Delaware Web Designers - Inclind, Inc Internet Professionals » How To’s

Sync Files in Drupal Using Services and xmlrpc()

Kevin Quillen — Tue, 05 Jan 2010 14:24:08 +0000

In a previous entry we explored content syncing/distributing using the Services module and XMLRPC in Drupal. We learned how to create a method, its callback, how to invoke it through xmlrpc from another server, and how to create or update a node based on that data.

Lets take a look at how you bring in files as part of that node as well. From the previous example, before calling node_save($node), I call another function to process files. Name it however you wish. My module is called homes_sync, so my hooks and functions begin with that as per Drupal standards.

1
2
3

homes_sync_get_files($node, $nid, $sessid);
// save the node object
node_save($node);

homes_sync_get_files() is passed the $node object and will return it after adding (or removing) data. To have a reliable file sync, we need to only update files if they are newer, and remove them if they no longer exist.

In this specific example, the project I am working on has two CCK file fields. One is for a floorplan (a PDF) and the other is an image field. In a node, there is only 1 floorplan, but can be up to 2 dozen images. If you had a more generic node that just has a CCK filefield of ‘client_files’ for example, your code would be slightly different.

Before we add any files to the node, the first thing we should do is compare the list of files from the remote site to the local site. We start that off by getting $files via xmlrpc, and loading the node object if $node->nid is present. If any are found on the local site, and not the remote site, we can safely remove them from the node object. The two arrays are iterated over and remove files if necessary.

function homes_sync_get_files($node, $nid, $sessid) {
 
	$files = xmlrpc(REMOTE_SERVICES_URL, 'file.getHomeFiles', $sessid, $nid);
 
	// first, compare list of files from parent server with local files
	// if our local files has something the parent server doesnt have
	// it was probably deleted. so we need to unset it from the node object
	// when it gets passed back through node_save, cck should delete it proper
 
	if ($node->nid) {
 
		$current_files = node_load($node->nid);
 
		if ($current_files && !$files) {
			// we have files locally, but none on the parent server. 	
			// remove all
			unset($node->field_floorplan);
			unset($node->field_image);
			watchdog('homes_sync', 'Remote copy of @node no longer has files. Removing all local files for @node.', array('@node' => $node->title), WATCHDOG_NOTICE);
		} elseif ($current_files && $files) {
 
			// build comparison arrays
 
			foreach ($files as $remote_file) {
				$remote_files[] = $remote_file['filename'];	
			}
 
			foreach ($current_files->field_floorplan as $local_floorplan_file) {
				$local_files[] = $local_floorplan_file['filename'];
			}
 
			foreach ($current_files->field_image as $local_image_file) {
				$local_files[] = $local_image_file['filename'];
			}
 
			// now lets see whats missing
 
			if (is_array($local_files) && is_array($remote_files)) {
 
				foreach ($local_files as $local_file) {
					if (!in_array($local_file, $remote_files)) {
						// parent site does not have this file in the node anymore
						$files_to_delete[] = $local_file;
					}
				}
 
				if (!empty($files_to_delete) && is_array($files_to_delete)) {
					foreach ($files_to_delete as $key => $file_to_delete) {
						// CCK field arrays exist in node objects even if they have no data
						// we can assume if the first record is NULL, there is no data
 
						if ($node->field_floorplan[0] != NULL) {
							foreach ($node->field_floorplan as $file_key => $floorplan) {
								if ($file_to_delete == $floorplan['filename']) {
									watchdog('homes_sync', '@file file does not exist on parent server anymore for @node. Removing.', array('@file' => $floorplan['filename'], '@node' => $node->title), WATCHDOG_NOTICE);
									unset($node->field_floorplan[$file_key]);
								}
							}
						}
 
						if ($node->field_image[0] != NULL) {
							foreach ($node->field_image as $image_key => $image) {
								if ($file_to_delete == $image['filename']) {
									watchdog('homes_sync', '@image image does not exist on parent server anymore for @node. Removing.', array('@image' => $image['filename'], '@node' => $node->title), WATCHDOG_NOTICE);
									unset($node->field_image[$image_key]);
								}
							}
						}
						unset($floorplan);
						unset($image);
					}
				}
 
			}
		}
 
		unset($remote_files);
		unset($local_files);
	}

Now that we are through with our deletion process, we can begin processing the remote files. For each file id ($fid) we call xmlrpc and get all the data and the file itself and bring it down to our local site. Based on the file extension, we begin building a query so we can look to see if this file exists locally, and what its last timestamp was. We do this so we know if a file should be replaced or not. For example, if you have MyHome.PDF on your local site, and a new version is uploaded on the remote site, simply comparing file names is not good enough. With a filename and a timestamp comparison, you are certain that it should be processed.

	if ($files) {
 
		foreach ($files as $fid => $remote_file) {
			$file = xmlrpc(REMOTE_SERVICES_URL, 'file.get', $sessid, $fid);
 
			if ($file) {
				// set filepath to save to
				// decode our content file
 
				$file['filepath'] = file_directory_path().'/'.$file['filename'];
				$file_data = base64_decode($file['file']);
 
				// set content type db table, and field to search on.
				// Load up the CCK field
 
				$filetype = explode('.', $file['filename']);
 
				if ($filetype[1] == 'pdf') {
					$content_table = 'content_type_homes';
					$fid_field = 'field_floorplan_fid';
				} else {
					$content_table = 'content_field_image';
					$fid_field = 'field_image_fid';
				}
 
				$file_details = array();
 
				// check if it's the same file coming over
				// only applies if the node exists in the first place. otherwise its a new import on a new home
				// if there is a file match we dont want to do anything but skip the creation
				// i think if you dont keep the node->file field prefilled, and returns those fields empty, it causes the file deletion on the server
 
				if ($node->nid) {
 
					$result = db_query("SELECT f.filename, f.fid, f.filepath, f.timestamp FROM {files} f
											INNER JOIN {%s} ctype ON f.fid = ctype.%s
										WHERE f.filename = '%s'", $content_table, $fid_field, $file['filename']);
 
