Wordpress Howto: Add Previous and Next Post Links to Blog Pages

HowTo: add Previous and Next Post buttons to your Wordpress blog.

Here's a tip: Want people to view more than one page of your site?

Give them an easy way to do that.

This might seem blatantly obvious but you'd be surprised how many sites don't have simple "Next" and "Previous" links on all pages that should.

You probably don't even notice, you just leave when you're done reading that article, probably without bookmarking or subscribing either (hint hint). You can literally double your "average time on site" in about 10 minutes with this simple trick.

Why is this key? Well, if more people visit more pages, and spend more time on your site, you will rank better. Even better, they'll be presented multiple opportunities to buy things or sign up or whatever your goal is that visitors should be doing.

Fun fact: time visitors spend on your site is also called "engagement" and Facebook is way out in front as the worldwide leader for this metric. In other words people spend more time on Facebook than they do on Twitter, Google+, etc.

I also show you how to change the links to say whatever you want, including how to add the post title to next / previous links. This is not only good for users, but also great for blog SEO. All bloggers should consider doing it this way, as internal linking is very important for search visibility.

How to add Next / Previous links to Wordpress post pages

We're going to edit your theme's Single Post template which is usually the single.php file.

Note: I recommend making a backup of the site before attempting any changes. If you have cPanel this is as easy as clicking Backup from the main cPanel page (most hosts), or you can use various Wordpress plugins, or simply copy the files somewhere safe on your local computer (like C:\Backup or /backup) before you edit them. 

Let's get started:

In your Wordpress dashboard, click Appearance->Themes->Editor 

In the right sidebar, click single.php 

Find the line:

<?php comments_template ?>

Hint: if your file is large, search for (Ctrl+F) the text comments_template

Go to the line AFTER that line by placing the cursor after ?> and pressing Enter

(I usually press Enter 2 or 3 times to give myself some space)

Add this block of code on the next line:

<div>
<h3>
<span style="text-align: center;">Where next?</span></h3>
<span><?php previous_post_link(); ?></span> <span style="float: right;"><?php next_post_link();
?></span>
</div>

That should get you started - you can use it as is or add custom styles with a bit of CSS.

*Note if you have multiple or custom post types - for example "Recipes" or similar - you will also have to find the .php files that generate those pages and change the Next and Previous links there as well. In most cases they should have the word "single" in the file name, like singlerecipes.php. Add the code above in the same place (new line after comments_template ?>)

Customizing Previous and Next Post link

You can add options by calling next_post_link and previous_post_link with options (add inside of the parentheses):

next_post_link('format', 'link', 'in_same_cat', 'excluded_categories');

So for example, to only pull items from the same category, exclude category number 2, and to always use "Next->" and the post title in bold for the text of the link, you would use:

next_post_link('%link', 'Next-><strong>%link</strong>', TRUE, '2');

in place of next_post_link();

You can even use an image for the Next post link in Wordpress although I generally recommend text links for SEO (if you use images, make sure you generate alt tags).

Save the file (you've backed it up, right?) and refresh your site. You may need to press Ctrl+Shift+Delete in your browser to clear the cache or just press Ctrl+F5 to refresh the page. If you don't like it or you broke the site, don't panic, just restore the backed up file, site, database, or cPanel backup that you made before making the changes.

If you need help, Call a developer

Further Reading -> Wordpress Customization:

"Wordpress Howto: Add Previous and Next Post Links to Blog Pages" continued here...

10 Tips for Web Designers to Ensure Client Satisfaction

Maybe you're in the small percentage of web designers who has never had a problem client, always turns everything in on time, and has never run into issues during a project. For the rest of you, these 10 tips for web designers will make your lives easier, whether you are just starting out in this field (or still in school), or you're a veteran web design ninja.

1. Set realistic goals, expectations, and deadlines

This one is probably the hardest for most web designers. We all want to say "Yeah, I can do that, it'll be awesomely high-tech, and it'll be done tomorrow." but the harsh reality is we often have many projects going, things come up, servers go down, and life sometimes gets in the way of our work (as does Internet Explorer...)

To avoid unhappy clients, overestimate your deadlines, downplay your design and coding skills, and be honest when you run into problems or things aren't happening on schedule. In general, underpromise and overdeliver to make your clients happy. They'll like you more if that new website has extra bells and whistles than if you have to leave things out that were on the project plan (or worse, the whole project is delayed).

2. Keep your files organized

Web designers and developers tend to have a million files of a thousand different types - HTML documents, CSS stylesheets, Javascripts, PHP files, database descriptions, keyword lists, sales copy, images, Flash files, and so on - that are all easy to lose track of. Which version of that default.css is most current? Why did I make this change? Where the %&*$ did I download those product images to?

To avoid a whole lot of hair-pulling, make a "Projects" folder on your local drive (if you don't have one, do it now, otherwise you'll forget), and make a separate client folder for each of your projects. I tend to use the domain name without the extension (so, for www.absurdhuman.com I have an "absurdhuman" folder in my Projects directory) which makes it pretty easy to track everything. Inside that folder, I usually keep the following folders:

• info - a description of the project, relevant login information, client questionnaires with answers, contact info, and other information about the project. Scans of sketches, audio / video of client meetings, photos of whiteboard sessions, deployment checklists, proposals, and contracts (scan a signed copy!) can all go in here.


• mockups - I keep my .psd or .jpg mockups separate. Once a client approves a specific design I usually move the selected mockup to /working/ so I can refer to it easily.


• current - an up-to-date listing of the files deployed or ready to deploy, and nothing else. This is where minified Javascript and CSS, gzipped XML sitemaps, HTML with meta tags, and a current robots.txt file reside.


• working - a whole mess of html, css, scripts, versioned by date and annotated with recent changes. This is the folder I work in.


• backup - the most recent set of files I deem reasonable to keep a complete backup of


• marketing - keyword lists, sales copy, banners, etc.


• fromftp - I use this to download a backup of files before moving them to /working/ and working there. That way I can always revert to the last live site if I screw something up.


• downloads - Mostly things sent by clients, including /images/ (usually uncropped large images from a digital camera that I need to edit before moving to working/images). I also keep software packages for a project (such as a gzipped recent download of jQuery or osCommerce) here before editing and moving to /working/.


• testing - Sometimes I'll include this folder to try out major changes to a design before moving to /working/, this way I can also have /testing/layouts/abstract/ or /testing/jQuery/12082009/


• snippets - I often find or write cool snippets of code or text that I want to incorporate into a project, but I'm not sure how or that part of the project is not done yet. I'll put text files of sales copy, code snippets, and even lists of images I'd like to use in here before putting it together in the working folder.

Feel free to modify this directory structure to your own design and coding needs, but the above is what I use and it helps me keep track of all 30+ projects I'm usually working on. Inside /working/ and /current/ you'll find the usual directories css, images, and scripts, as well as the planned directory structure of the actual site, which varies by project.

3. Backup!

You'd think I wouldn't have to list this here, but I've heard horror stories of accidental changes and deletions, and I've met many designers who can't tell me when the last backup was made of their Projects folder (if they have one). Back it up daily to an external hard drive or secure online virtual backup drive. Also make backups before you make major changes. Always knowing that you can "undo" changes from the last 10 minutes, few hours, or few days if necessary provides job security and peace of mind for a web designer.

