It hurts to sit. It hurts to stand. It hurts to walk. $DEITY knows what it will feel like to ride my bike.

How did I do this? It wasn't some bizarre biking accident. I was laying cables under the floor between the two offices at the opposite corners of my building yesterday. I lifted three floorboards and four carpets and drilled one hole. Afterwards, I rebuilt some shelves. How did that hurt my legs???

Today is Blogger Appreciation Day [UNOFFICIAL] so I'd like to thank Steve for Chronicle which is now powering this blog instead of the old homebrew.

Meanwhile, messages that came in while I was AFK included a strange one from Paul, Steve being elected as Debian Project Leader (well done!), 'Free Software in Ethics and Practice' - Richard Stallman, Thursday 1st May, Interview: How a hacker became a freedom fighter From New Scientist Print Edition, Understanding Design & Computers: Notes from an Introduction to OpenMoko, by Ole Tange for UKUUG

Finally, in a cycling and cooperatives cross-over, this article on Hammond's crash also mentions the other two Brits, who ride for cooperative teams. I watched the race, but didn't see much of them.

I keep hoping that things like suggesting good advice on meeting scheduling will avoid them repeating old mistakes. The most extreme life-and-death example is probably trying to help with Kewstoke Toll Road, where people still speed and someone crashed off again last night (although I don't know what caused last night's crash - could have been a simple accident).

Of course, it's better to talk with people who have asked questions and want to hear the answer. I'm currently involved in several groups like that and it makes me much happier [4HWW]. I've even made a confidentiality agreement [Network Blogging article] about one group because I really like the organiser and want to help them, but I've yet to see changes happen because of it and that's probably about all I can write here, which does rather suck.

But talking of changes that make me happy, I spotted that Bristol Wireless has now gone further than TTLLP by deciding to change people away from Microsoft Windows when they find it:-

"all Windows stuff must be gone from the premises [...] no longer help do callers favours with broken Windows machines, apart from fixing them properly and permanently by installing Debian"

at their March meeting. Well done, BW!

After a request, I finally put four photos from Social Source South West (which was hosted by BW) online, which reminded me to subscribe to watfordgap's travels. Disappointingly, on my first read, it promotes the Suppliers Directory developed by Lasa. That directory is a big problem because it creates a silly barrier to entry which hinders new social enterprises and cooperatives. At a time where most non-profit software is unsustainable and needs to change, requiring three referees is a way to obstruct change. Also, persuading three people to support their work is no substitute for supplier evaluation.

Any non-profits who want to lead their sector should approach ICT suppliers directly. The article also mentions Experts Online which is even more short-sighted about computing: "both PC and Mac" indeed! What about GNU/Linux, thin clients, and other changes which are already making a big difference to some non-profits...?

But here I go again, talking to a brick wall.

I expressed these concerns when that Directory started and it didn't do any good then, so I doubt they'll change it now, near the end of its life.

So I'm going to move on. There are lots of people emailing who want to hear from me, so it's time to concentrate on talking with people who do want to listen. If you want to discuss this with me, visit my website for the comments form (click the title or look for a "view original post" link, depending what site you're reading).

SPI isn't alone in this: many software organisations seem to suffer from similar problems. For example, I ranted in passing about Free Software Manchester yesterday, who just posted the notes from their own zero-day meeting and I've suggested possible ways of reforming debian's currently-stalled New Maintainer process more than once.

Are free software users particularly bad at the basics of running an interest society (like welcoming and expiring members, calling meetings, publishing routine communications, and so on), have I been spoiled by cooperatives with their friendly Member Services departments or secretariats, or what? Is this why so many free software orgs seem to include self-perpetuating leadership groups? Is this a serious problem if, as reported, Software Development is a Team Sport [etbe]? Are there fully-working free software mass participation groups out there?

I feel a lot of these problems are caused by attempting to order our inherently entropy-filled world completely and insisting everything follows petty rules, such as refusing to answer a question because the "wrong" member asked it. The world will not become less random just because hackers try to impose arbitrary rules. Sometimes it's good to put down minimum standards (because calling zero-day meetings is a mostly-avoidable way of excluding some members) but it will always be a poor alternative to trying to do the best you can for others.

How do we get past this? My pro-cooperation-and-better-business platform for SPI board went pretty badly and I've had some anti-cooperative flames back from someone starting another free software group this month, so I don't think I can fix these existing organisations any time soon. About 1 in 6 people in the UK are members of a cooperative, so even if that is reflected among hackers (and I think it's lower), all of them would not be enough to reform much.

One of the most common memes in free software is "show us the code" and the few other free software cooperatives I've seen have mostly failed, with a few surviving but hitting a size limit. As a result, I'm currently negotiating the start of a new free software cooperative. So far, I'm really happy with how that's going. Many cooperators learn at the feet of large consumer cooperatives like the Cooperative Group who run training courses for new members about putting cooperative values and principles into practice, which we smaller groups couldn't run ourselves. As a result, most cooperators already know how to work well together. Should large software societies like SPI try commissioning similar courses?