 
 
					$file_details = db_fetch_array($result);
 
				}
 
 
 
				if ($file_details && $file_details['timestamp'] < $file['timestamp']) {
 
					// if file exists and has not changed remotely, skip it
 
					watchdog('homes_sync', '@file already exists for @home. Skipping.', array('@file' => $file_details['filename'], '@home' => $node->title), WATCHDOG_NOTICE);
 
				} else { 
 
					// save file
					// REPLACE because we can be certain we will not have duplicate files
					// so we will only ever receive unique ones here
 
					file_save_data($file_data, $file['filepath'], FILE_EXISTS_REPLACE);
 
					//write record in files table
					drupal_write_record('files', $file);
 
					$result = db_query("SELECT fid,filepath FROM {files} WHERE filename = '%s'", $file['filename']);
					$file_details = db_fetch_object($result);
 
					$file_data = field_file_load($file_details->fid);
 
					watchdog('homes_sync', 'Uploaded @file into @home.', array('@file' => $full_file['filename'], '@home' => $node->title), WATCHDOG_NOTICE);
 
					if ($file_data) {
 
						if ($filetype[1] == 'pdf') {
							$node->field_floorplan[] = $file_data;
						} else {
							$node->field_image[] = $file_data;
						}
 
					}
 
				}
 
 
			}
		}
	}
 
	return $node;
}

After the file is saved to the file system and database, field_file_load() is called to load the file data. With a populated array now, we can add that to our node object by simply putting $node->field_floorplan[] = $file_data or $node->field_image[] = $file_data to append the existing array with data. The $node object is returned, and node_save($node) is immediately called, and our node data and file data are saved. Just like that, we have a simple content distribution system from one parent site to potentially many remote sites.

This is just a simple example, your mileage may vary. We are utilizing this technology to hook companies together under different Drupal installations on different servers. Using Services you could also distribute Views configurations, users, and system settings.

Sync Drupal Content Using Services and xmlrpc()

Kevin Quillen — Sat, 19 Dec 2009 01:52:37 +0000

Have you ever wondered how to push custom content from one Drupal site to another Drupal site?

There are a handful of ways to do this. One way would be to create an external database connection, talk to it, and update the data in our database through raw PHP. But that’s not really good, not to mention slow, and also very un Drupal.

Another way would be to utilize Domain Access, and publish content to affiliated sites. That works in some cases, but what if these sites are independent from each other with different companies managing them? You would then have the nightmare of dealing with prefixed tables, back-end training issues, and the occasional node overlap from misconfiguring Domain Access.

A third way would be to utilize FeedAPI (or its successor, Feeds), to read from an RSS feed. Then you could parse and import that content at regular intervals. Sounds great, but if you plan on importing custom node types that have extensive CCK fields, files and images, prepare to sit down and code plugins and parsers galore to support CCK as data sources to target.

The third way is the one I thought I could get working. It seems so simple in theory that you can create an RSS/XML/JSON data structure with Views, and then tell Feeds to take that feed and parse it. True, it works if you are using a basic content type like Story or Page, but all bets are off once CCK comes into play- and who doesn’t use CCK these days? Hats off to Alex Barth / Development Seed though on Feeds, its a great start and sure to grow into a monster data consuming module. I do want to use for future projects, just not for this function.

One way that most people are not aware of is to take advantage of Drupal’s XML-RPC functions through the Services module. In short, the Services module provides:

A standardized solution of integrating external applications with Drupal. Service callbacks may be used with multiple interfaces like XMLRPC, JSON, REST, SOAP, AMF, etc. This allows a Drupal site to provide web services via multiple interfaces while using the same callback code.

So, then we got the idea to have the ‘master’ Drupal site act as a SOAP server with the Services module, and provide our own custom services in order to get the job done. This runs once an hour, requires no user interaction, fails silently, and only requires two modules. Effectively, it also allows us to not have to use:

Domain Access
FeedAPI/Feeds
Multi-site Setup

The benefit of this is every site can run independently from one another and be customized various ways, while still receiving key content from the parent website. Thus is the beauty of XMLRPC/SOAP.

The next part was to create my own custom method so I can request a list of node ID’s from the parent server. There is no method of getting all node ID’s out of the box, but you can easily create them. Here is what I came up with:


 
// CODE ON PARENT SERVER
 
function homes_service_service() {
	return array(
		array(
			'#method' => 'node.getAllHomes',
			'#callback' => 'homes_service_node_get_all_homes',
			'#return' => 'array',
			'#help' => 'Return a list of node id\'s that are of the Home content type.',
		),
	);
}
 
function homes_service_node_get_all_homes() {
	$result = db_query('SELECT nid FROM {node} WHERE type = "%s"', 'homes');
 
	while ($home = db_fetch_array($result)) {
		if ($home['nid']) {
			$homes[] = $home['nid'];
		}	
	}
 
	return $homes;
}
 
// CODE ON REMOTE SERVERS
 
function homes_sync_get_node_list() {
 
	// user authentication code here
	// connect as 'services' user with 'services' role
	// that way, drupal permissions are respected
 
	// user.login method used
	// we get a successful login if the return is an array and the array values match our login information
        // this needs a little more work so the parent server knows exactly who is requesting information       
 
	$user = 'user';
	$password = 'password';
 
	$authenticate = xmlrpc('http://upgrade.beracahhomes.com/services/xmlrpc', 'user.login', $user, $password);
 
	if (is_array($authenticate) && $authenticate['user']['name'] === $user && $authenticate['user']['status'] == 1) {
 
