Introduction

I don't know about you, but I can't imagine doing my PHP development without an IDE with a debugger anymore.

It autocompletes for me, it lets me step through each line of code, jumping around the project, execute and change the code flow on the fly, and does many other things that make me feel cozy, comfortable, and efficient at PHP development (as opposed to, say, CPP which makes me feel cold and lonely).

There are many PHP IDEs out there and I've tried most of them (including the free PHPEclipse and PDT for Eclipse) but kept coming back to NuSphere's PHPEd every time. The other ones just don't do as good of a job and don't have the array of features PHPEd does. Did you know Dmitri, the author of PHPEd, actually wrote the PHP debugger and profiler for PHPEd from scratch?

But this post is not about PHPEd's features – I'm planning on doing a few detailed ones later on – this post is a quick note about a coupon code for 10% off PHPEd or any of their other products.

The Coupon

Here it is for your immediate enjoyment:

Just add the products you want to your cart and enter the coupon in the Coupon code field:

Observe the discount applied immediately:

Edit: it seems that they're running some sort of a promotion – PHPEd Pro temporarily has an additional $80 off the regular price. The discount was set to expire on January 15th but it seems to be still active:

The 10% off should work on top of the $80 discount no problem.

Enjoy!

"unknown host"

and

"Network is unreachable"

errors while pinging. I double and triple checked all the settings – DNS and gateway were set up right. I even rebooted, but nothing worked.

Then I vaguely remembered that I ran into the same issue a few years prior and also spent hours trying to figure out what was going wrong. The solution was so incredibly simple that my geek cred should have been docked 10 points. But what was it?.. And then it finally hit me.

Let's see… check ifconfig… yup, the network interface has no IP even though I set it and it even showed up during the network restart command.

ifup eth0

Check ifconfig again – there it goes, and the network is finally operational. Damn you, whoever wrote the network start script, for not dealing with this situation properly or at least issuing a warning that the interface was not up.

Hopefully, I won't have to waste time solving this problem next time it occurs, if I remember that I already blogged about it. Perhaps it will save you some time too.

The Problem

I wanted to export all the data from WordPress using its native export mechanism (located at http://YOURBLOG/wp-admin/export.php), but since the blog I was working on was pretty large (6k posts, 120k comments), I kept getting XML files that ended prematurely and for which xmllint spit out this error:

Premature end of data in tag channel

Upon closer inspection, I saw the XML file ended with a random, yet always fully closed, </item> tag, but was missing the closing </channel> and </rss> tags, as well as a whole bunch of data.

My immediate theory was that PHP was running out of memory. It's also interesting that the number of <item> elements was always divisible by 20, but after looking at the code in export.php, I saw the loop grabbed 20 posts at a time. This revelation made it obvious that the code crashed while processing one of the batches, which only made the out-of-memory theory stronger.

The Solution

After raising the memory in the export.php file itself and verifying the fix, I came up with the following solution that removes the need to modify core WordPress files. Just add this somewhere in functions.php:

/** 
* Dynamically increase allowed memory limit for export. 
* 
*/ 
function my_export_wp() { 
  ini_set('memory_limit', '1024M'); 
} 
add_action('export_wp', 'my_export_wp');

The code above will dynamically set the memory limit high enough for all but unimaginably large jobs to complete. Feel free to adjust this limit if you have, for instance, millions of comments and lots of RAM on the web server.

And there you have it – full exports. Much better, isn't it?

P.S. Some shared hosting providers have PHP set to ignore the directive above, in which case this solution, or no other solution but upgrading your hosting, will do anything.

P.P.S. There is a bug (#15203) in WordPress <=3.3.1, which doesn't properly escape posts that contain CDATA and breaks XML. It is slated for a fix in WordPress 3.4, but if you haven't upgraded yet (it's not even out at the time of this writing), you can still apply the fix manually, like so. My dumps wouldn't validate before the fix, but I've confirmed that they now fully validate after.

Turns out there's an easy and undocumented (other than in code) solution. To block external HTTP requests right in WordPress's core itself, open up wp-config.php and add WP_HTTP_BLOCK_EXTERNAL like so:

define('WP_HTTP_BLOCK_EXTERNAL', true);

Whenever this variable is present, external requests will be ignored, unless you specify your own comma-separated whitelist of domains using WP_ACCESSIBLE_HOSTS like so:

define('WP_ACCESSIBLE_HOSTS', 'site1.com, site2.com');

You can examine relevant core code here and the relevant bug reports here and here.

Happy developing!

Then, Gmail arrived and exploded the whole notion of desktop email clients forever, almost overnight. It was fast, robust, logical, and integrated – many things Outlook still isn't to this day (Outlook 2010 + IMAP is pure hell).

Slowly, Google brought out more and more features that made the fine line between web and desktop emailing thinner and thinner, and today, it finally disappeared, at least for me.

