Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

Today, the whole word is going gaga over "Opera Unite", the new technology in Opera 10 which will make your web browser a web server as well (and not just that, it will make a whole lot of “sharing” options available). Well, I’m not so excited about it. Technology wise, it is really cool but what they don’t realize is that this is like giving motorized chain-saw or a swiss army knife in the hands of a two-year old. Seriously, majority of the people around the world who get themselves into all sorts of shit while just plain surfing the net, now got a whole new array of avenues where they can be exploited upon. For people who do need a webserver, there are plenty of straight-forward point and click options available. I hope they atleast have options to completely turn it off and even better, keep it turned off by default.

© Shantanu Goel | Opera Web Server In A Browser: Bad Idea

Related posts

• Migrating From PHP4 To PHP5: Solving WP-Cache (and maybe other) Issues (1)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

I have a coupon to give away for the excellent SiteGround Web Hosting. This coupon will take off 20$ from anything you want to buy from them. If you have an existing website with them, then also you can use this to take off 20$ from your bill. So, what do you have to do? Just follow the 2 simple steps listed below, and I’ll choose one lucky winner at random to give it away.

Step 1. Subscribe (free) to receive this blog’s updates through email using the subscribe through email box on the right (which reads “Free Email Updates”).

Step 2. Leave a comment on this post mentioning your email ID with which you registered so that I know that you have registered (you can leave a small part of your username in your email ID if you want).

Then just sit back and relax, or better still, read a few other nice posts on my blog and comment on them . I’ll choose the winner in a few days and let you guys know right here. So, stay tuned.

What are you waiting for? I’d get those fingers moving if I were you . Good Luck.

© Shantanu Goel | Contest: Free 20$ SiteGround Web Hosting Coupon

Related posts

• TIP: Free Downloads For Windows Vista, XP Professional, Visual Studio 2008, MSDN And Much More (8)
• Idea Factory: Some Of My Latest Musings (2)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

A webhost that puts building relationships with customers before making money is definitely a good webhost. And this works out to be good for you as well as the webhost in the end. Now, why am I saying this all which should be part of a “Doing Business 101” course. Because, in this world of unprofessional webhosting, where people lure you with fool’s gold, promising everything unlimited and cutting you off with even the slightest of deviation from their “AUP” mumbo jumbo,  there still exist good webhosts which promise you very little but are good enough to deliver on them and then some more.

I had this experience with my webhost just a couple of days back. My site was being hammered by 100s and 1000s of visitors from stumbleupon, digg, linux.com, linuxtoday, lxer, lifehacker, etc all at the same time. Needless to say I ran out of my 15 GB monthly bandwidth in no time. So many visitors coming but finding a mundane “509 Bandwidth exceeded” error. Alas!

I mailed my host that I was willing to pay a bit more to get some more bandwidth per month so that this doesnt occur in the future. I woke up in the morning and found a one-liner reply in my box that made my day “Increased monthly limit to 20 GB”. Without any charge. Even though I was willing to pay and  had told them so. And already I’m paying a very measly amount for my hosting (20$ per year) so they are not retaining a BIG customer as well. I’m just a tiny fish. If that is not the sign of a good webhost then I don’t know what is.

You must be curious who my webhost is (those of you already haven’t whois’ed it). Well, the host is Real Value Hosting. Do visit them. We need to have more hosters like them.

Disclaimer: The link above is my affiliate link. If you like the stuff I write, click on it, if you don’t you are free to remove the affiliate code from it. Regardless of what you do, please make sure to visit realvaluehosting once. They are indeed very good and this review is not at all paid, sponsored or solicited by them in any sense. This is just the only way I thought I could show them a bit of gratitude I have for them.

© Shantanu Goel | A Friend In Need Is A Good Webhost Indeed

Related posts

• Looking for a Host – For a Party that you will throw (2)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

Update: In a thread about this post at Dropbox forums, it was brought to my notice that Dropbox has now changed its terms to remove the objectionable clause.

