Hi All – It’s been a long time since I’ve blogged… but certainly plenty been happening. I’m currently working in Papua New Guinea on an international assignment with my work – we’re working with the PNG LNG Project.

 As part of that international assignment, I’ve been required to train up some local staff to be IT Guru’s in their own right Along the way, given that these folks don’t have the kind of budget I’m used to administering, I’ve found myself needing to innovate a little. It’s been great. I am currently in the process of virtualizing a number of servers.

After a few dry gullies, I’ve settled on Citrix Xenserver – I like the fact that it’s linux based, which means that I can spend a bit of time at the CLI if I wish. I also like the fact that it offers ‘XenConvert‘, which you can run directly from the operating system you wish to convert and send it directly to a VM on a running xenserver – it’s cool

But – the application can be a little buggy.

Error: application has failed to start because its side-by-side configuration is incorrect

Recently, when trying to convert a running instance of Windows Server 2008 R2 (x64) across to xenserver, I got the rather non-descript error : “application has failed to start because its side-by-side configuration is incorrect“. The full error was:-

Microsoft.VC90.CRT,processorArchitecture=”amd64″,publicKeyToken=”1fc8b3b9a1e18e3b”,type=”win32″,version=”9.0.30729.4148″‘

After a little troubleshooting (including running xsxtrace), I managed to fix the problem.

If you’re having this problem, what you need to do is download and install the Microsoft Visual C++ 2008 Service Pack 1 Redistributable, then reboot your server.

I’m told that this problem also occurs with Windows Vista.

Hope this helps someone!

Cheers,

TheDuck

Hard Drives are proven performers – they’ve been around since 1956 – but they have a few limitations, mostly related to the fact that they have mechanical components:-

1. They fail – eventually, and usually catastrophically.
2. Their access speed is limited by the speed it takes the head to physically move across the platter and find the data you’re after – called ‘seek time’

One approach to overcome these limitations is called ‘RAID’ – or a Redundant Array of Inexpensive Disks (some folks argue that Inexpensive should be Independent, but I’ll beg to differ).

In this post, I’ll be investigating ways to speed up your computer – and I’ll be test driving RAID and the fastest available single drive solution (Western Digital Raptor) along the way – let’s fish out the facts from the hype.

What is RAID?

There are several flavors of RAID, but the major ones are RAID 0, RAID 1 and RAID 10.

RAID 0 addresses the second limitation – disk access speed – basically it spreads your data across various disks (usually two but can be more) in what is known as ‘stripes‘ – basically chunks of a file. These chunks are usually quite small (64K is typical). Basically what this does is theoretically at least double the speed to access a file – you have at least two hard drives sharing the load, and as we know, two heads are better than one J

RAID 1 addresses the first limitation – failure. RAID 1 ‘mirrors’ data. Basically, when you save a file on your hard drive, RAID 1 seamlessly saves a copy on a second hard drive behind the scenes. If one drive happens to croak, the second should still have a copy, so you don’t lose your data. It’s essentially an automatic backup, and adds redundancy to your system.

RAID 10 combines the best of both worlds – it both stripes and mirrors your data – so you have a backup as well as speed boost – but you need a minimum of four disks to implement a RAID 10 array, as opposed to two for the others.

RAID has been used for ages in servers – only recently with the advent of quite quick RAID chipsets (such as the intel ICH9R) on consumer grade motherboards has it really become an option for the home user.

Alternatives to RAID for fast disk access

One other thing that you can do to speed up disk access is to increase the speed of rotation of the hard drive. The standard for a 3.5″ disk these days is around 7200 RPM – but you can get 10,000 RPM drives from western digital, and they’re known by the trade-name ‘Raptor’

The Raptor’s offer around a 25% read speed increase over 7200RPM drives for non-fragmented data on account of the fact that they rotate faster.

So which is better? RAID or Raptor?

Well – that’s a difficult question, but I can talk about the theory. In theory, A RAID 0 or RAID 10 array should be better than a Raptor because they double (or more) the bandwidth from the drives – so essentially a 2 disk RAID array should (under perfect circumstances) perform with similar speed to what a 14,400 (2*7200RPM) drive would – a raw theoretical speed increase compared to the Raptor of 50%.

