Well yea, wordpress known as one of the open source cms vendor with really really good care of their security, so if they release something new, it must’ve been a security fix, or features improvements. Version 2.8.6, is one of its release from their security fix outlet.

There are 2 Security Fixes:

From official wordpress blog regarding this WordPress 2.8.6 Security Release :

2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges. If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.

Plain english would be read like this : There re 2 security problems which could be exploited by one of your registered user – with posting privileges and logged in. So actually, this security problem is an exploitable problem by someone who’s already in (logged in as a registered user), and has posting privilege (authors, editors, or other user with custom privileges with posting ability in it.) Long story short : Exploitable by inside man.

The 2 Security Problems Are

1. An XSS vulnerability in Press This discovered by Benjamin Flesch.
2. An issue with sanitizing uploaded file names that can be exploited in certain Apache configurations, discovered by Dawid Golunski.

Be advise, IF you guys have a blog with multiple authors, and there’s a possibility one of them has a possibility to go “bad”, this release is definitely recommended for you.
Alrite.. catch up with you later!

This morning, somebody was really poppin up. Again — he ‘s yet another just-so-happened-tobe-a-seo-analyst-wannabe buddy of mine. Not that I wasn’t expecting a company that morning, this smart-a55 buddy was suddenly lecturing me about some tricks to get our site on first page of search engine position result. I always referring to google when I mention search engine. Not really sure what his point at the very first part of his lectures, we have some discussions a bit about the topic he forced me to discuss, and after half of a pack of my cig pack is gone, he ‘s gone.

Somethin bothers me right after he left. I may not be a Search Engine Optimization Analyst or such thing, but I did learn some lessons of my own on how to get things right in a matter of optimizing our site, for search engines sake, for readers sake, for browsers sake, and for all that really matters sake. AND, the most important part which really bothers me — well, beside this whole weather thingy — is.. almost all things he lectured me about were things that in My SEO list marked as black hat techniques or some may called ‘em Dirty tricks. Whoa, did I learn the wrong stuff, of is it his?

I may not be the-mr-always-right-all-the-time, but this time, I ‘m 100 percent sure, I ‘m NOT wrong. So, here ‘s what he was lecturing me about this morning, which in MY SEO list, I ‘ve marked ‘em all as a black hat techniques, or Things you need to AVOID in a matter of optimizing your site for search engine position result, or, 10 Google DON`Ts — or should I also say — 10 Helluva Quick Ways to Get Google Kick Your Site ‘s Out of the Indexing!

1. Cloak Your Site.

It ‘s a way to make search engine see your web site as something, and visitors seeing something else. It can be done with some sneaky redirects or some programmings. Neither google, nor other search engines, nor visitors, likes to be treated — or should I say tricked — this way. It definitely is strictly forbidden, prohibited, verboten. Absolutely a no-no.
Cloak your site, google will definitely ban your site out.

2. Dupe Your Content

You know, spammers with their wholesome spam sites are doing their best these days to collect page views using this method. Duplicating the same exact content on some multiple pages.

Never, I repeat, never, copy and paste small part, even large part of contents from your own pages, or others elsewhere. It certainly violate copyright. And the most important thing we ‘re talking about here is Google — has been known banning sites with duplicate contents. The lightest scenario on getting kicked by google of this dupe issue is, getting penalized, either in rank, or in search result position.

Yea, copying and pasting contents from Free Articles sites may get you a go, as you won’t violate anybody’s copyright, but it ‘s surely never be your getaway from being kicked by google.
It still is a duplicating issue, and google never miss one kick. I repeat, never.

How about other sites that duplicating yours? Well, easy peasy, report ‘em to google.

3. Buy a Machine to Create Your Content

This one is the same worst idea as duplicating content. You may ‘ve heard about it — or worst, You ‘re now using it — about programs that duplicate some contents, make few changes on some part of ‘em, and publish ‘em as a different content. Don ‘t even try to dare google to test your site ‘s out, not even when you ‘ve bought the most-perfect-robot-writer on your side. Google pretty good on catching these kind of contents, and when they do, things you can do is say a bye-bye to your page views.