If you use dropbox (A popular online storage service with free 2 GB space), and use (or intend to use) its public or shared folders feature, then you must know something about the EULA (End Users’ LIcense Agreement). Yes, the one that you clicked “I Agree” on, without even reading one word of. Basically, you need to know the following lines:

While you own the content contained in Your Files, you hereby grant all other Dropbox users a non-exclusive, worldwide, royalty-free, sublicensable, perpetual and irrevocable right and license to use and exploit Your Files in your public folder. In addition, you hereby grant Dropbox users who have been given access to your shared folder a non-exclusive, worldwide, royalty-free, sublicensable, perpetual and irrevocable right and license to use and exploit Your Files in your shared folder.

What this means is that anything you share with anyone through dropbox falls into almost-public domain. This includes any pics, docs, source code, etc. So, be warned and use the service with care and descrition. PS: I searched SpiderOak’s EULA for similar terms but it looks clean to me. Are there any other services that you know having such hidden gotchas? (Although we must admit they are not so hidden after all, but it is us who turn a blind eye towards the terms)

© Shantanu Goel | Dropbox Online Storage Public/Shared Folders: A Word Of Caution

Related posts

• SpiderOak Promotion Code For Free Upgrade To 10 GB (8)
• TIP: Make Those Linux Samba Shares Accessible From Windows Mobile (7)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

If you have ever had these errors or just want to be prepared in case they pop up somtime (and they surely will), then read on as I discuss various situations that lead to them and also their solutions.

I generally use desktop clients (mostly blogjet, but also Windows Live Writer and Scribe Fire sometimes) to blog to my WordPress based blogs. Some months ago, I started getting "Http 406: Not Acceptable" error while posting a particular post. Tried posting through the WordPress inbuilt TinyMCE editor, but got the same result. A little bit of research told me that this was because the post contained some words that were considered harmful by the "mod_security" plugin for apache that had been installed by my host to prevent hacking attempts. The quick resolution was to include the following lines in my .htaccess:

Sure enough, I put them in, published the post, and it worked. But since this meant opening up my site to the real hacking attempts, I commented them out and went about my work, occassionally turning them on as and when required.

But, a few days ago, after a server upgrade, the problem reared its head again, and in a more vicious manner. I started getting the dreaded 406 error again, and this time for any post, even a blank post, and through all clients. But this time, TinyMCE was working without issues. A little bit of looking around my site told me that the problem was that my desktop clients were not able to connect to my "x mlrpc.php" file which is responsible for taking care of all the remote api provided by WordPress. Trying to access it through any means provided the 406 error. My site's error log was filled with:

An appropriate representation of the requested resource /x mlrpc.php could not be found on this server.

Now, the xml rpc methods are used not just by WordPress but many other CMS's (like drupal, joomla, etc) and sure enough a quick search resulted in many similar reports for all the platforms. Enabling my previous mod_security options resulted in "503: Server misconfiguration" errors, complicating things further.

On seeing the error logs, I found that the server could not understand the options, and then I discovered that the mod_security had been upgraded to and it wasn't backward compatible with old options. Modifying the options to their latest counterparts also didn't work, as further wading through mod_security manual told me that now, its options cannot be overridden through .htaccess and can only be changed by the web admin.

I found that my host has basically blocked the x mlrpc.php file from being accessed at all instead of using proper rules for blocking only the attacks while allowing valid accesses. This was the problem that a huge number of people are also having and moreover they (like me) are not able to convince their hosts to switch to proper rules.

However, not all hope is lost. I have "fixed" this issue with a workaround for now. It is pretty simple really. Just rename your x mlrpc.php to something else (e.g. myrpc123.php) and also replace all references to it in your CMS with your new file name. You can use sed to automate this task. I used perl however:

Now, the 406 errors should be gone. If this worked for you, or you had any issues let me know. Also, if you have any other workarounds/fixes of your own, do drop me a word.

