I created a Patreon page just before leaving for vacation on 2 Aug. The background to this is that while I’m now getting some regular bucks for working on NTPsec, it’s not a lot. Royalties from my books have been dwindling and my wife Cathy isn’t making all that much from legal contract gigs that are all she can get since Obamacare costs killed her full-time law job. Add the fact that our eight-year-old car has developed problems that would cost more to fix than its book value, and the house needs a new roof, and it’s looking pretty broke out.
Gitorious – which I preferred to GitHub for being totally open-source – is shutting down sometime in May. I had no fewer than 26 projects on there, including reposurgeon, cvs-fast-import, doclifter, and INTERCAL.
Now they’ve moved. This won’t affect most of my users, as the web pages and distribution tarballs are still in their accustomed locations at catb.org. If you’re a committer on any of these Gitirious repos, of course, the move actually matters.
Temporarily the repositories are on thyrsus.com; here’s the entire list. They may not stay there, but moving them to thyrsus.com was 90% of the work of moving them anywhere else and now I can consider options at my leisure.
Yes, I’m aware of the spam on the blog front page. The management does not hawk dubious drugs.
Daniel Franke and I just did an audit and re-secure of the blog last night, so this is a new attack. Looks like a different vector; previously the spam was edited into the posts and invisible, this time it’s only in the front-page display and visible.
It’s a fresh instance of WordPress verified against pristine sources less than 24 hours ago, all permissions checked. Accordingly, this may be a zero-day attack.
Daniel and I will tackle it later tonight after his dinner and my kung-fu class. I’ll update this post with news.
UPDATE: The initial spam has been removed. We don’t know where the hole is, though, so more may appear.
UPDATE2: It’s now about 6 hours later and spam has not reappeared. I changed my blog password for a stronger one, so one theory is that the bad guys were running a really good dictionary cracker.
I’ve settled on Brad Thomas’s “Admired” with the light white skin as the new theme for this blog. It’s a relatively new theme and is being actively maintained with a support forum. which relieves my main worry about my old Live Steam theme – it’s not going to fall out of sync with the WordPress engine any time soon.
Regulars: If you’re seeing the blog’s main page with a blue bar across the top, directly below the title, then you’re probably seeing the “Admire” theme. It’s an improvement over TwentyEleven, and I’ve figured out how to disable comment nesting. Let me know what you think: is this an improvement over the old Live Steam theme?
UPDATE: Aha! I found an even more minimalist skin, a bit closer to the look of the old Live Steam. No more blue bar, and no more boxes around comments.
I’m reverting to the old theme to see if I can fit some of the new features in it.
I agree the new theme was too whitespace-heavy, and comment nesting was not working out as well as I’d hoped. I haven’t been able to figure out how to get rid of the huge right margin on comment lists, which is the misfeature that annoys me most. By contrast, the serif font would have been easy to fix.
A significant reason comment nesting wasn’t working for me is that the administrative page doesn’t do it even when the main theme does. Thus, when commenters reacted naturally to the nesting by leaving out quotes, I could no longer follow threads.
The main reason I changed themes was to be able to support modular theme widgets, which is the newfangled way in WordPress to lay out sidebars and footers. Also, I was beginning to fear that changes in the underlying WordPress engine would break my theme, which is a custom variation of an old one called “Steam” from the 2.x version. (I changed it to be flexible to the browser size rather than having a fixed bounding box and padding, a design style I hate for both practical and philosophical reasons.)
Now I’ll try retrofitting widget support into my old theme (I call it “Live Steam”; the new one was a stock WordPress theme called TwentyEleven). Or, I might try finding a theme that already supports widgets and has a similar look and feel. The management regrets any inconvenience.
Hold on to your hats, I’m going to be experimenting with some theme and sidebar changes for the blog. Don’t be surprised if it looks different than you’re used to…
I finally got around to installing a site statistics plugin on this blog, about 20 minutes ago. There have since been 94 views.
I’m mainly interested in the order of magnitude. Do I have 1K readers per day? 10K?, 100K? My wild-ass guess is on the order of 10K. Now we’ll see.
I just got word that berlios.de, where I have several projects hosted including GPSD, is going to shut down at the end of the year.
This is a huge pain in the ass. It means I’m going to have to bust my hump to get us to new hosting space. Moving the git repo won’t be bad, but moving the mailing list and bugtracker content is going to suck. What’s worse, all the project URLs are going to break.
Back in 2009 I launched a project called forgeplucker to address this sort of migration problem. It stalled due to a flaky hosting site…
This is a heads-up for all fans of this blog. You probably want to get on Google+ ASAP, because in the future some content I would have shipped as short posts here will be Google+ shared text instead.
Essay-length stuff will remain here with pointers from Google+ updates. Likely I will lock comments on the Google+ updates.
UPDATE: Follow me here. Also, since there seems to be some confusion on this score, let me emphasize that I will continue to use this blog for essay-length content.
Hey ho, another day, another mandatory WordPress security update.
There will be a brief outage. Possibly there might be a prolonged one.
The management regrets any inconvenience.
UPDATE: That’s done. We now return you to your regularly-scheduled flamage.
One of my regulars writes, re the recent spam-raping of the blog
>I’m still trying to figure out what the attack was. All the comments were replaced by spam?
No. What happened was that on Sunday night I caught a bot in the act of replacing real comments with spam, oldest first. It was working its way forward in time, apparently limited by the spped at which the PHP in WordPress could respond. It was very lucky that I caught it as soon as I did; I happened to need to look at a post from 2002 twice within minutes and saw the comments had changed.