4. Stuff Un-Related Keywords

Did you heard that meta keywords are being marked as “Nah-this-part-is-no-longer-the-coolest” by Google? Some say google crawlers pass this meta, some say it still being read but not counted as an important part of ranking algorithm. But there’re things that remain the same, which are, un-related keywords that are being listed over and over again, and repeating the same keyword multiple times. These two, would definitely get your site ‘s rank being lowered by google.

5. Being as a Known Associate of Bad Neighborhoods

It ‘s about the right time I quote Marziah Karch saying – about this Bad neighborhoods term.

Google refers to malicious websites and spammers as “bad neighborhoods.” If you hang out in bad neighborhoods, you’re likely to be mistaken for a hooligan. The same is true of Web designers. If you link content to known spammers, Google might mistake your website for spam and lower its ranking in search results.

Link your site the natural way, the way this internet works, makes you a good citizen and a good neighbor of the internet world.

Having some one link yo your site never obligate you to link back to them. Feels free to do so, if you ‘ve checked it out and it ‘s not a bad neighborhood. Otherwise, Don’t. Linking to some malicious websites and spamming sites is one sure-fire way to get your pagerank and search result rank being dropped by google. Again, google never miss one kick. I repeat, never.

6. Hide Your Text with Font-Matching Technique

This technique is all about stuffing some keywords — to make the page “strong” in a matter of keyword relevancy — within the page, by making it hidden using the same color as the background color. This one also known as the one and the famous “Keyword Stuffing”. Not just google, other search engines are becoming really really good on catching this, surprisingly.
The other variant of this technique is putting some absolutely tiny text at the bottom of pages, way way at the bottom, even visitors need to scroll it the whole day, and way way tiny even human need to wear a watchmaker glasses to see it.

Same old same old result. It doesn’t work. Search engines will catch it eventually soon or later. Same kick you ‘ll get.

7. Stack Your Title

This one is really the real younger brother of keyword stuffing. Done by adding some extra keyword to your Title. Win you any places on search engine result? Nope. Get the nice hard kick from google? Definitely.

8. Taking Part of Distributing Trojans, Viruses and Other Badware

It ‘s pretty much obvious. Google will definitely remove you from their Index if your site is distributing a trojan, virus or some other badware. If you agree to distribute a software, make sure to double check and re-double check it, to make sure it ‘s not harmful, for ya and for others.

The other flip side of it is, make sure your site is secure, and safe from hackers who could hijack yours, and distribute malicious programs under your hood.

9. Creating Doorway Pages

Some may call these pages as Gateway pages, which is the same term for pages that are created and optimized for one specified term but never really created as a real content. Instead, it really is just a gateway to the intended or the real page. These pages usually cloaked and redirected to the real pages. Google may consider affiliate pages as doorway pages. So be aware.

10. All things Automated Inquiries

This one is the last one, and my fingers are screaming to get a break. So, let ‘s make this one quick. Google HATE, i repeat, HATE : robots writing you contents, checking you ranking, querying google’s services the automated way, link submission the automated way. They ‘re all against Google TOS, and for this one, google will kick you HARD and BADLY!

Let ‘s Conclude ‘em

Those 10 above are really your quick ways to get your sites KICKED out by google. Long story short, Be a Jerk. And you ‘d buried your self successfully out of this planet ‘s index.

The ball is on your court now, so decide it wisely. Play it safely.

Pretty much un-fortunate for me, I ran into him this morning on my way to Iza Media office. As actually my office is — surprisingly — nearby his house, so it ‘s not really an incidentally occasion. He told me that there ‘s a thing in his head he need to ask me, — yet again — so we ‘re headed together to my office.

We ‘re here at my office, I turn my pc on, I sat, He sat. My pc reach the desktop, by that exact time I ‘ve already feels this heat like a heated volcano would exploded nearby me.
..and it explodes.

“So Jarot, after your whole explanations about online opportunities, I ‘d really like to know if to create a website is as easy as you ‘ve told me couple days a go.” There he goes, he has it.

“Umm, what?” It confused me a bit.
As I never really mention the “it’s-easy-to-create-a-website” part.

