From GPS devices which report your whereabouts to Twitter to Facebook and Google Buzz.

Previously we used to caution everyone to be careful what you post or put on the Internet – but now with so many automatic devices, many people are publishing their entire lives (including when they’re NOT home) to everyone on the net. This is a crossover of “online” security to “physical” security. Do you really trust everyone on the Internet with all the details of your personal life? Where you work, what you do, where you live, pictures of your house with your cars visible – possibly even inside visible?

Examine a couple of these sites for more information:

Twitter Search 4sq

Buzz opens privacy Pandora’s box for Google

Please Rob Me web site – who’s NOT home

So ponder all that the next time you feel the need to tweet that you’re going away on a 3 week vacation.

-David

New clients are welcome, although we are selective.

We are actively interested in developing one or two new client web sites, graphics development, seo, and/or marketing projects.

Does your company need a new look, or did your old web developer vanish? Are you looking for online tie-in marketing, or ghost writing? We can assist. See our contact information via the menu above.

-David and Angela

Last month there was a big ruckus (see my posts too) about the Aurora attack exploiting IE6. For years now, IE6 has been a thorn in the side of web developers who constantly have had to add special code to handle the outdated browsers.

Now another nail in the coffin. Google killing support for IE6 in their applications.

As of March 1, Google will be killing support for IE6 in their web applications, and begin phasing out support for IE6 throughout Google. This is awesome news!

It will also save a lot of money from companies having to pay developers to spend extra time ensuring “compatibility” with the antiquated browsers.

Now if we could get Macs and their odd font sizing to match everyone else we’d be set O:)

Designers and Developers will be able to focus more on SEO, and marketing. Because that’s where it counts.

-David Lyle

If you’re running automatic update, you should be patched – but here’s the skinny: Microsoft Security Bulletin MS10-002-Critical

At this point, the real-world attacks have only occurred under IE 6, but the flaw exists in all unpatched versions of Internet Explorer. Please see my previous entry: The Aurora attack – can you be safe from cyberattack in your business for more information.

Additionally, we’re seeing continued traffic from China that is spam-bot and probing attacks against civilian business. These attacks are mostly aimed at web sites currently. Blocking code seems to be holding at this point, I will soon post an article on how to do that.

As usual, keep up the basics. In a future article I will go over some thoughts about where to focus on next.

-David Lyle
Thunderpaw

“Microsoft Internet Explorer that was used as an entry point for “Operation Aurora” to exploit Google and at least 30 other companies.” – Mcafee.

Microsoft posted this security advisory:
Microsoft Security Advisory (979352) – Vulnerability in Internet Explorer Could Allow Remote Code Execution

However, this is simply a continuation of larger issues.

When investigating cyberattack against businesses, we see an awful lot of sloppy security. Of course, not where most people expect it. Most everyone runs virus protection (sometimes 3 or 4 – I guess just to slow down their computers), firewalls (again sometimes 3 or 4! A corporate Firewall, then Windows Firewall, then McAfee or Norton as well!) Perhaps it’s fear of the unknown, perhaps it’s the old “more is better” concept. Try removing all those extra anti-virus and firewall apps, use one and make sure it’s working properly.

However, the real threats are not so much from random attacks. Real threats generally come from inside somewhere. Either an unhappy employee, or simple social engineering. I suspect both are at play in the Google attack. The weakest link in your corporate computer security often sits at one of your corporate computers drinking coffee.

Security always goes back to basics. Additionally, there is no security which is 100%. None. Well, ok there is one way – disconnect your computer from the ‘net and turn it off. That should protect you pretty well.

If, however, you feel the need to remain connected, then continue with the basics. Don’t panic over the little stuff. Here are some basic common sense security tips (which are amazingly not so common sense!)

• Change passwords regularly and use strong passwords.
• Change all important system passwords when employees leave.
• Backup backup backup. Store backups in multiple locations. Offsite if possible.
• If it’s important to your business, TREAT it as important!
• Let your IT people upgrade Internet Explorer. If you’re still using IE6 for business then you don’t care about your business. (or switch to an alternative browser)
• Hire professional IT people, and trust them.
• Let your IT professionals know of “odd” behavior. Sometimes it points to security issues that need to be addressed.