4. Contracts are important

Most web designers don't have an MBA or a law degree, but contracts are the most important part of a web designers repertoire. If you don't have a lawyer, get a contract template online and have a lawyer look over your modified version of it. A good web design contract will include a project plan, provisions for payment, clauses for what happens if the client doesn't pay, copyright transfer information, and a whole lot more. This is what protects your digital assets, so for your pocketbook's sake, get a solid web design contract and use it with all of your clients (even friends and friends-of-friends).

5. Listen to your clients

Yes, web designers do crazy cool things with code and images that most people just don't understand, or even care to. But that doesn't work both ways. You, as the designer, have to take an interest in your client's business, their objectives, and their ideas. It is not your website, you are simply a glorified copywriter as far as most clients are concerned. Your job is to make their ideas shine on the Internet and present their information in a way that their clients and visitors will understand. If you don't listen very carefully, and ask the right questions, you will very likely end up with a problem client.

Examples of good questions to ask a potential or existing client:

• Who buys / uses your product / service?


• Who will be updating the website? Are they technically savvy?


• Why do you want a website?


• What is the primary goal of your website?


• Do you want visitors from this city, this country, or all over the world?


• What languages do your clients/buyers/potential site visitors speak?


• Who are your biggest competitors? Do they have websites? Do you like any of them?


• Are there any specific features you would like your website to have?


• What colors do you like to see on other websites? What colors do you NOT want to see?

And many other similar questions. Take notes when they answer, do more research on your own based on their answers, then go back and ask some more questions. Only after that are you really ready to write a project plan and begin work on their new website - which will be exactly what they wanted if you listened carefully and asked enough questions.

6. Keep up with new technology

If technology advances quickly, the web is like a cheetah (or maybe more like a tasmanian devil) in a world of gazelles. Make it a part of your daily routine to check up on new technologies - Is that cool new software out of beta yet? Are there new versions of any of the libraries you usually use? What new web technology are people Twittering about?

Check up on your competitors - are they using CSS3 or HTML5 to enhance their sites, while you're stuck using transitional HTML4? How do they ensure their sites degrade nicely? Do they have any new tricks up their sleeves as far as animation, IE fixes, or backend programming (e.g. Ruby on Rails, Scala)? What did they add to their websites during recent updates?

Keep track of W3C standards and drafts - W3C compliance is one of your major web design goals, so go straight to the source and find out what you need to do now, and what you'll need to do in the future to make sure all of your websites are compliant.

7. Breathe

We all do it - you're on a code binge, so into your current project that before you know it, the sun's gone up and down twice, you haven't slept, you're out of coffee, and as you look over the last few hundred lines of code and text you wrote, you notice misspellings and mistakes everywhere.

Don't forget to take breaks during long design / code sessions, get some sleep regularly (ok, so sometimes a 15 minute walk has to suffice, but at least do that), and have someone else look over at least the text you've written before turning it over to a client.

Don't burn yourself out on a project - you are much more likely to make mistakes without ever noticing if you've been working for over 12 hours. If the deadline is tomorrow and you have to stay up all night to get it done, move the deadline and wake up early in the morning to work on the project. Trust me, the client will be happier with a well done website tomorrow than a website filled with poor grammar or bad code today.

8. Comment, comment, comment

In every language, including HTML and CSS, there is a semantic construct for adding comments to your code. It's there for a reason - please use comments liberally. Good comments are the difference between easily being able to re-design a site next year and having to start over from scratch. Add comments for things like: last modified, major changes, author, contact information, and description of this file at the beginning of each file. Then comment each section with what that section does, and add specific comments for anything that might not make sense to someone not familiar with your code (if you're not sure, comment it anyway).

9. If at first you don't succeed...

Don't get discouraged by failures, mistakes, or problem clients. Learn from your experiences, good and bad, and remember that there will always be other people and businesses who need websites. Every designer looks back at their early work and thinks "What was I doing?" - just know you will get better at design and dealing with clients with time, and keep doing what you do best. Someday you'll be able to hand-code fluid CSS layouts in your sleep. Until then, practice, practice, practice. Work on your own pet projects, build websites for friends, and go back to improve previous projects even if you never deploy your changes.

10. Have fun!

Design is fun, that's why we do what we do. None of us would deal with the crap we put up with if we didn't absolutely love making our clients happy, and showing off our cool designs and code. If design is not fun for you, try these tips and get organized. If you continue to experience frustration and just can't get ahead, take a few design classes or get a professional designer to mentor you for a while. Then build a few websites about subjects you are interested in for no other reason than to practice web design. If you're still not having fun, it may be time for a career change.

Happy designing!

Useful resources for web designers

Here is a list of websites, articles, and software packages I refer to and use regularly in my web design and development work:

• W3C Validator


• W3C CSS Validator


• Instant Domain Availability Checker


• The Ultimate Website Launch Checklist


• Freelance Web Design Contracts and Templates


• 15 Best Places for Designers to Get Free Stock Photos Online


• Tools of the trade: Web development frameworks that the pros use


• 50 Amazing jQuery Examples - Part 1


• 35 CSS-based Layouts That Look Awesome


• 10 Templates That Solve Problems for Web Developers


• 20+ Brand New and Incredibly Useful Wordpress Plugins


• CSS Pseudo-classes at W3Schools


• jQuery Javascript Library


• PHP 4 Applications PHP RAD Framework


• 17 Hours of Javascript from the Masters


• CSS Zen Garden


• Top 10 Most Usable Content Management Systems


• Develop AJAX Application like the Pros


• 30 Helpful Video Tutorials for Web Developers


• 80 AJAX Solutions for Professional Coding

Some more places to find useful SEO, web design, and web development resources:

• Mashable


• Smashing Magazine


• Tuts Plus


• Tutorialized


• IBM DeveloperWorks: Web Development


• W3 Schools Web Design Tutorials


• SEO Chat

My Twitter page often has more web design resource, so be sure to follow me to keep up with new web design tips and tutorials!

"10 Tips for Web Designers to Ensure Client Satisfaction" continued here...

7 Features of Usable Apps

We use many applications these days, often simultaneously. No more web browser and email client, now we have multiple browsers, chat clients, social media widgets and toolbars and icons in the system tray - web apps and desktop apps and things in between, all pinging and chatting and tweeting and chirping. What makes an application practical, fun, and easy to use? Here are 7 features of a usable application:

Application Usability Tips

1. Focus! What happens when you type the name of your favorite search engine into your address bar and press [Enter], then start typing? Input! Look at that! Put the first element on the page in focus to make your users happy. If you are developing a web application, here is a way to automatically put the first element in focus using jQuery.


2. Labels. Be clear about what you expect from users and what they are getting in return. Data alone is meaningless without context - be sure to provide enough information to use the data presented, and make it clear what everything visible means.


3. Icons. Don't assume your users know what the squiggly line with the hole in it means - use a standard set of icons, or at least explain what your icons do (use tooltips!).


