There’s a total of 595.2 TB of data exposed on the Internet via publicly accessible MongoDB instances that don’t have any form of authentication.

From Shodan: It’s the Data, Stupid!

What Every Programmer Absolutely, Positively Needs to Know About Encodings and Character Sets to Work With Text:

You’re never actually directly dealing with “characters” or “text”, you’re always dealing with bits as seen through several layers of abstractions. Incorrect results are a sign of one of the abstraction layers failing.

Alex had a background as a designer before he learned development, and I think that really came through as he was one of those rare people who thought about the design and usability of his code, the opposite of most development that drifts toward entropy and complexity. One of my favorite things about Alex was how darn tasteful he was. He would think about every aspect of something he built, every place someone could click, every path they could go down, and gave a thoughtfulness to these paths that I still admire and envy today.

As an example look at his project page (essentially a category archive) for the Post Formats Admin UI, isn’t that clever and intuitive how the posts connect together, and when more time passes in the thread it’s shown as a break. It’s classic Alex: something simple and thoughtful that in hindsight is so gobsmackingly obvious you wonder why everything doesn’t work that way, but you never would have imagined it beforehand. And Alex wouldn’t just imagine it and do it for himself, he released his best work as open source, as a gift to the community and the world, over and over and over again.

Back when WordPress was getting started Alex was a celebrity of the b2 world, his hacks (plugins before plugins) were some of the coolest ones around. We had a ton of overlapping interests in web standards, photography, development, and gadgets so we frequently read and commented on each other’s blogs. I would never miss a post on his site, and that’s back when we were both doing one or more posts a day. To get a sense of Alex it’s worth exploring his blog — he was a clear thinker and therefore a clear writer. The straightforward nature Alex wrote with was something I always admired about him.

We discussed WordPress early on, Alex signed up to help with what later became the plugin directory, and his CSS competition (look at those prizes! and notice it’s all GPL) was hugely influential on the path to themes, and he officially became a contributing developer in August of 2003.

The list of what Alex was one of the first to do in the WordPress community is long, and in hindsight seems gobsmackingly obvious, which is the sign of innovation. I smile when I think of how he moved from the Bay area to Denver before it was cool, or his love of scare quotes. Once there was something going on in WordPress and he called me to talk about it, I was so surprised, he said the number was right on my contact page (and it was) but even though it had been there for years no one had ever called it before, but that was just the type of person Alex was, always reaching out and connecting.

Adam Tow, myself, Barry Abrahamson, Alex King; Photo from Adam Tow’s post.

I’m not sure how to include this next part: I couldn’t write last night — I was too tired. After falling asleep I had one of those super vivid dreams that you can’t tell are dreams. There had been some sort of mix-up on Twitter and Alex was still alive, I visited Colorado with my sister and saw him surrounded by family at a picnic table, all the rooms were taken so they put me on a floor mattress where I slept. Tons of his friends were around and we took pictures together, he was excited about the better front camera on the 6s+. (Alex understood mobile all the way back to the Treo days.) It was all very ordinary and in a group setting, until we decided to walk alongside a small highway, past some grain silos, to meet the group at a bar. The walk was just the two of us and we talked and laughed about the big mix-up and he asked about this post, what was going to be in it. He got most excited and emphatic with the part about him being a developer with great taste, and a clear writer William Zinsser would be proud of, so I like to think that those were two things he was proud of. The overwhelming emotion I remember was joy. Waking up was disconcerting, part of me wants to believe part of Alex’s spirit was there, where another more logical part thinks my mind was just going through the denial stage of grief. Regardless I know that Alex will stay in the minds of people who knew him for many years to come.

Code that Alex wrote still runs billions of times a day across millions of websites, and long after that code evolves or gets refactored the ideas and philosophy he embedded in WordPress will continue to be part of who we are. Alex believed so deeply in open source, and was one of the few people from a design background who did. (Every time you see the share icon on the web or in Android you should think of him.) I like the idea that part of his work will continue in software for decades to come, but I’d rather have him here, thinking outside the box and challenging us to do better, to be more obvious, and work harder for our users. He never gave up.

I’d crossed paths with Alex several times over the years. He was a speaker at the very first WordCamp in Utah. Later I returned the favor speaking at a WordCamp in Denver. I enjoyed our conversations, he was always thoughtful and fun.

I, along with many others, will miss him. My thoughts and prayers are with his family.

First, we now listen for AngularJS routing events, such as $routeChangeStart. Once we see that the visitor is about to view new content, we start listening in preparation for gathering performance metrics for the soft navigation.

Second, and most importantly, when the page is first loading, and when a soft navigation starts, we begin monitoring the HTML document for any new downloadable resources that get inserted. We do this via a MutationObserver.

Real user monitoring techniques for single page apps are becoming a big deal, and don’t easily have a one size fits all solution.

“The reality is that more and more decisions, including decisions about life and death, are being made by software,” Thomas Dullien, a well-known security researcher and reverse engineer who goes by the Twitter handle Halvar Flake, said in an email. “But for the vast majority of software you interact with, you are not allowed to examine how it functions,” he said.

The Times has a great look at hacker and car manufacturer mishaps and makes the case over and over again for Open Source. It’s great to see more of the world waking up to the importance of open source.

This update clarifies the error messages that Akismet uses so that they’re easier to understand, and it enables link previews in the admin for all links in a comment — not just the author’s website link. A fix is also included for a bug that could have caused comment moderation emails to be sent for some comments that were caught as spam. For a full list of the changes in this release, see the revision log.

To upgrade, visit the Updates page of your WordPress dashboard and follow the instructions. If you need to download the plugin zip file directly, links to all versions are available in the WordPress plugins directory.

Techcrunch has a good write-up with a number of the relevant quotes from the event. The only thing I’d like to respond to, because it wasn’t a direct quote, is the headline “Move Over Slack? Automattic Mulls Commercializing Its Own Internal Messaging Product.”