Of course this relies upon a number of suppositions:-

1. That the disks are the same size and density (the speed that the media rotates under the hard drive head decreases from the periphery of the hard drive as you reach the center – this is because of the principle of ‘tip speed’ – basically imagine you have a truck tire and a mini-moke tire next to each other. You roll each along the ground 1 revolution – which goes further? The truck tire of course – it has a larger circumference – the truck tire goes further per revolution than the mini tire – so, for a given RPM, the truck tire goes much further than the mini – it has a higher tip speed.
2. That the actual speed of the head is equal between both disks.
3. That there are no serious ‘bottlenecks’ in the RAID controller that limit data transfer speeds.

So let’s test this supposition.

Trial Setup

For the purposes of this trial, I took a normal desktop PC with a Gigabyte EP35C-DS3R motherboard (with intel ICH9R RAID Controller on board) with 2GB of RAM and a Q6600 Quad Core processor.

I first added a standard 7200RPM hard drive, and loaded it with windows XP – basically I didn’t want the hard drives slowed down by the OS at all, so I put it on a separate drive altogether.

I then consecutively tested each of the following as a ‘secondary’ drive:-

1. 1 x 10K RPM 150G SATA Hard Drive
2. 4 x 7.2K RPM 500G SATAII Samsung HD501LJ hard drives in RAID 10 (64kb stripe)
3. 2 x 7.2K RPM 500G SATAII Western Digital WD5000KS hard drives in RAID 0 (64kb stripe).

I then used a free utility called ‘HD Tune‘ to test the read speeds for each arrangement.

Results

In these results I’ll be talking about two things –

1. Access time (the average time it takes for the head to move across the platter and find the data we’re after)
2. Transfer Rate (the speed data is transferred in MB per second from the drive to the computer)

On the following graphs the access time is represented as a series of yellow dots, with the time on the right hand y axis.

The transfer rate is represented as a blue line, with values on the left-hand y axis.

The x axis shows the position of the head on the disk – 0% is the outside of the disk, 100% is the inside of the disk (remember, tip speed, and hence data transfer rate, decrease as we near the centre of the disk)

Test 1 – 10,000 RPM 150G Raptor.

Test 2 – 4 x 7200 RPM Samsung SpinPoint 500GB hard drives in RAID 10

Test 3 – 2 x 7200 RPM Western Digital 500GB hard drives in RAID 0

Results

In a Nutshell –

	Transfer Rate (GB/s)	Access Time (ms)
Raptor 10K	Max 90, Min 55	Max 17.5, min 2.5
RAID 10 (4 disks) Samsung HD501LJ	Max 150, Min 75	Max 25, Min 2.5
RAID 0 (2 disks) WD WD5000KS	Max 150, min 75	Max 25, Min 2.5

Access Time

The Raptor had a lower average access time across the platter than either of the RAID arrays – a good thing, BUT – there is a density difference between these drives.

If you consider that the RAID arrays are 1TB in size whereas the Raptor is 150GB in size, and look at the graphs for the RAID array you’ll see that the first 150GB of these drives (0 to 15% on the x axis) have very similar access times (probably due to the fact that the data density is higher in these drives) if not identical to the raptor.

This tells me that the heads are not as speedy on the WD and Samsung as on the raptor, but the greater data density on the high-tip speed periphery of these drives makes up for it.

Transfer Rate

The Raid Arrays comprehensively kicked the Raptors backside in sheer transfer speed – The average transfer speed was between 50 and 65% higher for a 2 disk 7200 RPM RAID Array than a Raptor Across the drive – which is in keeping with our theoretical calculations.

Additional Results –

• There was no noticeable decrease in read performance between the RAID 10 and RAID 0 Arrays.
  

Recommendations – Should I use a Raptor or a RAID array?

The lower seek times for the Raptor could be useful for quick access to fragmented data – the operating system for example. On the other hand, the seek speed of the RAID arrays were just as good as the Raptor around the first 150GB of the disk, with far superior transfer rates.

If you take into account the massive cost of the Raptor (a 150GB Raptor is around the same price as two 500GB Samsung Hard Drives) it’s almost a no-brainer – go the RAID – for the same coin you’ll have 4.5 times the storage space and a much faster system – provided your files are not tiny or highly fragmented.

If you’re worried about the reduced seek speeds of the RAID array, consider partitioning your drive and using the outside sectors of the disk to host your OS.

In my case, I have two setups now – both with the same processor.

In the first, I’m using a Raptor to host my OS and a RAID 0 Array to host my documents. In the second I’ve got an unpartitioned RAID 10 array with everything – operating system and files on the one RAID volume.

I’d have to say – the RAID 10 only volume boots slightly quicker and feels generally ‘snappier’ than the Raptor based system.