Finally, do your best, and understand that there are people, companies, and countries which do nothing but try to hack. Many are after information, so think seriously what you store and how. Ponder how you’ll feel if you find out Google lost vital information about your company.

If you’d like a full copy of my reports when completed, send a feedback or comment through our contact form.

Today: Google Analytics (GA) vs. Statcounter

Overall Winner: Statcounter.

How they work:
GA: Javascript in footer
Statcounter: Javascript in footer, along with image url for non-script enabled browsers.

My test methodology: I selected random web sites to install both GA and Statcounter code

Cost: GA – Free , Statcounter – Free up to 500 log entries, 1500 costs $9/month, and upward.

Comparison:
GA being only javascript is already at a disadvantage to Statcounter – as anyone with javascript disabled (like myself) will automatically be invisible to GA. This is a huge disadvantage to GA stats. Generally speaking, the more technically savy of your visitors won’t be counted. On average, that works out to anywhere from 5%-10% or more of your visitors!

Let’s take a quick look at the stats.

I compared the same day the same web site with GA and Statcounter. In a full 24 hour day, GA reported 649 page views, and 181 unique visitors. If I didn’t maintain the logs myself, I’d have to simply trust GA on those numbers, as there’s no way in google analytics to drill down and actually look at the logs. Statcounter, on the other hand, reported 736 page views, and 355 unique visitors. That’s a significant difference (Statcounter is more in line with the web logs on the server, by the way).

Features:

Integration with adwords: Google obviously maintains excellent integration with Google Adwords – no question there. Winner: Google.

Personal data – Statcounter offers a lot more personal information – you can drill down and follow a single user’s path through your website, find where they left your site and where they went. This in particular is so valuable to marketing and SEO! Winner: Statcounter

Returning Visitors – GA will tell you how many are return visits, but nothing else. Statcounter adds the ability to drill down, find out who returned, and where they went. Winner: Statcounter

System Stats – both GA and Statcounter offer a breakdown of your visitors by the hardware they use to access your site, screen resolutions (if you’re still designing for 800×600 then you’re outdated!), browser versions, etc. GA seems to have more accurate data on this than statcounter. Winner: Google.

Logs – Statcounter offers the ability to download their logs in csv format. You can see exactly who hit your site when in the raw data form. GA offers no such reporting. This is definitely a feature for the more tech savy or numbers oriented people. Not a show-stopper for most people. Winner: Statcounter

Reports – Both services offer reports by email, scheduled and immediate. Both are quite configurable, but the Statcounter report out of the box is pretty poor. The GA report is quite beautiful with graphs. I’m going to give the win on this to GA. Winner: Google.

Summary!

Every professional web site needs good stats. You simply must know who is visiting your site, where they’re going, and why they’re leaving! Both GA and Statcounter offer excellent real time reporting. Chances are, GA will be on your site, and serves the purposes of most people. However, if you are like me, and want more detailed information – then you really should have Statcounter on your site. Try running both yourself and see which you like better.

In my opinion, having drill down paths of visitors, and more accurate numbers of visitors is more important to me than google adword integration. Of course, your needs may be different! The cost for Statcounter is pretty minor compared to the data, if you even need more than 500 log entries. Additionally, nothing prevents you from having two different services on your site, just don’t go overboard or you’ll slow your site down needlessly!

Disclaimer – I am not paid by either GA or Statcounter to comment on their services. I have no financial interest in either company.

-David Lyle

I have been scouring for some time attempting to find a silver bullet for Wordpress speed problems, and there are tons of articles, sites, etc detailing mostly outdated or incorrect information.

So I’m going to be putting as much as I can here, real, TESTED information. I highly recommend using Firebug addon for Firefox to test your blog so you can see how things run.

