Slashdot Mirror

http://code.sixapart.com/trac/TheSchwartz

It's not always obvious when an account is a shill on twitter.

For instance, did you know that the twitter account memcached is a shill for a company named Gear6 rather than an official twitter by the memcached team or Danga Interactive's owner, Sixapart?

It HAS to make some files it creates, writable, in order to create an output file of results I imagine...

I don't care if it makes them writable. It should not have to make them world-writable. Big difference there.

Writable means someone can write to them -- usually the user who created the file.

World-writable means anyone can write to them -- including anonymous/guest accounts, system services that aren't supposed to write to anything, or even just another user who isn't supposed to have admin rights.

THIS IS A SECURITY RISK? Come on...

Yes, I would say so.

Your casual "come on" statement comes up against decades of best practices in Unix, as well as some opinions by some people in security that I actually know of and respect. It's so obvious a bad idea that I can see it for myself, too -- I don't even need a second opinion.

And even if I ran it, what would it prove? If they can't even secure their own security-testing program, I'd say any results they come up with are suspect.

No, that's not a way of "getting out of a bad score" -- even if I got an incredibly good score, I would question the results. I wouldn't just use them to push an agenda, the way you seem to be.

You've got to be kidding me man... then, just install SUN's JVM, install the program & run it...... & then uninstall it.

So your solution to wanting me to run an obviously insecure program is to uninstall it when I'm done?

You're kidding, right?

In that case, I have a challenge for you: Here's a link I found in my spam. Go ahead and download that file, and run it. Then uninstall it. Your system should be secure again, right?

If you aren't willing to do that, you should be able to understand why I'm not willing to download some random, stupidly-insecure program to test my machine.

If you are willing to do that, I imagine you'll get an object lesson in how spyware works.

I don't see how that matters, as long as you were modded up for reasons other than "funny" or "karma" (these 2, to myself @ least, don't mean much - technical points mods, however, do)!

Not that I expect it to change your mind, but registered users get a whole bunch of preferences like that. If you wanted to, you could actually set funny and karma bonuses to have 0 effect on a post's apparent score to you, or even a negative effect.

If you look at their blogsite you will find Microsoft mentioned in there. http://www.sixapart.com/ gives this on netcraft wich i find perticularly interesting....: "a.microsoft.com Microsoft Corporation, One Microsoft Way, Redmond, 98052, United States January 2005 AkamaiGHost" ...etc, the list goes on and it looks like an effort to hide something. Are they affiliated with Microsoft in any way as this suggests its much worse than some stupid prank.

It's interesting to see that the change that changed these promises is publically-accessible. What's also interesting is that the person who made that commit is, so it appears, one of the many former LiveJournal staff that jumped ship after the Six Apart sellout due to exactly this kind of bullshit. From Brad Fitzpatrick's recent reactions to this kind of announcement, it wouldn't surprise me if he was to make some kind of grand exit in the near future, especially given that he's recently been making a big deal about getting other people's GPL-licenced contributions into the ex-Danga now-6A-run open source projects to ensure that 6A can't relicence them.

Movable Type can run on Postgresql. Create an installation of Movable Type using Postgresql. Export the posts from your MySQL Movable Type installation and import them into your Postgresql Movable Type installation.

If it's a question of moving to WordPress, there are many who have made the switch before you and some have even supplied instructions.

If what you're really looking for is a one-click method to make the shift, maybe you should reconsider your future in IT.

Movable Type can run on Postgresql. Create an installation of Movable Type using Postgresql. Export the posts from your MySQL Movable Type installation and import them into your Postgresql Movable Type installation.

If it's a question of moving to WordPress, there are many who have made the switch before you and some have even supplied instructions.

If what you're really looking for is a one-click method to make the shift, maybe you should reconsider your future in IT.

Movable Type can run on Postgresql. Create an installation of Movable Type using Postgresql. Export the posts from your MySQL Movable Type installation and import them into your Postgresql Movable Type installation.

If it's a question of moving to WordPress, there are many who have made the switch before you and some have even supplied instructions.

If what you're really looking for is a one-click method to make the shift, maybe you should reconsider your future in IT.

"An option for /. readers is to host a blog on your own site ..." But if you use a blog service you still rely on them some of the time to generate the pages to send to your server. It isn't as much load as hosting pages, but it is probably still significant. The ideal option would to use a blog tool that is hosted and runs off your server. My Yahoo website includes MoveableType (http://www.sixapart.com/movabletype/pricing). I haven't used it yet, but it seems OK. For non-Yahoo users it is fairly expensive.

