RSS

Microsoft and WordPress announce: Live Spaces out.... Wordpress In

Tue, 28th September 2010, 00:11

Microsoft and WordPress announced today that the Windows Live Spaces blogging service will be phased out. Users of Live Spaces will have the ability to transfer their blogs via a new migration utility beginning today.

In a post on Inside Windows Live, Dharmesh Mehta, said: “Over the last few weeks, we’ve spent a good bit of time talking about our approach to partnering with the web, and as part of that, how we’re deeply integrating with the leading consumer services that you find most valuable.

As we looked at customers’ blogging needs and what different companies were providing, we were particularly interested in what WordPress is doing….

So rather than having Windows Live invest in a competing blogging service, we decided the best thing we could do for our customers was to give them a great blogging solution through WordPress.com.”

Automattic’s Paul Kim added on the Just Another WordPress Weblog: “Over a six month period, beginning today, Windows Live Spaces users will have the option to move their blogs to WordPress. To make this possible, we’ve created a brand new importer for Windows Live Spaces to WordPres. New Windows Live users will also be offered a WordPress blog when they choose to create a new blog.”

We’re very happy that Microsoft chose WordPress as their preferred new blogging service for Windows Live users. It’s a sign of how strong WordPress has become, and credit for that goes to every one of you who’s been creating here....

This could easily double the current size of Wordpress ...only time will tell whether they stumble.


Police lay charges of libel, obstruction against Calgary website operator

Mon, 27th September 2010, 23:38

A story that is developing in Canada caught my eye when RCMP laid five charges against a Calgary man related to the operation of a website  highly critical of Calgary police officers. While heavy handed antics by the police may be nothing new (did you catch the G-20 summit in Toronto with people arrested using a “newly enacted pretend law”), this does appear to reach new levels.

At a news conference the RCMP announcing the charges against John Kelly, 53, of Calgary, Supt. Randy McGinnis said the charges are very rare. "In my 29 years, I've never heard of an individual being charged under the criminal code for libel charges, defamation of character,".

While there are conflicting reports, it does appear that the police have requested that the website host Register.com voluntarily take the site down We are awaiting a response from Register for a comment. There is also no word on whether officials have requested a court order to shut rottenapples.info down.

On the surface, the site appears to be the rantings of a disgruntled citizen who claims “The purpose of this site is to expose the rotten apples and corruption within the Calgary Police Service. And make no mistake it exists. This site will focus on seven criminal investigations and the lengths that the Calgary Police Service will go to, in order to prevent the details surrounding those investigations from coming out. This includes the police knowingly allowing criminal acts to go unpunished, including those committed by Calgary Police Officers.” end quote...

What I did find strikingly amiss in the various mainstream news reports was the lack of a link or even a mention of the name of the website. Coincidence no doubt!

We have requested a comment from John Kelly on whether he has had any communications with Register, or whether the police have had any communication that he is aware of. For now rottenapples.info is up and continues to attract the curious. Police should have read the HostJury's post "Cease and Desist” Takedown Letters can add buzz... and sales

Update... a response from John Kelly

I now have limited access to the internet and the Crown is unlawfully trying to trestrict even that, They attempted to have a condition placed in an order that I have refused to acknowledge or sign. The section is restrictive unreasonable and is a blatant attempt to stop me from commenting on their false charges and providing the truth to anyone.
 
This condition states the following (in capitals) " PROVIDED HE DOES NOT POST ANY COMMENT OR CONTENT ON THEM THAT IS RELEVANT TO THESE PROCEEDINGS - SPECIFICALLY ANYTHING THAT IS ON THE WEBSITE WWW.ROTTENAPPLES.INFO AND ANY OTHER INFORMATION REGARDING DETECTIVE MERCER OR DETECTIVE FRIZELL OR OTHER NAMED PEOPLE IN CONDITIONS 5 AND 6  ".
 
My next court date is October the 7th and despite numerous requests and promises the RCMP cannot provide any evidence to substantiate the allegation and charges they have laid agains me. Applications will be made to the Court to get them to comply
 
John Kelly.
 
HostJury will continue to follow this story!

 

CIRA overhauls domain registration system

Mon, 13th September 2010, 18:00

On October 12, 2010, it will become easier for Canadians to register and maintain their .CA domain names. The Canadian Internet Registration Authority (CIRA) is redesigning its domain name registration system, the system that enables Registrars – the companies that register domain names – to communicate with the .CA registry database.  This will effectively update and simplify every aspect of the registry from its technological processes to its policies and business practices.

In the largest single project undertaken in its history, CIRA will be replacing its current registry system with the industry standard EPP-based system. The rewrite is the result of nearly two years work and has involved almost all of CIRA’s employees.

“For 10 years, Canadians have come to rely on the .CA domain for its usability and reliability. As we approach 1.5 million .CA domain names registered, we knew it was imperative to investment in our systems, people, processes, and technical infrastructure,” said Byron Holland, CIRA’s President and CEO. “The new EPP-based system is really the de facto industry standard – its quality is known – and will allow us to maintain the safety and security of the system. We are also able to simplify many of the processes Canadians have to go through to register and maintain their .CA domain names.”

With the new system and policies, CIRA is effectively able to remove itself from many day-to-day transactions. Most transactions will be handled solely by CIRA certified Registrars. To ensure Registrants, the people and organizations who hold .CA domain names, continue to receive a high level of customer service, CIRA has introduced a mandatory technical and policy accreditation process for Registrars.

