Infinite Alis

Imperfect World

2009-01-09T00:49:08Z

Variel vs. the Oddfoot

Okay, since I know there are at least two people out there who may marginally care about this post (which is two more than usual), here goes.

Perfect World's Fortunate Kylin mount.

The other day I went out and downloaded Perfect World International. PWI is the English — as opposed to Engrish — translation of a Chinese “free” MMORPG. I have a love hate relationship with Asian MMORPGs, especially of the “free” variety, but I’d gotten stuck in zOMG!ⁱ and figured… what the hey. Plus, PW has the distinction of having the most awesome mount in any game in the universe; the Fortunate Kylin, as pictured right. And any games that gives me a shot at something like that can’t be all bad, right?

So anyway I downloaded the game client, signed up and signed on. I was tossing up between making an Archer and a Venomancer. Both are good, solid soloing classes, with the Venomancer being the best on account of it being a high DPS pet class. However, in the end I couldn’t resist a Winged Elf Archer, simply because you start the game with the ability to fly. I thought being able to slowly hover at level 6 in City of Villains was OP!

Thus was Variel born on the Sanctuary server.ⁱⁱ

First things first, Perfect World looks beautiful in a kind of generically, hyper-realistic Asian sort of way. Whether you like that sort of thing is up to you, I guess. The monsters are generally fairly cool-looking (another reason to be a Venomancer) but the world is a little… bleh. Then again, I’m still in the “noob” areas so maybe some of the later scenery is more spectacular. It’s also the first game of this type I’ve played which actually runs in native res for my monitor, though some UI scaling would be nice, since everything is so tiny I spend a lot of time leaning forward and peering.

The game itself is definitely post-WoW, and if you’re familiar with that there are a lot of things — from gathering to the skill tree page — that will cause some serious déjà vu. The gameplay is also similar, and PW is the first Asian MMORPG I’ve played with an emphasis on questing rather than letting the player loose to grind their way from 1 to 99. Okay, admittedly I’m only level 17 — I haven’t even made it to the major city yet — so it’s possible that peters out sometime but so far it’s promising. Questing actually seems integrated as a character stat, and crafting in nominally useful, at least at low levels (HP regen increase thingie for the win, man), even if I can never find enough Logs or Nectar.

Where PW does differ from WoW is in its skills and stats system; for godssakes, if you’re new, go in with a plan. Character building “resources” are limited, and while they can be reset, it costs actual Really Real Money, and the game is unforgiving if you allocate your stat and skill points incorrectly. Google yourself a class build guide before you start, and I swear you’ll have more fun.

Oh, and Guardian Charms? Best. Item. Ever.ⁱⁱⁱ You get one as a quest reward early on, and unfortunately that addicted me. Further charms have to be bought from the store, but I figure the couple of dollars is worth it if you’re going to play seriously. It still works out cheaper than WoW and Guild Wars.

So yeah. All-in-all I’d have to say I’m fairly impressed with Perfect World. It’s not, well, perfect but nothing is, and it’s certainly fun enough to keep me entertained at the lower levels. Plus, of course, the fact that there’s no subscription fee make it easy to pick up and put down at will.

So yeah, definitely worth checking out if MMORPGs are your bag, baby.

Next on the list to try out: Shaiya.

CL 3.x, if you’re wondering. I’d gotten to a point where all the appropriate level quests in Zen Gardens were broken, and I didn’t feel like blowing another 600,000 gold breaking up CL 10 Rings for Orbs like I did when I got stuck at CL 2. I don’t do non-quest farming, especially not in a game with random XP drops that forces me to walk back to town every ten minutes. ↩
Some cunts had apparently already stolen all my “usual” character names… including Loqia! ↩
Any time your HP falls below 50% — barring a tens econd cooldown — it heals you to full health. They’re require no user intervention, and expire when they exhaust their HP quota. There’s also an MP version, and you can have both equipped at the same time. ↩

Mirrored from void-star.net β. Comments are preferred on the original.

It’s Showtime!

2009-01-06T06:28:29Z

Just when I think work can’t get any worse, it does. Fuck.

On the plus side:

Beetlejuice! Beetlejuice! Beetlejuice!

Mirrored from void-star.net β. Comments are preferred on the original.

Meanwhile, on the Internet…

2009-01-05T09:54:09Z

Puppet Twilight
"Twilight As told in three minutes by puppets." Why does everyone spell 'Luthor' wrong?
gmth: This female gazes in the opposite direction
"But please don't say on the one hand it's a different kind of magazine because it doesn't presume to tell women what they want, and then say on the other hand that women are primarily interested in gay porn of only one kind."
Because it bears repeating.
Feminist beat poetry. Oh-so niche.
Late Post is Late.
"A friend is someone who is there for you when he'd rather be anywhere else."
Doodles
Want some art? 'Course you do!
Sunday ADD Blogging: WTF Edition
"70-some per cent of [...] porn is actual rape". Really? I mean… REALLY? By what definition of "rape"?
Stupidity and True Blood
"This is the dumbest post I've read in yonks." I'll say.
I don't have an icon angry enough for this post
In a hundred years time society is going to look back on this with SHAME. Hell, most of us are doing it already.
My two cents on the inauguration
What I REALLY want to know is why a supposedly secular government has a religious state ceremony. R.I.P. the separation of church and state, we hardly knew thee.
bradhanon: The Female Gaze
From the "No shit, Sherlock" department. Bonus artwank, featuring people on my flist and fandoms! Huzzah!
You do YOU…Picspam
"Today the US stands alone among Western nations in its refusal to sign a UN-sponsored international declaration calling for the decriminalization of homosexuality."

Mirrored from void-star.net β. Comments are preferred on the original.

Christmas Photos

2009-01-03T05:29:47Z

Okay, so while I wait for Perfect World to finish downloading, who wants some Christmas photos? I’m sure you do…

FiL and MiL’s Battle of Extravagance

So, Mat’s house has always had a tennis court and an indoor swimming pool, right? But when we went over to visit last year we found this:

Father-in-Law's golf course. It seems to get bigger every time I visit.

