' . $cached_html . '
';
$cached_html = str_replace( 'wp-embedded-content', 'npg-embedded-content', $cached_html );
$cached_html = str_replace( 'sandbox="allow-scripts"', '', $cached_html );
$cached_html = str_replace( 'security="restricted"', '', $cached_html );
}
return $cached_html;
}
```
Change `'://example.com/gallery'` to the location of your own gallery install.
No I don’t like this either, but it was a ‘get it done’ moment. Also this is why the iframe security is lacking.
**Categories:** How To
**Tags:** netphotographics, oembed, plugins
---
### [Why We Hate Your Security Reports](https://halfelf.org/2021/why-we-hate-your-security-reports/)
**Published:** December 27, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I did some self reflection on why I hate security reports, and what I came up with was "people aren't explaining themselves."
**Content:**
I was having a day where a bunch of security reports were dumped in my lap. There have been days where those have been hundreds. Thankfully this wasn’t, but it did make me sit back and think about why I hated so many reports.
In general, everything can be summed up as “The person reporting doesn’t provide all the relevant information.” Sometimes they don’t know, and that’s okay. People don’t learn by osmosis, they have to be taught. But a lot of the people submitting reports do know and just don’t. And the real crux of it all? People aren’t explaining **why** things matter.
Let me explain…
## The Uninformed
These are the people who report an app and say “It’s this app because I installed it and I was hacked.” Another variant is “It’s this app because that’s where the hacked file lives.”
And the email will have no other information. With those, I have to explain not only are they probably wrong, but I have to dig and get at the information.
- Why do you think it’s this app?
- Do you have any evidence?
Those are pretty basic questions at the heart, but it’s on me to explain why correlation isn’t causation, and just because (say) Hello Dolly was infected does not mean that it was vulnerable.
This has no solution other than education. I dislike those, but since most people are pretty cool about it when I explain how I know it’s **not** the app they think it is, it’s okay.
Semi-related are people who email us security logs from their services, and those are always messy, since it’s information without enough context. Which I’ll get to in a minute.
## The Too Terse
Sometimes reports are explanatory but not enough. “It’s an XSS in this app.”
Now, the good news is I know what I’m looking for. The **bad** news is that someone who actually knows what the issue is has decided to not share, which means I now have to figure out how they figured it out. It used to be I’d do that, but then they’d email back all snarky and bitchy that I didn’t find the one **they** found. Nowadays I push back. “Can you please provide details?”
That has a weird hit-and-miss. Sometimes people are pretty chill and explain. The majority do what I think of as a pre-teen eyeroll. You can actually tell they’re huffing in annoyance that someone dared ask them to unpack what was in their heads.
To put this differently, have you ever had someone say “Hey, the website’s down.” and just … not give you an error message? You know how maddening that is? Right that’s what we’re talking about.
## The Non Explainers
You’d think this is the same as Terse, but it’s not. The non-explainers don’t explain **WHY** something is a security issue.
I know, someone’s reading this going “Hang on, but if I tell you it’s a SQL injection vulnerability, and where it is, isn’t that enough?” And the answer is, most of the time, yes! The people who give a great proof of concept, with exactly how to replicate it, in clear English, are my favourites. They break down how things happen so you can see “Oh that’s why.” But… When they don’t, it means someone (read: me) has to go and figure out “Okay, why is this bad, and how bad is it?”
## The Hater Reporters
I can’t believe I had to add this one in, but here we are in 2021 and there are some ‘security reporter firms’ who think the best way to report an issue is
1. make it public
2. attempt to make other people feel bad
3. dogshame developers
For them, the only way forward is their road or no way at all, and they cannot be reasoned with. Eventually someone will sue them for releasing a 0-day vulnerability without even trying to privately disclose first, and when that happens, I’ll make the popcorn.
## The Issue Is Education
If you go back through, you can see the real issues are people not unpacking what they actually know and sharing in a **digestible** manner! And this is terribly endemic of security *companies* more than anything else.
For example, recently a security company reported a local file inclusion (LFI) issue. Now for those who don’t know, the issue is the code in question could be used to include **any** file on the server. Including a hacked file. But if someone just told you “Hey that’s an LFI and you’re bad!” then, even if they take the time to tell you where the issue is, if they’re not explaining to you **how** it’s exploitable, you may not know!
And then, even when people explain it, they explain as if they’re talking to a developer of their caliber. I certainly am, but the people I’ve got to pass the report to (the actual devs) are not always. Even when they are, sometimes they’re total berks who will snark that it’s not worth the time to escape things at that low a risk.
## Understanding Risk
Security is massively important but the reality is that it’s not the first thing on most people’s minds when they write code (sorry folks). Usually people concentrate on making the code work first. Then, once it works, they go back to make it safer. I’m not casting aspersions here. There’s nothing wrong with making it work first. The issues begin when people don’t take security with the proper seriousness.
Just the other day I saw someone who had to be told that yes, you **always** escape content you’re echoing. Why? Because users are humans, and humans do some really stupid things. Even if you think of yourself as average, that means roughly half of your users are not as smart as you, which means that half is who you’ve got to look out for. You sanitize content you save, you scape content you echo. All. The. Time.
And yes, I’ve seen people who are experienced developers, people with plugins whose user count is in thousands, reply that it’s not needed to escape because … it’ll make their code slower.
Sometimes I tell people “This is why I drink.”
## Proper Education
Now. Part of this is on the community/company. WordPress, where I do a lot of work, has decent documentation about security. In fact, as of late WordPress’ docs have been phenomenal about this!
Here’s what the plugin dev docs say about [nonces](https://developer.wordpress.org/plugins/security/nonces/):
> If your plugin allows users to submit data; be it on the Admin or the Public side; you have to make sure that the user is who they say they are and that they [have the necessary capability](https://developer.wordpress.org/plugins/security/checking-user-capabilities/) to perform the action. Doing both in tandem means that data is only changing when the user *expects* it to be changing.
Now. That kind of explains why you want to do this, but does it explain why it’s needed for security? Only from a high level. For the crux you have to scroll down a little:
> The capability check ensures that only users who have permission to delete a post are able to delete a post. But what if someone were to trick you into clicking that link? You have the necessary capability, so you could unwittingly delete a post.
Now that makes a lot more sense, right? That is a good doc, assuming people read it.
And look at the bolded intro for [escaping](https://developer.wordpress.org/plugins/security/securing-output/):
> Escaping means stripping out unwanted data, like malformed HTML or script tags.