The final nail in the coffin turned out to be something I'd desired for a very long time – taking screenshots and pasting them directly into Gmail in the browser window. Inline image pasting from the clipboard if you will.

I take a lot of screenshots of my desktop or certain parts of it when doing reviews or reporting bugs (with OneNote or SnagIt), and having to save the image, find it on the disk, and drop it into Gmail, while relatively easy, was still too cumbersome. In that regard, Outlook was great – I could quickly pump out a few screenshots and send off an email with all of them inline with text in only a few seconds. If I attempted to do that in Gmail, I either got nothing or a little image basically saying how full of fail I was.

It all changed with Firefox 4 (at least that's my theory) – I am now able to take screenshots and paste them straight into Gmail, right in the browser. Let's take a look:

Amazing, isn't it? This does not work for me in Chrome 12 or IE 9 – only Firefox 4 at the moment. I'm not sure how it works or why it started working only now, but I'm sure one of you will eventually come here and provide a sensible explanation.

Goodbye Outlook, I hardly knew ye.

P.S. I'm using Windows 7 in case it matters.

The problem I'm talking about today is trying to upgrade your Windows 7 installation to SP1 by applying Microsoft's update KB976932, called "Windows 7 Service Pack 1 for x64-based Systems" and getting nothing but a failure every time. The same problem may affect 32-bit systems as well, and I'm not sure what the update number for that would be, but the solution should work for either one.

The update starts just fine, chugs along for 10 minutes or so, then reboots the system and starts performing more operations, when suddenly one of them fails about 10% down the road, reboots, and reverts the whole process. You end up with this message (code 80070490) and a failure for which there are a lot of useless "solutions" on the web that just don't work.

Except for one. I can't take credit for it – all I did was spend a month weeding through the crap, retrying, and getting nowhere, until a genius by the name Ben-IS came up with exactly the right diagnosis and provided exactly the right solution. This solution, in my own interpretation, is below.

Step 1

We are going to use a utility called SFC (System File Checker or Windows Resource Checker), which is part of the Windows installation. It will help diagnose the problem.

Open up a command prompt (cmd) as administrator and run

sfc /scannow

This will run for a while and produce a file called CBS.log which you can find in %WINDIR%\Logs\CBS (usually C:\Windows\Logs\CBS). See this KB929833 for more info on SFC and CBS (Component Based Servicing).

sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Even though there are no integrity violations, we should have enough info in the log to diagnose the problem.

Step 2

Unfortunately, Windows overwrote my CBS.log, so I'll go by the one Ben-IS provided.

Open up CBS.log and look for something like Failed uninstalling driver updates or 0x80070490 – ERROR_NOT_FOUND.

If you have this line, which you should if you're reading this post, you should also see lines similar to these a few lines above:

2011-04-14 12:02:33, Info CBS Doqe: q-uninstall: Inf: usbvideo.inf, Ranking: 2, Device-Install: 0, Key: 598, Identity: usbvideo.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7600.16543, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS

2011-04-14 12:02:33, Info CBS Doqe: q-uninstall: Inf: sffdisk.inf, Ranking: 2, Device-Install: 0, Key: 599, Identity: sffdisk.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7600.16438, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS

2011-04-14 12:02:33, Info CBS Doqe: q-uninstall: Inf: sdbus.inf, Ranking: 2, Device-Install: 0, Key: 600, Identity: sdbus.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7600.16438, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS

One of these .inf files is the culprit, and we're going to find out which one in the next step.

Step 3

Now open up a different log file located at %WINDIR%\inf\setupapi.dev.log (normally c:\Windows\inf\setupapi.dev.log).

Look for a line that contains Failed to find driver update or FAILURE(0x00000490).

Note the exact path to the .inf file that failed. In my case, it was:

sto: Failed to find driver update 'C:\Windows\WinSxS\amd64_usbvideo.inf_31bf3856ad364e35_6.1.7600.16543_none_8a1a2513d42628c3\usbvideo.inf' in Driver Store. Error = 0x00000490

Step 4

This is the key to the whole operation. Open up the command prompt again (cmd) as administrator and run

pnputil -a INSERT_FILE_NAME_FROM_STEP_3

For example, I ran

pnputil -a C:\Windows\WinSxS\amd64_usbvideo.inf_31bf3856ad364e35_6.1.7600.16543_none_8a1a2513d42628c3\usbvideo.inf

You should see the following dialog:

Choose Install this driver software anyway.

The end result should be something like this:

pnputil -a C:\Windows\WinSxS\amd64_usbvideo.inf_31bf3856ad364e35_6.1.7600.16543_none_8a1a2513d42628c3\usbvideo.inf
Microsoft PnP Utility

Processing inf :            usbvideo.inf
Driver package added successfully.
Published name :            oem69.inf

Total attempted:              1
Number successfully imported: 1

Repeat this step for any failures found in step 3.

Step 5

Apply the SP1 Windows Update again – it should now install successfully.

And voila – enjoy your SP1!

