This will be a 2 part guide and this is part 1

What are the common mistakes that you make!

ever got your wordpress blog hacked? Well even my blog got hacked once Take a look at the image on the top. From this simple how to guide, Im going to explain some little facts about the common mistakes that you make against security and if you got hacked some tips that you can use to remove the malicious stuff from your blog and get back to running condition.

• Most of us tend to CHMOD ( setting permissions about the usage of files and folders) our files and directories to 777 maybe on the start and forgets or don’t even consider to set back the permissions to something secure like 644

Thats what happens most of the time. Some scripts even wordpress requires some directories such as upload directories to be set 777 permissions recursively in order to store the uploads and temporary files.  Newbies who setting up their blogs sometimes gets mad on the directories and set whole http directory and files to 777.  Yes some of you might laugh at this but this happens. And even I did the same thing on the beginning. But fortunately wordpress has been evolved these days and its smart enough to tell you what are the permissions required and its able to check if the permissions are correct on the folders while installation. So you might be lucky these days but even today some additional plugins require the file permissions specially to be set on some folders and you should be careful while doing those things.

• Never set 777 permissions on the main http folder. If your plugin require that, forget about the plugin!

• Always use trusted web hosts.

No matter how secure your blog is there can be loopholes on your hosting.  Yes you might be short with money but still there are plenty of good web hosts on the world which you can get bang for the buck. Forget about the web host advertised on your local discussion forum. Starting a web host is like nothing these days. Anyone with a dedicated server or VPS and cpanel license, whmcs license can start a web host. But good security wont be there most of the time. So you need to be careful. Chances of leaking your data to others is very high.

• Dont use your mysql database user password for something else such as your email accounts or anything.

You might be wondering why is that, its not because of someone stealing your email account password and then accessing your sql database. But I meant the reverse process. Think if your db user name and password got exposed due to a web server hack or something. Hacker will probably try the credentials for login to your email account or other online accounts. So have something special and unique as your mysql user password and never use it on anything!

• Using your web host provided backup system? Good! but take your time and backup off site too!

Its not always the index.php exploit. Sometimes wordpress core gets attacked due to weak-spots on the core itself and some brutal things happened with wordpress not far ago. So backups are most important. If your database got exploited and there is no information yet about how to remove the exploit and get back running you may really enjoy if you have backups in hand. Waiting for a statement and patch from wordpress team or something is not the best way specially if you are running a busy site. So if you have backups its like cheese!

So listen we know most web hosts give you the option to backup data on their control panel so the restoration will be easy and such. But dont depend on it. Like on the previous case if the whole server gets hacked or something. You might lose the backups and will left with nothing but sorrow! So be prepared and take backups redundantly!

• There is cool plugin on for wordpress I’m going for it! That’s not a problem. But view the ratings and read the forums on wordpress before installing a life changer plugins.

This is crucial. WordPress plugins emerge day by day and you need to be careful. The more plugin gets complex and interesting the better the chance of modifying the wordpress core heavily. So those plugins can really maybe weak spots later because of the modifications done to the wordpress core thus leaving possible exploit options. The best way to get around this problem is downloading your plugins from the wordpress.org plugin repository itself and read the ratings and corresponding forum ( there is separate forum for each plugin which can be found on plugin page) about the user experience! Trust me plugins are evil!

• Always update the plugins and wordpress core to latest

See Im using LNMP on my VPS which runs this blog and Im not running FTP service on it. So wordpress updates on the control panel and the easy one click plugin updates doesnt work because they all require FTP to do the trick.

So the get around is following the traditional way of upgrading stuff which  we did on wordpress 2.x.x That is downloading updates and overwriting files . What Im going to tell you is that always keep up to date on the plugins and wordpress core. See my way is very hard and sooo 2008 but I still do that when upgrade comes out and trust me I see upgrades very often with my 25 plugins.

• Read wordpress.org about the latest news and new releases.