		$node_ids = xmlrpc('http://www.parentsite.com/services/xmlrpc', 'node.getAllHomes');
 
		if (xmlrpc_error()) {
			$error = xmlrpc_error();
			watchdog('homes_sync', 'Error getting node list from parent server. Error: @error.', array('@error' => $error), WATCHDOG_CRITICAL);
		} else {
			foreach ($node_ids as $nid) {
				$nodes[] = $nid;
			}
			variable_set('parent_home_nodes', $nodes);
			watchdog('homes_sync', 'Successfully retrieved node list from parent server.', array(), WATCHDOG_NOTICE);
		}
	}
 
	homes_sync_perform_update();
}
 
function homes_sync_perform_update() {
 
	$node_ids = variable_get('parent_home_nodes', 0);
 
	foreach ($node_ids as $nid) {
		$data = xmlrpc('http://www.parentsite.com/services/xmlrpc', 'node.get', $nid);
 
		$result = db_fetch_array(db_query('SELECT n.nid, n.title, n.type FROM {node} n WHERE n.title = "%s" AND n.type = "%s"', $data['title'], 'homes'));
 
		if (xmlrpc_error()) {
			$error = xmlrpc_error();
			watchdog('homes_sync', 'Could not perform XMLRPC request. Error: @error.', array('@error' => $error), WATCHDOG_CRITICAL);
		} else {
			if (is_array($data)) {
				$node = "";
 
				if ($result && $result['nid']) {
					$node->nid = $result['nid'];
				}
 
				$node->type = $data['type'];
				$node->uid = 1;
				$node->status = $data['status'];
				$node->created = $data['created'];
				$node->changed = $data['changed'];
				$node->comment = $data['comment'];
				$node->promote = $data['promote'];
				$node->moderate = $data['moderate'];
				$node->sticky = $data['sticky'];
				$node->tnid = $data['tnid'];
				$node->translate = $data['translate'];
				$node->title = $data['title'];
				$node->body = $data['body'];
				$node->teaser = $data['teaser'];
				$node->format = $data['format'];
				$node->name = $data['name'];
				$node->data = $data['data'];
				$node->path = $data['path'];
				$node->field_type[0]['value'] = $data['field_type'][0]['value'];
				$node->field_number_of_bathrooms[0]['value'] = $data['field_number_of_bathrooms'][0]['value'];
				$node->field_number_of_bedrooms[0]['value'] = $data['field_number_of_bedrooms'][0]['value'];
				$node->field_number_of_floors[0]['value'] = $data['field_number_of_floors'][0]['value'];
				$node->field_square_footage[0]['value'] = $data['field_square_footage'][0]['value'];
 
				node_save($node);
 
				unset($node);
			}
		}	
	}
}
 
function homes_sync_cron() {
	homes_sync_get_node_list();	
}
?>

For some reason, I can’t have two instances of wp-syntax in a single post, so bear with me. The above code is part of two seperate modules, one on the parent server, and one on the remote server (as notated with the PHP comment).

The module code (after CODE ON PARENT SERVER) resides on the parent server. This uses hook_service to talk to Services, and says expose node.getAllHomes as a request. That request method then calls the homes_service_node_get_all_homes function, which does a SQL query returns an array of node id’s that I am looking for.

I could easily return all nodes as their full node objects, but for performance reasons, I’d rather get a short list and save them on the receiving end. That way, I can create/update a handful at a time instead of all at once, which lightens the load on the database and application server.

On the receiving end, we need some code that creates the request that is sent to the parent server. Using hook_cron, I can send this request on an automated basis. The module code (after CODE ON REMOTE SERVERS) looks for the node list locally, and constructs single requests to retrieve node data one at a time. From there, it constructs a node object and saves it all with node_save. If the node already exists, based on type and title (our node ID’s will not match, but our title certainly will, since child sites cannot create or edit these nodes) it grabs the node ID from the local database and puts that in with the node object. node_save is a great function that can handle creating or updating data with the same structure. So, if the update runs again and passes us the same data, it will recognize it already has it, and update the record instead of create duplicates. Slick.

So what do we have? If we deploy the remote code on multiple remote sites, they can all sync up specific content with the parent website without anyone having to do anything special. So long as the parent site admin provides content, everyone will get it.

This is a quick implementation of course. I am fleshing out the authentication further as well as staggering the amount of data updated every cron run. With the core functionality in place, I can focus on security and speed. The next step is retrieving files and images using the same methods, and I will go over that in another post when I get a chance.

I hope fellow Drupalers found this useful, because I found that documentation on this is touch and go (and probably a reason not many utilize XMLRPC/Services). It’s a very powerful feature.

High Quality Website Photos

shaun — Sun, 25 Jan 2009 19:27:02 +0000

Websites should present an image of quality to the public. Nowhere is this more apparent as in the area of website photography. A common mistake made by many website owners is undervaluing this very important facet of a website’s overall presentation. A professionally designed website can be made to appear not-so-professional by the careless use of less-than-optimal photography.

With today’s increasingly capable camera’s in terms of storage and megapixels as well as features, many amateurs mistakenly believe that high quality equipment can replace the experience and skill of a professional photographer. This is rarely the case. You may shoot wonderful photos of your children or pets or your favorite vacation spots, but that seldom qualifies you to take quality photos that truly represent your staff, your products, or your location well.

Nonetheless, with all the preceding disclaimers, you might decide to give it a whirl. If that’s the case, here a few tips to consider.

Ten Tips to Great Photography

Hire a professional. If you have the budget, this is usually the best choice.
Use a high quality camera. It’s less about megapixels than it is about the lens. Generally, a name brand camera with a large lens will give the best results. Consider renting or borrowing a good camera rather than using your personal pocket-sized camera.
Provide sufficient lighting. Either indirect sunshine (shade on a bright day) or lots of artificial lights are best. Don’t depend on the camera to compensate. Light your subjects well.
Use a tripod and the camera’s timer. A decent tripod can be purchased at your local discount store for less than $50. This will reduce the blur caused by
the camera’s movement while the shutter is open. This becomes increasingly more important in lower light and increased distance.
Using the timer. Using the camera’s timer will reduce the blur even more when on a tripod.
Acquire the right tools. Photoshop, Photoshop Elements, and PaintShop Pro are a few products worthy of consideration at different costs and capabilities.
Take the time to learn the tools. Depending your preferences and learning style, courses, books, and online courseware are all viable choices.
Add appropriate text over the image as a call to action. Photos add life to a website. Text can add value to the photo by leading your customers to the next step of contacting you or making a purchase.
Purchase stock photography. If you can’t afford a professional, many websites sell high-quality photos at reasonable costs, many less than $10 per photo. Read the licensing details carefully.
Hire a professional. If you have the budget, this is usually the best choice.

