accidental hacker

5 Things You Should Know About Big Data

rsobers — Tue, 24 Apr 2012 11:38:00 -0400

5 Things You Should Know About Big Data:

A few byte-sized big data concepts (not just trivia) so that you can distinguish the substance from the hype.

The State of Data Protection While over 80% reported that they...

rsobers — Thu, 19 Apr 2012 09:15:40 -0400

While over 80% reported that they store data belonging to customers, vendors, and other business partners, only 26% reported being very confident that data stored within their organization is protected.

nevver: Social Media Explained (with donuts)

rsobers — Wed, 04 Apr 2012 13:33:23 -0400

nevver:

Social Media Explained (with donuts)

Giving Away Your Passwords

rsobers — Fri, 30 Mar 2012 09:44:00 -0400

Giving Away Your Passwords:

The House voted down a bill this week that would prevent employers for asking for your Facebook password.

Unfortunately, plenty of third-party websites ask for your Facebook, Twitter, and Google passwords, too. This is called the Password Anti-Pattern, and it’s extremely dangerous. Luckily, OAuth is becoming more common and is way more secure.

7 Recommendations for Data Protection by Forrester’s Andras Cser

rsobers — Fri, 16 Mar 2012 09:19:56 -0400

7 Recommendations for Data Protection by Forrester’s Andras Cser:

If content is king, context is God. DLP solutions can tell you where data is exposed, but unless you have context, how do you know where to begin? You have to be able to answer, among other things:

What do I do first?
- You have to know which sensitive data is over-exposed and most at risk.
Who can should make the access decisions about sensitive data?
- Not IT, that’s for sure.
How do I prevent this in the first place?
- Ensure only the right people have access, that all data has an owner, and that owners periodically review who has access to their data.

Learning coding from boredom

rsobers — Mon, 27 Feb 2012 12:35:40 -0500

Learning coding from boredom:

Great post by Benjamin today.

Programmers like to program because they can do cool things.

The reason I learned to code at age 13 was so that I could automate slaying monsters in a text-based RPG that I loved. Today, I code for a number of other reasons: to earn a living, to make tasks in my life easier, to impress the ladies, etc.

Over the years I did eventually develop a deep passion for understanding data structures, algorithms, design patterns, and all the other “boring” aspects of software development. But one thing is certain — you could never have lured me into programming by teaching me about the knapsack problem or the strategy pattern.

Give me monsters and robots, then I’ll code

parislemon: Path, Not Pathological

rsobers — Fri, 10 Feb 2012 23:20:34 -0500

parislemon: Path, Not Pathological:

parislemon:

As an iOS lover and Path champion, a number of folks have asked for my take on the Path address book situation of yesterday and today. I’ve avoided weighing in for two reasons: first, I wanted to talk to some other actual developers about the situation. Second, the fact that CrunchFund is…

MG Seigler is great at calling people out when they a.) do something shitty, or b.) try to bullshit us. It’s one of the reasons I love reading him so much. In this case, however, Path did something shitty and MG is bullshitting us. It’s time to call him out on it.

MG’s main defense for Path stealing peoples’ address books is that they weren’t being shady, rather, they wanted to “ease the connection building process.” That’s odd. The whole point of Path is that it’s the anti-Facebook. That is, you only share your Path with intimately close friends and family. If I can’t pick them out of my address book myself, I’ve got problems a social app can’t solve.

And, by the way, how the hell is Path going to look at my address book and distinguish my best friend from my plumber? Maybe they’re stealing my phone call history, too.

OK, so let’s pretend they Path is completely benevolent (and I think they are, actually). They were storing our address book data on their servers! What if they got hacked? Most smart and security conscious developers would go out of their way not to store personal data. The minute you store personal data, you take on the responsibility for securing it.

Seigler proceeds to tell us that we shouldn’t be freaking out about Path because so many other applications take advantage of the same API. What?! He also says that Path developers were simply utilizing an option put in front of them. Browser developers have the option to grab our email passwords, but would they? Windows developers have the option to log our keystrokes, but would they? I guess some would.