“We’ve heard from Canadians that some of our processes are complicated as compared to other registries and we’ve listened. We’ve streamlined our most common transactions, greatly enhancing the experience customers will have starting October 12,” said Holland. “We’re also beefing up support to our partners, the companies that service .CA customers on a regular basis. That way, the entire process of getting and maintaining a .CA domain name will be among the most efficient in the world.”

More information about the .CA registry rewrite and how it will affect .CA domain names holders is available at cira.ca/ca-faq-10-12/.

GoDaddy goes up for sale

Sat, 11th September 2010, 05:06

GoDaddy -- the internet registrar responsible for the registration and management of over 43 million internet domain names has been put up for sale according to an article on the Wall Street Journal website. GoDaddy also represents 'Wild West Domains', a company that numerous other companies use for resale of SSL, domain names and other services to their own clientele. GoDaddy is renowned for their advertisements during the superbowl and budget-level hosting & domain registration. It will be extremely interesting to see what happens to both the company and clientele if the company changes hands -- it'll be safe to say this will be an exciting sale considering GoDaddy is the largest registrar on the planet. 

 More information about GoDaddy follows below: 

GoDaddy.com is the world's largest domain name registrar and is the flagship company of The Go Daddy Group, Inc.

The Go Daddy Group of companies also includes Wild West Domains, Inc., a reseller of domains and domain-related products and services; Domains by Proxy®, a private registration service; Starfield Technologies, a research and development affiliate; and Blue Razor Domains, a membership-based discount registrar.

As an ICANN-accredited domain registrar, Go Daddy has more names under management than any other registrar, offers products at prices up to 70% less than the competition and supports them all with world-class 24/7 live customer service.

Founded by Bob Parsons in 1997, The Go Daddy Group has grown to include more than 43 million domains under management. Godaddy offers a complete product line, including comprehensive hosting solutions, Web site creation tools, Secure SSL certificates, personalized email with spam and anti-phishing filtering, e-commerce tools and more.

Vox may have been all this... but Vox is still closing its doors

Mon, 6th September 2010, 19:59

Another free blogging service is calling it a day. Vox, a child of the Six Apart company, announced on the Team Vox blog that “Vox has been a fun place to explore, create and connect with your friends. But Vox is closing its doors on September 30, 2010.

 With this curt little announcement, Vox immediately ceased accepting new user registrations.  Existing Vox account holders can continue to sign in and manage their account and view posts from their “neighborhood”, but as of September 15th, Vox users will no longer be able to create new posts or upload new photos or videos.

The people behind Vox have clearly attempted to identify potential new homes for the bloggers. The Vox people have even added tools that allow the bloggers to more easily export their data to content management systems like wordpress, which can be used with most web host. Vox does point out that most users will experience various technical shortcomings, depending on the specific application they are using.

As of September 30th, the service will cease. As can be expected, there are many unhappy users complaining of the short notice given. Some users were complaining that they had only recently joined Vox after other micro blogging sites have modified their user policies, or closed their doors. Reading through the comments it would be hard to miss the community that has grown around longtime users of Vox.

One user, e2c summarized what others were saying:

“I think management doesn't "get" the whole idea behind Vox. Or maybe the people who were responsible for developing Vox are no longer with Six Apart? I was a beta tester, like many others who are replying here. I LOVE the communities we created here.


To see them - us! - deep-sixed without any real reason in support of this decision is just... wrong. Appalling. Offensive. Are you aware that people here helped cover funeral expenses for a member's family? That many of us were friends with members who have died - were, in at least one case, their primary support during their final illness?


I realize that it's no fun bringing the axe down, but I think all of us "little guys" are getting cut off with no reason at all. What if this site had moved to a subscription model? (A reasonably-priced one.) Is that possible NOW? Is it something Six Apart would consider doing? I just feel heartsick and angry over this. And all the answers so far are just empty words, empty promises.” end quote


Sometimes free may not always be the cheapest model

Firm to Settle FTC Charges of Advertising using Misleading Reviews

Sat, 4th September 2010, 18:35

A public relations agency hired by video game developers will settle Federal Trade Commission charges that it engaged in deceptive advertising by having employees pose as ordinary consumers posting game reviews at an online store, and not disclosing that the reviews came from paid employees working on behalf of the developers.

“Companies, including public relations firms involved in online marketing need to abide by long-held principles of truth in advertising,” said Mary Engle, Director of the FTC’s Division of Advertising Practices. “Advertisers should not pass themselves off as ordinary consumers touting a product, and endorsers should make it clear when they have financial connections to sellers.”

While it remains to be seen how they will actually accomplish what no one else on the internet has been able to accomplish, Reverb Communications and its sole owner, Tracie Snitker, are required to remove any previously posted endorsements that misrepresent the authors as independent users or ordinary consumers, and that fail to disclose a connection between Reverb and the seller of a product or service.  The agreement also bars Reverb and Snitker from misrepresenting that the user or endorser is an independent, ordinary consumer, and from making endorsement or user claims about a product or service unless they disclose any relevant connections that they have with the seller of the product or service.

HostJury has a strict policy about hosts writing fraud reviews. Still a little reminder never hurts.

