Stuart Hardy

WordPress 2.8.4 upgrade

Stuart — Tue, 08 Sep 2009 08:59:55 +0000

I spent most of Sunday and much of yesterday upgrading all of the WordPress installations that I’m responsible for, following the news that an internet worm is trawling the web looking for sites with security vulnerabilities. The scale of this particular attack is considerable, because the worm targets all versions prior to the current 2.8.4, which was only released on 11 August – less than a month ago. A friend had already had one of her sites hacked and I’ve since read about others I know who’ve been affected.

When I first heard about this issue, I was a bit slow to get to grips with its urgency and vaguely planned to do the upgrades “sometime” this week. The hacked friend urged me to take it much more seriously. Now I’m reading some of the horror stories of people trying to fix their hacked sites, I’m so glad she made the effort. At the risk of sounding like a latecoming evangelist, I’m going to repeat the warning. Don’t wait – do it now. Lorelle provides the best summary that I’ve read about this.

My newest client site, which is still at the pre-live stage, was already on version 2.8.4. All of the rest were at various version levels: 2.3.x, 2.5.x, 2.6.x and 2.7.x. Some of them hadn’t been upgraded because there had been no pressing need for clients to engage me to do so, some because they depended on plugins that weren’t compatible with 2.8 and some because of pure inertia. I was a little daunted by having to upgrade so many sites so quickly, but in the end everything went relatively smoothly.

The biggest technical issue that I encountered was that some of the files in one particular installation were owned by the web server, rather than by my account. This meant that I couldn’t delete them prior to the upgrade. I was rather puzzled by this, because other installations on the same server didn’t have the problem. The solution in the end was to run a custom Unix shell script via CGI. It was very quick and dirty, with no error checking. This is what it looked like:

#!/bin/sh /bin/rm -rf /usr/www/users/[account name]/path/to/some/files/* /bin/rm -rf /usr/www/users/[account name]/path/to/other/files/* echo "Content-type: text/html" echo "" echo "Deletion script" echo "

script has run

" echo "" exit

I put it into the cgi-bin directory for that particular website, changed its permissions to make it executable and then ran it. The first time, it failed. This was because all of the end-of-line characters had changed to ^M in the process of transferring the file from my PC to the Unix host. A quick spot of editing in vi, the Unix editor, soon sorted this out. After this, it ran perfectly and did exactly what it was supposed to. I made sure I deleted it when I was done with it, keeping a copy for future reference.

As far as WordPress plugins were concerned, I feared the worst and was pleasantly surprised. When I’d last scouted around towards the end of July to check plugin compatibility with 2.8, few of the ones that I use were formally supported. Since then, presumably due to the focus on the pre-2.8.4 security issues, every single one is now entirely compatible with the latest version. Nothing broke on any of my sites. Now they’re all done, I have that feeling of contentment that comes from a good spring-clean.

Update: a week later, everything’s still going strong. Only one issue emerged on one site after a couple of days. In upgrading to the latest version of the Twitter Tools plugin, I failed to spot that you now need a bit.ly account and API key if you want the plugin to auto-generate links to blog posts in the “tweets” that it creates. Easily remedied, it took less than five minutes to sort out.

The Cobbler’s Children…

Stuart — Mon, 07 Sep 2009 09:16:58 +0000

… always have the worst shoes, so the saying goes. In other words, even the most dedicated professional sometimes fails to apply their skills to their own needs closest to home. I’m a web and IT freelancer who makes an increasingly large part of his living from blogging and social networking, yet I haven’t updated my own blog for nearly seven months.

Mea culpa. It’s time to sort that out.

The good news, from my point of view, is that I’ve had an incredibly busy and exciting Spring and Summer. I’ve been involved in a range of satisfying projects and continue to acquire business via personal contacts and word-of-mouth, which I hope means that people value what I do and are happy to recommend me to their own friends and business partners.

The need to keep my blog updated from a marketing point of view has therefore not been foremost in my mind. However, that’s not what it’s all about. Much of my own research and skills-building is based on the things that I read in other people’s blogs and I’m well aware that it’s been a rather one-way relationship. I’m not giving much back in return.

So, my “back to school” resolution for September is to make a point of writing much more about the issues that I encounter in my work. Earlier this year this blog focused on documenting specific technical issues that I’d come across, but much of what I do these days is based on the broader concepts of how you communicate with people via the web.

Sometimes I worry that if I describe the full range of the services that I can offer, I’ll come across as an unfocused dilettante. I don’t think that’s true. I’m not necessarily a jack of all trades, but I’ve mastered many. I’m driven by the idea that fellow blogger Steve Hardy (no relation) calls “creative generalism“. In other words, eclecticism is power.