1. Property of a Lady » Wicca on House
2. Ross Burton: The End Of Homeopathy?
3. » Enough with the dried yoghurt covered raisins Korerorero: Just random ranting and raving
4. How to host a free software advocacy event | Free Software Magazine
5. Raw Output: AGPL
6. One for the Morning Glory: Facebook comments
7. Sam Liddicott » GPL3 Questions and Implications
8. Drugs and an Election | etbe
9. New Tropicana images «
10. robmyers - Support BY-SA/SFDL Compatibility, Not BY-SA/FDL Compatibility
11. Internet Psychology: Teenagers do not need our help online - we need them to help us oldies by Graham Jones, Internet Psychologist
12. Wanting Your Opinions about Blog Comments and City Attorneys : David Lee King
13. Zookoda - I Don't Recommend them Anymore
14. Solar Water Heating :: ShowBlog
15. Internet Psychology: Forget email - it's old hat by Graham Jones, Internet Psychologist
16. Drake.org.uk: That's a wrap! Time to roll the end credits..
17. Internet Psychology: Internet criminals are going to have a field day by Graham Jones, Internet Psychologist
18. A Cambridge Co-operator: Rebranded Stores
19. robmyers - Two Common Errors
20. Lucas Nussbaum's Blog » Blog Archive » Where is the NM bottleneck?
21. NM: FD is fixed - MadBlog

This is one of those Friday Afternoon Projects - it's been put off all through a busy week because it's unpaid, I'm not completely sure how to approach it and now my arms hurt like hell from travel jabs which are making it hard to concentrate! So I'm going to float it on here...

I've been asked to brief a meeting next week about that group's current web site and its problems. I'm not linking it yet to avoid insulting/embarrassing them.

The site looks OK, but doesn't rank well on search engines and doesn't allow much member participation. I need to explain why that's a bad thing and how the site's technical choices have led to that. I'm not directly pitching for TTLLP to get any work (because I'm a member of that group, it might be a conflict of interest and we're pretty busy anyway - even our own site needs work on some of the points I'm going to mention), but I don't want to be unhappy if we're asked to implement my recommendations.

I've got a usual outline that I follow, but my presentation's time is limited, so I'd like to ask you: what about this is important and what isn't? If you give me useful feedback, I'll put you in the Acknowledgements with a backlink and I hope the briefing will be shared pretty widely over the next few months.

The current plan is to start with a basic explanation of how search engines rank pages, as far as we can tell, referring to PageRank Explained Correctly with Examples, by Ian Rogers as well as the shorter official summaries from the dominant search sites at Yahoo, Microsoft and Google.

Then I go through a quick evaluation of the site against the basics of validation, accessibility and robot-friendliness, followed by a couple of SEO-style checks of its current rankings and inbound links.

Next is a bit different because I have access to some of their web access stats: I summarise what we know and suggest some other stats they've probably not considered and why they're useful, along the lines of Dave Briggs's measures of blog success.

Finally, I suggest ways to improve the site. The top tip will be to take control of the site hosting and stop using the cheap and cheerful donated server that makes all links except the front page point to another domain. I'll probably suggest a mix of free and open source software tools to power it. If they don't want to move it all yet, I'll suggest running a second site for member participation, using tools like Wordpress, NoseRub and so on.

What do you think? Plan for success, am I missing some tricks, or am I setting myself up for a lynching? Let me know with a comment or email, please.

Today, I went to an event about the Sub-National Review Consultation (as a substitute for someone else AIUI).

I'd not heard about this before, but if you're in England and you've any interest in our regional planning system (which I think you should, if you have your main home here or run a business here), you have six weeks left to comment on the UK Government's suggested changes.

As I understand it, it will move the second-highest tier of planning control from democratically-accountable regional bodies to the business-led Regional Development Agencies, with some oversight by MPs and the very- indirectly-accountable council leaders. I've posted more detail on Co-opNet.

When I asked about local involvement and cooperatives, I was directed towards Local Strategic Partnerships, but I'm pessimistic about how easy it will be to influence regional planning through those: a few weeks ago, I was at the launch of the North Somerset Partnership Sustainable Community Strategy for 2008-2026.

It's a 72-page A4 glossy book which I've still not found time to read properly. I think the size says something about its sustainability. I've posted a little more detail on WsMForum.

I'll try to answer questions about either of them on this blog or those forums...

It was nice to see them (first time I've met Bob) and have a bit of a chat about where we're each going with Koha. One interesting difference is that they have several private-sector clients, while I don't think my cooperative has yet done a private-sector Koha, but there seemed to be more similarities than differences, including adding more robust project management and ticketing as we deliver Koha 3 to people.

We went for lunch at The Cliffs Tea Rooms at the other end of Kewstoke Toll Road, which has great views towards Wales, but I forgot to take any pictures. Ooops.

Bristol Wireless's accountant has written some comments on GNUcash which is an interesting view: "not quite there yet" which could help finance software developers.

Better searching is one thing I will add to SQL-Journal some time, but it will probably never have features like reporting (I either use an SQL-based report package or export to a spreadsheet) and I know it's no better at handling VAT, mainly because TTLLP isn't VAT-registered yet.

I also spotted Finance software in Emdebian, by Neil Williams recently. I wonder if the bursts of accounting interest are connected to the end of the financial year?

Their addresses look identical but their phone numbers are different. Both appear to have some connections to directi.com. Is there any way to check if they are the same people?