Yes, kids, it’s a golf course. Or, at least, one hole thereof. Father-in-Law had it landscaped in so he could… I dunno, practice his golf I guess. Every time we visit there seems to be more work going on; pulling down trees, adding new tee-off spots, adding additional shielding so no more windows get broken… (I’m standing just outside the front door to take this shot; they’ve got a weird battleaxe block.)

So, in retaliation, Mother-in-Law covered over the swimming pool and stuck this in the room instead:

Yes, it's an industrial-quality quilting machine. Every home should have one.

It’s an industrial-grade quilting machine. You know, for making quilts. It’s twelve feet long.

No island yet, but we’re working on it.

Christmas Day

The Trollbeads bracelet I got from MiL and FiL.

I had trouble photographing these, and unfortunately the best shot had my pasty had in it. So short of cracking out the PhotoShop… here you go. My Trollbeads bracelet. It’s very cool.

Of course, present opening is always more fun than present-cleaning-up-after.

Mmm, presents.

Mum’s Surprise

So after a surprisingly relaxing two-ish weeks in Wollongong, we come home to find:

My mother is a fucking genius, seriously. This is the bedspread and sheet set she made us for Christmas, produced from a cut-up sari and some other miscellaneous pieces of silk. The throw pillow — which really impressed Mat — is made from woven ribbons.

This is actually the… third (I think) one of these she’s made. The first was silver and green, and still lives on my old bed at their place. I keep persuading her to take commissions, but she’s like me, and does this stuff for the love, not the money.

So there you go; Christmas in pictures. A-aa-and PW’s finished downloading so I’m off to check that out.

I’ll let you know how it goes.

Mirrored from void-star.net β. Comments are preferred on the original.

Ho Snap, 2009!

2009-01-01T12:15:23Z

2009's first crapart.

Happy new year, everyone!

And here, have a crappy photo of the first art if the year, drawn at Husks and Alysande’s party. Because I’m a dag like that.

In my defence, the night’s other activities were 500 and Lips…

Mirrored from void-star.net β. Comments are preferred on the original.

Thoughts on zOMG!

2008-12-30T23:24:22Z

So the other day I posted my first impressions of Gaia Online’s attempt at an MMORPG, zOMG!. Since then, I’ve had some more time to think and played a little more, and, well… while my initial impressions of zOMG! were fairly positive, in the intervening days I’ve hit what I guess is the game’s equivalent of a level curve, and it’s made me rethink my initial standpoint.

zOMG! still isn’t a bad game, but it suffers greatly from its confused parentage. The fact that it’s still in beta gives a bit of hope that some of these structural issues can be fixed, and in the grand tradition of the internet, here’s what I think needs doing:

#1: Decide What Kind of Game We’re Playing (or, If This is a “Casual MMORPG”, Then Make It One)

zOMG! is supposed to be a “casual MMORPG” but it isn’t. Ideologically, it owes a lot of to games like Ragnarok Online, Final Fantasy XI and FlyFF, which in turn come from what I guess is the Asian branch of MMORPG design. It differs from western ideas — seen in games like World of Warcraft, Everquest and Guild Wars — in that the focus is on, a) grouping, and b) grinding.

Now, I know a lot of casual MMO players, and as a general rule neither of those things are what they look for in a game. As a general rule, casual gamers like a fast-paced game with small, easily-achievable goals that build to something longer. Your standard casual is looking for something they can pick up for five minutes or five hours; give them a hundred “kill 5 mobs” quests and they’ll be much happier than if you tell them to kill 500 from the outset.

#2: Get Rid of the Emphasis on Grouping (”Crewing”)

In casual play, grouping should be something people do for fun, not something they do because the game mechanic forces them to. MMORPGs that are successful in the casual market (particularly WoW) are so because the majority of their content is accessible solo. With that in mind:

Be very, very careful about making grouping do things like increase normal drop rates. Players should not feel penalised for not grouping, but neither should they feel penalised for being in a group.
Quests that require a group should not “break” a quest line, especially if questing is your primary way of levelling up.
Understand that if you do implement content that requires a group to complete, a lot of players are going to takle that content by going away, levelling elsewhere, then coming back to finish off the lower-level content when they’re more powerful.
Get rid of the G’hi meter. Seriously; this is the nastiest mechanic in any MMORPG I’ve yet to encounter. Better yet, merge it with Stamina (i.e. rename the boringly generic ‘Stamina’ to the more zOMG!-specific G’hi) and remove any links with “social” activities. For the record, “social” and “casual” are not the same thing. Gaia already has plenty of outlets for the former.

Read the rest of this entry »
Mirrored from void-star.net β. Comments are preferred on the original.

Meanwhile, on the Internet…

2008-12-30T06:59:43Z

thornsilver @ 2008-12-18T12:00:00
10,000 time better than the original.
Update Day– HE6
(Second link.) This is freakin' awesome; the world's oldest computer, finally reborn by SCIENCE!
zOMG!
100 Things Meme
hunting

Mirrored from void-star.net β. Comments are preferred on the original.

zOMG!

2008-12-29T00:52:43Z

zOMG!'s Null Chamber

So I was trying to do the good thing and use Shutdown to catch up on my RSS feeds the other day when I came across a post mentioning something called zOMG!. Turns out this is the name of Gaia Online’s long-promised browser-based MMORPG. Being the sucker for punishment with the love-hate relationship with Gaia that I am, I decided to go check it out.

So. zOMG! (and yes, that’s really what it’s called) is, indeed, a MMORPG. I guess it kind of plays like a mish-mash of Ragnarok Online and The World Ends With You, in that it looks like the former but the concept (and the loading screen) is more like the latter. The nutshell back story is that A Mysterious Force is affecting the Gaiaverse and causing inanimate objects to come alive and start attacking people. These ‘Animate’ can only be fought by magitek-style Rings, which make up the sum total of both abilities and equipment in the game. That’s more-or-less it. There are no classes, and levelling is done indirectly by upgrading your rings, and therefore active abilities, (which means that yes, you can supposedly “de-level” yourself by unequipping stuff) and directly by a system called G’hi — which governs passive stat boosts — that I’d be damned if I can figure out.

