I put my hands up in the air, I’d been running an old version of WordPress (2.2) … which I’ve been meaning to upgrade for a long time; but hey, I’ve bought a house, had a baby and build my business during that time! It’s not been at the top of my priories.?? So yes, I’m aware of the security holes/risks, etc.

Needless to say, WordPress 2.2 has an ugly security hole which allows hackers to remotely inject SQL statements into the database.?? I’d heard about this at the time, but thought I was covered because it relied on the hacker having a valid username/password (see the trac ticket). Well it seems they don’t!

Within a minute of receiving the new user registration email, I deleted the user account, changed our passwords and upgraded to WordPress 2.6 - which came with it’s own set of problems (i.e. all the category names disappeared).

Here are the details of the would-be hacker, so others know about him:

Username: sidon
E-mail: Dimka@hotmail.com

However the problem with FLV files is that they aren’t requested directly by the web-browser, but rather the Flash video player (a .swf file).?? This causes a problem for the .htacces rules as there is no HTTP_REFERER value to restrict against.

This is causing an unnecessary hit on Shane’s bandwidth costs… so he’s desperately looking for an answer.

Any ideas are most welcome. Thanks.

Update: It seems that a lot of people have this same problem… so I suggested to Shane to turn the situation around by using the hotlinking as an advert for his site.?? All his video clips are watermarked with the DVD House of Horrors logo.

I’m curious why the developers of the Flash video players don’t send a HTTP_REFERER value, but then again that’s also easy to spoof.

Usually I learn this stuff on the job, yet from most other developers I speak to - it’s all guess-work!

Any advice is much appreciated!

The new API introduces a user authentication protocol which for the first time allows applications to create user sessions, bringing both read and write services to web apps, desktop apps and mobile devices.

Take our new tagging API???s. Developers can both pull and apply tags to music content from any application on any platform now. The same goes for sharing ??? developers can build Last.fm sharing support into any app.

There are also new search, playlist, event and geo API???s being rolled out today, with lots more stuff planned in the coming weeks and months.

At first glance, I noticed that there were a couple of key features (to me) were missing - namely the “Get Similar Tracks” - the Last.fm staff reminded me that they are planning to roll out more features in the coming weeks and months! OK, okay… I’ll be more patient!

The new API feels and works like the Flickr API; with very similar convensions of the method/call names and authentication/token process.?? This isn’t a bad thing - just that I feel they should be leading the crowd, rather than following it.?? (The beta version of the upcoming Last.fm site is being critisised for being a “facebook clone”!)

Regardless of my negative comments, I’m actually a fan of the new API - being more structured and scalable.?? I’m considering writing a .NET wrapper library (C#) for it too!?? As I’ve got plans for a small iTunes/Last.fm playlist app, that would require it; (all open-source, of course).

Since the new API follows similar Flickr API convensions, it seems to make sense that I could/should base my Last.fm .NET wrapper on it’s Flickr counter-part…. Flickr.NET API.?? The library is developed in a decent way - deserializing XML objects into the appropriate classes.?? It feels a lot nicer to develop with, rather than messing around with XPath node selections!

Not sure when I’ll get the time to develop the library, as my contract work is as busy as ever!! Hopefully things will calm down in a couple of weeks!

Today is Firefox 3 Download Day! Mozilla are hoping to set a Guinness World Record for most software downloads in 24 hours.

At the time of writing, over 1.2 million people have pledged to download Firefox 3 on the Download Day!

This is a first attempt of this record, so there is no number to beat. But Mozilla want to outdo the number of Firefox 2 downloads on its launch day, which was 1.6 million! The aim is 5 million+!

Update: It’s official, Firefox 3 set a Guinness World Record for the most software downloads in 24 hours. Reaching 8,002,530 downloads! They even give me a certificate for taking part … feels like I’m back at primary school! so proud!)

I tested this on Firefox 2.0 and IE7 on Vista, and IE6 and Safari on XP - all fine, so far so good! When I ask my client to test the page on their Mac … it’s no good! The videos just wouldn’t load! Hmphf!

So does anyone know of a simple way of embedding a WMV video clip that works cross-browser/platform? Please let me know, I’d be very a happy developer!

