pjbrunet

OK that makes a lot more sense, thanks for clarification.

"Anyone can use Android without Google"

Really? Then why can't I uninstall Google Plus, Play Music, Play Newstand, etc? These are "system" apps. Remember when Microsoft made IE a system app? That didn't end well.

More important than maintaining WordPress, you want a secure server. Here's a not-comprehensive list...

- Use a VPS. If you talk to Olly, author of "wpCop" http://wpcop.com/ and the VPSBible, he recommends CentOS. I believe it has a good reputation for security, for web hosting. Also Ubuntu & Debian are about as popular as CentOS for web hosting and they're probably just as secure, but choosing your distro is a big deal because they're all different.

- Automated backups of everything, and make sure you know how to restore everything. Backups of backups and offsite backups. So even if something goes wrong, you're not completely screwed. You need "offsite" backups because there's a million ways onsite backups can be lost, stolen, destroyed, etc.

- Configure MySQL to ignore remote connections.

- Don't use "admin" users for WordPress or MySQL. Is this really necessary? Probably not but it's fairly easy to setup.

- Don't use FTP, use ssh.

- I know a guy who was on vacation in a certain country and they totally destroyed his server. So be aware of your environment.

I agree. I've been generally following WordPress news since 2004 (the beginning of its popularity) there's been no serious security problem in many years, as long as you had open user registrations turned off. Why you would allow a complete stranger access to your admin panels in the first place is another debate, but basically: don't allow user registrations on your blog and you're safe.

If you look back in history, the so-called "WordPress hacks" in the news had nothing to do with a flaw in WordPress. What actually happened was, like in the case of the Media Temple hack, the hacker got access to the MySQL database and obviously all the blog data stored in MySQL was vulnerable. There was never any indication that WordPress was the attack vector when all those big hosts were affected. So what can you learn from that? Don't use shared hosting. Shared hosting was never that reliable in the first place. From my perspective, the shift to VPS was a big leap forward in terms of uptime for most websites/blogs.

Another big problem was the "timthumb" plugin. But from 2004 onward, that was really the only plugin that caused widespread problems for WordPress blogs, as far as I can remember. Yes, some plugins are dangerous and maybe you want a service like sucuri.net if you're really concerned about bad plugins. But bad plugins are rare, IMO.

Also weak passwords, again not a WordPress-specific problem. People using FTP carelessly, I bet that's the issue most of the time.

I'm not saying security is easy, I'm just saying WordPress is generally not the culprit. If there was ever any major hack that made the mainstream news that I missed, please post the link.

As long as you didn't need a user interface :-) Back then, you were lucky to get any Applet working without crashing the browser. From what I remember, GD was pretty much the only way to draw anything besides ASCII art. Oh and that Macromedia... shudders

Not if you're a sculptor ;-)

The way I see it, the top item on the menu is probably fresh and people like it. Or they wouldn't be in business very long.

This is how we did DOS VGA fonts ~1990. Draw the pixels right in the code (everything was monospace) and write that array directly to video memory. Mode 13 (320x200x256) video memory was sequential, easy to animate. Also you could do palette scrolling. Consequently, Mode 13 was the best video mode for games http://en.wikipedia.org/wiki/Mode_13h

Work and life purpose, not far from marriage and family in the hierarchy of things, depending on your beliefs.

LinkedIn blogs and news feed? That would be my guess.

That's one problem naming a business after a person. Still the domain is worth something. No sense "parking" a domain like that.

Repeated exposure to certain things cause an allergic reaction. Acne, fatigue, headaches, allergies come in many forms. I can't say for sure it was the sugar. All I can tell you is, I gave up sugar. (And other things, keep reading.) You come up with an educated guess and test it. In the case of the food allergist, he generally knew what foods caused acne problems for other people. Basically, you're using the process of elimination combined with an educated guess. If you completely eliminate sugar from your diet and you still have acne--then you know sugar isn't the problem. (I went to a dermatologist first, tried a number of prescriptions--no effect.) The food allergist worked. The food allergist explained, it's not the sugar by itself. The sugar is one component of a reaction, creating conditions for the acne. At the same time as giving up sugar, I also gave up dairy and yeast/bread. Maybe extreme but it worked. I went about two years without dairy! No ice cream, no cheese! Lots of salads and oatmeal LOL.

I thought the article was going to show brain scans ;-) I gave up sugar in high school because nothing else was working on my acne. It was difficult but you can replace sugar with maple syrup, honey and fruit. After a while the craving goes away and the effect for me was pretty much permanent.

Interesting point. Though universities allow F students in through loopholes. Fail HS, go to community college where the tests are open book, then transfer to a University which by law must accept them.

I agree we need extra careful people doing those important jobs. Most websites, they don't even want to pay for a failover server. So every market has different expectations.

Been writing code for 30+ years. I did devops for OS/2. I have seen stuff break, like when Media Temple had a cluster fail and their backups failed. Which is why you always do nightly offsite backups. I never trust a host's onsite backup because they often fail. However, digging into backups for code never happens because with experience you learn how to introduce changes. Also remember, there's a 3rd and 4th backup copy: control-z plus the copy on the production server. 5th backup copy if you count your code editor's backup copy. 6th backup copy if you count the hosts onsite backup copy. And because I use Linode, that means 4 archived backups. So yeah, that's about 9 backups, just in case I forget a semicolon ;-)

dnshistory.org: "A5: We aim to check every domain at least once per month and the minimum interval between checks is 24 hours."