Gaia markets zOMG! as a “casual MMORPG”. Some of you may remember a while back I Delicious-posted a link to an article wherein a guy from Gaia was essentially ragging on WoW for not being “successful enough”, and it’s fairly evident that zOMG! is Gaia’s attempt to try and one-up the current Lord of the MMORPG. If that’s the case, zOMG! is a dismal failure.

Let’s get this straight. I’ve played a lot of crappy free (and “free”) MMORPGs and zOMG! is by no means the worst of them. It’s questing system is solid, it looks pretty, and there aren’t too many bugs.ⁱ But it falls down by, a) inheriting the flaws of its parent site, and b) not actually being casual.

Thing is, you can’t really “do” zOMG! in isolation, which means it’s never, ever, ever going to attract a large gamer playerbase. The physical appearance of your character, in particular, is purely your forum avatar, carefully crafted from the items bought with forum gold. For those of you who don’t “do” Gaia Online, you get gold for participating in forum activities which you can then use to purchase clothing for your avi. It’s also possible to obtain gold and certain items directly with real-world cash, or from other users. Like Second Life, Gaia is essentially a giant pyramid scheme made up of those people who have a skill (most notably artistic) and those who don’t. This concept becomes important, because on the 8th of December this year, Gaia changed the implementation of zOMG! so that Rings could no longer be traded to other players (they even use WoW’s word for it; Soulbound).

From a pure-MMORPG standpoint, this makes sense. From a Gaia standpoint, it’s a total WTF move, since everything in Gaia is for sale and that fact is the whole basis of the site. At about the same time as this happened, they also apparently significantly lowered the drop rate of the Orbs required to level up; they’re now mostly only obtainable from questing. And these two facts combined totally blow Gaia’s claim that zOMG! is somehow “casual” right out of the water. Unless, of course, you come from the land where “casual” means “requires grind and luck, but no skill or strategy”. (Which, okay, is probably a pretty populated place.)

In short, the game is a grind. And it’s ridiculously unbalanced; some Rings are massively more useful than others, which is okay in the grand scheme of things but makes the game impossible if you’re unlucky enough to start with a craptacular combination like Solar Rays and Healing Halo. Neither Ring is bad per se… as secondaries. Solar Rays is ranged but low damage, single-target and has a long cooldown, necessitating a lot of kiting.ⁱⁱ Healing Halo is a HoT, which is great pre-combat but useless in an emergency. I was about to give the game up as too fucking frustrating until I read that pre-Soulbonding Rings were still being sold on the Marketplace, so went and nabbed me Slash and Diagnose. The difference was astounding; I was slaughtering up the Village Greens in no time.

I kind of understand Gaia not wanting people to go out and be able to buy level 10 Rings on their first day out, but similarly I don’t think making everything Soulbound is the right response either, especially in light of how difficult new rings are to acquire (I’ve had one drop randomly and obtained two via quests… of which I only actually received one, q.v. footnote). Personally I’d be more keen to see some kind of a system where the Ring levels you can equip are based on some stat intrinsic to your character. Protip, Gaia: This is exactly why most games have character levels. Keep Soulbinding if you want, but leave it off until a character levels a Ring with a Charge Orb.

Seriously, the price of Rings on the Marketplace is only going to increase exponentially otherwise. In fact, I’m going to go invest in some right now — and diligently not equip them — just so I can sell them off in six months.

The second main problem I have with zOMG! is that its buff items are only purchasable via real-world cash. Guys, fuck off. If you’re going to do shit like that, make Rings and special buffs cash-purchasable, like every other fucking quote-unquote-free MMORPG. Not the base level equivalent of a health and mana potion.ⁱⁱⁱ

My final problem is G’hi. I don’t really know what it does, but you get more of it by “being social”; specifically chatting and grouping, but at worst you can just hang out in town. As someone who is very much a solo player, I loathe the mechanic. Protip x2: Using a shitty mechanic in your game to force people to group up does not make your game “casual”. Seriously. I have to waste so much time constantly walking back to Barton to refill my G’hi to keep my drop rate up^iv and it’s just boring.

So, yeah. Like I said, zOMG! isn’t the worst MMORPG I’ve played, but overall it feels like it was created by people who’ve played in the genre before but don’t really understand the economic and social mechanics behind it. And like the rest of latter-day Gaia, it tries way too hard to be cool to actually, like, be cool (protip: it’s a group, not a ‘crew’). Let’s give it, oh, 6 out of 10 stars. And that’s generous because I’ve already got an established Gaia avatar, am a long time (MMO)RPG player and am old enough and employed enough to be able to shell out a couple of bucks for an online game, if I have to. For people who are a) new to Gaia, b) new to MMORPGs, and/or c) too young to have credit cards and a disposable income you’re looking at something closer to a 4. And guys, seriously, that’s your core demographic.

I don’t think WoW needs to feel threatened just yet.

The worst I’ve found so far was a quest that didn’t correctly give me a reward. Considering the reward was supposed to be a Ring, that really sucked. ↩
Luckily, I also acquired a Gumshoe as a drop in the first zone, which worked for exactly as long as it took to start having to kill enemies in groups. ↩
You get about thirty when you start out. My advice: Treat them as if you’re never, ever going to get any more. ↩
I dunno either. ↩

Mirrored from void-star.net β. Comments are preferred on the original.

100 Things Meme

2008-12-26T12:44:18Z

You know what we need? That Hundred Things Meme.

I’ve apparently done 41 of the things on this list. I’ve got most of the Euro-centric ones down, but am hampered by not having been to the States. Stupid north-o-centric meme; where’s my things like “Visited the Great Barrier Reef” and “Climbed Uluru”? Not that you’re supposed to or anything, but still!

Anyway, full list behind the jump. Booyah!

Read the rest of this entry »

Mirrored from void-star.net β. Comments are preferred on the original.

Christmas Unwrap

2008-12-25T04:42:19Z

So, Christmas, eh?

Well, this year was the first year since I’ve been with Mat that we’ve spent down in Wollongong with his family, rather than up in Canberra with mine. Usually we do Christmas in Canberra, then New Year’s in Wollongong, but I suppose now that we’re all married and stuff we should work out some kind of alternating timeshare arrangement.

Anyway.