>
> **Whenever you’re rendering data, make sure to properly escape it. Escaping output prevents XSS (Cross-site scripting) attacks.**
Whenever. Not sometimes, not when it’s convenient. **WHENEVER**.
And yes, this means **every single time you echo anything as a variable, you damn well escape it**. No questions asked.
But when I say proper education, I mean in explaining why a specific issue is, in fact, an issue.
## Communication Is Queen
If you’re a regular person who sent a report you weren’t sure about, you’re fine. This next bit is not about you. This is about security experts and other developers.
Did you contact developers, ***privately***, about issues with their code? If you’re a security company, do you have documentation on your site to explain how something in an XSS or LFI vulnerability? Did you explain in the contact why something is a risky LFI? Did you take a minute to share a Proof of Concept to illustrate how you knew something was a risk? Did you describe why and how the POC shows the risk?
That’s what you have to do.
You want other developers to be better and to write better code? Then you communicate, clearly, and take time to ensure what you’ve said is understandable by the recipient.
I hate your security reports because they’re not reports at all. They’re dumping a problem on someone else and not giving them the tools to progress. You’re expecting them to do all the work you already did, which by the way is a waste of everyone’s time. It wastes my time because now I have to do everything you already did, and it wastes yours since I’ll probably ask you for the details.
But. If you start with a private, polite, report of “Hey, I found this. Here’s how and here’s why I know it’s an issue.” then you, you my friend, are heroes. You’re actually making the entire world better for everyone.
Thank you.
**Categories:** How It Is
**Tags:** reporting, security
---
### [Stopping Jerks in Ninja Forms](https://halfelf.org/2022/stopping-jerks-in-ninja-forms/)
**Published:** October 25, 2022
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stopping spam with Ninja Forms is shockingly harder than I expected, and overall disappointing.
**Content:**
I don’t have a spam problem, I have a jerky people problem. I have people who, no matter how many times I explain I cannot help them, or I don’t want to talk to them, will continue to email.
Right now, I have some absolute weirdo in Europe who emails me every day via a contact form. I don’t know what the heck he’s thinking, but I do not need advice about how to live my life nor can I help him talk to a celebrity. The problem though is I can’t delete the form. I can (and did) set his email to auto-bin via my mail server, but he still fills the form in and I am just tired of cleaning this up.
This site happens to use Ninja Forms, and really what I want to do is auto-cycle his emails to the bin so he can rant all he wants and never knows I don’t see a thing.
(Note: This is **not** the same person as my [serial harasser](https://halfelf.org/2021/when-its-not-burnout/).)
## Warning: Their Documentation is Rough
The biggest headache to all this is the fact that Ninja Forms’ documentation kinda sucks. For example, you cannot **search** their ‘[codex](https://developer.ninjaforms.com/codex/)‘! That’s just basic level for a documentation service, and on top of that if you try googling, it wants to send you to the non-developer pages.
Now to their credit they know this:
> *Admin note*: we have not been able to give this site the attention it needs or deserves for a while. *Most* of the Codex documentation is still applicable, but please be aware that you will find some outdated material here that will need to be adapted for Ninja Forms in its current, more modern, state.
But that doesn’t make it really any better for me today, and it’s been like that for a while.
Which means thinking “I can search for how to auto-flag a submission as spam/trash!” is impossible. It doesn’t work, it doesn’t exist in current NF format, and it’s a pain to the point that I seriously considered dumping the whole plugin over this!
Folks. I know documentation is incredibly hard, but if you want people to make plugins to extend yours, and thus help make you even more popular, hire someone to do this. It’s only gonna get harder as time goes on.
## The Initial Code
The first step is, of course, can I even do this, and of course I can:
```
**Categories:** How To
**Tags:** email, Ninja Forms, plugins, spam
---
### [CLI Like a Webhost](https://halfelf.org/2022/cli-like-a-webhost/)
**Published:** September 21, 2022
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Command Line tools to knock administrator to the next level!
**Content:**
For the last ten years, I worked for DreamHost, which meant I had access to a lot of awesome commands that everyone ran to diagnose things.
Well now I’m gone and I’m still a webadmin for my domains. And I have, as you all know, a weird guy who keeps going after me. I also have been running fandom sites for longer than WordPress has existed. I’ve had to learn a lot of tricks to sort out ‘Is this person so-and-so *again*?!’
Now… I’m going to tell you a secret. You ready? Okay, most of those scripts hosts run? They’re just cleaned up shell commands you run on the server via command line (aka command line interface aka cli). And those commands? They’re actually pretty common, well known, and public.
So here are *some* of the ones I use and why!
## Before You Begin…
I have to step back a moment.
Do you know where your log files are? DreamHost posted in their KB how you do that, but you will want to check your hosts:
- [Access.log via SSH on DreamHost](https://help.dreamhost.com/hc/en-us/articles/216105097-Viewing-and-examining-your-access-log-via-SSH)
- [Error.log via SSH on DreamHost](https://help.dreamhost.com/hc/en-us/articles/216512217-Viewing-and-examining-your-error-log-via-SSH)
There are three caveats, and I know one is weird.
### 1. Logs rotate
Server space matters, so logs are regularly deleted to prevent your data from killing things.
Right now I see this:
```
-rw-r--r-- 1 root root 3.5M Sep 16 09:08 access.log
lrwxrwxrwx 1 root root 21 Sep 16 00:49 access.log.0 -> access.log.2022-09-15
-rw-r--r-- 1 username server 1.6M Sep 12 00:51 access.log.2022-09-11.gz
-rw-r--r-- 1 username server 1.4M Sep 13 00:54 access.log.2022-09-12.gz
-rw-r--r-- 1 username server 1.6M Sep 14 00:11 access.log.2022-09-13.gz
-rw-r--r-- 1 root root 9.7M Sep 15 00:21 access.log.2022-09-14
-rw-r--r-- 1 root root 11M Sep 16 00:49 access.log.2022-09-15
```
Tomorrow I’ll loose the 9-11 log.
### 2. You need to know what your logs look like
Every host tweaks the format of apache logs in a different way. You’ll see I use things like `print $1` in my code, and for me I know that means “$1 is the IP address.” But that **may not** be what your host does.
