June 2008 Archives

Movable Type has just released a security update called 4.12. It is a free mandatory security update for all Movable Type 4.x users. The update resolve a vulnerability which has not been exploited, but was reported by a third party on June 16.

In short it is a cross-site scripting (XSS) vulnerability that has been found in Movable Type's built-in search feature, which could be exploited by malicious parties to execute javascript without permission.

The release candidates of Movable Type 4.2, currently in testing, Movable Type 3.36 and Movable Type Enterprise 1.5 are all unaffected by this issue.

You can get the updated file here: http://www.movabletype.com/patches/mt403/Search-mt403.zip

I just received my favorite magazine - Entrepreneur, in the mail. There is an article called Marketing - word to the wise that lists 8 tired words that will turn customers off instead of drawing them in. Very interesting, and if I think about the words they're listing it actually makes sense. In fact, it turned out that FirmDot was guilty of word crimes - using one word out of those 8.

The words, if anyone is interested, are: Care, Solutions (that is the one we've been using till today, now replaced with Services), Results, Amazing, Needs, Quality, Turnkey and #1.

The reason I replaced the word Solutions with Services is quite simple - although we do offer Blog Solutions to some extent, it is mostly Blog Services and not necessarily Solutions per se. I hope it makes sense.

Happy blogging!

As I was looking for books to put on one of my shelves, I remembered the book I special ordered from Barnes and Noble a couple of years ago. It's called Founders at Work: Stories of Startups' Early Days, By Jessica Livingston. I see the book is now available on books.google.com for free if you'd like to check it out. I actually encourage you to check it out if you're into business stories, or just interested to know how some companies have started. Like some movies, you can read that book over and over again, or at least a couple of times.

The book contains stories of companies such as: Adobe, Apple, Blogger, Craigslist, Del.icio.us, Firefox, Flickr, Hotmail, PayPal, RIM, Six Apart and many others.

You will be hooked once you start reading it, very interesting material.

For example did you know that husband-and-wife co-founders Mena and Ben Trott started Six Apart (named for the number of days between their birthdays) in their apartment in 2001. Now it's a company with 4 offices and over 100 employees.

I think I'm going to re-read some of the stories, and also check Google before buying any books since you can find them online!

If you're getting tired of Movable Type comment spam, here are some free suggestions that will either stop the spam or significantly slow it down.

We've tried it all and found that implementing CAPTCHA in your blog is pretty much the only thing you will need to stop all the comment spam on your blog. However, I will go ahead and list 3 tips that will help the situation.

Tip 1. Renaming MT comment script:

Blog spammers generally look for the file called mt-comments.cgi and start attacking it with spam. Renaming the file to something unique, will help the situation.

Open your Movable Type configuration file called mt-config.cgi located in the installation folder of your Movable Type (older versions of Movable Type will have the file called mt.cfg) and make sure you have the following code listed there. If you don't see it, go ahead and add it to your configuration file:

CommentScript mt-anything-here.cgi

If you see CommentScript mt-comments.cgi go ahead and rename it to CommentScript mt-anything-here.cgi then locate your original mt-comments.cgi file and rename it to the same name you used in your configuration file. Next, login into your Movable Type and rebuild the blog.

Tip 2. TypeKey Authentication.

TypeKey is a service that lets you confidently identify a particular user.

If you haven't already done so, go ahead and sign-up (free) at www.typekey.com and follow their instructions on how to add your Movable Type blog to your TypeKey account. You will then be presented with the TypeKey API token. Next, login into your Movable Type, and enable TypeKey under your Movable Type Blog Settings -> Registration. The next step is to make sure that you have your Commenting Policy setup properly under Blog Settings -> Comment -> Commenting Policy. Please select "Any authenticated commenters". After everything is configured properly a person will need to authenticate themselves before leaving a comment on your blog, and spammers generally don't. Please note that above directions might vary on the Movable Type version you are using.

Tip 3. CAPTCHA.

A CAPTCHA is a program that can tell whether its user is a human or a computer.

Movable Type 4 and up have CAPTCHA built-in. To activate it you'll first need to locate your Movable Type configuration file called mt-config.cgi and add the following line:

CaptchaSourceImageBase /home/username/public_html/mt-static/images/captcha-source

Note: you will need to change the path to match your MT installation directory and the location of your mt-static folder. In addition, ImageMagick needs to be installed on your server.

Next, login into your Movable Type, click Blog Settings -> Comments. There, under CAPTCHA Provider you should see "Movable Type default". Go ahead and select that, then save and rebuild your blog.

