rare pattern

Via GigaOM:

Back in November, we looked at WordPress themes being distributed by third parties who’d embedded hidden code to allow the insertion of arbitrary content. Now a rash of sites are reporting that their blogs have been subverted....

...There are lots of reasons a hacker may want to inject code into a page:

• To infect visitors by exploiting a browser vulnerability
• To place ads they can then get revenue from
• To embed links to blogs they own, improving their page rank
• To entice people to click on links that lead them elsewhere

The clever thing about the WordPress hack was that it would check for code to insert into a page each time it was loaded, but if none was available, it would just sit there quietly.

It's all too easy to compromise a website's security via the theming layer. Malice is just one possibility. There are also hacks and vulnerable code gimmicks pursued amateur theme developers who just don't know better. It's not just a Wordpress thing -- it's all websites, whether built on open source or proprietary platforms (though not static html sites, which presumably are as safe as their servers).

In this context, the question for the website owner is whether you want to buy a theme (or download a free one) from an un-vetted vendor. Sure, if you are an adept coder, and/or know the proper API calls to protect your site from things like XSS, you can just clean that up and enjoy the design that attracted you in the first place. But if you don't know those vulnerabilities, you could be opening your site up to ill-will or novice mistakes. Caveat emptor. Don't end up like Deep Jive. Ouch.

It looks like the session we proposed for the OSCMS Summit has been scheduled for March 22nd at 1:45 p.m. 11:30 a.m [?], first last session after before lunch, in "the big room." Even though I feel confident in the topic and the deep knowledge of my co-presenters, I do feel some stage fright. Eeep!

Update: My session on community building was also booked later the same day. That concept from the start is for more of a round table discussion, so I hope people attending this one will come chock full of ideas and experiences to share.

Over the past few days, while doing some free-association doodling to clear my head between design work for clients, I came up with this crazy little theme. There's no Reboot occasion. Just needing a change here. I suppose I should add a screenshot to the portfolio, along with others in an overdue update.

Anyway, it seems to work in Firefox, Safari and IE (Win). If it's crazy breaking somewhere, please let me know.

One of the more exciting projects I'm working on right now is a semi-major website for the as-yet-to-be-announced "Client B." ("Client A" is the as-yet-announced DVD project client.)

(A note about as-yet-to-be-announced clients: Sometimes you want to announce the new gig right off, and sometimes you want to line up your ducks first -- and we like to have our ducks all lined up in pretty formations before the fanfare starts.)

Anyway....this will be an interesting site because we're building it in Drupal but, in the end, will be approaching something similar to what a CivicSpace installation might have yielded. (I won't go into the why's of not just using CivicSpace except to say that this was the client's preference.)

A big part of this project will be the incorporation of CiviCRM into the site. The site's membership is expected to jump up into the several hundreds in the early going, and having robust membership directory management features will be key.

The real challenge has been getting all the essential information into the site's front page. Most websites, frankly, don't need to manage so much information.

Needless to say, the front-page module will play a key role, and include much in the way of php code calling up lists and excerpts from recent and most-active posts. The challenge lies in keeping that front page scannable. Most front pages like this end up being an utter mess to my eye; I think concepts of visual chunking of the interactive interface elude most people. Hell, sometimes they elude me -- it's not easy, getting a lot of information on a single page without making it look like a monkey got ahold of a keyboard.

I'll also be using directed themes guided by the particular sections of the site. The exact approach -- using the sections module or the taxonomy theme module or something else -- I'm undecided on.

Anyway, this design and coding challenge is what will serve as my early holiday entertainment. We'll be going with a public beta sometime in December, so in the end it will be Client A, and the as-yet-unknown Clients C-Z, who will offer respite from Christmas carols and holiday cookies and divinity fudge and extended family.