Authentication Hacks

My first talk was on User Authentication with MU in Existing Ecosystems, all about integrating WP with LDAP/AD/CAS and other directory authentication schemes, as well as the hacks I did to make that integration bi-directional and deliver new user features. My slides are online (.MOV / .PDF), and you can read earlier blog post summing up the project.

Plugins Mentioned

• wpCAS (long description)
• Alternate Contact Info
• WordPress Ticket Framework
• wpSMS (long description)

Scriblio

I was most excited, however, to talk about Scriblio, a plugin that turns WordPress into a library catalog with faceted searching and browsing. Those slides are online as well (.MOV / .PDF). The core plugin is in the repository, but I’d recommend people join the mail list if they’re thinking of diving in to it.

Scriblio Sites I Demoed

• Collingswood Public Library
• Colby-Sawyer College Archives
• Beyond Brown Paper photo archive

Matt demanded accent-aware spell checking for the WordPress spell checking plugin his company acquired earlier this year. And just a little more than a month later, After the Deadline delivered. Now Beyoncé, café, coöperate, and even my resumé look prettier.

Separately, Wordnik offers a new take on online dictionaries, and they just launched an API.

Backblaze is a cloud backup service that needs cheap storage. Lots of it. They say a petabyte worth of raw drives runs under $100,000, but buying that much storage in products from major vendors easily costs over $1,000,000. So they built their own.

The result is a 4U rack-mounted Linux-based server that contains 67 terabytes at a material cost of $7,867, the bulk of which goes to purchase the drives themselves.

And best of all, they open sourced their hardware:

I’ve been a fan of Drobo since I got mine over a year ago. The little(-ish, and sweet looking, for stack of disks) device packs as many as four drives and automatically manages them to ensure the reliability of your data and easy expandability of the storage. However, Thomas Tomchak just pointed out one major flaw: if you overflow your Drobo with data, the entire device may give up and you’ll lose everything.

How do you overflow a Drobo? Most users only have a few terrabytes of storage in their Drobo, but configure it to tell the computer its attached to that it can store eight or 16 TB of data. Doing that allows easy expansion when more or larger drives are added — the attached computer doesn’t need to reformat anything, it can simply save more stuff to the device — but it also opens the door to the Drobo overflow.

From Tomchak’s post:

While on my tech support call I asked the engineer how frequently he received calls about this particular problem. After a big sigh he admitted that it was nearly every day.

One commenter on the article suggested the Drobo could “just simulate that the uninstalled part is already full of simulated read-only data,” a suggestion that makes sense, but may require the Drobo to know more about the filesystem on it than it otherwise would.

I’ve been at 90% capacity on my Drobo for a while, I think it’s time I popped another disk in there.

(CC licensed photo by Pixelthing.)

A few years ago I found an article pointing out how spammers had figured out how to abuse some code I wrote back in 2001 or so. I’d put it on the list to fix and even started a blog post so that I could take my lumps publicly.

Now I’ve rediscovered that draft post…and that I never fixed the bad code it had fingered. Worse, I’m no longer in a position to change the code.

Along similar lines, I’ve been told that a database driven DHCP config file generator that I wrote back in the late 1990s is still in use, and still suffers bugs due to my failure to sanitize MAC addresses that, being entered by humans, sometimes have errors.

I’ve written bad code since then and will write more bad code still, but as my participation in open source projects has increased, I’ve enjoyed the benefit of community examples and criticism. My work now is better for it.

Most of my work is available publicly, but some development is hosted on a private SVN that’s hidden behind a firewall. Unfortunately, my primary development server is on the wrong side of that particular firewall, so I use the following command to bridge the gap:

ssh -R 1980:svn_host:80 username@dev_server.com

That creates a reverse tunnel through my laptop to the SVN server and allows me to checkout code using the following:

http://localhost:1980/path/to/trunk

I’m posting that because I lost my terminal command history and had to think for a moment about how to do this again.