I don't know how to verify US companies when they appear not to want to be verified... Domain Detectives thinks they're both directi

So, it was good to read Connecting People: Making an exhibition of yourself - the exhibitor and the linked Business Startup Coach shares Exhibition & Trade show secrets which repeat many points I've made before. Don't want to listen to me? Listen to the marketing experts.

Some time after noticing WDPRS, I tried reporting as much spam as possible for a while, to hosters and registrars based on WHOIS details.

Some hosts and registrars were good at dealing with spam (Yahoo and walla.net.il were exceptionally good) many were bad (bresnan.net, registrationtek.com, publicdomainregistry.com (PDR), ait.com, omantel.co.om, ttnet.net.tr) and some were ugly (Tucows/OpenSRS wrote back to say they don't do anything about domains they register, while ENom and Moniker never sent human answers).

So it's no surprise to see ENom, Moniker, PDR and AIT on the list of

"Top Ten Worst Spam Registrars Notified By ICANN" ultimately taken from this report.

]]> 2008-05-30T08:54:13+00:00 http://mjr.towers.org.uk/writing/reflections/Hosting_Blogs_on_Multiple_Servers.html <p class="leadimg"> <img src="http://mjr.towers.org.uk/writing/reflections/attachments/mastsm.jpg" width="120" height="120" alt="[Mast]" title="Mast" /><br /> (Is this a network?) </p> <p> <a href="http://www.buzzinfly.co.uk/">Terry Lane</a> asked: </p><blockquote><p>"Do you know of any reason why someone would suggest we consider placing blogs on more than one server? I think his main concern would be related to SEO and - I'm assuming here - Google."</p></blockquote><p> There are some small reasons, mainly about various sorts of reliability: what if the server catches fire, what if someone filters out adverts from the server, what if the server gets labelled as a spammer or splogger, and so on... but I believe they're outweighed by ease of management and having all your site on one server. </p><p> If the search engines label your IP address as a spammer, you can get another IP address as a short-term fix, but in general, the search engines are always a major threat to a blog-based business. If they label one server as a spammer, I think it would take the guys at google or whatever about 0.1 seconds to spot the link to another server. The best tactic is to avoid looking like a spam source in the first place... </p><p> I guess if you're hosting several blogs on shared servers, like I do, splitting your blogs across several servers is a good idea for those reasons, which is part of why I do it... In any case, make sure you download backups in case your hosting goes like this:- <a href="http://www.webmasterworld.com/webmaster/3663978.htm">The Planet (EV1) Data Center Catches Fire - 9000 Servers Offline</a> </p><p> If a blog becomes really popular, <a href="http://www.dmoz.org/Computers/Software/Internet/Site_Management/">the usual tactics of mirroring and distributed load-balanced hosting</a> can be used, but I don't think that was the question here. Even after all those, I can't think of any real killer reasons to split a blog across multiple servers if you're on your own dedicated server already. Have I missed a reason? </p>
(Is this a network?)

Terry Lane asked:

"Do you know of any reason why someone would suggest we consider placing blogs on more than one server? I think his main concern would be related to SEO and - I'm assuming here - Google."

There are some small reasons, mainly about various sorts of reliability: what if the server catches fire, what if someone filters out adverts from the server, what if the server gets labelled as a spammer or splogger, and so on... but I believe they're outweighed by ease of management and having all your site on one server.

If the search engines label your IP address as a spammer, you can get another IP address as a short-term fix, but in general, the search engines are always a major threat to a blog-based business. If they label one server as a spammer, I think it would take the guys at google or whatever about 0.1 seconds to spot the link to another server. The best tactic is to avoid looking like a spam source in the first place...

I guess if you're hosting several blogs on shared servers, like I do, splitting your blogs across several servers is a good idea for those reasons, which is part of why I do it... In any case, make sure you download backups in case your hosting goes like this:- The Planet (EV1) Data Center Catches Fire - 9000 Servers Offline

If a blog becomes really popular, the usual tactics of mirroring and distributed load-balanced hosting can be used, but I don't think that was the question here. Even after all those, I can't think of any real killer reasons to split a blog across multiple servers if you're on your own dedicated server already. Have I missed a reason?