The first problem is the headline missed the obvious alliteration of “Mullenweg Mulls,” but more importantly… Slack has become a really key tool for both Automattic and WordPress.org and anything we do with the evolution of P2 (some of which we already have running internally) will be complementary to Slack, not competitive with it.

WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

This release addresses three issues, including two cross-site scripting vulnerabilities and a potential privilege escalation.

• WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.
• A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.
• Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.

Our thanks to those who have practiced responsible disclosure of security issues.

WordPress 4.3.1 also fixes twenty-six bugs. For more information, see the release notes or consult the list of changes.

Download WordPress 4.3.1 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.3.1.

Thanks to everyone who contributed to 4.3.1:

Adam Silverstein, Andrea Fercia, Andrew Ozz, Boone Gorges, Brandon Kraft, chriscct7, Daisuke Takahashi, Dion Hulse, Dominik Schilling, Drew Jaynes, dustinbolton, Gary Pendergast, hauvong, James Huff, Jeremy Felt, jobst, Marin Atanasov, Nick Halsey, nikeo, Nikolay Bachiyski, Pascal Birchler, Paul Ryan, Peter Wilson, Robert Chapin, Samuel Wood, Scott Taylor, Sergey Biryukov, tmatsuur, Tracy Levesque, Umesh Nevase, vortfu, welcher, Weston Ruter

Goal

Guide the direction of bbPress plugin development in 2015.

Objectives

1. Discover current and actual bbPress usage.
2. Gauge user interest in potential new features.
3. Identify key areas for improvement.
4. Prioritize areas of bbPress development.
5. Set benchmarks to streamline development processes.
6. Identify volunteers who are interested in contributing to bbPress development.

Survey Method/Design

The questionnaire we posted this year was based on the survey questions in the 2014 bbPress Survey. We went over the the questions used, replaced, and improved others. The final twenty-five questions for the survey set up using Polldaddy.com were categorized in the same manner as the year before:
a) You and bbPress
b) Themes and Plugins
c) Components and Participation
d) Opinions and Requests

The online survey was created using Polldaddy.com, a great service that provides polling widgets for blogs, websites, and social networks. A variety of survey question types were employed to gather the data required: multiple choices, check boxes, free text, email address box, and open‐ended questions.

Prior to analyzing the data collected, empty forms were deleted and submissions marked as “incomplete responses” were reviewed individually. Submissions which had no responses in the second and third pages of the survey were excluded from this report.

Key Findings

1. Software Versions.

Ninety-seven percent of participants using bbPress 2.5+ in their production sites are on the latest WordPress version (WP 4.2 at the time of survey). Notably, 71% of participants using the legacy bbPress <=1.x.x are also on the latest WP version as well.

2. bbPress Users.

For the second year in a row, the majority of our respondents used bbPress for their own sites (51%). They were followed by those who create sites with bbPress forums for others (30%), Keymasters of bbPress forums (5%), advanced bbPress developers (5%), never used bbPress but considering it (5%), theme developers (3%), plugin developers (1%), and member of forum community (1%).

3. bbPress In Your Language.

The top three languages used are English (74%), German (7%), and French (6.5%) for the second year in a row.

4. bbPress Installations:

Seventy-five percent of bbPress forums are activated in regular WordPress installations in either the domain root, physical directory, or physical subdomain. The remaining 25% are on multisite installations where more than half have activated bbPress network-wide and the rest activated bbPress in multiple networks.

5. Volunteer Sign-ups.

Eighteen respondents from 9 countries signed up to learn how they can contribute to the project. 50% of those who signed up to volunteer are respondents who “use bbPress for own sites”, 30% are respondents who “create sites with bbPress forums for others”, 10% “have never used bbPress but considering it”, and 5% each for “advanced bbPress developers” and “Keymasters of bbPress forums.” Thank you. We will be contacting you soon.

6. bbPress Site Types.

The top five types remain the same as last year’s except for Academic/educational sites which increased by 5% this year to tie for 5th. The top placers are: Generic (40%), Technical (28%), Business (28%), Non-profit(25%), Gaming and Academic (14%).

7. How participants found out about the survey.

Fifty-one percent of respondents found out about this 2015 survey through bbPress blog post, Forum post, and Twitter update. Huge props to Jeff Chandler (@jeffr0) of WP Tavern for getting in 29% of the respondents through his blog post, Twitter update, and Tavern feed in the WP admin dashboard. Props as well to The Whip Newsletter WPMUDev (7%), make.wordpress.org/support (@jdembowski) and Google search results (2%), WP Greek Community, Better Planet, bpdevel.wordpress.com (1%), and Slack, Automattic, fastwp.de, Feed, Friend, managewp.com, WordPress Planet.

8. Theming bbPress forums.

The top three choices remain the same as that of last year’s survey: Free WP theme with default bbPress theme compatibility (32%), My custom theme/s with completely custom templates/CSS (32%), and My custom theme/s using bbPress theme compatibility (31.5%).

Customizing bbPress is easier now. You can go to the bbPress codex to learn how to change layout and functionality or how to change styles of forum elements, among others.

9. bbPress Theme Features Wanted.

For the second year in a row, the top three preferences are: Responsive (69.5%), Light and Fresh Design (52%), and Compatible with the latest bbPress version (49%). Preference for “Responsive, mobile-first themes” comes in fourth at 39%.

10. bbPress-Specific Plugins used.

Almost 25% of respondents voted BuddyPress as the top plugin used, a 150% increase from last year’s survey. This could bee because per results of the 2015 BuddyPress Survey, at least half of the BP sites have activated bbPress forums. The seamless integration of bbPress and BuddyPress is due to the fact that both official WordPress plugins are led by @johnjamesjacoby. In addition, members of the BP core team have contributed to bbPress dev and members of the bbPress core team have contributed to BP dev as well. Sweet

Following closely in the most mentioned plugins category are the popular GD bbPress Attachments plugin (21.82%), GD bbPress Tools (16.36%), and bbPress Enable TinyMCE Visual Tab & responses with “No bbPress-specific plugins used” (8.18%), the top 4 responses last year. You can find the list of all plugins mentioned in the survey along with ranking and links to repository pages in this Google spreadsheet.

