WordPress attack - lessons from my personal security review

This week there's a  brute force password attack on WordPress sites. That inspired my security review, here are a few things I learned doing it:

• I again appreciated the FileMaker database I've used since 1997 to track my net credentials. I dump data from it to a now dated version of 1Password, but it's hard to beat the ease of searching and editing my own repository. It lives on an encrypted disk image on my local machine.
• It's easy to end up with orphan WordPress instances. I have one on Wordpress.com and two on my Dreamhost account, but I only use http://www.kateva.org/sh/. It archives my Pinboard/App.net shares; one day, if I figure out how to do it, I may append my old Google Reader shares (json).
• I had a strong password on the wordpress.com account, but only pretty-good on my other two and they had the same pw. I upped both to very strong but still typable. I will have to review how IFTTT connects to kateva.org/sh -- obviously there are big security risk with many uses of IFTTT. 
• I'd been keeping my WordPress blog software current (Dreamhost makes that easy!) but not the plug-ins and themes.
• I'd changed a theme on one blog recently, and today I learned it didn't include a log-in link! I was briefly shut out, but a bit of web research turned up kateva.org/sh/wp-admin.

The most important thing I learned is that it's not trivial to safely delete a self-hosted WordPress blog. Yikes! No wonder there are lots of vulnerable old blogs lying around for the taking. WordPress.com blogs have a delete tool, but not self-hosted sites. Things can get nasty here -- two WordPress blogs can share the same database, so deletion must be done carefully. Reading some Google hits this is a very unsolved problem with lots of confusion.

We need a fix WordPress.org and we need it very soon. Dreamhost, you could help too.

Google Reader: More like this

Sad moment in the last days of Google Reader -- I'd forgotten about the 'more like this' item in the Folder Settings (and Feed Settings) dropdown ...

Note the Translation services, and ability to create a 'bundle' (shareable set of feeds made of all the feeds contained in the Folder).

There's so much in Google Reader that most users never saw.

Today's Aperture bugs: Empty Projects, Repeated Facebook Albums (Bonus: fixed screensaver)

Aperture gave me two bugs today. Or maybe three.

One I've seen before. I move an Event, Aperture chugs along, and the Event shows no images. There's no way to make them reappear, but if I restart Aperture they're back. It happened several times today, so I ran "Select Repair Database". I don't know if this will help. 

This is, of course, a rather nasty bug. It would be easy to delete a seemingly empty project and lose all of its photos. [1]

My second bug concerned the drop down list of Facebook albums available from the Facebook publish dialog. Each album was repeated 4 or more times. That I fixed by deleting my Facebook account and restoring it.

There's a related Facebook bug, but this one came, I think, with a Facebook change. When publishing to Facebook Aperture's share settings are ignored. Albums are always private, you have to make them visible from Facebook. This has been broken for months, and Apple hasn't issued a fix, so I suppose it's a joint bug.

[1] Tip: If you configure Aperture to display the number of images in Project you'll at least see that number, even if none of the images can be seen. Still, I do wonder if I've deleted images in the past due to this old bug.

Update 3/17/2013: Subsequently I also ran permissions repair. I can't say whether it was upgrading to 10.8.3 or this work, but my OS X Aperture smart album based screen saver/slideshow has now worked for two days. I think that's a record.

It wasn't obvious at first, but I also discovered 60 thumbnail sized images in 'Rejected' folder with file names like: "4206_76697672461_1778151_n (1).jpg". They are assigned batches of dates that don't match the image date. I was able to find the five of them full sized in my Library, so I was reassured that these were truly garbage and I deleted them.

Clearly the repair process did something.

I've set a reminder in my calendar to do an Aperture database repair every four weeks as a routine preventive measure.

Update 3/21/2013: I think the library database repair MAY have helped my screensaver bug, but it didn't fix the empty folder bug. I just moved a project from one folder to another, and after the move Aperture wouldn't display its images. Again, having the image count display by the Project is a potential lifesaver. Nasty nasty bug.

iOS Contacts search annoyances

There are two things to be aware of about Contacts search in iOS:

• If you search from Contacts.app iOS will search both person name and business name.
• If you search from global (spotlight) search iOS will only search one of these, depending on Contact type.

This is sufficiently weird and inconsistent that it may qualify as a bug.

In general search on iOS is "annoying". PalmOS did a much better job in 1997.

Mountain Lion Recovery Partition Disk Utility Drive Repair - Unlock the Encrypted Drive with Admin Password

Even after I figured this out I couldn't find Apple's documentation on this. (Yeah, worrisome.)