Do this at least twice a week. Sometimes you may not even know when a large scale attack or loop hole on wordpress gets exposed to hackers and they are doing mass destruction. WordPress.org maintains a news blog here which provide news about new wordpress releases and most importantly security releases and flows. Don’t think wordpress core itself is very secure and you don’t have to look in to that, WordPress core loop holes has been exploited many times before. So be prepared!

Continued to Part 2

Other posts you might feel interesting

• LNMP V0.8 The complete Nginx auto installer!
• 1+ Years of Uptime with linode! Review
• Linode Tokyo/Japan Speedtests
• Linode XEN VPS review
• Find out uptime of a server without SSH

You may have noticed the new widget on my right side bar which is displaying my facebook fan page details. Yeah I have created a facebook fan page for my blog which is located right here . I know Im too late on this, I have created my facebook profile on 2008 and up to the date I didnt thought about having a facebook fan page for my blog because I didnt trusted it to be a good traffic maker.

However I had the feedburner  since the beginning and it counts 1445 subscribers as im writing this. That was a huge achievement and its not like having 1445 facebook fans, it really worth 5X than the facebook likes for me as the email subscriptions really show the encouragement of readers toward reading this blog rather than clicking the like button.

Awful thing happened to me while creating the fan page. It was that I previously had facebook.com/ruchirablog permalink attached to my facebook profile and when I was creating the fan page I thought having facebook.com/ruchirablog as the fan page url is the best idea since /ruchirablog for my personal profile isnt a necessary thing. And luckyly there was a option to change the url for just one time and I thought I should change it to some other thing like /ruchira.sahan so the released /ruchirablog will be available to assign for my fan page!

And then I changed my profile address to /ruchira.sahan and when I tried to assign the released /ruchirablog to my fan page, it said the name isnt available even the name is released from my profile So I lose /ruchirablog url from facebook and it wasn’t a nice experience!

However my fan page is now live at http://www.facebook.com/ruchirablog.fans

Other posts you might feel interesting

• How to download Facebook photo albums of friends and yourself
• Osama+Facebook Fail
• Fake news can really drive traffic!
• Facebook kills Myspace ?
• Most epic facebook profile Hopp-Dogg YO!

If you are sending considerable amount of emails to your visitors or customers you may have a problem reaching most of the users inbox because the risk of getting your IP’s blacklisted etc. So using your own servers to send emails for like 1000 users per day is a disaster because of the possibility of getting blacklisted. And a simple workaround for this problem is using Google Apps mail and its SMTP functionality.

And even there is a hard cap on sending emails from google apps mail and you will need to consider something else for the demand. And Amazon SES (Simple Email Service) offers a great and simple way to get through this problem but hey its not a innovation and these kind of service providers existed long before SES. But SES offers you very good price than the other providers.

But until now SES lacked major functionality. Thats sending emails over SMTP. All your web apps which need to send emails outside will simply use SMTP when you want external service to send the emails for it. Best example is wordpress. you can find SMTP plugins to use with google apps. But previously SES required some complex CLI actions and special programs to do the trick! In simple words its not user friendly.
But now Amazon SES introduced SMTP functionality and new section inside your amazon aws account.

you can simply obtain your SMTP login details from SES control panel and implementing it is very easy.
I have gave it a try and unfortunately for some reason it didnt worked for me on this blog and other site and I guess its minor problem on my own account or something like that and I will give a try again. I hope it will work Happy sending everyone

Other posts you might feel interesting

• 1+ Years of Uptime with linode! Review
• Cloudberry Explorer review
• Amazon S3 and Cloudfront Review
• Yahoo mail gets new interface
• LOL Mails 2011 March

Too many reviews these days meh? But I cant pass this one because working on this thing has become integral part of my carrier now. Its SocialEngine and its used to create social networks. Yes its like wordpress, its a script but costs money.  In my case we spent $669 for the script and all the default plugins. But its kinda worth the money we spent and it got many options to customize the features.

Script Features

• Built on Zend Framework PHP+MySql
• Most importantly code isn’t encrypted ( IonCubed) so any type of custom modifications are possible which is very handy
• All Licenses comes with “No branding” option. which means there wont be any copyright text from developer company left in the footer and they wont ask more $$ to remove it. Which is very good considering other commercial scripts charge $$ or $$$ to remove the branding.

