Aug 25

Spam alert

Yes, I’m aware of the spam on the blog front page. The management does not hawk dubious drugs.

Daniel Franke and I just did an audit and re-secure of the blog last night, so this is a new attack. Looks like a different vector; previously the spam was edited into the posts and invisible, this time it’s only in the front-page display and visible.

It’s a fresh instance of WordPress verified against pristine sources less than 24 hours ago, all permissions checked. Accordingly, this may be a zero-day attack.

Daniel and I will tackle it later tonight after his dinner and my kung-fu class. I’ll update this post with news.

UPDATE: The initial spam has been removed. We don’t know where the hole is, though, so more may appear.

UPDATE2: It’s now about 6 hours later and spam has not reappeared.  I changed my blog password for a stronger one, so one theory is that the bad guys were running a really good dictionary cracker.

Feb 09

Admire this?

Regulars: If you’re seeing the blog’s main page with a blue bar across the top, directly below the title, then you’re probably seeing the “Admire” theme. It’s an improvement over TwentyEleven, and I’ve figured out how to disable comment nesting. Let me know what you think: is this an improvement over the old Live Steam theme?

UPDATE: Aha! I found an even more minimalist skin, a bit closer to the look of the old Live Steam. No more blue bar, and no more boxes around comments.

Feb 09

Reverting to the old theme…

I’m reverting to the old theme to see if I can fit some of the new features in it.

I agree the new theme was too whitespace-heavy, and comment nesting was not working out as well as I’d hoped. I haven’t been able to figure out how to get rid of the huge right margin on comment lists, which is the misfeature that annoys me most. By contrast, the serif font would have been easy to fix.

A significant reason comment nesting wasn’t working for me is that the administrative page doesn’t do it even when the main theme does. Thus, when commenters reacted naturally to the nesting by leaving out quotes, I could no longer follow threads.

The main reason I changed themes was to be able to support modular theme widgets, which is the newfangled way in WordPress to lay out sidebars and footers. Also, I was beginning to fear that changes in the underlying WordPress engine would break my theme, which is a custom variation of an old one called “Steam” from the 2.x version. (I changed it to be flexible to the browser size rather than having a fixed bounding box and padding, a design style I hate for both practical and philosophical reasons.)

Now I’ll try retrofitting widget support into my old theme (I call it “Live Steam”; the new one was a stock WordPress theme called TwentyEleven). Or, I might try finding a theme that already supports widgets and has a similar look and feel. The management regrets any inconvenience.

Jan 20

Site statistics are enabled

I finally got around to installing a site statistics plugin on this blog, about 20 minutes ago. There have since been 94 views.

I’m mainly interested in the order of magnitude. Do I have 1K readers per day? 10K?, 100K? My wild-ass guess is on the order of 10K. Now we’ll see.

Sep 30

Berlios is dying…

I just got word that berlios.de, where I have several projects hosted including GPSD, is going to shut down at the end of the year.

This is a huge pain in the ass. It means I’m going to have to bust my hump to get us to new hosting space. Moving the git repo won’t be bad, but moving the mailing list and bugtracker content is going to suck. What’s worse, all the project URLs are going to break.

Back in 2009 I launched a project called forgeplucker to address this sort of migration problem. It stalled due to a flaky hosting site…

Jul 12

Heads up: Google+ changes things

This is a heads-up for all fans of this blog. You probably want to get on Google+ ASAP, because in the future some content I would have shipped as short posts here will be Google+ shared text instead.

Essay-length stuff will remain here with pointers from Google+ updates. Likely I will lock comments on the Google+ updates.

UPDATE: Follow me here. Also, since there seems to be some confusion on this score, let me emphasize that I will continue to use this blog for essay-length content.

Dec 09

Blog outage for upgrade

Hey ho, another day, another mandatory WordPress security update.

There will be a brief outage. Possibly there might be a prolonged one.

The management regrets any inconvenience.

UPDATE: That’s done. We now return you to your regularly-scheduled flamage.

Nov 17

Why spamrape happens

One of my regulars writes, re the recent spam-raping of the blog

>I’m still trying to figure out what the attack was. All the comments were replaced by spam?

No. What happened was that on Sunday night I caught a bot in the act of replacing real comments with spam, oldest first. It was working its way forward in time, apparently limited by the spped at which the PHP in WordPress could respond. It was very lucky that I caught it as soon as I did; I happened to need to look at a post from 2002 twice within minutes and saw the comments had changed.

I think the purpose of replacing oldest comments first was to delay or prevent me from noticing what had happened until the whole blog was corrupted. And corrupting the blog wasn’t the actual aim, anyway; what they were actually trying to do was boost the Google ratings of various shady marketing and scam sites by stuffing a fairly high-ranked blog with links to them.

Nov 16

The Rape of the Blog

(Part of this is a repost. The problem it described have been solved, at least until someone finds the next hole in WordPress. I have restored it to keep the record complete.)

Sometime late Sunday night or Monday, I wrote:

My blog is being raped by a spambot. I first noticed about a half an hour ago that some older posts had become inaccessible through search. Then I actually accessed an old post (“Women With Guns”) twice, a few mnutes apart, and saw that the 8 comments there originally had been replaced by one spam comment.