]]> 2008-06-04T15:09:03+00:00 http://mjr.towers.org.uk/writing/reflections/World_Environment_Day.html <p> Today is <a href="http://www.unep.org/wed/2008/english/">World Environment Day 2008</a> and also <a href="http://www.recyclenowpartners.org.uk/local_authorities/news/are_you_ready_for.html">Recycle Week in the UK.</a> </p><p> Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article <a href="http://www.thisissomerset.co.uk/displayNode.jsp?nodeId=147472&amp;command=displayContent&amp;sourceNode=147472&amp;contentPK=20792383&amp;folderPk=84808">'REDUCE WASTE NOW OR FACE A £12M FINE'</a> It's very annoying to read a Conservative councillor say </p><blockquote><p>"The message we really have to get out to people is that this is their problem too."</p></blockquote><p> We <strong>know</strong> it's a bloody problem. Have you tried to use your stupid recycling system? </p><p> <strong>Criticism of the stupid collections</strong> is strangely absent from the local Lib-Dem's <a href="http://www.mike-bell.org.uk/news/000428/mid_table_place_shouldnt_be_good_enough_when_it_comes_to_recycling.html">Mid table place shouldn't be good enough when it comes to recycling (Mike Bell)</a> and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to <a href="http://www.wsmforum.co.uk/index.php?topic=15.0">local residents to explain the problem.</a> </p><p> <a href="http://www.n-somerset.gov.uk/waste/">Local waste collections have been simplified recently</a> but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's <a href="http://www.n-somerset.gov.uk/Your+Council/Communication+and+information/North+Somerset+Life/default.htm">North Somerset Life</a> magazine explained that they don't collect plastic bottles from the doorstep because it would add £10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that £10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them? </p><p> <strong>Speaking of Tesco...</strong> those <a href="http://www.nomillroadtesco.org/">national</a> and <a href="http://bristol.indymedia.org/article/688196">local favourites</a> have applied to build <a href="http://www.thewestonmercury.co.uk/content/twm/news/story.aspx?brand=Westonmercury&amp;category=news&amp;tBrand=westonmercury&amp;tCategory=znews&amp;itemid=WeED04%20Jun%202008%2016%3A30%3A52%3A210">Two more Tesco stores for Weston [The Weston Mercury]</a> including one directly opposite another supermarket. The application number is <a href="http://wam.n-somerset.gov.uk/MULTIWAM/showCaseFile.do?appNumber=08/P/1230/F">08/P/1230/F</a> if you want to respond. </p><p> <strong>The planning system seems my main chance to protect my local environment</strong> at the moment. Next Monday evening at 7.30pm, <a href="http://wam.n-somerset.gov.uk/MULTIWAM/showCaseFile.do?appNumber=08/P/1070/F">08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant</a> will be considered by a <a href="http://www.kewstoke.org/parish.htm">Kewstoke village council</a> planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle. </p> Today is World Environment Day 2008 and also Recycle Week in the UK.

Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article 'REDUCE WASTE NOW OR FACE A £12M FINE' It's very annoying to read a Conservative councillor say

"The message we really have to get out to people is that this is their problem too."

We know it's a bloody problem. Have you tried to use your stupid recycling system?

Criticism of the stupid collections is strangely absent from the local Lib-Dem's Mid table place shouldn't be good enough when it comes to recycling (Mike Bell) and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to local residents to explain the problem.

Local waste collections have been simplified recently but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's North Somerset Life magazine explained that they don't collect plastic bottles from the doorstep because it would add £10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that £10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them?

Speaking of Tesco... those national and local favourites have applied to build Two more Tesco stores for Weston [The Weston Mercury] including one directly opposite another supermarket. The application number is 08/P/1230/F if you want to respond.

The planning system seems my main chance to protect my local environment at the moment. Next Monday evening at 7.30pm, 08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant will be considered by a Kewstoke village council planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle.

]]> 2008-06-05T15:04:16+00:00 http://mjr.towers.org.uk/writing/reflections/Bridgwater_College_Computing_Advisory_Panel.html <p> Probably due to some mistake or just an excess of randomness in the world, <a href="http://www.ttllp.co.uk">our webmaster cooperative</a> has been invited to <a href="http://www.bridgwater.ac.uk/">Bridgwater College's</a> Computing Advisory Panel meeting next week and it looks like I'm going. </p><p> The interesting agenda items are:- </p><p> 5. Current Curriculum offer </p><p> 6. Computing and ICT Sector Developments - Education and Training - ICT Diplomas - Distance Learning - Specialist training / apprenticeships </p><p> 7. Meeting Employer Needs </p><p> I've asked some <a href="http://www.software.coop/info/other.html">nearby cooperatives and social enterprises</a> for comments and I'll probably highlight things like <a href="http://news.zdnet.co.uk/software/0,1000000121,39419829,00.htm">Linux opens London's Oyster</a> and <a href="http://resources.zdnet.co.uk/articles/casestudy/0,1000001994,39303425,00.htm">Specsavers sees clear benefits in open source</a> when arguing for more free software use and emphasising "worker needs" rather than "employer needs", but please send me any other suggestions in a comment on this blog post or an email. </p> Probably due to some mistake or just an excess of randomness in the world, our webmaster cooperative has been invited to Bridgwater College's Computing Advisory Panel meeting next week and it looks like I'm going.

The interesting agenda items are:-

5. Current Curriculum offer

6. Computing and ICT Sector Developments - Education and Training - ICT Diplomas - Distance Learning - Specialist training / apprenticeships

7. Meeting Employer Needs

I've asked some nearby cooperatives and social enterprises for comments and I'll probably highlight things like Linux opens London's Oyster and Specsavers sees clear benefits in open source when arguing for more free software use and emphasising "worker needs" rather than "employer needs", but please send me any other suggestions in a comment on this blog post or an email.