Look at the logs:
```
192.0.114.84 - - [16/Sep/2022:00:49:05 -0700] "GET /wp-content/uploads/2019/10/Pure.jpg HTTP/1.1" 200 257552 "-" "Photon/1.0"
```
And then count things. IP is #1, URL is #7, and so on.
It can be a pain so please feel free to experiment and mess with it to get exactly what you want.
### 3. You may need to use http logs for everything
This is specific to **DreamPRESS** (the managed WP hosting) and is the weird thing, you always have to use the http folder **even if you use https**.
Why? Well that has to do with how the server processes traffic. DreamPress (as of the time of this post) uses Varnish to cache and Nginx as an SSL proxy. That means when you go to `https://example.com` the server has nginx check the HTTPS stuff and passes it to Apache, which runs HTTP. Those logs are your **apache** logs, not your Nginx ones.
Can you view the Nginx logs? Not at this time. Also they really are pass-throughs, so you’re not missing much. If you think you are, please open a ticket and tell them what you’re looking for in specific. Those help-desk folks are awesome, but the more clear you are about *exactly* what you’re looking for, the better help you get.
Okay! On with the show!
## Top IPs
Sometimes your site is running super slow and you want to know “Who the heck is hitting my site so much!?”
```
awk '{ print $1}' access.log | sort | uniq -c | sort -nr | head -n 10
```
This command will list the top 10 IPs that hit your site. I find this one super helpful when used in conjunction with an IP lookup service like [IPQualityScore](https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test), because it tells me sometimes “Hey, did you know Amazon’s bots are hitting the heck out of your site!?”
You can change that `10` to whatever number of top IPs you want to look for. That tends to be enough for me.
If you know you have a lot of ‘self’ lookups (like you wrote something that has your server do a thing) you’ll want to try something like this to exclude them:
```
awk '{print $1}' access.log | grep -ivE "(127.0.0.1|192.168.100.)" | sort | uniq -c | sort -rn | head -10
```
## Popular pages (excluding images/css/js)
Sometimes you just want to know what pages are being hit, right?
Remember how I said you actually need to know what your log looks like? For me, $7 is the 7th ‘item’ in my access log:
```
192.0.114.84 - - [16/Sep/2022:00:49:05 -0700] "GET /wp-content/uploads/2019/10/Pure.jpg HTTP/1.1" 200 257552 "-" "Photon/1.0"
```
Counting is weird, I know, but the 7th is ‘/wp-content/uploads…’ so I know that the command has to use $7. BTW Photon there just means I use WordPress’s image stuff via Jetpack.
```
awk '{print $7}' access.log | grep -ivE '(mod_status|favico|crossdomain|alive.txt)' | grep -ivE '(.gif|.jpg|.png|.js|.css)' | \
sed 's/\/$//g' | sort | \
uniq -c | sort -rn | head -25
```
That returns a unique list:
```
862 /xmlrpc.php
539 /wp-admin/admin-ajax.php
382 /wp-login.php
75 /wp-cron.php?doing_wp_cron
```
And it’s not a shock those are the high hits. Nice try folks. I use things to protect me. But before we get into that…
## IPs Hitting a Specific Page
Now let’s say you’re trying to figure out what numb nut is hitting a specific page on your site! For example, I have a page called “electric-boogaloo” and I’m pretty sure someone specific is hammering that page. I’ll do this:
```
awk -F'[ "]+' '$7 == "/electric-boogaloo/" { ipcount[$1]++ }
END { for (i in ipcount) {
printf "%15s - %d\n", i, ipcount[i] } }' access.log
```
That spits out a short list:
```
12.34.56.789 - 3
1.234.567.890 - 4
```
It’s okay that the command spans multiple lines. Check those IPs and you might find your culprit.
## What ModSecurity Rule Hates Me
I have a love/hate relationship with ModSecurity. My first WP post (not question) in the forums was about it. It’s great and protects things, especially when you tie it into IPTables and have it auto-ban people… Until you accidentally block your co-editor-in-chief. Whoops!
For this one, you’ll need to ask the person impacted for their **IPv4** address. Then you can run this:
```
zgrep --no-filename IPADDRESS error.log*|grep --color -o "\[id [^]]*\].*\[msg [^]]*\]"|sort -h|uniq -c|sort -h
```
That will loop through **all** the error logs (on DreamHost they’re in the same location as the access logs) and tell you what rules someone’s hitting. Then you can tweak the rules.
Of course, if you’re not the root admin, you’ll want to ping your support reps with “Hey, found this, can you help?” They usually will.
Don’t feel bad about this, and don’t blame the reps for this. ModSecurity is **constantly** changing, because jerks are constantly trying to screw with your site for funzies and profit (I guess). Every decent host out there is hammering the heck out of their rules constantly. They update and tweak and change. Sometimes when they do that, it reveals that a rule is too restrictive. Happens all the time.
## Long Running Requests
Another cool thing is “What’s making my site slow” comes from “What processes are taking too long.”
```
awk '{print $10,$7}' access.log | grep -ivE '(.gif|.jpg|.jpeg|.png|.css|.js)' | awk '{secs=0.000001*$1;req=$2;printf("%.2f minutes req time for %s\n", secs / 60,req )}' | sort -rn | head -50
```
That gets me the 25 top URLs. For me it happened to list MP4s so I added that into my little exclusion list where .gif etc are listed.
## Who’s Referring?
A referrer is basically asking “What site sent people here.”
```
awk '{print $11}' access.log | \
grep -vE "(^"-"$|/www.$host|/$host)" | \
sort | uniq -c | sort -rn | head -25
```
This one is a little weird to look at:
```
15999 "-"
31 "www.google.com"
8 "example.com"
4 "binance.com"
```
The ‘example.com’ means “People came here from here” which always confuses me. More impressive is that top one. It means “People came here directly.” Except I know I’m using Nginx as a proxy, so that’s likely to be a little wonky.
## What are your favourite cli tools?
Do you have one? Drop a line in the comments! (Be wary about posting code, it can get weird in comments).
**Categories:** How To
**Tags:** apache, cli, command line, nginx
---
### [Open Dungeons](https://halfelf.org/2022/open-dungeons/)
**Published:** April 19, 2022
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making things with a 3D printer is all Jan's fault.
**Content:**
I play a D&D game. We recently transitioned into playing in person (yay vaccines!) and after much discussion, we have acquired a 3D printer.
Blame my friend Jan.