Years ago I used to tunnel my outgoing email to an un-authenticated SMTP server that only accepted outgoing messages from hosts on the local network. That was fairly common back in 2000 or so, but obviously made life (or communication) difficult for people at home or on the road. The easy solution was to SSH to a machine on mail server’s local network and forward emails through it.

ssh -L 1925:email_host:25 username@ssh_host

Doing that, I was able to configure my mail client to send outgoing emails using a server configuration like the following:

SMTP host: localhost
SMTP port: 1925

Search Engine Land.com:

Yelp…is…essentially a poster-child for semantic markup. This spring, Google’s introduction of rich snippets has allowed Yelp’s listings in the SERPs to stand out more, attracting consumers to click more due to the “bling” decorating the listings in the form of the star ratings.

There are now some very good reasons why sites with ratings and reviews should be adopting microformats, and it’s not that hard to do! For a more detailed explanation, read my recap on the subject, Why Use Microformats?

In March of this year Apple applied for a patent on technology that enables or disables features of a phone via a config file. The tech is already in use: it’s the carrier profiles we’ve been downloading recently. On the one hand this is just an extension of the parental controls that Apple has included in Mac OS X since the early days, but it also implies some rather anti-consumer thinking at the company.

One examplar claim in the patent is that the config file can include a “blacklist of device resources to be restricted from access.”

AT&T used this this technology to block MMS until recently, and uses it now to block tethering, but the description given in the patent application goes much further:

For example, a carrier may wish to provide an enhanced service which utilizes the global positioning system (GPS) functionality in a mobile device. Carrier may wish to charge a premium for this service, so it may configure carrier provisioning profile to disallow third party applications from accessing the GPS functionality in device, and instead only allow applications digitally signed by carrier (or another entity affiliated with carrier) to access the GPS services in device.

Readers may remember the Trusted Computing video by Lutz Vogel and Benjamin Stephan that spotlighted the growing interest within the computing industry to impose new and artificial restrictions on the way we use the hardware and software we use daily.

A quick Google search of klaomta.com reveals more than a few people wondering why it’s iframed on their websites. The answer is that the site has been compromised.

Unfortunately for the fellow who asked me the question at WordCamp, solving the problem can be a bit of a chore. Keeping your WordPress installation up to date is important, as there are some known security flaws in older versions, but most of the attacks that crackers use are targeted elsewhere. Your passwords, all your server apps, the PHP config, your hosting control panel, and other users all must go under the microscope when trying to find security holes.

• site.org/blogname1
• site.org/departments/blogname2
• site.org/departments/blogname3
• site.org/services/blogname3

The association between blog IDs and sub-directory paths is determined in wpmu-settings.php, but the code there knows nothing about nested paths. So a person planning to use WordPress MU as a CMS must either flatten his/her information architecture, or do some hacking.

Challenge: hacking WordPress MU to support arbitrary directory paths for each blog

As with my multi-domain hack, the following assumes that you’re using the vhost=no setting, that you have access to and know how to manipulate your MySQL, that you have control over your DNS and know how to use it, and that you know how to configure Apache or similar. You’d also be smart to turn off any object caching you may have running, at least until we’re done doing direct database manipulation. The following also assumes that your wp-config.php sets the DOMAIN_CURRENT_SITE and PATH_CURRENT_SITE constants — if you’ve done a fresh install recently, it probably does, or you can check my domain mapping hack.

Hack The Path Mapping

Right at the top of wpmu-settings.php you can see how it strips all but the base of the URL path, but rather than mod that file, we can take advantage of an obscure MU hack: sunrise.php, which gets executed after some important WordPress components like the database class get loaded and before wpmu-settings.php.

To use sunrise.php, create a PHP file at /wp-content/sunrise.php and set define('SUNRISE', TRUE); in your wp-config.php.