Microsoft has failed to fix this incredibly cryptic problem, leaving it up to the users to figure out why their SP1 updates are not installing. Thanks to people like Ben-IS, solutions no longer involve head-banging, postal rage, and f7u12.

For example, my regular PHP memory allocation is 32MB or so, but if I load up Windows Live Writer, my favorite publishing tool, and ask it to load 1000 of the latest blog posts, I will undoubtedly get a server error back.

One solution would be to increase the memory allocated to PHP to something higher, like 256MB, which is how I used to get around the issue. I say "get around" because it's not a good solution – if someone finds a page that uses a lot of memory on your site, they could easily kill not only your web server but the whole machine due to swap death. Keeping a lower memory limit allows you to run your web server, such as Apache, with more children, thus serving more requests without getting overloaded.

So, I've looked into the WordPress core and came up with what I think is a proper fix – dynamic memory limit tweaking when dealing with XML-RPC only. Here is the code – add it to your functions.php and you should be golden:

/**
* Dynamically increase allowed memory limit for XML-RPC only.
*
* @param array $methods
* @return array
*/
function my_xmlrpc_methods($methods) {
  ini_set('memory_limit', '256M');
  return $methods;
}
add_action('xmlrpc_methods', 'my_xmlrpc_methods');

The code is pretty self-explanatory: it hooks into a WordPress hook that fires only for XML-RPC requests and adjusts the memory limit on the fly. No more out of memory errors and I'm able to load 1000 posts in Windows Live Writer without problems. If you want to load more, and PHP still crashes, try to raise this limit, but be careful not to send the server into swap death spiral.

One glaring omission in the way shortcodes are set up by default is that they only get triggered in the content of your post, leaving the sidebar and comments out. I'm sure this is done for security, so that your readers can't screw something up by posting shortcodes they're not supposed to – after all, shortcodes are PHP snippets on the backend.

However, let's assume you really know what you're doing and you want, for example, to allow certain shortcodes in the comments and all shortcodes in the sidebar. It's your site and you should be able to do whatever you want with it. For instance, I wanted to provide a way to include QR codes using a [qr] shortcode syntax that I'd written both in the sidebar and in the comments, except in the comments that was the only shortcode I wanted to allow my readers to use.

Since these cases can get complicated, let's start simple and then progressively get deeper.

Allow all shortcodes in the sidebar

Assuming you want to enable shortcodes in the PHP Code Widget widgets (I believe this is the most common way to add PHP support to the sidebar), use this code:

add_filter('widget_execphp', 'do_shortcode');

If you have some other widgets in mind, you have to find out the right filter and use it just like above.

Allow only whitelisted shortcodes in the comments

Since I don't want all shortcodes to fire here, things get slightly trickier.

function init_common_shortcodes() {
  add_shortcode('qr', 'my_shortcode_qr');
}

function init_comment_shortcodes() {
  remove_all_shortcodes();
  init_common_shortcodes();
  add_filter('comment_text', 'do_shortcode');
}

init_common_shortcodes();
add_filter('comments_template', 'init_comment_shortcodes');

The code above will remove all shortcodes when it gets to comments and reinitialize only the whitelisted one called "[qr]", which is exactly what I wanted.

Allow all shortcodes in the sidebar AND only whitelisted ones in the comments

At this point, things get slightly tricky because if I combine the previous 2 solutions into 1, by the time WordPress gets to the sidebar, it'll be left without any shortcodes at all – they've been removed by the code dealing with comments. Therefore, I need to save the shortcodes before dealing with comments and then restore them after the comments and before the sidebar.

function my_remove_all_shortcodes() {
  global $shortcode_tags;
  global $temp_shortcode_tags;
  $temp_shortcode_tags = $shortcode_tags;
  remove_all_shortcodes();
}

function my_restore_all_shortcodes() {
  global $shortcode_tags;
  global $temp_shortcode_tags;
  if(!empty($temp_shortcode_tags)) {
    $shortcode_tags = $temp_shortcode_tags;
  }
}

function init_common_shortcodes() {
  add_shortcode('qr', 'my_shortcode_qr');
}

function init_comment_shortcodes() {
  my_remove_all_shortcodes();
  init_common_shortcodes();
  add_filter('comment_text', 'do_shortcode');
}

add_filter('comments_template', 'init_comment_shortcodes');
add_filter('dynamic_sidebar', 'my_restore_all_shortcodes');
add_filter('widget_execphp', 'do_shortcode');
init_common_shortcodes();

Here is what the code does:

1. Initialize custom shortcodes that I want to add all over the place.
2. When WP gets to the comment block, it removes all shortcodes (again, for security) and re-initializes only the ones I want, but this time remembers them so that they can be restored later.
3. After the comments, when WP gets to the dynamic sidebar, it restores all the shortcodes and applies them to each PHP Code Widget.

And there you have it. Of course, the code may need tweaking for your own scenario but the ideas are all there. If you spot an error or know of an easier/better way, please let me know.