That doesn't really refute the article. Anyone with access to the DNS server could change the email records for a few minutes to intercept mail. A hacker wouldn't have to wait for propagation in that case. And who would notice? This has me thinking, it would be nice to get alerted if a) my DNS records change at registrar level and more importantly if b) my DNS records change at the DNS host level.

I think DNS hosts should offer a waiting period option or approval system (with warning alert) for changing email records. Obviously you want website records to change instantly for failover, but I don't want a hacker changing email records in the middle of the night without anyone knowing. I use Linode and DNSMadeEasy and I don't remember either service sending me a notification when an email record was changed.

Also, seems like you could sell a 3rd party service to monitor DNS hosts. (I didn't bother to Google if that service exists already.) I'm assuming "dnshistory.org" only pings once per day--pretty much useless info from a security standpoint.

What makes me fast is I press Control-S and my code is live--working--in production. Clients love it.

You have an idea--I make that idea work while we're on the phone. Slow devs have six layers of red tape between their code editor and the production server (version control, dev servers, prebuilds...) and they call that agile.

Fast devs keep it simple.

Fast devs are not afraid of their code, they know what to do. Code works the first time, most of the time. That's a good feeling. With experience, you're confident, most changes are easy and predictable.

The Square app has easy email invoicing and you get the money in 48hrs. Freshbooks-Paypal combo is good too. Or just send the invoice as an email (no need for a spreadsheet) and ask for a check in the email--doesn't have to be complicated.

I don't hate LinkedIn. It's a terrific resource.

For what you're talking about, you could also try Meetup.com

I can't remember where I read this but I think Google's new "gold standard" for load time is < 1s. A couple of years ago I think it was < 3s.

I wouldn't trust New Relic charts. Maybe that is the source of all this disinformation. Get in the actual code and time everything yourself. If PHP is actually slow, you should be able to isolate the problem, like a loop within a loop that's just bad coding. You can make any language go slow with bad code. Check out my blog post on this subject:

http://pjbrunet.com/microtimers-on-hooks-to-measure-wordpres...

In that example, I bet WordPress on its own would have spent less than 550ms without having to replenish your cache layer. Also how much of that time was actually PHP vs. PHP waiting for MySQL? I bet if you scattered microtimers throughout WordPress, you would see 99% of your 550ms would be waiting for the disk and MySQL.

I agree. And that's just fine for 99% of the bloggers that will never reach 1 million pageviews/month. Most of those queries are unnecessary. But rather than fix the root of the problem, we put the whole database in memory. Run out of memory? No problem, move to a solid state drive! LOL.

Post links and downvote all you want. Drop in the microtimers yourself and see where your PHP apps are really spending time.

8 million caching plugins is a total exaggeration. As far as I can tell there's only two options: WP Super Cache (which seems to have been abandoned by the author) and W3 Total Cache which is a spammy mess of nag screens to join New Relic and MaxCDN. (No wonder it was banned by WP-Engine.) If I wasn't busy on other projects, I would take on W3 Total Cache--it's the worst UI I have ever seen and it doesn't even work. I had to mostly disable it today because my CPU went from 100% to 600% after installing it.

"Unless you’ve goofed something up, the slowest part of your PHP-based application should be PHP itself. Other parts of your stack may exhibit scaling problems that affect response times, but in terms of raw performance, PHP is the piggy in the middle of your web server and data stores."

I completely disagree. PHP is rarely the issue and I don't know where people get this idea that PHP is slow. Unless you're calculating the flight trajectory to Mars, the main bottleneck of WordPress is MySQL. Fill up you PHP application with microtimers, you'll see PHP only needs milliseconds to do its job even without caching. If there's anything slowing you down, you're waiting for MySQL or Curl or some external application, which is unnecessary most of the time if you designed the application properly.

All you need is a niche market and your first advertiser. Then start contacting the publishers in that space. You'll need somebody to help the publishers embed the ad codes. A decent developer could track everything or you could just use Google Analytics or some other commercial tool. Most publishers are willing to try something new, but consider the ad inventory is worth much more to Google (Adsense) because they have a ton more advertisers bidding on the inventory and they're tracking people's interests and so forth.

On the one hand, Google completely ignores 99% of its publishers. On the other hand, the bigger publishers receive advertising proposals all day long every day. So yes the advertiser can contact the publisher directly, they don't really need you, which (last I checked) is against the Adsense/Adwords TOS.

"If people start to switch over, then more sites will be developed to work in IE Lightning."

Based on this sentence, I get the feeling you don't appreciate the value of web standards? If Microsoft wants to be taken seriously ever again (they had 10+ years to make that effort with IE before they lost the browser war) all they need to do is render pages correctly, not in their own special way. That also means not inventing special-to-Microsoft codes.

Microsoft has a long record of screwing the greater community for their own self-interest. For example, sabotaging Java.