11. Participation in bbPress development.

Twenty-nine percent of respondents have contributed towards the development of bbPress this year. The top three ways they have participated in the project remained the same as last year’s survey: helping out in the bbPress support forums (44%), reported bugs in bbPress Trac (32.5%), and submitted translations of bbPress (19%).

While there was a slight increase in the number of contributors, most of the respondents have limited their participation in one to two activities this year. Last year, the majority of respondents were active in three or more volunteer opportunities. This shift is shown in the decreases of participation levels across the board except for a very slight increases in two: submitting themes and plugins to the WP repository with bbPress support.

12. Devices used to access forums.

Desktops and Laptops were the top two devices used most often to navigate the forums, followed by Smartphones and Tablets. While the ranking was the same as last year’s survey, the increases in usage of smartphones and especially tablets to navigate through the forums is noticeable. Fortunately, bbPress provides responsive stylesheets which are relatively easy to customize.

13. Other Forum Software Evaluated.

Top five are repeats from last year’s survey: 1) phpBB forums = 66%, 2) vbulletin forums = 48%, 3) SimplePress plugin = 41.5%, 4) Vanilla forums = 35.5%, and 5) MyBB =27%.

Thanks to @netweb, you can import data from most of the forum software mentioned above. For the current list of available forum importers/converters plus instructions on how to use them, check out this bbPress Codex article.

14. Most Requested Features.

For the second year in a row, the top requested features are: Attachments (42.5%), Ajaxification of Topics and Replies (41.5%), and Moderation tools in the front end (39%).

Acknowledgements

Survey Participants: Thank you to the 213 survey participants who completed this survey.
Online Survey Solution: Polldaddy.com and Automattic.com for the corporate account
Survey Preparation: @mercime, @johnjamesjacoby, and @netweb
Survey Report: D3.js, tagxedo.com, Microsoft Excel, Google Documents & Spreadsheets, fontawesome, and Github.com (gh-pages).

Moving Forward

For those concerned about the future of this project or about continued development, rest assured that bbPress will be around for a long long time. The bbPress core team has been involved in the process of migrating the WordPress Support Forums (English and all Rosetta sites) from bbPress 1.x.x to bbPress 2.5.8 starting with one European-language forums subsite which has been already ported and being tested on. While this migration has been discussed many times and often over the years, @johnjamesjacoby formally started the process when he posted the results of an audit to show the custom functionality required for a successful migration.

The other volunteer bbPress core team members are also involved with this migration. @jmdodd has migrated two plugins to bbPress 2.5.8. @netweb has been on hand during the migration process in the first site, setting up and improving unit tests, and very active in bbPress Trac and Forums, among other volunteer efforts. If you’re interested to help in migrating other 1.x.x plugins to 2.5.8, be sure to put your name in JJJ’s post and also join the #meta-i18n channel on Slack.

What does this all mean for you? More eyes on the bbPress codebase because along with the bbPress core team, volunteers from the WP Support team and WP Meta Team are involved in this project. Any/all lessons learned due to this migration which would serve more than 8.15 Million WordPress.org users, can only translate to improvements to the bbPress code and thereby benefiting the whole bbPress community. Your support and patience are greatly appreciated.

You can keep abreast of the latest bbPress developments by checking out https://bbpress.org/blog/ or following the project on Twitter at https://twitter.com/bbpress and/or the #bbPress channels on ​Slack.

Finally, check out the mobile-friendly bbPress 2015 Survey Results page for the complete tally of this survey including comparisons with the results from last year’s survey.

Cheers.

Also: A Civil Libertarian Reading List

Also: A Civil Libertarian Reading List

We never pass on the opportunity to mix in a little bit of humor with our passion for web content moderation.

One of our engineers, Dan Walmsley, participated in Cultivated Wit’s Comedy Hack Day in Los Angeles last weekend, and his team’s resulting project has since surfaced on Motherboard and Engadget.

Free Reddit Check, created by Dan’s team and crowned with the day’s top prize, is a site which attempts to quantify the terribleness of Reddit users based on their public comment content and subreddit participation. While perfectly suited for a hack day which pairs developers and comedians, there is certainly usefulness in determining the respectability of a potential online acquaintance. Or just knowing who to ignore.

And being obsessed with content analysis, community moderation, and keeping the web’s underbelly in check, we can’t help but think it’s a nifty idea.

Update: I sent the four Hays county commissioners this charming email.

http://www.co.hays.tx.us/school-zone-safety-program-expands-for-fall-semester.aspx

ATS is known for corruption and cronyism. They should not be invited into our community. This dirty association is unbecoming.  I’m concerned Dripping Springs is becoming yet another revenue enhancement town. The van blocking the shoulder in front of Dripping Springs Elementary is an unwelcome sight. A crossing guard, a real person there to help instead of robotically levy a regressive tax, would be a real attempt at safety. This is the right and proper job of a peace officer. Unfortunately, they are preoccupied with the mass incarceration of peaceful people. Instead, we get a public/private camera scam that surveils us as we go about our daily lives.

http://ryan.boren.me/2015/08/21/american-traffic-solutions-in-my-town/

Regards,

Ryan Boren

Dripping Springs

Update: KVUE interviewed Constable Ron Hood and came away with little. The article does report some numbers, however.

American Traffic Solutions provided both vans to the county at no cost. In the first year, Hays County will receive 25 percent of the money from those fines. After the first year, Hays County will receive 60 percent with the rest going to ATS.