Just because I leave my keys on the counter doesn’t make it okay for everyone who comes into my house to snag them and make copies. Path made a choice. They chose to be the creepy repairman that copies your keys.

Marco Arment wrote a terrific post about how his app, Instapaper, deals with the address book. Marco gets it. Could he swipe our data? Yes, but he wouldn’t dare.

Lastly, I love how MG calls it “weird” that Apple exposes your address book to developers. If this were an Android story, I think the word would be “sinister.” I’m just sayin’.

Again, I love MG and I usually agree with what he says, but I think he’s letting his loyalties get in the way here, so much so that he’s willing to be hypocritical.

Data Protection: It's Just the Right Thing To Do

rsobers — Tue, 07 Feb 2012 09:35:43 -0500

Data Protection: It's Just the Right Thing To Do:

Too many business put data protection out of mind and, in the long-run, end up harming customers, partners, and shareholders. Sadly, since moral obligation clearly is not enough to make most companies flinch, state legislators have been trying to force compliance with PCI-DSS and other standards. Now the SEC is stepping in.

The enterprise cloud is, well, cloudy

rsobers — Mon, 30 Jan 2012 12:08:00 -0500

Last night I watched a fantastic episode of This Week in Startups with guest Aaron Levie of Box.net. Aaron is a remarkable young CEO who really seems to understand and care about enterprise software, which is a rare combination.

One of the themes of the interview was that CIOs and IT departments at large organizations are starting to embrace the cloud. Jason and Aaron discussed “bottom up” adoption of cloud-based software in the enterprise. Essentially, lower-level employees start using their favorite applications like DropBox or Evernote at work and the apps become so widespread and integral to collaboration that IT managers and CIOs adopt the technology officially.

They talked about how big Fortune 500 companies are starting to develop or acquire cloud solutions to put in their portfolios (e.g., Oracle buys RightNow, SAP buys SuccessFactors). Cloud, cloud, cloud.

Then, about 23 minutes into the interview, the elephant in the room rears it’s giant head: what about security?

Even the most progressive enterprises, Aaron remarks, have the philosophy: use any device you want (Mac, PC, iPhones), use any software you want, but secure the data at all costs.

They’d be foolish not to. We’re not talking about MP3s and funny cat photos. We’re talking about intellectual property, source code, patents, legal and HR documents, etc.

As the definition of “secure” evolves, every company is faced with hard decisions.

Alice: “All of our critical data must stay within the company’s walls.”
Bob: “But we if we can’t share and collaborate, the value of the data decreases substantially.”
Alice: “OK, we have a VPN. Nothing leaves the VPN!”
Bob: “But we need to email a contract to our lawyers, print this business plan for our VCs, and grant temporary access to our web agency.”
Alice: “Fuuuuuuuu!”

So what’s the solution? We have to have a security model that fits today’s distributed work model. We can’t lock everything down lest we destroy efficiency.

Levie goes on:

We have to redefine what it means to be secure and what it means to manage security. Then you move more into this category where visibility is security. If I have far more visibility into where my data is, who’s using it, every access, every event on it — maybe it’s a little more open, but people will use the product and I’ll actually see what’s going on with the data.

Secure collaboration is something Varonis (the company I now work for) has been focused on for years. If you have complete visibility into who can access data and who is accessing data at all times, then you can facilitate collaboration while avoiding the front page of Wikileaks.

Complete visibility is not a trivial accomplishment given the enormous growth and fragmentation of data:

The number one challenge is actually the sprawl that gets created with organizations — the amount of apps and data that people are now consuming and interacting with and how unmanageable that is for IT.

Varonis has been the saving grace for many of the world’s biggest enterprises when it comes to securing unstructured data. Varonis monitors every single event across your entire IT infrastructure: every file open, rename, delete, copy. Every email sent, received, marked as unread, etc. This audit trail enables us to answer all sorts of critical questions (and helps us sleep at night):

Who is looking at sensitive data?
What data is stale and should be archived?
Where can I reduce access?
Who moved my files?
Who’s abusing their access?