Community Around it

• You will find considerable community working behind it unofficially. which means many sites to download plugins, themes,addons are available  and some forums are there to get help if you need.

• Since this is a paid script you will have to pay to get the plugins and things from those web sites as for now I have found only few free plugins to it.

• Also socialengine.net site itself got some great documents about how to get things up and going.

Value Added Features

• There is built in CDN support which supports Amazon S3,CloudFront and MaXCDN. And setting it up is very easy and probably this is the best cloud integration that I ever seen on a script.

• Admin panel plugin,theme,addon installation support. Remember the days you installed plugins via FTP on your wordpress blog? yes things have changed and with socialengine you can install plugins saved on your computer and upgrade to newer version by using your admin panel GUI.

• Admin panel editor for site layout and theme codes is available and its even better than wordpress theme/layout editor.
• Built-in support for caching is available and supports File Based caching (like WP-Super-Cache) , Memcached, APC, Xcache

What kind of cost you should be looking at

• Well it mostly depends on you. minimal code base (without default plugins) costs $299
• All the official plugins cost $370
• If you want fully fledged site with this it will easily run you about $1000 and even more.
• Third party plugins starts at about $10 and costs as much as $120 for some great plugins.

Whats Bad

• And its very bad! Take a look at below image

And its a screenshot of my amazon S3 bucket which I use to host images,mp3s,thumbnails of the users of our socialnetwork. As you can see it creates stupid amount of Folders to store images and thumbnails of users.

For example remember wordpress creates single folder to store a month worth of uploads such as wp-content/uploads/2011/10/ that directory stores all uploads to web site on october 2011.

But this socialengine script creates stupid and crazy amount of folders to store images and most of the time there is only 1 image on a folder and I think there are folders than the files And its bullshit! I dont know why they did this and this might be artifact of Zend Framework. ( please correct me on comments if im wrong) And this makes the backing up process hard and it would be ridiculous to backup those folders without like zipping the whole directory and then backing it up.

its fairly easy to manage the script via admin interface and can be easily get used to it after few days of use. At last I would recommend SocialEngine to anyone who is searching for good socialnetwork script and I would rate this 8/10 and you lost 2 stars because of that folder problem socialengine

Random Posts

• LOL Mails 2011 March
• LNMP0.5RB released!
• Activating Voice Calling on Huawei HSPA modems
• How to get more twitter followers
• RuchiraBlog is updated to new version of wordpress

I have always recommended linode ( A XEN VPS hosting company) for you! Checkout my last 100 day uptime review here- http://www.ruchirablog.com/linode-xen-vps-review/

Trust me guys its amazing experience which I’m having with Linode. Today I hit the milestone of 365 days of uptime on the VPS which hosts this blog. Now I have 4 Linode 512 plans on their London Data Center and another one which runs the web site of the company which I work on is having 371 of uptime as of now.

You can check my blogs uptime here - http://www.ruchirablog.com/uptime.php

My blog runs on Ubuntu 10.04LTS and Nginx is serving the requests, and my Linode never skipped a beat. And also the 2 VPS’s im having 1+ years of uptime are on different host boxes and its amazing.

You can find the network uptime graph of my blog by pingdom below

As you can see I only had 17 minutes of network downtime according to linode and longest downtime was 3 minutes. Do the math and you can find that I had about 99.9978% of network uptime while Linode promises us 99%.

I never had any problems with 4 of my VPS’s with linode and support is amazing and never took more than 10 minutes to answer any serious question.

And the exciting thing is its very hard to find a negative review about linode on the internet and even Linode got thousands of customers, I never able to find bad things like “I lost my data” on internet about linode.

Its the most amazing hosting experience I ever had in my life and I’ll give 10/10 marks for linode any day.

You can find my old detailed review here- http://www.ruchirablog.com/linode-xen-vps-review/

And if you wish to signup for linode you can do so here- http://www.ruchirablog.com/go/linode ( Its a referral link )

*Disclaimer- Linode hasn’t paid me cent to write this review and my expressions are solely based on my own experience!