I think the purpose of replacing oldest comments first was to delay or prevent me from noticing what had happened until the whole blog was corrupted. And corrupting the blog wasn’t the actual aim, anyway; what they were actually trying to do was boost the Google ratings of various shady marketing and scam sites by stuffing a fairly high-ranked blog with links to them.
(Part of this is a repost. The problem it described have been solved, at least until someone finds the next hole in WordPress. I have restored it to keep the record complete.)
Sometime late Sunday night or Monday, I wrote:
My blog is being raped by a spambot. I first noticed about a half an hour ago that some older posts had become inaccessible through search. Then I actually accessed an old post (“Women With Guns”) twice, a few mnutes apart, and saw that the 8 comments there originally had been replaced by one spam comment.
What’s probably happeniing is some sort of SQL attack on the database behind the blog engine.
I don’t recommend commenting until after we can close the hole and restore from a backup.
My rm -fr blunder on Friday proved to be but the entr’acte of a four-day descent into system-administration hell, from which I shall not even yet say I am delivered lest the dread god Finagle and his mad prophet Murphy laugh at my presumption and turn their awful gaze upon me. The aftermath of the spambot rape was actually mere a divertimento, playing as several different unrelated hardware and software snafus delivered a finely orchestrated attack upon my sanity.
Did I say merely my sanity? The consequences actually drew blood, which has done a pretty good job of soaking through the bandage over the laceration on my thumb. I have learned several different lessons which are unlikely to grow dim or doubtful.
1. Do not trust KVM splitters. They are flaky and can interfere with your diagnostic process, especially if you are having boot-time problems.
2. Ubuntu 10.10 is fucked up. I mean really fucked up, as in I have seen it hang during install on four different machines in the last 24 hours (and that was trying two different media). I had to drop back to 10.04 to get anywhere.
3. Ancient optical drives are an insidious horror. They can cause installations to fail in un-obvious ways. I replaced three today. It helped, but didn’t help enough by itself.
And most generally…if you are you one of those people, like me, who tends to never throws away superannuated hardware until it fails catastrophically, recycling old drives and cases and cables through multiple motherboard upgrades…stop now. You’ll feel virtuous and thrifty right up until the day you have a system emergency that snowballs into a major nightmare because some of your fallback hardware is marginal-to-the-point-of-near collapse and more of it is obsolete.
(Memo to self: Both PS/2 trackballs get replaced with USB devices as soon as I can get to MicroCenter. Who knew a brand-new motherboard would refuse to see them on the port?)
I’ve learned my lesson. I bought my way out of this disaster by paying $400 for a shiny new mailserver/webhost/DMZ machine. The machine it’s replacing is going to the recyclers. No parts are going to get saved to be built into Frankenboxes this time.
Now I gotta go wrestle with more consequences. My mail isn’t back up yet. The new machine needs configured.
This blog was badly raped by a spambot on Saturday. Recovery from the problem required restoring from a backup made early that morning. Lost in the restore were two posts and about a dozen comments.
It is possible I may be able to rescue some content by looking directly at an SQL dump, but I can’t guarantee anything. Apologies to anyone who was inconvenienced.
The amount of bot-spam being posted to this blog has gone up by an order of magnitude in the last week.
I wouldn’t bother my readers about this, except that if one of your posts happens to trigger the spam filter, the odds that I will notice and rescue it have dropped significantly. It’s easier to notice the ham in a dozen putative items of spam, which was the typical length of queue last week, than when the queue is 217 items long as it was just now.
This probably means akismet, the WordPress shared spamtrap that I use, needs some tuning. But I don’t know when or even if that problem will be fixed. Apologies for any inconvenience.
This blog is one of many that got hit late last week by a particularly nasty and invasive worm targeting WordPress sites. (No, it wasn’t a botched upgrade, as I saw at least one commenter speculate.) The first symptoms showed up either late Thursday or early Friday of last week, when links from the main page became garbled. What was going on was an attempt to insert pharmaceutical-spam malware into the site permalinks.
This injection attack actually corrupted the mysql database behind the blog, and some fairly serious surgery (which the ibiblio site admins were reluctant to try on a Friday) was required to fix it. All posts and coments from Thursday evening or previous should now be restored. The blog is now running WordPress 2.8.4, the very latest version which was rush-released to foil the worm.
A big hand to Ken Chestnutt, the ibiblio site administrator who did the actual repair. Regular posting will resume shortly.
I have deactivated IntenseDebate. Its maintainers tell me there is no way to disable pagination of comments, a feature several of my regulars justifiably complained about and I loathed.
I apologize for any inconvenience this may have caused.
If you have left a comment which has not appeared, have patience. I will try untangling the mess from my home machine Sunday night when I get home from my current road trip.
I’m installing the WordPress IntenseDebate plugin. Commenting may have glitches for an hour or two, after which will have plenty of new features including comment threading and reply by email..
Sometime shortly after 6AM this morning, my blog site and home page were defaced, replaced with a message reading “Happy 9/11 LOL” and a very ugly image.
I happened to be up and working and discovered the damage quickly, probably within minutes of the attack. Less than ten minutes later I had received three pieces of email and a phone call alerting me; apparently, I have enough friendly readers that even if I had not been on line I would have been informed of such vandalism within a half hour.
I have undone the damage, taken some appropriate security measures, and reported full details of the crack to the ibiblio site admins. The pinhead behind this attack is very likely to be tracked down, and had better hope the ibiblio site people find him before I do.