This feels like a familiar narrative. ATS gives a free taste, ATS takes a percentage generous enough for in-kind kickbacks, local government gets hooked on regressive revenue.

These cameras are generating complaints. The flash is triggering unexpectedly. The line from ATS as relayed through Constable Hood’s office is that the flash builds up to a point of needing to discharge. We’ve had this happen to us several times, bringing into question the frequency and pattern of these build-up discharges. At the very least, this is a bad user interface backed by the threat of fines and force that we must deal with daily.

A free toy, thoughtlessly used.

Update: This piece from KXAN is typical local journalism that carries water for authority and asks no questions.

More press release reporting.

Update 2015/09/29: The van disappeared from Dripping Springs elementary a couple weeks-ish ago.

Update: I sent the four Hays county commissioners this charming email.

http://www.co.hays.tx.us/school-zone-safety-program-expands-for-fall-semester.aspx

ATS is known for corruption and cronyism. They should not be invited into our community. This dirty association is unbecoming.  I’m concerned Dripping Springs is becoming yet another revenue enhancement town. The van blocking the shoulder in front of Dripping Springs Elementary is an unwelcome sight. A crossing guard, a real person there to help instead of robotically levy a regressive tax, would be a real attempt at safety. This is the right and proper job of a peace officer. Unfortunately, they are preoccupied with the mass incarceration of peaceful people. Instead, we get a public/private camera scam that surveils us as we go about our daily lives.

http://ryan.boren.me/2015/08/21/american-traffic-solutions-in-my-town/

Regards,

Ryan Boren

Dripping Springs

Update: KVUE interviewed Constable Ron Hood and came away with little. The article does report some numbers, however.

American Traffic Solutions provided both vans to the county at no cost. In the first year, Hays County will receive 25 percent of the money from those fines. After the first year, Hays County will receive 60 percent with the rest going to ATS.

This feels like a familiar narrative. ATS gives a free taste, ATS takes a percentage generous enough for in-kind kickbacks, local government gets hooked on regressive revenue.

These cameras are generating complaints. The flash is triggering unexpectedly. The line from ATS as relayed through Constable Hood’s office is that the flash builds up to a point of needing to discharge. We’ve had this happen to us several times, bringing into question the frequency and pattern of these build-up discharges. At the very least, this is a bad user interface backed by the threat of fines and force that we must deal with daily.

A free toy, thoughtlessly used.

Update: This piece from KXAN is typical local journalism that carries water for authority and asks no questions.

More press release reporting.

Update 2015/09/29: The van disappeared from Dripping Springs elementary a couple weeks-ish ago.

Version 4.3 of WordPress, named “Billie” in honor of jazz singer Billie Holiday, is available for download or update in your WordPress dashboard. New features in 4.3 make it even easier to format your content and customize your site.

Menus in the Customizer

Create your menu, update it, and assign it, all while live-previewing in the customizer. The streamlined customizer design provides a mobile-friendly and accessible interface. With every release, it becomes easier and faster to make your site just the way you want it.

Formatting Shortcuts

Your writing flow just got faster with new formatting shortcuts in WordPress 4.3. Use asterisks to create lists and number signs to make a heading. No more breaking your flow; your text looks great with a * and a #.

Site Icons

 
Site icons represent your site in browser tabs, bookmark menus, and on the home screen of mobile devices. Add your unique site icon in the customizer; it will even stay in place when you switch themes. Make your whole site reflect your brand.

Better Passwords

 
Keep your site more secure with WordPress’ improved approach to passwords. Instead of receiving passwords via email, you’ll get a password reset link. When you add new users to your site or edit a user profile, WordPress will automatically generate a secure password.

Other improvements

• A smoother admin experience – Refinements to the list view across the admin make your WordPress more accessible and easier to work with on any device.
• Comments turned off on pages – All new pages that you create will have comments turned off. Keep discussions to your blog, right where they’re supposed to happen.
• Customize your site quickly – Wherever you are on the front-end, you can click the customize link in the toolbar to swiftly make changes to your site.

The Team

This release was led by Konstantin Obenland, with the help of these fine individuals. There are 246 contributors with props in this release. Pull up some Billie Holiday on your music service of choice, and check out some of their profiles:

Special thanks go to Siobhan McKeown for producing the release video, Hugo Baeta for the design, and Jack Lenox for the voice-over.

Finally, thanks to all of the contributors who provided subtitles for the release video, which at last count had been translated into 30 languages!

If you want to follow along or help out, check out Make WordPress and our core development blog. Thanks for choosing WordPress. See you soon for version 4.4!

This release addresses six issues, including three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site, which were discovered by Marc-Alexandre Montpas of Sucuri, Helen Hou-Sandí of the WordPress security team, Netanel Rubin of Check Point, and Ivan Grigorov. It also includes a fix for a potential timing side-channel attack, discovered by Johannes Schmitt of Scrutinizer, and prevents an attacker from locking a post from being edited, discovered by Mohamed A. Baset.

Our thanks to those who have practiced responsible disclosure of security issues.

WordPress 4.2.4 also fixes four bugs. For more information, see the release notes or consult the list of changes.

Download WordPress 4.2.4 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.2.4.

Already testing WordPress 4.3? The second release candidate is now available (zip) and it contains these fixes. For more on 4.3, see the RC 1 announcement post.

These fixes have also been ported over to 2.6, which we continue to run here at bbPress.org and BuddyPress.org.

So, for this first foray I’ve settled on a fairly simple setup – Canon 7D with a 12mm Kenko Extension Tube and the EF 50mm f1/8 II.  For the second two shots I also brought my trusty 580EX II into the mix because there wasn’t enough light in the kitchen to get any good shots otherwise. The shallow depth of field and narrow distance window at which the lens will focus in this setup make taking these photos a challenge.

I really love how the shallow depth of field in the first image really draws you into the Kingfishers eye while the background just blurs away.

