I have noticed over the years that the quality of the comment spammers has been improving. It is to be expect really, as the tools to combat spammers step up and gets better so the spammers will improve their scripts and tools.  Not that I like it.

Over the years you get to see the general type of spam:

• Simple link list comment spam.
• Comments made up of paragraphs that at first glance appear to make sense and are full of link bait.
• Generic comments on how good the post or site is.

But Wait… there is More…

Well now there is a new kid, (well for me).   This one is going to be a little bit of a pain – The Real Duplicate Comment.

Basically the comment is well structured, it even makes sense, in fact it’s on topic. So often a fair amount of thought has gone into the comment – well at least a few minutes.

The IP addresses are random, as are the email addresses.   The URLs (no follows are on by default on this blog) go to spammy web sites, you know the type.

The only way you get to know that it’s not a real comment is that it’s often duplicated within 24-48s of posting by an exact copy of the original comment from an different commenter.

Currently my only solution is to mark them both as spam when the duplicate comment turns up.

I would be interested to know if others have encountered similar comment spam.

Well yes there are lots if good reasons to open up a twitter stream to the public, here are a few:

• It’s really easy for people to decide to connect with you if they can read your previous tweets.
• It can be handy for the odd self promotion and the digital footprint if people can connect with you easily.
• You can build a better community around you of like minded people if you are easy to connect to.
• You can have more conversations with a greater community.
• You can integrate your twitter stream with all sorts of cool tools using the twitter API  with ease.

It’s Not that I Don’t Like You

Okay that’s good, yes you can engage with people easier if you have a public twitter stream.  But there is also a good number of reasons for not having a public  twitter stream such as:

• Google – This is the primary reason that my stream is private, I don’t want any Google bots spidering and indexing my tweets.  I don’t what any of my tweets being used out of context or being lodged in the grand Google repository of knowledge for evermore.   Of course this would be solved if Twitter had a no index option for each  account.
• SpamBots – Whether they are real people or bots, you get other twitter accounts following you just so they can direct message spam you.  With an open stream you get this a lot more than a closed on.   Easiest thing to do is restrict their access.
• Auto Follow Bots – It’s amazing, If I tweet about coffee, suddenly ten coffee bots start to follow me, this auto following trend on an open stream is a real pain.  These are not real people, just some programing script..  Sure the twitter crew cull them from time to time, but really I just don’t want some random non person following me.
• Auto Publish Bots -  Just like Auto Follow bots there are now auto publish bots that detect various keywords in the public stream and retweet your tweet they have  detected or even quote the tweet in a blog style entry somewhere.   Now that means we can all be constantly taken out of context  even more. Now this doesn’t happen with a private account.
• The Creeps –  Now I don’t get this much, but I know a lot of my female friends on twitter get some weird creeps following them, some just outright digitally stalking them.  These people are often just end up being blocked.  With a private stream you restrict who follows you.
• Social Media Experts – These are another breed of experts people that have suddenly appeared on Twitter. Seems they are out to teach me how to use online social networks, with their all of five minutes experience.  I really think these people need to reconsider their approach to social media.  Maybe folks like me that have been around for a while do get it.  It’s just we don’t be blowing our trumpet all over the relevant social networking sites about it.   Best way to  avoid these people is control their connection into you community, like the creeps above.
• My Community – I know it’s all about community, but the social network is centered around me, it’s my social network.   It would be nice if I had control who can easily listen in on my network.  Who is in that community.   I want to ensure that they are relevant to me.   I want to know the people in my conversation, I want to select the people around me.  Seems a little anal or self centered, is it really. Consider all the other social networking sites, you get to select who you can connect with, so why should Twitter be any different.  Think about it, your social network isn’t for your neighbour or the kid down the road it is for you.   So you should have a say in it.

It’s Private, but Just Ask.

Sure my twitter stream is set to private.   Yes its not that private, as my followers can access my tweets so my privacy is only as good as my community.  But my followers aren’t the nasties listed above.  They are the reason I’m on twitter for the community.

So if you think you belong in my community and we have a common interest, go on request to follow me.   I don’t bite.