Anyway. One of the things I wanted to build, besides maybe minis, was the modular dungeon! I knew about the brilliant [Devon Jones](https://www.thingiverse.com/devonjones) and his OpenForge dungeons, and recently he’s pushed out a version 2. This was exactly what I wanted and needed. The problem … all the [tutorials](https://github.com/devonjones/openforge-tutorials) were for version 1. So I had to sit down and figure out what I really needed.
## What’s OpenForge?
[OpenForge](http://masterwork-tools.com/openforge) is an open source (heh) dungeon set for D&D which lets you build…. oh this:
Example build by the creator – Devon JonesOriginally we used images on a screen, or (badly) drawn lines on a mat. And all my D&D life, we used graph paper and ‘theatre of the mind.’ We’ve also been playing online for almost a year, and now that we’re in person, I find myself wanting minis and a set for people too SEE the evil that is in my mind.
## What Connections
There are three main types of connections:
- Magnets – Most common, it lets things be compatible with Dwarven Forge
- [OpenLock](http://printablescenery.com/) – this is a kind of lego-esque clip connection from Printable Scenery. It’s open source.
- [Dragonbite](http://www.fatdragongames.com/fdgfiles/?p=4240) – Proprietary (licensed) but compatible with their system
- Infinitylock – Compatible with the [DungeonWorks](https://gamedecor.com) system
- Glue – … As it says.
Magnets are a little weirdly expensive, since you have to buy the magnets to go in. Glue is messy. What I wanted was OpenLock — it’s more stable and my supplies are upstairs.
Originally I was really anti-glue, but as time went on, I came to appreciate it. Especially since I can throw things in the freezer to separate them! But day to day I wanted to be able to click things together like lego and change up sets when needed.
## Sets
The next bit is where I got miles of miles confused. Here are the recommended **starter** sets for the Stone setup. I figured stone is 90% of what I’ll be using for now (there are other places where we may be on mats, like for the beach or wood battles (yes, beware players! More adventures are coming!):
[**Stone Floor**](https://www.thingiverse.com/thing:2787905)
- 16 dungeon\_stone\_floor.inch.E
- 8 dungeon\_stone\_floor.inch.F
- 2 dungeon\_stone\_floor.inch.R
- 4 dungeon\_stone\_floor.inch.U
[**Stone Walls**](https://www.thingiverse.com/thing:2787903)
- 20 dungeon\_stone\_wall.inch.A
- 4 dungeon\_stone\_wall.inch.BA
- 8 dungeon\_stone\_wall.inch.G
- 2 dungeon\_stone\_wall.inch.IA
- 4 dungeon\_stone\_floor.inch.Q
- 4 dungeon\_stone\_column.inch.I.stl
- 8 dungeon\_stone\_column.inch.L.stl
- 4 dungeon\_stone\_column.inch.O.stl
- 4 dungeon\_stone\_column.inch.X.stl
- 4 dungeon\_stone\_column.inch.T.stl
If you look at that, though, you wonder what the heck E, F, R and U are. Oh and then there’s Openforge vs Triplex!? And some of those files have SIDE in there!?!
## Bases
First, we’ll cover the bases. Depending on how you want to connect, depends on the base you want. The one we’re going to use is **triplex** – which has many openlock ports, one per edge between squares and one per square. So here’s what Triplex looks like:
1×1 Topper2×1 TriplexThe non Triplex is just a ‘topper’ which you will then glue or magnet on to your bases (hence why I came to love the glue). The Triplex comes with holes on the sides, which are for using OpenLock clips! That said, you will need to [prep your printed whatnots for the clips](https://support.terraintinker.com/article/13-preparing-your-openlock-tile-pieces). Which is also a pain in the ass.
This means I looked at the toppers and then I looked at the bases. There were a lot of options, and I finally settled on the one that had the least amount of work for me: [OpenForge 2.0 Plain OpenLOCK Base](https://www.thingiverse.com/thing:1910972)
Related to that, the ‘side’ versions of walls are ones with click holes on the sides, as well as front/back.
### OpenLock
I like this. It’s a double ended clip you stick in the holes in the above. They look like this:
Photo of Springy OpenLock Clip by [Marcel Toele](https://www.thingiverse.com/eleotlecram)
Stick ’em in the hole, click and done. Now if you don’t want to use the clips, you can put magnets in some of those holes. If you’re using OpenLock, you want about 2 clips per tile you print, so 54 for the starters. For magnets you’ll need 256. Big difference!
Many people recommend the [Springy OpenLock Clip](https://www.thingiverse.com/thing:3367267) by Marcel Tool, who makes a loose, medium, and firm springy version (he recommends the medium). For whatever reason, I could not get it to build properly reliably (sometimes it was okay), so I used the ones made by Jones and the official ones until I could figure out why my slice was wrong (I’m very new at this!).
## Letters
Now! What the bell end does “dungeon\_stone\_wall.inch.A” mean?
Well after some serious digging I found the [documentation about filename](https://www.patreon.com/posts/new-filename-56811509)! **\[Texture\]#\[Shape\]+\[Shape Options\].\[Letter\].\[Connection system\]+\[Options\].stl**
Now… that’s the **new** naming convention, but as you can see on Thingiverse, the names aren’t that. But! That clued me in to the fact that those letters, A and AS and so on all relate to the **OpenLock** code!
This is made worse by the ThingiVerse display:
If you hover over the name, you can see the whole name but you cannot click on the small picture and see the big one. I had to turn off ‘max width’ to get the full names, and everything looks like this:
- dungeon\_stone\_floor.inch.AS.openforge.stl
- dungeon\_stone\_floor.inch.AS.triplex.stl
Obviously I don’t need openforge AND triplex. But that still was a pain in the butt to get the list of. And those tiny photos meant I was going mad to figure out what the hell was what Thankfully [someone else felt my pain](https://martinnr5.com/2019/10/09/getting-to-grips-with-openforge-part-1/), and with that I made a key!
### Keys
FilenameSize\#AS3″ x 1″ rectangle (wide)E2″ x 2″ square16EA3″ x 3″ squareF2″ x 2″ curve/V8I1″ x 1″ squareR2″ x 4″ rectangle2S1″ x 2″ rectangle (tall)SA1″ x 3″ rectangleSB1″ x 4″ rectangleU4″ x 4″ square4\# means the recommended number to print from the starter setThat makes a lot more sense, right? I tend to use sprawling dungeons and large rooms (they’re fighting in the castle as I started all this) it would work for me. Except for the 8 F’s. I don’t use curves like that because I’m hand-making maps and I hate curves. I can’t make straight lines.