Kingfisher ornament

The other two photos that I want to share from this experiment come from a recent days baking.  These rocky piles of sugar have a magical sparkle, maybe they can be mined for diamonds ;).

Sugar mountains

This close up of the brownies came out really well. I love the bokeh and shallow depth of field.

Brownie Landscape

The Beatles – Love Me Do, Penny Lane, Help!
Ben Folds – Still Fighting It
Blind Melon – No Rain
Bob Dylan – Leopard-Skin Pill-Box Hat, Just Like a Woman
Bob Marley – Three Little Birds
Cake – Short Skirt/Long Jacket
Caribou – Andorra (album)
Carole King – I Feel The Earth Move
Construction Joe – Lizard
The Dave Brubeck Quartet – Time Out (album)
Erik Satie – Three Gymnopédies 1-3
Frank Turner – Dan’s Song
Jack Johnson – Mudfootball
Jamiroquai – Cosmic Girl
Manitoba/Caribou – Up In Flames (album)
Outkast – My Favorite Things
Phish – Stealing Time From The Faulty Plan, Esther, Tweezer, Chalk Dust Torture
Queen – You’re My Best Friend
Shawn Wasabi – Marble Soda
Soundtrack – Broken Flowers (Ethiopian jazz)
Soundtrack – Waking Life (tango)
Thievery Corporation – The Mirror Conspiracy (album)
UB40 – The Way You Do The Things You Do
Underworld – Dubnobasswithmyheadman (album)

They already have a lot of songs and kids’ albums but I’m always looking for recommendations.

• (NU)X is the experience provided to new users. (New User)’s Experience
• N(UX) is when any user experiences something unfamiliar. Novel (User Experience)

“NUX” commonly means (NU)X. We use “new users” to refer to people who are signing up and starting to use the service. “NUX” therefore refers to the signup flow and maybe some early interactions.

I prefer to think in terms of N(UX) because it’s user-centric and personalized. (NU)X is an onboarding process with an end whereas N(UX) treats novelty from the viewpoint of the user throughout their lifetime. You can apply N(UX) thinking to (NU)X but that’s not where it ends. And not every (NU)X is a N(UX).

Examples

we should try to offer the right variation for individual users

New users all look pretty much the same on arrival: just a bunch of unauthenticated HTTP requests for a signup page. When you know nothing about the individual users you can’t differentiate between them to sort them into signup variations. The more you know about them, the better you can tailor their experience. Do they need a guide? A map? A hint? A challenge? No help at all?

It looks like you are trying to start a blog. Can I help?

Clippy was a good idea that became an ironic cliché because it was too eager to help. It kept repeating its distracting wiggle onto the screen long after the user stopped needing its simplistic instruction. Good help can come from an automated agent if it doesn’t take the form of an attention-starved acrobat.

Please listen carefully as our menu options have changed.

This ubiquitous admonition is annoyingly disingenuous. They don’t actually keep track of whether you have called and listened to the menu since the latest update. Good help remembers what you already know.

 Yellow! Yellow! Yellow! Yellow!

Have you ever noticed a newly installed traffic signal on your daily commute? Commuters are terrible at noticing because they are conditioned by familiarity to be less alert. This is why new traffic lights are magnets for accidents. Where I live, road crews typically give commuters a few days of flashing yellow to alert them. Blogging about a change isn’t enough; respecting the habits of seasoned users saves lives.

Pleas

With N(UX) you can see that every user slips in and out of familiarity. Even tenured users and the developers themselves go through N(UX) now and then. My WordPress.com account is ten years old and I’m constantly getting N(UX)ed.

Knowing whether a given user is in unfamiliar territory depends on knowing where the user has been and whether the territory has changed. Depending on how comfortable they are with novelty, they’ll either need a guided tour or be happy with a hint.

N(UX) is not a yes-or-no question, a one-way ramp or a single fact for each user. It is a record of a relationship between a person and software, a profile that maps familiarities and predilections. The software has a “mental model” of the person and adjusts itself to suit them, or offers instruction when needed.

For a start, ask the beginning user if they want help. Just not too acrobatically.

Everything was captured using my Canon 7D and 16-35 f/4 IS L pairing and processed from RAW using Aperture.

I remember in the mid to late 90s that there was a whole community that wanted them to work on VR and multi-player worlds, and it just strikes that it’s a near perfect hollywood script that they would end up together again ushering in this next wave of VR.

I’ve personally been interested in VR, starting with VRML (pronounced “vermal” – and maybe the worst pronounced acronym ever), the HTML of VR – and been super excited to watch Oculus and other entrants make their debut.

When people ask me why I’m excited about VR, the way I answer it is the following: The first time I tried the Oculus it was like using a TI/99 (or Apple IIe) for the first time. In that it wasn’t perfect, and had some very clunky aspects to it, but you could instantly imagine what version 5 or 6 would be like, and how mind blowing it would be. As importantly, Oculus was the first VR device that convincingly “tricked my mind” into accepting that what I was seeing was “real”. When I did a racing demo, I tried to crash into a wall, and as hard as I tired, I couldn’t help but flinch and really felt a visceral reaction. It’s hard to explain, but I encourage anyone who hasn’t tried it yet to find a demo, or even better yet, head to a local VR meetup to see a whole bunch of demos and meet the people who are working on this cutting edge stuff.

Last week Abrash gave a talk at F8 on Virtual Reality, and I think it’s a must-watch to understand just why this time around VR might become a very big deal:

I’m not saying that Atlanta is better than your city, I’m just pointing out that you can order deviled eggs here online and have them delivered to your house.

So. For a couple of weeks now, on and off, I’ve been trying to track down the source of my personal server being slow to log in via SSH.  IT was slow… say… 98% of the time, and 2% of the time it was fast.

I thought maybe it was compromised somehow (and I did find some xmlrpc pingback reflection attacks being done using a site of mine… which I fixed) but it didn’t appear to be so.