The biggest question I have for Aaron, Jason, and everyone else is how do you get visibility if your data is in the cloud? How do you audit access? How do you get visibility into who is accessing what data? Are Google and Amazon going to let us install Varonis on their infrastructure? When it comes to security the cloud is very, well, cloudy.

Photo credit: http://mp5gosu.deviantart.com/art/Cloudy-stormy-day-47828616

Please don't learn to code

rsobers — Thu, 19 Jan 2012 10:11:00 -0500

I remember stumbling upon tryruby.org a few years back. It was this neat little web-based shell that helped teach Ruby in a fun and interactive way.

The site lowered the barrier to entry for newcomers: you didn’t have to download anything; you didn’t need an editor or an interpreter; you didn’t even have to know what a shell was. You would simply read the instructions on the screen, type some commands, hit enter, and immediately see the results. In mere seconds, you were coding.

This was just one of why the lucky stiff’s many whimsical creations aimed at spreading the joy of coding. Nowadays, there are dozens of interactive code tutorial sites trying to do the same thing, mostly for profit. Some have even raised millions in venture capital to fuel their efforts.

One site in particular, Codecademy, reportedly hauled in 1,000,000 users due largely to their well-timed Code Year initiative, which delivers weekly programming lessons to people who have resolved to learn to code in 2012. Last week, they announced a partnership with the White House.

The response has been overwhelmingly positive: writers, VCs, accountants, lawyers all learning to code! But someone has to be the bearer of bad news:

We’re not all going to be programmers.

I promise I’m not trying to cut anyone down or dig a moat around my pristine programming castle. Those who know me know that I’ll happily teach programming to anyone who will give me the time of day. I’ve personally use sites like codeschool.com and udemy.com. I also don’t believe you have to switch professions in order to justify learning and enjoying the craft.

Confused yet? Let me try to explain where I’m coming from.

On a recent episode of my favorite podcast—Hypercritical—John Siracusa talks about the death of HyperCard. HyperCard was an application on early MacOS that let you make your own programs, or stacks, via Lego-block-style programming. HyperCard made it super-easy for normal people to build their very own programs.

The nerds thought: of course everyone wants to write their own computer programs! Why else would people want a computer in their house? We just have to make it easy enough for them.

John mentions other attempts at lowering the coding bar: AppleScript, Logo for kids, and Automator made programming more natural, fun, and easy. These platforms did, without question, make programming more accessible, but they never took off the way we geeks hoped and expected they would.

Siracusa explains (paraphrasing):

You could build up a pretty powerful system by composing all of these pieces that you didn’t write and you didn’t have to understand. But in all of these cases—HyperCard, AppleScript, Automator—the harsh reality is that anything that lowers the bar for people to do powerful things inevitably leads to Programming with a capital P.

These abstractions were leaky. The minute you try to do anything that is even slightly off the rails, you very quickly find yourself doing actual programming: conditionals, loops, composition, abstraction. These concepts aren’t natural to most people, so they stop right there. They won’t ever make the leap, no matter how easy or fun you make it.

If CPA firms had ping pong tables and Friday beer bashes, I might be tempted to learn accounting. And I would love it if there were a fun and easy way to go about it. But in the end, I could never be passionate about double-entry bookkeeping the way I’m passionate about JavaScript, because you can’t teach passion.

The percentage of the population that can engineer great software is so minuscule, and that number won’t change dramatically. HyperCard couldn’t change it; Visual Basic couldn’t change it; and no amount of instructional videos and interactive code challenges can change it. We might be able to nudge the number upward by making things easier, but there is a hard limit.

I would love to see more people from all walks of life learn to code, but I think we need to calibrate our expectations so we’re not shocked or disappointed when the dust settles and it’s just us nerds hunched over our laptops hacking away at 3am because we just can’t help ourselves.