Walls are a little weirder since a number of items have ‘side’ options and ‘pegs’ options.
FilenameSizeSidePegs\#A0.5″ x 2″YesYes20B0.5″ x 1.5″YesNo4G0.5″ x 2″ x 2″ curved cornerYesYes8IA0.5″ x 1″YesYes2Q0.5″ x 4″YesYes4I1″ x 1″NoNo4L1″ x 1″NoNo8O1″ x 1″NoNo4X1″ x 1″NoNo4T1″ x 1″NoNo4**\#** means the recommended number to print from the starter setYou’ll notice new columns!
- **Pegs** is if there’s an alt version with pegs for making a second layer (not needed for starters)
- **Sides** is if there’s an alt version with clip slots on the sides
All columns are 1″x1″, but have pegs in different places.
## What did I Print?
The weird part about this was figuring out if I really wanted Triplex (supports all three) or just plain bottoms and glue on tops… I will likely use the same floors over and over and over again. And I don’t plan on stacking layers…. Yet. Not until they have fights in a house. Otherwise I’ll pop upstairs, get the next set, and pop back down and have them scream their delight at me.
So what did I end up building?
- 54+ OpenLock clips — these are a mix of springy and official and Devon’s
- 36 2×2 bases (E) — these are a mix of topless (10) and the old plain ones (26)
- 16 2×2 curved bases (G) – topless
- 2 2×4 bases (R) — topless
- 8 4×4 bases (U) — topless
- 16 cut stone 2×2 toppers (E)
- 20 cut stone 2×2 walls (G)
- 20 cut stone 2×2 wall floor (G)
- 4 cut stone 4×4 toppers (U)
- 4 cut stone 4×4 wall floor (U)
- 4 cut stone 4×4 walls (U)
Example of how to do an interior hallway by **Manfred G**
You’ll notice things are more than they recommended. Once I went with toppers, while it does mean a lot of gluing, it also let me use the new Wall Floor system, which obviates the drama of a wall being a half inch. Instead of having a half-inch gap between wall and the floor behind it (like if you’re doing internal walls), you can make a wall that takes up a half inch, and then a floor for an inch and a half.
The example image I included is weird, I know, but basically those are **TWO** `towne_wall.floor.inch.2x1`, which are both 1 inch wide. Then two walls which are each a **half** inch for a total of three inches. Plug them onto an AS or SA (3 inches by 1 inch) and you have a hallway!
Since I’m building a specific campaign, I mathed out what I needed to mimic the boss fight. In the end, I decided to change the size a little from paper map to cardboard to real, to compensate for what I was doing.
I had to wait to post this until (a) the printer showed up and (b) I had successfully built the set. My wife knew I was doing this. The others did not. And due to the time crunch we did not paint them. Still… it worked! Here are some of the ones I’ve made (or am making) and a cardboard to compare:
So far, it’s all been well received.
**Categories:** How To
**Tags:** 3d printing, d&d
---
### [oEmbedding Hugo](https://halfelf.org/2021/oembedding-hugo/)
**Published:** November 10, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Even more oembed magic, this time for a static site builder.
**Content:**
No, not Hugo …
No no. *[Hugo](https://gohugo.io)*
[](https://gohugo.io)
I’ve been using Hugo to [power a part of a website](https://halfelf.org/2015/hugo/) for quite a while now. Since 2015 I’ve had a static site, a simple library, with around 2000 posts that I wanted to be a static, less-possible-to-be-hackable site. It’s purpose was to be an encyclopedia, and as a Hugo powered site, it works amazingly.
But… I do use WordPress, and sometimes I want to link and embed.
## Integrations Are Queen
It helps to have a picture of how I built things. Back in *\*cough\** 1995, the site was a single HTML page. By 1996 it was a series of SHTML (yeah) with a manually edited gallery. Fast-forward to 2005 and we have a gallery in the thousands and a full blown wiki.
Now. Never once did I have integrated logins. While I love it for the ease of … me, I hate it from a security standpoint. Today, the blog is powered by WordPress and the gallery by NetPhotoGraphics and the ‘wiki’ by Hugo (I call it a library now). Once in a while I’ll post articles or transcripts or recaps over on the library and I want to cross link to the blog to tell people “Hey! New things!”
But… from a practical standpoint, what are the options?
1. A plain ol’ link
2. A ‘table’ list of articles/transcripts/etc by name with links
3. oEmbed
Oh yes. Option 3.
## oEmbed and Hugo is Complex
Since Hugo is a static HTML generator, you have to create faux ‘endpoints’ and you cannot make a dynamic JSON generator per post. Most of the things you’ll find when you google for oEmbed and Hugo is how to make it **read** oEmbed (like “[adding a generic oEmbed *handler* for Hugo](https://bofh.org.uk/2020/05/12/oembed-for-hugo/)“). I wanted the other way, so I broke down what I needed to do:
1. Make the ‘oembed’ JSON
2. Make the returning iframe
3. Add the link/alternate tag to the regular HTML
Unlike with NetPhotoGraphics, wherein I could make a single PHP file which generated the endpoints and the json and the iframe, I had to approach it from a different angle with Hugo, and ask myself “How do I want the ‘endpoints’ to look?
See you actually **can** make a pseudo endpoint of `example.com/json/link/to/page` which would generate the iframe from `example.com/link/to/page` and then `example.com/oembed/link/to/page` but this comes with a weird cost. You will actually end up having **multiple** folders on your site, and you’d want to make an `.htaccess` to block things.
This has to do with how Hugo (and most static site generators) make pages. See if I wanted to make a page for ‘about’, then I would go into `/posts/` and make a file called `about.md` with the right headers. But that doesn’t make a file called `about.html`, it actually makes a **folder** in my `public_html` director, called `about` with a file in there named `index.html` — that’s basic web directory stuff, though.
But Hugo has an extra trick, which allows you to make custom files. Most people use it to make AMP pages and they explain the system like this:
> A page can be output in as many output formats as you want, and you can have an infinite amount of output formats defined **as long as they resolve to a unique path on the file system**. In the above table, the best example of this is `AMP` vs. `HTML`. `AMP` has the value `amp` for `Path` so it doesn’t overwrite the `HTML` version; e.g. we can now have both `/index.html` and `/amp/index.html`.