What I’d really like to test is a Raid of raptors J

All the best,

Matt

This first photo shows the place during the day..

Note the cool pink bouncy sitting ball above – very Googley – Jazz, my hound, loved it – happy to chase it around all day.

Alas, Jazz’s days of fun with the ball are now over.

Jazz doesn’t realise how sharp her fangs are, and she is currently lying on the remains of the pink ball mourning – this photo I took just now

If you’re from Google, and you have a tough, more dog friendly ball – I’d suggest you be totally Googley and send Jazz a new bouncy ball – the poor chook is very depressed, as you can see – Prozac anyone?

This photo shows my house after dark.. yes, it’s still small, regardless of the time of day That is a photo of my girlfriend, Claudia (Schiffer), on the wall, by the way

And.. of course, the computer desk.. here we have a lenovo T60 (lovely computer, donated by lenovo as support for my PhD, thanks Lenovo!) on the left, followed by my new E8200 based overclocked behemoth, and finally my Q6600 based quad core super-data-muncher GIS computer on the right. I wish I had three eyes.

And, naturally, everyone needs to wash – in keeping with the rest of the house, the bathroom is tiny.

Where is the toilet I hear you say – well, it’s actually in a seperate building.

This is very much a batch pad, folks – but after several years living in Asia / PNG it doesn’t worry me a bit – I actually like it – don’t ask me why – I just do.

Gets a bit chilly up here – the pot belly stove keeps me warm, adds ambience and heats my water.

And of course, the most important thing when you’ve locked yourself away to study and write a PhD – company.

Luckily Jazz, the alsation / kelpie cross, also serves as the garbage disposal unit;

Between Jazz and the pot-belly stove I don’t tend to generate much trash other than plastics – which is a good thing, as we don’t have a garbage collection up here – even though we’re only 15kms out of the centre of town.

And, naturally, if you’re wondering why I’ve moved out of town, this photo should explain it –

Apart from the fact that I get to play the music I love (alot of Paul Simon at the moment, I admit – right at the mo I’m hearing ‘spirit voices’ – love it) – I jog about 5 miles (round trip) down a big hill every morning and back – this is my reward at the end of the walk – I live right on the edge of a national park (forest) – see (or smell) koalas and kangaroos almost every morning, and end up HERE –

I’ve had a few folks up here tonight for house-warming – been very fun – actually, 3 Californians – Dave, my chef mate (naturalised Australian now) and two of his nephews from Mountain View.

Cheers and hope you are all well.
M

UPDATE:- Four hours later – not cuddling with the carcass anymore, but still within a few feet of ‘the-deed’ just-in-case – still desperately depressed, but beginning to figure that all these photos and pats must mean biccys are coming soon, I figure.

UPDATE 2 :- after 24 hours of witnessing a dog in deep depression, I caved and bought Jazz a new ball. She’s happy again now

I notice a few of my friends turning up on my mybloglog sidebar.. so.. just a shout out to a few.. John – fantastic to see your blog getting the traffic it deserves lately for some inspired commentary on what peeves us about the inadequacies of Google Webmaster feedback. Shambhavi, I’d love to hear how you’ve settled in since your big move.. possibly you’re visiting in the vain hope that I’ve updated my blog recently – alas no, I haven’t.. UNTIL NOW…

But.. in all fairness I have been genuinely really busy. I’ve completed the long and drawn out process of moving into my new house… And, as the title of this post would suggest, I’ve actually managed to get broadband internet working here – which is very satisfying indeed.

Once I’ve converted my new place from the current maze of boxes to something a bit more worthy of a few photographs, I will do a post about it.

It’s certainly a unique place and I think some of my non-Australian readers would be fascinated – it’s definitely a very ‘Aussie’ pad – we’ve got Kookaburras, Kangaroos, Wombats.. very relaxing.. it’s such an Aussie house that the first thing I bought was a BBQ – and I haven’t cooked inside even once in the four weeks since I started moving in (Sorry folks from the US, but we’ve had absolutely brilliant weather here – warm, tropical).

I’ve been travelling alot recently, but by far the most ‘important’ thing I have been doing is consulting to a company in the North of my state – developing yield maps that help sugarcane growers improve their productivity whilst simultaneously reducing their costs – the fabled ‘win-win’ solution. It’s something very interesting, and I’d like to blog about it here.. But… I need your help.

Does anybody know of any free or open source software that allows you to record your screen in real time as a video? I basically want to do an online ‘tutorial’ about my new ‘yield mapping’ sofware – I’ll be putting it on my business site (www.jaisaben.com) of course.