Your summary implies that the latest Typepad outage has something to do with their datacenter move of October. It does not. They had a hard drive problem that they noticed during routine maintenance.

Serious bloggers usually use software such as Wordpress or MovableType to blog. Both of those have RSS feeds built in. Six Apart actually owns LiveJournal and the web-based version of MT called TypePad.

I'm not saying LJ and Blogger users aren't serious, and all users of WP or MT are. Just stating what is the "norm."

Ever since a year ago, when I was laid off, I've been contracting for companies who need CMS software. I've tried a LOT of them at this point.

Agitar Software uses Movable Type to power their site. It's a corporate site, not really a blog. I added a boatload of PHP statements to the MT templates, so that it would provide i18n (the pages get generated with PHP code in them, then they become dynamic PHP files on the server). Unfortunately, we don't do much with the i18n yet. No matter what you pick, it's in English. But we've got a translation firm on the hook, so that will change. I also work on Developer Testing, which is far, far more bloggy (also uses MT).

Mill Valley Film Festival uses Drupal. It isn't really bloggy, but on the backend, that's how it works. There are a few "blogs" available (such as "Film Listings"), and the staff add in entries. I also have just started a very basic drupal blog for my daughter's class.

I have a boatload of other blog-like sites I maintain (mostly using Mambo & Joomla), and I've even open-sourced some software to turn phpBB into a blogging system.

So, with some credentials out of the way, here's my impressions.

First, Movable Type is archaic, even with the new 3.2 update. It's great for old-school Web publishing, where the main players know a few HTML tags and dynamic publishing isn't terribly urgent. Yes, MT can do dynamic publishing, but there are other systems that do that waaaaayyy better. So its strength is more along the lines of "update & release, update & release."

It has hard-coded fields, but you can muck around with them (moreso in 3.2). We use those fields for features that don't really tie into the fields anymore. For example, when a user wants to control the URL of an entry, he/she fills out our keywords field. It's just how the solutions have evolved.

I think MT is weakest at looping through entries. The entire scoping system is arbitrary. Some plugins sometimes return global loops, other times narrowly-scoped loops, which can be really not-fun to learn about. Overall, Movable Type seems to me to be a workhorse, reliable, but old and no longer well-devised.

Drupal is very frustrating. The template system is rigid. The PHPTemplate plugin helps. I used it exclusively on mvff.com. But it still requires a huge investment into figuring out how it works. In some cases, I ended up posting support questions and then later answering them myself on drupal.org -- partly because the forums are quiet, and partly because I was pushing the system waaaayy more than the bulk of users do. But what's surprising is that I wasn't doing much. You can see that from mvff.com -- it's just a film Web site. It's not highly sophisticated. If you're going to be building a typical site and the system requires so much tweaking that you become a bleeding-edge pioneer for it, that's a bit much. Drupal is too technical for the average blogger.

What Drupal does well is the plugin system. A default install of Drupal comes with a boatload of plugins. Want forums? Just click a button. Want blogs? Click a button. Want an image gallery? Click a button. For example, with the school blog that I built using Drupal, I went with almost all of the defaults, and it was a lot easier to setup. It took maybe 3 hours from start to finish. It also looks really plain and doesn't do much, however. And I'm still having trouble getting the TinyMCE HTML GUI to work properly on that system. I don't know why yet.

Joomla seems to be the best of both worlds -- a fair balance of tradeoffs on the technical side, but also a backend control pa

I use moveable type at my http://www.quarterlifeliving.com/ blog... I tried WordPress (cause its free) and didn't meet my needs at all. It was way to simple. What I love about movabletype are the plugins, using the BigApi (or something like that, can't remember now) which allows you to modify almost ever UI component. I then using Ajaxify http://www.sixapart.com/pronet/plugins/plugin/ajax ify.html to get a AJAX wysiwyg editoring.. Tons of plug-ins come out all the time.. I love it.. Check out all the plug-ins here http://www.sixapart.com/pronet/plugins/all.html

I use moveable type at my http://www.quarterlifeliving.com/ blog... I tried WordPress (cause its free) and didn't meet my needs at all. It was way to simple. What I love about movabletype are the plugins, using the BigApi (or something like that, can't remember now) which allows you to modify almost ever UI component. I then using Ajaxify http://www.sixapart.com/pronet/plugins/plugin/ajax ify.html to get a AJAX wysiwyg editoring.. Tons of plug-ins come out all the time.. I love it.. Check out all the plug-ins here http://www.sixapart.com/pronet/plugins/all.html

Look at Six Apart's next-generation blogging tool, Project Comet. It emphasizes not only sharing, but also ways to limit access to a small group.