Except… your ‘unique path’ doesn’t have to be a path! And you can customize it to kick out differently named files. So instead of `/index.html` and `/amp/index.html` I could do `/index-amp.html` in the same location.
So that means my options were:
1. A custom folder (and subfolders) for every post per ‘type’ of output
2. Subfiles in the already existing folder
I picked the second and here’s how:
## Output Formats
The secret sauce for Hugo is making a new set of [output formats](https://gohugo.io/templates/output-formats/).
```
outputFormats:
iframe:
name: "iframe"
baseName: "iframe"
mediaType: "text/html"
isHTML: true
oembed:
name: "oembed"
baseName: "oembed"
mediaType: "application/json"
isPlainText: true
```
By *omitting* the **path** value and telling it that my **baseName** is `iframe` and `oembed`, I’m telling Hugo not to make a new folder, but to rename the files! Instead of making `/oembed/index.html` and `/oembed/about/index.html` I’m making `/about/oembed.html`!
Boom.
The next trick was to tell Hugo what ‘type’ of content should use those new formats:
```
outputs:
home: [ "HTML", "JSON", "IFRAME", "OEMBED" ]
page: [ "HTML", "IFRAME", "OEMBED" ]
section: [ "HTML", "IFRAME", "OEMBED" ]
```
Home also has a JSON which is something I use for search. No one else needs it.
## New Template Files
I’ll admit, this took me some trial and error. In order to have Hugo generate the right files, and not just a copy of the main index, you have to add new template files. Remember those basenames?
- `index.oembed.json`
- `index.iframe.html`
Looks pretty obvious, right? The iframe file is the HTML for the iframe. The oembed is the JSON for oembed discovery. Those go right into the main `layouts` folder of your theme. But… I ended up having to duplicate things in order to get everything working and that meant I also made:
- `/_default/baseof.iframe.html`
- `/_default/baseof.oembed.json`
- `/_default/single.iframe.html`
- `/_default/single.json`
Now, if you;’re wondering “Why is it named `single.json`?” I don’t know. What I know is if I named it any other way, I got this error:
> WARN: found no layout file for “oembed” for layout “single” for kind “page”: You should create a template file which matches Hugo Layouts Lookup Rules for this combination.
So I did that and it works. I also added in these:
- `/section/section.iframe.html`
- `/section/section.oembed.json`
Since I make heavy use of special sections, that was needed.
## The Template Files
They actually all look pretty much the same.
There’s the oembed JSON:
```
{
"version": "1.0",
"provider_name": "{{ .Site.Title }}",
"provider_url": "{{ .Site.BaseURL }}",
"type": "rich",
"title": "{{ .Title }} | {{ .Site.Title }}",
"url": "{{ .Permalink }}",
"author_name": "{{ if .Params.author }}{{ .Params.author }}{{ else }}Anonymous{{ end }}",
"html": ""
}
```
And there’s the iframe HTML:
```
{{ .Title }} · {{ .Site.Title }}
{{ .Title }}
{{ .Summary }}...
{{ .Site.Title }}
```
Note: I set `summaryLength: 10` in my config to limit the summary to something manageable. And no, you’re not mis-reading that, the library generally has no images.
And then in my header code for the ‘normal’ html pages:
```
{{ if not .Params.notoembed }}
{{ "" | safeHTML }}
{{ end }}
```
I wanted to leave a way to say certain pages were **non** embeddable, and while I’m not using it at the moment, the logic remains.
## Does it Float Work?
Of course!
Nice, quick, to the point.
**Categories:** How To
**Tags:** hugo, oembed
---
### [FreshRSS: A Simpler Self Hosted RSS Manager](https://halfelf.org/2021/freshrss-self-hosted/)
**Published:** September 10, 2021
**Author:** Ipstenu (Mika Epstein)
**Content:**
I’ve been using [Tiny Tiny RSS](https://tt-rss.org) for … well [years](https://halfelf.org/2012/tiny-tiny-rss/). Almost a decade. I like it a lot, the interface is nice and pretty to use. But there have always been some serious lingering issues with it.
1. The developer is very opinionated, to the point of aggression
2. The development is Docker, to the point that non-Docker support is non existent
3. Support for ‘non modern’ browsers means Safari is not supported
Now I’m opinionated, and I can be curt and blunt at times. And I work with a lot (A LOT) of people who are similar. I do plugin reviews for WordPress.org — trust me, I know from opinionated developers. I have lost track of the time I’ve spent arguing with prima donnas who cannot fathom that their code might not be god’s gift to the universe.
The majority of people, thankfully, are not like that. They recognize no one is perfect, they understand that sometimes you have to make allowances in your code for the sake of a system, and most of all they aren’t aggro when told “no.” (If you find yourself getting pissed off, BTW, when someone reviews your code, yes, I’m talking about you.)
Anyway. [Andrew Dolgov](https://fakecake.org/) is an amazing developer, a talented one at that. But he has a very ‘my way or GTFO’ kind of flow, and since it’s a single-man project, I really do get that. And for the time that he happily supported PHP on whatever, I didn’t care. The code worked, he didn’t have any strong opinions that offended me (like being a Nazi sympathizer, and yes, I’ve ditched software I love for that), and so what if he was a bit prickly?
But… He’s Docker all in. And I like Docker, but I don’t want to run it all the time, and certainly not for a flippin’ RSS reader that is PHP and SQL and that’s it. As time went on, it got harder and harder and harder to manage and maintain a slight fork, to the point that it’s just not worth it.
## The Replacement: FreshRSS
[FreshRSS](http://freshrss.github.io/FreshRSS/). It’s a barebones, simple, easy to install RSS reader. How easy? It’s practically a ‘famous five minute install.’
The selling points are:
- Open Source (AGPL)
- Easy and fast install
- No Docker requirement
- Many active contributors
- [Active development](https://github.com/FreshRSS/FreshRSS)
- [Extensions library](https://github.com/FreshRSS/Extensions)
- French language support
- [Clear documentation](https://freshrss.github.io/FreshRSS/)
That’s really all I needed.
The install was to download the [latest release](https://github.com/FreshRSS/FreshRSS/releases), unzip it on my server, and then I went to the URL where I’d installed it ( i.e. `https://example.com` ) and entered the DB credentials. Then I made a new account and boom. Done.
Much like with TTRSS, I have to set up a cron job to run the refresh, which I set to hourly:
`php /home/username/`example.com`/app/actualize_script.php > /home/username/FreshRSS.log 2>&1`
Now I have to migrate my content to actually have something to check.
