work on my second day of employment. I keep giving Apple the opportunity to impress me, but keep coming away disappointed.

So the point (and dilemma I’m facing) is that, if I should somehow find the £1,500 needed for a semi-decent Macbook, and decide to embrace the Apple once again, am I just going to end up regretting it?

As always, I welcome your comments below.

Essentials

These are the applications and software without which I would be unable to do my job.

NetBeans (Free / Open Source)

Having tried a number of different text editors over the years (including PSPad and NotePad++) I’ve settled upon NetBeans as my editor of choice. Netbeans, being an IDE however, is more than just a text editor, and while I have to admit that I probably don’t use anywhere close to all its tools and features, the tools and features that I do use (PHP syntax checking, Git diff highlighting, syntax autocomplete, source formatting, et al) are invaluable.

VirtualBox (Free / Open Source)

A valuable piece of software that lets me run guest operating systems on my PC. My initial reason for using this was to run copies of Windows XP (for IE6), and Windows Vista (for IE7 and IE8) for backwards compatibility testing of Web sites, but in recent months I’ve started using it to run a LAMP development server.

Debian (Free / Open Source)

Used as operating system, this is the L of the aforementioned LAMP development server. There seem to be as many different flavours of Linux as there are religions (and their followers are just as ferocious), but current poster child is Ubuntu, which is built upon best practice and designed to make things as easy as possible. I’ve chosen Debian however, as I’m new to managing a Linux server, so wanted to learn best practice for myself, rather than have it all done for me.

Apache, MySQL and PHP (Free / Open Source)

With the first letter of the LAMP abbreviation being filled by Debian above, the last three are filled by Apache (a web server), MySQL (a database) and PHP (a scripting language), which combined, power most of the Web sites I build.

SASS (Free / Open Source)

SASS is a CSS preprocessor written in Ruby which “makes CSS fun again”. It does this by adding a number of features sorely missing in vanilla CSS, including support for variables, calculations, functions and mixins. SASS files need to be compiled before they can be used, but this is handled by running a simple script on the command-line which does this automatically every time they’re saved.

FileZilla (Free / Open Source)

Although I use Git to deploy my sites, no web developer can survive without an FTP client, a piece of software that allows me to transfer files between two computers, such as the local machine and a server.

PuTTY (Free / Open Source)

This is an SSH client which allows me access to the command line of my remote servers. Nuff said.

KeePass (Free / Open Source)

As I mentioned in my article on the importance of a good password, in addition to keeping a secure copy of all my own login details, I have a duty to do the same for the login details of my clients. KeePass, an encrypted password manager makes this easy.

Optional

Although not needed to do my job, this list of software and applications which do make my job easier.

Synergy (Free / Donationware)

I work in an office full of iMacs (my own personal hell) and was given an iMac of my very own to use (f7u12) – so from my second day of working here I brought in my own Windows 7 laptop to use instead. Quickly realizing the benefits of being able to use two separate machines simultaneously however, lead me to Synergy: an application which allows me to share the keyboard and mouse of my Windows 7 machine with the iMac via the network.

DisplayFusion ($25)

Thats right, I’ve actually paid for something… Much like the aforementioned benefits surrounding the use of two separate computers, as a result of working for Propeller I discovered the benefits of having multiple monitors on a single computer. At a minimum DisplayFusion adds a taskbar to the second monitor, but also makes it easy to setup multi-monitor wallpapers, window snapping, and buttons which send the applications to the other monitor.

Conclusion

Wow, so while Chris’ one off costs amount to $1,779.98, mine are a fraction of that at $25 (and even that is optional extra).

By now however, I’m sure that many of you will be painfully aware that I’ve neglected to list Creative Suite (or even one of the many free alternatives such as GIMP or Pixlr) which accounted for $1,299 of Chris’ budget. This is because, as a developer (rather than a designer), I don’t actually have to do all that much image manipulation. What little I do do is limited to basic stuff like image cropping and sharpening, for which I do use Photoshop (a cost of $699, which thankfully has been absorbed by my various employers), but could just as easily do this using either of the free options listed above.

