Category Archives: WordPress

Akismet Stops Spam

Akismet, Spam, WordPress

Akismet is a new web service that stops comment and trackback spam. (Or at least tries really hard to.) The service is usable immediately as a WordPress plugin and the API could also be adapted for other systems.

I must say, this has been one of the more rewarding things I’ve worked on lately — when people tell you they’re able to spend more time with their family because they’re not spending 30 minutes a day dealing with spam it really puts things in perspective. If nothing else, I hope this makes blogging more joyful for at least one person.

Anyway, try it out, install it for a friend, link it on your blog. The more you use it the more effective it becomes. It’s a virtuous cycle that will hopefully curb the spam arms race.

Update: The reviews are starting to come in. Here’s some one with stats (from when the service was still in development).

AJAX and CSRF

WordPress, , ,

When working on some new AJAX features for bbPress and WordPress we’ve noticed that AJAX requests don’t seem to send HTTP_REFERER values. We check referrers as one level of protection against cross-site-scripting, or XSS, so when they’re not set we aren’t able to use that value. How are most people using AJAX protecting against XSS? It seems the same things we’re doing to make things easily accesible in a dynamic fashion are also opening new vectors for attack.

New WP.org Search

Open Source, Search, WordPress

At the last IRC meetup the WordPress community asked for better search that included both the forums and the Codex and was integrated with the look and feel of the rest of the site. When I did this before it was horribly slow and it involved several queries across several different programs and MySQL hosts to get the results from the wiki, the forums, the blog, and then splice them together somehow. Later we switched to a plain Google site-search but they didn’t like the HTML we used for the search form so we took it down. Well after the meeting I remembered Yahoo Developer Network which had some sort of API for their search with a much higher limit than Google’s.

I went to the site to see how much of a pain it would be so I could start properly procrastinating, but I was taken aback by how incredibly easy it was to get an application ID and start getting the results back as simple XML. I began hacking on it right then. It was about 5 minutes to set up a search form with URIs the way I wanted, 7 minutes to get the XML and parse it out, 5 minutes to write in some paging, and then about 20 minutes tweaking the search page to make it look a little better. The result is the new search.wordpress.org WordPress Search.

It still needs some more work. There seems to be a dupe problem, which is actually a problem with our site, not Yahoo Search. I’d like to tweak the results to highlight newer topics more, or at leats allow for a date-based weighting. Finally I think it would be nice to include some WP-related blogs like Blogging Pro and Weblog Tools Collection in the results. Most importantly we now have a clean URI structure and home for searches which is abstracted from any piece of software or particular service provider. Yahoo deserves major kudos for opening up their information in such a free way and making it so easy that it’s taken me longer to write this post than start using their API.

Pulse of Freedom

WordPress,

“The Pulse of Freedom is a site published by the protesters at Martyrs’ Square, Beirut, from a tent city.” This is an inspiring story: “A group of Web masters, graphic design artists, writers, and photographers stayed up all night for several nights in a row putting the Web site together.” They chose WordPress. “As far as I’m aware this is the first Web site of its kind anywhere in the world. The leaders of a democratic revolution are openly blogging about their experience from the center of the action.” Echoditto writes about their part in Blogging from Beirut. “I am writing this post from a tent city in the Martyrs’ Square in central Beirut, a place which is filled with the energy and excitement of a burgeoning democratic movement.” Hat tip: Mike Carvalho via email.

Back Online

WordPress

I called my sister last night to tell her about a present I found for her in the market and she interrupted me to say she saw my name show up in Google News a few times and started reading some of the articles. Before the phone card ran out she read me some headlines and my stomach sank. This is my first vacation and I almost didn’t even bring my laptop. (Luckily I talked myself into bringing it to do pictures.) I haven’t been on the internet since Monday and I obviously have a lot to catch up on. It was almost midnight when I found out and there was no access anywhere, so I woke up at 4:30 AM this morning to catch the first water bus to the airport and found some overpriced wifi, and here I am.

I have close to a thousand emails and countless blog posts and comments to go through, but I’ll try to synthesize everything and respond ASAP, I think it’s important because some people seem to be spinning things quite maliciously. If you have a specific question please send me an email and I’ll do my best to respond personally or on the blog, even if you’ve already decided I’m the scum of the earth.

WordPress and Dreamhost

WordPress

As has been reported many places, and sent to me in a dozen emails, Dreamhost have integrated support for installing and upgrading WordPress through their administration interface. For many this is not new, some systems like Fantastico have had support for auto-installing WP for a while now, but the interface was cluttered and WordPress was just one of several dozen miscellaneous scripts. What’s really interesting about this decision is their thought process, quoted from their newsletter:

Why didn’t we make it so you could just install Movable Type itself with one click instead? Somewhat because Movable Type is a commercial product, and they would require us to do some sort of weird registration for all our users with them in order to even install the free version. Also, WordPress doesn’t require “rebuilding” your blog every time you publish. Mostly though, installing WordPress was eleven times easier for us.

Tyler Brekko sent me screenshots from the entire installation process, including emails from the “Happy DreamHost WordPress Robot” and it’s kinda neat. They take advantage of a few structural decisions in WordPress and on wordpress.org to make the process very smooth. You can read a bit in their knowledge base. What surprised me the most was the sheer number of people who emailed me about this, DreamHost must have a ton of users. Here are some other posts around the web about this:

Thanks to everyone who wrote in about this!