While I did explained some of the-what-and-the-how of how things works on the internet – and fyi this dude is aint a tech savvy to the core – I still remember it precisely that I never mentioned about making a website is easy.

“I ‘m positive, I never told ya that creating websites like what I have live up there is easy. Where did ya get that idea anyway?”

I replied lightly. Light up my A-Mild cig. Flat face mode : ON.
.. and you know what, he giggles.

“Haha, you got me on that. Yea, you never really mentioned it. I made that part up. So c’mon, gimme your secret.”

He just admit that he lied, yet he seems damn proud of it. I ‘m sure there’s something wrong with his head.

“What more secrets do you want, you ‘ve seen it all these last 2 weeks.”

I shoot back. Yet another headshot. I ‘m beginning to become an expert on this shooting back thingy.

Not Easy, Aleast for Me.

“All I did is code this code that — you ‘ve seen it — Create some graphics — you ‘ve seen it also — and blogging. That ‘s that. And one thing for sure, to create A website is never easy. Atleast for me.”
I added some more pressures on my tone.

I can see this desperation is growing bigger on his eyes.

“So it ‘s not easy huh?” he replied desperately, like he has loose the war of this century of something.
“I ‘m not really a designer, nor even a programmer like you, so the whole online earning thingy is really just for dudes like you? Right?” He ‘s down even more.

IF there ‘re others on this room, they ‘d definitely cry a river for him seeing how desperate being he is this very second.

Me? Nah.. I ‘m NOT buying it. Not a bit.

He ‘s been doing this the whole 2 weeks, So I know exactly he ‘s faking it this time just like previously, and the previously previous. Maybe he thought it ‘s his first time to trick me this way, or he might thought I don ‘t remember it anymore the last time he did it. I dunno.

I really think there ‘s something absolutely wrong with his head.

So I slap it hard to make it right.

“Okay stop your lousy act now, you did it the same style even the same mimic like the last time. What was it, yeah, yesterday. So stop it.”

I slap it once more.

And he stopped, and mumbled, “Geez, it ‘s not working!”
And looked up at me, putting up that — dumbest smile I ‘ve ever seen — on his face.

There ‘s definitely something wrong with his head. Positive.

It called Website Builder

“Okay so, there ‘s actually an easy way to create a professional website, and this one might be the one for ya. It called website builder. With this tool, you won ‘t need to be a designer nor programmer to built a website. You can point and click, right? Just add a bit imagination and BOOM, you ‘ve created a website. Wanna have those kind of professional lookie websites, it ‘s all there for ya to choose.”

“Yup, this one is definitely for ya.” I concluded.
“Why don’t you say so!” He punch my shoulder hard.
“I just did.” I punch back. He took a cig from my A-mild pack. Light it up.
“So, man, tell me, Why don ‘t you use this website builder for all your websites up there?” He ask this thing, and this is the first time he asked a reasonable thing.

“Well, I ‘m a coder, remember? It ‘s a pride for me to code my own site. As simple as that.”
I replied.
He stand up.

“Alritey, you can keep that pride and your wholesome code-this-code-that thingy of yours, I ‘ll definitely go with this website builder. I ‘ll see ya around buddy.”
He leave.
Just like that.

Oh well, It ‘s great anyway, time to get back to work.
But wait.. where ‘s my Amild cig pack?

Crap! That moronic creature took it with him!

So what I ‘m gonna discuss this time is about what is unlimited hosting really mean.

Well you, me, us, seen it all over the place for this kind of offer, when we ‘re on our way to choose which web hosting is the right hosting for our need. Right? Here, there, and everywhere.. you ‘ll meet this unlimited plan offer. Just f-y-i, a.k.a for your information, there 2 main elements of a web hosting plan. Bandwidth and Disk space, or you can say disk space and bandwidth, both means the same anyway, either you ‘re saying it by disk space first or bandwidth first. (So why bother writing it with an OR? not really sure, whatever. )

Okay so, unlimited always attractive in some obvious ways. One thing for sure is it requires you no more thought. Well it ‘s unlimited right, you won ‘t have to worry about running it out. Right? Uh huh, it ‘s a common public thought. and that ‘s pretty much the main reason why this unlimited thingy being placed all over the place by web hosting providers to gain more clients or customers. While truth is always bitter, you ‘ll found out real soon that the real truth behind the unlimited-webhosting-offer scene is bitter even more.