4. Tooltips. Again, at least some of your users might not know what "Reverse Proxy Address" means, so take a few minutes to add meaningful tooltips that pop up on mouseover for all of your form labels, icons, and anything else that may be even slightly ambiguous.


5. Spacing. You may remember the days when all applications were presented as 80 (or 100) green characters on a black terminal. These days, your users may be using a screen size of a few inches or several feet, and you have hundreds of fonts to choose from. Keep the font readable, make sure elements are ordered and spaced in a logical manner, and keep the "eye flow" of the application in mind as you design to make your spacing user-friendly.


6. Colors. What is the very first thing you notice about an application, or even a website? You may think it's the layout or the banner, but go to a website with bad colors and I think you will see what I mean. Choose a "soft" set of default colors, and maybe offer some wilder templates or skins.


7. Choices. Users use applications to save time (whether they are successful is another story). Let them. I know this is tough, after all that thought about colors and spacing, but you have to let your users view their data how they choose. That means they can apply their favorite mauve/brown/khaki color scheme and make your pretty font so big it breaks your whole layout, then move all of the icons to the bottom right corner. Your application will not be "user-friendly" to all users, so let them change everything and avoid a lot of headaches down the road.

This is by no means an exhaustive list of application usability tips - and there are "recommended" features specific to web applications and desktop applications - but keeping these usability tips in mind as you design your next application will go a long way toward keeping your users happy!

"7 Features of Usable Apps" continued here...

5 Advanced Twitter Tips

I know, I should post more often - I've got requests for posts about RSS and some Twitter basics, but in true absurd human fashion, I will give you some juicy advanced Twitter tidbits (twidbits?) instead. If you need a basic overview of Twitter, please see Twitter Blog Marketing Tactics, leave a comment, or contact me directly. Please add your favorite advanced Twitter tips in the comments! Here are my top 5 Advanced Twitter Tips for Twitter Power Users, in no particular order:

• Be retweetable. The best ways to do this are: 1) say something funny and somewhat random (keep it related to your "primary topic"), or b) bring the news - tweet breaking articles within a few hours of them being posted to get lots of retweets! Tip: leave really good tweets up overnight - remember how your latest tweet is in nice big attention-getting font? Great place to leave a joke, quote, tip or link to your awesome product/service for 6-12 hours (if you can stay away from Twitter that long).


• Timing is everything. Morning in the US (or your local market) is a great time to Tweet, especially if you want people to act today. Based on some of my analytics, Twitter may be up to twice as "active" on weekends, so if you Tweet once a week, make it on Saturday.


• Pay attention to your following. Try to follow most of the people you expect (want) to be your customers. Note things like tone (casual/professional), "style" (lots of RT's? Do they recommend or buy other products? What attracts them to people/products/companies?), what time of day their tweets are the most dense (hint: check the difference in timestamps of the first and last posts on your home page - closer together = good time to engage your followers).


• Give stuff away, at the right time, to the right people. People are attracted to Twitter specials - try pre-releasing a product on Twitter, or giving a discount to your followers!


• When you @reply, make at least some of your @replies such that anyone will benefit. An @reply can be a powerful recommendation for a product or service - just remember to add a description (e.g. Don't just say "This will work", say "Robo2112 widget will help you add that spark you need to your website")


• DMs can help - or hurt - you significantly. DM's (and @replies) are the bread-and-butter of Twitter. Carefully crafted direct messages can create strong personal relationships and quickly convert a follower into a loyal follower, or even a paying client. I would recommend staying away from auto-DM's, at least until you are over, say, 100,000 followers. I do understand there is a point at which marketing this way makes sense, but while you have the ability to enjoy close reciprocal relationships with your most targeted followers, take that opportunity. Use the above tips to write powerful DM's that make your point in a concise and memorable way and you will be able to literally pick the clients you want to work with - a powerful edge in any industry!


• Last but not least, timing is everything (paying attention?). By now you should have a target market of several specific niches and some understanding of your followers' Twitter habits (twabits). When they are online - DM them, @reply them, follow the people they are chatting with (who are also online and should follow you back), and follow some of their followers. Hint: Twitter followers are listed in chronological order by when they followed that user (most recent first). The first page of users, especially for popular users in your target niches, should be online currently - follow them to get more targeted followers.

Disclaimer: None of these techniques are likely to get you tens of thousands of followers in 90 days or whatever it is everyone is DM-ing around lately, nor will they shoot you to the top of the Twitter celebrities. These 5 advanced Twitter techniques may, however, help you use Twitter within your overall marketing strategy as an effective tool to build a community of close-knit, engaged followers who may become your best clients!

Bonus - Cool Free Twitter Tools!

• Twitterator lets you follow a bunch of people at once


• TweetCube lets you share files (<10MB) on Twitter for free! Remember the "give stuff away" tip? Here you go...


• Twits Like Me helps you find people to follow who share some of your interests. Targeted marketing, and such.


• If that's not enough Mashable has a list of over 140 Twitter tools


• Last, there's the older Twitter Toolbox - some of these may no longer work, but there are still some good Twitter apps and tools there!

Happy Twittering and remember to Retweet!

UPDATE: Thanks to everyone tweeting this post!

@IgorFomichev @seanometer @MarjyMeechan @MonicaPortugfan @mabsmith @CodeSucker @zygbot @EdwinKersten @hsbcnews @julianpettit @TracyGazzard @twitme101 @AnthonyMcMurray @kdburnett @briankurtz @Marenda @foolsprogress @thewildjoker @Jan_Geronimo @fpalattao @mparent77772 @sillyaudrey @twitte_r_tips

Want to get even more Twitter followers? Just Tweet these 5 Twitter tips, and I will put your Twitter link on this page! Feel free to leave comments to remind me!

"5 Advanced Twitter Tips" continued here...

Toshiba Qosmio gets major upgrade: Quad-core laptop from Toshiba!

Update: There are less than 5 Quad-core Qosmio laptops remaining! Order today if you don't want to wait!

Click Here to Get Your Quad-Core Laptop Now!

My Toshiba Qosmio is an awesome, unbelievably powerful laptop. With a subwoofer. It might not be the only one out there, but this one also happens to leave most desktops, and even many servers in the dust as far as power. And I just found out Toshiba is sneaking in an upgraded version of my trusty Qosmio: They made a quad-core laptop! Sure it's not the first, but it's definitely the one that makes the most sense. The Qosmio line is the pinnacle of performance - I have the old Q701 and it's still better than most laptops released today. Except, of course, the quad-core Qosmio...

You can buy the quad-core Toshiba Qosmio X305-Q720 now!

Click Here to Order Toshiba Qosmio X305-Q720 17.0-Inch Laptop

Most Qosmio's have:

• 4 GB of DDR3 PC3-8500 (!) so I can have over 400 tabs in 40+ windows open (3 or 4 different browsers), while listening to music (on the subwoofer!), and the thing doesn't blink.


• Mostly because of the 7200rpm Hard Drive that opens my documents and even does the silly AutoSearches quick.


• 4 Speakers plus Subwoofer, Dolby Digital Surround Emulation that actually works!