I did a bit of brainstorming with a business contact recently and he offered the tongue-in-cheek suggestion that my core marketing message should be “I am the glue”. It’s possibly the worst slogan ever, but it does highlight the way that I connect things together into a larger whole. That’s the underlying theme of what I do and what I want to write about.

HP Officejet 6300 series drivers

Stuart — Wed, 11 Feb 2009 13:23:33 +0000

One of my clients has a couple of HP Officejet 6300 Series all-in-one printer/scanner/fax units (model 6310 in particular). These units come with a comprehensive set of software for scanning and image manipulation, in addition to the basic drivers. I’ve always found the Windows XP software installation rather tricky. It seems to take far longer than it reasonably should, even on well specified hardware.

On Monday I reconfigured one of these printers to connect directly to the office’s ethernet hub, so it could be accessed wirelessly by the business’ laptops rather than needing to connect directly with a USB cable. HP offers various software installations, so on my own laptop I chose to install only the drivers. The installation routine completed, asked me to reboot and told me that the printer was ready to use.

The only problem was that it didn’t appear in my list of Windows XP printers. I didn’t think this was worth troubleshooting; my laptop has had all kinds of software loaded on it and has connected to several different client networks in its time. I figured things would be fine on this client’s own laptop. I installed the full software package onto his machine, but after two hours it was obvious the process had frozen.

Time was running out, neither the client nor I wanted to spend much more of my time on this issue and I needed to be making my way back to London. I rebooted the machine and went for a basic driver-only installation on his machine. The software discovered the printer on the network, completed successfully and promised printer availability after a reboot. The problem was, once more Windows XP couldn’t see it.

I figured that I’d have to leave the machine configured to print via a USB cable as a temporary measure. This went smoothly; Windows XP’s Plug & Play found the printer, set it up and within a couple of minutes I had temporarily printed a test page. I was mystified, but began to wonder whether there was anything I could do to configure this Windows XP printer to print via the network rather than the attached USB cable.

A little poking around in the “Ports” tab of the printer’s properties revealed that the HP software installation had created a port called “Officejet6300series” with a description of “HP Standard TCP/IP Port”. I changed the existing printer’s port to this one, unplugged the USB cable and printed a test page straight away. It’s very disappointing that I had to sort this out manually, but at least it can be made to work.

Mac OS X Leopard, AirPort and wireless channels

Stuart — Fri, 06 Feb 2009 11:26:35 +0000

Stephen Fry famously freaked out on Twitter a couple of months ago when trying to get a Windows Vista PC to join a wireless network (a couple of those links aren’t for the faint-hearted). I had exactly the opposite problem yesterday: an Apple MacBook that steadfastly refused to even acknowledge the presence of a specific wireless network.

The Mac could see other networks in the area and readily connected to the ones that weren’t security-enabled. Equally, laptops running both Windows XP and Windows Vista were happy to associate with this apparently evasive network and deal with its WPA security. Even my Nokia N95 mobile phone knew it was there and would happily connect with it.

The OS X Console utility wasn’t much help: a series of messages from SystemUIServer advising that there was an error joining the network, with a cryptic “Connection failed (16 result unavailable)” description. I did a few searches and came up with the rather worrying news that OS X Leopard is known to be rather flaky where wireless is concerned.

Nothing I read seemed to encapsulate my own problem. Even iStumbler failed to reveal the presence of the router sitting a couple of metres away from the Mac. Several local WLANs were broadcasting on channel 11, but I checked the router and it was using channel 13. On a hunch, I changed it to channel 10. Almost immediately, the Mac connected.

It turns out that in certain areas of the world, only the use of channels 1-11 is permitted. Europe uses channels 1-13, so why I encountered this problem with a British MacBook is unclear. Nevertheless, it’s a good example of a frequent situation in IT troubleshooting: sometimes a little bit of trial and error is the only way to really find out what’s going on.

When enough is enough

Stuart — Tue, 20 Jan 2009 09:04:33 +0000

I recently helped someone with two PCs to reorganise her home working environment. She was sharing a printer between an old Windows 95 desktop and a new Windows Vista laptop. When she needed to print, she would carry the laptop upstairs to where the printer and desktop PC were based and switch the USB cable over from the old computer to the new one.

I had a much better idea. I suggested that we configured the two PCs as a small workgroup, meaning that she could leave the desktop turned on, acting as a print server, and would be able to print at her leisure whilst working downstairs in the lounge. She loved the idea, so I went ahead. It worked perfectly… until about five minutes after I walked out the door.

Returning to her house, the problem was immediately apparent: the Windows 95 desktop machine was demonstrating the infamous “blue screen of death”. I reversed my work and apologised for getting her hopes up. While it should work in theory, in practice the Windows 95 installation on her ageing computer had become too unstable over time for her to rely on this solution.