Why I Hate Android

rsobers — Tue, 10 Jan 2012 09:27:00 -0500

Is Google sleeping with the enemy?

parislemon:

Why do I hate Android? It’s definitely one of the questions I get asked most often these days. And most of those that don’t ask probably assume it’s because I’m an iPhone guy. People see negative take after negative take about the operating system and label me as “unreasonable” or “biased” or worse.

I should probably explain.

Believe it or not, I actually don’t hate Android. That is to say, I don’t hate the concept of Android — in fact, at one point, I loved it. What I hate is what Android has become. And more specifically, what Google has done with Android.

Read More

Using Mercurial Subrepositories

rsobers — Mon, 21 Mar 2011 23:18:00 -0400

Code reuse is important. As developers, we don’t want to keep reinventing the wheel over and over again. We should leverage code that we’ve already written, and use open source libraries and frameworks where appropriate.

Having the source code of a library that your project depends on is very beneficial. You can browse through it, debug into it, and make changes to it. But what is the most efficient way to store and track a piece of code that is shared across dozens of projects? Should you simply copy and paste the library’s source code into a lib folder within each project’s repository? Or should you store the library in its own repository and reference it externally?

The copy/paste method makes propagating changes a real nightmare, and the external reference approach has its own drawbacks:

How is this extra step communicated? Is it in a wiki document somewhere?
Should you write a script to fetch the dependencies or some build tool?
What version of the library should you clone?
Where on my disk does the library need to live?
Does the build server know about all this?

That’s a lot of question marks. They’re not intractable issues by any stretch, but you do have to think about them. You don’t want to have to think, you want to write code and get things done.

Subrepositories to the rescue

Subrepositories let you treat a collection of repositories as a group. For example, when you clone a repo, Mercurial will recursively clone all of its subrepositories as well, so the developer (or build server) doesn’t need to know about the dependencies — the source control system handles it all.

When you create (or update) a subrepository, Mercurial takes a snapshot of the subrepo’s state and stores it in the parent repository’s .hgsubstate file. This means that multiple projects can point to a single shared subrepository, yet each one can independently decide which revision of the shared repository to rely on.

Further, the subrepository can be anywhere — on your local disk, in Kiln, on a co-worker’s machine, etc. Heck, it can even be a Subversion repository!

Let’s see an example that illustrates exactly how to use them.

Note: Before you get your hands dirty, if you’re using subrepos, you almost certainly want to have the following lines in your .hgrc or Mercurial.ini file (thanks to David Wolever for this tip).

[ui]
commitsubrepos = false

A Tale of Two Résumés: A Case Study in Subrepositories

Fog Creek is always looking to hire great people. In fact, I’m proud to announce our two most recent hires — we just poached Darth Vader from Microsoft and Cthulhu from Facebook (sorry, Zuck).

Whenever someone new joins the team, one of the first things we have them do is create a personal résumé site that showcases their skills. I provide them with a standard HTML template and they fill in all the content. Each team member has their own repository in Kiln.

Here’s what the project looks like right now:

Vader and Cthulhu have very similar sites at this point — both contain a single static HTML page, CSS, and some images. There aren’t any external dependencies.

Have a look inside Cthulhu’s repo:

The résumés look nice and clean, albeit plain:

Creating a subrepository

I’ve been spending my days on Hacker News reading about how all the JavaScript ninjas are writing jQuery plugins to enhance their websites. So, naturally, I wrote a jQuery plugin that everyone can use to add awesome text shadows to their résumés. The plugin is aptly named awesomejs.

I checked my code into Kiln so my team can grab it.

Now, don’t tell Cthulhu, but Vader is my favorite co-worker. His ability to dominate a galaxy is truly unmatched. Vader happens to be out of the office at the moment. While he’s gone, I’m going to make his résumé just a little more awesome.