The new Toshiba Qosmio X305-Q720 ups the ante by adding:

• 2.0 Ghz Core2 Quad 9000 CPU for those who think instant coffee isn't fast enough


• The GeForce 9800M GTS with 1GB GDDR3! HDMI output at 1080p.

It just blows me away that a laptop can do this. I thought I would have to immediately ditch Vista when I got this laptop, but I haven't had a single problem with it. Everything loads quickly, the search works, and yeah UAC is annoying but it's great for users who really don't know why they clicked there (and offers other protection), and most sysadmins know how to disable UAC on Vista anyway.

Everything about this laptop is great. The fact that it's very shiny is appealing, but the fact that the CD drive is in the front just makes sense, the amount of USB ports (5 USB + 1 eSATA) is impressive, the built-in multi-card reader is convenient, and the media strip is low profile and works well. The only negatives are the size and the fact that it only lasts about 2-3 hours on battery (pretty good for this much raw power). If you're looking at this laptop, you probably know this already. So just get it - do you really anticipate needing your laptop for more than an hour or two without a plug nearby? You won't find a better machine for games, system administration, CAD, or anything else for the price.

The two things that really surprised and impressed me about the Toshiba Qosmio were the lack of sound and heat. You see, when computers compute really fast, generally there are electronics wasting a lot of energy and outputting this as noise and heat; This computer runs nearly silent and runs much cooler than I expected, even when I do many things at once, which indicates some pretty serious attention to efficiency and stability. I honestly haven't gotten the thing to crash even though I probably should have.

Until somebody hands me a netbook with 2 Core i7's in it, this is the machine I will use to quickly navigate and process the vast seas of the Internet:

Get Your Toshiba Qosmio X305-Q720 17.0-Inch Laptop Now!

Not what you were looking for? Search here:

"Toshiba Qosmio gets major upgrade: Quad-core laptop from Toshiba!" continued here...

Will the Internet survive Conficker?

The Conficker worm - also known as Downandup, Kido, and Downup - has become a serious threat on the Internet in the last several months. Microsoft is offering a reward of $250,000 if you find the creator, and Internet security professionals have been scrambling to keep up. Conficker.A was pretty bad, then Conficker.B infected over 1 million computers in 24 hours. Now there is a third, even more robust version, called Conficker.C, which does not focus as much on spreading itself, but significantly increases the worm's hold on an infected system.

Here is what the Internet security community knows about what Conficker does and how it interacts:

• Conficker supposedly does not spread through downloading or email, but installs itself when you plug in a USB drive or insert a CD, and it can even hack your whole network using brute force password cracking (especially if you have weak passwords). So if one system on your network is missing security updates, all networked computers could be compromised.


• Conficker disables system services and antivirus, and adds services to listen for traffic.


• Conficker pings common sites to test for Internet connectivity, gets the date from search engines, and gets your IP address using online tools.


• Conficker can lockout accounts, change user settings, and send user information out over the Internet.


• Conficker.B and Conficker.C can also block access to Windows Updates, antivirus websites, and many removal tools


• Conficker has the ability to download new code and update itself.

Conficker's signature move is downloading updated code - not the first worm to do this, sure, but certainly the most effective so far. The worm randomly connects to one of several domains and tries to receive instructions. Conficker.B could connect to 32 domains out of a list of 500. Now we have Conficker.C that can connect to 500 random domains out of a list of millions. Conficker's download dates that I've seen referenced are March 8, March 13, March 18, and March 31. Supposedly, Conficker.C will initiate another attack sequence on April 1 - please ensure you are patched by that date.

Conficker Cleaning and Removal

Download the Microsoft patch at http://support.microsoft.com/kb/962007 and then do the steps here

Bitdefender has released a removal tool that can remove Conficker versions Conficker.A and Conficker.B, but may not remove Conficker.C. Download and run BitDefender's removal tool to check for and try to remove Conficker.

Symptoms of a machine or network infected with Conficker*:

*Please note you may be infected even if no symptoms appear.

• 1. You are unable to install Windows Updates


• 2. You are unable to view security websites or download antivirus and anti-malware products


• 3. It takes a long time to log in to your computer.


• 4. You see strange popups or programs running.


• 5. Unusual entries in Task Manager, Services, Event Viewer, %Windir%\System32, or the registry


• 6. Strange network traffic, especially relating to network logins by administrator accounts

Conficker may be a decoy?

In case the existence of this worm is not bad enough for sysadmins and IT professionals everywhere, some Internet security professionals think that this whole mess might just be a distraction for a much more serious attack. Until recently, most security professionals assumed that the end-game for Conficker was just another botnet - a network of computers under a hacker's control. However, “We think this is a wide-scale distraction to hide data breaches,” said Ryan Sherstobitoff, chief corporate evangelist for Panda Security. “It does not appear in the variants of Conficker that they are building a botnet, but that wouldn’t surprise us, either. This is an attack we have not seen in some time and is certainly a warning sign for something more to come.”

I agree that this is likely a distraction for a major Internet attack - think about the possibilities. It's April fool's day, they could even send out a link that says "This is a virus" to everyone's contact list and they would still get a bunch of clicks. Network admins would be slow to react to the flood of "server down" notices also. And your customers might not feel the need to let you know that your website now just displays Lolcats (and spreads malware).

Please get the word out about this problem - share this article (using ShareThis below), blog or write about this on your website, talk about it in forums, and tell your friends. Update Windows systems (or switch to Linux), update your Antivirus and anti-malware (you do have both, right?), use strong passwords, and read Internet security news sites regularly.

Links:

• Conficker Technical details from CA


• Conficker.B infected 1.1 million in 24 hours - Ars Technica


• Conficker download schedule - PC Mag


• Cleaning Conficker - Keeping Your Network Safe From Windows Worm


• Conficker attack April 1 - eWeek


• Not all tools remove all versions of Conficker - Heise.de
• Microsoft offers $250,000 to catch creator of Conficker


• Conficker update 2 - The Tech Herald


• Kaspersky and OpenDNS team up against Conficker

What do you think - will the Internet survive Conficker?

"Will the Internet survive Conficker?" continued here...

Internet Security: Are we losing to "Malware 2.0"?

Have you noticed an increase in Internet threats and "noise" lately? It seems like there has been a surge of malicious activity on the web in recent months. Since I wrote the post about the AdSense DoubleClick tracking cookie a few days ago, I have come across quite a bit of recent unusual activity related to malware and Internet security - the Google DoubleClick network itself has recently shown malware on multiple publisher sites.

Google responded by blocking the sites - not just the ads - and displaying a blatant "This site contains malware" warning to visitors. This decreases the publisher's reputation and costs the publisher time, money, and customers - but keeps Google looking like the hero that responded quickly to an outside threat...

A Google spokesman said: "Our scanners have found a few instances of these malware ads in the DoubleClick network. As such, we've added these domains to our malware list and are in the process of removing any offending ads from our ad network."
- From The Register - DoubleClick distributes malware (emphasis mine)

It seems to me that many recent hacks and threats exploit the things we all like about Web 2.0:

• it's connected
• it's fast
• it's everywhere
• it's personal, and
• it's always on

This is troublesome, because it is practically impossible to continuously monitor all of the data aggregated, repeated, mashed up, linked, regurgitated, and spewed into the massive expanse that is the Internet through new applications and websites by new people and robots every hour.