I was reminded of a fairly basic principle that day: sometimes you have to say no, enough is enough. With the best of intentions, I had tried to help her to get more value out of her existing IT systems, but I let my enthusiasm and helpful nature get the better of me. Microsoft stopped supporting Windows 95 at the end of 2001 and in future I’ll be following its example.

Keeping customers informed

Stuart — Tue, 06 Jan 2009 10:57:14 +0000

I’ve recently been working with a couple of service providers that take a very different attitude to keeping customers informed. The first is embarrassed by problems and is very defensive when they are reported. It doesn’t update its own “service status” page on its website for anything other than the most major outages lasting several days. The second is very open about any issues that occur and updates its service status information as soon as possible, usually within an hour or so.

Superficially, if you look at these service status pages, it seems that the first organisation has a very reliable service and the second one experiences a lot of problems. Appearances can be deceptive. Anyone working in IT, or using IT services, knows that there are occasionally problems. Trying to cover them up always backfires. The mark of a professional organisation is one that acknowledges issues and keeps customers well informed while making every effort to rectify them.

ADSL fault reporting in the UK

Stuart — Tue, 16 Dec 2008 15:26:47 +0000

I recently had a few problems with my home broadband connection, provided by Demon Internet. Working with Demon to resolve these, I learnt some useful stuff applicable to anyone whose underlying connection uses BT’s ADSL Max service.

Many British ADSL providers use this BT Wholesale service to connect their customers to their own network. The exceptions are those who have taken advantage of the local loop unbundling (LLU) concept to place their own equipment in BT’s exchanges.

If your service is based on BT ADSL Max, you can check your connection speed by using BT’S SpeedTester service at www.speedtester.bt.com. The tester will ask for the phone number on which your ADSL line is based and for your ADSL login name.

Numerous internet speed testing websites are available. For services based on ADSL Max, the BT tester provides one crucial piece of information you won’t find anywhere else: your IP Profile. This figure has a direct impact on your speed of access.

If you know how to login to your router, you might find – as I do, usually – that you have a downstream connection speed of about 5Mbps, in line with the “up to 8Mbps” guideline for this type of service. However, sometimes the IP Profile is much lower.

The IP Profile is essentially the highest speed at which the BT network management systems will let you download data. If you’ve been experiencing connection problems and have temporarily connected at a lower speed, your IP Profile drops accordingly.

However, when you manage to reconnect at a higher speed, the IP Profile does not automatically rise again. It can sometimes take several days to regain a higher profile, during which time your apparently fast connection feels much slower.

Here’s an example of the test results for me at the moment, when everything has been running fine for a couple of weeks:

    Your DSL connection rate: 5728 kbps(DOWN-STREAM),  448 kbps(UP-STREAM)
    IP profile for your line is - 5000 kbps
    Actual IP throughput achieved during the test was - 3077 kbps

Compare that with the following results from a few weeks previously, when my connection speed was slightly lower, but my IP Profile had dropped considerably:

    Your DSL connection rate: 4544 kbps(DOWN-STREAM),  448 kbps(UP-STREAM)
    IP profile for your line is - 350 kbps
    Actual IP throughput achieved during the test was - 296 kbps

Demon indicated that certain information needs to be provided in order for a persuasive case to be made to BT to get a fault investigated, otherwise the fault report is liable to be rejected. Specifically, evidence of instability and slow speed.

Instability means line drops and reconnects. Your ISP can usually provide this information itself. Slow speed means poor performance and three separate sets of BT SpeedTester results (spaced more than three hours apart) are the best evidence.

If you can also provide evidence of having used two completely different routers to reproduce the fault, this is useful. Typically most people don’t have a spare router though, and with retail prices of around £50 this is fairly understandable.

Creating free PDFs using PDFCreator

Stuart — Tue, 02 Dec 2008 13:57:13 +0000

PDF files have become a de facto standard for information publishing over the past decade or so. There are lots of good reasons why you might want to create a PDF version of a file. Here are a few of the most common:

You’re sending a document to someone – or publishing it on your website – and you don’t want the reader to be able to edit it;
You’re not sure whether your reader has the same software package or version as you;
Your “document” is actually a composite of various files created in various different applications;
Your document is graphic-heavy and the file size is rather large.

Creating a PDF file is often seen as a bit of a black art, but if you’re a Windows user it can actually be very simple. PDFCreator is a freeware application that installs as a printer. When you want to create a PDF document, you “print” it to the PDF printer, which then allows you to save and/or e-mail the results.

PDFCreator can also queue up multiple files and then combine them together as a single PDF file, which can be useful in many instances. For example, my invoices are created in Microsoft Word, but some clients require a second page of detail held in Excel. PDFCreator allows me to put both sets of information together as a single file.

