Just three hours ago, Matt posted this on the wordpress-hackers mailing list:
Subject: [wp-hackers] 2.0 Release
Wednesday or Thursday, depending on the phase of the moon.
Now would be a great time to start making sure your themes and plugins work with the new version, and post to hackers if you need any help updating them.
Yow! On the one hand, I’m really excited about this release. A lot of the changes are under the hood, with tons of new API hooks, a new object cache system, new user “roles and capabilities” security model, fixes and code refactoring. The major immediate change that most users will see is the new WYSIWYG post editor. Personally, though, I’ll turn that off, because I prefer crafting the xhtml for my posts by hand.
The new API hooks are going to enable a whole new class of themes for WordPress which have built-in customization options. An early example is Michael Heilemann’s K2 (which is actually built off of WordPress 1.5, but will take advantage of 2.0 features soon).
On the other hand, as you might infer from the ‘2.0’ version number, this is a major change release. You may very well run into ‘issues’ (as we in the software development community like to politely call them) when upgrading from older versions of WordPress. I strongly suggest that anyone who is upgrading an older version of WordPress to 2.0 should backup everything. Backup your entire existing wordpress directory and your database tables. This is particularly true if you rely on third-party themes or plugins. Most people will probably upgrade without incident. For for those (hopefully) few who run into problems, a backup is going to be essential.
That said, it looks like it could be a very Merry Christmas indeed for us WordPress users ๐
Poisoning the well
December 6th, 2005Overall, the volume of spam attempts on my server have been down lately. Oh, I still get a steady stream, I delete over 100 comment spams (caught by my filters) each day. But I’ve seen fewer of the massive, server-squashing spam runs that hammer my web service with too many simultaneous connections, blocking out legitimate users.
On the other hand, I’m seeing a lot more attempts by spammers to poison the well. What I mean by that is that they are submitting bogus comments, full of non-spammy (but more-or-less random) content, and links to legitimate web sites. For example:
The comment is obviously gibberish, right? And the links are all to perfectly normal — in fact, popular — sites. You might wonder why a spammer would bother posting it. The idea is to poison the well of any sites which use Bayesian techniques to classify content as spam or not. By tricking sites into classifying “good” content as “spam”, they (theoretically) can reduce the effectiveness of the spam filters.
With enough poisoning, your spam filter may start getting false-positives, which are legitimate messages that have incorrectly been tagged as spam. And if you get enough false-positives, you’ll lose faith in your spam filter and disable it. At least, that’s what the spammers are trying to accomplish.
Will their plan work? I guess that depends on your particular spam filters. I’m betting that systems like Akismet, which collect data from a wide variety of sources, will probably be able to defend against Bayes poisoning. How? Well, there’s this thing called an IP address. Even though the spammers submit their garbage via an army of anonymous proxy servers and zombie machines, they still only have access to a finite number of hosts, a limited number of IP addresses. It won’t take long for those IPs to be statistically classified as sources of spam. An IP like
221.3.235.96will be flagged as a spam indicator far sooner than the words “Industrious” and “Soldier”.So once again I say, thank you, spammers. We’re learning more about you every day.
Tags: Akismet, Bayesian, commentspam, dom, Spam
Posted in Blogs, Spam | 16 Comments »