Here are just a few examples of recent web 2.0 threats and other Internet incidents:

• DoubleClick Distributes Malware
• There have been multiple Twitter security incidents
• The personal data of millions of jobseekers was compromised - including passwords - when Monster.com was hacked - for the second time
• BlogCatalog distributed malware (Please note, this may have been related to the DoubleClick incident
• Spotify, an online music service, was hacked, and may have distributed malware. Spotify user details were compromised in the hack
• The web site of the scientific journal, Nature, was hacked. User login credentials potentially exposed in nature.com breach

I think the scariest part is this:

"...no new malware variants introduced in the Top 10 for two consecutive months."
- Pro Security Zone, based on Fortinet threatscape report. Super-Worm emerges in Fortinet threatscape report for February

combined with this:

"BitDefender’s list of top threats for February dominated by the drive-by variant of malware activated during website visits"
- Pro Security, based on BitDefender's threat list: Auto-downloads dominate February threat list

Basically, in addition to the usual email, file, download, and popup malware you now must watch out for auto-download attacks and malware that "activates" when you visit a reputable site, look at AdSense or Doubleclick ads, Twitter, Facebook, or simply open your browser.

It might be time to slow down, Internet (especially Web 2.0). We are developing applications too fast. We are neglecting Internet security and online privacy to a point that it is getting difficult to tune out the Internet "background noise" and focus on productivity. We would rather give the users the fully connected always-logged-in remember-me target-my-ads ooh-thats-pretty just-tell-me-where-to-click Internet.

I think we should step back, re-examine user goals, and clean up the junk floating around in the World Wide Web.

How to (hopefully, maybe, sometimes) stop popups, trojans, worms, and other malware while surfing:

• Get a good virus scanner and spyware blocker
• Run full scans regularly
• Keep your operating system, browser, and all other programs up to date
• Turn your computer off regularly
• Never allow sites to keep you logged in, remember your password, or log you in to any other site
• Clean up your temporary files, and remove as many unused programs and links as possible
• Check your system files and folders, as well as running processes regularly. Know what should be there so you will quickly see when something is wrong
• Do not assume https is safe
• Avoid typing your Bank account, Routing, Credit Card, Driver License, Social Security Number, or any other "severly identifying" information into a text box, form, widget, email, chat, or any other application online or even on your computer as much as possible
• Use safe surfing browser extensions like AdBlock Plus for Firefox
• Observe symptoms and get help if your computer or browser does something suspicious or unusual
• Regularly check security sites such as those linked in this post for threats
• Use Scroogle to search
• Use Privacy Choice to opt out of all ad networks
• Clear your cache and cookies when you close your browser, and manually after you see ads
• Consider disabling cookies altogether, along with JavaScript and all popups.
• Block ads using your hosts file. Doing this sets the "location" of each ad network in the list to your local computer, so you will only see errors instead of ads from those providers, and never connect to them (note: some malware modifies the hosts file, circumventing this protection). This technique allows you to allow some ads if you choose. Here is a regularly updated ad-blocking hosts file in plain text. Try to avoid the ones that want you to download a .bat file or other executable. Your hosts file is usually in C:\Windows\System32\drivers\etc in Windows XP and has no extension. Back it up before changing or overwriting!
• In general, never ever ever download files with funny names, lots of special characters, and never run a program from the Internet
• Similarly, never ever pass things on to your whole contact list, reply to chain letters or forwarded mail, or click anything even slightly suspicious
• Most importantly, think before you click!

Links:
DoubleClick distributes malware
Pro Security Zone - How to clean Downandup
The Age - Twitter accounts hacked
Telegraph - Top recent hacker stories
TechWorld Internet Security
Daily cyber threats and internet security news alerts
Malware - Breaking Business and Technology News at silicon.com

Please add your thoughts, ideas, questions, or comments below.

"Internet Security: Are we losing to "Malware 2.0"?" continued here...

AdSense Privacy 2 - Google PopUp?

Related to AdSense Privacy? - Need New Ad Provider. I dug a bit more, and found the FAQ page for DoubleClick - the provider responsible for the new Google AdSense tracking cookies, and apparently also for 1 x 1 pixel image "tracking beacons". But are they really saying, essentially that Google AdSense may include popups?

This is from the DoubleClick FAQ (emphasis mine throughout):

"DoubleClick provides its ad-serving clients with a means of choosing and reporting on ads. It is the website owners or the advertisers with whom they contract that make the decisions about the format of the ads. The advertisers choose whether they want to have banner ads or pop ups delivered, and they use our technology to make it happen. The website owners and advertisers choose the size and frequency of pop-up ads. DoubleClick has no control over which ad format website publishers or their advertisers choose.

Generally, there are a couple of different ways that you might receive pop up advertising:

• 1. The site you are currently visiting has sold an advertising opportunity to a marketer and that marketer has chosen to create an advertisement that opens a new browser window. This is a form of “traditional” Internet advertising.


• 2. You have some kind of ad-delivery software installed (intentionally or unintentionally, knowingly or unknowingly) on your computer. This type of software often comes bundled with freeware such as P2P (Peer-to-Peer) music sharing applications. It may track the sites you visit and scan their contents looking for triggers that match criteria identified by advertisers that purchased space from the software manufacturer. The software program will then display advertisements on your monitor."

...Ok, so AdSense will be: tracking users across all sites using a 'perma-cookie'; targeting ads based on what the user saw before your site, not what is on your site; requires you as the publisher to maintain a compliant privacy policy; and there could be popups in there too;

Where do I sign? Check is in the mail (for $1.73), right?

Fortunately, many others have realized the necessity to act. People have created ad-free search and a universal ad tracking opt-out tool that make the web feel just a little cleaner.

Links:
Ad-free search
Privacy Choice Universal Opt-Out
DoubleClick FAQ

"AdSense Privacy 2 - Google PopUp?" continued here...

AdSense Privacy? - Need New Ad Provider

I got an interesting email from AdSense. They are introducing "interest-based advertising". Seems harmless, right? Well, maybe. But if it is, why does this "enhancement" have anything to do with a publisher's privacy policy?

"We're writing to let you know about the upcoming launch of interest-based advertising, which will require you to review and make any necessary changes to your site's privacy policies. ...make any necessary changes by April 8, 2009."

Ok, sure. Like the sitemaps... where do I get the template/code/widget/whatever? How do I comply?

"...we're unfortunately unable to suggest specific privacy policy language."

Hmm... Ok, the link in the email for "AdSense Help" (link below) was a little more helpful:

Your posted privacy policy should include the following information about Google and the DoubleClick DART cookie:

• Google, as a third party vendor, uses cookies to serve ads on your site.


• Google's use of the DART cookie enables it to serve ads to your users based on their visit to your sites and other sites on the Internet.


• Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy. (link below)

EDIT: These guys have more info on the cookie technology:
SEO Book - Google Phorm Behavioral Ad Targeting

I found an AdSense privacy policy generator(link below).