First I’ll clone Vader’s repo down to my machine.

c:\code>hg clone https://rob.kilnhg.com/Repo/Subrepo-Demo/Websites/vader
destination directory: vader
adding changesets
adding manifests
adding file changes
added 1 changesets with 4 changes to 4 files
updating to branch default
4 files updated, 0 files merged, 0 files removed, 0 files unresolved

Then, from within the vader repo, I’ll clone awesomejs so that it becomes a nested subdirectory.

c:\code>cd vader

c:\code\vader>hg clone https://rob.kilnhg.com/Repo/Subrepo-Demo/Libraries/awesomejs
destination directory: awesomejs
requesting all changes
adding changesets
adding manifests
adding file changes
added 1 changesets with 1 changes to 1 files
updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved

Now I have two nested Mercurial repositories, but they are not linked in any way and I can’t operate on them in tandem…yet.

To achieve full-subrepo goodness I have to create the .hgsub file in the vader repository’s root directory. .hgsub is a plain text file with one line per subrepository. On left-hand side of the equals sign is the local directory name where the subrepo will reside. On the right-hand side is where that repo lives.

c:\code\vader>echo awesomejs = https://rob.kilnhg.com/Repo/Subrepo-Demo/Libraries/awesomejs > .hgsub

I save the file, add it, and commit it just like I would any other file. I can tell by the output that Mercurial knows I’m making a subrepo when I commit .hgsub. Further, it automatically creates a .hgsubstate file where it records a snapshot of the subrepo’s state.

c:\code\vader>hg add
adding .hgsub

c:\code\vader>hg commit -m "adding subrepository awesomejs"
committing subrepository awesomejs

With my new subrepo in place, I’m ready to share my changes, so, from within the vader repo, I push my changeset to Kiln.

c:\code\vader>hg push
pushing to https://rob.kilnhg.com/Repo/Subrepo-Demo/Websites/vader
pushing subrepo awesomejs to https://rob.kilnhg.com/Repo/Subrepo-Demo/Libraries/awesomejs
searching for changes
searching for changes
no changes found
searching for changes
searching for changes
remote: kiln: successfully pushed one changeset

Notice how issuing hg push from the parent repository automatically pushed the subrepo as well (though, in our case, there happened not to be any changes in the subrepo). Mercurial will automatically push all subrepositories when the parent repository is being pushed. This ensures new subrepository changes are available when referenced by top-level repositories.

Note: not all Mercurial commands will automatically recurse into subrepos. For instance, hg status does not recurse unless the -S option is specified, and hg pull will not act on subrepositories at all. Type hg help subrepos for more on this.

Now, if I look at the Vader website in Kiln I can see my new changeset. And if I switch to the file browser I can see a little visual cue next to awesomejs to indicate that there’s a subrepo present.

If I click on the awesomejs folder, I can see that I don’t have a copy of the awesomejs files within the vader repository; rather, I have a link to the Subrepo Demo -> Libraries -> awesomejs repository. What’s more, Kiln knows exactly which revision of awesomejs to show me based on the data in .hgsubstate.

If I were to peer inside the .hgsubstate file in the vader repo, I would see that it simply contains the changeset hash of the revision that it expects awesomejs to be locked on:

Applying some awesomeness

Now that I have my subrepo relationship established, I’ll actually make use of the plugin. I will edit index.html and, right above the closing <body> tag, add references to jQuery and awesomejs, and call the plugin.

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.js"></script>
<script src="awesomejs/awesome.js"></script>
<script>
    // make all the h1 and dt tags awesome.
    $(document).ready(function () {
        $('h1, dt').makeAwesome();
     });
</script>

Much better:

Cthulhu’s turn

Cthulhu decided that, not only is he going to use awesomejs for his own resume, he’s going to contribue some changes to the plugin to make it better. He noticed that I hard-coded the color magenta right into awesome.js and thought it might be better if it were passed as a parameter to the plugin instead. This way, each engineer can use their own personalized color scheme.

To make this change, first Cthulhu clones his repo and repeats the same steps I did to create the subrepository (i.e., hg clone awesomejs, create .hgsub, hg add, hg commit). Then, within the subrepository folder, Cthulhu makes his changes to awesomejs. Lastly, Cthulhu updates index.html within the cthulhu repository to referenence and call the plugin. He likes cyan.

