On Security Half Ass Done

Where should I begin…  Let’s take Pacific Place Mall in Jakarta for a start.  Recently, I am sure most of us in Jakarta already know about a particular incident in this place where a young lady was murdered inside the mall.  OMG.  This place is one of the high class shopping centre in Jakarta, with expensive security screening and checkpoints clearly visible on the mall entrances (or some of entrances).  So let’s see where the security flaws are…  If you come by car, as you try to enter the parking lot in the basement, the security staff will “search or put a facade of attempting to search” for suspicious things in your car, but as most of us know, this sort of thing if not done properly is just half-ass done and this is the case most of the time.  So say if I have a concealed weapon in a bag which is inside the car, they don’t really going to find them.  Oh but wait… after you park your car in the basement and try to enter the building … There is a security guy at the door, but … he doesn’t do anything.  You can just waltz yourself into the building and go on your merry way.   Another point of entry into the mall is a strip of underground tunnel from Jl. Jendral Sudirman into the mall.  There is a security checkpoint there, but again, I’ve seen enough people going through the checkpoint and causing the alarm to beep, but… no extra security check was performed by the guard.  Of the latest, I’ve seen it in a lot at other places as well.  Totally, totally false sense of security.

On Cause and Effect

In a nearby rich neighborhood from where I live, oh heck, let’s just call it by name, Kebun Jeruk Intercon, one family home was robbed.  The detail is not important.  It just happened to involve a small kid, maid of the house and stranger pretending to know the owner of the house and was granted access into the house by the maid or something like that.  One thing that you should know is that this particular neighborhood connects two major roads (Joglo Raya and Meruya) and a lot traffic is taking advantage of it by passing through the neighborhood to get from one road to the other.  Not long after the incident, the usual passageway through the neighborhood were blocked (at least from Joglo Raya side).  No more traffic can get through from that side.  I’m sure as a community, the neighborhood has put a lot of thought before closing itself to the public, but I don’t think they thought about the effect of such action.  All the traffic, and I mean a lot of it, that used to go through that connecting road now has to be redirected somewhere else.  The problem is, the other supporting roads are just inadequate to receive the new traffic flow and walla, the already hellish traffic area is now becoming more unbearable.  Where it used to be a pretty smooth 10 to 15 minutes ride through Srengseng, now becomes 45 minutes to 1 hour to go through.  And the funny thing is, even though they plugged the main entrance, there are a lot of other ways to get in / out from that complex.  I can think of 2 to 3 already.  And Indonesian being resourceful as we are can’t help but to take advantage of these “jalan tikus” (alternate roads).  The people using these alternate small roads are so many that they are causing more traffic jam in Joglo Raya that is as I said already a hellish road, especially one narrow part of it.  Do the people in Intercon deserve to feel safe?  Of course, they do, but … are they really safe now that they have closed that particular road entrance?  I think not.

What’s the Point?

My point for this rambling is that, in the end, you just can’t depend on other for security.  You have to take it seriously on your own.  Be aware of your surrounding and the lack of security there of.  Be proactive and less reactive.  Knee jerk reaction like in the second story will only cause more problems, if not for you, then for a lot of others and really… in that particular example, it’s not even a complete safety solution.

On Roundabout Sillyness

Who the h*#% invented this useless thing?  At least of every places that I've been to, I've only seen one that actually work properly and that is certainly not in this country (Indonesia).  All the roundabout locally is nothing but a huge trap for traffic jam / slowdown since nobody actually put any sane thought on how to do correct traffic flow for it.  For those who does not know what I'm talking about, roundabout is that circle structure in a middle of a 2 or more ways road intersection.  For example:  Bundaran HI or the one in Kelapa Gading or wherever else you can think of. *sigh*

On Silly Road Design or Lack of It

Every day of the week since I got back to Indonesia (let see, counting this year, it would be already 5 years), I have to endure one silly portion of the road that is called Joglo Raya.  Let see, how should I begin...  Okay, imagine a 4 lane (officially) road, 2 going to one direction and 2 going the other direction which suddenly narrow down to 2 freaking lane (1 going one way and one going the other way) which will go on for about 1 km or so and suddenly becoming a broad 4 lane (officially) again. Can you say... BOTTLE-FREAKIN'-NECK???

Combine that with the unruly Jakarta's motorists... remember, I mentioned 4 official lanes... unofficially, it's 6 or 8 freaking lane, meaning you squish 4 lanes of traffic into one that supposed to be only 2 lanes going the same direction.  Can you say LACK OF TRAFFIC-*#$%&-CONTROL & PLANNING???

I don't think I have to say anything more on this subject. *sigh*

On Queueing or Lack of It

One thing that I freakin' hate is that people who just don't understand about queueing etiquette.  Surprisingly, I've seen sticker / banner on this topic somewhere (forgot where I've seen it... maybe at the airport, not sure) in big big letters.  Something like ...BUDAYA NGANTRI...  But, apparently Indonesian public or most that I've encountered anyhow are totally foreign to this concept.  This, more than anything is one of the most annoying habit that I found of the local people, especially on the road, but not constrained to one.  Yesterday alone, I've encountered numerous of this, on the road and when queueing for food... say at Es Teler 77 or after church trying to buy a street vendor's food.  *sigh*

Are You a Lemming / Cartman Wannabe?