]]> 2008-06-07T08:52:34+00:00 http://mjr.towers.org.uk/writing/reflections/Online_shopping.html <p> I maintain a number of web shops for <a href="http://www.ttllp.co.uk/">our webmaster cooperative</a> and one of our main challenges is to encourage people who put things into their basket/cart to actually buy them. </p><p> <a href="http://www.grahamjones.co.uk/2008/06/how-to-avoid-shopping-cart-abandonment.htm">How to avoid shopping cart abandonment by Graham Jones</a> makes some points that I've identified as possible reasons for people not buying in the past: comparisons, robots and not trusting the site enough to give payment details. There's not much we can do about robots or people comparison-shopping at a technical level, but we try to build some trust by publishing the shop owner's geographic address and telephone number (which I think is required by law in England for most web shops now), making sure the SSL certificate and domain registration details are correct, using reputable payment providers and being clear about delivery charges and terms. </p><p> The point about the slickness of the checkout process is a good one and one that we've only recently started to work on. We've had pretty good results from making the checkout slicker on one site. It looks like two-thirds of people who click the checkout button now continue to buy, putting it comfortably ahead of <a href="http://www.coremetrics.co.uk/solutions/benchmarking.php">current UK averages</a> but I need to tweak our stats calculator to make the report directly comparable. Nevertheless, I think those improvements will be added to our other shops as soon as possible. </p><p> I share Graham's low opinion of the oft-quoted Amazon. We've also been looking at other web shop software besides <a href="http://www.oscommerce.com/">OSCommerce</a> for a new project, so now would be a good time to change to something new if it improves the checkout a lot. We've made OSCommerce's checkout a lot smoother, but it's still essentially OSC. Is there a good checkout which you'd want to use as an example? </p><p> The other challenge is getting visitors onto the site in the first place. <a href="http://www.blogstorm.co.uk/how-to-build-links/">How To Build Links By Patrick Altoft</a> explains the basics as well as I've seen recently. </p> I maintain a number of web shops for our webmaster cooperative and one of our main challenges is to encourage people who put things into their basket/cart to actually buy them.

How to avoid shopping cart abandonment by Graham Jones makes some points that I've identified as possible reasons for people not buying in the past: comparisons, robots and not trusting the site enough to give payment details. There's not much we can do about robots or people comparison-shopping at a technical level, but we try to build some trust by publishing the shop owner's geographic address and telephone number (which I think is required by law in England for most web shops now), making sure the SSL certificate and domain registration details are correct, using reputable payment providers and being clear about delivery charges and terms.

The point about the slickness of the checkout process is a good one and one that we've only recently started to work on. We've had pretty good results from making the checkout slicker on one site. It looks like two-thirds of people who click the checkout button now continue to buy, putting it comfortably ahead of current UK averages but I need to tweak our stats calculator to make the report directly comparable. Nevertheless, I think those improvements will be added to our other shops as soon as possible.

I share Graham's low opinion of the oft-quoted Amazon. We've also been looking at other web shop software besides OSCommerce for a new project, so now would be a good time to change to something new if it improves the checkout a lot. We've made OSCommerce's checkout a lot smoother, but it's still essentially OSC. Is there a good checkout which you'd want to use as an example?

The other challenge is getting visitors onto the site in the first place. How To Build Links By Patrick Altoft explains the basics as well as I've seen recently.

]]> 2008-06-10T11:48:38+00:00 http://mjr.towers.org.uk/writing/reflections/Warning_for_Webmasters__Friday_13th_ahoy_.html <p> Personally, I like Friday 13th. It's usually been pretty good for me. But for this one, I won't be surprised if computer abusers are planning some big attack tomorrow. </p><p> I've just spent a big chunk of my day upgrading and securing some of the websites that <a href="http://www.ttllp.co.uk/">our free software cooperative</a> supports for a customer. The number of attacks in the access logs is surprising - and I've been fixing other people's cracked servers for over a decade. It makes me wonder if someone is finding and recruiting exploitable systems for tomorrow. </p><p> If you have a website, please check that any web applications on it are installed correctly and the latest secure versions. I've been seeing a lot of attack attempts for <a href="http://www.joomla.org/">Joomla</a> and <a href="http://www.wordpress.org/">WordPress</a> in particular, even on sites which don't run them. That says something bad about either the success rate of attacks for them, or the stupidity of their attackers. </p><p> In our case today, the damage seems to have been minimal (touch wood!), with the customer merely being banned from some networks for a while. It could be so much worse, like this BBC News report about Cotton Traders <a href="http://news.bbc.co.uk/1/hi/technology/7446871.stm">Card details stolen in web hack</a> (which is part of why I suggest small online shops avoid storing credit card details on their site - leave it to the payment gateway). </p><p> Finally, there are some new scams like <a href="http://news.bbc.co.uk/1/hi/technology/7448187.stm">Conmen abuse web address checks</a> on the horizon for online shops, so make sure you've got your 3D-Secure rules set correctly by now and be cautious about sending goods before you're sure you've got the money. I think all web card payment systems are a risk, so please try to limit your risk. </p><p> <strong>Update:</strong> If you do get attacked, try to help track the attackers down so we can get other results like the <a href="http://news.bbc.co.uk/1/hi/technology/7451268.stm">Jail sentence for botnet creator.</a> I wish our governments would concentrate on toughening up blatent computer misuse law and stop <a href="http://actonacta.org/?p=9">tightening copyright law in secret.</a> </p> Personally, I like Friday 13th. It's usually been pretty good for me. But for this one, I won't be surprised if computer abusers are planning some big attack tomorrow.

