bobds

It's going to be on streaks.me eventually. Isn't that a nice domain for it?

If you don't want to wait for other people to fix this, there is a handy Firefox addon called No Referrer. It can block referers selectively, either when you click a link on a certain URL, or when you click a link that points to a certain URL. It uses regular expressions so it should be flexible enough.

It also blocks referers being sent from localhost/local URLs. I would be interested in trying out an option that only allows referers to be send to the same domain or its subdomains. The interesting part is seeing how many things that option would break.

EDIT: Forgot the link.

https://addons.mozilla.org/en-US/firefox/addon/no-referrer-m...

I like that quote and I, too, wanted something that can record my chains of big red Xs.

And I'm building it at 6am on Sunday (right now), although it's a website, not an app.

I shiver when I think how many pieces of code are fetched over the internet on my machines.

If you are a motivated attacker you can compromise a plugin author's PC or server and silently push a backdoor to a whole lot of people.

Signed releases are commonplace. It would make sense to require them in most plugin systems, especially those with central plugin repositories and lots of users.

STEP 1:

Make every theme/plugin author create a private key to sign their releases. Their public key will be available on their profile page and via API. Wordpress will notify you if the public key for an author has changed or if a release signature doesn't match the public key.

Why is this not done?

(Also in other software that uses plugins and is updated easily over the internet.)

You forgot the many people that write handbooks full of made up shit. So you have to keep the following two rules in mind:

Be careful of whose advice you buy.

Free advice is not always free.

This is pretty cool. Reminds me of a Defcon presentation that only used whitespace characters to encode the script (and a bit of boilerplate). I think it looks less suspicious than lots of symbols lumped together.

Here it is: https://www.defcon.org/html/links/dc-archives/dc-16-archive....

https://www.defcon.org/images/defcon-16/dc16-presentations/d...

Or just search for "fabric" without personalization/being-logged-in and you probably get the Python-related fabric in the top 10.

It was result number 7 for me.

There's also http://webbynode.com/

They have ready-made stacks with Node.js, Rails and Django.

> Oh my, do I have to put it even more bluntly to get the point across: These commercial whitelists are effectively extortion scams and affiliate rings.

You made a few points.

First is that nobody reaches out to get themselves whitelisted in advance. Lots of people do that and some ESPs even offer their own whitelist request forms.

Second is that none of the big ESPs look at third-party whitelists. AOL and Hotmail say they do.

Third is that even if the above is true, the impact on deliverability is minimal. I would guess you are right about that but I'd love to look at some data.

Intermediaries like SendGrid would be well within reason to be paying for such services. I don't think they have to signup their individual customers on the whitelists. They just say they are intermediaries and promise to vet their customers.

I think anyone sending low volumes of email is much better off using an intermediary. They get to use well-configured mail servers, IPs with good reputation, etc. Doing it yourself, IMHO, is not worth all the trouble compared to paying $20/month.

> The big ESPs don't look at these lists.

Some of them do.

AOL uses GoodMailSystems.

http://postmaster.aol.com/Postmaster.Whitelist.php

http://www.goodmailsystems.com/

Hotmail uses ReturnPath.

http://mail.live.com/mail/services.aspx#Safelist

Yahoo seems to run their own. I remember them using one of the big ones but I can't find any mention in their help pages now.

http://help.yahoo.com/l/us/yahoo/mail/postmaster/bulkv2.html

Google only asks for best practices, but it's possibly they look at some of the whitelists for more data.

https://mail.google.com/support/bin/answer.py?answer=81126

> That is nonsense. Nobody reaches out to the ESPs to have their IPs "whitelisted" in advance. You reach out when, if and after you've been blacklisted, in order to get unlisted.

That's nonsense, lots of people do that. Only you don't usually go direct to the service provider, see following links:

http://www.returnpath.net/commercialsender/certification/

http://www.spamhauswhitelist.com/en/

http://www.certified-senders.eu/csa_html/en/266.htm

People in hot climates have been painting their roofs white for many decades.

http://www.pictureninja.com/pages/israel/coastline-of-israel...

http://travelsplendid.com/wp-content/uploads/2010/10/Santori...

Neither did you.

I commented on half the items in the list to show why I disagree with such lists. Yes, I've done plenty of link-building but I don't think it gives me any more authority on the subject than the next guy.

What's a more important question: "How do you measure which ranking factors matter more?" or "Have you done a lot of link-building?"

I used to track SERPs for dozens of keywords daily for all my domains (I had a lot then), however I've stopped doing than now as I wasn't getting much out of it. I may try it again in the future but I'm waiting until I get some better ideas on signals to track.

How do you measure what and how much it matters?

I'm saying making lists of ranking factors is not a good idea. Not that all SEO advice is useless.

Let me elaborate, then. The list is dubious. There are some solid arguments against making such lists in the article I linked to. The web is made of links, people, companies, bots and more. What's a "genuine organic" link?

> Exact match keywords are an absolute killer when it comes to ranking

Where are these keywords supposed to be? I'm guessing exact-match domains. I don't think they matter much but that's up for debate.