Now he’s ready to commit the changes in both repositories. Note, however, that when you call hg status from within the parent repo, you won’t see your changes to any subrepos. If you want to see what’s changed in a subrepo, you’ll need to use hg status -S instead. Here’s what hg status -S looks like at this point:

c:\code\cthulhu>hg status -S
M awesomejs\awesome.js
M index.html

IMPORTANT POINT! When he commits, he must do so from within the parent repository, otherwise Mercurial will NOT update its .hgsubstate. As a result, when the next developer comes along and clones the Cthulhu website, they’d get the hard-coded magenta version of awesomejs with it, and that’s not what we want.

First he commits the change to awesomejs:

c:\code\cthulu>hg commit -m "make the color a parameter instead of hard-coding it to 'magenta'" awesomejs
committing subrepository awesomejs

Then the change to index.html in vader:

c:\code\cthulu>hg commit -m "make use of the awesomejs plugin.  I like cyan." index.html

And here’s the log:

c:\code\cthulhu>hg log
changeset:   3:90ccac8e4a0b
tag:         tip
user:        Rob Sobers
date:        Thu Mar 17 14:42:26 2011 -0400
summary:     make use of the awesomejs plugin.  I like cyan.

changeset:   2:71e8c78d1f59
user:        Rob Sobers
date:        Thu Mar 17 14:42:04 2011 -0400
summary:     make the color a parameter instead of hard-coding it to 'magenta'

changeset:   1:7f699cdf3208
user:        Rob Sobers
date:        Thu Mar 17 14:24:43 2011 -0400
summary:     adding awesomejs subrepository

changeset:   0:3517279c43fd
user:        Rob Sobers
date:        Tue Mar 15 23:45:15 2011 -0400
summary:     new resume site

Cthulhu can now push these changes up to Kiln (remember, push is recursive) and carry on…right?

Wait a minute! Cthulhu changed the signature to the makeAwesome function without regard for anyone else! What is that going to do to Vader’s site? Vader isn’t passing a color name, so his shadow color will be undefined, which I’m pretty sure isn’t a valid HTML color. Vader is expecting his drop shadows to be magenta.

No worries! The change Cthulhu made to the subrepo is available to Vader, but not automatically forced on him. Here’s what’s in Vader’s subrepo:

C:\code\vader\awesomejs>hg tip
changeset:   0:d5e13195590d
tag:         tip
user:        Rob Sobers
date:        Tue Mar 15 23:37:48 2011 -0400
summary:     creating new jQuery plugin

And here’s the incoming changeset, should he choose to pull it:

C:\code\vader\awesomejs>hg in

comparing with https://rob.kilnhg.com/Repo/Subrepo-Demo/Libraries/awesomejs
searching for changes
changeset:   1:e281bb75e574
tag:         tip
user:        Rob Sobers
date:        Thu Mar 17 14:42:04 2011 -0400
summary:     make the color a parameter instead of hard-coding it to 'magenta'

When Vader is ready, he can pull the above change, update, and commit the parent repo to record the new version in .hgsubstate.

And that’s the beauty of subrepositories — they give you the benefit of working on a single shared repository across multiple projects while letting you lock each project at a specific version.

All of the code from this tutorial is available for you to play with in a public Kiln repo: https://rob.kilnhg.com

Credits:

Cthulhu résumé and HTML template by Chris Coyier: http://css-tricks.com/one-page-resume-site.

Darth Vader résumé details: http://www.giraffecvs.co.uk/darth-vader-cv

Other resources:

http://nerdwords.blogspot.com/2010/10/understanding-mercurial-subrepositories.html
http://kiln.stackexchange.com/questions/2685/how-does-fog-creek-or-other-users-use-sub-repositories
http://kiln.stackexchange.com/questions/1066/problems-using-sub-repositories-subrepos
http://mercurial.aragost.com/kick-start/en/subrepositories

Sticky notes with CSS3

rsobers — Tue, 23 Nov 2010 05:42:00 -0500

I’ve been working on a pretty cool wall-mounted status board as one of my projects at Fog Creek. It’s a webapp that runs on a vertically mounted LCD screen in our office. It displays a bunch of interesting information like tech support calls, staff vacations, tweets about FogBugz, and more.