I've just spent a big chunk of my day upgrading and securing some of the websites that our free software cooperative supports for a customer. The number of attacks in the access logs is surprising - and I've been fixing other people's cracked servers for over a decade. It makes me wonder if someone is finding and recruiting exploitable systems for tomorrow.

If you have a website, please check that any web applications on it are installed correctly and the latest secure versions. I've been seeing a lot of attack attempts for Joomla and WordPress in particular, even on sites which don't run them. That says something bad about either the success rate of attacks for them, or the stupidity of their attackers.

In our case today, the damage seems to have been minimal (touch wood!), with the customer merely being banned from some networks for a while. It could be so much worse, like this BBC News report about Cotton Traders Card details stolen in web hack (which is part of why I suggest small online shops avoid storing credit card details on their site - leave it to the payment gateway).

Finally, there are some new scams like Conmen abuse web address checks on the horizon for online shops, so make sure you've got your 3D-Secure rules set correctly by now and be cautious about sending goods before you're sure you've got the money. I think all web card payment systems are a risk, so please try to limit your risk.

Update: If you do get attacked, try to help track the attackers down so we can get other results like the Jail sentence for botnet creator. I wish our governments would concentrate on toughening up blatent computer misuse law and stop tightening copyright law in secret.

]]> 2008-06-12T16:18:11+00:00 http://mjr.towers.org.uk/writing/reflections/Forthcoming__and_past__Events_News__LUGoG__BikeWeek__HacktionLab__SPI.html <p> <a href="http://www.lugog.org.uk/">LUG of Glastonbury</a> meets at <a href="http://www.torleisure.com/">Tor Leisure</a> in Glastonbury at 7pm tonight (Monday). It will be a general planning meeting, maybe with some GPG-key-signing and other tasks. If you want the LUG to show you something in particular, this will be a good event to attend. </p><p> This week is <a href="http://www.bikeweek.org.uk/">BikeWeek 2008</a> and there's <a href="http://www.bikeweek.org.uk/event_search.php?pagemode=display&amp;event_id=548">a free cyclists breakfast</a> at the Victorian Cafe on the Weston-super-Mare seafront about 8am Wednesday morning. For events in other areas, stick a partial postcode into <a href="http://www.bikeweek.org.uk/event_search.php">the BikeWeek event search.</a> </p><p> <a href="http://www.doonofmay.org/blog/?p=24">Someone from The Doon Of May was at Hacktionlab 2008 @ Highbury Farm</a> this last weekend, as were <a href="http://www.bristolwireless.net/news/?p=393">Bristol Wireless, who were running the wifi.</a> </p><p> I've not seen an official announcement, but <a href="http://www.spi-inc.org/corporate/meetings">SPI's board meeting</a> will be on Wednesday at 8pm UK time (1900 UTC), according to <a href="http://lists.spi-inc.org/pipermail/spi-general/2008-May/002574.html">my last meeting report.</a> </p><p> I've heard through <a href="http://www.bristol.lug.org.uk/">BBLUG</a> that the notorious Shevek is co-organising an event called "An Adventure in Technology" at Trinity Community Arts in Bristol on 28 June 2008. It's a follow-up event to the 2003 Bristol Linux and will be an all-inclusive event where everybody is encouraged to bring something along, talk about it, swap ideas, and build things on site. It doesn't have to be Linux-based, but a lot of things will be. The event web site is <a href="http://www.techadventure.org/">http://www.techadventure.org/</a> and you should post there if you have an idea or want to run a session. There will also be a list for people who decide on the day that they want to give a talk. </p> LUG of Glastonbury meets at Tor Leisure in Glastonbury at 7pm tonight (Monday). It will be a general planning meeting, maybe with some GPG-key-signing and other tasks. If you want the LUG to show you something in particular, this will be a good event to attend.

This week is BikeWeek 2008 and there's a free cyclists breakfast at the Victorian Cafe on the Weston-super-Mare seafront about 8am Wednesday morning. For events in other areas, stick a partial postcode into the BikeWeek event search.

Someone from The Doon Of May was at Hacktionlab 2008 @ Highbury Farm this last weekend, as were Bristol Wireless, who were running the wifi.

I've not seen an official announcement, but SPI's board meeting will be on Wednesday at 8pm UK time (1900 UTC), according to my last meeting report.

I've heard through BBLUG that the notorious Shevek is co-organising an event called "An Adventure in Technology" at Trinity Community Arts in Bristol on 28 June 2008. It's a follow-up event to the 2003 Bristol Linux and will be an all-inclusive event where everybody is encouraged to bring something along, talk about it, swap ideas, and build things on site. It doesn't have to be Linux-based, but a lot of things will be. The event web site is http://www.techadventure.org/ and you should post there if you have an idea or want to run a session. There will also be a list for people who decide on the day that they want to give a talk.