FTC Halts Canadian Domain Name Scam

Mon, 9th August 2010, 21:24

Thousands of Small Businesses and Non-profits Billed for Bogus Renewal Fees

The Federal Trade Commission has permanently halted the operations of Canadian con artists who allegedly posed as domain name registrars and convinced thousands of U.S. consumers, small businesses and non-profit organizations to pay bogus bills by leading them to believe they would lose their Web site addresses unless they paid. Settlement and default judgment orders signed by the court will bar the deceptive practices in the future.

In June 2008, the FTC charged Toronto-based Internet Listing Service with sending fake invoices to small businesses and others, listing the existing domain name of the consumer’s Web site or a slight variation on the domain name, such as substituting “.org” for “.com.” The invoices appeared to come from the businesses’ existing domain name registrar and instructed them to pay for an annual “WEBSITE ADDRESS LISTING.” The invoices also claimed to include a search engine optimization service. Most consumers who received the “invoices” were led to believe that they had to pay them to maintain their registrations of domain names. Other consumers were induced to pay based on Internet Listing Service’s claims that its “Search Optimization” service would “direct mass traffic” to their sites and that their “proven search engine listing service” would result in “a substantial increase in traffic.”

The FTC’s complaint charged that most consumers who paid the defendants’ invoices did not receive any domain name registration services and that the “search optimization” service did not result in increased traffic to the consumers’ Web sites.

A federal district court judge in Chicago, Robert M. Dow, Jr., ordered a temporary halt to the deceptive claims and froze the defendants’ assets, pending trial. The settlement and default judgment orders announced today end that litigation.

The orders bar the defendants from misrepresenting: that they have a preexisting business relationship with consumers; that consumers owe them money; that they will provide domain name registration; and that they will provide “search optimization services” that will substantially increase traffic to consumers’ Web sites. The defendants are also required to disclose any material restrictions or aspects of any goods or services they provide.

The settlement order, entered against defendants Isaac Benlolo, Kirk Mulveney, Pearl Keslassy, and 1646153 Ontario Inc., includes a suspended judgment of $4,261,876, the total amount of consumer injury caused by the illegal activities. Based on the inability of the settling defendants to pay, they will turn over $10,000 to satisfy the judgment. The default judgment order was entered against defendant Steven E. Dale and includes a judgment in the amount of $4,261,876.

Charges against Ari Balabanian and Data Business Solutions were dismissed by the court at the FTC’s request.

 

Reviewer Caught Posting Marketing Material As A Review... Uses DMCA To Takedown

Sat, 31st July 2010, 14:18

Reviews that can not be confirmed, are bogus, or even fraudulent, are nothing new at HostJury. Over the years, they have been posted by all sorts of individuals from a host's competitor trying to tarnish a otherwise solid reputation, a site trying to get a SEO link, friends and family of web hosts, and it even has been known for a host to occasionally try to post a “fraudulent” review themselves!

Normally the reviews are just removed although there has been occasions where we have called the host out on the issue.  Sometimes it has become so blatant that we have edited the company's profile to state that they continually post fraud reviews.

So I found quite humorous the tale of professional freelance journalist Stuart Campbell, who “outed” on his blog worldofstuart.co.uk, an on line review published by the site BenchmarkReviews. The review of a rather expensive Herman Miller office chair that was written by the site owner Orlin Coles.

“In looking through the details, it quickly became clear that the "review" text appeared to have copied potentially large segments from either marketing material or a press release. Some of the sources of the material were found out -- including a Herman Miller product brochure and a furniture store company's product description. As people commented on the BenchmarkReviews website pointing this out, those comments were swiftly deleted, and the users' IP addresses were banned”, Stewart Campbell states on his blog.

Campbell then sent Coles an email, identifying himself and asking a series of questions about the "review." Instead of replying, Olin Coles posted a note to BenchmarkReview's forums, publicly naming Campbell, claiming that Campbell was banned from the site for making "anonymous threats."

Next, a reader of Campbell's site contacted the furniture store in question, Smart Furniture, who claimed that they had written their own product description, suggesting that Benchmark Review may have copied it from Smart Furniture. Suddenly the text of the original review at Benchmark Review started gradually morphing, with no notice of the changes. Of course, Campbell had the originals and highlighted the ongoing changes. Oddly, the newly changed review included a whole bunch of ads pointing to Smart Furniture.

That's when things got nasty. Apparently Coles sent a DMCA takedown to Campbell's web hosting provider JustHost.  JustHost pulled down the entire site. Campbell continues "JustHost seemed utterly clueless about how to properly handle a DMCA takedown notice and counternotice. WoSblog was eventually reinstated by JustHost with the alleged offending material temporarily removed, pending someone arriving in their offices who knows more about copyright law than a squirrel".

HostJury covered DMCA take down notices in a prior story recently!  HostJury has contacted JustHost for a comment.

 

Wordpress announces end of road for PHP 4 and MySQL 4

Sat, 24th July 2010, 14:14

WordPress has always been able to run on basically any common server configurations allowing users to have flexibility when choosing a web host for their website. Web hosting platforms have changed over time, and Wordpress has announced they are evaluating some of the requirements for running WordPress.

WordPress 3.1, due in late 2010, will be the last version of WordPress to support PHP 4. For WordPress 3.2, due in the first half of 2011, the minimum required PHP version will be 5.2 which means you will not be able to upgrade to this version unless you have 5.2..