Here’s the sunrise.php code I’m using:

if( defined( 'DOMAIN_CURRENT_SITE' ) && defined( 'PATH_CURRENT_SITE' ) ) {
	$current_site->id = (defined( 'SITE_ID_CURRENT_SITE' ) ? constant('SITE_ID_CURRENT_SITE') : 1);
	$current_site->domain = $domain = DOMAIN_CURRENT_SITE;
	$current_site->path  = $path = PATH_CURRENT_SITE;
	if( defined( 'BLOGID_CURRENT_SITE' ) )
		$current_site->blog_id = BLOGID_CURRENT_SITE;

	$url = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );

	$patharray = (array) explode( '/', trim( $url, '/' ));
	$blogsearch = '';
	if( count( $patharray )){
		foreach( $patharray as $pathpart ){
			$pathsearch .= '/'. $pathpart;
			$blogsearch .= $wpdb->prepare(" OR (domain = %s AND path = %s) ", $domain, $pathsearch .'/' );
		}
	}

	$current_blog = $wpdb->get_row( $wpdb->prepare("SELECT *, LENGTH( path ) as pathlen FROM $wpdb->blogs WHERE domain = %s AND path = '/'", $domain, $path) . $blogsearch .'ORDER BY pathlen DESC LIMIT 1');

	$blog_id = $current_blog->blog_id;
	$public  = $current_blog->public;
	$site_id = $current_blog->site_id;
	$current_site = sl_get_current_site_name( $current_site );
}

function sl_get_current_site_name( $current_site ) {
	global $wpdb;
	$current_site->site_name = wp_cache_get( $current_site->id . ':current_site_name', "site-options" );
	if ( !$current_site->site_name ) {
		$current_site->site_name = $wpdb->get_var( $wpdb->prepare( "SELECT meta_value FROM $wpdb->sitemeta WHERE site_id = %d AND meta_key = 'site_name'", $current_site->id ) );
		if( $current_site->site_name == null )
			$current_site->site_name = ucfirst( $current_site->domain );
		wp_cache_set( $current_site->id . ':current_site_name', $current_site->site_name, 'site-options');
	}
	return $current_site;
}

The first few lines of the code do pretty much the same as the start of the wpmu_current_site() function in wpmu-settings.php, but starting with line 8 it takes a big departure.

That’s where it splits the requested URL path like /path/to/blog/and/stuff/ into pieces and constructs an SQL query against the wp_blogs table to identify the correct blog to serve the request. The following example shows how:

SELECT *, LENGTH( path ) as pathlen
	 FROM wp_blogs
	 WHERE domain = 'domain.org' AND path = '/'"
	  	 OR (domain = 'domain.org' AND path = '/path/')
	 	 OR (domain = 'domain.org' AND path = '/path/to/')
	 	 OR (domain = 'domain.org' AND path = '/path/to/blog/')
	 	 OR (domain = 'domain.org' AND path = '/path/to/blog/and/')
	 	 OR (domain = 'domain.org' AND path = '/path/to/blog/and/stuff/')
	 ORDER BY pathlen DESC
	 LIMIT 1

Optimization note

Setting a maximum depth (and array_slice( $patharray, 0, $maxdepth )) would allow the query to be cached up to that depth. Otherwise, the query must be executed for every page load. The $maxdepth could either be set arbitrarily, or could be determined automatically based on the maximum path length of registered blogs.

Setting Up New Blogs

Once you’ve hacked the path mapping (and tested that it didn’t break your current site), you can add a new blog at a nested path.

Create a new blog in the MU blog admin.

Unfortunately, MU strips the slashes from the URL path you just tried to set.

The new blog you just tried to create, but with a very different path.

Fortunately, you can set the path correctly in the MU blog editor, and it won’t break the path when you save there.

Set the blog path in the MU blog editor, MU won't break it when you save it this time.

Once you create the new blog, try to load it in your browser. You’ll quickly notice the stylesheet is missing, though the blog works and functions properly.

Hack The .htaccess

WPMU uses the following .htaccess rewrite rule to properly direct requests for files on the real filesystem:

RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]

Obviously, that rule won’t work for deep paths, so I’ve replaced it with this rule:

RewriteRule  ^(.+)?/(wp-.*) /$2 [L]

And with that, you should be done.

Click here to view the embedded video.