One of the biggest problems with Eclipse is that there is no clear upgrade path from major versions, for example 3.5->3.6. What I ended up having to do for years is back up the old release, download and unpack the new release, and then try to migrate all the settings by importing and exporting left and right. Not so pleasant.

Turns out, as of Eclipse 3.3 (though I've only tried it with Eclipse 3.5), it's possible to successfully complete an in-place upgrade without doing any wiping or voodoo hackery. I've successfully completed this on 2 of my machines and now need to share it with the rest of the world.

Step 1. Go to Help > Install New Software… > Available Software Sites or Windows > Preferences > Install/Update > Available Software Sites. I personally prefer the former way because it results in fewer clicks but both end up in the same place.

Step 2. Everywhere you see 3.5, press Edit and change it to 3.6. Similarly, change "galileo" to "helios". For example, you should end up with at least these (if you don't have these, just add them):

http://download.eclipse.org/eclipse/updates/3.6

http://download.eclipse.org/releases/helios

Note: you may also need to update other repositories (for example, Galileo was compatible with CDT 6, while Helios needed CDT 7).

Step 3. Press OK, then go to Help > Check for Updates. You should see the progress in the Progress tab – let the magic happen, restart when prompted, and after a few minutes, you should have a working upgraded version of Eclipse.

curl -IL "URL"

This command would send a HEAD request (-I), follow through all redirects (-L), and display some useful information in the end. Most of the time it's ideal:

curl -IL "http://www.google.com"

HTTP/1.1 200 OK
Date: Fri, 11 Jun 2010 03:58:55 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
Server: gws
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked

However, the server I was curling didn't support HEAD requests explicitly. Additionally, I was really only interested in HTTP status codes and not in the rest of the output. This means I would have to change my strategy and issue GET requests, ignoring HTML output completely.

Curl manual to the rescue. A few minutes later, I came up with the following, which served my needs perfectly:

curl -sL -w "%{http_code} %{url_effective}\\n" "URL" -o /dev/null

Here is a sample of what comes out:

curl -sL -w "%{http_code} %{url_effective}\\n" "http://www.amazon.com/dp/B0015T963C/?tag=beepla-20" -o /dev/null

200 http://www.amazon.com/dp/B0015T963C/?tag=beepla-20

Here, -s silences curl's progress output, -L follows all redirects as before, -w prints the report using a custom format, and -o redirects curl's HTML output to /dev/null.

Here are the other special variables available in case you want to customize the output some more:

• url_effective
• http_code
• http_connect
• time_total
• time_namelookup
• time_connect
• time_pretransfer
• time_redirect
• time_starttransfer
• size_download
• size_upload
• size_header
• size_request
• speed_download
• speed_upload
• content_type
• num_connects
• num_redirects
• ftp_entry_path

Is there a better way to do this with curl? Perhaps, but this way offers the most flexibility, as I am in control of all the formatting.

Introduction

If your WordPress comment counts got messed up, whether because of a plugin (I'm talking about you, DISQUS) or you messed with your database manually and did something wrong (yup, that's what I just did), fear not – I have a solution for you.

But first, a little background.

Comment Counts In WordPress

Here's how comment counts work in WP:

• Posts live in a table called wp_posts and each has an ID.
• Comments reside in a table called wp_comments, each referring to an ID in wp_posts.
• However, to make queries faster, the comment count is also cached in the wp_posts table, rather than getting calculated on every page load.
  If this count ever gets out of sync with the actual number of comments for some reason, WordPress, while still displaying all comments properly, will simply show the wrong count.

How To Find Out Which Posts Are Out Of Sync

Fire up a MySQL shell or your favorite MySQL software (mine is Navicat) and run this query.

It assumes your database is called wordpress and the prefix is wp_, so adjust those accordingly.

SELECT wpp.id, wpp.post_title, wpp.comment_count, wpc.cnt
FROM wordpress.wp_posts wpp
LEFT JOIN
(SELECT comment_post_id AS c_post_id, count(*) AS cnt FROM wordpress.wp_comments
 WHERE comment_approved = 1 GROUP BY comment_post_id) wpc
ON wpp.id=wpc.c_post_id
WHERE wpp.post_type IN ('post', 'page')
      AND (wpp.comment_count!=wpc.cnt OR (wpp.comment_count != 0 AND wpc.cnt IS NULL));

The result of this query is a list of posts whose comment_counts differ from the actual number of comments associated with each of them.

The left count is the cached number, while the right one is the right one.

How To Fix The Counts Automatically

The following query will recalculate and fix the comment counts for all posts that are out of sync (ones we just queried for above):

UPDATE wordpress.wp_posts wpp
LEFT JOIN
(SELECT comment_post_id AS c_post_id, count(*) AS cnt FROM wordpress.wp_comments
 WHERE comment_approved = 1 GROUP BY comment_post_id) wpc
ON wpp.id=wpc.c_post_id
SET wpp.comment_count=wpc.cnt
WHERE wpp.post_type IN ('post', 'page')
      AND (wpp.comment_count!=wpc.cnt OR (wpp.comment_count != 0 AND wpc.cnt IS NULL));

I tested this approach on a few test cases but if you experience any problems, please do alert me in the comments and desribe your problem.