Is Unlimited web hosting really Unlimited?

Nope. It ‘s NOT. It ‘s just an un-real thingY, with a capital Y. Why?
You know, here ‘re some facts you need to know why this unlimited offer thingy would never happened, not in this lifetime near future,

1. Disk space is “the” space where you ‘d allot on server as your website storage. It cost money. Check.
2. Bandwidth is “the” amount of data capacity transferred from the server to visitor’s browser to display requested web pages. It cost money also. Check.
3. Graphics, web pages, flash files, other file formats stored on server and requested by visitors browser consume bandwidth. Check.
4. Network lines that would carry data all over the web have its finite capacity, and it’s limited at any point at a time. Check.
5. Hard drive of a server always has limited amount of space depends on how big the hard drive is, in a matter of capacity. There ‘re no such thing as hard drive with unlimited capacity. Check.
6. 5 points above, all cost lotsa money. Check.
7. All web hosting providers have this contract with their own ISP for their internet connection. Which is Limited. So with this capability they have there never will be a chance they could provide unlimited bandwidth for their customers. Check.

Make sense?
Let ‘s go thru some more deeper then..

Yet Another Humpty Dumpty Speaking

Christopher Heng of sitewizard dot com, explained it wide plus in a great way how this unlimited term is just another humpty dumpty speaking. Here I quoted a bit :

In Lewis Carroll’s “Through the Looking Glass”, Humpty Dumpty redefined the meaning of the word “glory” to mean “a nice knock-down argument”. When Alice, to whom he was speaking, protested that that was not the correct meaning of the word, Humpty Dumpty replied:
“When I use a word,” Humpty Dumpty said in a rather scornful tone, “it means just what I choose it to mean — neither more nor less.”

So, when you find web hosting providers use this unlimited term to say that you would have unlimited disk space and/or bandwidth, it always get redefined to some other definitions at their own discretion. While the real meaning of it may vary from one provider to another, surprisingly – the real definition is always an antonym of “unlimited” you ‘d found in the English dictionary. Funny? Not really.

They Always Define What’s their “Unlimited” Term Really Means.

Really?
Yeah, seriously.

Always look at their fine print, the Term of Use. They always explained the further definitions of their-so-called-unlimited-hosting. Here ‘s an example of it from one web hosting provider, how unlimited disk space being redefined, on its fine print:

1. “you can add as much content as you want, but maybe not all at once“
   
   Real english meaning : You can NOT use the unlimited disk space in one shot. You should use some amount first, and then add some more at some other different time. The amount you could use in one same ride never really explained. Who ‘d decide how big is it, each time? The provider, pretty obvious.
2. “The vast majority of our customers’ sites grow at rates well within our rules, however, and will not be impacted by this constraint“
   
   Real english meaning : How many amount in Mega bytes you could use by the first row, at which rate you could have the disk space increased, is ain’t stated. Long story short, it never really let you to get to know how much capacity you could really use. Yet you ‘ve forced to do so, without any objections at any forms.

So All Unlimited Offers are Humpty Dumpty?

Well, not exactly. When it comes to disk space and/or bandwidth, yeah it is. To be precise, it should be. But when I see one web hosting provider advertise on its landing page that they offer unlimited email accounts, it might be true. Although I never really tested it out to their real limits, but these kind of features are usually being limited already by other aspects of your account – I ‘m referring to disk space – which is it may be the reason why the host provider doesn’t really bother to restrict the number of email account you’d use.

There you go, you ‘ve know the whole scenario behind “unlimited plans.
So, what now?

Best Practices

Plan it ahead. You should really calculate the type of disk space and bandwidth you ‘ll gonna need for your site(s) and then multiply ‘em by two or more than 2 – for some expansion purposes.