Anyway went to save a post with an externally sourced image in it the other day, and the post failed to update, returning me instead to the standard 404 error page. Which is strange as it had saved okay minutes before. The only difference being the newly inserted image code.

So I did a bit of a search and it appears that there has been an ongoing issue with the ModSecurity module that is used by some hosts, which is not part of the Wordpress install . It also appears that this 404 on a post save issue has been around for a while.

So what is this ModSecurity thingie?

Good question.

ModSecurity is a code module for open source web servers that acts like a firewall. It works via providing protection from a range of attacks against web applications on the web server (such as Wordpress).

Well that is certainly something that you want to keep operating on your site, as it protects from cross-site request forgeries, script injection, automated attacks, block information disclosure issues and much more.

A Solution Maybe

It has been suggested all over the place that maybe it’s a good idea to just disable the ModSecurity for that application which you are having a problem. You do this via inserting one of the following into your .htaccess file

Alternative One

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterPost Off
</IfModule>

Alternative Two

<IfModule mod_env.c>
SetEnv MODSEC_ENABLE Off
PassEnv MODSEC_ENABLE
</IfModule>

This is Not a Good Idea

ModSecurity is there for a reason, disabling it is like removing all your house locks because one sticks from time to time.

It would be better to fix the issue with ModSecurity, as that is the source of the problem here.

ModSecurity works via comparing the text you are saving or processing to a list of positive and negative outcome rules. If part of your processed text, my blog post in this case, matches a rule, instead of letting it proceed as normal, it will resolved to the designated alternative action, a 404 page in this case.

A Real Solution

So what we need to do is work out what is tripping up the ModSecurity.

I was lucky I knew it was just the image html code. So after a bit of an elimination I have determined that there must be a rule on my host that stops the source code “src=http:”. This also means that I can’t use the built in media insert functionality within Wordpress as that generates code with the offending string in it.

This type of rule will be in place to stop cross-site javascript injection attacks. It is most likely the result of a sloppy custom rule generation.

The real solution in this case, is to get the host to remove or amend the rule to one that allows for the detection of the <script> tag as well as the offending src linking code.

Finally Wordpress 2.7 is released, but don’t you just hate all the endless upgrades, especially if you have code base modifications in place.

Whether or not you like Wordpress as a blogging platform is debatable, but you have to agree that it does have a large slice of the market share.  And when you get to be a tall poppy like Wordpress, just in shear numbers you will get (that is find) your security problems as people poke holes in your product.

This can have a distinct downside in the endless upgrades that the wordpress development community puts out.  It seems that you can be forever upgrading, testing it all works and then doing it all again.

There must be a better way. Well there is.  Don’t use Wordpress (joking). No seriously, there are better ways than the constant manual upgrade of hundreds of files:

• Automatic Update Plugin – You can get Wordpress to upgrade itself for you, with the Wordpress Automatic upgrade plugin. From version 2.7 this is automatically included as a core feature.  Now personally I’d be a little hesitant on this one, given the volume of sub releases that are fixes for previously introduced bugs and the like.
• Use Subversion – If you are a developer and are subversion savvy this would be a way to go using subversion (SVN) to upgrade at your request.
• Use the Trac – Did you know you can find out which specific files have changed and even the lines of code with them that has changed from version to version.  So you may only have to download a handful of files to install not hundreds in a full release. You can do all this with the Wordpress Trac facility.

How to Use Wordpress Trac

Trac can be very confusing with all its version numbers, revisions, tags  and trunks.  Sure you can go spread a while working it all out.  But really if you just want to know what has changed from one version to another and if it’s going to effect your code base then you maybe going a little too far.

Figure 1 – Trac Changes Search Page

So how do you work out what files have changed and what hasn’t:

1. Go to the ChangeSet Page (follow the link or press the View Changes Button on the bottom of the Browse Source Page).
2. On this page is two fields for Select Base and Target for Diff, they are labeled From and To (see figure 1).