With AT&T facing lawsuits for not delivering MMS features at the iPhone 3GS launch, they kind of had to do something. I’m not sure if I’d be satisfied by this video if I were among the plaintiffs, but I think it does a good enough job. The stat about 300% annual increases in mobile data use is pretty powerful. I’d heard it a dozen times before*, but because I wasn’t in Austin for SXSW iPhone meltdown, I don’t have quite the same appreciation as some do. AT&T added capacity then, and they seem to have been scrambling elsewhere too.

iPhone users are said to be six times as likely as anybody else to watch video on their phones, and if WiFi aggregator JiWire’s report says anything about cell data, the iPhone has certainly changed the game. JiWire’s Mobile Audience Insights Report shows that over 97% of the devices on their network are either iPhones (about 56% of the total) or iPod Touches! And all the way back in 2007 in Britain, iPhone users were 33 times as likely as other phone users to send or receive more than 25MB a month.

It will be interesting to see what happens to other carriers as they get devices that encourage use as the iPhone has.

*Actually, I hadn’t heard the 300% stat specifically, just inspecific reports of increased usage.

Click here to view the embedded video.

Okay, I don’t want to watch all the movies depicted in this 100 year overview of film special effects, but I did just add a few to my Netflix queue.

The full list, according to the description in YouTube:

• 1900 – The Enchanted Drawing
• 1903 – The Great Train Robbery
• 1923 – The Ten Commandments (Silent)
• 1927 – Sunrise
• 1933 – King Kong
• 1939 – The Wizard of Oz
• 1940 – The Thief of Bagdad
• 1954 – 20,000 Leagues Under the Sea
• 1956 – Forbidden Planet
• 1963 – Jason and the Argonauts
• 1964 – Mary Poppins
• 1977 – Star Wars
• 1982 – Tron
• 1985 – Back to the Future
• 1988 – Who Framed Roger Rabbit
• 1989 – The Abyss
• 1991 – Terminator 2: Judgement Day
• 1992 – The Young Indiana Jones Chronicles
• 1993 – Jurassic Park
• 2004 – Spider-Man 2
• 2005 – King Kong
• 2006 – Pirates of the Caribbean: Dead Man’s Chest
• 2007 – Pirates of the Caribbean: At World’s End
• 2007 – The Golden Compass
• 2008 – The Spiderwick Chronicles
• 2008 – The Curious Case of Benjamin Button

WordPress MU is a solid CMS to support a large organization. Each individual blog has its own place in the organization’s URL scheme (www.site.org/blogname), and each blog can have its own administrators and other users. Groups of blogs in WPMU make up a “Site” and one or more Sites can be hosted with a single implementation. (I’m capitalizing Site for the same reason WordPress docs capitalize Page) Each Site has a defined set of administrators and options controlling various features. You might, for instance, lock down the plugins on your blogs.site.org, while keeping it open on your www.site.org. Or maybe you’d like to let your helpdesk staff create new blogs at blogs.site.org, but not at www.site.org. That’s what WPMU’s notion of Site can help you control.

Challenge: setting up service on multiple (sub-) domains

WordPress MU makes it easy to host both blogs.site.org and www.site.org within a single implementation, but there’s little documentation for how to do it.

Once you get WPMU up and running on one of your domains you can add another. The following assumes that you’re using the vhost=no setting (correct: I really mean vhost=no), that you have access to and know how to manipulate your MySQL, that you have control over your DNS and know how to use it, and that you know how to configure Apache or similar. You’d also be smart to turn off any object caching you may have running, at least until we’re done doing direct database manipulation.

Some might ask why I’m not simply using Donncha’s plugin, and the answer is simple: it only works for vhost=yes sites. For my own use, I find that sub-directories are easier for users to make sense of (go ahead, try to tell your mom to go to “myblog.sub.domain.org“).

Set up your web server

If you’re using Apache, you’ll either need to create an IP-based virtual host or manually configure your name-based virtual host for every (sub-)domain you plan to serve. Why: WordPress will handle the domain mapping for you, so it’s better to keep Apache out of the way and let WPMU own the entire IP.

Set up your DNS

Point each subdomain you plan to host in WordPress to your webserver. You can use a wildcard domain, but you don’t have to.

Create a new blog in WPMU

It doesn’t matter what you call it or what the path is, just create one. Now go edit it in the Site Admin:

Change the domain and path to match your new domain.