But even removing this from the equation only reduces Chris’ budget to $480.98, which is still   almost 20 times higher than mine. And it’s not even like I’m missing out on anything. I’m able to do my job as efficiently and comfortably as he does his.

Anyway, the next post in this series will be in response to Chris’ Monthly Service Costs – watch this space.

It would appear, however, that whoever it was that hacked into my server and turned it into a spam-sending machine, had other ideas.

(This post is a bit long and rambling, so feel free to skip to the end if I start to bore you.)

A bit of background

This time last year, if you had asked me about running my own Web server, I would have told you that I had no interest in it. I was perfectly happy with the cPanel based shared hosting that I was been using, and didn’t see the need for anything else.

This all changed during my time at Propeller Communications, where I was introduced to version control. My first taste of a version control system was Mercurial, and while my own experience of it was rarely bad, and the bundled TortoiseHG was a joy to use, it didn’t take long for me to realise that the de-facto industry standard was Git (thanks, mainly to GitHub), so upon leaving Propeller, I made the switch.

The list of benefits afforded to users of version control is long, but the one benefit that really caught my attention was the ability to push changes I had made on my local machine directly to the server. No longer did I have to use FTP to upload the correct files to the correct place, while remembering to removing files that weren’t needed any more. I simply had to run one command, and everything was taken care of for me.

But, in order to reap the benefits of Git, I needed my sites to be hosted somewhere that supported Git – and to date I’ve yet to find a shared host that does. So it was time to say goodbye to cPanel, and say hello to SSH.

First tentative steps

Prior to setting up my live server, the one the hackers took a fancy to, I had built two local development servers.

The first, which was as much an experiment as anything else, was in built out of an old PC in the office at Ghost Design. The process involved booting off the Ubuntu Server (10.11) CD, selecting all the options I wanted (LAMP, DNS, SSH, etc..), then, after watching the progress bar complete, I installed Webmin to help manage it. This, I felt, went quite well, and allowed me to gain more confidence using the Linux command line.

The second, which I use as a development server in my flat, was built out of a PC that I had been using as a Windows-based media server. The install of Debian 6 was a much more involved process because I had decided to install all the software I wanted manually. I also avoided installing Webmin, as I wanted to learn how do things properly.

The success of these two servers had filled me with confidence, and so on the 8th December 2011, with a small loan from my mum, I ordered a dedicated server from Hetzner. Because a development server should be as close to that of the production server as possible, I went for Debian 6 again, and for the most part, followed the same instructions as I had for my home server.

Skip to the end

On the 30th January I received an email from Hetzner stating that an ISP had reported my server for sending spam. I forwarded this email to Phil, who suggested that an incorrectly configured mail server might be at fault. After removing EXIM, I thought that would be the end of it, but three days later I received another abuse report.

A full week later I was still receiving abuse reports, and crying out to Phil for help. I have no idea how he managed it (via the use of the occult no doubt), but he tracked down the culprit: a whole bunch of unexpected files located in three of the sites/vhosts I was hosting.

Two of the sites were based on WordPress. I vaguely understand how the open source nature of WordPress, combined with an out of date install and some lax permissions, could allow someone to search the source code for exploits, then search the Web for an exploitable server. But the third was a static HTML site, meaning whoever had done this had been able to get access to it from one of the other two sites, meaning, potentially, the entire server was compromised.

To stop the immediate issue of spam being sent, I had to turn the server off, and following Sheepy‘s advice, I’m going to “Nuke it from a great distance and start again”.

Prevention is better than cure

So what can I do differently to prevent this from happening again? I think my main issue was that of permissions. You can afford a level of flexibility, and a more relaxed attitude to permissions on a development server, because, for the most part, it isn’t accessible to the outside world. For obvious reasons, the same isn’t true of a production server.

I’m also going to make sure that any software I use on the server is kept up to date, thereby increasing the chance of exploits being fixed.

Anyway, I’m going to reinstall the server soon, and I’m still hoping to write the server newbie post, so watch this space.