When you ‘ve felt into these kind of scheme and found out this real truth a lil bit too late and you ‘re facing the fact that you ‘ve really used all maximum amount of this so-called-unlimited-plans of your hosting provider, you ‘ll get your self shutdown and being forced to upgrade to some higher package, such as VPS (Virtual Private Server) or Dedicated Server. This pretty much the real situation some publisher buddies of mine confessed me some while back, so choosing a dedicated server plan is always a great leap and getaway for you who ‘ve already have some developed websites with some real serious traffics.

For the Sake of the Mother Earth

What ‘s up with Saving the Planet slogan? I ‘m all virtual here. The internet never really has anything to do with this Planet and its break down. Right? Or, is it?

Well, buddy, internet is all virtual. But all machines that run the whole internet thingy are physically existed on this planet. It took resources and spit some waste to this planet’s surfaces, cores and atmosphere. So yeah, the internet and the whole technology run along with it took part on destroying this mother earth. Taking your part of saving it in any available forms is always a good use for the earth.

So you ‘re a Green Peace kind of person now?
I am, and I always will be. Not that I ‘m one of its active member who took part in every demo and act to save the planet, no. Like I mentioned above, I took a part on my own act, in some available form for me. Well, I ‘m a web developer, I used web hosting services alot, so green hosting plan is one real form for me as taking part of this saving-the-planet act.

All in all

Get your self educated a bit more about how web hosting providers do their business by referring to their Terms of use is always a wise move. Do your researches on Web hosting review such as WHG, is one real move. Do choose green hosting to take your part on saving our lovely environment for the sake of this planet and our grand and grand grand children – is way way noble move of all.

Just IMHO. That ‘s that. I ‘m out.

1. Speed and Reliability.

Web host should be fast, yet reliable. You ‘d notice this word “UPTIME” mentioned all over webhost provider. It refers to the time when this offered service is functional. Did you even know that you should go for the one with minimum uptime 99%? You heard me right, 99% is a minimum. Don’t go anything below it. In fact, 99% is too low. You should actually go with higher than 99.5% uptime. Guarantee always reflect to some amount of compensation. Be sure you got that in hand.

2. To Go or Not To Go With Unlimited

Point 2 here would be about traffic or sometimes called bandwidth which refer to the real state: Data Transfer. How much amount of bytes that your site transferred to your visitor when they ‘re on your site and browse around. To go or Not to go with Unlimited bandwidth offers, that ‘s the question. Never believe any “unlimited” terms advertised on some web host, as unlimited is ain’t really unlimited at all in the end. You ‘d never be able to use that oh-so-called-unlimited-amount, ‘coz it will always hit other limits – which sometimes specified somewhere else where you could find it being redefined to be “yeah-it-actually-is-limited” in some way. Always go for offers that stated clearly how much traffic of some offered packages allows.

Oh, if you still need me to say it out loud, the answer would always be, Not to Go. And buddy, this point is also applied for this popular term called Unlimited Disk Space. End of point 2.

3. A Real Functional Technical support

When I say functional, I mean functional. You know, when you need ‘em they around. When You ask things they answered. Do they offered a functional 24/7 support? Refers to 24 hours a day – 7 days a week. Refers to all year around? You ‘ll gonna need a webhost that have staff working on weekends and some national holidays. Things often went wrong at some of the most inconvenient times, and you ‘d be surprised that a web hosting provider that advertise 24/7 support doesn’t really have this kinda support on their end. I ‘ve got some worse moments of my own with this kind of provider. I got my self in to a webhost that run by bunch of salesmen, which have this smooth talky-talk, but not really how to fix problems. So tested it out first.

4. Some Fancy Thingy Called Software

I ‘m referring to these things : PHP, .htaccess, FTP, MySQL, Perl, SSI, telnet, crontabs, SSH, Email, POP3, Auto Responders, Mail Forwarding. Make sure, you have all that, and you can use each and every one of ‘em without asking for approval first. Yeah, there ‘re some web hosts don ‘t allow you install Perl or PHP scripts, not without their approval. You can’t really have some SEF (search engine friendly) url or customized Error pages if you don ‘t have access to .htaccess. You ‘ll gonna need MySQL to create database based kinda of websites. You ‘ll gonna need all email functions such your own email address (on your own domain name), auto responder, pop3, forwarding.