I’ve recommended PDFCreator to a couple of my clients. One of them jokes that it’s the best thing I’ve ever helped her with. She has a point: it’s lightweight, handy and easy to use. It’s become an essential tool for me and was one of the first things that I installed on my new PC a couple of months ago.

E-mail Virus Hoaxes

Stuart — Wed, 19 Nov 2008 08:18:21 +0000

“Hi all, I checked with Norton Anti-Virus, and they are gearing up for this virus! This is the worst virus announced by CNN. I checked Snopes (URL above), and it is for real !! Get this E-mail message sent around to your contacts ASAP. PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS!”

I usually receive one or two of these messages a month from friends and business contacts. Either I’m being asked to check them out, or they’re just forwarding them in a well-meaning attempt to help me avoid some kind of disaster befalling my computer.

This kind of e-mail hoax has been running for almost as long as I’ve had e-mail; many of the messages have retained exactly the same phrasing over the years. Here are some tell-tale signs by which you can recognise when a message is safe to ignore:

Norton won’t be “gearing up” for it. Viruses don’t tend to schedule themselves conveniently like this. The moment anti-virus software providers are aware of a virus, they’ll dissect it and release an update for their package, which gets downloaded automatically in the background. Chances are you’ll never even know. (Check that your home PC’s anti-virus package is updating at least once a day.)
The message recommends that you forward it to everyone you know. This is pure chain letter psychology. They’re trying to see how far they can get the message to spread.
The message contains pseudo-technical gobbledegook: for example, a virus that “burns” your disk. The only thing your computer can burn is CDs or DVDs and even that depends on it having a CD/DVD writer as opposed to a reader.
It contains melodramatic and meaningless advice to shutdown your computer immediately. What, and never turn it on again? It’s true that in the case of some genuine viruses this can be absolutely the right thing to do, but it’s usually followed by a call to your IT support person.
It includes further exhortations to send the message on to everyone, just in case you didn’t get the point. In CAPITALS and in bold too.
In case that doesn’t work, it brings in the big guns – Microsoft, CNN, and so on. People tend to associate these large corporations with authority, so the writer of the hoax is trying to bring some spurious authority to their message. That still doesn’t mean it’s true.
Finally, it will often use the self-important phrase “the most destructive virus ever”. Oooh, scary! This fumblingly inadequate machismo masks the reality that, in fact, many viruses are a bit crap. One or two high-profile instances have caused genuine havoc, but there are many that fell at the first hurdle.

I recommend that you adopt a default viewpoint of scepticism where these messages are concerned. The best way to deal with them is generally to delete them. If in doubt, paste a few key phrases from it into your favourite search engine and see what turns up.

Many messages will tell you that their virus warning has been checked on Snopes (a useful resource to remember) or similar sites, but of course this is rubbish. In general, Snopes and its peers will have identified the message as a hoax months previously.

Laptop Outgoing SMTP Server Settings

Stuart — Tue, 11 Nov 2008 22:52:37 +0000

I’ve recently moved onto much better tariff for my mobile phone and now have unlimited mobile broadband (HSDPA) access for a minimal fixed monthly cost. The fact that my phone can operate as an internet gateway for my laptop (when connected via Bluetooth or a cable) makes it even better. Having previously not wanted to access the internet via my phone except in emergencies, I’ve now configured it for all my online essentials and I’m very happy with it.

However, I soon found that I was having problems sending e-mail via my phone. I checked and re-checked the settings, but couldn’t see anything wrong with them. They work on my laptop, I figured, so there’s no reason that they shouldn’t work on the phone too. However, when I discovered that the same settings also failed on the laptop when it was connected via the mobile phone – yet they worked fine via any number of random wi-fi hotspots – a re-think was required.

It turns out that Vodafone blocks outgoing SMTP connections via port 25 to any servers other than its own, probably as an anti-spam measure. I was trying to use the SMTP server that my domain provider makes available to customers who can’t rely on a particular ISP – ideal for the transient, changeable nature of wi-fi access – when instead I needed to configure my mail client’s outgoing SMTP server to be send.vodafone.net instead. After I changed it, my Outbox emptied.

However, that didn’t seem like the right solution. The next time I used the laptop via wi-fi, outgoing e-mail would fail again because I would no longer be connecting via Vodafone. Back to the drawing board. I did some digging around and discovered that my domain provider’s SMTP server can also be accessed via SSL on port 465. I tested it and was pleased when it worked. That’s a solution that will stand me in good stead regardless of the underlying internet connection.

The moral of this story is that outgoing SMTP server settings that work well in one environment aren’t necessarily appropriate in another. The average home desktop PC user who only ever connects via a single broadband provider will rarely have to think about this kind of thing. However, people who are beginning to take advantage of the increasing number of cheap mobile broadband services now available will need to ensure that their settings work in multiple environments.