One quirk of WPMU is that it strips “www” from any domain name you enter (or is requested), so don’t bother trying to enter it (unless you’re willing to do some hacking to make it work). WPMU stores domain and path information in three locations: the wp_#_options table for the blog, the wp_blogs table, and the wp_sites table. When you edit a blog in the Site Admin, you’ll get a chance to edit the domain and path for both the wp_#_options and the wp_blogs tables. Clicking the helpful checkbox above will do most of that for you, but you’ll need to manually update the Upload Path.

Now make sure the new domain is shown in the blog's options as well.

You might be able to load the blog at the new URL as soon as you update those settings, but recent versions of WPMU set some constants in wp-config.php that can get in your way.

Reconfigure wp-config.php

Your wp-config.php might have something like this:

$base = '/';
define('DOMAIN_CURRENT_SITE', 'sub.site.org' );
define('PATH_CURRENT_SITE', '/' );
define('SITE_ID_CURRENT_SITE', 1);
define('BLOGID_CURRENT_SITE', '1' );

Those constants override the database checking that goes on in wpmu-settings.php to map the requested domain to a site. You have three choices: leave it as it is (and use only one “Site”), remove it and have WPMU do the mapping against the database, or expand the hard-coded mapping to include other sites.

I’ve used code like the following to do just that:

if( preg_match( '/(.+?\.)?([^\.]+?)\.site.org/i', 'www'. $_SERVER['SERVER_NAME'] , $matchedsubdomains ))
{
	switch( array_pop( $matchedsubdomains )){
		case 'connect':
			define('DOMAIN_CURRENT_SITE', 'blogs.site.org' );
			define('PATH_CURRENT_SITE', '/' );
			define('BLOGID_CURRENT_SITE', '1' );
			break;
		case 'www':
		default:
			define('DOMAIN_CURRENT_SITE', 'site.org' );
			define('PATH_CURRENT_SITE', '/' );
			define('BLOGID_CURRENT_SITE', '2' );
			break;
}
}
else
{
	define('DOMAIN_CURRENT_SITE', 'site.org' );
	define('PATH_CURRENT_SITE', '/' );
	define('BLOGID_CURRENT_SITE', '2' );
}

Set up your new Site

Once you have your new sub-domain working with one blog, you can create your new Site. Even if you don’t plan to create separate management policies for the different sites, it’s easier to create new blogs at each sub-domain if they each have their own Site.

Go in to your MySQL tool of choice and browse the wp_site table. There you’ll see just one row, but if you’ve made it this far you can also probably figure out how to create a new row representing the site at the new sub-domain. And once you do that, you can change the entry in the wp_blogs table to associate it with your new Site.

Set up the admins of the new site

Creating the new entry in wp_site doesn’t set the options for the new Site, and that means there are no Site administrators yet. Once again in your MySQL tool of choice, open up the wp_sitemeta table and look for an entry with meta_key = 'site_admins'. The meta_value for that entry is a serialized array containing WordPress usernames of the people who have site-wide administration privileges on the first Site. I’m assuming that if you have MySQL access you’re also a Site admin, so the easy thing to do is copy that row and change the site_id to match the auto-increment value from the new wp_site entry you made in the last step.

With the database manipulation done, you should now be able to go to the WP dashboard at your new Site, visit the WPMU admin options screen, and set the other options as necessary. You could decide to make one of your Sites open registration (remember, however, that users are shared across all Sites), while making other Sites more closed. And, obviously, you can delegate different Site admins for each Site.

Sub-domains or just different domains?

It’s worth noting that the instructions so far apply to both sub-domains and domains. You can use a single implementation of WPMU to manage content at both lolzors.org and tehsite.org. The detail about sub-domains really only applies to the next part. It’s also worth noting that you can support an arbitrary number of blogs, sites, and domains; I’m just using two sub-domains as an example.

Challenge: unified log in cookies

What’s the point of hosting multiple sub-domains with one WPMU implementation if you’ll need to log in separately at each one?