Some stuff happened at work in the week before Shutdown that had left me not a particularly happy camper. Getting out of town was probably about the best thing for me, and spending the last couple of days at Husks and Alysande’s with Braken playing World Tour and WCIII custom maps has been good for stopping me feeling sorry for myself.

We also got the have a look at Mother-in-Law’s new quilting machine, ostensibly bought in retaliation for Father-in-Law putting in a golf green last year. Said quilting machine is twelve feet long. Yes, you read that right; it’s an industrial-grade sewing machine that’s about twice the length of a person. We all thought mum’s factory straight-stitcher was over the top.

With this in mind, Mat’s trying to persuade his parents to buy either a) a private island, or b) a castle, but so far neither idea seems to be taking. I’d totally volunteer to go live in the Family Castle, especially if it ended up being built in one of the small, industrial towns the family has ties to. The fandom lulz alone would be worth having to live in, say, Gladstone or Port Headland. Oh well, maybe in a few years with this whole GFC thing blows over.

So, Christmas swag:

A new mattress from and to Mat;
A sweet ex-sari quilt sheet set from mum for said mattress;
Handmade chocolates from Alysande and Husks;
Free dinner from Braken;
Various sundry things like chocolates and shortbread (mm, my weakness); and
A Trollbeads bracelet from MiL.

That’s an interesting one. I hadn’t heard of these before specifically, but I’ve seen the concept done before by more mainstream jewellery retailers (I think they’re called “Pandora” or something). It’s more-or-less a charm bracelet, albeit not tacky. I’ve currently got a berry, fairy, five faces, lucky dragon, origami, planet, Art Deco, royal and a neither fish nor bird with a fish lock. And, damn, it’s bad because I love semi-symbolic collectable shit like this, and I can already see myself buying, say, a bead of fortune and a Midgard Serpent to add in, and it’ll just get worse from there. Luckily they sell special boxes for the excess beads.

Mat loves it when I spend money, hey.

Anyway, that’s Christmas. We’re here until after the new year, so maybe I’ll be ready to go back and face work by then (har har). Right now, it’s just that lazt time after Christmas lunch. Mat is playing DotA and his brothers are camped out in front of the projector trying to figure out how to play World Tour (assembling the drumkit was almost more lulzworthy than playing it). Me, I’m going to see if I can find a cable to get the photos off my camera (if this post has photos, the answer was yes) then maybe… have a nap. Or install WoW on the laptop and make Mat play tower defence with me. Either works.

Best wishes for the season to y’all.

Mirrored from void-star.net β. Comments are preferred on the original.

Music Monday 4.2: Christmas

2008-12-22T11:32:28Z

What’s that, it’s Christmas soon?

Here, have some music.

#6. The Pogues feat. Kirsty McCole, “Fairytale of New York” (watch)

You’re a bum, you’re a punk
You’re an old slut on junk
Living there almost dead
On a drip in that bed
You scum bag, you maggot
You cheap lousy faggot
Happy Christmas your arse
I pray God it’s our last

Trufax: This is my absolute favourite Christmas song of all time. I think you can probably figure out why…

7. Trans-Siberian Orchestra, “Christmas Eve / Sarajevo 12/24″ (watch)

For those of you who don’t know, the Trans-Siberian Orchestra are a side project of prog metal band Savatage. They do Christmas carols. And that’s pretty much it. Since I originally got this song off Random, it’s more-or-less the official Urban Nordica Christmas Special theme song.

#8. Band Aid, “Do They Know It’s Christmas?” (watch)

There’s a world outside your window
And it’s a world of dread and fear
Where the only water flowing is the bitter sting of tears
And the Christmas bells that ring there are the clanging chimes of doom

Ever wondered where that whole “starving Ethiopians” trope comes from? Well, it’s this! Sort of. In the mid-1980s there was a massive famine in Ethiopia. Western apathy towards the situations caused erstwhile rock drop-out Bob Geldof to take matters into his own hands, by doing what he did “best”; writing a shitty pop song, the proceeds of which went to support the cause. Singer-celebrities were variously pleaded, cajoled and coerced into participating, which if I’m not mistaken makes this song the first charity fund-raiser pile-on. Band Aid sky-rocketed Geldof to knighthood, and the song is… sadly catchy, despite its godawfulness (q.v. lyrics above). Even Geldof has decried its artistic merits, and that’s really saying something. (Oh, and check out Bono’s terrible 80’s hair in the videoclip, just for extra lulz.)

#9. The Darkness, “Christmas Time (Don’t Let the Bells End)” (watch)

Well, the weather is cruel
And the season of love warms the heart
But it still hurts

Who doesn’t love The Darkness? Well, you suck. No really.

#10. Mariah Carey, “All I Want for Christmas is You” (watch)

I won’t ask for much this Christmas
I don’t even wish for snow
I’m just gonna keep on waiting
Underneath the mistletoe

I had the misfortune of hearing this in an airport last Christmas when I happened to be in the right frame of mind to associate it with the trope of the Grinch-like loner character whose pride won’t allow him (and it’s always a him) to drop his miserable facade and join in the Christmas fun. Hell, he probably doesn’t even want to… but that doesn’t mean he wants to be alone, either. So I can justify it, but sadly the bottom line is that this so is way too catchy for its own good. And now you know. Bonus fun: Oddly disturbing videoclip.

Fun Music Monday facts! Remember last week? Well, Box.net is telling me it got a total of sixteen downloads. “Woke Up This Morning” was the standout winner, with six downloads, followed by “Dig, Lazarus Dig!!!” with four. Sadly, my favourite song of the rotation, OK Go’s “Invincible”, received a measley one download. Geeze people, c’mon!

Want to know the weirdest thing, though? The most downloaded song from any Music Monday ever — with 29 total downloads since whenever Box.net started counting these things — is apparently Plastic Bertrand’s “Ça plane pour moi”, which comes from MM 3.6’s Smallville mix.

Go figure.

Mirrored from void-star.net β. Comments are preferred on the original.

WordPress Security 101

2008-12-22T00:23:27Z

I guess the one downside to switching from sk.log to WordPress is that I’m no longer protected, security-wise, by everyone’s favourite method, security-by-obscurity. It’s the trade-off, I guess. I no longer have to maintain my own code (yay), but WordPress is a huge target, simply because of its popularity and scope. Of course, considering it’s scope — and the fact that its code is easily obtainable — it’s actually pretty secure.