Good presentation of good photos, along with quality copy and solid layout, can add real value to your website. Your website is indeed the only view of your company or organization that many potential customers, suppliers, and employees will ever see. Don’t make the mistake of skimping on photography.

Why Should You Use Gmail (Google Mail)?

Kevin Quillen — Tue, 19 Aug 2008 01:11:07 +0000

I’ve been using Google Mail since around 2004 when it was invite-only. After the first few emails, I was hooked. I killed my existing Hotmail, Yahoo! and other random accounts laying around. They simply provided few features, and demanded money for features that are basically standard in any mail client like Outlook. I email pretty frequently, so it is important that I have a feature rich service available to me anytime, anywhere.

So why Gmail? For starters, its really simple to import existing contacts into your system from your other accounts. Gmail also supports POP3 and IMAP- for free. This means that you can use any email client like Mozilla Thunderbird (also free) from any desktop and connect to your email. Last time I checked, Hotmail and Yahoo! both charged an annual fee to do this which is ridiculous. It isolates customers who don’t want to be tied to a web interface all the time. My storage cap at that time was like 250 MB, a ridiculously small amount. So it was no contest to switch to Gmail, who offer 6 GB to 8 GB per account, almost enough to last a lifetime (I have 7000 email conversations in my inbox).

Included with Gmail is Google Docs, Google’s online alternative to Microsoft Office. It is a lightweight application for basic word processing or spreadsheet creation. You can also share access with other Gmail clients (coworkers, friends, employees) by putting in their email address into the access list. They can then access the files and make revisions without ever having to connect to a server or downloading / uploading files, its all done from the web interface. And if that isn’t enough, Google Talk is embedded into the mailbox sections loaded with your contact list. If they also use Gmail, you can IM directly through Gmail instantly through the power of AJAX.

For those that are tech savvy like me and own an iPhone or iPod Touch, Gmail is supported fully either through Safari or the device’s Mail application- which to me is even more addictive than the Blackberry (Crackberry).

All of these reasons alone are enough to cut ties with other email services and sign up with Google. If that wasn’t enough, check out this article detailing 10 Reasons To Switch To Gmail.

Stylus for iPhone / iPod Touch

Kevin Quillen — Thu, 31 Jul 2008 17:09:21 +0000

There’s no doubt that the iPhone / iPod touch are the worlds smallest efficient mobile multimedia devices, but its one drawback echoed around the world is the varying difficulty users have in typing on it. If you have large fingers, you may register a few letters or multiple keypresses in one touch. This can make texting, emailing, and typing URLs frustrating. What’s a discouraged user to do?

Thankfully, there is a solution. The good folks at Ten One Design came up with a stylus unique for the iPhone / iPod Touch glass surface- a felt tipped stylus. Not only can this be used to make you a more efficient typer, but it can double as a drawing tool as well for drawing or sketching applications. Games that require sliding (such as Tetris, or Aurora Feint) can be better fit with the stylus as well, saving the screen from oil and smudges from dirty fingers.

http://www.tenonedesign.com/stylus.php

Top 5 Best iPhone Apps

Kevin Quillen — Mon, 28 Jul 2008 17:27:23 +0000

I love my iPod Touch. I was a bit weary back in March about the decision to buy the 32GB model but now it’s paid off. With the recent firmware update (available for 10 bucks through iTunes) comes a new little program called AppStore. AppStore is basically iTunes for iPhone/iPod specific software, with plenty of freebies. There has always been the ability to run Web Apps, which is to say connecting to a website and running an application- but this is so much better. This lets you download software to keep, more responsive, more slick, and better designed.

For those who don’t know, the iPhone and iPod Touch are identical (the iPod has no phone capability, obviously). As long as iPhone is on AT&T, I’ll never have one. I don’t think I would want my phone and iPod as one anyway for various reasons, but I digress.

The AppStore boasts a few hundred applications with more on the way. Apple is encouraging developers around the world to develop for the iPhone, and even make a little money too (some apps are free, others cost anywhere from 1.99 to 99.99). The SDK has been available for some time now, and there are tons of unique apps on AppStore. Ironically, its the free ones that seem to be the best (the paid ones are poorly to mediocrely scored). Users weigh in on AppStore apps with reviews, for usability, performance, purpose, stability. It’s like a condensed version of an Amazon product page.

I browse the AppStore daily for new apps or updates. My only complaint with it so far, if not the only one, is that there isn’t a section to see ‘New’ apps. I can’t tell if these are mixed in with the listings, but they are not easy to spot unless you have a pretty good memory. Perhaps a future update will make this easier to view.

I am an avid music lover, so I was quite thrilled to find the following apps on AppStore. Incidentally, they are what I consider the best current apps on AppStore so far, basically because they saved me from having to invest in Sirius or XM Radio (I have a huge disdain for FM radio- its disgusting crap that never changes because the industry is so messed up, but thats a whole other topic). Now with these I have immensely supplemented my playlist of ~3000 mp3s with free streaming music:

AOL Radio – Besides AOL Instant Messenger, this has to be hands down the best thing AOL has ever put out, period. With tons of stations at your fingertips, there is always something brand new just a tap away. So long as you have a data connection, you have music, and its all totally free. On top of that, you can mark favorites, or tap to purchase the track from an online store, and see a list of recently listened to songs for purchasing. This alone is worth the investment for an iPod Touch / iPhone. But wait, theres more.
Last.fm – Last.fm was another internet service that I was a heavy user of. It works based on delivering songs to you from picking genres you like. The userbase tags songs and artists so the results that stream to you are fine tuned. I used this a lot last year to discover new music and now its on the iPod Touch / iPhone too. It also keeps complete logs of what you’ve listened to on your account page. Can’t get any better than that.
Pandora – I remember when Pandora was an technical demo of sorts back in my first year of college (2000). I was quite impressed at the level of accuracy and the algorithm behind Pandora that makes it such a great / unique service. It’s very simple: Pandora lets you input your favorite bands, and based on what you put in, it creates playlists for you of music it believes you will enjoy. There are so many factors and ways it indexes music its insane- and for me, it’s rarely off the mark. Over 400 different musical attributes (see List of Music Genome Project attributes) are considered when selecting the next song. These 400 attributes are combined into larger groups called focus traits. There are 2,000 focus traits. Examples of these are rhythm syncopation, key tonality, vocal harmonies and displayed instrumental proficiency. It’s almost like Pandora can read your mind.
Tuner – Tuner is very similar to AOL Radio, but with full listings of Internet radio stations, or ShoutCast radio stations. These are indie stations created by users and their own playlists. There is just so much music here its insane. Comedy and talk as well. I heard this app was pulled from AppStore though, but I cannot confirm.
WeatherBug – Normally I wouldn’t dare ever suggest to anyone to put WeatherBug on their computer, due to its bugginess and spyware/adware it throws on your PC. But for a portable device like the iPod Touch / iPhone, it’s indispensable. If only the device’s Weather program was more robust I wouldn’t need this. But when you live at the beach, this is a must have- especially for the Google Map Weather Radar mashup.

This is just the start for what AppStore will have. It will only get better as time goes on. The top 5 apps above are free, with the exception of Tuner ($5.99).

The games are great too. One game, Super Monkey Ball (first released as a GameCube title, unbelievable) uses the accelerometers to guide the ball through the mazes. Just a glimpse of what is possible with the future of handhelds in general. It’s been said that the iPod Touch alone is as powerful as the Sega Dreamcast, a console from 2000/2001 which saw its demise when the Playstation 2 was released. That is pretty damn powerful, as most fans (including me) still have/use the Dreamcast from time to time. Mine is loaded with 800 classic Nintendo games. Child of the 80’s.

Get one of these. You’ll be glad you did.

User Security

Kevin Quillen — Fri, 02 May 2008 16:55:12 +0000

User security is a pretty big deal these days, and as I prep my follow up to Avoid Identity Theft I had another thought to write about.

One of my favorite things to do is guess someones password. Why? Because I can usually guess it. After analyzing someones intelligence and technical prowess, you can gauge how difficult their password probably is. Pete likes to throw random accounts at me and I’ll guess the password for fun. Usually get it on the third or fourth try. Ask Kevin Howett, I could regularly guess his AIM/MSN Zone passwords quite regularly back in the day.

Here’s the scary part. Most users in the real world day to day business use passwords that are far too weak to even have any use. You would be surprised how many people use ‘password’ or ‘name123′ or just ‘name’ as a password. Tons. Or their birthdate, car, dogs name, or sports team name. This won’t protect you against anything, and choosing a password you can remember does not give you the benefits of a password at all. By just being a regular word like ‘toyota’ or ‘bill123′ any skilled cracker/hacker is going to get into your account no sweat.

Why? Well, they will tell you that choosing a password is hard. I don’t disagree with them. Having to think of something no one else is expected to discover is hard. There are services that can assist you with this.

A good password is one no one can guess, and one that would hinder even the best hacker or brute force app out there. That is why I am recommending to you to use Good Password. It will assist you in generating a password randomly or from a phrase of your liking.

While these may be hard for you to remember, don’t be discouraged. This is for your (and the company you work for) protection. I would suggest, if you must, to write them down and keep it in your wallet, or a place no one but you has access to.

Avoid Identity Theft Pt 1

Kevin Quillen — Fri, 18 Apr 2008 18:40:43 +0000

A while back, I posted an article dealing with internet security and protecting your identity:

http://www.delawarewebdesigner.com/rants-raves/protecting-your-computer.htm

http://www.delawarewebdesigner.com/blurbs/the-information-you-should-never-share-online.htm

Recently I have been advising clients on certain basic steps they can take to ensure they do not become a victim of identity theft. It has happened to me before, and it is a complete pain in the ass to reverse everything. Fortunately I caught on fast on the day it was happening (while my bank account was being drained, when 5 figures goes to 2 you know something’s up.) and was able to reverse and resolve the situation in 2 days, recover my money and my good name. I did however have to obtain all new bank account, credit card numbers, checks and the like. Others haven’t been so lucky.

Identity theft is the fastest growing cyber crime in the world. The Internet is still a very young technology, and all things considered, still somewhat of a lawless frontier. With so many ways to remain anonymous online, its easy for people to hack, steal, and dupe people out of personal information such as financial info, credit card numbers, bank accounts, or even simple address and phone number. Almost 99% of the time, unless its easily traceable and/or major damage, law enforcement does not have either the time or resources to help you.

If you think you are safe while using services and sites like Paypal, Ebay, Amazon, or online banking, think again.

The most common way people lose their identity is through an email phishing method. Occasionally you will get an email that seems legitimate from a well known company, like Bank of America, Paypal, WaMu, or Hotmail. Check the ‘From:’ field, the email address looks real. Hmm, so you open it up, and it reads something like:

“Please update your personal information for our records” … with a lot of other corporate sounding reading material. Typically followed with “http://www.somecompany.com/login”. It’s second nature for us IT people to just click delete, but most people will believe this is a real email, and click whatever link it tells you to click. A simple hover on the link with the cursor will display where that link ACTUALLY links to, so, while the link appears to be “http://www.somecompany.com/login”, its actually masked and ends up at a hackers website. You can easily tell by hovering on the link, because most fraudulent links will look like jibberish or not even have the correct parent domain.