I ‘m also referring to Shopping Cart and SSL / secure server, if you ‘re planning on creating an e-commerce site that need to collect credit card for your payment. Stay clear of web hosting provider that don ‘t offer these facilities provided.

5. Your Own Administration Backend

This point here I ‘m talking about would be the Control Panel. You may find it being called with some other various names, such Control Panel, Admin Panel, Cpanel and such. A place where you could administer all things about your own hosting account on your own. You don’t wanna spend your money to a web hosting that whenever you need to create your email address, you should ask their support to do so, right? It ‘s one of the most common thing we webmaster do all the time over and over again, and it would be great great hassle if it should be a “should-wait-on-technical-support” kinda task.

6. Multiple Domain and Sub-Domains

You should definitely aim for this if, you ‘re planning on having multiple domains or multiple sub domains. Check out also, the extra amount – if there ‘re any – they would charge for this extra feature.

7. Operating System Types

Yeah, the type of server and operating system of it, is matter. Well, you can’t really go for others if you ‘d use asp programs, you would need to go with Windows server. In other flip side of it, is the more stable, feature-laden and often cheaper Unix-based systems, which runs Apache server. Me, Unix-based is my preferable and favorite choice. The why is, with the same goal of creating dynamically generated pages which access the database, writing it down on PHP is alot more MORE then tying down to ASP. I meant it. You could configure a lot of facilities with no requirement to ask your technical support to implement ‘em. Isn’ t it the coolest thing?

8. Payment Plans and Pricey Thingy

Price always is factor. And most go for the cheapest. But not in this post. It ‘s about things to help you to find the Best web hosting, and NOT the cheapest one. Based on my own personal experiences, go for the cheaper one is desirable, but the other flip side of it, is you would often get what you’ve paid for. Cheaper always means lack on something. In my experience, they always lack on support, uptime, and speed. It doesn’t necessarily always mean that the best is the most expensive one. Not always. So playing the period plans would help you a lot on testing out things. Buying a monthly package would allows you to switch quickly if your web host turned out to be dissatisfying.

9. Reseller Web Hosting

It ‘s a term of a web hosting who doesn’t really own their web servers. They ‘re a reseller of some other hosting company. It would be disadvantages, as you might be dealing with some people who don ‘t really know the what and the how the system they ‘re selling. But, not all resellers are disadvantages, as there ‘re some reliable and fast resellers which actually good and cheaper than their orig hosting company. Bottom line is, if you ‘re in this situation, your best shot is investigate both.

User Reviews

It always matters to hear things from users end. They ‘ve been there using the services, so hearing from them about their experiences on how certain web hosting services doing so far would always be great point of consideration for ya. For me it ‘s pretty much essential. Do some researches to some web hosting reviews, of some top 10 web hosting listing. Spend your time to read, you wont regret of the “found-out” you ‘d discover.

Okay so, I ‘m having this strange de-javu again by the time I read this writing. As all things above – you could find ‘em already out there. Well, atleast I write ‘em down on my own perspective. Somebody might thought my point of view is interesting, who knows? Hope it help you out in some sort of point.

Stefan Esser of suspekt.org recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().

With his help, WordPress team worked around these problems and were releasing WordPress 2.6.2, last September 8, 2008. Yeah, I know, i ‘m a bit late to write this, but it’s always better be late then not knowing at all, right?

Should I upgrade?

If you allow open registration on your blog, you should definitely upgrade. With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password. Stefan Esser has already release details of the complete attack, both for SQL Column Truncation and the weakness of mt_rand(). The attack is difficult to accomplish, but its mere possibility means, upgrading to 2.6.2 is recommended.

Some bloggers and sys admin with open registration feature for their site or blog, has closed their registration temporarily until they got chances to upgrade to 2.6.2. Wiser choice I must say, couldn’t agree more.

Version 2.6.2 Bugs, Fixes and Security Patches

There ‘re some bugs found for 2.6.1 or previously 2.6, and the 2.6.2 have all the fixes and security patches. If you ‘re interested to take a look at the 2.6.2 bugs and fixes list, headed to this page of that contains a handful of bug fixes.

So, wait no more, upgrade now! For all of you who upgrade it already, congrats!

[ Indonesian version → ]