If you install it right. Which most of you probably don’t. So, without further preamble, here’s Dee’s “quick” WordPress Security check-list…

The Database

Never, ever, ever, ever ever use your domain’s CPanel login as the username and password for your database. Some hosts nowadays won’t even let you, which is a Very Good Thing. This isn’t just a WordPress thing, either; you should never run any webapp using these credentials. For those of you on hosted on other people’s domains, this also holds true for not making your database login and password the same as your FTP login and password.
Do create a new database and user account just for WordPress. Sometimes this isn’t possible or practical, but if you can, you should.
If your website is called, say, void-star.net then for godssakes do not make your database name something like vsnet. Think of your database name like a second password, and try and make it something hard to guess.
Speaking of passwords, do make yours hard to guess. There is (probably) no reason for you to ever use your script’s database account interactively, or to ever have to re-enter the password, so it doesn’t matter if you forget the login details.ⁱ Hit up a random generator and get yourself something long (no less than eight characters) and full of symbols, numbers and upper- and lowercase letters. Hell, make a shorter one for the DB username too, while you’re there.
When you assign your WordPress database user to the database, it’s a good idea to limit the rights it had. Admittedly, the rights WordPress needs (SELECT, INSERT, UPDATE, DELETE, CREATE, DROP) are pretty broad, but still. It’s the principle of the thing.

The Filesystem

WordPress has some funky auto-updating stuff (with more getting added every release), and while that’s awesome, get your hands away from chmod. Most hosts nowadays run something called phpSuExec, which runs your PHP scripts as your user account rather than the “anonymous” Apache user. This means they’ll be able to interact with your files directly, without any special (i.e. anonymous) permissions. Note that this won’t protect you from weaknesses in the script itself, but it can stop some remote exploits.

If, for some reason, your host doesn’t use phpSuExec… find a new host.

WordPress

WordPress itself is surprisingly free of vulnerabilities, if you take into account the scope of the product. And, okay, that statement maybe runs counter to the “common sense” view, but the WordPress developers have generally been fairly savvy about jumping on issues as soon as they arise. What this means for you as a user, however, is that it is imperative that you update your WordPress installation whenever a new version is released. WP’s structure has always made this a fairly simple process,ⁱⁱ and post-2.7 it’s even easier (one button click; yum).

The other major security issue at the default admin account. The fact that WordPress continues to insist on calling this account ‘admin’ after all this time is a little baffling, considering that a large number of WP vulnerabilities rely on this account having this name; including, of course, a straight-out brute-force password crack attempt. There’s not a lot you can do about a brute-force password attempt in WordPress, other than follow general good password security practices.ⁱⁱⁱ It’s a failing of the script.

The first thing you should do, however, is either rename your default admin account or de-privilege it somehow. Everyone has a different method for doing this. Users with existing blogs — who’ve probably been using the admin account since they installed — will want to go into the database (probably via phpMyAdmin) and change the username manually. Users with new blogs have it a bit easier; they can simply create a second account, assigned it the Administrator role, then either demote the “old” admin account down to Subscriber or simply delete it completely.

… and More?

That’s a start. It’s a good start, true, but there’s always more you can do, if you’ve a mind to. As always, a good place to start is WordPress.org itself.

Of course, if you do, you can always check the config file. ↩
So long as you use the API in the way it was intended… but that’s a whole separate rant in and of itself I think. ↩
I feel compelled to point out, that having a highly complex password doesn’t stop a brute force attack, only slows it down. It’s still entirely possible that the first string a cracking script attempts is going to be your password, even if it is sixteen random alpha-numeric characters with uppercase and lowercase. It’s not likely, but that’s probability for you. Having a password made up solely of a dictionary word significantly increases the likelihood it’s going to be broken, and note that dictionary-based hacks are not fooled by a) non-English words, or b) doing things like replacing the letter ‘a’ with the number 4. Seriously, they’ve thought of that. ↩

Mirrored from void-star.net β. Comments are preferred on the original.

TV Shows as Exes

2008-12-19T09:11:42Z

Picked this one up randomly and thought it was kinda cute…

The one who seduced you and fucked you over and broke your heart in a million pieces and laughed about it: Doctor Who. Fuck you, Moffat.
The old flame you don’t see very often any more but whom you still really enjoy getting together with for a few drinks and maybe a pleasant nostalgic romp in the sheets: The X-Files. Or at least the first four-ish seasons thereof. Adored them at the time (I had the books, the trading cards, the diary), and while the old spark has gone, it’s nice to sometimes pick it back up again and remember the good times.
The mysterious dark gothy one whom you used to sit up with talking until 3 a.m. at weird coffeehouses and with whom you were quite smitten until you realized he really was fucking crazy: Buffy the Vampire Slayer. Fuck you, Joss. You had a good thing going until you got over-confident.
The one you spent a whole weekend in bed with and who drank up all your liquor, and whom you’d still really like to fuck again although you’re relieved he doesn’t actually live in town: Twin Peaks. This is the the only thing David Lynch has ever done that I’ve ever thought was worth the reels it was filmed on. I think it’s probably because the format forced him to be a bit more narrative and a bit less fucking pretentious.
The steady: Law & Order. I could just… sit down and watch these all day. Have, in fact. Jack McCoy is, like, my #1 Fictional Hero.
The one you repeatedly cheat on your steady with: Law & Order: SVU. Up until the last season or so — and after Jerry Orbach passed away — I loved the core cast more. Munch and Fin particularly. I haven’t been so keen on the recent seasons, since they seem to be shifting to a more character- rather than event-focused show, but I have faith.
The alluring stranger whom you’ve flirted with at parties but have never gotten really serious with: Queer as Folk. It’s not really my genre, so eventually even the copious fanservice got kinda dull.
The one you hang out with and have vague fantasies about maybe having a thing with but ultimately you’re just good buddies ’cause the friendship is there but the chemistry ain’t: Dexter. It’s good and I like it… but watching it leaves me with this niggling feeling that it’s less clever than it thinks it is, which keeps from from, like, like liking it.
The one your friends keep introducing you to and who seems like a hell of a cool guy except it’s never really gone anywhere: Smallville. Okay, “cool” might be an overstatement, but there are enough good concepts in this sorry excuse of a show for me to want to like it… but I just can’t. This has, unfortunately, forced me into a Clois-style love triangle with the show’s much slicker, sexier, better-written and more canonically consistent fandom alter-ego. Irony.
The one you slept with on the rebound who still smiles at you, yet you have no interest in any more: Angel. The rebound being, of course, Buffy. As with that, I loved it until I realise the creator was a toolbox.
The one who’s slept with all your friends, and you keep looking at him and thinking, “Him? How the hell did he land all these cool babes?”: Torchwood. I just… don’t get it. Maybe it’s because I’ve never been a fan of Captain Jack.
The one your friend has fallen for like a ton of bricks and whom she keeps babbling to you about on the phone for hours, and you’d be happy for her except you just know it’s going to end badly: Heroes. Another series that thinks it’s a lot fucking cleverer than it actually is. I’ve found, as a general rule of thumb, that the more you read “real” comic books, the less you’re likely to enjoy this show. I put it down to the fact that it’s not presenting us with anything new… it’s just that not a lot of people realise that.