Your help would be appreciated!

Oh – one additional subscript – those of you that know me well will know that there has been a stressful sidetrack regarding a new lingerie product over the last little while – I spoke about the stress of that particular venture quite briefly on the website of  a friend a couple of months back.

I’m glad to say that this is now completely over and done with. We won the case – something I’d never like to go through ever again, but it’s given me some new and interesting insights into the challenges that entrepreneurial businesses and webmasters face – and those kind of insights are priceless.

I now feel quite qualified to advise folks about the legal side of webmastering – how to be ‘savvy’ about these issues and avoid destroying a great business with endless legal battles It’s an important lesson – your time should be spent building a business. Time in court is wasted time folks!

Cheers and all the best,

M

I’ve found a fantastic place about 25kms out of Brisbane, at a spot called Mount Nebo (quite near to where my parents live, actually). The rent is good, the view is FANTASTIC and it’s a rural area, so I’ll be able to get back to my roots and have a few chooks etc

One big problem – if you can believe it – here in Australia, only 25kms out of a major city I cannot get broadband internet. To understand why this is, consider that the telecommunications utility (Telstra, often perhaps aptly renamed Hellstra) in this country was until recently Government owned, and is now a publicly owned company – so now the mighty dollar rules the roost.

It strikes me as a bit odd that the government would privatise a company that provides a service every bit as important as other utilities like water, electricity etc, without imposing conditions – like, for instance, the need to provide that service to folks where the population density might not quite make it a rapid return on investment – that is, after all, the reason that we have government owned utilities in the first place.

Actually, these days broadband internet is probably a more important utility than water and electricity – if you’ve got no water, you can always collect it from your roof. If you’ve got no electricity, you can always probably pay for solar panels. If you’ve got no broadband – well, sorry mate – you’ve just got no broadband. Hard luck.

This has resulted in the issue becoming a hot political potato. In fact, one of the major election promises of the incoming Rudd Labor government was that they would ensure that the entire population of Australia would have 8Mbp/s internet connections within several years if they were elected.

To this, the current American CEO of Telstra, Sol Trujillo, rejected the Rudd Labor Government’s idea of Telstra and its competitors all forming a jointly owned ‘new’ broadband network (probably FTTN – fibre to the node) as being some form of ‘kumbaya, holding hands theory – we are only going to participate in things we own and control’.

I must admit I can see his logic – CEO’s are paid the big bucks to maximise shareholder value. Opening up your monopoly owned exchanges and infrastructure to competitors for ‘the common good’ doesn’t cut it in this modern world of capitalism.

On the other hand, Telstra also blissfully enjoys their monopoly.. they argue I can get broadband – their wireless (3G) offering – Next-G. Yep, it’s fantastic – a whopping top speed in the area of 512Kbps, and only the low low price of $US150 per month for a maximum of 3GB download capacity.

I can use 3GB in my sleep – just 10kms down the road I can get 50GB a month for $50 at 5Mbps… so.. broadband at 100 times the market rate and 10% of the market speed is really only for those that have too much money or too few brain cells.. so. no broadband for me – I’ll have to buy a carrier pidgeon instead.

Alternatively.. well I am a comms engineer so.. I have the technology. I might just see if I can’t find someone with ADSL broadband in the valley below and offer to pay their monthly fees if I can rig up a yagi from their property and longshot the internet over an 802.11g/n link. It might be not strictly legal, but avoiding not-strictly-legal conduct is probably the reason that they never privatised the police force as well…

M

When we’re faced with a situation where we have a large number of xy or lat long points in arcmap (for instance, when we’ve got a lot of yield monitor data) overlaid over the top of a polygon data set (for instance, block or paddock boundary shapefiles) in arcGis, what’s the best way to select only those paddocks (polygon shapefiles) which contain logged points?

Actually, it’s not too difficult. You have to use something called an ‘intersect’.

Select By Location in ArcGIS

Basically, in ArcGIS / ArcMap lingo, you’re selecting a feature (our block boundary polygons) that intercept or contain elements from another feature (our point data layer) – as shown below, with the selected features highlighted in cyan.

To achieve this type of select, you need to go to the select menu, and choose ‘select by location’ – which will take you to the ‘select by location’ dialogue – (you can click the thumbnail to view full size).

In the dialogue, first you need to select the data layer that contains the polygons / blocks / features you’d like to select (select features FROM the following layer) and from there you need to chose ‘intersect’ in the drop-down followed by your points layer in the ‘features from this layer’ box.