To be honest, the RSS vs. Atom thing is a lot like DVD+R and DVD-R - at this point they might as well be interchangeable.

Just about every feed parser handles both Atom and RSS feeds. Using a tool like Magpie RSS (PHP) or the Universal Feed Parser (Python) the format of any given feed is entirely transparent to application developers. RSS 1.0? RSS 2.0? Atom 0.3? It all gets processed by the parser in a nearly identical way.

Already tools like Movable Type/Typepad or WordPress generate both RSS and Atom feeds by default. The vast majority of users don't know and don't care which feed format they're reading so long as it works. Both the toolkits and the applications use both formats and there's really little reason why they can't continue to support both.

There doesn't have to be a single "winner" in the syndication feed wars. Atom and RSS can exist together for some time, and arguing that this is a zero-sum game in which one and only one feed format can exist is ridiculous. As long as the difference is transparent to end users, and relatively transparent to developers, neither format will totally conquer the other.

But the point is that it isn't a product for sale, and they do not have or even need a "customer" relationship. It is given away for free by volunteers, and they aren't required to donate their money too, just because they donated their time. That would be like some hobo at a soup kitchen complaining that he had to walk a few miles to get his free meal instead of being driven by one of the volunteers.

since everyone bitches about how they have no content, let's see how many present their content, or rather: how many are black text on white background...

EVIL

* underlined+bold
* drop shadow
* cream background, not much of an improvement. some of the header text is glossy (shiney / embossed / see above one / other various "auto-artistic" trash ).
* the tiny images illustrating each entry, are dithered (i guess with a "web palette" [making it look even more horrible], which people stopped doing 5+ years ago) then jpg'd.
* cyan background (the name of 100% green + 100% blue)
* purple text, orange links. no, that's not better.
* yes i really want to be tortured with your family album pics
* half of the people leave directly (or die) with the header
* light yellow (piss-water yellow?) background.
* "I.Mter-
views" ?
i don't get it. dashes in headlines are satan.
* scary vector portrait
* horrible. evil. tasteless.
* scarier than the sixapart girl.
* yellow background.

GOOD

* pear/white background. title with first letter biggie, first line in different font from rest.
* greenish tasty tone over everything ...which i didn't follow. great. thanks. as for the equally bad link-colours being that horrible default-blue/purple, it was only around 10%. this was checking 70% of the a-list. methinks those popular people should hire someone to design their site

good design = pyros, don't remember any other. and yeah, it's not a blog.
says intersting things = ms g33k. who i'm not sure is a good thing to link, i won't link myself.

My problem is that LiveJournal *is* SixApart, makers of TypeKey. So why not just convert LJ accounts to TypeKey ones?

(it's not that easy, of course, but it would have made more sense to me to use your parent company's SSO technology than to implement a new one)

looks like Movable Type

I don't think Yahoo! has ever been a dot.has.been. Yahoo! is such a large company that they are perceived as a somewhat faceless corporate behemoth (at least among techies). Google, on the other hand is perceived as a more nimble, dynamic and adaptable company. Google is, of course, much smaller than Yahoo!, but still quite a large company (1900+ employees).

For techie folks who follow the Yahoo! bloggers, that "faceless" perception of Yahoo! is changing I think. Ironically, Google is beginning to appear a bit like a faceless corporation in the way they present themselves on the Web. Anyone who reads Google's official blog can't fail to notice how phoney and vapid it sometimes seems. As if each entry that's been posted has been run through a "press-release" language filter (I wonder if every entry is vetted before being posted). The other aspect is their secrecy - this is understandable to an extent. For me, the problem lies with their purchase of Blogger - I wish they would give some hint of what they plan to do with the service. Nothing has been announced or information given on the direction of the service - meanwhile, other companies like Six Apart are forging ahead with new features and growing mindshare. Now, Yahoo! is jumping into the fray with their imminent launch of Yahoo! 360.

I really dislike the new re-design of Google groups. I'm sure they must have done some user-testing on this, but it just seems like a leap backwards in many respects from their previous design.