Other posts you might feel interesting

• Linode XEN VPS review
• Linode Tokyo/Japan Speedtests
• LNMP V0.8 The complete Nginx auto installer!
• My hosting journey
• Get Amazon EC2 instance free with ubuntu 10

Apple sent a email to reporters Tuesday saying “Let’s talk iphone” . You can see the image contained on it above, Actually Apple is getting ready to announce next generation Iphone on on October 4th. We cant expect apple to launch the device on the same day but they will release specs,pics and also a feature video about it.

For now we got 2 judgements about the name of the device it will be Iphone 5 or Iphone 4S. So in this post I’ll post my assumptions about it

• I think it will be Iphone 4S rather than 5. The main reason to think like that is I believe technology isn’t developed much since Iphone 4 to convince Apple to make it “Iphone 5″. But who knows its their decision.
• Screen size will be bumped up to 4 inches.  4inch is becoming a standard these days. Personally I wont go for a phone which got below 4inch display after using my Galaxy S
• Most likely it will get HD 720P Retina display.
• IOS 5
• Thickness wont go beyond Iphone 4
•  1GB RAM for sure
• most likely processor will be 1Ghz dual core A5 or 1.2Ghz Dual core?
• 8MP primary CAM which shoot 1080P at 30FPS and 2MP secondary HD cam for Facetime.
• 4G LTE for verizon and HSPA+ for AT&T and T-mo.

Those are just assumptions of mine and its open for discussion. However October 4th isnt far away and time will tell us whats going to be there

Other posts you might feel interesting

• Fancy Itune spams
• Cherry’s better than apple?

Linode which is my favorite VPS host, recently announced their service availability on Tokyo,Japan data center.  If your visitors reside in Asia you might be interested in jumping to Tokyo data center.  But what about speeds? London data center is already performing very well for Asian linode customers.

So to find out what kind of speeds that I can get with Tokyo Data Center, I have snatched a 512MB linode on Tokyo DC and decided to perform some network speedtests. All tests were done with 100MB test files.

Unfortunately the results are extremely poor as you can see below. I wont put the blames quickly on linodes part because since its new there can be few minor problems and most likely be able to resolve this by simple support ticket. But I found something interesting,

As a tradition Linode hosts their speedtest files on their 1st server of specific data center. For an example their first server on London DC is london1.linode.com and their london speedtest is located on London1.linode.com ( http://london1.linode.com/100MB-london.bin ) too.

Vice-versa Tokyo speedtest file is hosted on Tokyo1.linode.com ( http://tokyo1.linode.com/100MB-tokyo.bin ) But when I saw the Linode Manager Dashboard I saw my Tokyo Linode also resides on Tokyo1 host node

And I guess that’s the major reason I got this kinda slow speeds because since its new data center, many customers might be testing speeds by downloading that 100MB test file which is hosted on the Tokyo1 Node which my Linode resides in.

So Its not a good idea to host public speedtest files on a customer production server. Specially since linode is a big company it can be brutal for the other linode members resides on the same node.  However things can be different and Ill put this to linode staff attention and lets see what their answer is!

Anyway here are the results

1. Lets start with Cachefly 100MB test which become community standard by now

Connecting to cachefly.cachefly.net|205.234.175.175|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100mb.test.1'

100%[======================================>] 104,857,600 2.94M/s   in 35s

2011-09-25 09:25:23 (2.84 MB/s) – `100mb.test.1′ saved [104857600/104857600]

I have performed this cachefly test about 2 times and this is the best that I managed to get. Since Cachefly also got Tokyo POP, Im wondering why this test got slow

2. Linode Newark NJ

http://newark1.linode.com/100MB-newark.bin
Connecting to newark1.linode.com|207.192.68.6|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-newark.bin'

100%[======================================>] 104,857,600 1.59M/s in 79s

2011-09-25 09:56:33 (1.26 MB/s) – `100MB-newark.bin’ saved [104857600/104857600]