]]> 2008-06-16T15:05:41+00:00 http://mjr.towers.org.uk/writing/reflections/7_Reasons_Why_Firefox_3_Download_Day_Sucks.html <p><a href="http://www.spreadfirefox.com/en-US/worldrecord" ><img alt="Download Day 2008" title="Download Day 2008" src="http://www.spreadfirefox.com/sites/all/themes/spreadfirefox_RCS/images/download-day/buttons/en-US/180x150_02.png" /></a></p> <ol> <li><a href="http://news.sky.com/skynews/article/0,,91221-1319341,00.html">It's</a> <a href="http://news.bbc.co.uk/1/hi/technology/7457503.stm">every</a> <a href="http://www.newsnow.co.uk/h/Breaking+News/Firefox+3.0+Launch">where</a> on TV and in print, even <a href="http://raporto.info/node/4">in Esperanto</a>, which <a href="http://www.mozilla.com/en-US/firefox/all.html">doesn't even have an official translation</a> - only <a href="http://tradukado.esperanto.org.uy/">a third-party add-on Esperanto language pack</a>. </li> <li>It was <a href="http://www.web2learning.net/archives/1804">late even for the US</a> and after most of Europe finished work AFAIK.</li> <li>There's no official <a href="http://www.bittorrent.org/introduction.html">bittorrent</a>.</li> <li>There's no link to <a href="http://releases.mozilla.org/pub/mozilla.org/firefox/releases/3.0/source/">the source code</a> from <a href="http://www.mozilla.com/en-US/firefox/?p=downloadday">the main download page</a> as far as I can tell. It may be mostly free software, but it feels like MozCorp don't want pesky users changing things. </li> <li>It brings <a href="http://www.ibm.com/developerworks/library/wa-ffox3/?ca=dgr-lnxw04wa-ffox3&amp;S_TACT=105AGX59&amp;S_CMP=GRsitelnxw04">more changes for webmasters</a> (which is another reason I code to standards whenever possible, but I bet some of <a href="http://www.ttllp.co.uk/">the free software web applications we use</a> will need upgrades).</li> <li>It might be the <a href="http://np237.livejournal.com/18484.html">"most stupid world record ever"</a> (or at least <a href="http://glandium.org/blog/?p=198">useless</a>) and comes just as some browsers move away from the Gecko engine.</li> <li>...and all this irritation came before I've even built and installed the damn thing!</li> </ol> <p>Seriously: the browser looks like a big improvement from Firefox 2, but there are so many niggles with this download day idea...</p>

1. It's every where on TV and in print, even in Esperanto, which doesn't even have an official translation - only a third-party add-on Esperanto language pack.
2. It was late even for the US and after most of Europe finished work AFAIK.
3. There's no official bittorrent.
4. There's no link to the source code from the main download page as far as I can tell. It may be mostly free software, but it feels like MozCorp don't want pesky users changing things.
5. It brings more changes for webmasters (which is another reason I code to standards whenever possible, but I bet some of the free software web applications we use will need upgrades).
6. It might be the "most stupid world record ever" (or at least useless) and comes just as some browsers move away from the Gecko engine.
7. ...and all this irritation came before I've even built and installed the damn thing!

Seriously: the browser looks like a big improvement from Firefox 2, but there are so many niggles with this download day idea...

]]> 2008-06-18T14:06:57+00:00 http://mjr.towers.org.uk/writing/reflections/Firefox_3__day_3__first_impressions.html <p><a href="http://mjr.towers.org.uk/writing/reflections/7_Reasons_Why_Firefox_3_Download_Day_Sucks.html">Previously</a>, I wrote:</p> <blockquote><p>Seriously: the browser looks like a big improvement from Firefox 2, but there are so many niggles with this download day idea...</p></blockquote> <p>In reply to <a href="http://blogs.liblime.com/open-sesame/archives/93">Open Sesame » Did you download Firefox 3?</a>, I answer "Yes". It was a major upgrade for me, requiring new versions of Cairo and GTK+2, and installation of DBus-GLib on my <a href="http://www.gobolinux.org/">GoboLinux</a> computer, which brought in new versions of Xorg and so required a recompile of my <a href="http://www.gnustep.org/">GNUstep</a> desktop applications. </p> <p>Once that was done, Firefox compiled unattended. As noted by Adam Sampson in the <a href="http://mjr.towers.org.uk/writing/reflections/7_Reasons_Why_Firefox_3_Download_Day_Sucks.html#c">comments on my last post,</a> even after building from source, you still get all the obnoxious click-through EULA and when you type about:config into the address bar, you get a "no user-servicable parts" sort of notice, which really sucks. I notice that MozCorp don't call it "100% Open Source", preferring instead <a href="http://en-us.www.mozilla.com/en-US/firefox/organic/">Firefox: 100% Organic Software</a> (because we need another marketing campaign for free software, right?), so I expect I need to winkle out the restrictively-licensed parts again - <a href="http://www.gnu.org/software/gnuzilla/">GNUzilla</a>, there's still demand for your good work! </p> <p>After day 3 with Firefox 3, what do I think of it? Well, it seems a lot faster and a lot less RAM-hungry, and I'm quite impressed that all of the fancier bits of <a href="http://www.koha.org/">Koha</a> and <a href="http://www.wordpress.org/">Wordpress</a> seem to be working nicely but while I'm not annoyed enough to switch browsers yet (unlike <a href="http://wooga.drbacchus.com/ff3-and-safari">FF3 and Safari - DrBacchus' Journal</a>), there are still a hell of a lot of niggles and interface bugs. Some of the problems may have been introduced in Firefox 2, but I didn't actually use that enough to notice. My day-to-day browsing for the last year or so has been on a customised Firefox 1.5. </p><p> The FF3 user interface has some big steps backwards from FF1.5: in particular, I've lost the "force pages that try to open new windows into the same window" option (or whatever it was called... I can't find the FF1.5 manual online anymore); some keyboard shortcuts have changed - for no good reason that I can see (JavaScript has switched from Alt-E n Alt-S to Alt-E n Alt-J, for example); what on earth is the history drop down doing next to the "Go Forward" arrow?; and the button to close a tab is on each tab, so I need to be careful to miss it when trying to switch to a tab and my pointer makes a pointless detour to the top-right when I want to close a tab. </p> <p>It's not all bad on the interface. The new RSS feed and bookmark links in the location bar are much better than in previous versions. The bookmark tagging and auto-generated folders could be a great idea once I've used it for a while.</p> <p>I'm pretty annoyed that Firefox 3 seems to come with some spyware enabled as default. I usually have cookies either switched off or set to "ask me every time" so I was surprised to be offered a cookie from safebrowsing.google.com! I know it's for a noble goal, but what's this doing enabled without asking first? Untick the "tell me if the site I'm visiting is ..." options in Edit: Preferences: Security if you don't want details of your browsing to be sent to the USA. Another thing which really annoys me is that the <a href="http://support.mozilla.com/en-US/kb/">Firefox support site</a> requires javascript and seems unhappy with my cookie settings. Not cool. </p> <p>Other than that, the main problems with Firefox 3 are omissions rather than bugs. For example, <a href="http://blog.mozilla.com/faaborg/2006/12/11/microformats-part-0-introduction/">Microformats [Alex Faaborg]</a> support was one of the long-trumpeted new features in Firefox 3, but they're really not obviously included, as noted by others in posts like <a href="http://www.ampedwebstandards.com/2008/06/13/firefox-3-is-here-wheres-the-microformats-support/">Firefox 3 is here - where's the microformats?</a> </p> <p>And finally, <a href="http://en-us.www.mozilla.com/en-US/search/?query=firefox&amp;hits_per_page=10&amp;hits_per_site=0">searching mozilla.com for firefox</a> returns 0 hits, which is a bit strange... are they ashamed of it?</p> Previously, I wrote:

Seriously: the browser looks like a big improvement from Firefox 2, but there are so many niggles with this download day idea...

In reply to Open Sesame » Did you download Firefox 3?, I answer "Yes". It was a major upgrade for me, requiring new versions of Cairo and GTK+2, and installation of DBus-GLib on my GoboLinux computer, which brought in new versions of Xorg and so required a recompile of my GNUstep desktop applications.

Once that was done, Firefox compiled unattended. As noted by Adam Sampson in the comments on my last post, even after building from source, you still get all the obnoxious click-through EULA and when you type about:config into the address bar, you get a "no user-servicable parts" sort of notice, which really sucks. I notice that MozCorp don't call it "100% Open Source", preferring instead Firefox: 100% Organic Software (because we need another marketing campaign for free software, right?), so I expect I need to winkle out the restrictively-licensed parts again - GNUzilla, there's still demand for your good work!

After day 3 with Firefox 3, what do I think of it? Well, it seems a lot faster and a lot less RAM-hungry, and I'm quite impressed that all of the fancier bits of Koha and Wordpress seem to be working nicely but while I'm not annoyed enough to switch browsers yet (unlike FF3 and Safari - DrBacchus' Journal), there are still a hell of a lot of niggles and interface bugs. Some of the problems may have been introduced in Firefox 2, but I didn't actually use that enough to notice. My day-to-day browsing for the last year or so has been on a customised Firefox 1.5.

The FF3 user interface has some big steps backwards from FF1.5: in particular, I've lost the "force pages that try to open new windows into the same window" option (or whatever it was called... I can't find the FF1.5 manual online anymore); some keyboard shortcuts have changed - for no good reason that I can see (JavaScript has switched from Alt-E n Alt-S to Alt-E n Alt-J, for example); what on earth is the history drop down doing next to the "Go Forward" arrow?; and the button to close a tab is on each tab, so I need to be careful to miss it when trying to switch to a tab and my pointer makes a pointless detour to the top-right when I want to close a tab.

It's not all bad on the interface. The new RSS feed and bookmark links in the location bar are much better than in previous versions. The bookmark tagging and auto-generated folders could be a great idea once I've used it for a while.

I'm pretty annoyed that Firefox 3 seems to come with some spyware enabled as default. I usually have cookies either switched off or set to "ask me every time" so I was surprised to be offered a cookie from safebrowsing.google.com! I know it's for a noble goal, but what's this doing enabled without asking first? Untick the "tell me if the site I'm visiting is ..." options in Edit: Preferences: Security if you don't want details of your browsing to be sent to the USA. Another thing which really annoys me is that the Firefox support site requires javascript and seems unhappy with my cookie settings. Not cool.

Other than that, the main problems with Firefox 3 are omissions rather than bugs. For example, Microformats [Alex Faaborg] support was one of the long-trumpeted new features in Firefox 3, but they're really not obviously included, as noted by others in posts like Firefox 3 is here - where's the microformats?

And finally, searching mozilla.com for firefox returns 0 hits, which is a bit strange... are they ashamed of it?

]]> 2008-06-20T14:24:30+00:00