Then I thought maybe it was some sort of network exhaustion. But my bandwidth, and my tcp connections as reported by netstat all looked very low.

I had some swap used, so I thought maybe there was something important in swap slowing the system down.

I checked the usual suspects (dns resolvers, etc) and nothing. I checked my 2 factor authentication setup. Again nothing. I checked my sshrc script. Nada.

Turning to google and the various .*exchange(like)? site answers I tried setting usedns to no, and GSSAPIAuthentication to no. I cleared out some hosts.deny|allow entries, I even disabled some dynamic things in PAM for SSH, and finally turned PAM authentication off completely.  disabled and configured the server not to use avahi

Nothing worked. Everything looked good… sshd loglevel was set to verbose and not giving me any signs… using ssh -v to connect didn’t show me anything out of the ordinary

Well that’s not true. It showed the problem but it wasn’t an “error”, so to speak, and so I didn’t immediately notice it.

It turns out that, since my server has an IPV6 address my ssh client was attempting to connect to it via IPV6 first.  This is problematic because my internet connection has no such support.

Setting “AddressFamily inet” for “Host *” in .ssh/config fixed things right up.

I want to say this started happening right around the time I upgraded to OSX Yosemite (GM candidate), but I couldn’t swear to that.

As someone who has managed to play once or twice a year for 20 years and remain terrible but hopelessly optimistic that one day the game will get easier, I can understand the frustration.

The biggest gap that jumps out to me with golf is that there is no natural place to practice. The idea of going to the driving range seems tough to pull off. When you play soccer, baseball, basketball, etc with your kids or friends — it’s either in the backyard or down the street at the park.

I think for golf to take off, the industry needs to figure out a way get the game into the backyard and parks so when people actually get to the courses, the game will be easier. Maybe technology will play a role with lower costs simulators, backyard nets, 3D swing analyzers, and other gadgets. Will be an interesting space to watch.

• “Etsy Security Notice”
• “Your IMDb password has been changed”
• WordPress.com News “Gmail Password Leak Update“.

I expect more emails like this over the next week. Only the last one — the blog post from my former employer Automattic — reflects a company taking appropriate steps:

We checked the accounts of 600,000 other WordPress.com users whose email addresses were included in the list. Since these users were not immediately vulnerable, we did not reset their passwords or send emails but will be enabling a notification in their dashboards so that they can assess the security of their passwords at their leisure and with all of this information in hand.

It is frightening that “over 100,000 accounts for which the password given in the list matched the WordPress.com password”. That is over 14% of the gmail address that matched. Still I’m not sure that justifies the other service provider wholesale resetting all the gmail addresses that match.

I have accounts on a large number of services. It feels like I’m now regularly getting more required password reset emails and “If you didn’t make this request, it’s likely that another user has entered your email address by mistake and your account is still secure.”

Are IMDB and Etsy’s approaches good? Does it help customers?

Are real solutions to today’s authentication challenges on the horizon?

其实我们每个人都有根本弱点。有人一辈子生活在无穷无尽的忧虑之中，有人脾气暴躁，有人天生骄傲自大，有人天生自卑自弃，有人在成功也找不到成就感。我和上八年纪孩子谈论这个话题时，他自告奋勇地承认他也有个根本弱点，就是他吃糖果必定要按颜色分成红黄绿紫，然后先吃绿的。

造物主创造宇宙万物，甚是美好，最后按自己形象造人的时候，深知拥有智慧的人将来的骄傲，叛逆和堕落，于是给每个人以不完全的个性，以免有人将来因自己的完美在神面前夸口。

始祖亚当夏娃犯罪之时，罪就进入人类，在人肉体心灵的体现就是不完美。人再也没有神的完美和荣光。于是有限的人在追求无限中消亡。在追求良善中落入罪孽, 在追求真理中落入迷茫，在追求生命中落入死亡。

我们人只有依靠神才能对付自己的根本弱点。哥林多后书 12:9 说：
他对我说：「我的恩典够你用的，因为我的能力是在人的软弱上显得完全。」所以，我更喜欢夸自己的软弱，好叫基督的能力覆庇我。腓立比书4:12 说：我靠着那加给我力量的，凡事都能做。然而，你们和我同受患难原是美事。

原来造物主的奇妙竟然也体现在我们的弱点中。

But as one of my editorial colleague back at TIME would frequently remind the team — stop burying the lead. So I’ll take that advice and jump into the TL;DR: After seven incredible, fun, and rewarding years at Automattic, I’m wrapping up in a couple of weeks, and joining Mike Hirshland at Resolute Ventures as a General Partner. Resolute is focused on early stage seed investing, and already has fantastic companies in the portfolio.

When I joined Automattic back in 2007, we were a handful of folks distributed around the world running WordPress.com and Akismet and contributing everything we did to the WordPress open source project. When we got together in person, we could fit around one table in the old Pier38, which was True Venture’s SF office, and later we got a space of our own at the very same pier.

About a year in I recall that Google and others had estimated that WordPress powered about one percent of the web (which we were ecstatic about!). I remember thinking, here was a company with still a couple of dozen people, having raised just over a million dollars in funding – and what a big impact already!.

Fast forward to today and WordPress is powering over 22% of the web. Automattic is 250 people in 190 cities and 30 countries, profitable (and now with a war chest), a positive force for the open web, and we are still contributing everything we do back into a huge open source project. As Matt Mullenweg, the founder and CEO of Automattic likes to say, “we open source everything but our password files.” It’s a powerful concept, and one that has held true at Automattic for all these years.