After some processing, this will select all blocks / polygons / features that contain your points of interest.

Exporting a Selection to a new Shapefile in ArcGIS

Of course, now you’ll probably wish to export the selected features to a new layer – that process is described here – ‘Creating Subset Datasets in ArcGIS’

Firstly, the E8200 processor itself uses the same socket (775) as Intel has been using for quite some time now, but as I’ve been using AMD 64 processors up until now (socket 939), I needed to get a new motherboard as well – I chose the Gigabyte P35C-DS3R motherbard.

Meh – what the heck – if you’re going to go all out, why not get the works – so I topped off my purchase with some Kingston HyperX PC8500 DDR2 RAM as well – which is rated to 1066MhZ.

Add to that a nice little RAID 0 array of 2*500Gb 7.2K rpm hard drives for my data, and 1 10K RPM 160Gb WD Raptor, and you’re starting to shape up as a very speedy system.

Recommended Overclocking Settings for the E8200

Ok – so, the E8200 is rated at 2.66 GHz out of the box. With a little trial and error, I’ve been able to get it stable at a pretty decent 3.92GHz with the stock standard cooler. Here are the settings I used –

• Ram Latency Settings – 5-5-5-10
• RAM:FSB Ratio 1:1 (so effectively the Ram is matched to the CPU speed, running at around 490MHz – well, actually, 980 because it’s DDR – double data rate)
• CPU Core voltage – 1.25 volts (this one was a suprise – many folks suggest you need to go as high as 1.5 – I didn’t)
• RAM Voltage – 2.2V
• CPU Clock 490MHz at the default multiplier of 8.

The system (on account of the low voltages) actually runs very cool – around 42 degrees Celsius (107 F) at idle, with a max temp of 62 degrees C (141 F) running Prime95, which is a CPU testing tool (amongst other things) – and that’s just using a stock CPU cooler with Arctic 5 heatsink compound.

Cool, in my mind, is good. If a processor runs cool, it’s usually a good sign that it is energy efficient – and it definitely means that less energy has to be spent keeping it cool which means lower electricity bills and a smaller environmental footprint – a good outcome all round.

So… contrary to the bad press I have heard elsewhere about the E8200 being not so overclockable, I’m absolutely stoked with these figures – but rumor has it that the E8400 and E8500 are getting prodigious numbers in the mid 4Ghz range, so they may be worthy of the additional investment, although the E8500 is a little overpriced for only an incremental increase.

For those of you interested – my particular CPU is the number 6 stepping – here’s a picture of the processor’s SuperPi numbers (just over 12 secs) –

Some Additional E8200 Overclocking Tips

1. To get very high CPU speeds like those noted above – YOU WILL NEED FAST RAM that can quite happily sit at ~ 960Mhz or above. A high quality DDR2 800Mhz stick MIGHT cut it, but I’d recommend going for a min of 1066MhZ RAM (PC8500), otherwise you’re going to find your overclock will be constrained to around 3.3Ghz.
2. A New RAM technology is currently emerging called DDR3 – It offers speeds in excess of 1066MHz, but it is horrendously expensive – consider getting a motherboard (like the gigabyte Gigabyte P35C-DS3R I chose) that can handle BOTH DDR2 and DDR3 memory – socket 775 is going to be around for a while, and you might want to use DDR3 in the future.
3. Don’t go overboard with the CPU voltage – some people are recommending as high as 1.5V, but I’ve found that past 1.3V you are mostly generating exponentially more heat for very little additional clock speed – it’s not worth it unless you’re nuts and like spending heaps of money on expensive cooling gear.

How did you go? Did you achieve the same speeds? Are you doing better with an E8400 or E8500? How much better? Got any questions? I’m really keen to hear from you – leave a comment below!

All the best –

doc

Ok – so a bit of an update – I’ve spent the last little while learning a new language (VB.NET). It’s been a nice challenge, as most of my programming to date has been non-object oriented stuff – command line interfaces or totally embedded solutions usually written in ANSI C.

I’ve been up in North Queensland helping a company up there develop yield maps for their Sugar Cane harvesters (actually, I helped design the equipment that sits on the harvesters and does the yield monitoring, as well). The process of taking the raw data off the harvesters and converting it into yield maps is a fairly long and drawn out one. Firstly you need to filter the data (something I had been doing in Excel) to remove erroneous positions and obvious outliers.