> For the same reason, have no follow backlinks as well.

I think that's supposed to be "no nofollow". I dislike nofollow a lot. Some of your links are bound to end up in places that use nofollow, no need to worry about it.

> Backlinks from .edu/.gov sites

Spammers have been after those since at least 2005. I'm sure Google knows better than to place a lot of weight on those.

> Metatags are still important, even if Google doesn't care about them.

Meta keywords are dead for sure. Meta descriptions are the oldest standard way to provide a summary of your page, so you should use it. There are also many non-standard meta tags that can prove bad for your site (nocache,noindex,etc).

> PubSubHubbub is excellent to get your site noticed/indexed by Google

Dunno about that, is it any better than a regular RSS feed (and maybe a good old blog ping)?

> The number of indexed pages on your site

If you have enough "positive factors" you will have more pages indexed. How can that be a signal in itself?

> Make your content unique.

How do you measure the uniqueness of your content? Besides that, there's many types of content where uniqueness does not matter and is not expected, for example: lyrics, recipes, press releases, syndicated news and more.

(Duplicate) Content can be aggregated, filtered, commented on, mirrored, reorganised, reformatted and so on.

> A public whois record

Why does that matter? Whois obfuscation is offered by most mainstream registrars, lots of people use it. It's an effective tactic against all the unscrupulous people that mine whois records. Also plenty of ccTLDs do not expose anywhere near as much information as .com and the likes.

> A domain registered for more than one year > An aged domain name

That would be a great way to provide stale content to a lot of search queries. The rate of website creation is surely rising, why do we have to trust their content less? And with many people buying old websites in order to exploit this presumed signal, the noise has certainly gone up.

Google will also pay those sites infringing your copyright to display their pay-per-click ads.

They will comply with some removal requests, but sending a letter for each case of infringing content does not scale well.

Why this list is no good:

http://www.seo-theory.com/2011/01/07/why-you-cannot-reverse-...

You will quickly find out that the scrapers are coming from USA-based proxies, they pretend to be Google or Bing, they use an intermediary (say, Google Cache)... and so on, until you are tired of fighting them.

It's a losing game, unless you don't mind making it hard for actual users to view your content.

Wasn't that a well-crafted hoax?

> the coating won’t evaporate off under ambient conditions

They say a coating lasts about a year, which is what is prompting this type of questions. What happens to it after a year? Does it stick to various things that come in contact with the coating? Does it break off and fall to the floor?

How about applying a coating to your lungs? Then they can't get dirty from all the glass nanoparticles flying around.

I understand where you are coming from with this but let's consider the security implications of embedding just anything in the browser.

A prime example is embedding custom fonts with CSS. The code that handles them wasn't built with arbitrary fonts downloaded from untrusted sources in mind (I think the guy that wrote the code said that's insecure and a bad idea).

My wireless mouse is usually in front of my keyboard, ending up between my arms while I'm typing.

It's pretty hilarious that the big record labels also dabble in "piracy", releasing stuff without permission from the artists.

>> almost all monitors display 32-bit color anyway

Actually, I was surprised to find out that this is not the case.

"The inexpensive twisted nematic display is the most common consumer display type."

"Also, most TN panels represent colors using only 6 bits per RGB color, or 18 bit in total, and are unable to display the 16.7 million color shades (24-bit truecolor) that are available from graphics cards."

http://en.wikipedia.org/wiki/TFT_LCD#Twisted_nematic_.28TN.2...

You should first ask to see whether you can keep your job and work remotely.

If you haven't been to Taiwan, don't plan for a year. Go for a month. If it's good, stay. If not, move to next destination.

Programmers who type that fast might not have enough time to think. Typing speed is never the bottleneck.

This might be cheaper, depending on your requirements: http://www.btopenzone.com/buy/

I just so happen to have this list.

http://haxe.org/doc

http://github.com/scriptor/pharen

http://www.mathgladiator.com/projects/kira/

http://www.scriptol.net/

http://sunra.nachtkabarett.com/

http://users.xelent.net/mlewis/tellpdf.php?seid=12457c30afd9...

http://ialexi.com/portfolio/original-works/components/quirk/

And a somewhat related list:

https://github.com/ryantenney/php7 Hacking the PHP compiler and standard libraries in the name of turning it into a not crappy language.

https://github.com/tenderlove/phuby Phuby wraps PHP in a loving embrace. Exposes a PHP runtime in ruby

https://code.google.com/p/japha/ implementation of the Java 1.4.2 library in PHP

https://github.com/lunant/lisphp Lisphp is a Lisp dialect written in PHP

https://code.google.com/p/php-alternative-syntax/ Scala inspired syntax for PHP

https://code.google.com/p/java-php-toolkit/ a cross language compiler than transforms java code to php code deployable on any server supporting PHP >= 5.3

https://github.com/bendemott/pyhp Pyhp is a way to execute PHP Source Code directly within Python Scripts

https://github.com/ramen/phply PHP parser written in Python using PLY

https://github.com/skeltoac/php_app A PHP eval server for Erlang/OTP