Biosphere 2

Can you imagine staying inside a sealed building for two years without physical contact with the outside world? That’s what happened at Biosphere 2 in 1991. It makes an interesting story and the Wikipedia page has a lot more on that mission and a second one that followed.

We visited there today, here are a few photos!

Biosphere 2
Matt wants us to go live in Biosphere 2, away from the Nintendo Wii distractions to help get WordPress 2.5 out on time.
Biosphere 2Biosphere 2Biosphere 2Biosphere 2Biosphere 2Biosphere 2
A room with a view
I asked for a room with a view and they gave me this. WiFi reception is spotty but the view is stunning!

Blogging in Arizona

Most of the Automattic team are in the wilds of Arizona this week. Looking out the window I see an environment as alien to the green Irish landscape I’m familiar with as I’ll probably ever see. Cactus grows everywhere, dark green bushes cover the hills and the dirt on the ground is bone dry. The sun beats down out of a clear blue sky. It’s warm outside, but so cold in the shade. It’s still winter after all, even if it doesn’t feel like it to me.

Cactus

It’s WordPress this, WordPress that. Despite the broadband going down yesterday there’s plenty going on here. Stay tuned for new developments!

PS. Act Two, Automattic Fundraising. Great news for Automattic and WordPress!

Ping. The ping heard across the world

If you’re wondering why trackbacks and pings aren’t working on your blog then you might want to do what I did earlier today: allow your blog to talk to other servers.

WordPress needs either allow_url_fopen to be set On or to have the Curl extension loaded. If you’re having problems receiving pings from other blogs then both of these are probably turned off or missing. Wouldn’t it be nice if Options->Discussion warned that pings wouldn’t work?

Look in your php.ini, or the output of phpinfo() to check for both. If you want to enable fopen, then the entry in php.ini should look like this:

;;;;;;;;;;;;;;;;;;
; Fopen wrappers ;
;;;;;;;;;;;;;;;;;;

; Whether to allow the treatment of URLs (like http:// or ftp://) as files.
allow_url_fopen = On

I switched to Litespeed web server a while back and by default allow_url_fopen is set to Off and the curl library isn’t included. Check /opt/lsws/php/php.ini and make sure remote fopens are allowed!

Thanks Barry for helping me fix that.

PS. if you linked to this blog recently, feel free to save your post again. WordPress will ping my site again and this time the ping will get through.

Phoar! What a spike!

I released WP Super Cache 0.5.3 on Friday last. From the stats it looks like people are upgrading which is good news!

This version has a number of fixes and improvements:

  • If your blog is installed in a sub-directory you’ll want to upgrade. This version fixes the mod_rewrite rules that search for the cached files. If upgrading, make sure you delete the Super Cache rules so they’ll be upgraded. (Thanks Otto42)
  • With a click of a link in the backend page you can view your mod_rewrite rules to check that they are ok. This may help the adventurous who want to upgrade those rules manually too.
  • The plugin now warns if your blog’s root directory is writeable. Most of the time there’s absolutely no reason for this so it’s good to be reminded to fix it.
  • Check that $mutex is set. This is really only useful if your server is borked and the filesystem is mounted read-only but it’s good to be complete.

Wondering about the title? Check out this traffic graph Scott Beale posted a few weeks ago and you’ll understand. One of his posts hit the front page of Digg (twice) then Slashdot.org, and was covered by lots of other blogs and media. Wow.

On December 12th our blog hit a record high of 222,523 views in one day.

Best Buy Cease & Desist Traffic Stats

20f1aeb7819d7858684c898d1e98c1bb

What is the significance of “20f1aeb7819d7858684c898d1e98c1bb”? It’s the MD5 hash of the name “Anthony” and was the password used by someone who broke into lightbluetouchpaper.org. Searching for the md5 hash was clever, but it won’t work for long because Ryan is working on securing the WordPress cookies and passwords.
In case you’re wondering, the hacker got in because the blog was running an outdated version of WordPress.