...but I'm pretty sure I am going to remove the AdSense. I have until April 8th to decide. What would you like to see? Leave a comment if you know of an ad network, advertisers, or some other (preferably monetized) widget, gadget, network, group, exchange, etc. that would provide good technology-related content, and would actually add to the site, leave a comment, Twitter, email, smoke signal...

Links:

• Google AdSense Cookie Opt Out Link!


• DoubleClick DART cookie - AdSense Help


• AdSense Privacy Policy Generator

"AdSense Privacy? - Need New Ad Provider" continued here...

How to Recover from a Hard Drive Crash

The day we all dread finally came - your (or your client's) hard disk crashed. The disk might be making funny noises or simply throwing errors when you boot. There is usually a whole bunch of data that hasn't been backed up, but it's not so important that you're willing to spend $4000+ to recover it (yes, data recovery does really cost thousands of dollars. If it doesn't, they probably won't go beyond what I show you how to do below, so you may as well try it yourself). Here is what you should do when you need to recover data from a crashed hard disk. Note: in many cases, the disk actually works fine (corrupt MBR or MFT, system file corruption, etc) - if you are lucky, you can literally "clone" the failed disk to a new one and boot into your old system!

Stop! Don't open, click, type, or touch anything. Turn off the computer by holding the power button or unplugging it. Unplug the computer.

Get a hard drive that is identical (preferable) or larger than the crashed hard disk.*

We are going to try recovering the data from the failed hard disk to the new one by using a bootable rescue CD. You can either add a second hard disk to the affected PC, or use another computer. If you use another computer, I would recommend you still plug in only the new disk and the one you are recovering data from, to avoid confusion.

• 0. Before you do anything, discharge your static well away from the computer, and put on a static wrist strap.


• 1. First, download and burn SystemRescueCD, or your favorite computer recovery toolkit. There are several others - in fact, most Linux LiveCDs will work, and you can easily make your own rescue cd also.


• 2. With all of your disks unplugged - unplug power and data cable - turn the computer on and go into Setup (look for the "Press DEL to enter Setup..." when the computer boots and press that key). Look for the "Boot Order" or similar option, and use the + and - keys (or PgUp/PgDn, it should tell you in the sidebar) to remove "hard disk" from the boot order, or at least move it to the bottom. Make sure CD or DVD is listed - preferably first.

 

• 3. Add a second hard drive  (as "primary" for IDE)
                Note: If your hard disk is physically damaged, making noise, or emitting smoke, do not leave it in the computer. While the computer is unplugged, very carefully place the disk on a static-free surface (like rubber - a mousepad might work), plug it in (may need a longer cable), get a powerful fan or an icepack (DO NOT cover up the little tiny air intake hole on top of the drive, or get the drive wet) and try to keep the crashed hard drive cool. In this case, you may have to make many short passes with long (hour+) breaks in between to let the drive cool down. Remember to turn off and unplug everything when you are not actively recovering data.


• 4. Power on the computer, quickly insert the Systemrescuecd, and Press a Key if prompted to boot to the CD. 


• 5. Identify the failed hard drive and the new disk that will hold the recovered data. Usually these will be sda and sdb (SATA) or hda and hdb (IDE), but make sure to check - you don't want to move the blank space from the new hard disk and wipe out the failed hard drive!
• 6. Use ddrescue to move the contents of the failed hard disk to the new hard disk.
          Note: this process is different depending on your kernel (and ddrescue) version. I am only listing instructions for 2.6.3 and later. These instructions will work for the latest Systemrescuecd. If you have to use an earlier kernel, please visit the Forensics Wiki for instructions. (-d is the same as --direct, and -v is the same as --verbose)
  
            First pass: get the data that is still intact (no retries, don't split)
  ddrescue --no-split --verbose /dev/sda /dev/sdb rescue.log
            Second pass: Retry errors 3 times, don't use the disk cache
  ddrescue --direct -v --max-retries=3 /dev/sda /dev/sdb rescue.log
            Third pass: Add retrim which will retry reads in a different order
  ddrescue -d -v --retrim --max-retries=3 /dev/sda /dev/sdb rescue.log
   

• 7. If you have successfully recovered the whole disk, you will want to check the disk for errors. Most operating systems will do this if you simply boot to the new disk containing the recovered data (unplug the old disk completely), but to be sure you may want to run the appropriate file system checker from the rescue disk (after rebooting with only the new hard disk in the system):
      FAT / NTFS         chkdisk /F /R C:\
      Ext2 / Ext3          e2fsck  /dev/sda1


• 8. If you haven't recovered all of your data, you can still try to mount partitions from the failed disk. The ro indicates "read only", while the noexec prevents anything on the disk from being executed, and the noatime prevents the file access time from being updates, so there really should be no disk writes.
  Try: mkdir /mnt/data; mount -o ro noexec noatime /dev/sdb /mnt/data
  If that doesn't work, try a partition at a time:
  
             mount -o ro noexec noatime /dev/sdb1 /mnt/data1
             mount -o ro noexec noatime /dev/sdb2 /mnt/data2
               ...


• 9. Then you should be able to see at least some of your files and copy them elsewhere using cp /mnt/data1/* /backup/folder/or/mounted/network/drive/ 

If you have not yet been successful, then you probably have to pay for professional data recovery or forget about that data. If you are feeling adventurous, or the data is extremely important but you can't afford to pay, you might want to try some forensic recovery tools. A good open source tool is The Sleuth Kit (make sure you get Autopsy with it). For a professional tool, consider EnCase. 

If your disk is damaged because of "Head-to-Disk Interference" or HDI, there is little chance of data recovery. This relatively uncommon drive failure is when the platters and/or head become off balance and the head physically grinds across the platters, "scratching" the disk much like a CD. If you experienced this you would know by the metal-on-metal grinding noise coming from the drive as soon as it tries to spin. That's data being completely destroyed. If you have a few hundred thousand dollars, you can recover the data on the non-damaged parts of the disk platters using various advanced electron microscopy techniques, but realistically you should probably move on with a fresh operating system on a new disk - why not give Linux a try?

More about mounting disks with the mount command

More about ddrescue

"How to Recover from a Hard Drive Crash" continued here...

Computing in a Weak Economy - Cut Costs to Stay Afloat

Times are changing. Companies are losing money on deals that were once profitable. We are cutting back on spending, laying off employees, eliminating projects, raising prices, and losing morale daily. Many are starting to worry that the quick recovery might not be quick, and the consumer outlook doesn't look good. What can a company do to stay afloat in a recession?

Well, we do need to take a look at spending patterns and cut some spending, and we might need to adjust pricing as well as creatively improve morale around the office. But we can use the simple fact that technology is always advancing to our advantage.

Now is the time to upgrade your hardware, improve software and process efficiency, and renegotiate contracts. Why? Well, the technology has improved, companies know about the recession, and they will give you a deal to get your business. It works both ways - in a recession, more than ever, your customer loyalty will matter. Help your customers get through this now, and they will return the favor.

Looking for specific examples to help you cut costs using new technologies? Consider the following ways to save money and improve the efficiency of your business:

• Virtualization. With many companies still entering this market, and some established players going strong, this is a technology that is here to stay. Check out Xen or VMWare to download a free virtualization solution today!


