Also, we want to play with our new Django server we have running for our custom art maps listings app. DNS changes risk taking down the millionz of sites we have running on this server, so new subdomain it is!

When moving this blog to a sub-page, I came across a very old iteration of EchoBlog. Funnie, so I thought I would share. We’re not really sure how its still running out there in the deep dark depths of our server – we must have at least five old installs of wordpress, drupal, joomla, even habari still running, loose on our trusty old Site5 server.

/History /Update

It does a drive by download attack through un-patched vulnerabilities on Windows machines with version of Windows prior Vista (NT 6).  It seems to be using vulnerabilities specific to known exploits in flash and acrobat. It not only makes the infected users pc part of a botnet but also scrapes ftp username and passwords and then injects the malicious JavaScript into the users sites. This trojan may change Google search results and redirect to other malicious sites. It also installs a backdoor that connects to 78 .109 .29 .112 and now after its recent mutation into martuz, 95.129.145.58 (Firewalls should be configured to block these IPs).

Sophos is calling it the JSRedir-R script and according to them, last week, this threat blew all previous web based malware out of the water:

Here is some coverage about it:
http://blog.scansafe.com/
http://blog.unmaskparasites.com/2009/05/07/gumblar-cn-exploit-12-facts-about-this-injected-script/
http://blog.unmaskparasites.com/2009/05/18/martuz-cn-is-a-new-incarnation-of-gumblar-exploit/

You can check if sites are infected using this tool: http://www.unmaskparasites.com/

You can check if you pc is infected using some malware detection software like or Malwarebytes or SpyBot.  If you are infected,  start with you own pc. Get it clean and get your software up to date, especially windows, flash and acrobat.  Then change your ftp passwords and restore your site from a backup.  Once you do this, check your sites and pc again.  If you’re still infected, lather, rinse, repeat.

To prevent getting re-infected consider using the Google Chrome browser or Firefox with the NoScript Extension

What I’m advocating here are alternatives.  We need plan B and need we need to be a fualt-tollerant, disptributed system of systems.  Yes, google’s system is distributed and there’s always yahoo (asif) but we’ve now seen the disruption that issues with core routing systems can cuase.  I think that all this talk about “the cloud” is really missing the point that we are the cloud and every single pc, networked appliance and mobile device could be contributing to it and carrying that load.  What we need is to crowd source the cloud.

I’d go a few steps further and talk about the ease of installation and the approachability of the templating language, when compared to the mammoth un-approachability of Drual for anyone without a solid knowledge of PHP.  SilverStripe’s install process is the same as Wordpress, with a browser-based install screen to enter all database details and run the installation.  In addition, the intuitive back-end user interface is easily approachable for novice web producers at all levels, making it cheaper and easier to adopt into an organization.

It was rather illuminating hearing the history of the project, how a group of teenagers in New Zeland started to work towards building a better platform in 2000.  They produced sites to test their tool’s  limits and improve functionality.  The decision to go Open Source was made in 2006, and since that time downloads and users have skyrocketed.  Now, with a new polished branding and a solid reputation, SilverStripe is moving into maturity as a CMS, extending invitations to development partners across the word, and still testing and developing new features.

Howdiz and I are super-stoked on SilverStripe after lastnight’s event, and we’re going to focus in on it more and more. We have a few sites already running on SilverStripe, and are working on some freelance projects right now built on SilverStripe.  I’m excited to see how Howdiz webdev skillz change the way I use the CMS.

In Summary: Despite the non-locative nature of the medium of the web, there is much to learn from putting a face with a tool - I feel more connected with the project than I ever have before.  I’m working on a series of tutorials about getting SilverStripe up-and-running, and musing over the idea of putting together a series of workshops to help people get comfortable with the system.  It would be awesome to see a strong community emerge in Philly around this humble yet powerful website management tool.

I’m very excited about the project, nonetheless, and have been thinking alot about CMS lately.  Particularity, that fine line between needing an entire platform (like Wordpress, Drupal, Silverstripe) and simply needing some dynamic/CMS driven functionality.  In other words, the investment in templating on one of those packages is overkill for many of the projects I do which are smaller informational sites that require just one or two data driven elements.

One feature that I am in need of right now is a simple ‘message board/commenting feature’ - where users can leave comments without creating an account or logging-in, and these comments must be manually published by the administrator.  The comments will need to go to a simple dashboard for approval before they are pushed live to their CSS defined content area.

This feature would be used for ‘Testimonials’ - a request I have found solutions to for more than one client.  The client wants to display user generated comments/testimonials on their products and services.  They want to collect these easily using a simple form on their website, and publish them just as easily.

The ideal feature-set for this would be a mash-up of a few projects that are already doing parts of this very well:

1. A submission form that is as easy to set-up as Silverstripe’s forms
2. A spam filter as effective and easy to set-up as Wordpress’s Askimet to block SPAM submissions to that form
3. A dashboard, much like the Wordpress has developed, for approving/moderating/publishing submissions to that form
4. A widget/view that is easily customized with CSS to display approved comments/testimonials/etc.

The notion of a separate ‘Dashboard’ to approve comments wouldn’t really jive with Apostrophe’s driving priciple of editing content in context.  I think this feature could be easily accomidated however, by using a lightbox effect to present the ‘backend’ functionality, thus not loosing the ‘context’ of the content you are approving for publication.  A simple email/RSS reminder each time a submission is recieved would be a nice way to make a user generated content feature such as this less cumbersome to maintain.

The first one ran on Joomla, that was a nightmare we woke up from relatively quickly.  We might have had an early Drupal attempt in there, but I think Wordpress was adopted pretty early on.  I’ve been working with Wordpress for almost three years now, and we’re still in love.

When I started the job search for what eventually culminated in my position at M, I moved echoability into a static HTML/CSS design - one of my first.  It was hard to learn CSS, and I still feel as if i’m learning more with each project I pursue.  In the past year our server has become our dirty room, and for the time being its gonna remain nice and cluttered.

We host some live websites for our friends on this mess-of-a-server, as well as old projects galore.  I should make myself a sitemap of some sort.  Here are the ones I know about:

• the3oclockbook.com
• liquidvinylproductions.com
• laurenandadam.us
• the243foundation.org

A quick look-see at our databases reminds me of the Ubercart, the Habari, our efforts to build something called PhillyBetterBeer.com, which might still be resurrected.  Someday!

For now, I am really looking forward to creating new content.  So since at first I didn’t really succeed so much, here we go again.  FTW.