Oh while we are on the topic, how come I get the impression that Indonesian public mentality is similar to those video game characters in Lemmings.  You know... if the one in front is jumping off a cliff the rest will basically follow the one in front.   Plenty of proof of this that you can see every single freakin' day.  Don't believe me?  Just pay attention the motorists on your way to work or back.  One of them will run over a traffic light and about 6 or 10 others will follow closely behind.

COME ON, PEOPLE!! Stop the Cartman - me first and screw you all - mentality (If you don't know what I'm talking about, look up South Park somewhere) already *sigh* 

I've never been a fan of ASP.NET Validation controls (perhaps old habit dies hard).  Well, the real reason is because I've tried using them before and it felt very quirky and buggy, especially when you just started using it.  For example, one moment it works and then suddenly it does not work anymore and you are left standing in confusion wondering what the heck is actually going on in the backend.  In the end, I found that writing my own client side validation routine will give me complete control over how and what to validate (as it was in classic ASP).  That's right... I'm a control freak and am proud of it *hahaha*.
But in the last two web projects, I finally decided to give them a second try. Sure, why not, right?  Less form validation code to write... right?  Less headache, right? At least that was the premise of the Validation controls.

So, I started with the easiest one, RequiredFieldValidator ... compiled it, ran it, tested it. Great, it worked.  Piece of cake... Perhaps I should change my thinking about these neat validators stuffs, hmm... or so I thought. 

Great, next, let's try the CustomValidator to validate a dropdown list like the one described below.  The end result that I was going for is that if the value of the control to be validated is empty, show validation error.  (Perhaps I should clear it a bit more... if the first dropdown list item is currently selected, which just happen to have empty value - it's a dummy option -, return fail).

The controls are setup as:

<asp:customvalidator id="DisciplineCustomValidator" runat="server" 
    ClientValidationFunction="ValidateDiscipline" 
    ControlToValidate="DisciplineDropDownList" 
    ErrorMessage="Invalid discipline choice." Display="Dynamic">*</asp:customvalidator>

<asp:dropdownlist id="DisciplineDropDownList" runat="server"></asp:dropdownlist>

The dropdown list, after data bound, will have the following OPTION elements...

<option value=“A“>A - Discipline A</option>
<option value=“B“>B - Discipline B</option>
<option value=“C“>C - Discipline C</option>

and the Javascript client side validation code as follow:

function ValidateDiscipline(source, args)
{
    args.IsValid = false;  // force failure to test...
}

and the server side validation code as follow:

private void DisciplineCustomValidator_ServerValidate(
    object source, 
    System.Web.UI.WebControls.ServerValidateEventArgs args)
{
   args.IsValid = false;  // force failure to test ...
}

Compiled it, ran it, tested it... Great it work as expected.

Having my faith in the ASP.NET Validation control renewed, I decided to have a little bit more fun with it.

Next step, I added a dummy option for my DisciplineDropDownList... after databinding, the list should contain the following OPTIONs...

<option value=““>- - Select a Discipline - -</option>
<option value=“A“>A - Discipline A</option>
<option value=“B“>B - Discipline B</option>
<option value=“C“>C - Discipline C</option>

Of course, user should not choose the first option in the list... that would be bad... No no no. *wiggle index finger from side to side*  Bad user... very very bad user.  You no no choose the Select a Discipline option.  No you don't.  Great, now it's decided, the ValidateDiscipline JavaScript function should take care of this...

so, I changed my Javascript routine to something like so...

function ValidateDiscipline(source, args)
{
    args.IsValid = (args.Value != ““);
}

and the server side validation code as follow:

private void DisciplineCustomValidator_ServerValidate(
    object source, 
    System.Web.UI.WebControls.ServerValidateEventArgs args)
{
   args.IsValid = (args.Value != string.Empty);
}

Compiled it, ran it, tested it.  Well, guess what... the validation stopped working.  Hmm... *boggled* *getting irritated* *started cursing like a mad monkey* *pulled hair frustratedly* - I swear... sometimes I think I pulled my hair too much that I've become more and more balder...sigh.

Both client side and server side validation just do not want to trigger for whatever reason.

Long story short, after googling for about 30 minutes trying to get to the root of the problem, and not finding real solution to this problem, I've decided to put the code back in the state where it last worked.

So the options are back to...

<option value=“A“>A - Discipline A</option>
<option value=“B“>B - Discipline B</option>
<option value=“C“>C - Discipline C</option>

Compiled it, ran it, tested it.  !^&*#!(* it worked again.

It looks like the CustomValidator does not like the argument value to be empty string.  Lesson learned.

Jimmy's ASP.NET CustomValidator rule #1: Thou shalt not custom validate against empty string (well not exactly).

The long version: If you specify a ControlToValidate attribute in the CustomValidator and the default value to validate againsts is an empty string value, the control will fail miserably regardless what you are putting into the client side validation function.  It will always return as valid.

Is this a bug? or by design?  You tell me...

If you should find yourself needing to do this, you can do the following...

Do not specify the ControlToValidate attribute in the CustomValidator tag. And re-code your validation routine to like so...

function ValidateDiscipline(src, args)
{
   var e = document.getElementById(“DisciplineDropDownList“);
   args.IsValid = (e.options[e.selectedIndex].value != ““)
}

or in my case, like this...

function ValidateDiscipline(src, args)
{
   var e = document.getElementById(“DisciplineDropDownList“);
   args.IsValid = (e.selectedIndex > 0);
}

Till next validation control quirkiness... Nuff said.