Tips – many will vary depending on your host configuration and your Theme. We’ll also assume a host (like godaddy) which does NOT compress js and css files but can be configured to compress text. (more on that later, for now let’s assume you have it working properly)

make the following changes in wp-config.php

/* I like this as a security - someone tries to open /wp-config.php and get redirected. there are other ways to do it... but here's one */
if (eregi("wp-config.php", $_SERVER['SCRIPT_NAME'])) {
Header("Location: index.php"); die();
}
// below just because I like putting this hard coded rather than using unnecessary database calls for the info.
define('WP_HOME','http://yourdomain.com');
define('WP_SITEURL','http://yourdomain.com');

/* I don’t like sending the long cookie names wordpress defaults too. A few bytes savings per file requested.*/
define(‘USER_COOKIE’, ‘ua’);
define(‘PASS_COOKIE’, ‘pa’);
define(‘AUTH_COOKIE’, ‘au’);
define(‘SECURE_AUTH_COOKIE’, ’sec_’ . COOKIEHASH);
define(‘LOGGED_IN_COOKIE’, ‘li’);
define(‘TEST_COOKIE’, ‘wtc’);

// Enable the WordPress Object Cache:
define(‘ENABLE_CACHE’, true);
——————

That ends the changes in wp-config.php.

Now, things that are theme oriented!

In your functions.php file, I don’t like all the darn filtering that WP does by default, and all the JUNK it puts in the headers. Annoying, useless, slows down your site, etc. Obviously if you’re using some of that functionality you’ll need to leave things in… but try:


remove_action( 'wp_head', 'feed_links_extra', 3 ); // Removes the links to the extra feeds such as category feeds
remove_action( 'wp_head', 'feed_links', 2 ); // Removes links to the general feeds: Post and Comment Feed
remove_action( 'wp_head', 'rsd_link'); // Removes the link to the Really Simple Discovery service endpoint, EditURI link
remove_action( 'wp_head', 'wlwmanifest_link'); // Removes the link to the Windows Live Writer manifest file.
remove_action( 'wp_head', 'index_rel_link'); // Removes the index link
remove_action( 'wp_head', 'adjacent_posts_rel_link'); // Removes the relational links for the posts adjacent to the current post.
remove_action( 'wp_head', 'wp_generator'); // Removes the Wordpress version i.e. - WordPress 2.8.4
remove_action( 'wp_head','rel_canonical');

Now onto the header.php file. Your theme may vary, but the largest speed increases will come from reducing unnecessary calls to the database and long-winded-bloated functions. Chances are, none of these settings will EVER change on your site, if they do it’s easy to modify!
First off, remove unneeded javascript junk – javascript is cumbersome and slow. Needed for some functions but hardly for most.

Notice my css file name is changed to add a .php — that will be explained later, but put your own settings in.


<meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
with:
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

replace:
<link rel="stylesheet" type="text/css" href="<?php bloginfo('template_directory'); ?>/style_a.css" media="all" />
with:
<link rel="stylesheet" type="text/css" href="/wp-content/themes/thunderpaw-web-marketing/style_a.css.php" media="all" />


Onto the stylesheet. If your host, like mine, doesn’t gzip css files – change them to a .php and make the following changes:

change stylesheet:
add to beginning:
<?php
header("Content-Type: text/css");
echo '
....(your css goes here)...
';?>


This will enable gzip compression of your style sheet and your html.

Lots more to come.

-David Lyle

One More Smith – how you can help

Thank you for considering!

We just wanted to put a post out to thank everyone for a great 2009, and wish everyone a wonderful 2010.

Web design and marketing have merged in 2009. In 2010 we look forward to more merging. SEO and Social Media Marketing will continue to be very important to all businesses. We’ve got a few secrets in the works for the future too. Thankfully we’re seeing less and less interest in “squeeze” pages (we don’t believe in them) and a move away from “get rich quick” and toward good honest products and services. We like that change.

Cheers and Happy New Year to everyone!

Dell Made $6.5 Million on sales through Twitter and other Social Media Marketing.

I’m thinking $6.5 Million isn’t really too bad. Social Media Marketing does indeed work. If done correctly. It’s still a small portion of Dell’s revenue, but a growing chunk.

As Connie Guglielmo writes for Bloomberg:

By Connie Guglielmo

Dec. 8 (Bloomberg) — Dell Inc., relying on social- networking sites to drum up sales of personal computers, said its promotions on Twitter have helped generate more than $6.5 million in orders for PCs, accessories and software.

Read more: Dell Rings Up $6.5 Million in Sales Using Twitter