Set your cookie path

Setting a cookie path that that’s broad enough to cover the entire domain will solve this:

define('COOKIE_DOMAIN', 'site.org');
define('ADMIN_COOKIE_PATH', '/');
define('COOKIEPATH', '/');
define('SITECOOKIEPATH', '/');

Avoid conflicts with other WordPress installations at your domain

But having such a broad cookie domain can interfere with other WordPress implementations. You’ll have to solve that by setting a unique cookiehash:

define( 'COOKIEHASH', 'asdf_arbitrary_string' );

You’d do better to keep it shorter than that, though.

Challenge: unified log in location/URL

WordPress MU is happy to handle authentication requests wherever it hosts a blog, but some organizations prefer to funnel all authentication requests through a single location. The idea is to provide some protection against fishing (assuming users can ever be taught to look at URLs) and make it easer to integrate external applications.

Filter login_url and logout_url

Set the log in and log out path to whatever you want, just make sure the destination knows how to create (or destroy) the WordPress cookies.

$hack_base_domain = 'site.org';

function hack_login_url( $path ){
	global $hack_base_domain;

	return preg_replace( '/^.+?\/wp-login.php/' , 'https://login.'. $hack_base_domain .'/wp-login.php', $path );
}
add_filter( 'login_url' , 'hack_login_url' , 10 );
add_filter( 'logout_url' , 'hack_login_url' , 10 );

Filter allowed_redirect_hosts

WP will normally block redirects outside the web root of the active blog, so you’ll need to tell it about your other sub-domains.

function hack_allowed_redirect_hosts( $allowed_domains ){
	global $hack_base_domain;

	$allowed_domains[] = $hack_base_domain;
	$allowed_domains[] = 'www.'. $hack_base_domain;
	$allowed_domains[] = 'blogs.'. $hack_base_domain;

	return $allowed_domains;
}
add_filter( 'allowed_redirect_hosts' , 'hack_allowed_redirect_hosts' , 10 );

Click here to view the embedded video.

Liam Lynch explains the origin of the video, but what was Dan Deacon thinking as he recorded the audio? Of all the free MP3 downloads he offers, Two Friends from the Acorn Master album may be the most, um, listenable.

Thanks to daily songsmith Corey B (Corey Blanchette) for the tip.

The following was my email response to a thread on the web4lib mail list:

Okay, it must be said: you’re all wrong[1].

I can understand that news of a librarian being fired/furloughed will raise our defenses, but that’s no excuse for giving up the considered and critical thinking that this occasion demands.

Consider this: the principle’s blog reveals a reasonable person actively trying to improve academic performance despite crushing economic conditions. The communications show a level of transparency many of us can only wish for.

Unfortunately, many on this mail list seem to have come to the conclusion that this library was a stellar, but unappreciated example of everything that libraries should be, capriciously closed by a principle who secretly wanted to see the football team shoving bookshelves around on a hot summer day.

Go ahead, mock the story (and so far we only have one story about this) for suggesting that the books have been “re-organized” by subject, but the fact remains that this community didn’t think their library was organized in a way that met its needs. This suggests that either (a) it wasn’t well organized, or (b) the librarian had failed to educate the users and develop the finding aids necessary to help the community use the library.

Nobody here is banning or burning books. Nobody is suggesting that libraries are irrelevant. Far from it: this story about the modernization of a library to make it a more significant part of students’ academic activity.

News that a member of our profession has been furloughed is sad. But, news that a principle is investing time, attention, and money in the library is good. News that those two stories are one in the same should make us ask critical questions about how we and our libraries are positioned to serve our community.

[1]: Everybody but Robert L. Balliot, whose message has so far been ignored.

An amusing hacks-conference lightning talk-turned-blog post on web development: “Graceful Hacks” – UX, IA and interaction design tips for hack days. Martin Belam’s talk at The Guardian’s July 2009 Hack Day must have been both funny and useful:

• Funny: “However, I am given to understand that this is now deprecated and has gone out of fashion.”
• Useful: “the Yahoo! Design Pattern Library is your friend.”

Click here to view the embedded video.

Google’s own webmasters help site recommends microformats and RDFa structured data to improve indexing and usefulness of the data. Review metadata appears to have full support, while people, product, and business data are in beta.