• Open source software, especially Linux, has come a long way in terms of features, ease-of-use, and stability. Consider replacing some development or web servers with Centos or Ubuntu. And remember, open source does not mean "unsupported" - if you get stuck, there are enterprise level support options for most products. Check out Sourceforge for an up-to-date list of many open source projects.


• Consolidate workloads. The above two solutions will help with this, but the important step is determining exactly what your technical people and your technology products are doing, and evaluating whether these tasks can be done with less. You may need to refactor code, restructure or eliminate projects, and even optimize business processes. Server optimization, network redesign, and in-house technical experience will help you here.


• Cut expenses. Renegotiating contracts is important - your bandwidth and hosting costs could drop significantly. Re-evaluate whether you really need all those licenses. Consider short projects that will show a return, or at least savings, within a year.


• Rethink your power usage. Track the cost of your power. Turn computers (even some server) off at night. Use super-efficient 1U Twin servers to cut your power use. Decrease the resources necessary for your applications. Increase the temperature in your datacenter. Maybe even use the heat generated by your equipment to heat your office.

Feel free to add your own suggestions on how a business can save money in a recession - we could all use the tips!

"Computing in a Weak Economy - Cut Costs to Stay Afloat" continued here...

Quick Tech Tips - Part 2

When faced with a computer you know nothing about, you will want to at least know the basic system information to avoid headaches. This is not only useful for troubleshooting, and applies to client machines also - can you tell me what processes are running on your system right now? So how should you approach an unfamiliar computer system? How do you get the system specs, logs, and other information you might need to fix a problem, pass on to a technician, or list in your asset log?

This is what I do to gather specs and system information before starting to work on a system that I know nothing about:

Windows


• Backup the system: Start->Run...->ntbackup


• Start->Right Click My Computer->Properties


• Start->Run...->taskmgr


• Start->Run...->msinfo32


• Start->Run...->msconfig


• Start->Run...->eventvwr


• Start->Run...->cmd; ipconfig /all


• Start->Run...->gpedit.msc


• Start->Run...->regedit

Linux


• Backup the system: tar or rsync


• dmesg


• uname -a


• free


• top


• lsmod


• lspci


• cat /proc/cpuinfo


• cat /var/log/messages


• vi /etc/sysctl.conf


• cd /etc/sysconfig; cat [things that you want info about] (e.g. cd /etc/sysconfig; cat network)


• ifconfig /all


• You will find much more information browsing around the /proc virtual filesystem, so e.g. to get the current max threads in the kernel, use: cat /proc/sys/kernel/threads-max

Am I missing a tech tip you use regularly? Add it in the comments below!

"Quick Tech Tips - Part 2" continued here...

Search Tips to Solve Problems Fast

How do we find information on the Internet?

A simple question that people have been trying to answer since the Internet happened. Many pieces of code and humans are working constantly to "index" this endless dynamic web using complex algorithms to make it easier to "find" things on the Internet, so for now we will focus solely on perfecting the art of the web search. Unfortunately, the average surfer uses mostly basic queries and may only click the first search result, using only a few resources to solve even complex problems. Fortunately, there are simple ways to increase the effectiveness of your searches and decrease the time required to come up with a solution.

You need to solve a problem at home or work - whether it is technical in nature or not is irrelevant. For this example, let's say that you have limited groceries and need a creative idea for dinner.

How to search effectively:

1. Define the data you already have; In this case, note the food items you have on hand. This will turn into your query.
2. Define the result you are looking for; Here, this will be one or more recipes.
3. Think about similar problems you may have solved or come across in the past. Did you see a recipe on a blog or hear about a type of dish you might be interested in trying?
4. If you are already familiar with some resources, start there. In this case, you might try Food Network's website or searching simply for "recipe" or "chicken recipe". Do you see anything that grabs your attention? Look for categories you may be interested in as well as key words. Make sure you always read at least the entire first page of results, and pick out the most reliable links by their title and description.
5. As you see things you might like, you can require terms in your query by using a plus sign* (+) before the word (no space). In this case, try your main ingredient first, such as: recipe +chicken
6. Refine your query by trying additional ingredients, like this: recipe +chicken +paprika
7. Try adding actions, for example: recipe +chicken +paprika +bake
8. You can also exclude words by adding a minus sign(-) immediately before the word. So, if you don't like (or have) garlic: recipe +chicken +paprika +bake -garlic
9. If you need to include or exclude a phrase, use quotes: recipe +chicken +paprika +bake -garlic +"sour cream"

*Most search engines will give you similar results without the plus sign (recipe chicken paprika ...), but using the plus sign requires exactly that word as opposed to including synonyms.

More Search tips:


• Generally, you can use "find this phrase" in quotes to search for exactly that phrase - words in that order. Try this for queries like "less than" +minutes
• You can use the plus sign (+) before a word to require the exact word rather than including synonyms.
• You can usually use the word OR to indicate pages that include one word or the other, or both.
• Use the minus sign (-) to exclude words.
• You can use -"this phrase", however this seems to work differently depending on the search engine:
  
  
  
  1. Equivalent to -this -phrase in some cases (Ask.com)
  2. Works as I expected - excluding only "this phrase" in order(Google)
  3. Strange results sometimes, such as including results that should definitely be excluded, especially with more than two words in the phrase.(Yahoo!)


• You can usually use the asterisk (*) to replace a single word, so to get results for "marinated in (or with or using...) paprika" you would use: marinated * paprika
• Sometimes you can use the underscore (_) to mean "near" - so you could use the following query to get results with "marinated", "chicken", and "paprika" in the same paragraph: chicken _ marinated _ paprika
• Using the underscore gives you results when the words are near each other, usually within the same paragraph.
• Don't be afraid to use long queries. For computer problems, search for the whole error text. To look for the author of a poem, paste a line or stanza. Try with and without the quotes. Use advanced search. Try different search engines.
• Most importantly, read the documentation (usually under "Advanced Search"), refine your query and observe how your results change between queries. With practice, the 9 steps above should help you find information and solve problems more efficiently on and off the 'net.

Feel free to share your experience or add other search tips in the comments below.

"Search Tips to Solve Problems Fast" continued here...

State of The Internet: 3.7.09

Here's what happened behind the scenes of The Internet recently, while you weren't looking. Yes, it's important.

IBM not so sure about open source anymore. Nobody has any money, of course they won't take our free products! Hope this doesn't keep up, or tech might have a "financial-style" rude awakening about the importance of customers vs. profit.

Microsoft will let you disable IE (only if you're absolutely sure) - no word on whether one day we can also disable "Slow", "Blue Screen" or Vista's trick of pinging the Department of Homeland Security. Move along, no glaring irony to see here.

Facebook a little red in the face after realizing that people aren't quite as dumb as they thought. Time to get a smarter lawyer. Or dumber customers.

Foreclosure scams on the rise. In other news, you probably won the lottery at least 4 times this week - go check your email! Make sure to write the tracking code "ID10T" legibly on the envelope containing all of your assets.