Looking at our growth, I decided to flip through the annual company meetup photos over the past few years. It’s fun to look at these photos as a nice visual on just how much the company grew:

I want to especially thank Matt Mullenweg and Toni Schneider for making this an amazing journey. We sketched out some big ambitious plans (often at Crossroads) all those years ago, and it’s incredible to look at where things are now and see how many of those big ideas became a reality. When we started talking about my transition a while back, Matt & Toni were super supportive and it was fun (and a bit nostalgic) to walk down memory lane and add up all the amazing experiences we’ve had together.

At Automattic, maybe more than any other company I’ve worked at, every single team member made themselves available to help at a moments notice – we were real-time before it was cool!. All it took was a “ping” in IRC and you had the top person in the world in their field ready to help (I’m biased, but the talent level at Automattic is incredible). So a special thank-you to those early team members who welcomed me with open arms and helped me ramp-up. Too many to list, but I’ll try: Barry Abrahamson, Mike Adams, Ryan Boren, Andy Skelton, Joseph Scott,Nikolay Bachiyski, Donncha O Caoimh, Mark Riley, Maya Desai, Lloyd DeWolf, Matt Miklic, Alex Shiels, Demitrious Kelly, and many others. You all were unbelievable colleagues and true friends.

I loved every second at Automattic, and have learned a ton along the way. I loved the way we worked and focused on output, and put engineers at the center of the company. Automattic and WordPress will always be part of my DNA, and I can’t wait to see what the talented team tackles next. In fact, I’ll remain an advisor to Automattic, and you’ll still see me out there championing the cause of democratizing publishing. For anyone looking to work at a fast paced, fun, and big impact type of organization – I can 100% recommend working at Automattic.

I also want to thank Phil Black, Jon Callaghan, Tony Conrad, and the whole team at True Ventures. I’ve known many of them even longer than my colleagues at Automattic, and they are just a tremendous group of people who are the embodiment of integrity and loyalty. I’ve learned so much from them, and in many ways they provided the spark that got me hooked on working with early stage companies.

In terms of Resolute Ventures – this was an opportunity that was tailor made for me. My passion is working right in the intersection of technology and entrepreneurship. I’ve always been both a tech entrepreneur who is passionate about building businesses and working on product, and a business guy who thinks the more technical you are, the closer you are to the truth.

I love working with founders and helping early stage companies navigate and make sense of the amazing opportunities and the chaos. I’ve founded companies back in the web 1.0 days, worked at large media companies in NY, and have helped grow Automattic the last few years wearing many different hats — from building up our enterprise VIP business to most recently heading up corp dev and partnerships. The highlights for me at Automattic were definitely helping bring people on board either through hiring or acquisitions — and seeing fantastic people make great contributions has been incredibly rewarding.

Mike Hirshland, the founder of Resolute Ventures, is someone well known here in the Valley, especially for a guy based in Boston. I’ve known him for close to a decade, and he served on our board at Automattic for many years while at Polaris and was part of the original investors in Automattic. Many of you know him from Dogpatch Labs, which he ran, and where Instagram and many other companies got their start. He’s a true advocate for founders, and blends hard work, persistence, and self deprecating humor into something magical.

Part of me is definitely a bit sad to be leaving my family at Automattic, but I’m excited for the next chapter and can’t wait to work with all the fantastic people who are part of Resolute. A special shout-out to my friends who helped me with this transition and were so generous with their time and insights.

So here goes something new — and I’m looking forward to the next seven years and beyond.

Writing this post after nine months is a coincidence. The impedance for this post is actually my colleague Deirdré Straughan’s Joyent Retrospective.

The video is a “retrospective of the videos [Deirdré has] done in the last few years”. The video is wonderfully playful. Joyent CTO Bryan Cantrill appears to fidget along to the music.

The experiences highlighted in the video are the real gift. Deirdré links to all the the videos (with the exception of the internal meet-and-greet ones). Deirdré has done an incredible job leading Joyent sharing so much of its technical expertise.

Watching Joyent Retrospective brings to mind the journey I’ve been part of here. I thought I knew what I was getting myself into, but I really had no appreciation of the depth and pragmatic uniqueness of this team and technology. No company compares to Joyent in density of expertise in Infrastructure as a Service and as a product. This team has deep, deep, strong roots and continues to execute on its vision.

Enjoy!

凡事都有定期，天下万务都有定时。生有时，死有时；栽种有时，拔出所栽种的也有时；杀戮有时，医治有时；拆毁有时，建造有时；哭有时，笑有时；哀恸有时，跳舞有时；抛掷石头有时，堆聚石头有时；怀抱有时，不怀抱有时；寻找有时，失落有时；保守有时，舍弃有时；撕裂有时，缝补有时；静默有时，言语有时；喜爱有时，恨恶有时；争战有时，和好有时。

说什么脂正浓，粉正香，如何两鬓又成霜？

你趁着年幼、衰败的日子尚未来到，就是你所说，我毫无喜乐的那些年日未曾临近之先，当记念造你的主。不要等到日头、光明、月亮、星宿变为黑暗，雨后云彩反回。

 昨日黄土陇头送白骨，今宵红灯帐底卧鸳鸯。

 凡你手所当做的事要尽力去做；因为在你所必去的阴间没有工作，没有谋算，没有知识，也没有智慧。

 金满箱，银满箱，展眼乞丐人皆谤。

他怎样从母胎赤身而来，也必照样赤身而去；他所劳碌得来的，手中分毫不能带去。

 正叹他人命不长，那知自己归来丧！

 不要行义过分，也不要过于自逞智慧，何必自取败亡呢？不要行恶过分，也不要为人愚昧，何必不到期而死呢？
无人有权力掌管生命，将生命留住；也无人有权力掌管死期；这场争战，无人能免；邪恶也不能救那好行邪恶的人。