Happy WP hacking!

• how to display hidden local directories and files and
• how to display hidden FTP directories and files

Really, Total Commander should just control this setting in one place but, unfortunately, it is not the case.

I usually prefer when my file manager shows me everything I have, so that I can be more in control and see the hidden directories, such as .svn or $Recycle.Bin, and files, such as .bashrc or pagefile.sys.

How To Display Hidden Local Directories And Files

• go to Configuration -> Options… -> Display
• put a check next to the "Show hidden/system files (for experts only)"

How To Display Hidden FTP Directories And Files

This one is a bit trickier – you would think the same option as above controls this, and you would be wrong.

Furthermore, you would think that it's an option in the FTP manager (Ctrl-F), and you would be wrong again.

Here is how to do it:

• connect to the FTP server you need
• select Net -> FTP Show Hidden Files

Weird choice for an option, isn't it?

Apparently, at least as of Total Commander 7.50a, this option persists while Total Commander is running but it is not saved when you restart it.

If you use a VPN (Virtual Private Network), this tip is for you.

The Problem

• you connect to a VPN to get access to your work/whatever network
• your connection is fast but the VPN connection is balls slow
• you try to stream a bit of online radio, go to a website, watch a video, or do anything, which is automatically routed through the VPN connection but everything TAKES AGES because the VPN connection is the limiting factor
• so not only are you frustrated by hiccupping radio, stuttering video, and a never disappearing progress bar but you're also making your already slow link slower, so now remote desktop and other activity for which you've VPN'ed in the first place is taking even longer

Familiar situation? You bet.

The Solution

This solution is for Windows users only but I'm sure similar settings are available in MacOS, Linux, etc.

Here in particular I am using Windows 7 but this solution applies to Windows XP and Vista as well (the menus look only slightly different for those).

1. Open up the VPN Connection's Properties

These properties can be reached by right clicking on the VPN connection in the list of networks and selecting Properties.

2. Go to the TCP Properties

On Windows XP, you might see only the "Internet Protocol (TCP/IP)", while on Windows 7 you will see both IPv4 and IPv6. You will most likely need to select IPv4 then.

3. Head to the Advanced settings

4. Uncheck the "Use default gateway on remote network" checkbox

5. Restart the VPN connection

This should do the trick.

The New Behavior

The new behavior from what I can tell is:

• use a local connection, such as your WiFi or wired connection, so your radio, streaming video, websites, etc should now bypass the VPN connection
• if the request above fails, Windows should only then fall back on the VPN connection

When Not To Use This Tweak

Do not use this tweak if you rely on the VPN to always encrypt all your network traffic.

Temporarily disable this tweak if normally you are OK with not encrypting all of your traffic but are currently using an unsecure network. Examples include a WiFi connection that does not prompt for a password or a public network, such as an Internet cafe.

Enjoy your faster VPN experience!

And then I found it:

Right click here and Save As to download the 1920×1200 version

And that's how you set up your iMac people.

Credit goes to Jonzy from DeviantArt.

Everyone who uses SVN knows that most repositories are set up to allow viewing of their contents via a web browser. For example, here's the trunk of WP Plugins SVN: http://plugins.svn.wordpress.org/ and here is the current trunk version of a specific file, let's say http://plugins.svn.wordpress.org/stats/trunk/readme.txt.

The Problem

However, what if you wanted to view a specific revision of a file or directory in your browser?

Let's say I wanted revision 100,000 of http://plugins.svn.wordpress.org/stats/trunk/readme.txt

Normally, on a command line, you'd do something like

svn co http://plugins.svn.wordpress.org/stats/trunk/readme.txt stats
cd stats;
svn up -r100000 readme.txt

or simply

svn export -r100000 http://plugins.svn.wordpress.org/stats/trunk/readme.txt

However, how would you do this in your browser? Trying something like ?r=100000 or ?revision=100000 parameters doesn't work.

The Solution

Here is the syntax to get a specific revision of a file or directory:

1. Take the root of the repository (in our case, http://plugins.svn.wordpress.org)
2. Append this string !svn/bc/REVISION_NUMBER right after the repository root and before the directory or file path.

Going back to our example:

• http://plugins.svn.wordpress.org/!svn/bc/100000/stats/

  shows the stats directory exactly as it was at revision 100,000 and

• http://plugins.svn.wordpress.org/!svn/bc/100000/stats/trunk/readme.txt

  shows our readme.txt at 100,000.

And that's how you do it, folks. Happy revisioning!

Update: this post is now sponsored by Wirefly Learn where you can find cell phone news and reviews, as well as comparisons and videos.