For example, ‘http://somecompany.secure.foo.bar.2.com/login/index.php’ would be the actual destination of the link in the email. What does this mean? This means that, while you think you may be clicking a link from SomeCompany, and going to SomeCompany’s website, you are actually being directed to another place, most likely the site has been setup to look just like where you intended (or thought) you were going in the first place. What happens then is you try to log in on the fake website, and it tells you login failed, check your password. Really, what just happened was you sent your login credentials to the hacker running the site, who then goes and uses it to log into your account at the real website, change your password, and bam you just lost your account to someone who is going to do whatever they want with it. This is quite common with PayPal and eBay, as I have seen many emails like this (I frequently use both services).

So, how can I protect myself?

There are a few simple steps you can do to protect yourself.

Email
If you receive an email from a company advising you to update account information, or to verify your identity, the best thing to do is go directly to their website (don’t click any links in the email, do this yourself in the browser), log in, and check your account yourself. Especially for something like PayPal, this is the quickest way to determine if any account activity has occurred or administrative messages/alerts are pending for you.
Validate the Website
If you wind up at a login page, check to see that it is SSL secured (most, if not all, are) who issued it, and what the URL is. If something seems strange, don’t do anything further. Your best bet, like above, is to go to the parent site and log in from there. Don’t follow any links from other sites or search engines which can easily be spoofed.
Use a Secure Browser
By default, most users use Internet Explorer 6 or 7. You can take additional steps to protect yourself from various types of hacks by using Mozilla Firefox or Opera browsers. For example, when visiting a secure web site, Opera encrypts data using either SSL 3 or TLS, both of which are highly secure encryption protocols. It then adds information about the site’s security to the address bar. Users may also click a button on the address bar to check if a web site is a fraudulent or “phishing” site. Both companies ensure the browser actively protects you, and are extremely quick to patch any vulnerabilities found. In comparison, Internet Explorer was left to sit over a year before receiving any security patching or updates.
Invest in Software
You should have some form of protection on your computer to guard against malware, spyware, and adware. Like phishing, these are other methods that hackers use to not only get personal information, but gain backdoor access to your PC and execute commands. Typically they include keystroke loggers and other things that retrieve data and send it back to the source. Norton and Symantec are the most ‘known’ names, but there are more alternatives out there that surpass both. Trend Micro, LavaSoft, AVG, and Panda Security all are excellent solutions for anti-virus and *ware handling. Add in a firewall like ZoneAlarm, and you’ve stepped up security by a huge degree. Don’t simply rely on Windows Security or Windows Firewall (Windows XP), it simply cannot protect you enough.
Consider a Monitoring Service
Services like LifeLock will protect you against someone attempting to use your name or social security number in order to do things like apply for credit at a bank. LifeLock is awesome.

I will have part 2 ready in a few weeks, where I will cover software usage, and what software to not use to protect your identity.

The Information You Should Never Share Online

Kevin Quillen — Fri, 21 Sep 2007 01:51:12 +0000

As a continuation of the post I created a couple days ago, I’d like to share this article with you written by the folks over at mint.com which reinforces some of the basic concepts I stated in my post. Like I said, protecting your online privacy is very important and should be taken seriously by newbies or veterans of the internet when you submit any information on the web.

From mint.com:

According to a recent report by the San Jose Mercury News, Sophos, a Boston-based Internet security company, was able to acquire highly personal information from 40% of the nearly 200 Facebook users who chose to add “Freddi Staur” as a friend in their Facebook accounts. Freddi Staur doesn’t exist, except as a toy on the desk of some Sophos employee. The company created a fictional person on Facebook to illustrate how vulnerable people can be when using social networks.

Why is Mint bringing this story to you? Well, securing your personal information on social networking sites isn’t only a matter of privacy. It’s also an important step in preventing identity theft. If you share personal information online, you make it easier for identity thieves to make off with your life story (and credit cards, and social security number, and so on) without a second thought. Victims of identity theft can suffer significant financial losses, and can spend years working to “clear their name.” Read any of Identity Theft Horror Stories our readers have shared with us… We don’t want to have this happen to you.

Secondly, as a new web service in the personal finance space, we’ve given a lot of thought to what we can do to make a web experience as private and anonymous as possible. In fact, you’ll be able to register for Mint using only your email address, zip code and password. And since we don’t share or sell your data with anyone, your privacy will be thoroughly protected, and TRUSTe verified.

We thought we should share with you what we know about how to evaluate and protect your privacy and identity online. The Freddi Staur story got us focused on the issues relative to the popular “social networks,” so let’s answer the big question:

How do you protect your personal information while still enjoying the social and professional benefits that Facebook, MySpace and LinkedIn have to offer?

At Mint, we want you to understand:

The information you should and shouldn’t share
How you can actively set limits on the information you do share, and
How these sites treat your information differently.

The Information You Should Never Share Online

Some information is so central to your personal safety and so revealing of your individual identity that you should never make it available on the public area of any website. Think of these as the Three Off-Limit Facts about you:

Your social security number
Your phone numbers
Your home address

Information You May Choose to Provide Online

Facebook, MySpace, LinkedIn and similar sites have become incredibly popular precisely because of their social factor: they help you stay in touch with friends or business contacts, and make new ones as well. To take advantage of their benefits, though, these services need you to share some personal information. That’s where we throw the caution flag, because you have to:

Understand the information you share with the site.
Understand what information the site will share by default and with whom.
Actively use controls the site provides to better protect your information.
Understand how the company providing the site will use your information themselves.

Understand the information you share

Sites typically ask for some personal information at two points: registration and profile development. These sites typically require some or all of the following information from you to set up an account:

Name
E-mail address
Zip code
Birth date
Gender

After registering, you’ll probably want to add information to your profile to get the most out of the site. After all, isn’t this “private profile” supposed to represent you? Many people often add a slew of other identifying bits after registration to flesh themselves out. Common additions like school and work locations, contact information, your friends, groups and networks you join, and personal interests and activities are all there to give your profile personality. Right? True, but be aware it’s giving your profile publicity, too.

