Who would want to hack my website?!

It would appear that hacking doesn’t always take the “This site 0WneD by L33t Hax0rs” form, and that WordPress sites in particular are being targetted by Spam Injection hacks.

A few weeks ago I noticed that the ads on the front page of pnotepad.org were a little odd, lots of drug adverts and nothing programming related. I didn’t really think much about it, however, and moved on to something else.

Yesterday I got a friendly tip-off e-mail (thanks Erik!) telling me that pnotepad.org was serving up adverts and links for various drugs and other unpleasantness. Weirdly, I couldn’t see the problem at all. A little bit of investigation showed that these ads were only showing up if you used Firefox (not Safari or IE), but sure enough they were there.

I spent the rest of yesterday evening undoing the work of the hacker, tying down various parts of the host system, upgrading WordPress and re-doing the customisations used on the pnotepad.org site.

It’ll never happen to me.

I had put off upgrading WordPress for a long time due to thinking I’d need to rework various customisations with the upgraded code, and not really knowing how much effort the upgrade would cost me. I learned a lesson there! The hacker got in via well-known WordPress hacks. In the end, the pnotepad.org site didn’t work properly for a few hours – perhaps 10 at most (some while I slept). I wish I had just upgraded earlier.

If you run a WordPress-based site or blog, make sure you are up-to-date! This means you may have to take some pains and use newer versions that you’re not fully sold on, but the alternative is you may end up with a hacked site. You may not even notice at first!

There are some useful pages on hardening your WordPress install here:

• Hardening WordPress at the Codex
• Using mod_rewrite and htaccess to harden WordPress

For the last 10+ years I have run my own mail server, I’ve used a variety of platforms and servers including Win NT4, Win 2k, Debian and Gentoo using Mailtraq on Windows and Postfix/Qmail/Exim/Courier/Squirrelmail on Linux. Mailtraq was very easy to administer and I would highly recommend it, but I needed to move away from hosting a Windows machine at home and the only reasonably priced VM I could afford was a Linux host.

Administering any of Postfix/Qmail/Exim is fairly hard work. The tools are almost all console based (it’s Linux!) and the configuration often complicated and hard to debug. That said, these systems will run in low memory environments and deliver mail efficiently. The problem is keeping on top of a Linux system running these tools and making sure everything keeps running smoothly takes a fair amount of time – way more than administering Mailtraq ever took.

I was in the middle of advising a friend to use Google Apps the other day when it occurred to me that perhaps I should take my own advice. Managing my gentoo box has been eating up a lot of my time over the last year, I want to rebuild with something more manageable but migrating the full mail setup to a rebuilt box filled me with fear.

So I took the plunge and migrated untidy.net to Google Apps in one night. The sign-up and configuration process was very easy, and the advice on what needed doing externally was clear and concise. Essentially I just needed to change the domain MX records for untidy.net to point to Google mail servers and optionally add a record to give me a nice domain for webmail. For plenty of good information on techniques for migrating your mail to Google Apps see the excellent article by Scott Hanselman

Having done that I’m now in the process of migrating the pnotepad.org mail services to a combination of the same google apps account, and the google groups lists service. The mailing lists have already been moved, this was simply a matter of transferring member lists which was easy to do. The rest of the mail will be moved tonight hopefully.

I’m already familiar with the gmail interface and using it for all my mail now is proving great so far, it’s a huge improvement over squirrelmail. Even if I don’t want to use the web interface, I can access my mail over IMAP or POP3 just like before.

For me, Google Apps is the new Linux Mail Server – why run your own when someone far more competent can run one for you!

Just today at work, hundreds of Facebook users are being shown the inboxes of other users. It appears to be some kind of web caching issue caused by recent updates to Facebook. This is a huge breach of the privacy of each Facebook user affected. Fortunately it doesn’t show the contents of other pages, just the inbox but that’s still a big deal.

I’ll keep to keeping to myself thanks!

If I read your CV and find that you have worked with “FlurbleGibbet” for quite some time and my company is also working with the same technology, I’m very likely to test you on the subject of FlurbleGibbet. Here’s an example of a recent interview session:

Me: I see that you have used FlurbleGibbet in a couple of jobs, what level of skill would you say that you have with this technology?
Interviewee: Oh very advanced.
Me: Excellent! Given that, can you please explain to me the basics of FlurbleGibbet as if I were new to the technology?
Interviewee: Hmmm….
Err.
Mmmmmm..
No.
Me: Ok, don’t worry. How about the “Gibbet++” feature, are you familiar with that?
Interviewee: Oh yes, definitely.
Me: Great, can you tell me a little about how you would use it?
Interviewee: Errrrm.
Hmm
No, not really.

Can you see the point at which I flipped the dummy bit on this interviewee? To help, I’ve highlighted and underlined it above! If you come into an interview and lie about your knowledge or abilities, you are very unlikely to get the job – think before answering! If you have a technology on your CV that you have only passing familiarity with, then at least be honest when asked and say so. Even better, make it clear on your CV that you have a passing knowledge rather than real skills.

Every now and then a company releases an advert that you really don’t mind watching over and over again. This latest advert joins the previous three in the collection of adverts that I think show true talent, artistic skill and an intention to entertain as well as to sell.

My love of Honda adverts began with “Cog” – the honda Accord advert that took 6 months of planning, one week of shooting and 606 takes to get right. Cog is a fantastic example of a Rube Goldberg style device which legend has it ran the full way through as seen in the advert – other sources disagree and claim that it was taken in two halves due to cost and space, which is still astounding.

The next one that I remember is the “Impossible Dream” commercial, designed not to promote a specific product but instead the brand. Showing a number of famous Honda vehicles both old and new driven by a man singing along to Andy Williams, the advert comes to a climax with him plunging into the Iguasu falls and emerging singing in a Honda hot air baloon. This is a clever advert symbolising the life and dreams of Soichiro Honda that won the Meribel Awards Festival 2006 Grand Crystal award.

More recently Honda produced a new advert for the launch of the Civic: “Choir”. This advert featured a choir producing the complete soundtrack for various shots of the Civic driving about town. This advert made me smile, and again was achieved without tricks:

Finally back to the one I saw about two hours ago that inspired me to start up the computer and write this post, the new Asimo advert. Again this doesn’t really promote a particular product (Asimo doesn’t really count here) and is about the brand and their dedication to technology. Asimo is incredible, and even with recent movie clips on YouTube showing hilarious and no doubt costly accidents involving Asimo and stairs nobody can be unimpressed with the incredible control and lifelike movement on display.

This new campaign also has a web site to go with it (beware heavy use of flash, like this post!) “Human Technology” and comes with a series of five short films featuring Asimo to be available on iTunes and honda.co.uk (source).

While searching for this video, I found another Asimo one that I’ve not seen, here for your viewing pleasure anyway because it’s as good as the rest!

I hope you’ve enjoyed watching the above videos as much as I have while searching for them and writing this post. If only more adverts were made like these. If you want to learn more about Honda (and you should, they are an astounding company born largely through the incredible visions of Soichiro Honda) then read the Wikipedia article or, if you can get hold of a copy, the excellent editorial piece in the October 2006 issue of Car Magazine.

A friend and I went along to the Monthly Reading Japanese car meet yesterday for the first time. I had never seen so many Imprezas, Supras, Skylines and Integras in the same place (not to mention all the other cars).

This car made me laugh – I would never have thought of doing that to a Civic!

We sloped off after about half an hour having realised that our unmodified cars were looking very out of place.

Update: Another 140 since this post, this plugin is definitely saving me time!