In this review I'm going to take a look at a pair of 2010 thirtytwo Focus Boa snowboard boots that I picked up a few weeks ago, after spending a day demoing them in the snow at a resort in Tahoe.

Even though I am an avid snowboarder (I try to go to the snow almost every weekend during the winter), I haven't evaluated my gear in years. This season, however, I decided to take a look at my options with the snowboard boots.

The Upgrade

It was only after the shoelace on one of my 5 year old Salomon Dialogue boots snapped that I even considered checking out other boots. I was always *kind of* happy with the Dialogues but never really fully happy.

Here are some reasons you, like me, might not be happy with your boots:

• They were hard to get into and yet my foot would move around inside. They were comfortable to walk around in but little did I know that it was actually a sign of the wrong boot size – more on that later.
• The outer lace, which uses this seemingly pretty cool one-pull quicklace, would actually constantly loosen itself.
• The inner lace never really tightened well either.
• They're kind of ugly… Here, check my old ones out.

To cut the long story short, after trying on a few different models and weighing all positives and negatives, I selected the 2010 thirtytwo Focus Boas for my demo day. The next day, absolutely in love with them, I came back and bought a pair on the spot.

Main Highlights

Here are some highlights that make these boots top notch:

• Dual Zone Boa Lacing System
• Fully Heat Moldable Liner = Custom Fit Comfort
• Forward Lean
• Excellent Tongue Strap And Inner Lacing

Here's each one in detail:

Dual Zone Boa Lacing System

The Boa lacing system is what really sets these boots apart from most others, and anything I'd seen before.

Rather than having conventional laces that you need to tie, the Boa system consists of a dial and a metal cable. It is very simple.

You push on the dial to lock it and crank it clockwise to tighten the metal "lace".

When you want to loosen the grip, just pull on the dial and it instantly lets go and loosens the cable.

What this achieves is nothing short of amazing:

• The quickest way to lace up and unlace.
• Having this very durable cable instead of a soft lace makes it almost impossible to snap it (in an unlikely case that you do, there's a spare one in the box).
• It doesn't untie throughout the day.
• Small adjustments, such as tightening the lace, are very easy – I just have to turn the dial a few more clicks, which is possible to do while going down the hill.

Now, note that I mentioned a dual zone Boa. After the original Boa system came out, there were some complaints that it doesn't tie the cable evenly at the top and bottom – some people prefer to have a tighter fit at the bottom and a loser one at the top, for instance.

To address this issue, the 2010 Focus boots actually come with 2 dials and 2 sets of cables – one in the front and one on the side, controlling the top and bottom cables respectively.

I have to tell you – after using them 4 times this season, I am still excited about the Boa. I don't have to mess with my laces anymore, don't have to tighten them, and here's the most beautiful part: when I get down the hill, I unlace and walk around relaxed and comfortable (by pulling on the dials – takes 2 seconds). Then, when I'm back at the top of the lift, a few cranks and I'm back in business (6-10 seconds).

To summarize, the Boa cable system rocks.

Check it out in action in this quick video I shot:

Fully Heat Moldable Liner = Custom Fit Comfort

Another feature of these boots that makes them stand out is a fully heat moldable liner.

What this means is that you can essentially custom mold the inside of the boot to your foot.

It only needs to be done one time, when you buy the boots, and can be done at a local snowboard shop (it costs $10 at Tahoe Dave's, for example but is included for free if you buy the boots from them).

What sets the thirtytwo Focus boots apart from others is that most boots only contain a partially moldable liner. With the Focus, however, the whole liner can be molded.

In order to mold the liner, I had to put on special socks and wait till a special machine heats the boots up. After that, I had to put them on and stand around, flexing, for about 15 minutes. This ironed out all pressure points and eliminated any discomfort.

To summarize, the heat moldable liner is very comfortable and after molding fits your feet like a glove.

Forward Lean

The Focus boots are angled forward for more convenient riding.

At first it may feel a bit unnatural, until you realize that on the mountain most of the time you ride bending your knees a bit and this forward lean is actually much more comfortable than the plain L shape of your old boots.

In fact, because of the Boa system that allows you to quickly unlace when you walk around, this extra lean never bothers me.

Excellent Tongue Strap And Inner Lacing

The inner lacing system is excellent – it locks in very easily, holds all day, and unlocks with a quick pull.

In order to make unlacing the inner lace easier, the thirtytwo folks added a loop to its bottom – pull on it and it relaxes the whole lace from the bottom. I found this very helpful at the end of the day.

There is also a strap going through the front of the tongue, which keeps it centered and snug with your leg.

A Note On Boot Size

I think the biggest mistake you can make buying new snowboard boots is getting them in the wrong size. Therefore, I highly suggest you try the boots out before you buy.

If you get them too big, your foot will move around and you will not have enough control. What's worse is it will most likely cause pain all over your foot and lower leg as you try to steer with a loose boot.