And when you look across all the information you’ve shared, it’s pretty clear that any stranger with bad intentions — and access to this information — has a great head start in knowing who and where you are, and if you’re a high potential target for identity theft. They know how to contact you, too, and what information they might use to lure you into slipping them some of the Three Off-Limit Facts that open the door to your financial life and personal security.

Understanding Your Options

Each of the three sites we’ve highlighted takes a slightly a different approach to sharing your information, so we’ll look at each separately.

Facebook

Default Settings: Facebook’s information philosophy — and default setting — is to share almost everything that you’ve included in your Facebook account. That means if you’ve never changed your privacy settings, your Facebook profile is shared with not only all your friends and groups, but also with everyone in every network you join.

That’s a lot of sharing.

Luckily, though, Facebook gives you options to limit that outlandish profile broadcasting. Here’s where to start reigning in your information.

Information Control Options: The good news is that unlike many social websites, Facebook provides their users with an arsenal of privacy control and settings.

When you sign into your Facebook profile, take a look at the upper right-hand corner of the page, and click on the “Privacy” link next to the “Logout” link:

In this page, you have control over:

Information you share in your profile
Information people see when they search for you
Information on actions you take with other people
Information available to others when you contact them
Privacy controls for applications you’ve added to your account

Important Facebook privacy settings to note:

Search settings: By default, everyone can find your profile listing in a public search. This includes users on Facebook, and potentially people searching on Google, Yahoo, and MSN.

If you want to keep yourself searchable like this, you should strictly limit the information you’re leaving on that public listing. We highly recommend, though, that you don’t “go public” and instead uncheck the box “Allow anyone to see my public search listing.”

Profile settings: Here’s where you have control over the contact information you provide to other people. If you’re in one or more of Facebook’s Networks, you have the option of either displaying your contact information to only your friends, or to everyone. Again, Mint recommends that you limit sharing to only your friends and that you specify “no one” can see your contact e-mail.

Are all of these settings giving you a headache? Set your profile to “No Networks” and many of these settings will remain inactive. This makes it less likely that you will unknowingly share information you don’t want to provide to strangers.

MySpace

Default Settings: By default, people on MySpace can see when you’re online. Your profile and photo is also set to be viewable by everyone.

Information Control Options: MySpace’s privacy options are very limited, but changing three key settings can provide you with some important privacy protection:

Online Now: By un-checking this box, other users won’t know when you’re actively on your account.
Profile Viewable By: By selecting “My Friends Only,” you limit the ability for strangers to find your personal information.
Photos: By un-checking this box, you prevent your photos from being emailed and shared by other users.

You should be aware that MySpace does not have individual privacy controls for each section of information you provide. Whenever you decide to add information to your MySpace profile, you should take extra care in deciding what you divulge.

LinkedIn

Default Settings: By default, your LinkedIn public profile is set to display your full profile information. That means any information you provided will be available publicly. Thankfully, there are choices available to you to take control of your privacy.

Information Control Settings: LinkedIn provides you with much more control over the information you share with other users. Unfortunately, these controls are scattered throughout the site.

To get started, click on the “Accounts & Settings” link on the top right corner of LinkedIn, and then on the “My Public Profile” link under the Profile Settings section. You will now be on this page:

Now you have two options: turn off your public profile so that no one out of your LinkedIn Network can view your information, or limit the type of information other people can see. If you’re concerned about your privacy, we recommend that you turn off your public profile.

The other settings choices are fairly straightforward. You should note that if you choose to have your public profile on, LinkedIn requires that you make available your basic information such as name, industry, location, and numbers of recommendations.

LinkedIn also provides further privacy controls under the “Privacy Settings” section of the Settings page. Although each of these settings is on a separate page, LinkedIn provides great descriptions to each of the settings available to you, and what those settings can do.

Two settings to note in this area: “Profile Views,” where you can set what will be shown to other LinkedIn users when you view their profiles; and “Notifying My Network,” where you can control how or when people in your network are notified when you make significant changes to your profile.

In the “Name & Location” settings page, you have the option to display only your first name and last initial. When you set your locations, LinkedIn does a good job of simply sharing your regional area — not your specific city — to other LinkedIn users.

Understanding Their Privacy Policy

An important part in being proactive about your personal information is to examine a website’s privacy policy. That policy document explains how the website’s parent company plans to share (or commits not to share) the information you provide with other large populations of strangers — namely its employees, its parent company, subsidiaries, advertisers, and the like.

Things to consider when you read a privacy policy:

Is the privacy policy easy to read and understand?
Will they share or sell your information?
How recently was it updated?

Let’s apply some of the considerations listed above to each of the social networking websites:

Will they sell your information? Sites that share and sell your information expose you to greater privacy risks. Obviously, the more people with access to your information, the more opportunities for identity theft.
- Facebook and MySpace: Neither states that they will not sell your personal information. It’s safe to assume that they are reserving the right to do so.
- LinkedIn: LinkedIn clearly states that they will never rent or sell your personal identifiable information to third parties for marketing purposes.
How recently was it updated? Sites should be updating their policies whenever new services and features are introduced which affect the privacy of your personal information. If you see that the social networking sites you use are frequently adding new features, you should expect to see that their privacy policies are reviewed and updated regularly. How recently were these sites’ privacy policies updated?
- Facebook (May 24, 2007) and LinkedIn (July 14, 2006): both updated within the last 14 months. Not bad.
- MySpace (August 26, 2005): you may want to consider whether their policy is current enough to protect the information you may have added in any new features they’ve added over the past 2 years.

Mint’s View on Privacy

These sites offer real benefits to their users, as shown through their popularity. But they also come with considerable risks to your privacy and identity. You should protect your “virtual self” with the same common sense that you apply in the real world. Mint’s point of view is:

You should never share your phone numbers, physical addresses, or social security number information on public websites.
You should take the time to understand how the information you do choose to provide will be shared. There are three key questions to answer before you open accounts and complete “profiles” (or to answer today if you already have an account):
- What’s shown to friends/contacts?
- What’s shared with strangers on the site?
- What’s shown publicly on search engines?
You also need to be proactive in finding and using the controls these sites provide to protect your personal information and reduce your exposure to identity theft.
You should understand how the companies that provide these sites will use your information. Key questions to answer:
- Will they share or sell your information?
- How up-to-date is their Privacy Policy?