Secondly you need to convert the latitudes and longitudes from the yield monitor into eastings and northings (A degree of latitude isn’t the same distance at every position on the earth) so that you can project the data onto the local industry GIS system (the projection used is called the Geodatic Datum of Australia – GDA Zone 55) which was a bit of a mission – I had to convert a long and convuluted mathematical process (about three pages of equations) into a neat little visual basic function.

Thirdly you need to tie the data back to actual weights to obtain a calibration for each machine (had a hybrid Excel / Access database for that job) and fourthly you need to have a way to automagically recalibrate the harvester as the season progresses and the pressures that the yield monitor uses to monitor cane throughput start to change (mostly they go up – wear and tear on the harvester).

I was planning to teach my clients how to do this all manually, but, since I had a hankering to learn a new language and wanted to make life easier for them, I asked a famous Googler what object oriented language he would use. He suggested visual basic, which suited me fine because it turns out that it’s quite similar to C in many ways.

So.. now.. a month later I know a new language and have a great little humungous larger and more comprehensive than I ever imagined software package.

The package condenses what took me about 7 or 8 days to do using excel spreadsheets etc into an algorithm – essentially distilling it down into a 5 minute batch process. The danger is that it will look TOO easy and my clients won’t appreciate the effort that’s gone into it – but, meh, the satisfaction of a job well done was worth the extra effort.

Once the yield data has been processed by the software, it then connects into a GIS system which converts the point yields into a smooth surface – a yield map. The one I use alot is called ArcGIS, and it makes life rather easy. Specifically, it uses a function called ‘Inverse Distance Weighted (IDW) Interpolation’ to draw the map. Basically, for every recorded point from the datalogger, it looks at 8-12 other nearby points and uses them to ‘guess’ what the yield may be between the points – and hence comes up with a nice smooth yield map.

That process can take a long time – for a years worth of data for 23 harvesters in Australia the process of calculating the IDW maps took me about 3 days with my Opteron 165 based system – which leads me into my next post – about my new computer (feeling very Geeky here).

You can hear me cackling in the background a few times – having lived there in my early 20’s, I’m familiar with the particular bar they are singing about – a few lines stand out to me – “It took them more than 3 months just to realize – that the road to Surfers Paradise was bitumised” – it takes the piss and congratulates North Queenslander’s in one fell swoop… Why?

Funny because Surfer’s is the main ‘tourist attraction’ in Qld (but 1600 miles south of Cairns) – I think they’re basically saying that as far as the locals are concerned Cairns is the centre of the universe.. 

I also liked the line – ‘the ceiling fans rotate’ as the chorus – that’s so appropriate – so very North Queensland – time just drifts by, the slow, steady beat of the ceiling fan matches the rhythm of life in general up there – Cairns is not really known as a hectic place 

YouTube Link

Blix Krieg is a widgetized, Google adsense and Search Engine friendly version of Sebastian Schmieg’s original Blix theme.

Unlike the original Blix Theme, BlixKrieg is fully compatible with the newest version of WordPress. Blix Krieg can be installed as a drop in replacement for Blix if you are having problems with your Blix Based site after upgrading WordPress.

You can download the latest version of Blix Krieg HERE, and see the latest version at work on our Blixkrieg beta test page.

Problems that I have identified and corrected in this release include:-

Blix XSS (Cross Site Scripting) Vulnerability Corrected

XSS, or cross site scripting, is a technique that can be used by hackers to gain unauthorised access to a blog. In its most basic form, an XSS attack occurs when a hacker inserts executable code within an input form (for instance, when entering comments or doing a search) and it can be used (in the worst case scenario) to gain unauthorised access to your blog.

For the techophiles amongst you, this type of attack is described in the excellent paper by Gavin Zuchlinski, “The Anatomy of an XSS Attack“.

It recently came to my attention that this vulnerability exists in the original Blix theme, and had been inherited by Blix Krieg (and other Blix variants such as dark blix, the webble you blix theme, Blixed and Blix with adsense). In the case of blixkrieg, the extent of the vulnerability has been minor, but worth correcting nonetheless.

You can easily test for the vulnerability by typing <script>alert(‘xss’);</script> into the search bar of your version of blix, and pressing ‘go!’ – if you see a pop-up, you have the vulnerability.

The good news is that I’ve now made a few substantial changes to the theme to sanitize user input and completely remove the vulnerability.

Sidebar Icons Broken After Upgrade

Some users reported that the default Blix sidebar icons were broken after an upgrade to wordpress 2.3.1. I have corrected that problem in this release.

Cheers and all the best,

Matt