Click here to view the embedded video.

Mozilla Labs’ Ubiquity has a lot of promise:

Ubiquity is an experiment into connecting the Web with language in an attempt to find new user interfaces that make it possible for everyone to do common Web tasks more quickly and easily. It’s a Firefox extension, so it works on Macs, Windows, and Linux.

With only a couple keystrokes, it lets you use language to instruct your browser. You can translate to and from most languages, add maps to your email, edit any page, twitter, check your calendar, search, email your friends, and much more. All without leaving the page you’re on.

The first live example I saw reminded me of how a person could add an appointment in Newton (the web is strangely empty of examples, but you would write out “lunch with Dave next Tuesday” or something like that). The second example reminded me of Mac OS X’s Spotlight. The third example finally showed me something useful, and the video above is along those lines.

I’m wondering, however, how long until Apple adds those features to Spotlight.

Click here to view the embedded video.

I’m simply in love with this video. Watch through the credits to see a bit of how it’s made.

Philip Greenspun suggests small organizations use a blog for their website (ironically, not blogged):

The Small Business Web circa 1994

In 1994, a small organization that wanted a Web site would hire a “Web designer” skilled in the exotic art of “HTML programming” to produce a static Web site, i.e., a cluster of linked pages with a distinctive design and color scheme, giving information about the company or non-profit org. None of the pages would have a date on them because, by definition, nothing on the Web could be more than four years old.

The Small Business Web circa 2009

Managers of new small enterprises or established non-profit organizations sometimes ask me “Whom should I hire to build my Web site?”

I ask them what they want the site to do. The answer is to promote their business and distribute some basic information to customers. What they want is a static 1994-style graphic designer-produced Web site.

I explain that publishing on the Web is like producing a word processor document or writing an email. Would they hire a designer to write their documents and emails? No? Then why would they hire a designer to build their Web site?

he goes on…

The description to David McNicol’s URL Cache Plugin raises more questions than it answers:

Given a URL, the url_cache() function will attempt to download the file it represents and return a URL pointing to this locally cached version.

Where did he plan to use it? Does he envision the cache as an archive, or for performance? Why hasn’t it been updated since 2005?

It caught my interest because I’ve long been interested in a solution to link rot in my blog. A real “perma-permalink” would be very useful.

Bret Victor offers the above design suggestions (from 2006) to Amazon in the book search results display (he’s comparing to this). I didn’t discover them at the time, but many of them are still relevant now. Bret notes that Amazon’s display doesn’t do a good job of answering the questions a person has when searching for books: “What is the book about?” and “is it any good?”

Unfortunately, these questions are completely unaddressed by the information provided. To see relevant information, the user must click on each listing individually. That is, she must navigate by hand instead of by eye, and must use her memory to compare information across time instead of space.

The problem is that this graphic was designed as an index into a set of webpages, but is used as a catalog for comparing a set of books. The purpose of this graphic should not be to return a list of query matches, but to help the user learn about books related to her topic of interest.

The Hanzo Archives Wordpress plugin is something I’d be very excited to use. Ironically, it’s disappeared from the web (though the blog post hasn’t):

We’ve released a Wordpress Plugin which automatically archives anything you link to in your blog posts; it also adds a ‘perma-permalink’ for the archived version adjacent to each original link.

An Amazon Web Services case study put me on to Hanzo a while ago, and in May 2008 I actually spoke with Mark Middleton (the markm who posted the entry above). Mark revealed that community take-up on the plugin and other general purpose web archiving services was below expectations. The company has since refocused on legal matters (even their blog tag-line has changed to “web archiving for compliance and e-discovery”).

I wonder if, now that the number of people and companies that have been blogging for years has grown, there might be more of a market for such a service.

Lorelle is a big fan of Scott Reilly’s Customizable Post Listings:

Display Recent Posts, Recently Commented Posts, Recently Modified Posts, Random Posts, and other post, page, or draft listings using the post information of your choosing in an easily customizable manner. You can narrow post searches by specifying categories and/or authors, among other things.