What’s probably happeniing is some sort of SQL attack on the database behind the blog engine.

I don’t recommend commenting until after we can close the hole and restore from a backup.

My rm -fr blunder on Friday proved to be but the entr’acte of a four-day descent into system-administration hell, from which I shall not even yet say I am delivered lest the dread god Finagle and his mad prophet Murphy laugh at my presumption and turn their awful gaze upon me. The aftermath of the spambot rape was actually mere a divertimento, playing as several different unrelated hardware and software snafus delivered a finely orchestrated attack upon my sanity.

Did I say merely my sanity? The consequences actually drew blood, which has done a pretty good job of soaking through the bandage over the laceration on my thumb. I have learned several different lessons which are unlikely to grow dim or doubtful.

1. Do not trust KVM splitters. They are flaky and can interfere with your diagnostic process, especially if you are having boot-time problems.

2. Ubuntu 10.10 is fucked up. I mean really fucked up, as in I have seen it hang during install on four different machines in the last 24 hours (and that was trying two different media). I had to drop back to 10.04 to get anywhere.

3. Ancient optical drives are an insidious horror. They can cause installations to fail in un-obvious ways. I replaced three today. It helped, but didn’t help enough by itself.

And most generally…if you are you one of those people, like me, who tends to never throws away superannuated hardware until it fails catastrophically, recycling old drives and cases and cables through multiple motherboard upgrades…stop now. You’ll feel virtuous and thrifty right up until the day you have a system emergency that snowballs into a major nightmare because some of your fallback hardware is marginal-to-the-point-of-near collapse and more of it is obsolete.

(Memo to self: Both PS/2 trackballs get replaced with USB devices as soon as I can get to MicroCenter. Who knew a brand-new motherboard would refuse to see them on the port?)

I’ve learned my lesson. I bought my way out of this disaster by paying $400 for a shiny new mailserver/webhost/DMZ machine. The machine it’s replacing is going to the recyclers. No parts are going to get saved to be built into Frankenboxes this time.

Now I gotta go wrestle with more consequences. My mail isn’t back up yet. The new machine needs configured.

Nov 16

After the spamraping, there has been some loss

This blog was badly raped by a spambot on Saturday. Recovery from the problem required restoring from a backup made early that morning. Lost in the restore were two posts and about a dozen comments.

It is possible I may be able to rescue some content by looking directly at an SQL dump, but I can’t guarantee anything. Apologies to anyone who was inconvenienced.

Jul 31

Spam inundation may result in lost posts

The amount of bot-spam being posted to this blog has gone up by an order of magnitude in the last week.

I wouldn’t bother my readers about this, except that if one of your posts happens to trigger the spam filter, the odds that I will notice and rescue it have dropped significantly. It’s easier to notice the ham in a dozen putative items of spam, which was the typical length of queue last week, than when the queue is 217 items long as it was just now.

This probably means akismet, the WordPress shared spamtrap that I use, needs some tuning. But I don’t know when or even if that problem will be fixed. Apologies for any inconvenience.

Sep 10

This blog got wormed

This blog is one of many that got hit late last week by a particularly nasty and invasive worm targeting WordPress sites. (No, it wasn’t a botched upgrade, as I saw at least one commenter speculate.) The first symptoms showed up either late Thursday or early Friday of last week, when links from the main page became garbled. What was going on was an attempt to insert pharmaceutical-spam malware into the site permalinks.

This injection attack actually corrupted the mysql database behind the blog, and some fairly serious surgery (which the ibiblio site admins were reluctant to try on a Friday) was required to fix it. All posts and coments from Thursday evening or previous should now be restored. The blog is now running WordPress 2.8.4, the very latest version which was rush-released to foil the worm.

A big hand to Ken Chestnutt, the ibiblio site administrator who did the actual repair. Regular posting will resume shortly.

May 02

I may have to disable IntenseDebate

I may have to disable IntenseDebate. The interface for approving/deleting/spam-flagging posts seems broken since sometime yesterday; I suspect some sort of database problem at intensedebate.com, as my local Javascript hasn’t changed.

If you have left a comment which has not appeared, have patience. I will try untangling the mess from my home machine Sunday night when I get home from my current road trip.

Sep 11

Blog site defacement

Sometime shortly after 6AM this morning, my blog site and home page were defaced, replaced with a message reading “Happy 9/11 LOL” and a very ugly image.

I happened to be up and working and discovered the damage quickly, probably within minutes of the attack. Less than ten minutes later I had received three pieces of email and a phone call alerting me; apparently, I have enough friendly readers that even if I had not been on line I would have been informed of such vandalism within a half hour.

I have undone the damage, taken some appropriate security measures, and reported full details of the crack to the ibiblio site admins. The pinhead behind this attack is very likely to be tracked down, and had better hope the ibiblio site people find him before I do.

Jul 25

On the road in Michigan

Blogging (and my responses to comments) will be light for the next two weeks. I’m on the road in Michigan, attending a week-long swordfighting intensive that starts tomorrow, then I’ll be at the World Boardgaming Championships for a week after that.