Finally, I'm sure that Google remains the default search for many people, but I have noticed that other search engines like Alltheweb and Yahoo! Search often give comparable results. I don't think one can say (with as much certainty as in the past) that Google always provides the best search results. As an example, compare a search for the terms Open Source Usability on Google, Yahoo! and AlltheWeb. Not much to choose between them.

MT-Blacklist Stats
Comment spams blocked: 7091
Comment spams moderated: 3864
Duplicates blocked: 8
Blacklist - Strings: 3039
Blacklist - URLPatterns: 33
Blacklist - Regexes: 24
Blacklist - FlexProtect: 0
Blacklist - Pending: N/A

I'll second that. Read about Rich Text Editing and Spell Check Come to TypePad and thats pretty much what the dog was designed for when I was working for sausage back in '95.

The key difference is that with a server based model you have a simplified platform (browser) compared to targeting an operating system (MS Windows) with a binary.

See press release.

So the official press release is lying about SA acquiring Danga?

More specifically, Six Apart purchased LiveJournal because of each companies respective strengths and weaknesses and because LiveJournals user base would complement Six Aparts business model by getting access to a younger user base. All that and the owner of LiveJournal was looking to sell. Read Mena's (President of Six Apart) blog for specifics and a handy FAQ.

And if what you and Brad say wasn't enough, there's always Six Apart's own statement:
"Q. What is going to happen to LiveJournal and its current users?

A. We acquired LiveJournal because we like LiveJournal just the way it is -- it's an awesome product. We will invest in the further development of LiveJournal and help it expand its reach around the globe but our plans do not include removing the free level, plastering the sites with ads, owning user content, etc... We think the LiveJournal community is unique and vibrant. We welcome LiveJournal users to the Six Apart family, and promise to keep the LiveJournal culture and quality which has earned their devotion. " (full text here)

But then again this is /., where everyone jumps to assumptions without RingTFA. Or using the product, for that matter.

Here's an interesting blog post by Mena, President of Six Apart. I thought the following quote was interesting in the context of the typical "bloggerz sux0r" threads you see on slashdot:

I believe that LiveJournal has, unfortunately, received a bum rap because many have considered the postings on LiveJournal to be trivial. It's sort of like a vicious circle: Journalists make fun of webloggers saying that they only post about their cats, webloggers make fun of LiveJournalers saying that they only post about high school angst and LiveJournalers make fun of webloggers saying that they are SUV-driving yuppies who think they have something important to say (and I'm generalizing). The fact is, webloggers and LiveJournalers are in essence doing the same thing: they are posting their thoughts to people who are important to them. For some webloggers, it's 100,000 people, for others it is 10. For LiveJournalers, it may be 30 people, it may be 3 (or a combination of some number).

• Weblogging Software Leader Six Apart Acquires LiveJournal
• Six Apart bought LiveJournal!
• LiveJournal and Six Aart

Live Journal Confirms the reports http://www.livejournal.com/users/news/82926.html Six Apart reoprts here: http://www.sixapart.com/corner/archives/2005/01/cu rrent_mood_op.shtml http://www.sixapart.com/press/livejournal_acquisit ion_faq.shtml and http://www.sixapart.com/press/weblogging_software_ leader_six_apar.shtml

Live Journal Confirms the reports http://www.livejournal.com/users/news/82926.html Six Apart reoprts here: http://www.sixapart.com/corner/archives/2005/01/cu rrent_mood_op.shtml http://www.sixapart.com/press/livejournal_acquisit ion_faq.shtml and http://www.sixapart.com/press/weblogging_software_ leader_six_apar.shtml

Live Journal Confirms the reports http://www.livejournal.com/users/news/82926.html Six Apart reoprts here: http://www.sixapart.com/corner/archives/2005/01/cu rrent_mood_op.shtml http://www.sixapart.com/press/livejournal_acquisit ion_faq.shtml and http://www.sixapart.com/press/weblogging_software_ leader_six_apar.shtml

If you're doing shared hosting and you allow your users to run CGIs-- regardless of what CGI it is-- you should have reasonable limits in place that keep child processes in check. Apache has had such directives for doing this for some time, one of them being RLimitNPROC. This directive allows you to limit the number of subprocesses that Apache will run concurrently.

You can even specify subprocess limits on a per-virtual host basis. With Apache 2, you can even limit based on directory. Using RLimitMEM is also a good idea.

Yes, MT's comment system can use some improvement. We're working on that. But these servers are getting hammered; in effect a denial-of-service style attack.