### The Migration
First up, you have to export from TTRSS, which is not as obvious as all that. The best way is via command line:
`$ php ./update.php --opml-export "ipstenu:ipstenu.opml"`
Don’t waste time with the various plugins, they’re not supported and in my experience, don’t work. Also if you’re mystified trying to find out how to export, it’s not just you. I had to trawl through the forums to find an example that didn’t work, but did link me to the code and I was able to figure it out from there.
Once you have that, save the OPML file and pop over to FreshRSS and import. It will keep your categories and everything.
Yeah, that was it!
### The Tweaks
Most of the settings are fine as is. I turned off the option to mark as read when I scroll by (I regularly use unread to know what I need to handle next):
I also added in a [filter](https://freshrss.github.io/FreshRSS/en/users/03_Main_view.html#filtering-articles) to mark a specific feed as read *unless* it mentions a keyword which was as easy as a filter for `-intitle:keyword` to that feed.
I picked a theme that made me happy to boot.
All in all, it was a super easy move.
**Categories:** How To
**Tags:** FreshRSS, open source, rss, ttrss
---
### [Failure to Protect](https://halfelf.org/2021/failure-to-protect/)
**Published:** June 16, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I talk a lot about things that are wrong. Things that lead to abuse. And the question everyone has is "How do I fix this?"
**Content:**
Something I knew would come up after I posted about my [ongoing harassment](https://halfelf.org/2021/when-its-not-burnout/) is the question “How do we fix this?”
Now, the cause of all this actually can be boiled down to two things:
1. A systemic failure of social services to help those in need
2. The overall lack of awareness of how tools are abused
I can’t really fix the first one. The world is broken on many levels and the fact that people in pain and anger have no help, and thus lash out in anger at me, at you, at people who write code, at people just trying to help … That’s all of us. We need health care (physical and mental). We need fair and equal pay. We need a living wage, not a minimum one where companies *literally* pay you that because they don’t have to treat you like a human.
That one is huge.
But the other problem? That’s why I posted.
## How Can Code Be (Ab)Used?
When we write code, and this is pretty much all of us, we’re trying to solve a specific problem. Sometimes that problem is huge, with multiple layers and facets and complexities that make us look like a scene from “A Beautiful Mind.” If we’re lucky. Usually we look like this guy”
Regardless of how twisty-turney our code is, though, at the end of the day the question many of us forgot to ask is “What’s the **worst** thing someone can do with our code?”
Let me give you an example.
“What’s a bad thing someone can do with Akismet?”
Right? It’s an anti-spam plugin that checks via a closed-API (meaning, I have no idea how it works) so it’s not easy at all to abuse, you might think. Well, without any forethought, the very first thing that comes to mind is I could write a bunch of clearly spam comments, spin up my VPN, and use someone else’s email address to leave spam comments on a hundred or a thousand blogs. That would get the email flagged and they’d probably have to constantly struggle until they figured out why, if they ever could. All they’d know is their comments never show up. Give me a couple hours and I could automate that, set it out into the world, and reap the joy of annoying someone.
I’m fairly certain I just screwed up someone’s day with that, by the way. Sorry/Not Sorry friends over at Akismet. Because that’s my point. If Akismet **has not** already sat down and made a list of all the shitty, terrible, vile things someone could do with their product, they’ve failed to fully protect its users.
## Disruption Makes Harassment
When we build to ‘disrupt’ we do so with the knowledge we’re breaking the system. Sometimes we’re breaking it stupidly, like “Uber is disrupting taxis!” really is “Uber figured out that people would rather know what they’re going to pay, and wanted an easy way to hail a gosh darn taxi in the first place! Let’s go!” And yes, I have a low opinion on the ideas to ‘revolutionize’ the bus system (spoilers? invest in public transportation, not privatization).
The thing is, we continue to attack a single, specific problem. Big, large, whatever, we’re solving *a* thing.
But the problem with this is our disruptions create opportunities for harassment.
Did you get a delivery from Instacart or DoorDash? They know where you live and what you eat. Those are all known risks of course. Could someone roofie my food or tamper with it? Sure! Now the solving of that falls onto the people who package the delivery. Restaurants will tamper-proof seal their deliveries, but that’s on them. What did DoorDash do? Nothing I can find. Instacart? Most of their stuff is pre-packaged, but if you get fresh fruits etc, gosh they could. It’s like those stupid Halloween rumours we heard growing up. None were true, but …
Uber received 235 reports of a rape occurring during a ride in the United States in 2018. Those are the numbers of **reported** cases, [provided by Uber](https://www.uber.com/newsroom/2019-us-safety-report). Remember, rape is wildly underreported in the US (probably everywhere). Now think about all the information an Uber driver has on you? They know where they picked you up, they know where they dropped you off, and they know your name. [And they can get your phone number](https://angelinatravels.boardingarea.com/2018/02/27/uncovering-flaw-uber-drivers-can-access-real-phone-number/).
All those great innovations? Actually yes. They’re really helpful to people! Calling a car to your door that’s more reliable than a Taxi? Hell yes! But they are incredibly easy to use to harass someone. Of course they require you to be in the same general location, but still. What are **they** doing to make **us** safer? What about the *drivers*? Someone I know quit driving because the guy wanted her to drop him off inside a super suspect parking lot. She dropped him off outside. He called her a four letter word that starts with a C.
## Social Media Makes Monsters
I’m sure I don’t have to list out the problems with social media. If someone harasses me, I block them, but they can make a new account and a new account and a new account. They can get a VPN and a fake email, and we’re always and forever behind the 8 ball catching and stopping.
Why do [Facebook moderators have PTSD](https://www.nytimes.com/2018/09/25/technology/facebook-moderator-job-ptsd-lawsuit.html)? Why do content moderators on YouTube have to [sign a waiver ](https://www.theguardian.com/technology/2020/jan/24/youtube-moderators-contract-ptsd-mental-health)agreeing that they know their job may case mental breakdowns, and it’s not YouTube’s fault?
And the answer here is because our solutions are **HUMANS**.
We disrupted communication, but we opened the door for harassment because there was little to no forethought put into how to protect anyone. In fact, I bet I know how the conversation went (spoilers? I had this conversation with someone):
“Hey, someone could make a hundred fake accounts all to call someone a jackass.”
“Yep. No point trying to stop that. We block ’em they’ll just make new accounts.”