You can also take immediate steps today to give yourself an extra layer of privacy:

Visit TRUSTe and read the ten tips on protecting your personal information on the Internet.
Check out Privacy Rights Clearinghouse’s fact sheets on Internet Privacy and Financial Privacy.

Protecting Your Computer, and Your Identity

Kevin Quillen — Wed, 19 Sep 2007 01:05:13 +0000

As the internet and technology zips along every hour of every day, literally hundreds of new threats arise in the form of spyware, malware, adware, worms, virii, you name it. For you, the user, it is imperative that you be proactive in protection of your machine, instead of reactive (waiting until something happens to take action). The more proactive you are in applying security, the more you can stop spreading junk that comes through your inbox or browser, and more importantly, protect your identity.

There are lots of retail software suites that can accomplish the basic protection you need for your computer. But lets take a look at some free offerings that you can find on the internet that can do just as good of a job and be used in conjunction with Norton type packages, adding an additional 60-80% more protection.

Firstly, lets start at the largest point of entry on your computer other than your inbox, the browser. Most people unwittingly use Internet Explorer, since it comes packaged in with Windows. Version 6 (XP) and to an extent, version 7 (XP/Vista) are very lacking when it comes to protection from spyware and adware on the internet. Those open to change should switch to Firefox, the best browser in town and second most installed browser on computers in the world (and that number is climbing by the day). Firefox is totally free and will let you install plugins made by users, and this is where the value lies.

From the plugins page, search or look for the following plugins:

AdBlock Plus – Ever been annoyed by all those ads and banners on the internet that often take longer to download than everything else on the page? Install Adblock Plus now and get rid of them.

With this plugin installed, right-click on a banner and choose “Adblock” from the context menu – the banner won’t be downloaded again. Maybe even replace parts of the banner address with star symbols to block similar banners as well. Or you select a filter subscription when Adblock Plus starts up the first time, then even this simple task will usually be unnecessary: the filter subscription will block most advertisements fully automatically.

NoScript – Winner of the “2006 PC World World Class Award”, this tool makes Firefox the safest browser around.

Winner of the “2006 PC World World Class Award”, this tool provides extra protection to your Firefox.

It allows JavaScript, Java and other executable content to run only from trusted domains of your choice, e.g. your home-banking web site, and guards the “trust boundaries” against cross-site scripting attacks (XSS).

Such a preemptive approach prevents exploitation of security vulnerabilities (known and even unknown!) with no loss of functionality.

KeyScrambler Personal – KeyScrambler Personal encrypts your keystrokes at the kernel driver level to protect your login information from keyloggers.

When you type on your keyboard, the keys travel along a path within the operating system before it arrives at your browser. Keyloggers plant themselves along this path and observe and record your keystrokes. The collected information is then sent to the criminals who will use it to steal from you.

KeyScrambler defeats keyloggers by encrypting your keystrokes at the keyboard driver level, deep within the operating system. When the encrypted keystrokes reach your browser, KeyScrambler then decrypts them so you see exactly the keys you’ve typed. Keyloggers can only record the encrypted keys, which are completely indecipherable.

Unlike anti-virus and anti-spyware programs that depend on recognition to remove keyloggers that they know about, KeyScrambler will protect you from both known and unknown keyloggers. What’s more, KeyScrambler provides protection without getting in your way. You don’t have anything to learn about the program and you don’t have to do anything differently, but with KeyScrambler your important personal information will be a whole lot safer.

Why are these important? AdBlock Plus will allow you to filter out advertisements of any type on the websites you visit. Some advertisements, like Google Ads and Google AdSense, are harmless and their intent is just that, an advertisement. However, there are more sinister companies out there that create advertisements that look like real advertisements, and when you click and follow it to the website, any number of things could happen. You could be installing spyware, adware, or just had personal information phished from you. Popular phishing methods try to mimic familiar advertisements or alerts. The most typical type of phishing alert is something that looks like a standard Windows dialogue box that states ‘Click Here To Protect Your Pc Now!’. The average user tends to click on this, since it looks so much like anything else Windows would tell you in a dialouge box. With combined efforts of AdBlock Plus and NoScript, you can effectively eliminate 80% of these malicious efforts to infect your computer. NoScript allows you to permit/block websites at the domain level to run scripts, like Javascript, which is another method used in order to get into your machine.

So far, you’ve invested $0.00 in protecting your computer. Not bad, huh?

Next, try to monitor your browsing habits and those that use the computer, such as family members or friends. If they tend to visit popular sites like MySpace, CollegeHumor and the like, its possible they could run into malicious ads or phishing attempts. MySpace in particular is a hotbed of activity for spam, spyware, adware, virii, and phishing with hundreds of accounts getting hijacked daily. One of the most frequent ways this starts is by using template generator sites for your layout, or clicking images or ads in another persons generated layout. Some providers of these have malicious intent when deploying, in order to gain access to MySpace accounts for even more phishing and scam campaigns. You should educate those in your household that have internet access to sites like these.

If you use services online like Amazon, PayPal, or eBay, a simple email over MySpace could give away your personal information in under a second. You can use the plugins above as methods of stopping these attempts.

Typically, you can tell that you are getting a fake/spam email on an online web service like MySpace or YouTube one of the following ways:

It is from someone you don’t know (this alone should throw up a mental flag).
It is from someone you know, but sounds very cryptic / message is all jibberish with links.
It is from someone you know, but it doesn’t sound like ‘them’. i.e. they beg you to click on a link, or urge you to try out a strange website.
The content is something like “I got $50 Off Instantly By Clicking Here!”, with an image, or link.

Your computer security, online privacy, and identity are very important and it is critical to keep them in check. I hope you take some of the advice listed here to heart, because identity theft / fraud is the fastest growing crime in the world. You can take steps to prevent it from happening to you.