Note: In the above article, please ignore the space between "x" and "mlrpc" as the mod_security rules prevent them from being in content also. Moreover, use some unique name for rpc file.

© Shantanu Goel | Http 406 Errors Galore

Related posts

• Hack: WordPress function ‘wp_list_pages’ to output page description (or other custom fields) in your page lists (22)
• HACK: Fixing The Code Syntax Highlighter WordPress Plugins To Work With WYSIWYG (18)
• [TIP] Asus WL-500W Hacks:How To Reset Web Admin Password (2)
• WordPress Must Have Plugins: Download Managers (2)
• WordPress (1)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

Situation: You are migrating your WordPress blog from PHP4 to PHP5 (intentionally or being forced to as you web host won’t support PHP4 anymore). Most of the times, this is as simple as adding some simple lines to .htaccess (e.g. AddHandler application/x-httpd-php5 .php ). And you might not notice any issues. But many of you still do. The issues range from weird page layouts, to some controls not working, to some errors popping up here and there, and probably your blog not even displaying. This occurs because even though WordPress is PHP5 compatible, some of the plugins you are using might not be. But even if you ensure that all your plugins are PHP5 compatible, there is still one more problem that I just saw today.

Problem: My host supports both PHP4 and PHP5. I decided to migrate my personal blog to PHP5 today by adding the aforementioned line to my .htaccess. Immediately, my blog disappeared, and in its place, all that was left was a few errors:

[07-Apr-2008 12:11:49] PHP Warning:  flock() expects parameter 1 to be resource, boolean given in /…/wp-cache-phase2.php on line 105
[07-Apr-2008 12:11:49] PHP Warning:  fopen/…/wp-cache-e3ba4b7161eb59d50c5e976a0b66782a.meta) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: Permission denied in /…/wp-cache-phase2.php on line 240
[07-Apr-2008 12:11:49] PHP Warning:  fputs(): supplied argument is not a valid stream resource in /…/wp-cache-phase2.php on line 241

Note: I’ve deleted the exact file paths above for security reasons.

It gave me an idea that it had something to do with wp-cache. When I tried to open the settings for wp-cache, it again gve error that web server doesn’t have the permissions to write the file wp-cache-config.php, wp_cache_mutex.lock etc.

Analysis: On checking the file permissions for these mentioned files, I found that they already belong to the user under which the web server runs. So, write permissions shouldn’t have been a problem. I guessed that maybe this issue is because of another “handler” (x-httpd-php5) now trying to modify the files while earlier they were created by the php4 handler. But I couldn’t change the permissions now because they were created by the web server and I can’t modify/delete them through ssh/ftp under my username.

Solution: So, the solution (or workaround as you may call it) was to login to my cpanel, and use the “File Manager” there, since all operations done by it would also be carried out by the web-server. So, all I did was:

1. Went back to PHP4
2. Disabled WP-Cache Plugin
3. Launched the file manager, deleted the wp-content/wp-cache-config.php and wp-content/cache/wp_cache_mutex.lock. Came out.
4. Enabled PHP5 in .htaccess
5. Enable the WP-Cache Plugin

And that’s it. My Personal Blog is now running happily over PHP5 goodness . let me know if you have any comments about this or any other suggestions that are better than this workaround.

Note: This problem might not be limited to WP-Cache alone. There might be other plugins as well having the same problem.

Note2: If you feel uncomfortable deleting any file, then make a copy of it through ssh/ftp (so that it is under your user name), delete the original file, and replace it by the copy you made. Now, you can give this file a permission of “777” (that is readable, writable, executable by all), so that the web server can also modify it.