Even worse, if you get it too small, you will probably be in pain by the time you get half way down the mountain.

It turns out my previous boots were a size and a half too big: 10.5. I didn't know what I was doing 5 years back and didn't have the right person helping me out, so I went "safe" with something I felt less constrained in.

With thirtytwo boots, just go with your regular size. I wear size 9 shoes, and the size 9 boot ended up being perfect. Another person confirms the same observation here.

What's In The Box

• boots
• an extra metal replacement cord (don't think I'll ever need it but nice to have just in case)
• a little tool for opening the cord mechanism
• a snowboarding poster
• a hamster (OK, maybe not)

Buy thirtytwo Focus Boas

I hope I helped influence your buying decision in one way or another and that you'll give these great boots a go.

They come in 2 different colors:

• Black/Silver – these are the ones I got
• Green/Black

Here are some places and direct links to purchasing the Focus Boa boots:

• your local snowboard store (I highly recommend Tahoe Dave's in Tahoe City) – these guys usually know what they're talking about and if they have the product on hand, you can try it out immediately
• Amazon.com
• Endless.com
• Zappos.com
• Backcountry.com
• Evogear.com
• SnowboardConnection.com
• ShorelineOfTahoe.com (though these seem to be an older model – 08 or 09)
• ValSurf
• VerticalUrge

Similar Boots With A Dual Zone Boa System

Here are some competitors with a similar dual zone boa system, if you want to check them out and compare to the Focus:

Gallery

[lg_folder folder='2010/2010.01.05 thirtytwo Focus Boa Snowboarding Boots']

BeTwittered is a simple and comfortable gadget that you can add to your site, such as your iGoogle homepage.

Since BeTwittered is just a bridge between you and Twitter, it has to first log you into your account. Here is where things go horribly, horribly wrong.

1. BeTwittered does not use SSL to secure requests to its servers

All authentication information is transmitted to BeTwittered servers in plain text and is easily sniffable by an attacker, both on your own network and outside of it. You can read more about SSL encryption here.

Since BeTwittered passes your Twitter username and password unencrypted as GET parameters, it may as well be serving them to potential attackers on a silver platter (note that passing this data in a POST request would change nothing, security-wise).

Here is an example request:

http://betwittered.com/api/?_=1265242511260&req=verify_credentials&username=foo&password=bar

Ugh…

2. BeTwittered stores your username and password in unencrypted cookies

Because BeTwittered tries to keep you logged into Twitter, it caches the username and password, unencrypted, inside browser cookies.

This means that an attacker needs to simply look at your cookies to steal this information. This can be done using these methods, among others:

• using an XSS vulnerability
• sniffing the network traffic
• walking up to your computer

3. Because BeTwittered passes your authentication information to its servers, it's already insecure

If someone gets access to BeTwittered servers, it's safe to assume at that time that all accounts are potentially compromised.

Smaller sites generally cannot dedicate appropriate resources to securing their servers, which can make breaching them easier for hackers. Even Twitter itself was hacked numerous times.

The Alternative Solution

oAuth

If the endpoint application supports oAuth (Twitter has for months), do us all a favor and use it. Please.

oAuth allows delegating authentication to Twitter itself and only giving the application easily revokable limited access.

If BeTwittered were using oAuth, the user would be redirected to Twitter, where he or she would login. Then, the user would be sent back to BeTwittered, but now bearing special tokens. Any requests to Twitter would then be accompanied by these tokens, which would be validated by Twitter every time they're used – all of this without ever passing your password around.

You can find a nice overview of the oAuth architecture here.

Otherwise

If the endpoint application doesn't support oAuth, then

• use SSL encryption (https)
• store the authentication information on the server side instead of the client side in a cookie. Instead, use the cookie to store some sort of an internal ID pointing to this server-side data. Alternatively, encrypt the username and password via a secure salted two-way hash and only then store the encrypted version in a cookie
• make sure to stay on top of securing your servers (and give your sysadmin a raise). It's a time-consuming commitment, please take it seriously

Conclusion

What other secure authentication technique or tips do you know about? Feel free to share in the comments.

Oh, and this goes without saying – stop using BeTwittered, at least until they implement a more secure login option. I've alerted the creators about the issue and also started these threads on HN and Reddit.

I did this just for fun and found most of the results funny, some hilarious, and some offensive and controversial.

However, all of them have a reason for being there – statistics. It's what people search for. The cream of the crop. Stereotypes, hilarities, it's all here.

If you can, please don't take them too close to heart. In fact, if you're a righteous conservative thinking of lecturing me, do me a favor and close this page now.

So here goes.

Why Are?..

"Why are canadians"

Afraid of the dark? – I didn't know that, thanks Google.

"Why are brazilian"

Agreed.

"Why are swedish"

Also agreed.

"Why are irish"

Heh.

"Why are palestinians"

"Why are israeli"

Another

And the women… true again.