Even a "Hello, world" type script can be hit hard enough to bring down a server, assuming there are no process limits in place. Invoking a modern interpreter to execute a CGI script is no small feat. Perl, Python, Ruby, and even PHP (when run as a CGI as many shared hosting companies do for security reasons) consume enormous amounts of resources at startup regardless of the size or complexity of the script they are summoned to execute.

So, sure, code can be added to MT to recognize and adapt to a flood of comments coming in, but by the time the CGI runs, it's already chewing up CPU and memory. In my opinion, a better defense for these flood-style attacks is for Apache itself (or third-party in-memory Apache modules) to handle such situations.

mod_security, mod_dosevasive and others are excellent defensive tools for any public Apache server admin to use.

I'd love to know what others have done to configure Apache to prevent denial-of-service attacks.

You can't just give a false email address because they send a confirmation email to the address with a link in it that you need to click in order to complete your registration. I would suggest using a throw-away @yahoo.com address.

Today, Six Apart responded to the comments, making some changes based on feedback and clarified the things that they didn't communicate well.

I've written my feelings already: pre- and post-clarification

Anyone who cares to chime in and let Six Apart know how they feel should both weigh in vie Trackbacks to Mena's post on http://sixapart.com/corner/ and chime in at the support forums and http://www.movabletype.org/support/index.php?s=73e 99f66b1894f2bafe8c17f192d13d6&act=ST&f=11&t=40800& st=32&#entry182353 in particular.

AFAI understand, the main reason why there's a lot of bitching going on against the MT authors is that they were using their loyal users to beta-test their new MT release (3.0) while keeping them under the mistaken impression it was going to remain free. I quote from one blog:

No business ethics problems? How about this.

You ready a beta release of a piece of software, and ask people to beta test it. Mention nothing about paying, or even that you are considering changing the license. Being the loyal folks they are, lots say "OK" and you give them the software. They upgrade to it, and there's no way to downgrade.

Then, about 5 weeks later, you say, "Oh, by the way, most of you will have to pay to upgrade out of beta". Keeping in mind that most of the people who are the most loyal to MT, and therefore the most likely to have signed up for the beta program, are the ones who take MT to its' limits by using multiple blogs for things like link sidebars, book reviews, photoblogs, etc., and a lot of them no longer qualify for the free version because of the three blog limit.

You've just stranded a whole bunch of people on a beta version of your software, and you're basically extorting them to allow them to upgrade to a non-beta release.

It does look like SixApart have shot themselves in the foot and alienated themselves from their fanbase. They have violated the golden role of starting to charge for something that was previously free. In the world of tech where everyone wants the latest and greatest (and MT users are particularly tech-savvy given the requirements to install and maintain the software), this was always going to be an unpopular decision. How could they not have foreseen this?

The launch of their TypePad service last year (which is basically a fully commercial, hosted MT package with bells and whistles like photo gallery management) was a smart business move; make a service out of your product, and keep the original product free. This latest move, though, is beyond comprehension and will only hurt them. It will sure be interesting to see how they backpedal from this.

No, it's crippled because (from the site):

# No promotion of your weblogs through the Recently Updated list

# No commercial usage

# No more than one author and three weblogs

AFAIK these were part of the old MT package before this pricing scheme was launched. Hence, crippled.

There's no bait or switch going on here at all. There is still a free version available, it's not crippled in any way:

There is a free version of Movable Type, available on our site, which like all versions of Movable Type consists of the exact same code. There's no crippleware, no nagware. We trust you. We never said this is the last free version of Movable Type.

The only thing this does is a) allow SixApart to eat, and b) allow large corporations to buy MT. I know plenty of organisations that want to use it, but couldn't even look at it until it cost more than nothing. Many procurement processes can't deal with Free.

From backroom hobby to multinational company in three years: Good for them, frankly.

The post containing the rationale for the licensing change contains hundreds of trackbacks from the MT community. Guess what most of them are saying.

Allow me to introduce you to TypeKey...

Barring that, they'll spam the next communication medium... website comments.

MT pro is just around the corner, and I am so happy with 2.64, I am just dying to see the pro version:

Exactly.

To the Mozilla Developers. Take this opportunity to be radical. Let's go back and view what the browser is and what it could be. I suggest that they take a look at things like:
DashBoard.
Haystack
and Echo.
Information begs to be consolidated and made useful. We can do more with the browser then just view static stateless pages.

About.com is an example large scale site using Moveable Type.