I’ve been incrementally adding features and improving the UI whenever I have spare cycles. The other night, I decided to redesign the Kanban board widget, which is a list of the top N things that the customer team needs from engineering. I decided to go with a sticky note UI that mimics a real-life Kanban board, which typically consists of a giant white board filled with a bunch of sticky notes.

My initial design used the classic yellow sticky notes, which I thought looked pretty neat. I showed my co-worker Rich who suggested that we make the notes look like the FogBugz and Kiln notepads that are laying around the office. Awesome idea! Way better.

Click here to play around with the code yourself on jsFiddle. As you can see, the implementation is pretty simple. CSS3 is really nifty. No images necessary (aside from the kiwi and dodo logos).

Here’s the markup:

<link href='http://fonts.googleapis.com/css?family=Reenie+Beanie&amp;subset=latin' rel='stylesheet' type='text/css'>

<ul id="notes">
    <li>
        <p>Push new feature to Kiln for code review</p>
    </li>
    <li class="kiln">
        <p>Browse hacker news for a bit</p>
    </li>
    <li>
        <p>Read JavaScript: The Good Parts by Douglas Crockford</p>
    </li>
</ul>

Notice that I’m pulling in the handwriting-style font right from the Google CDN.

Now for the CSS3 magic:

body {
    background: #B2CCCC;
}

#notes li {
    position: relative;
    width: 300px;
    min-height: 100px;
    margin: 25px auto;
    padding: 60px 15px 15px 15px;
    background: #fff url(http://our.fogbugz.com/images/tbKiwiLogo.gif) no-repeat 4px 8px;
    -webkit-box-shadow: 0 2px 12px rgba(0,0,0,.5);
    -moz-box-shadow: 0 2px 12px rgba(0,0,0,.5);
    box-shadow: 0 1px 2px #000;
    -webkit-transform: rotate(-.5deg);
    -moz-transform: rotate(-.5deg);
    -o-transform: rotate(-.5deg);
}

#notes li:nth-child(even) {
    -webkit-transform: rotate(.5deg);
    -moz-transform: rotate(.5deg);
    -o-transform: rotate(.5deg);
}

#notes li.kiln
{
    background-image: url(https://rob.kilnhg.com/Content/Images/kiln_focus.gif);
}

#notes li p {
    text-align: center;
    font: normal normal normal 40px/48px 'Reenie Beanie', Helvetica, Arial, sans-serif;
    color: #000;
    text-shadow: white 1px 1px 0px;
    overflow:hidden;
}

#notes li::before {
    content: ' ';
    display: block;
    position: absolute;
    left: 115px;
    top: -15px;
    width: 75px;
    height: 25px;
    z-index: 2;
    background-color: rgba(243,245,228,0.5);
    border: 2px solid rgba(255,255,255,0.5);
    -webkit-box-shadow: 0 0 5px #888;
    -moz-box-shadow: 0 0 5px #888;
    box-shadow: 2px 2px 2px #000;
    -webkit-transform: rotate(-6deg);
    -moz-transform: rotate(-6deg);
    -o-transform: rotate(-6deg);
}

#notes li:nth-child(even)::before {
    -webkit-transform: rotate(6deg);
    -moz-transform: rotate(6deg);
    -o-transform: rotate(6deg);
}

Each note has a background gradient to give it the sticky note color. The note is rotated ever-so-slightly with a transform and decorated with a little box shadow for a 3D effect.

The tape is inserted using ::before and is absolutely positioned with a box shadow, slight rotation, and a semi-transparent background color (using rgba notation to set alpha transparency).

I hope you found this little technique useful. I’m going to be posting more about the big board soon. Stay tuned.