Tips to help keep your blog safe:

  • Keep all your software updated, not just WordPress. Make sure your plugins are updated.
  • Use a strong password. Don’t use words or sequences of characters like “12345” as your password. Make it a mix of characters and numbers.
  • Don’t ever store your database dump online in a place Google will index it. It is very easy to use a Google search to find it.
  • If you use public WiFi or a net cafe regularly, use SSL to secure the communication with your blog. Use the secure admin plugin for just this purpose.
  • If you use Firefox, install PwdHash. It’s simple to use and works really well.

WordPress MU admins – Fire up phpmyadmin and look at wp_users. Try these sql queries to find weak passwords in your database:

SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘wordpress’);
SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘12345’);
SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘qwerty’);
SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘anthony’);
SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘Anthony’);
and because of the season:
SELECT count(*) FROM `wp_users` WHERE user_pass = md5(‘christmas’);

Scary isn’t it how many people still use simple passwords? I must release that “Strong password” plugin we use on WordPress.com soon. That will certainly help avoid account hijacking.

Spy on your visitors with Blog Voyeur

Do you ever wonder what pages your regular visitors look at? Do they dig deep into your blog exploring old posts or do they sit in their feed reader and only read your latest posts?

By using my Blog Voyeur plugin you can find out.

This is the first release of the plugin. It appears to work well on the couple of blogs I tried but your mileage may vary. Download link is on the Blog Voyeur homepage above.

blogvoyeur screenshot

Subscribe to comments?

Pass the word around. If you use the very popular Subscribe to Comments plugin by Mark Jaquith, you should download version 2.1.1 download the development version instead. (thanks Baris!)

The previous version has a small but annoying bug. If you approve comments from several posts at one time, everyone subscribed to those posts will get notifications for all the approved comments! Mark applied my patch 3 weeks ago but people are slow to update.

In the last 3 days I’ve received extra notifications from 2 blogs. I emailed the first blog owner, but then Pat moderated some comments this morning and I decided this was the easiest way to get the word out!

Go on, update your plugin! Your blog visitors will thank you!

Blogs in Plain English

What’s the big deal about blogs? Haydn rang me this morning because he’s doing research on blogs and I remembered Joseph mentioned this video on IRC. This is a reminder from the Common Craft folk that not everyone knows what a blog is, or why they’re a great communication tool.

If you’re reading this and thinking about setting up your own website, watch this short three minute video and you may well decide to start a blog. Nice to see WordPress.com get a mention too!

Digg users will love this

Version 0.5.1 of WP Super Cache is now available! This release of the plugin will be especially useful for Digg and Slashdot users who experience really huge traffic spikes.

This post has been dugg! Add your Digg here! I doubt it’ll get anywhere near the front page at this stage as it’s only collected 3 diggs in 7 hours. Once it hits 24 hours it disappears forever.

supercache-directfiles

After submitting a site to Digg, some people do the following to get every last ounce of performance out of their WordPress blog, especially on an underpowered server:

  1. Clear the cookies from their browser so the comment form won’t be filled in. (or use a second browser).
  2. Visit the page they submitted to Digg and save it to their desktop.
  3. Open an ftp programme, and recreate the path to the page. Then upload the saved file as “index.html” to that directory.
  4. Finally, after the Digg subsides 24 hours later, remember to remove the directory structure and index.html.

The new version of WP Super Cache automates all the above. You do have to make your blog’s root directory writable by the webserver, but you’re warned continually that this is a major security risk and reminded to make it read-only again.

Download it here: wp-super-cache.0.5.1.zip

How does it perform versus the regular static files the plugin creates? In most situations you won’t notice any difference, but when there are tens of thousands of requests hitting your server for one particular page, I find that Apache has trouble keeping up.

In other developments, I added checks for PHP safe_mode. Unfortunately safe_mode stops WP Super Cache working properly. I’m glad to see Mark applied my patch for Subscribe to Comments! No more stray emails if you use the moderation queue to approve comments from many posts!