The vast majority of WordPress users are currently using 5.2, which offers substantial improvements over the earlier PHP 5 releases. It is also the minimum PHP version that the Drupal and Joomla projects will be supporting in their next versions, both due out in 2010.

Wordpress statistics show that only around 11 percent of WordPress installs are running on a PHP versions below 5.2. Many of these are on hosts who actually support PHP 5.2. The users merely need to change a setting in their hosting control panel to activate it. Wordpress believe these percentage will only go down over the rest of the year as hosting providers realize that to support the newest versions of WordPress (or Drupal, or Joomla), they’re going to have to facilitate the change.

Wp is also dropping support for MySQL 4 after WordPress 3.1. Fewer than 6 percent of WordPress users are running MySQL 4. The new required MySQL version for WordPress 3.2 will be 5.0.15.

A quick google for vulnerabilities will show how dated these versions actually are! It is hard to imagine that up to eleven percent of sites function in this way or that there are still web hosts that even offer them the opportunity.  

Need a new web host?

"Cease and Desist” Takedown Letters can add buzz... and sales

Tue, 20th July 2010, 11:39

We have all heard about condescending letters sent out by lawyer types informing an offending party of copyright or trademark infringement. These “cease and desist” letters demand that the offender must immediately comply with the request under threat of further legal action. In many instances these letters may have been the first notice of infringing material. Or in other scenarios, the lawyer types were trying to sweep something under their clients rug.

While C & D letters certainly predate the web, like many things, the Internet has made them so more interesting. Back in the early days (2002), in an apparent response to criticism of its handling of a threatening letter from a Church of Scientology lawyer, Google began to make so-called "take-down" letters public. And in true Internet fashion, the sites sometimes became more popular!

ThinkGeek reported that they got a 12 page take-down notice from the National Pork Board, over a little parody they did on April 1 (April Fools). Seems the legal types felt using the slogan "The Other White Meat," while advertising Radiant Farms Canned Unicorn (yep... Unicorn) meat may confuse the consumer.

Big Pork also demanded that T shirt gurus Neighborhoodies stop selling, at once, a Tshirt product where "Alf" asserts that cats are "The Other White Meat." The public may become confused about which animal does, in fact, constitute an appropriately pale substitute for chicken. Cat or Unicorns

Neighborhoodies has again run afoul. This time for a logo of a newspaper that folded in 1966. Elissa, Senior VP, Marketing and New Business Development of Hoodies, wrote on the official company blog “We just got a cease and desist letter from the lawyers at the NY Times. Crazy, right? We’re tired of being bullied, so we’re not going to take this shirt down. We think the absurdities have to stop. That just wouldn’t be in the spirit of Jean Seberg, the inspiration for our shirt which she so stylishly sports in the movie Breathless.”

Not to be so quickly brushed aside, the legal hawks at the NY Times sent a C & D letter to the website host SoftLayer. “SoftLayer then requested we comply with a letter they received from the NY Times” Elissa told HostJury. Continuing, she stated “We took down the shirt ourselves, rather than have SoftLayer take down the whole Neighborhoodies web site. SoftLayer has been intimidated by the New York Times threat. It's not that they are unsympathetic, but a threatening letter from a giant like the NY Times can be scary. “SoftLayer wanted us to bear the burden of any legal fees they might take on. We're a small company, and we're not prepared to take on legal fees for other companies. We're in the process of moving to a more sympathetic hosting company.”

Under the DMCA Safe Harbor Provisions, Softlayer would be required to remove questionable material if certain requirements are satisfied by the representative of the originator of the C&D notice. In order to ensure that copyright owners do not wrongly insist on the removal of materials that actually do not infringe their copyrights, the safe harbor provisions require service providers to notify the subscribers if their materials have been removed and to provide them with an opportunity to send a written notice to the service provider stating that the material has been wrongly removed. In this particular situation, this notice is not required by SoftLayer as the material in question was voluntarily removed by Neighborhoodies.

The DMCA also states a subscriber can provides a proper "counter-notice" claiming that the material does not infringe copyrights, and the service provider must then promptly notify the claiming party of the individual's objection. If the copyright owner does not bring a lawsuit in district court within 14 days, the service provider is then required to restore the material to its location on its network.

It is interesting to note that the CEO of Softlayer,Lance Crosby is actually a lawyer. We have requested comment on a number of questions and are awaiting their response.

For now the waiting continues.  In the meantime the shirt can still be purchased at Hoodies brick and motar establishment.

Report on on the usefulness and limitations of consumer complaint websites.

Thu, 10th June 2010, 19:13

The Consumer Federation of America (CFA) released a report, on the usefulness and limitations of popular free consumer complaint websites. The report concludes that, while these websites do not help consumers resolve their grievances, they can give complainants the satisfaction of communicating their unsatisfactory experiences to many other consumers, to the companies themselves, and to various third parties including consumer protection agencies and the press.


Moreover, these websites provide useful information to shoppers about potential problems they might experience purchasing products, especially services provided by nationwide companies. “The complaint websites provide a unique opportunity for consumers both to make their complaints heard and to learn about frequent problems experienced by other consumers,” said CFA Executive Director Stephen Brobeck, the report’s author. “We commend those who have created and maintain these websites.”