3. Linode Fremont CA

http://fremont1.linode.com/100MB-fremont.bin
Connecting to fremont1.linode.com|64.71.152.17|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-fremont.bin'

100%[======================================>] 104,857,600 2.47M/s in 38s

2011-09-25 10:05:16 (2.62 MB/s) – `100MB-fremont.bin’ saved [104857600/104857600]

4. Linode Atlanta GA

http://atlanta1.linode.com/100MB-atlanta.bin
Connecting to atlanta1.linode.com|63.247.71.196|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-atlanta.bin'

100%[======================================>] 104,857,600 1.51M/s in 1m 51s

2011-09-25 10:09:44 (920 KB/s) – `100MB-atlanta.bin’ saved [104857600/104857600]

5. Linode Dallas TX

http://dallas1.linode.com/100MB-dallas.bin
Connecting to dallas1.linode.com|69.164.200.100|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-dallas.bin'

100%[======================================>] 104,857,600 1.76M/s in 68s

2011-09-25 10:12:18 (1.46 MB/s) – `100MB-dallas.bin’ saved [104857600/104857600]

6. Linode London UK

http://london1.linode.com/100MB-london.bin
Connecting to london1.linode.com|109.74.207.9|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-london.bin'

100%[======================================>] 104,857,600 1.15M/s in 92s

2011-09-25 10:14:42 (1.09 MB/s) – `100MB-london.bin’ saved [104857600/104857600]

7. Hetzner Germany

http://hetzner.de/100MB.iso
Connecting to hetzner.de|213.133.107.227|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://www.hetzner.de/100MB.iso [following]
--2011-09-25 10:17:49-- http://www.hetzner.de/100MB.iso
Resolving www.hetzner.de... 213.133.107.227
Reusing existing connection to hetzner.de:80.
HTTP request sent, awaiting response... 200 OK
Length: 104840234 (100M) [application/x-iso9660-image]
Saving to: `100MB.iso'

100%[======================================>] 104,840,234 508K/s in 3m 33s

2011-09-25 10:21:22 (482 KB/s) – `100MB.iso’ saved [104840234/104840234]

8. Serverboost Netherlands

www.serverboost.nl/snelheid/100mb.bin
Connecting to www.serverboost.nl|213.152.169.209|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100mb.bin'

100%[======================================>] 104,857,600 366K/s in 5m 30s

2011-09-25 10:30:26 (310 KB/s) – `100mb.bin’ saved [104857600/104857600]

Now that sucks. 310KB/s I was able to max out my DSL with that same serverboost speedtest by downloading it at 460KB/s

9. OVH France

ftp://ftp.ovh.net/test.bin
Connecting to ftp.ovh.net|213.186.33.9|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE test.bin ... 104857600
==> PASV ... done. ==> RETR test.bin ... done.
Length: 104857600 (100M) (unauthoritative)

100%[======================================>] 104,857,600 903K/s in 2m 23s

2011-09-25 10:34:38 (716 KB/s) – `test.bin’ saved [104857600]

10. Finally for the lulz lets try the Linode Tokyo speedtest

Linode hosts their tokyo test file here http://tokyo1.linode.com/100MB-tokyo.bin and Like I said before I found that my linode resides on Tokyo 1 too. So lets try same host speedtest to see what kind of result that we can get.

Connecting to tokyo1.linode.com|106.187.33.12|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: `100MB-tokyo.bin.1'

100%[======================================>] 104,857,600 53.0M/s in 1.9s

2011-09-25 10:41:45 (53.0 MB/s) – `100MB-tokyo.bin.1′ saved [104857600/1048576]

Other posts you might feel interesting

• 1+ Years of Uptime with linode! Review
• Linode XEN VPS review
• Wordpress blog got hacked? Part 1 What are the common mistakes you make!
• LNMP V0.8 The complete Nginx auto installer!
• My Favourite Whois checker tool

If you were lucky enough to snatch a HP touchpad for $99 before they went out of stock you are now lucky than ever before. You might heard rumors that Android will be ported to run on touchpad! I read comments on various techblogs about HP’s decision to sell out touchpads for $99 and most of the commentators said that they are going to buy one because in future Android will be ported to run on it. On the time HP started fire sale there wasn’t any evidence that Android can be ported to touchpad.

