Monthly Archives: April 2010

A “new” hack to WordPress at GoDaddy sites

1 minute, 50 seconds

Recently slashdot posted this:

Massive Number of GoDaddy WordPress Blogs Hacked
A nasty little exploit has hit a large number of GoDaddy-hosted WordPress blogs this weekend. The best part is that the exploit only executes when the traffic is referred by Google, making it the sort of thing that site maintainers won’t easily notice. Clever and devious.
Slashdot

Immediately, with out reading any more of the sources for the article I had my suspicions that this was nothing new. The part where they say “only executes when referred by Google” (or refered [sic] :) is what tipped me. This was an old hack for old version of WordPress, topics I’ve written about before.

Digging deeper and looking at the source article, I see that that an enterprising hacker has gone the extra step of trying to turn your computer into a virus filled bot computer (or some other nefarious sounding term). The write up, with breaking news current as of today, is over at wpsecuritylock.com. The break down of the virus payload and sources was then attempted over at some dude name Dancho Denchoev’s blog. Dancho’s write up looks good, but use of “emerging threatscape” in is bio doesn’t look so good.

My take on all this is going to sound familiar: you must be vigilant about keeping your software up to date. I suspect that a lot of the GoDaddy customers feel they really got the shaft. Most likely these WordPress installs were all copies of the same older WordPress installed via a control panel for a domain that said “Set up a blog in 1 click!”. This is a great use of an open source project and WordPress is a really good candidate to be the one click code base for a blog. However, the end user at GoDaddy probably knows more about their flower pots or farmers market they blogged about, than about how to upgrade their blog. I’m not entirely sure it should have fallen to GoDaddy to keep up to date, but enabling easy updates (it’s built in since…um WP 2.8?) via SFTP and really extra for reals making sure folks upgrade would have gone a long way. Further, there’s all kinds of ways you can harden WordPress. You don’t want to be Network Solutions with their big hack (nor suffering the wrath of a WordPress author!).

Speaking of WordPress authors, you should check out their Codex entry on the Hardening WordPress. It’s a good, holistic approach at security.

Will the real 404 please stand up?

0 minutes, 46 seconds

One of the laptops in the house died recently. The svelte new Dell Latitude 13 showed up as its replacement, and it’s great. However, it’s running a factory set up version of IE8. I don’t use IE8, opting for the fox (for debugging) or the goog (for speed) instead, but I noticed that the totally awesome plip 404 page was being usurped in IE8. This will not stand! Just as I will not have my ISP taking over DNS for domains that don’t resolve, I will not have my browser decide what a 404 page should look like.

At first I found some sites that suggested a different header or that you could make your 404 page more than 512 bytes. While this will work, and will work every *every* user, I was curious about a client side setting. Enter “show friendly http error message” check box:

Just uncheck that guy in your IE settings and welcome back fugly plip 404 messages. Interesting enough, there’s all kinds of wackiness in Microsoft land about this. Read on if you care!

True Cost

3 minutes, 34 seconds

When we consume products in the US, what is the true cost? Most folks would think it’s simply the dollars they shell out of their wallet for the item they just purchased. If it’s just a monetary exchange, then price is king and entirely defines an item’s true cost. You should always pay the lowest amount possible for the highest quality goods.

To that end, Amazon’s native Android app is pretty great. Say you’re in your local widget shop, just down the street and they have Model A Widgets for $59.99. Whip out your phone, scan the bar code and BEEP, you see Amazon has it for $39.99. What’s that? It’s on Amazon Prime too? Sign me up! I get it 2 day shipping and tax free!

What if you’re looking for an audio cable. You could make one out of the spare parts bucket you’ve got in your garage, or you could get shiny new one online for $75.00. But whats this? It’s marked down to $4.72? Well, that’s over a 90% discount, sign me up for that deal too!

What about food? Should I pay triple for an Avocado because it has the “Organic” label on it? No way jose! The ones in the bin right next to it are cheaper and bigger to boot.

If you know me, you know this is not what I believe. I believe that the true cost of that widget includes not only the revenue you deprive your local shop of, but the neighborhood’s loss when it’s full of big box stores. I once was told by a fake cop I couldn’t park my bicycle in front the big box store I was trying to patronize because it wasn’t allowed. See, the entire box store mall setup was on private property, so they could set arbitrary rules that made no sense and then kick you off their property if you ride a bike and park it “funny”. Yes, a bit of a rant, I know, but I consider that the true cost of keeping your local shops in business.

The food has the same true cost. We should ensure our local farmers can make a living wage off the food they sell. Further, we should not by crap that will so pumped full of craziness, including preservatives that last forever. Eating this deprives us of healthy bodies which in turn cost the health care system money to fix.

Sadly, this post has a hypocritical end. I bought the cable. It came two days latter to my office. I suspect there’s some little boy in a sweat shop who doesn’t like me. I could have pulled out my soldering iron, found the scrap cable parts in my wires bucket and pieced together the cable I need. But nope, I just clicked “buy” instead.

Any one know of a good place online to by this sort of item and pay the true cost for it?

Update: One of our fine (few?) readers wrote in:

Interesting post. Here is an article, though a few years old now, that I may have alluded to in the past: Food That Travels Well

It doesn’t address electronics, but food. The main point being that distance itself isn’t the only variable in the “true cost” of something equation, at least environmentally.

Good point! Looking at the true cost inherently means you open the cost equation wider and wider, thus covering more and more factors. In this case, the fact that farmers can’t graze their sheep and are forced to use feed bumps up the net pollution for equation.

This should give us pause to know more about what we consume and what resources that consumption demands. A good, but admittedly hard to find, solution is something like Polyface farms as featured in Michael Pollan’s Botany of Desire. What’s hard to find here is the solution to the massive equation to figure the true cost of eating a good steak. In general, we, as lazy consumers, don’t want to be on the line for counting every carbon footprint, health care cost, and increase in child slavery. Instead, we want a simple, “If I do A, B will happen” type of solution. It doesn’t exist.

Here’s another tip of an iceberg along the lines, of “just do A…”:

The geophysicists Gidon Eschel and Pamela Martin have estimated that if every American reduced meat consumption by just 20%, the greenhouse gas savings would be the same as if we all switched from a normal sedan to a hybrid Prius – Meat: Making Global Warming Worse

There’s a great exhibit at the Academy of Science that explores this fact and demonstrates it in a way that even a 10 year old can grok.

More food for thought, indeed! Also, I very thoroughly checked the “Rambling” category in this update too ;)