Mirrored from void-star.net β. Comments are preferred on the original.

Overheard at Breakfast

2008-12-15T21:50:59Z

So I’m standing there, waiting for my raisin toast, when:

BoHo Chick: I’d like a chai soy mocha latte with decaf thanks.
Italian Café Owner: … what?
Chick: A chai soy mocha latte with decaf.
Café Owner: (very confused) Chai is–
Chick: I know what chai is. I was a barista you know.

With that attitude, no, I didn’t know.

Here’s the deal, BoHo Chick. There are two types of cafés in this here city. There are hipster American-style cafes where they serve things like your chai soy mocha latte with decaf (that is to say, things that wouldn’t know a coffee if it sprinkled cinnamon all over them) and there are cafés owned by Italian, Turkish and Greek immigrant families who make exactly one thing: Coffee. Thick, black and like it was Back In Ze Old Kontry. You do not walk into one of these places and ask for you chai soy latte whatever, any more than a sane, coffee-loving person walks into one of the Americanized cafés looking for a cappuccino.

Seriously.

Oh, and cut your fringe out of your eyes. You look like a horse.

In shamefully related news, both hot water urns here at work are broken. That means no tea. A whole day with no tea. I should claim unduly cruel conditions and go home.

Mirrored from void-star.net β. Comments are preferred on the original.

links for 2008-12-12

2008-12-12T22:10:19Z

EXTRALIFE (2008-07-30)

May your blades never dull.

(tags: funny warcraft:wow comics:web)
Kirby really is a radical: he made court courteous

Farewell, Kirby, you’ll be missed.

(tags: australia law people:michaelkirby)

Mirrored from void-star.net β. Comments are preferred on the original.

The Eater

2008-12-11T11:29:51Z

Remember that meme the other day? Well, Random foolishly asked for Urban Nordica! …as it would play out on The Discworld.

This is probably not quite what he was intending but, well…

Read the rest of this entry »

Mirrored from void-star.net β. Comments are preferred on the original.

links for 2008-12-10

2008-12-10T21:01:38Z

Acting Pet Peeve

You know how, in a play or a film or a television show or even a commercial, two characters will be talking and one of them will interrupt the other? Of course you do, I mean, obviously. But you know how almost everyone always delivers the interrupted line as if the character knew zie was about to be interrupted?

(tags: opinion acting)
Deconstructing the Myths of “The First Thanksgiving”

A bit late for the season, I know, but I never could resist a downer ending… so long as it's someone else's.

(tags: usa history)

Mirrored from void-star.net β. Comments are preferred on the original.

Drabble Meme (and Stuff)

2008-12-10T09:41:16Z

I’m feeling restlessly creative.

Help me channel it, people! Give me a scene or plotbunny from a fandom or even an original series and watch as I attempt (or maybe not) a drabble (or possibly art) from it. Booyah.

You know what I did the other day? Batch scripting. Yanno, like bash in *NIX but ten thousand times more retarded. In a nutshell, what I had to do was look for the last modified date on a specific file in every subfolder in a directory, and if it was older than a certain date, delete it. The extra stipulation was that the program should be able to be run both in “check only” and “active” mode.

It took me about a day to figure it out, but in the end I got:

@echo off

setlocal ENABLEEXTENSIONS



:::: START EDITING :::::::::::::::::::::::::::::::::::::::::::::::::::::

:: where are we looking?

:: NO quotes around the path

set lookdir=D:



:: delete anything that hasn't been looked at since...

:: year only, anything this age or older will be deleted

set maxdate=2007



:: what are we excluding?

:: space separated list of directory -prefixes- to ignore

set dontcare=zz tem



:: where can we stick our working?

set logfile=results.log



:: our working files and where they live

set tempdir=.

set dirlist="%tempdir%\dirlist.tmpfile.%random%"



:::: STOP EDITING ::::::::::::::::::::::::::::::::::::::::::::::::::::::



:: do we want help?

if "%1"=="/h" goto SYNTAX



:: reset our logfile

echo. > %logfile%



:: get all our directory names and stick them into a temporary file

dir /b "%lookdir%" | findstr /v /b /i "%dontcare%" > %dirlist%



:: make sure we've got a checkfile.ext file in all these directories

for /f %%d in ('type %dirlist%') do (

  if exist "%lookdir%\%%d\checkfile.ext" (

:: now check the date it was last modified

    for /f "tokens=1" %%t in ('dir "%lookdir%\%%d" ^| findstr /i "checkfile.ext"') do (

      for /f "tokens=3 delims=/" %%x in ("%%t") do (

:: check our date, and if it's less than or equal to maxdate, do stuff

        if "%%x" leq "%maxdate%" (

:: log the name, date last modified and size

          for /f %%s in ('diruse "%lookdir%\%%d" ^| findstr "[^SUB-]TOTAL:"') do ( echo %lookdir%\%%d %%x %%s >> %logfile% )

:: and if our /d argument is set, delete the directory

          if "%1"=="/d" rd /s /q "%lookdir%\%%d"

        )

      )

    )

  )

)



goto END



:::: SYNTAX HELP OUTPUT ::::::::::::::::::::::::::::::::::::::::::::::::

:SYNTAX

echo.

echo DIRCLEAN.CMD ^[^/h^|^/d^]

echo   If run with no options, the script simply outputs the list of

echo   directories to be deleted to a file, in addition to the date to the

echo   date they were last accessed, and the size of the directory (total

echo   size needs to be calculated externally; sorry about that).

echo.

echo OTHER OPTIONS:

echo (Note that these are CASE SENSITIVE.)

echo   ^/h   Output help.

echo   ^/d   Delete found directories.

echo.