I first noticed a problem after attempts to run VirtualBox on my 128GB SSD MacBook Air. We first tried a Win7 .vbox and ran into some network issues, then I tried a smaller sized XP .vhd image. The latter worked, though getting VirtualBox to use the .vhd was a bit odd; I think I did better ignoring the few web references I could find and simply telling VB to create a new XP image then selecting the .VHD when asked for drive.

After that process I checked available disk space, and the Finder said I had a 120GB drive with 228GB available.

Uh-oh.

So I ran Disk Utility and found I had about 58GB free but my drive was corrupted due to "incorrect number of file hard links". DU told me to boot into the ML Recovery Partition and run Disk Repair.

When I did that though, my OS drive appeared grayed out. I could see other non-gray items I could "repair" but that did nothing.

So why was it grayed out?

My guess was encryption. Even so, Google was no help. I did see that the Disk Utility toolbar had a new icon however, one called, I think, Unlock. I clicked on it and was invited to enter a password -- but not, curiously, a user name. I entered my admin pw and that worked. (This smells like a security hole btw -- not asking the un is weird. I suspect I could have turned off File Vault encryption first and avoided this mystery.)

After I did that my system drive was no longer grayed out. I ran Disk Utility repair and it said the drive was better; I ran verification twice to check.

On restart, however the Finder still has the wrong amount of Free Space -- though now Disk Utility says the drive is fine.

So I'm not entirely happy. But at least I've documented how Disk Utility Unlock works from the recovery partition.

Update: The VirtualBox VHD thinks it has a 127GB hard drive. Disk Utility says I have 69GB free. I'm suspicious that a hard link in the Virtual Box is messing up the Finder, but I can't find anything on this...

Tools for diagramming and sketching on Windows

Windows is a broken and barren desert of malware and spyware, but I still need to work in it. Alas, I can't switch at work (yet).

So, when I'm looking for better ways to diagram and sketch, I can't choose from the rich world of Mac alternatives, much less from iOS tools. I need something that will work on Windows -- or on a web platform our corporate software doesn't block (alas, Evernote).

I'm working on my options, but fwiw here's a list I'm assembling. I'll update it with whatever I like, while striking out those I've considered and eliminated.

Windows 

• OneNote 2010: popular, but tied to Office
• SnagIt Editor
• PowerPoint: Too awkward to just use for diagrams.
• Visio: Expensive, clumsy, overpowered, relearning curve with infrequent use.

Web

• Google Drawings: Current favorite
• Lucidchart (Google Drive/Apps): $$
• Gliffy Online
• Balsamiq Mockups (wireframe)
• Creately

Mac/Win

• Pencil Project - GPL, no documentation, no help file. Couldn't figure out rounded corner.
• Dia - GNOME Live! - Visio like
• yEd - Graph Editor
• ConceptDraw Pro $200

Apple's iCloud control panel enables iCloud Contacts within corporate Outlook

iCloud support is limited to relatively new Macs able to at least run Lion. Practically speaking, Mountain Lion.

Apple is kinder to the Windows world. The iCloud Control Panel will run on Outlook 2007 or later on any old OS.

I suppose they don't have the same sales incentives on the Windows platform. In any event, it seems to work very much like the old MobileMe Control Panel, at least when it comes to Contacts. I installed it on a Win 7 laptop running Outlook 2007 that syncs to Exchange Server and I now have full access to my iPhone/Mac Contacts.

It works by creating a new account, separate from the Exchange account. There are few install options -- you have to sync Calendar, Contacts and Reminders (but not Notes). Just like MobileMe [2] (I suspect some shared code). It also creates an IMAP account.

I had some glitches on installation and had to fiddle with restarting both the Control Panel and Outlook 2007, but now it seems stable. I didn't want the IMAP service so I canceled out of the credentials prompt and deleted the IMAP account.

There's no way to turn off Reminders, so I now sync my iPhone reminders in some puzzling ways -- basically via ActiveSync/Exchange for one set of reminders, via this method for the iCloud set. Weird.

Contacts is what I was interested in and it seems to work. Since Outlook allows only one Group per Contact, and iCloud allows many [1] there are potential problems related to Group assignment. In the case of MobileMe this didn't seem to break anything.

It's great to have all my Contacts at hand, and to able to quickly add to them. As an extra bennie, I get to use Outlook's Contact views. They are old and complex, but they are far more powerful than anything Apple gives me.

[1] Group relationships are kind of messed up between iOS and OS X, but Apple has bigger problems.
[2] At one time MobileMe Control Panel could work with Outlook/Exchange, but then it coulnd't -- which made things hard. This version can, perhaps because it creates a new local account.