As posted in our forums in early March, HostJury has been working to create tools that will possibly help consumers do more than just air their frustrations about their experiences.

“The changes will allow web hosting providers & users alike to 'flag' or 'dispute' reviews. The dispute / flagging process will allow 'web hosting providers' to open a three-way communication window with users who have left reviews in another thread. For users of HostJury, we will be adding a 'flag' function to reviews. By 'flagging' a review it will open the review for discussion here in the forums and everyone will be able to contribute their thoughts on a particular entry.”

 

Potential clients researching a new webhost will be able to view the reactions of the web host to various review and or criticism, and also know how issues are handled and hopefully resolved, prior to making a final choice of a new home their website.

Green Hosting provider iMountain needs to shed light on speculation about power

Tue, 8th June 2010, 00:10

Everything including the phone service was down at iMOUNTAIN web hosting after the local Pomona power grid went offline, service was restored after approximately twelve hours, when the power came back on.

Not entirely surprising except that iMountain web hosting touts on the company's solar powered website "iMountain.com is proud to own and operate a solar powered data center serving the webhosting and corporate data processing community.”

Back in 2007, some questions were raised by a web hosting security consultant concerning the location of the solar panels and the availability of a back-up generator. In response to the criticism, a iMountain representative responded:


“I am happy to say that we don't use generators. Trying to sell a pollution causing generator to a solar powered webhost is like selling ice to an Eskimo.

Our solar powered batteries carry us through most of the night and we have grid power and we have UPS systems. We have 4 levels of power without having to pollute the environment with diesel and gas.”

They continued “ we had the solar panels on the roof until about 2 weeks ago. We took them down because everybody was saying they couldn't see them. In your pictures, we had them on the East wing (away from the freeway) And as a result, nobody could see them. The stands are being retrofitted so we can hang them on the freeway side (that drive-by freeway shot). Drive by in a few weeks and you can't miss them, and that's the whole point of us retro-fitting it. We'll be adding the panels and a solar freeway cam so you can view traffic conditions”

Curiously, during this time none of their systems went offline despite having their main power-source disabled. iMountain hosts approximately one thousand domain names at this time and touts having a 30ghz MySQL cluster to serve their clientele.


(We'd love to get our hands on one of those but sadly our budget leaves us within the realms of reality)

 

 

Privacy Issues and Cloud Computing Discussed Again!

Fri, 16th April 2010, 18:15

Howbeit a late comer to the fray, the Office of the Privacy Commissioner of Canada recently joined the growing list of officials expressing concerns about the shift to cloud hosting. Their paper, titled “Privacy Issues related to Cloud Computing”, was an abbreviated rehash of readily available information from many other papers on the same subject.

The copyrighted paper (most documents issued by Canadian Government are), in my opinion, misses the mark. The paper's introduction gives a broad overview of cloud computing, providing some Pew Internet Survey statistics to suggest why there is a shift to the cloud. The paper then continues to provide us with all the reasons why we should be concerned in what appears to be a copy and paste manner from countless other papers issued by various governments on the same subject.

In short, there is a lot of "what if" speculating without any clear basis in fact or practicality. Things like unintended intrusion, inappropriate use of data, or any number of the other issues pointed out by the paper are possible, but they are also possible in the current model of co-located, managed, or shared hosting environments.

The average client wishing to host their latest web offerings, mostly concern themselves only with the likes of page load speeds, and website uptime. If Pew were to survey this same “crowd”, likely many respondants would express concern over intrusion and spying by the same powers that are issuing these papers.

Protection of personal data is a growing concern with the advancement of technology. Cloud computing does present unique consideration that go beyond the current model as the data uploaded will cross various jurisdictional boundaries. Individuals and businesses will need to consider the implications and especially the legal issues that may surround their particular circumstances. Users will need to ensure that they comply with the legal requirements of the data they collect and retain possession of.

The better approach for the privacy commissioner would be to remind, and ensure that the business practices and policies of companies are sound regardless of the location or type of technological platform used to power the site. This is NOT a technology issue, rather a business privacy and ethics issue.

 

Network Solutions and Mass Wordpress exploits

Tue, 13th April 2010, 23:33

Throughout the weekend an interesting story has been developing regarding Network Solutions & Wordpress. As early as April 5th a series of exploits began occurring within Network Solutions shared web hosting account targetting Wordpress installations. Though we'll spare you most of the details regarding the exploit itself, they appear to largely stem from insecure permissions on Network Solution's own shared web hosting accounts and misconfigurations by clients themselves.

It seems that somewhere along the way Network Solutions began pointing fingers towards Wordpress in an attempt to pass the blame, causing Matt Mullenwag, founding developer of Wordpress to make a public statement on the Wordpress blog regarding file permissions and their importance.The current arrangement that Network Solutions utilizes for serving their client's websites seems to be based on a non-suexec arrangement where files are all owned by a particular user, allowing anyone to (essentially) read almost anyone elses files if the permissions are misconfigured. 

Most web hosting providers choose to go a more secure route and implement what's known as 'SuPHP', or 'PHP Suexec'. The latter solution results in each user owning his or her own files and results in increased filesystem permissions & security. The former solution that Network Solutions has been widely regarded as easily exploitable for years -- and something that almost all web hosting providers steer clear of. 