Britain printing paper money - good thing nobody remembers the time when money had to have something of value to back it

How to think what nobody else thinks

Managers buy out company instead of letting it go bankrupt. If only there were a group of people at GM, Bank of America, or Circuit City that had enough cash laying around to do something similar.... But clearly large companies haven't been paying their top people enough over the last several decades.

Company gives $9 million to its employees. Wait, I thought "The Economy" had all the money and that's why we can't have any? It really is just the scumbags at the top?

Schwarzenegger is still very sensible and intelligent - it's too bad everyone thinks he's just a big dumb jock.

We might have a shot at efficient solar cells after all. Realistically, the military will get exclusive use this technology so we can have invisible killing machines instead.

Microsoft is a little slow.That's ok, they have a lot of money, and it's their free country we live in so we all need to adjust to the lowest common denominator. Seems to be the norm these days.

These "scientists" are going to try to make a real live dinosaur. Want to guess who's money their using? And we all wonder why "The Economy" has collapsed (here's a hint - it's NOT the banks fault people can't read, make decisions, or do math)...

Please visit Fark if you want to survive the chaos. Remember - information is more powerful than greed, now we just need more people to have the first than the latter!

"State of The Internet: 3.7.09" continued here...

V12’s Dual Touchscreen Canova Laptop Coming from Estari

V12’s Dual Touchscreen Canova Laptop Coming from Estari

Posted using ShareThis
"V12’s Dual Touchscreen Canova Laptop Coming from Estari" continued here...

IT can't see through the Cloud

I try to stay out of politi-technical discussions, but I have to say my piece on this whole "cloud" thing that everyone seems to be so excited about. In case you have somehow managed to avoid getting roped into these discussions, they are usually centered around the fact that could computing is "new" "cool" and "might save you money..." Unfortunately, this whole concept has created quite a disagreement between IT departments and "everyone else".

"Cloud Computing" is a generic term used to describe "Infrastructure-as-a-Service", such as Amazon Web Services (EC2), Microsoft Azure, Google App Engine, and many others. The basic idea is that you can move your entire network - servers, routers, firewalls, load balancers, all of it - into a virtual "bucket" or buckets and just let it run forever and ever without any attention to the underlying technical stuff. You just develop your application, pay for "server uptime" by the hour, and ignore all of the fine print and the additional charges on your bill. What could possibly go wrong?

First, let me say that I have no vendetta against any cloud company or technology, nor do I object to the idea of reducing IT bandwidth spent on physical hardware replacement, auditing, and configuring new server instances. And I don't think cloud computing is a horrible technology that is bound to fail.

What I do think is that people are extremely confused about how this all works, and cloud vendors are all too willing to say "Sure, we can do that." before consulting the tech team or extensively testing the product/service/code/whatever. Add to that the fact that anyone can run and even distribute code on the cloud, and we're in for a bumpy ride.

My main point is that cloud computing is amazing new technology that works extremely well when it is used for its intended purpose - highly parallel multi-threaded applications, such as video encoding or scientific modeling. Remember: cloud computing was originally just a way to rent CPU time in convenient blocks.

So what's the difference between that and what we are all trying to do now on the cloud? Lots:

• We screamed so loud for "disks" that Amazon gave us exactly what we wanted - and other companies followed. Think of the difference - if I hack a single thread (even 100 threads) running arbitrary analysis on a protein sequence, or encoding single frames of video, not only will I have an extremely limited and practically useless piece of your data, you will likely catch and auto-correct the problem when you put the responses back together in your own datacenter.
• Now, however, we are putting our end-to-end request/response cycle entirely in the "cloud" - which seems to me like doing your taxes on Wikipedia just so you don't have to store a copy of the forms. Think about it - what IT principal responsible for the complete, end-to-end cycle of your application would allow 100% of that application to be outside of their control?
• In the aforementioned CPU-only model, there is very little additional action required to incorporate the process into your existing security infrastructure - your data itself is visible and controlled inside of your datacenter. Worst case - total compromise of EC2 - and all you've lost is some processing time, and you can quickly prevent the spread of damage and move processes to available local nodes.
• When your whole cycle is in the cloud, there are many potential issues that others have presented adequately (see the included links for extensive treatments of security and stability in the cloud), so I won't rehash them here. The main point is that you are no longer losing CPU cycles in the event of [failure|downtime|hacking|natural disaster|humans] - you are losing data.

Even Amazon's "official position" on security is not convincing. Within their Overview of Security Processes they make several obvious contradictions that will be (have been) duly noted. Within the same page they maintain that essentially [your data is safe, we don't touch it] and [we audit everything, so our data is safe]. Do you see the problem? How do I know what's "my data" and what's "Amazon's data" - the virtual disk? the binary JSON/AJP/AMF3 requests I make between "zones"? And so on...

Bottom line:

Cloud computing is a cool up-and-coming technology, but until these companies provide visibility, control, traceability, and maintainability, (possibly liability? support?) don't bet - or put - the "farm" on this technology.

There may be more to come on this, feel free to ask questions and I'll call Amazon (oh, wait, I can't do that...) or use my hackerly Googling skills to come up with some data.

**Note: I am not singling out Amazon because of any personal or political reason - this is simply the most prominent cloud platform available today. I am hopeful that all of the recent security/stability discussions will result in Amazon fixing these issues and creating the first "IT-department-friendly" cloud platform.

Links:

O'Reilly Blog - EC2

EC2 Security

TechBuddha - Can We Secure The Cloud?

What a Cloudy Web We Weave

Could Computing - The Good, The Bad, and The Cloudy

Amazon fixed security vulnerability - after 7 months

"IT can't see through the Cloud" continued here...

Tuning Basics

When you run into performance problems, it's easy to add network equipment, servers, or bandwidth to cope with the load. However, you will often need to fix the issues without spending additional capital. This means tuning. Unfortunately, many websites on tuning simply give specific values without any explanation, such as a set of sysctl values for Linux or a bunch of registry keys for Windows. These values are often tuned to the poster's hardware and environment, and may even introduce new and obscure problems if you apply them without knowing what they do and how they apply to your environment.

So why am I writing a blog on tuning, then? Well, I would like to present techniques for identifying bottlenecks and tuning your systems correctly. I will also provide specific tools for monitoring and testing performance where applicable. Finally, I will list specific tuning options at times (mostly so I can find them again), but I will always preface these with an explanation, including the details of my environment and system specs. 

Let's start with the basic rules of system tuning:

• Identify the problem first
  
• Only tune if it will actually help (For example, tuning can't fix a bad switch port. Troubleshoot and eliminate obvious problems first.) 
• Don't ever tune a live server (If you have an emergency, clone the box to a VM or spare box instead)
• Back up the current system state and all data before you touch anything
• Make a performance baseline
• Make a performance goal
• Document everything
• Back up the current system state and all data before you touch anything
• Write down what you change when you change it
• Classify results in multiple categories - keep track of what hurts, what helps, and what doesn't affect performance
• Make regular backups (or better, snapshots) as you progress so you can revert
• Test each change separately
• Test in a pre-production environment before going live - don't assume it will work in your datacenter because it works in your lab.

Check back often (I will try to post at least once a week), and if there's a specific question you have or benchmarks you'd like to see, let me know and I'll do what I can to help.

"Tuning Basics" continued here...