3. If you want to see the differences between for example: Wordpress 2.6.3 and Wordpress 2.6.5

   Type in the first field:  tags/2.6.3

   And the next field:  tags/2.6.5

   Yeah the secret is the “tags/” bit then the version number.

4. Now press the View Changes button.   Ignore the “At Revision” fields leave them as their default.
5. You will be presented with the results (see figure 2) this is a list of files (at the top), and the changes to the files. It is important to look for files that have been moved and removed as well as these may give you grief later.
6. At the very bottom of this page is a link Zip Archives under the heading Download in other formats. This link will allow you to download just the changed files and apply or modify them as required.

Figure 2 – Trac Results Page

Note sometimes you really just want to do the full upgrade like from version 2.6.3 to 2.7.  But at least now you have the option to find out what has really been changed in Wordpress.

Okay this is a blog slap down challenge.

Is your blog up to the grade to win a real award, judged by leading experts in their fields.  Last year this blog was.

So this year I’m issuing a challenge to all Western Australian Bloggers can you out do this blog.  Can you out do the man with no blog.  Can you win a Western Australian Web Award.

There are a few rules, go over the WA Web Awards site and check them out.

The important one is the site must have been launched or relaunched during the last financial year (2007 to 2008).

Okay the pages (html/css) also have to validate, but don’t worry about the design to much as that isn’t as important as the content.  Yeap in this case content is king.  I have been a little busy freelancing and with AWIA duties of late so you may pip me at the post on that one alone!

I’m entering this blog, are you entering yours or are you just a little scared to mix it with the big boys. Maybe you just don’t have the balls. (Edit: Note the WAWA’s are closing on Thursday  7th August 2008)

‘Course if you know of friends or blogosphere colleagues that could enter, twist their arm get them to enter as well.

Come on are you up for the Slap Down!

Edit – 25/7, Clarification: the WAWA’s judges have issued a list of Hints and Tips for Entrants.  You will note that you don’t have to redesign your blog to enter.

So last Sunday I quietly rolled out Manwithnoblog 2.0.

This design is based around a modified sandbox template, can’t help but hack the templates. I still have a list of some minor modifications And as you can expect, I’m never 100% happy with any design, there is always something that’s just not quiet right, something that is just never prefect. Perfect design I have found over the years is really unobtainable. With this in mind I would expect that this design will shift and evolve over time. I have few interesting ideas in progress, so for those visiting in person you will get a few visual treats from time to time.

In case you missed it the previous design used to sport 7 random designs, really they are nothing special, but still I have documented these on flickr.

The main design requirement I had this time around was to uncluttered the blog, keep it simple. If an element didn’t have any central benefit, then it went. That’s not to say some elements will not return in the longer term, just not at the moment. Mind you if there are elements that you personally would like to see back on the blog, just drop me a line.

The visual design started with two main inspirational elements, the silver scales and texture of a fish and inline stake frames. These morphed into a tech-gigerish theme. I may extend this concept a little further.

The Web is wonderful it’s full of all this content, all this information. It’s a copy writer or blogger’s dream. You just don’t have to do any work at all. It’s all laid out there for you, all you have to do is find it and take it.

Maybe just write a small introductory paragraph and then simply cut and paste the rest of the article you have found and publish. Easy!

Oh isn’t the web great. It allows such theft of someone else’s work. It’s fine to do isn’t it as the poor suckers put the information online so we could steal it… NO STOP IT!

Now I know we have various scrapers and SEO blackhats that just love to steal real content of the legitimate source. It’s a problem we all deal with on a daily basis. Then you get the various slack web site owners, gutter bloggers or copy writers that insist on copying content word for word.

Professional Bloggers Go Bad

You would think that this wouldn’t be happening in the world of the professional blogging. Yes the people that get paid to write and research original content. Surely they wouldn’t be just cut and pasting. Surely they have ethics. Surely they are not bringing the entire professional blogging community down.

Well this week I ran into a major incident from a group of people promoting themselves as professional bloggers that are knowingly stealing content. We don’t have one or two instances here, but a stunning amount, all attributed to a professional who didn’t write them. It’s not like these people are new to the industry, they come from an established professional culture where copyright is a constant issue.