For some more information on the most recent Wordpress exploits and network solutions you can view some of the original posts from a few security related blogs below. Don't hesitate to comment in the new forum if you have any additional information our readers might enjoy hearing.

Network Solutions and security flaw

Securi: Details on Network Solutions Hack

The register: Network Solutions mops up after mass breach

A Final Note on Sharkspace S9C4

Wed, 31st March 2010, 17:40

Some clients of Sharkspace got a reminder today of why all hosting patrons need to keep their own back-ups of their data.

Yesterday morning started with the Sharkspace company network forum posting:

 Affecting Server - S9C4 | Priority - Critical

The server S9C4 will be taken offline shortly and a manual FSCK (file system check)will be completed to fix a file system error. We will keep you updated in this post.

And it went down hill from there. The FSCK became a hardware failure then the new hardware revealed corrupt data which then lead to corrupt back-ups. Numerous updates later ended with

 

A Final Note:
The server and backups are corrupt. At this point we are sending new welcome emails to clients. Please change your dns to the ones listed in the welcome email and restore your accounts from your personal backup.

We are extremely sorry and will provide a 1 yr account credit once things settle down to all affected clients....

While this downtime affected only the clients on one particular server, throughout the ordeal Sharkspace kept these clients well informed with regular updates in a most professional manner. The exact cause of the outage is still under investigation.

Review Sharkspace

Scratch Telecom Announces Permanent Shut Down in April

Tue, 30th March 2010, 17:59

Canadian Colocation and Web Hosting provider Scratch Telecom has announced that as of April 30 2010 they are permanently shutting down.

In an email sent to existing clients, management states in part “Due to a major dispute with Shaw Business Solutions, the Scratch Telecom Corporation will be ceasing operations as your hosting provider effective April 30, 2010 at 9:00AM (EST, GMT -5:00). The decision to move you to a more stable hosting provider was made with your best interests in mind due to the dispute seriously threatening network stability in the future. All billing packages to your account were canceled as of March 23, 2010 and you will not receive any further invoices from the Scratch Telecom Corporation.”

Scratch Telecom has made arrangements for clients to move their services to Priority Colo in Toronto. Many clients are facing a forty percent increase in cost.

Management continues stating in the email that “effective immediately we will be doing emergency support only via email. There may be higher delays in response than normal from both Priority Colo staff as well as Scratch Telecom staff due to the obvious inrush of inquiries we expect to see with regards to this unfortunate turn of events.”

HostJury is seeking clarification on the dispute with Shaw at the center of this announcement.

If the meantime if you are now seeking a new host you can check out some of the great hosts reviewed on HostJury

Wikipedia Failover *Fails*

Thu, 25th March 2010, 17:05

You may have noticed that Wikipedia was down yesterday which appears to be a result of a overheating problem in their European data center.

Wikpedia's tech blog states:

“Many of our servers turned off to protect themselves. As this impacted all Wikipedia and other projects access from European users, we were forced to move all user traffic to our Florida cluster, for which we have a standard quick failover procedure in place, that changes our DNS entries.

However, shortly after we did this failover switch, it turned out that this failover mechanism was now broken, causing the DNS resolution of Wikimedia sites to stop working globally. This problem was quickly resolved, but unfortunately it may take up to an hour before access is restored for everyone, due to caching effects.

We apologize for the inconvenience this has caused.” (end of quote)

In lay terms their back-up system failed then they had to wait for DNS propagation!

Data Center Knowledge states that Wikipedia houses about 50 servers in the EvoSwitch data center in Amsterdam. EvoSwitch is a 100,000 square foot data center supported by 20 megawatts of power capacity that is generated entirely from sustainable energy sources including, solar, wind and biomass. The facility uses free cooling (fresh air economization) to reduce its use of energy for air conditioning.

It’s not clear why the cooling system for the Wikipedia servers encountered problems yesterday but that may provide a clue that new technology is still not fail-proof.

In February the Wikimedia Foundation received a $2 million grant from Google, which it will use to expand its data centers.

 

GoDaddy Joins Google China Boycott

Thu, 25th March 2010, 16:50

Publicity swavy GoDaddy.com has announced that like Google, it too will be halting operations in China. While not likely a physical impediment to registration of cn domain names, it is a physiological hit to the image sensitive Chinese.

The decision by GoDaddy to limit its reselling of .CN domain names more than anything may have others following suit. There is already talk of Dell following suit. Public perception may pressure others to follow

WashingtonPost.com reports

GoDaddy.com Inc., the world’s largest domain name registration company, told lawmakers Wednesday that it will cease registering Web sites in China in response to intrusive new government rules that require applicants to provide extensive personal data, including photographs of themselves.
The rules, the company believes, are an effort by China to increase monitoring and surveillance of Web site content and could put individuals who register their sites with the firm at risk. The company also believes the rules will have a “chilling effect” on new domain name registrations.


The Godaddy announcement

“There appears to be a recent increase in China’s surveillance and monitoring of the Internet activities of its citizens,” said Christine Jones, general counsel for Go Daddy, at the Congressional- Executive Commission on China (CECC).
Jones said the new Chinese policies required every website owner to submit photographs, business information and individually signed forms, as well as their physical address, email address and telephone numbers.
“We didn’t want to act as an agent of the Chinese government,” Jones said. “We can’t let them be strong and us be weak all the time. We just have to stop it, and then we’ll start offering .CN domain names again.”