© Shantanu Goel | Migrating From PHP4 To PHP5: Solving WP-Cache (and maybe other) Issues

Related posts

• WordPress (1)
• Project: shantz-wp-qotd and shantz-wp-prefix-suffix updated (0)
• WordPress Must Have Plugins: Download Managers (2)
• WordCamp India Is Here (0)
• Tips: Configure FTP upload support for wordpress in Blogjet (3)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

Microsoft is doling out a lot of free stuff today. If you have a Live ID, or have the patience of 5 minutes to fill up a small form to create a new one, you can get free domain name as well as free webhosting from then for one complete year. Cool, huh? All you need to do is click here.

A word of caution: Unless you are creating a new website just for kicks, you might want to check out the terms and conditions properly because I’m not sure whether you can transfer the domain name to some other provider after the one year is over.

© Shantanu Goel | Free Domain, Free Webhosting from Microsoft

Related posts

• TIP: Free Downloads For Windows Vista, XP Professional, Visual Studio 2008, MSDN And Much More (8)
• Nokia + Windows Mobile = Let’s Kick Some <InsertWMPhoneMakerName> Butt (6)
• Microsoft Has A Problem: Software Patents Go Up In Smoke (6)
• Firefox Incognito Mode Is Here: Move Over Chrome/IE8 (39)
• Firefox Incognito / Private Browsing Mode – Part II (13)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

If you had a dream of starting your own website, your online abode, and you wanted to see whether the pretty little name for your dream house is available or not, what do you do? Check its availability on one of the many domain sellers’ sites. And if you picked “Network Solutions” to do the search, then you have just been scammed my dear friend.

Did you wonder, that though Network Solutions showed the domain name as available, but yet when you searched and found a cheaper registrar, the domain name was suddenly…GONE..What about the second one you had searched for at NetSol? Gone. Third One? Gone. Now, what is the probability of all 3 names being registered within 5 minutes of you searching for them? Probably one in a billion. No, its one in one (100%) if you searched on Network Solutions, as a friend of mine found out the hard way.

Donning the detective cap, if you do a whois for all those domains, they will undoubtedly be registered with Network Solutions. And you are now in there clutches, to buy it for their exhorbitant prices, almost 4–5 times the normal prices.

Actually, its not that bad as of now, because NetSol doesn’t really “buy” all those domain names (otherwise it’ll take less than a day for them to go bankrupt). They register it with ICANN but are allowed to cancel it within 5 days so they don’t have to pay any money. This clause was made to protect registrars from Credit Card fraud, but NetSol is using it to create their own fraud. As now, they can block the site for 5 days for free and people panic and buy it from them for their higher prices. They say that they do it to “protect” their customers. Hell, all they are protecting is the customers from buying it from their “cheaper” competitors as NetSol will sell it to anyone who pays and not just the guy who searched for it.

So, if you have become a victim of this and can wait for 5 days, then do that instead of paying through your nose. I call for a boycott of all services of Network Solutions and not just the domain whois, so that they can learn a lesson.

© Shantanu Goel | Caution: “Network Solutions”, Stay As Far As Possible

Related posts

• Do They Really Know How To Sell Something In India? (8)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

The question that we will be answering today is: Q2: Cron? Using tar, making up the script file is enough command line for me. Isn’t there an easy way? Cron is a tool that can schedule any kind of tasks for you, and here we are using it to run our backup script automatically, so that we can concentrate on blogging. Now, most of us are phobic of anything that has anything to do with command line. And we already have enough of command line stuff in this series. So, you can breathe a sigh of relief for a few moments because atleast the cron part can be made Web/GUI based for you (The command line method for cron was given in the first part). The details that I’m going to present here are relevant for cpanel but it might differ for you (very minor to very major) as your webhost might have a different panel for you (e.g. vdeck) or even your cpanel might look very different. But the basic concept remains the same and with a bit of common sense, you can apply this concept to your site easily.

Step1) Look for some option in your control panel, which says something on the lines of “cron”, “cron job” or such. e.g.:

Step2) If you get a screen as shown below, choose the experience level as “Standard” (maybe “novice” or similar in your panel). After all, we are using it because we want to avoid that unixy-command-line-stuff .