If you don't have ImageMagick installed or would rather not touch your configuration files you can also sign-up for reCaptcha which is a free plugin that you'll need to install on your server and add to your blog templates. For Movable Type 4 instructions please visit: http://joshcarter.com/software/recaptcha

Please feel free to use one or all three tips to combat Movable Type comment spam. If you're in a hurry or don't feel comfortable doing it yourself you can always hire FirmDot for assistance. Also, Movable Type 4.2 will have some great improvements to stop comment spam. Stay tuned :)

What blog owners might not know, is that Movable Type versions prior to 4.2 are really hard on servers. From the personal experience if we place a bit over 200 accounts on a very beefy server, it will barely handle the load and users might experience slow page loads and a not very pleasant Movable Type blogging experience.

There are many techniques available today to improve such experience. I will mention two - MemCached and FastCGI.

MemCached is a general-purpose distributed memory caching system that was originally developed by Danga Interactive for LiveJournal, but is now used by many other sites. It is often used to speed up dynamic database-driven websites by caching data and objects in memory to reduce the number of times the database must be read.

FastCGI's main aim is to reduce the overhead associated with interfacing the web server and CGI programs, allowing a server to handle more web page requests at once.

We've tried them all and found some drawbacks, especially with FastCGI.

Why I'm really looking forward to Movable Type 4.2. It is the culmination of the largest concerted effort by the Movable Type team and community to improve the performance of the core platform than ever before. The performance is not just measured by how long its takes for a database query to execute. Performance is also measured by how long it takes a user to complete a task.

For more information on MT 4.2 please visit: http://www.movabletype.org/documentation/mt42/whats-new.html

My personal recommendation is to upgrade to Movable Type 4.2 as soon as it's out, and it will make your blogging much more enjoyable, not to mention fast and efficient. If you'd like some assistance upgrading your Movable Type to the latest edition, please click the Services button above and we will be happy to do it for you for a low fee.

Companies looking to try MT 4.2 prior to upgrading their blogs can request a development environment created with a mirror copy of their blogs, upgraded to Movable Type 4.2 so you can "play" with it before using it in production.

It is interesting how far blogs have come. For example just the other day at a local Barnes and Noble I came across an article where an owner of a small retail handbag store decided to close the store, and just concentrate on her blog instead.

The business owner mentioned that she noticed more sales and exposure by having a blog. Users were able to leave comments, and talk to her directly. On her blog she was posting work-in-progress pictures, how the handbags are being made, the materials used, and the care she put into her work. This powerful combination - having a great product powered by a blog let the business owner work from the comfort of her house, and save some money by closing the retail store.

The story was very interesting; too bad I don't recall the title of the magazine. I wonder why no one has published a blogging magazine yet. I would be the first to sign-up for the subscription :) There are many books on blogging though, which is always good.

I remember when Blogging for Dummies book included a couple of pages on LivingDot - a blog hosting company I started in 2003, but that's another story.

Happy blogging!

FirmDot builds on founder's long industry experience to offer one-stop shopping.

High-powered corporate bloggers and individual hobbyists alike will find it easier to unleash the full power of the medium with the launch of a new company that offers state-of-the-art solutions for every blogging need. FirmDot, a subsidiary of ResidenceDot, Inc., offers a comprehensive menu of blog-related services, according to Pavel Ushakov, the firm's founder and top official.

The company's offerings include everything from installation, configuration and customization of the popular blogging platform, Movable Type, to blog maintenance packs, conversions between platforms, domain name registrations and specialized consultations, he added. All FirmDot services utilize only the most up-to-date software, and the firm's staff all has several years' of experience working with blogs.

A complete list of services can be viewed at FirmDot.com

"We started FirmDot because we realized there was a void in the field, and both individuals and corporations for a one-stop shop where they can get all kinds of assistance with their blogs," Ushakov said.

He said FirmDot, while a new company itself, begins its corporate life with a depth of experience in the field that stretches back through virtually the entire history and development cycle of blogs. Prior to founding FirmDot, Ushakov started the well-known and highly-regarded blog hosting firm, LivingDot, where he remains the hands-on Manager. Both companies are based in Los Angeles and serve a national clientele.

In business since 2003, LivingDot provides professional blog hosting services to both individuals and many of the nation's largest businesses and media giants, including the Washington Post, TIME, Newsweek, Tribune, O'Reilly, CapitalOne, Cisco, and many others.

In the years since its founding, LivingDot has established itself as a leader and innovator in the field, garnering attention from such publications as The New York Times and "Blogging for Dummies," the widely-read book that newcomers often turn to.

That uncommon level of experience prepared Ushakov and his seasoned staff to create FirmDot, with the goal of serving every blog-related need.

"Our staff knows all there is to know when it comes to blogs. If we get stuck, rest assured we will find the answer," he said. "Over the past five years we have seen it all and done it all, from assisting individuals with hobby blogs to setting up dedicated blog clusters for giant companies..."

"It's quite possible that we don't know it all, but we are pretty darn good at blogs," Ushakov added.