:::: GOODBYE! ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:END

... wow. The script is crazy inefficient, and I'm sure I program DOS like someone who's used to Perl, but... hey, it worked. And lo, I acquired a new skill.

Next step: VBScript. Shudder.

Trufax: There's some chick who regularly pops up on Mat's Vent with the most irritating, lilting valleygirl accent in the entire universe. Every time she speaks I want to punch the speakers.

That's... probably not good, hey?

Mirrored from void-star.net β. Comments are preferred on the original.

links for 2008-12-08

2008-12-08T20:28:34Z

Windows XP Commands

Man I “love” batch scripting. In the way where I totally don’t.

(tags: microsoft:windows:dos programming)

Mirrored from void-star.net β. Comments are preferred on the original.

Later That Night…

2008-12-07T05:01:36Z

So this sitcom ad pops up while we’re lying in bed watching Lord of the Rings…

Him: What’s that about?

Me: Why would I know?

Him: You’ve got friends on the internet who watch bad TV shows, right?

Me: Only ones with a dominant homoerotic subtext.

Him: Good point.

Mirrored from void-star.net β. Comments are preferred on the original.

WordPress 2.7 RC1

2008-12-06T05:05:21Z

Well, since JournalPress should now be compatible, I’ve converted β over to WordPress 2.7 RC 1.

Overall, I’m in a bit of a mixed mind about the new version. Some of the admin panel changes are pretty cool, but I’m not keen on the grey and blue theme (not enough contrast… and I never thought I’d be saying that). It took me about half a day to wrangle with the new wp_list_comments() comment API, and I was almost ready to give up in annoyance before I realised it supported a function callback for overriding the default style. Thank gods. I spent a couple of hours fretting over the fact that my comments didn’t seem to be threading in my dev site, before realising that they were only having that issue on one page. Which then didn’t follow me when I gave up and uploaded everything.

So it all works.

For those of you who’re curious, the custom comment function I use is:

<?php

function vs_comments( $comment, $args, $depth ){

  $GLOBALS['comment'] = $comment;

  $av = empty( $args['avatar_size'] ) ? 50 : $args['avatar_size']; ?>



    <li <?php comment_class(); ?> id="comment-<?php comment_ID() ?>"><div id="div-comment-<?php comment_ID() ?>">



      <div class="avatar-bkg"><?php echo get_avatar( $comment, $av ); ?></div>

      <div class="entry-comment">

      <ul class="comment-meta">

        <li class="comment-meta-name"><cite><?php comment_author_link() ?></cite></li>

        <li class="comment-meta-date"><a href="<?php echo htmlspecialchars( get_comment_link( $comment->comment_ID ) ) ?>"><?php comment_date('jS F, Y') ?> @ <?php comment_time() ?></a></li>

        <li class="comment-meta-reply"><?php comment_reply_link( array_merge( $args, array( 'add_below' => 'div-comment', 'depth' => $depth, 'max_depth' => $args['max_depth'] ) ) ) ?></li>

<?php if( $comment->comment_approved == '0' ) : ?>

        <li class="comment-meta-mod">Awaiting Moderation</li>

<?php endif; ?>

        <?php edit_comment_link( 'Edit','<li class="comment-meta-edit">', '</li>' ); ?>

      </ul>



<?php comment_text(); ?>

      </div>

      <div style="clear: left;"></div>

    </div>

<?php

}

?>

And while I'm posting code, I also knocked up something quick to display JournalPress-compatible currents somewhere either above or underneath a post. This'll be rolled up nicer into the next release, but for now:

if( get_post_meta( $postID, 'mood', true ) || get_post_meta( $postID, 'music', true ) || get_post_meta( $postID, 'location', true ) ){

  echo "  <ul class=\"post-meta post-currently\">\n";

  if( get_post_meta( $postID, 'mood', true ) )

    echo '   <li class="post-meta-mood"><span class="post-meta-key">Mood:</span> ', stripslashes( get_post_meta( $postID, 'mood', true ) ) ,"</li>\n";

  if( get_post_meta( $postID, 'music', true ) )

    echo '   <li class="post-meta-music"><span class="post-meta-key">Mood:</span> ', stripslashes( get_post_meta( $postID, 'music', true ) ) ,"</li>\n";

  if( get_post_meta( $postID, 'location', true ) )

    echo '   <li class="post-meta-location"><span class="post-meta-key">Mood:</span> ', stripslashes( get_post_meta( $postID, 'location', true ) ) ,"</li>\n";

  echo "  </ul>\n";

}

What a productive weekend. Or something.

Edit: ~~Yes, yes. I know the code breaks LiveJournal. Bite me.~~ Okay, less so now. This was a quick fix in WP-Syntax to stop it freaking over the WordPress visual editor:

    $code = htmlspecialchars_decode( wp_syntax_code_trim($match[3]) );

Mirrored from void-star.net β. Comments are preferred on the original.

JournalPress v0.2

2008-12-05T11:55:53Z

Woohoo, JournalPress should now be compatible with WordPress v2.7 RC1. There really wasn’t much to change, apart from the fact that I was apparently using a depreciated API hook to add the meta box to the new post page. So that’s now been updated to use add_meta_box() like a good plugin, and all should be dandy.