Hats off to GoDaddy on this one

CanSecWest in Vancouver hosts Pwn2Own on March 24, 2010

Sun, 7th March 2010, 14:22

The TippingPoint Zero Day Initiative has announced that the annual Pwn2Own contest is back again this year at the CanSecWest security conference held in Vancouver, BC on March 24th 2010.

As the contest name implies, if you successfully exploit a target you get to keep it along with a ZDI cash prize and related benefits. This is the 4th year running and to commemorate they have increased the total cash prize amount to $100,000 USD.

This year the competition will have two main technology targets. In keeping with tradition the first portion of the event will attempt to bring to light the current security posture of market-leading web browser and operating system pairings. The multifaceted web browser continues to occupy a critical presence on the client-side attack surface. As Adobe, Google, and an estimated 30 other companies affected in the Aurora incident can attest to, the security posture of these products merits a yearly public evaluation by the research community at large.

The second portion of Pwn2Own 2010 offers bounties for vulnerabilities affecting mobile phones. The increased presence and capabilities of smart phones has brought with it the same security issues and attention traditionally reserved for non hand-held platforms. Vulnerabilities in parsing media, dynamic web content, e-mail, and other client-side issues have been published in the past. Additionally, many of the communication protocols that mobile phones implement are the focus of a burgeoning field of security research. The data stored and communicated across these devices is increasing in value to attackers.

Registration

Pwn2Own will be held over the course of three days starting on March 24th with the browser and the mobile contests running concurrently. To register for the competition, send an e-mail to ZDI@tippingpoint.com. Competitors will be assigned a random half hour time slot.

 

Myriad Network having a myriad of problems

Thu, 25th February 2010, 21:35

It seems Myriad Network / EMC telecom are having a myriad of problems, mostly of the financial sort. I found this interesting post about the two while traversing the net -- we had written about how Myriad Network had been sold off to EMC telecom back in the day but now it seems the purchasing party never did pay up.

Worse, it seems they haven't paid their bandwidth bills to Cavecreek, their uplink as of yesterday and have been offline since as a result. The 'official' story is that they lost one of their core uplinks as a result of failed hardware. The proof is in the pudding however: Myriad Network / EMC telecom having a myriad of problems

In lieu of whatever lawsuit could follow as a result of these statements, understand that from what I've heard through the grapevine regarding EMC Telecom having shafted the ex-owners out of almost 100% of the payments owed to them for Myriad Network, it's a very sad situation. 100% of the previous team involved had a truly deep love for 100% of their clientbase and EMC telecom / the new Myriad Network owners simply acquired the company without paying a single dime while screwing every party involved. That's the honest truth from trusted, anonymous sources.

It's little surprise that EMC telecom is currently attempting to also screw their upstream provider out of over $25,000 in owed bills.
Update: It looks like they owe Chase bank $200,000 as well, interesting.

Westhost and VPS.net outages causing client problems

Tue, 23rd February 2010, 11:09

On Saturday, February 20th some routine testing of the Westhost / VPS.net datacenter's inergen fire suppressant system appear to have gone horribly wrong. According to the status updates it appears that the inergen system caused large amounts of data corruption & potential data loss. As of this time the Westhost / VPS.net teams are still working to resolve the entire issue but the ETA for resolution appears to getting continually pushed back.

Initially the Westhost clients were told that the issue would be resolved on Saturday evening but after a few days of the ETA being jostled around, many Westhost clients are beginning to doubt the story behind the outage. There's a great deal going on within the Westhost forums which you can peruse here: http://forums.westhost.com/showthread.php?t=14067

There's also a brief outage page detailing the problems that Westhost is currently experiencing. As of this time it appears that 100% of the vps.net systems are functional and restored in full, however an ETA for Westhost is still uncertan.

We're awaiting some addiitonal information from Inergen & a few other parties involved to see what their take on things are. Interestingly enough, the only reference to Inergen being able to cause any problems with hard-drives is a mention in the related Wikipedia article here: Inergen

Please note that the reference to it causing damage was added by an IP address owned by UK2group, the UK-based company that purchased Westhost in November of 2008


One particular client on the Westhost forums contacted Tyco, one of the major suppliers of Inergen (and one of the only suppliers of refills for the systems) and got this response:

I just had a call from Tyco (http://www.tycofireandsecurity.com/), the local suppliers of Inergen. Very interesting. They were very surprised that their product was being blamed for an outage like this.

 

They said - and I was talking with their country manager, seems they got very panicey about the reputation of their product - that in all but one case which is still undergoing review, outages due to discharge could be traced back to underlying causes, not the product itself. And in that one case that was still under investigation the HDDs still spun up, the servers just needed a reboot.

 

Basically, when Inergen is deployed, it must fill the room to a high percentage in a very short time. Thus the discharge of gas is at a quite high velocity. Due to this, in this country, all installations are discharge tested at installation & periodically thereafter.

 

He said they had seen incidents where the installation was not up to par, and during discharge other debris was blown in to servers etc. He also felt that in any enterprise DC - and I agree on this - levels of dust & other particulate matter should not accumulate to the point of being at risk of disrupting server operation. He did say he'd seen installations where discharge had blown peices of ceiling tile out...