It’s an interesting fact that these professional bloggers should be aware that they are now liable (I would assume, usually legal disclaimer) to pay the original author royalty payments. I would normally name names here and shame them, but I have been asked to remain silent on who and where as the issue is dealt with.

The Right Thing to do

Now I just shouldn’t have to say this.

When you are looking for content for your blog or web site don’t copy it from elsewhere. Fine you can quote sections. That’s sections like a sentences, a paragraph or two, make sure you attribute the source, not the entire article. It’s acceptable to get inspiration from the content, or summarise it. But don’t copy it. It’s against the law. Go have a look at Meg Tsiamis’ Copyright and Plagiarism on Blogs.

Don’t go saying it’s okay under the terms of fair use as blogging is just news reporting. We are not talking about a part of an article here, but the entire article word for word.

Stop It!

Remember we still have the Australian Copyright Act (and others elsewhere), in which once it is published it is automatically copyrighted, copyright notice or not. If you’re a little unsure on this please go read up on it at the Australian Attorney-General’s Department.

What about creative commons, isn’t that just an open licence to reuse it as you like. Well no, go read up on creative commons there is a range of licences. Creative Commons basically:

….provides free tools that let authors, scientists, artists, and educators easily mark their creative work with the freedoms they want it to carry. You can use CC to change your copyright terms from “All Rights Reserved” to “Some Rights Reserved.”

This still doesn’t give someone the right to resell and rip the author off completely.

So what would you do with these professional bloggers that are getting paid to steal other peoples content and resell it as their own.

As many of you know I operate out of our home studio. It’s ideal for my freelance lifestyle. Plus all the trendy people are doing it now. So this meme is going to be different, I’m not technically going home from work as that type of photo-shoot would be just two or three pics at best.

So what to do. I was going to do going home after a AWIA / Port80 meetup, but that didn’t work at all, as it’s at night and I’m using my crappy N80 phone camera (see rules).

What I ended up doing what my return journey home after dropping the kids of at school one morning. Technically it is going home, just then I go to work as well. The photo set is on flickr as well.

Bit of a backwards approach with this, I’m going from home to work, not the standard going home from work. Time to set the wheels in motion for the next participants.

The Rules

Well these are very simple:

• Use a simple camera, the simpler the better,
• Upload them to flickr or whatever your preference is, but as long as they can be seen through the web,
• Tag them if you can with “onmywayhomeme”,
• Blog it and tell the story,
• Tag your mates.

The Tagged

The following folk are tagged with this meme:

• Alexandra Graham
• Myles Eftos
• Michael Newby
• Bronwen Clune
• Kay Smoljak
• Matt Didcoe
• Gian Wild

Don’t know if you have noticed but the web is becoming obsessed with video. First off we had YouTube and the like with the publication of amateur video and the associated commenting.

Now the web has moved on from all that to conversational video. So has video killed the forum, the IRC, the blog. The interesting point for users in Australia is the low bandwidth of the broadband services can make the use of these services is all but impossible in some places. Still there are some interesting services now available:

Seesmic

We have Seesmic, this is still in alpha. I haven’t reviewed or really criticised Seesmic about its Adobe Flex based interface. It has a lot of problems, but they are slowly getting to them all one at a time it seems. What is Seesmic? Well it’s really like a forum of video conversations. Others have likened it to twitter with video; but it is more like a forum, you post a video like a forum post and people reply to that post, creating a separated stringed conversation on the topic at hand.

There is no text based chat component. Presently it is very hard to find friends, and to follow a conversation or topic. But overall Seesmic like twitter can be addictive. Seesmic would I feel work well in the mobile web space.

Ustream

Then there is Ustream.tv. In the main, you can stream video from your webcam and have multiple audio inputs and a stream of IRC style responses. Ustream lacks the video conversations facility and is clearly targeting the single video broadcast to the wide audience model. This is good, but in my thinking this is a little old school method, and is just really an extension of services from a web cam that have been available for years.