2.7 puts the Add Mirrors page in an exceptionally stupid location¹, which I’ll fix eventually (maybe), but for now take heart by the fact that there’s a new little plugin page hook that allows you to add custom link options. Now if only people actually read the instructions instead of emailing me every time they can’t find something…

I’ve also rolled up that fix for the non-Roman characters on the Settings page, so all should be well. There are a couple more minor features to get slotted in before I go back to poking at The Big One (userpics), but I think this weekend will be spent updating β’s template to use 2.7’s native threaded comments.

Or playing WoW… or Fallout 3. I haven’t decided yet.

It’s under Tools, if you’re looking. [↩]

Mirrored from void-star.net β. Comments are preferred on the original.

JournalPress v0.1.3

2008-12-04T10:05:16Z

So, those of you who use JournalPress will note that it hit v0.1.3 last night. This is mostly a “tweak” version, with the following changes:

Debugged some of the backdating stuff. It’s a bit more brute force now, but hopefully more reliable (maybe).
Added the ability to tag a post with categories, tags or both (you’ll need to re-update your options).
JournalPress should now accept non-Roman characters in the crosspost text, music and mood field (location and tags still have issues, but I maintain this one is LiveJournal’s fault).
Quotes no longer cause icky backslashes to appear in the mood, music and location fields.
Thanks to some of the world’s most convoluted return code, errors are now no longer silent.

Alas, despite my efforts with UTF-8 to entity conversion, I still missed out the appropriate part on the admin page that will allow those of you who use non-Roman characters in things like your linkback or custom journal name to actually, like, edit those. I’ll roll the proper fix into v0.1.4, but if the issue is bugging you right now, you can open up journalpress/jpfunctions.inc.php and change the following on line line 114:

114	<?php echo htmlentities( $old_name ); ?>

To:

114	<?php echo htmlentities( stripslashes( $old_name ), ENT_COMPAT, 'UTF-8' ); ?>

And again on line 153:

153	<?php echo htmlentities( stripslashes( $old_custom_header ) ); ?>

To:

153	<?php echo htmlentities( stripslashes( $old_custom_header ), ENT_COMPAT, 'UTF-8' ); ?>

Kudos to Anton Borisov for the tip.

Oh, and for the record, v0.1.3 is (hopefully) going to be the last release before the much-anticipated WordPress 2.7. Mmm, delicious new features…

Mirrored from void-star.net β. Comments are preferred on the original.

Die, Live.com!

2008-12-03T03:46:19Z

Since Jem’s blog ate my full comment (and I need to test the appearance of codeblocks anyway), here it is again.

The Problem: Shitty spam referrers from Live.com.

The Solution: Block the fucking things.

Sure, you can block the bot, but the bot isn’t the problem per se; it’s the referrers. I figure no-one important actually uses Live.com, so it’s not like I’m missing out on anything by banning people from coming to here from there. Besides, if someone is really keen to visit, they can always type the URL in manually.

Note that this method requires mod_security to be enabled. If you host does not have said Apache module… get a new host.

So, in your .htaccess you want:

<IfModule mod_security.c>
  # turn ModSecurity On
  SecFilterEngine On
 
  # set up rejection to throw a 501
  # you can pretty much set this to whatever you want, but I like 501 because it's unusual
  SecFilterDefaultAction "deny,log,status:501"
 
  # search.live.com requests; these are invaraibly spam
  SecFilterSelective HTTP_Referer "search\.live\.com"
</IfModule>

Beautiful.

Edit (1 Jan ‘09)

Okay, it’s been brought to my attention that people are having trouble with mod_security. Firstly, not all hosts implement it, and secondly it has a couple of functions that will break well-known scripts (including some versions of Mint and WordPress) if you don’t know what you’re doing.

But lo! All is not lost! There’s an almost-identical thing that can be done with “straight” Apache. Watch in awe:

# bot blacklist
Order Allow,Deny
Allow from all
 
# live.com
SetEnvIf Referer "search\.live\.com" bad_bot
 
Deny from env=bad_bot

Mirrored from void-star.net β. Comments are preferred on the original.

Pew Pew v0.1

2008-12-02T02:38:17Z

Pew Pew v0.1, void-star.net β

So, instead of working on JournalPress like a good girl, I’ve been delicately tapping away at the layout here at β. And lo! It is done!

I’m probably about, hrm… 64.58% happy with it, I guess. The concept was a “rough” version of what I plan to do with the finished product, hence the painted look of all the elements. That part I think worked out pretty well, but this is still definitely relegated to a proof-of-concept design rather than anything polished and final. Which, for β, is highly appropriate. Hence the layout stays.

Scarily (and unintentionally), despite being designed for Gecko/WebKit (albeit a little small on the iPhone), it also renders the same — :before and :after pseudoclasses excepted — in IE6 and IE7. Wow; I think that’s, like, a first since circa 2003.

In other news, it’s been pointed out to me that JournalPress doesn’t work with the beta of WordPress 2.7. No, it doesn’t; there’s no point wasting time on compatability to an API that isn’t finalised.

… I have a beautiful analogy for this, too, but alas I can’t use it for fear of getting Googled by work. Damnit.

Mirrored from void-star.net β. Comments are preferred on the original.

Infinite Alis

Imperfect World

It’s Showtime!

Meanwhile, on the Internet…

Christmas Photos

FiL and MiL’s Battle of Extravagance

Christmas Day

Mum’s Surprise

Ho Snap, 2009!

Thoughts on zOMG!

#1: Decide What Kind of Game We’re Playing (or, If This is a “Casual MMORPG”, Then Make It One)

#2: Get Rid of the Emphasis on Grouping (”Crewing”)

Read the rest of this entry »Mirrored from void-star.net β. Comments are preferred on the original.

Meanwhile, on the Internet…

zOMG!

100 Things Meme

Christmas Unwrap

Music Monday 4.2: Christmas

WordPress Security 101

The Database

The Filesystem

WordPress

… and More?

TV Shows as Exes

Overheard at Breakfast

links for 2008-12-12

The Eater

links for 2008-12-10

Drabble Meme (and Stuff)

links for 2008-12-08

Later That Night…

WordPress 2.7 RC1

JournalPress v0.2

JournalPress v0.1.3

Die, Live.com!

Edit (1 Jan ‘09)

Pew Pew v0.1

Read the rest of this entry »
Mirrored from void-star.net β. Comments are preferred on the original.