 活着的人知道必死；死了的人毫无所知，也不再得赏赐；他们的名无人记念。他们的爱，他们的恨，他们的嫉妒，早都消灭了。在日光之下所行的一切事上，他们永不再有分了。

训有方，保不定日后作强梁。
择膏粱，谁承望流落在烟花巷！
因嫌纱帽小，致使锁枷杠，

原来人也不知道自己的定期。鱼被恶网圈住，鸟被网罗捉住，祸患忽然临到的时候，世人陷在其中也是如此。

昨怜破袄寒，今嫌紫蟒长：

 见日光之下，快跑的未必能赢；力战的未必得胜；智慧的未必得粮食；明哲的未必得资财；灵巧的未必得喜悦。所临到众人的是在乎当时的机会。

乱烘烘你方唱罢我登场，反认他乡是故乡。

已过的世代，无人记念；将来的世代，后来的人也不记念。

甚荒唐，到头来都是为他人作嫁衣裳！

人一生虚度的日子，就如影儿经过，谁知道什么与他有益呢？谁能告诉他身后在日光之下有什么事呢？因为世人遭遇的，兽也遭遇，所遭遇的都是一样：这个怎样死，那个也怎样死，气息都是一样。人不能强于兽，都是虚空。都归一处，都是出于尘土，也都归于尘土。

I was happy to take an Uber for free when I used PayPal as payment for the first time (expires Nov 28, 2013): http://blog.uber.com/paywithpaypal

If you don’t have an account, you can get another $10 credit using my referral code: http://www.uber.com/invite/uberlloydde

I’m relieved I didn’t have phone a taxi company only for one not to show, or to try to hail down a taxi. I’m too old for white-knuckled rides through the city.

I don’t use Uber much as I like to walk and use public transit. When I do need it, I’m very thankful for the service.

I’m terrible with names of people, addresses, and locations. Uber makes me feel more comfortable navigating San Francisco. I can enjoy San Francisco more. Uber is easy and it works.

Also, as a technology professional Uber inspires me.

We’re going to hit 200 employees very soon. That’s more than five times my age.

Coincidence? Almost certainly.

One of those seven years was definitely coincident, though, with working closely with someone who would have been one of those 200 people if only he hadn’t decided Automattic was too cool for him.

You can learn all about that voyage of discovery in his new book:

To research how distributed companies work, Scott Berkun joined Automattic in 2010 and led the company’s newly formed Team Social, where Andy, Beau, and I caused as much trouble as possible. The fruit of that research is The Year Without Pants, which strikes a nice balance between exposing the skeletons in Team Social’s closet (including the sordid affairs of one Michael D Adams) and documenting how Automatticians communicate and get things done.

Even if you’re not interested in those hot mdawaffe pics, you should check it out for the insider’s view of Automattic’s culture.

And speaking of hot mdawaffe pics:

Raanan and I surprised Scott at his Launch Party. It was great seeing Scott again and helping him ring in the new book with style.

I’m pretty sure the party was only the eighth time Scott and I had ever met in meatspace (a.k.a. “real life”). A good friend, my former boss, and a formative teacher of mine, Scott and I have only ever seen each other eight times. If you don’t understand how that’s possible, read the book.

PS: We’re hiring.

Making this switch is going to be a fun journey and we are bound to find that there are some setups that can’t/don’t/won’t support https with the WP_HTTP API.

So before we try switching to using https in trunk I’ve update the Beta Tester plugin so that it forces all requests to api.wordpress.org to happen over https. I’ve also updated the api so that if you make a https request it will return https references in the results.

Please go for and test this on your test installs and let us know of any issues you find here in the comments or on the trac ticket.

A thin one :(

Congratulations to the super talented new Astronaut Candidates. I’m really excited for you all :)

Update/PS: Just so we’re clear, a thin letter is a rejection letter. I am not an Astronaut Candidate.

So I’ve switched to Twenty Thirteen, and here is the first short post of hopefully more to come, for more about my WordPress journey so far head over to my personal blog.

The Internet is definitely not a big truck…

In a cool summer night in late June 2011, Calvin Low and I were walking outside the AOL building in Palo Alto, and we were brainstorming all sorts of game ideas. Calvin said “we should do a pictionary game, it’s fun”. This is a guy who created two separate million+ DAU facebook games, so I’ve always trusted his opinion.

Our small team quickly created Mini Painters and released it in the first week of September. It was the best in the category – with best UI, art and synchronous game play. The engineering work was marvelous – the game runs on both iOS and Android seamlessly. Users gave 5 star ratings and we knew the game will be evergreen because it’s a magical platform that elevates users imagination to draw things.

Then why did we miss the chance to turn the budding success into a hit game?

The single biggest reason is that we intentionally left out facebook integration. Airy Labs mission was to create education games for kids, and kids are not on facebook.  This self-imposed limit essentially eliminated the viral nature of the game, and prevents users from playing with their facebook friends directly.

The second reason is that we missed the window to enhance the game further. Between September 2011 and December, Airy Labs did not do any promotion of this (or any) game. With a small promotional effort in mid December 2011, we quickly saw the huge popularity of this game.  Users loved it, there were over 500,000 downloads and the average play session was over 30 minutes! The number of concurrent users  once reached close to a thousand, crashing our backend servers. I wrote an email to the team “I think we may have a hit in our hands now!”

When OMGPOP saw similar trends, they quickly focused the whole company on their hit.  We didn’t. We were driven to work extremely hard on a much more complex game, writing another 40,000 lines of code between December 2011 and early Feb 2012, until the whole company collapsed under poor management.

On the other hand, the OMGPOP team struggled for years until they find this hit swiftly, so they definitely deserve this success.

“We missed the lottery ticket by one digit”, we joked when we meet with each other nowadays.

$ man jrunscript

I’m using it to deobfuscate some JavaScript.

More info at: Synologic’s Stop gnome-terminal screen clear, Fix Log’s Stop gnome-terminal screen clear, and The Shallow Sky’s Exorcising the Evil Alternate Screen.

Update

I had to turn this off since it was affecting ssh terminals. Will revisit.

$ nano
Error opening terminal: xterm-color-noclear.