But now the most popular third party Android ROM Dev team Cyanogenmod announced that they are going to cook their Cyanogenmod 7 to support HP touchpad. And one of their team members released a CM7 firstboot video on youtube

And the description says that

Here is some (older) touchpad progress from Friday. The Cyanogenmod team wanted to share it with the public to bring attention to our need for a few more touchpads (for developers currently working without them).

As you can see from this quick demo, we’ve been working hard and have made progress. Since this video was created last week, the build has been more “tabletized” (tablet tweaks added, etc.), lvm support has been added.

The touchscreen driver issue is now the focus of our attention.

Our ultimate vision is to create a *multiboot* solution where the end user will be able to boot into WebOS, Cyanogenmod, and/or other OSes. This appears to be very possible, and we have discussed several potential implementations with our new friends in the WebOS development community to make it easy for an end-user to set up.

For the moment though, we need about 4 tablets, as we have talented and experienced developers who cannot contribute effectively due to a lack of hardware. If you have an extra touchpad and are willing to help the cause, please let us know in the comments below.

A BIG CAVEAT– PLEASE DO NOT ASK FOR ETAS. For the uninitiated, this is the #1 rule for Cyanogenmod. It will certainly be a long while before our goals become reality. Our goals incidentally are not connected with any bounty– we are motivated to do it right, not do it fast.

And now the obligatory shout outs– Thanks to rootzwiki and all the devs and everyone else who are collaborating and contributing to this project. You know who you are, you.

The CM team
www.cyanogenmod.com

So hopefully we can wait for them and I’m pretty sure that other great dev teams will focus to work on possible honeycomb port for touchpad owners

Random Posts

• How much does your Twitter worth?
• Most epic facebook profile Hopp-Dogg YO!
• Get a CO.TV Free domain
• Facebook introduces Permalinks
• Google or People?

Hmm. I have took a long break. However some interesting things happened online in last few days. Ray William Johnson, My most favorite youtube author passed NigaHiga becoming most subscribed youtube user.Actually whats hard to understand is why NigaHiga become this much popular with his late videos. Sorry NigaHiga fans but I must admit that NigaHiga’s videos are much better in the past but now they become worse.

However Ray William Johnson will keep his position for years I have no doubt about it. I’m a huge RWJ fan So I take this moment to congratulate him about his success.

And guess what Ruchirablog is now under Alexa’s 100000 most viewed web sites. Actually at the moment I’m sitting on 98113th position and I hope that it will gradually increase as I seem to have very strong reader base. Actually now there are more than 700 email subscribers to my blog and nearly 1000 visitors a day. I know some of you are visiting this blog daily and also I know that its very annoying when you are visiting a website and you don’t see any new things there   It personally applies for me.  But sorry about being this much busy guys. I’ll do my best to write frequently from now on as I always say

Other posts you might feel interesting

• .im domains now available for registration
• Google or People?
• Youtube offers “Shows”

I was shocked when I heard the news that all Google Apps accounts will be automatically transitioned to standard google account type so we can use our google apps account to login other google services like youtube. If you are not a typical gmail user you will think that “Hey thats nice news” but the problem is when we got more than 1 google apps logins or if we got a gmail account it will be really annoying because google dont allow to login to 2 Google accounts on the same browser.

So we cant keep eye on our Google apps email accounts and Gmail accounts same time. So when I browsed Google for solution ( yeah I meant I searched on google ) I found a nice tip allowing for login to many google accounts on same time on same browser.

You have to navigate to www.google.com/accounts

There will be a setting called “Multiple sign-in” and you have to click edit->on to enable this feature!

So here after you can login to many google accounts like I do

Random Posts

• Net4Ever.eu VPS review
• Facebook introduces Permalinks
• Nginx+Mysql+PHP-FPM Auto installer for centos 5 and debian
• Youtube offers “Shows”
• Back to Basics!