 

So, the summary was that Inergen on it's own is very unlikely to have caused the outage. Airconditioning? Naturally it would have been shut down during the discharge, but unless it was one dude doing the test late at night & he went out for a coffee when the discharge occured, the aircons should have been brought back up in time to stop damage...even if the servers didn't shut themselves down when the temperature rose.

Wordpress outage affects over ten million sites!

Sat, 20th February 2010, 02:10

Today WordPress.com was down for approximately 110 minutes, their worst downtime outage in four years. The outage affected 10.2 million blogs and appears to have deprived those blogs of about 5.5 million pageviews.

Wordpress is still dusting itself off and gathering the details.

"It appears an unscheduled change to a core router by one of our datacenter providers messed up our network in a way we haven’t experienced before, and broke it the site" states Wordpress founder Matt Mullenweg.  He continued "It also broke all the mechanisms for failover between our locations in San Antonio and Chicago. All of your data was safe and secure, we just couldn’t serve it."

 "I know this sucked for you guys as much as it did for us — the entire team was on pins and needles trying to get your blogs back as soon as possible. I hope it will be much longer than four years before we face a problem like this again.

I'll bet!

Unlike some webhost, Wordpress continually provided status updates on both Twitter and the company blog and all sites appear to be up and running again

 

Not all hosts are created equal

Wed, 17th February 2010, 22:10

I came across a short article on the globe and mail about web hosting providers and not all of them being created equal. David McKendrick, CEO of Fused Network contributed some of the answers fielded by Mark Evans regarding web hosting.

“Just like cars, not all brands are created equal, and more often than not certain types can lead to a lot of headaches later on down the road,” he says. “The quality of service offered by a hosting company is quickly reflected in their service. If they cut corners and use lower quality hardware, support teams or network gear, the difference is often like night and day.” - David McKendrick

You can read more of the article on the globe and mail site, not all hosts created equal.

Search Engine Giants get Political

Thu, 21st January 2010, 20:08

A couple of developing news stories more reminiscent of the tit for tat that was associated with big governments of the cold war era. First Google announced in a blog post that it had been, or more specifically human rights activist mail accounts had been the target of sophisticated hacking attempts. The post then goes on to say, without saying, that the Chinese government was behind the hack. Therefore Google is rethinking it's deal with the devil and may even need to withdraw totally from China. Just a causal observation but I doubt this defense mechanism will deter the hackers hiding behind the great wall!

Next volley came a couple of days later when China's most widely used search engine, Baidu announced plans to sue Register.com after a January 12 attack that left Baidu's main search engine inaccessible for several hours. The fault of Register.com led to the malicious and unlawful altering of the domain name of Baidu, which made thousands of people unable to visit Baidu.com and brought serious losses to Baidu," the company stated.

Register.com responded on Thursday that the lawsuit filed by Baidu Inc. alleging the attack on its site was due to negligence by Register.com Inc. is "completely without merit. Register.com takes cyber-terrorism very seriously as we are working closely with federal law enforcement officials who are investigating this crime as well as the recent similar attacks on Twitter and Google," spokeswoman Alice McGillion said in a statement.

All Baidu searches were redirected to a home page carrying the message: This site has been hacked by Iranian Cyber Army. The Iranian embassy in Beijing rejects any speculation of a connection between the hackers and the Iranian government, and roundly condemned the attack, according to a Chinese state television report.

baidu_hacked

The security blog Praetorian Prefect states that the IP address baidu.com points to was temporarily routed to 174.121.0.7 via ISP ThePlanet.com . The site normally shows sites in Beijing, China. It appears that the defacement site was hosted at a couple of different places. Two other domain names are referenced on the page: cyberarmyofiran.com and ircarmy.com. The first, IP 70.35.29.162, shows hosting by Netfirms in Markham Ontario in Canada. The second, ircarmy.com, is at IP 69.147.83.188, showing hosting by Yahoo in Sunnyvalue, California.

Just another casual observation but lately some influential types have expressed concern over China's cozy relationship with the Iranian government. I suspect the story will continue to unfold.

Hackers Hit Web Host Network Solutions

Thu, 21st January 2010, 00:50

Hackers have managed to deface several hundred Web sites hosted by Network Solutions, the company said Tuesday.  Network Solutions stated that it is monitoring this threat and working with law enforcement organizations while it works to restore the impacted sites.


Network Solutions described the incident as a "limited attack on websites hosted on Network Solutions Unix servers." Several servers were hit and "intruders were able to get through by using a file inclusion technique," a blog post on the company site stated.
Remote file inclusion attacks are a relatively common way of exploiting buggy Web server programming in order to run unauthorized content on the server. "Our preliminary investigation indicates that the source of entry was through a single site," said spokeswoman Susan Wade


One Network Solutions customer Lucina Mastro learned Sunday that someone had crawled the folders on the Web site she maintains and replaced all of the index.html and main.html files with new files claiming that the defacement was "For Palestine."
Mastro, a volunteer web administrator for a church in San Francisco, replaced the files from backup. That seemed to fix the problem, she said.


Harry Brooks, another Network Solutions client was not so lucky. He learned that one of the sites he oversees had been hacked with a similar defacement Monday, and restored the site from backup, only to learn that it had been defaced anew on Tuesday, apparently by someone else.
The second defacement made no mention of Palestine, but said simply "Server Is RooT!"