Otherwise, I’m so close to using the beastly code that comes from the “Embedded Media HTML Generator” … help me please! ]]> http://blog.leekelleher.com/2008/06/09/how-to-best-embed-a-wmv-video-clip/ http://blog.leekelleher.com/2008/06/09/how-to-best-embed-a-wmv-video-clip/ Mon, 09 Jun 2008 07:56:11 +0000 /// <summary> /// Constructs a QueryString (string). /// Consider this method to be the opposite of "System.Web.HttpUtility.ParseQueryString" /// </summary> /// public static String ConstructQueryString(NameValueCollection parameters) { List<String> items = new List<String>(); foreach (String name in parameters) items.Add(String.Concat(name, "=", System.Web.HttpUtility.UrlEncode(parameters[name]))); return String.Join("&", items.ToArray()); }

Just in case you didn’t know about the System.Web.HttpUtility.ParseQueryString method, it’s a quick way of converting a query (key/value pairs) string back into a NameValueCollection.

Now you can add/remove the key/values to your hearts content!

Oh, yeah, remember to import the System.Collections.Specialized namespace too!

Since I was only following a few tweeters there wasn’t of a flow - so I added a couple more higher profile tweeters, like Jeff Atwood’s Coding Horror.

This morning Jeff tweeted:

I hate #region so much. DIE #REGION DIE!

I quite like #region in VS.NET, (it makes my code look/feel tidy). I was curious to why Jeff had a problem with it, so I tempted to reply to his tweet. But I stopped - thinking it was a bit of a fan-boy thing to do. Also I’m sure someone else would have asked the same question… which got me thinking how do you follow a conversation on Twitter?

I came across Summize (a search engine for Twitter) the other day, so tried that to see if anyone mentions #region or @codinghorror - which they do, but it’s a tad disjointed. I couldn’t follow a conversation.

So I turned to my old friend Google (how to follow conversations on twitter), and found Quotably!

Now I can follow the conversation: http://quotably.com/codinghorror/statuses/811735028

Quotably is powered by Summize, with some extra jiggery-pokery (and human intervention).

Whilst I was testing it out on ReadySteadyBook, I noticed that the only tagspace was “Blog.aspx“, which seemed a bit weird. When I found the same problem on other websites, such as Amazon (example here) where the tagspace was “ref=tag_dpp_cust_itdp_t“. I thought this was a bug, so I raised a ticket on Bugzilla.

… however, I was wrong! Michael Kaply (the Operator developer) pointed me towards the Tagspaces spec.

It seems that for a rel-tag to be recognised as a tagspace it needs to have a specific URI structure:

Tags are embedded in HTTP URIs in a well-defined manner so that the tag embedded in an HTTP URI can be mechanically extracted from that URI. Specifically, the last segment of the path portion of the URI (after the final “/” character) contains the tag value. For example, the URI: http://www.example.com/tags/foo contains the tag “foo”.

This causes an issue for me. On ReadySteadyBook, the site is built using ASP.NET (1.1) on a shared web hosting environment. This means that I have no control over how the web-server (IIS) handles the page requests. For legacy reasons, IIS is configured to only map URI that have ASP.NET extensions (e.g. .aspx, .ascx, .ashx, .asmx, etc) to handled by the .NET Framework. So any “fancy permalinks” that I want to use must have one of those extensions.

At present, an example of a tagspace on ReadySteadyBook is: http://www.readysteadybook.com/Blog.aspx?tag=poetry

(The “Blog.aspx” page is quite complex, it can take all sorts of parameter to filter out it’s content - hence my reason to use the querystring)

Even if I did pretty up the URI structure to not use the querystring, at most I could get it to this: http://www.readysteadybook.com/blog/tag/poetry.aspx

Unfortunately, that still wouldn’t pass the grade with the “Masters of the Microformats”! As the tag would be defined as “poetry.aspx“, rather than “poetry“. See my dilemma?

Should I keep the rel-tag attribute on my tag links? or remove them because it conflicts with the current version of the rel-tag specification? (For other issues with the rel-tag spec, go here.)

Alternatively, I could link them to an external tagspace, such as Technorati? <snarky>oooh, they’d like that wouldn’t they!?!</snarky> A list of external tagspaces can be found here.