Step3) You will get a screen as shown below.

First, fill in the e-mail ID to which you want the script output to be sent to. (e.g. tar will output the list of files that were backed up) (e.g. myemail@mysite.com)

Then, give the “full” path (yes, starting from the root “/”) to your script that has to be run (e.g. /home/myusername/backup/backup.sh)

Then, choose the periodicity/time when this script has to be run, e.g., here we have chosen the script to be run everyday at 10:00 PM. IMPORTANT: Note that the time given here is GMT, so add your timezone offset. Generally, you should select a time when you expect the load on your website to be the lowest. e.g. I have selected a time of 3:00 AM everyday.

Press “save”, “done”, “add’’ or whatever similar button you can find and it’s over . That was easy innit?

That’s it for today. Lemme know if you have any doubts, or if you would like to see any other questions answered in this series. The question that will be answered next time (in “hopefully” the last part of the series) is:

Q3: Well, backup is all hunky-dory. Now, how do I restore?

© Shantanu Goel | TIP: Automating Website Backups – Part III (Cron Made Easy)

Related posts

• TIP: Automating Website Backups – Part II (Reducing Backup Size) (1)
• TIP: Automating Website Backups – Part IIb (Reducing Backup Size Contd.) (3)
• TIP: Automating Website Backups (13)
• [TIP] Add Directories Recursively To Perforce (P4) Depot (0)
• Fill Your Password To Invite Your Buddies – Not So Fast!! (2)

Blog | Tech Blog | Secure Coding | Twitter | RSS Feed | Get Email Updates

Last time, I had told you about how to reduce the backup size. Well, this is a short note further developing on the approaches discussed there. Basically, telling tar to backup only those files which have changed. For this, Linux has a command “find” which I am very fond of. You can give it a option “-newer” followed by a f”filename” and it will return the names of the files that are newer than filename.

So, the command given above will find all the files that have changed since you took the backup “backup_x.tgz” and store those filenames and paths into “files.txt”. The “-type f” option makes sure that only filenames are listed and not directory names, because tar creates a lot of issues when presented with directory names (Explore yourself about this).

Now, all we have to do is give this “files.txt” to tar as an input to tell it which files to archive.

The “-T files.txt” option makes this happen. Moreover, I have introduced 2 new options here, that were not present in our last part. They are:

• p – Tells tar to preserve file permissions
• G – Tells tar to ignore any file read errors etc and continue

Apart from this, you can also take a look at the “-mtime x” option for find command which lets you specify to list files which have changed in past x days. There are other similar options available for find. Look at “man find” and take your pick. Similar options exist for tar, but I have had a lot of weird issues using them, so I’d recommend sticking with this two step process of “find” followed by “tar”.

Now, the above mentioned commands and options can be used in innumerous ways and combinations to achieve your perfect balance of space and ease of use etc for backups. I’ll list down a sample script here, that will make a full backup on every first day of the week, and then make incremental backups over each day for rest 6 days. So, you’ll save a lot of space (more than 5 times), but you will have to use all 7 backup files to make a full restore. (I’m listing just the backup part, you can add the “mutt” command yourself, for e-mailing as mentioned in Part I)

That’s it for today. Lemme know if you have any doubts, or if you would like to see any other questions answered in this series. The question that will be answered next time is:

Q2: Cron? Using tar, making up the script file is enough command line for me. Isn’t there an easy way?

© Shantanu Goel | TIP: Automating Website Backups – Part IIb (Reducing Backup Size Contd.)

Related posts

• TIP: Automating Website Backups – Part III (Cron Made Easy) (2)
• TIP: Automating Website Backups – Part II (Reducing Backup Size) (1)
• TIP: Automating Website Backups (13)
• [TIP] Add Directories Recursively To Perforce (P4) Depot (0)