Qik.com

And we have the mobile kid on the block, Qik.com. Qik allows you to stream videos from your phone for your friends to comment or reply with their own videos. You can also engage friends in Twitter or Facebook with the live video conversation (videosation). The really cool feature is that you can mash it with twitter and chat like in Ustream with the broadcaster as they stream their mobile videosation to the world. Again it’s a one to many service. The part that makes it really interesting is that the core is built around the mobile web.

Yahoo Live

Finally to top this off is Yahoo Live that started with a few rocky moments. Personally I had few problems getting Yahoo Live to work, and still have major issues with the flex application hanging my browser when I finish using it (that is close the tab).

Yahoo live allows you to create a video stream channel in which others can join you with their own streaming video conversations or lifecasts. This is supplemented with the use of a IRC facility.

The problems with Yahoo Live is that its hard to find and follow the conversation when over five people are all streaming at once. This brings back a major drawback of the interface. Clearly this was a limitation to reduce the throughput on bandwidth, but overall this could make the tool unworkable when a large group of people are using it.

There is no facility to zoom in a make another video the focus while maintaining the same channel. Oh and aside there is no social networking features and it’s not mobile enabled. Nice first cut Yahoo, but for your resources a little lame. I would check it out quick, as I can see it being first on the Microsoft shopping block.

So what is the Solution

Were is all this going? Good question, it’s centering around the conversation or constant life streaming. Which is good as that is what people are all about, interaction with others. It would be ideal to see a service that was all these things, especially focusing on the mobile web and not the fixed desktop:

• Static video conversation threads.
• Mobile web based streams.
• Multiple live conversational video streams (many to many).
• Supplemented with IRC.
• Live one to many and many to many (beyond 5) streaming

What do you think, have these services nailed it or are they all just off the mark a little?

The rules :

1. Link to your tagger and post these rules.
2. List EIGHT random facts about yourself.
3. Tag EIGHT people at the end of your post and list their names.
4. Let them know they’ve been tagged.

So what are the juicy facts about me:

1. I have a passion for ancient and medieval Irish/ Welsh Celtic history and culture. I’m not talking about that neo-paganism clap trap stemming from the Victorian Golden Dawn, but the real historical record and academic discussion on the topic.
2. Was doing inline speed skating, until march last year when I slammed into a rink wall (with helmet on) head first after a slide out. As a result I was in a neck brace for a few weeks. Needless to say I had to give up the competitive element of the sport (Doctors orders), not that it’s generally dangerous, I was just unlucky. I still recreational skate, but it’s not the same.
3. I was born in England. But I have never seen snow. Given that I hate the cold I don’t think I will be seeing it soon.
4. Back in the dark days before there was the web I used to code in dBaseIII and IV.
5. I have a degree in Organic Chemistry. Yes that has nothing to do with web design, usability and information architecture does it. But ‘m a great believer that all a degree does is teach you how to learn.
6. I’m waiting for the “moment” when you suddenly have to get serious and “grow up”, I seem to have missed it.
7. I collect and read comic books, not the superhero ones, I was involved with the Australia Comic book industry for a short time way back when.
8. I have given up trying to find time to read fiction novels. Although I do have a passion for good cthulhu fiction.

So I am going to tag the following, some have already been tagged, but not responded, so they get a double dose of tag prompting:

1. Nathanael Boehm – Nat has been tagged before but has not responded.
2. Sarah Issacson – Sarah is a good friend who seems to and fallen off the Blogosphere, I blame Travian.
3. Laurel Papworth – Laurel is a social networking guru, time for her to step up.
4. Ben Winter-Giles – I met Ben at Web Directions South. Ben is one smart guy, Who doesn’t blog enough!
5. Jesse Rodgers – Jesse is a Twitter contact, UI person from University of Waterloo, time we pushed this internationally.
6. Sue Waters – Not that Sue needs an excuse to blog.
7. Teresa Watts – Teresa is an extremely talented designer. When I grow up I want to be able to design like she does.
8. John Johnston – JJ seems to have been to busy to blog. Well this will fix that.

So that’s it. Not tagged but want to join in, go for it.