"Why are mexican"

Ouch.

"Why are hawaiians"

I can think of a few reasons.

"Why are germans"

I can attest to the rude part.

"Why are italians"

We've all seen the movies.

"Why are japanese"

Have you seen a non-weird Japanese video?

"Why are chinese"

The truth is there somewhere.

"Why are russians"

Very observational.

"Why are koreans"

Starcraft – so true.

"Why are british"

This is hilarious.

"Why are spanish"

100% correct.

"Why are polish"

This one was frankly news to me. Poor Polish people.

"Why are indians"

Indians are afraid of dogs?

"Why are armenians"

I've never seen a non-hairy Armenian.

And something more generic, without comments.

"Why are white"

"Why are black"

"Why are asians"

And something more local.

"Why are new yorkers"

"Why are texans"

Of course I saved the best for last:

"Why are americans"

If you use the Recent Comments sidebar widget in your WordPress installation, it's possible that you want to customize this widget's style.

You will quickly find, however, that as soon as you add the widget to your sidebar, it injects the following inline, hardcoded CSS into the containing page (using !important to make things worse): 

<style type="text/css">.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}</style>

The code above comes from recent_comments_style() (found in wp-includes/default-widgets.php), which is in turn called by WP_Widget_Recent_Comments() in the same file (this is just an old-style PHP4 constructor – same as PHP5's __construct()), which is triggered when the Recent Comments widget is used:

add_action( 'wp_head', array(&$this, 'recent_comments_style') );

This leaves a bad taste in my mouth because:

• the style is automatically forced into any page that embeds the widget
• it uses !important to override any existing styles
• it cannot be configured from the widget
• this is a core WordPress widget and not some widget added by a random plugin. WordPress should not contain such bad practices.

After seeing this, I raised a new issue #11928 in the WordPress bug tracker but in the meantime, of course, I could go and hack the default-widgets.php core file to solve this problem. That, of course, would be a horrible thing to do – the next upgrade could wipe my changes or result in a conflict (if upgrading via svn). In general, one should never need to modify core files.

The Solution

Fortunately, there is a solution that doesn't involve modifying core files. Remember that we are talking about WordPress here, which gained its popularity due to the ease of customization.

Normally, we would just need to remove the recent_comments_style hook, which would prevent it from ever firing and injecting the CSS. In fact, somebody over at webstractions.com already took a crack at this approach with the following code, which may have worked for a while but doesn't anymore:

function remove_wp_widget_recent_comments_style() {
   if ( has_filter('wp_head', 'wp_widget_recent_comments_style') ) {
      remove_filter('wp_head', 'wp_widget_recent_comments_style' );
   }
}
add_filter( 'wp_head', 'remove_wp_widget_recent_comments_style', 1 );

This code doesn't work in the current version of WordPress because recent_comments_style() belongs to the WP_Widget_Recent_Comments class, and we need a tiny bit more effort to get through to the object of that class.

The following snippet, suggested by Andrew Nacin in a comment to the bug I opened up, does the job and works in WordPress 2.9.1:

add_action('widgets_init', 'my_remove_recent_comments_style');
function my_remove_recent_comments_style() {
	global $wp_widget_factory;
	remove_action('wp_head', array($wp_widget_factory->widgets['WP_Widget_Recent_Comments'], 'recent_comments_style'));
}

This code first gets access to the right object and then passes it to the remove_action() function, along with the right function name recent_comments_style. Stick it intoyour functions.php and it should do the trick.

And there you have it.

I'd like to pose this question to all WordPress developers – plugin, theme, as well as core ones:

How do you make your living?

And, for clarification, by this I mean: "what are your primary sources of income?"

Open Source

Open source is a beautiful concept but it often comes with a price tag or, rather, the inverse price tag: most of the time you are not being paid for your time (of course, there are exceptions, such as companies hiring dedicated open source developers and keeping them on their direct payroll).

Everyone has to make a living, however, and everyone has their ways.

Developers can benefit from such income sources as:

• advertising on their sites, fueled by boosted Alexa and Google PR ratings
• freelancing and consulting work directly related to their open source project
• presenting at developer conferences
• creating products based on the open source projects they're involved with, as the technologies should be very familiar to them

WordPress

Since I've always been interested in WordPress development, I feel connected to the WordPress community and would like to get some insight into the lives of WordPress developers.

Therefore, in addition to the main question, I have some follow-up questions:

• does Automattic pay WordPress core developers salary?
• are there many WordPress core developers working for Automattic full time, besides Matt?
• how about you, plugin and theme developers – are any of you successful enough that you can make a living off your plugins or themes?
• what are your secrets?

So in your responses, please state whether you're a core or plugin/theme developer, and answer the questions above that you can.

Of course, it goes without saying that any extra bits of advice would be welcomed as well.

Update: this post is now sponsored by Wirefly Learn, where you can find a ton of cell phone tutorials, comparisons, and videos.