The WordPress dashboard, as secure as ever

ORDPRESS continues to be a secure and robust piece of Web-based software. Rumours, however, sometimes stand in its way. Below is one example among several, which have been ‘severe’ enough to trigger high-profile advisories. All the hoi polloi was, needless to mention, in vain.

It sometimes appears as though such rants are desperate attempt to stir up a hornet’s nest. WordPress has become a prime target due to its popularity and existence as Web-based software, making it more exposed to the factor of traffic en masse. Google have become a target for rumours, the reasons being very similar.

Apart from minor wishlist items or bugs, such as one that I recently filed, there are more pressing issues that need resolving and require open clarifications from the community. More latterly, a concern was raised over the visibility of WordPress plug-ins to all site visitors. My opinion on the matter was phrased therein (see full thread for context).

Directory listing, which in turn exposes plug-in names, is never being linked to. Thus, it will not be indexed by search engines and flawed plug-ins will not be easily discoverable.

You could trivially scan many blogs using a script in attempts to find vulnerabilities. PHP-Nuke, Advanced Guestbook and Coppermine are notorious in that respect.

All in all, getting a list of plug-ins may be a convenient way for learning the blog’s composition. If you target a particular vulnerability (due to third-party code), it gives the hacker no advantage. That, marke1, is why your argument and its ludicrous, overstated backing are void.

Backed by an ambitious contention, one Web site calls for the halt of Web privatisation.

You think the Internet will always be the great freewheeling information superhighway you’ve grown to love? Well, think again. Media giants want to privatize our Internet.

As one among several threats, consider Google Groups. Under the magnifying glass is accumulation of over 20 years worth of forums conversations (full names included). To make matters worse, consider the practice of appending “Copyright Google Groups” to each of these pages. Then comes the contribution (or lack therefore) from those who post from Google Groups without quoting, which merely leads to clutter in UseNet. It sometimes seems as though UseNet has evolved into ‘Google Chat’, which is worrisome.

Another matter to consider is charging for E-mail traffic, as means of crippling spam. It comes to show that corporations can instate and manipulate ‘Net politics’.

Beyond these facts, rumours are formed and echoed as regards a Google Web or even the newly-proposed ‘Chinese Web’. Then, of course, there is the issue of censorship, aimed to better suit the interest of governments– either through blocking of sites or filtering of search results.

The future of the Web looks not bright. Given present trends, the outlook is rather grim.

HE notion of community-driven decisions is not a foreign one. Voting is just one among many examples. The power of a broad audience should be ascribed to handling of large samples of data, thereby making cohesive — sometimes conflicting — and yet reasonable choices.

The ideas were embraced by Google (no other precedence I am aware of) to filtering of E-mail, albeit other anti-spam initiative and services like spamcop.net began to accumulate and share knowledge as regards origins of spam. In Google Mail, it is the users who help one another in discerning ham from spam. In the latter case, sharing of data (primarily blacklist) shapes the core of of the methodology.

The technique which involves blacklists can be rather powerful. SpamAssassin, for instance, which I happily use as a second gate for my E-mail accounts, has never yet marked genuine messages as spam (false positives). This comes as an astounding statistic. SpamAssassin processes close to 200 messages per day and has been activated for about a year. Worth mentioning is the fact that SpamAssassin is free and Open software.

The more interesting technique involves identification and flagging of spam by many individuals. Algorithms can be further extended to take advantage of machine learning approaches such boosting and support vector machines, which are excellent classifiers capable of generalising while retaining good specificity. Let us consider this a case where science meets industry (somewhat of a rarity).

More recently, such ideas were considered a possible cure to a Web 2.0 epidemic: comment spam. To recite, the key idea is one which involves collaborative spam flagging and assemblage of newly-acquired knowledge in a centralised database. The back end of this service remains obscure, for security purposes. The approach has been facing barriers and various problems such as knowledgebase/learner poisoning using training data which is bogus. This led to some doubts and skepticism in the past.

All in all, I am left wondering: what if Google Mail filters were extrapolated to the benefit of everyone? People already use Google Mail as a spam filter, peripherally, but they cannot contribute. The relationship is not truly reciprocal. Moreover, should such services ideally be handled and governed by one particular company? It boggles the mind. Proposition for adoption of the methods, then making them publicly available, is definitely worthwhile. The Akismet spam stopper, for instance, provides hooks for third-party software, which I think is a wonderful demonstration of communal spirit and openness.

A shot in the dark perhaps, but it would be nice to have the Akismet approach applied to E-mail as well (a la Google Mail). API‘s are merely analogous, but with subject lines and headers included, which helps further. Maybe it can outperform SpamAssassin some day? We shall wait and see how spam can be combatted — spam in its entirely, that is, as opposed to just E-mail.

Below lies a inspirational quote from James A. Michener.

The master in the art of living makes little distinction between his work and his play, his labor and his leisure, his mind and his body, his information and his recreation, his love and his religion. He hardly knows which is which. He simply pursues his vision of excellence at whatever he does, leaving others to decide whether he is working or playing. To him he’s always doing both.

I would argue that the intersection between work and play is a fuzzy one, for everyone. How does one define “work”? Is the chore of shopping considered “work”? And is not, what would be the argument? If an individual takes pleasure in a particular aspect of his/her job, can it not be perceived as “play”? Should play and work be determinded purely by the venue? What happens when all work-related factors are eliminated? Some of the more eccentric scientists in history neglected what did not appeal to their passions.

few moment ago I realised that our beloved dog Jenny does not appear anywhere on this site. How can this be? As Jenny is nearing the age of 15, I decided to post a picture of hers, pulled from September 27^th, 1992. It was extracted from the digitised photo albums archive, which I had acquired on my most recent home visit.

Click image for full size

I can vividly recall the day that we got Jenny as a puppy. I must have been 9 or 10 years old at the time.

According to a recent article from the BBC, there was collaboration involving the British Government and Microsoft — collaboration over getting the back door to Windows Vista.

In jeopardy: people’s privacy, on thier own workstation.

The controversy: encrypted filesystems made futile due the ability of governments to penetrate them. Government were said to be liaising with Microsoft, which could theoretically provide a ‘master key’. In turn, Microsoft denies any such claims.

Windows Vista won’t have a backdoor that could be used by police forces to get into encrypted files, Microsoft has stressed.

N the last 8 days of February, I may have set a new personal record. I composed nearly 400 posts, which had been sent to various newsgroups, especially technical ones. I am admittedly somewhat addicted at this stage. I merely try to catch up and keep up appearances as a regular reader and participant.

Below is my personal take on newsgroups and in particular UseNet:

• Newsgroups are suitable for like-minded people to support each other and contribute on-topic ideas
• Newsgroups are a place for pressing, on-topic news to be raised and openly discussed. The newsgroup has a chance of having impact on the parties (e.g. companies) involved and/or being discussed.
• In UseNet, content is made eternally public owing to (or put negatively — due to) newsgroup mirrors
• Key advice: always watch newsgroup post headers. Especially when reading high-traffic newsgroups, keep all headers in sight. Headers in newsgroups can help a great deal in discerning and predicting the poster’s behaviour and his/her chance of returning to the discussion. Such habits are less important for E-mail where most typically the sender is known, assuming good spam filters operate.

Related item: Newsgroups Statistics