“Yeah, good point. Okay, next item on the agenda? Bots!”
Oh yeah, Bots totally extended from that problem. I used to use something called [Block Together](https://blocktogether.org) to catch and block bots and spammers and harassers, but the fact that it shut down and Twitter never made anything better is … well it tells a story, doesn’t it? Can anyone tell me what Twitter’s done?
Well they, and Facebook, claim to be using machine learning to find and track abuse, but here’s the funny thing. I have a friend who has been permabanned from Twitter for telling someone to jump in a volcano. The claim was she was violent and sent a legitimate and **plausible** threat. About a volcano. Which she does not own. I mean, do any of us? it’s not even that it was a bad joke about suicide, it was flagged as a violent threat.
Want to know how that happens? It’s easy. She tells a man to shove it, he and his friends mob-report her, Twitter’s AI decides “Gosh, if all these people flagged her, it’s real!” and ban her. No appeals. Done. And this story is repeated over and over, that the AI caught something (people talking about black and white chess pieces was pretty recent), banned someone, and that’s the end of it.
All this is not to mention the ongoing racist and sexist biases of AIs, like how Asian people can’t use FaceID, or how Google’s AI labelled black people as gorillas? All of those things come down to the problem of people with biases (which is a systemic issue related to the failure of social services) building AIs and not thinking about the abuse therein (which is … an us problem).
To put this a different way, we’ve been fighting spam in email since email was born, and everyone *still* gets some in their inbox. If we can’t win with that? We’re never going to win with an AI and abuse.
## Democratizing Abuse
Now, I’m going to say something controversial.
WordPress democratized abuse.
I’m not talking about WordPress.org and the forums and plugins and themes. I’m talking about your blog. If you have comments open, what’s to stop someone from leaving comments pretending to be you? Heck, if you have comments open, what’s to stop someone from leaving comments pretending to be **ME**? How do you ban someone from your site? How do you ban them from a network? How do you stop them from making an account or email one after another and using your contact form to be a jerk?
I have 10+ rather insane messages from a contact form that tells you that even for me, someone who is pretty much awesome at WordPress code, this is not easy. For a long time, you couldn’t filter contact form messages to block spammers on Jetpack. How long? Well I [opened the ticket in 2014](https://github.com/Automattic/jetpack/issues/430), so it was a long time until 2020, when [someone else made a new ticket about](https://github.com/Automattic/jetpack/issues/16513).
Is all this WordPress’ fault? Absolutely not! I don’t have to have comments on most of the time, or a contact form. You’ll notice I have neither on most posts on this site, and it’s for a reason. Abuse and harassment. In fact, WordPress gives me the agency to both harass people via my blog (if I wanted to) **and** protect myself from the harassment by others. That’s a fun one when you say it out loud, ain’t it?
WordPress is a weapon, like all websites. When wielded by the good and just, it’s a weapon for good and justice. When it’s not? Let me just point out that there are a lot of ‘revenge porn’ type sites out there, powered by WordPress. And again, **none of that is WordPress’ fault**.
We built WordPress to make it easier to publish whatever we want, whenever we want. We build features and plugins and themes to share stories. Not all of those stories are good. Some of them are abusive. And while there are already laws out there about it, technology is a massive whole of lawlessness where the laws can’t be applied.
We’ve all heard “Guns don’t kill people, people kill people.” Some of you even know the common retort “Guns make it a heck of a lot easier, though.”
WordPress isn’t the harasser, but gosh it makes things easier. And if that doesn’t give you chills and nausea, you’re not paying attention to the world. It sure scares the snot out of me.
## The Open Consequences Net
I have to preface this bit with the fact that I don’t believe in ‘Cancel Culture’ but I do believe in **consequence** culture. Do I think you should be ‘canceled’ for telling a single off-colour joke 5 or 10 years ago? Hell no. But do I think you should be canceled for telling multiple jokes, being a defensive jerk when called out on them, and showing your literal penis to people? Hell yes.
Actions have consequences. Or at least they should. And the problem we’re facing is that by making an Open Internet, which I’m in full support of, we failed to put in any way to enforce consequences. Everything is silo’d so I can ban you from site A or B, but not C or D. Worse, because you can make another email or get a new IP, I cannot permanently ban you forever, just from each account.
Basically? We built something so wild and free and open, we cannot contain or control it anymore.
## Can We Fix It?
This is the part where I tell you how much I hated making this post.
See, I have no idea. Seriously.
Even if we make the internet ‘invite only’ (as if that was possible), it’ll still be abused. But I don’t think that means we should do **nothing**. I think we’re not doing enough to make it difficult and hard for abusers and harassers to get a foot in the door. We’re making it so the only way people can protect themselves is to simply not be social online. Given the pandemic, I suspect you can all see why that’s a flawed prospect.
Everything we need to do needs to be balanced. For example, it’s easy (and probably right) to say we need to begin to disrupt ‘anonymity’ but… What about people who can’t say who they are for fear of retribution? I immediately think of all those kids out there who are terrified for their ultra conservative, homo-hatin’ family members to find out they’re queer? They should be allowed to be anonymous and learn that there’s a world out there who loves them.
I do like to bag on Twitter and Facebook for their lack of nuance when it comes to handling harassment and abuse, but I am also a realist. At their scale? How the hell do you tackle things? The only answer is really to throw more humans at it which would make more jobs, but it’s some of the most soul destroying work you’re ever going to do. And they don’t see it as a beneficial investment, so they’re not going to pay the people who do this a solid wage, with great health care, rotating them in and out so they don’t flame out.
Proof? Okay. [Read what happened to WangGuard](https://wordpress.org/support/topic/why-wangguard-was-closed/).
> WangGuard worked in two different ways: as an algorithm that I had been refining for 7 years, and which was getting better as the sploggers evolved, so that it was always one step ahead of them, and also as human curation, in which I reviewed many factors, among them sites of sploggers to see if their content, could improve the algorithm and make sure that it worked correctly both when it was blocking or not blocking a site. The great secret of WangGuard was this second part. Without it WangGuard would not ever have become what it was.
>
> This human component is what I have been doing for 7 years, and also what has led me to close WangGuard (along with other considerations that are not relevant).
>
> [Why WangGuard was Closed](https://wordpress.org/support/topic/why-wangguard-was-closed/) by Jose Conti
And I have to agree with Jose, doing that job eats at your soul. The ‘fix’ is to change the world, and that’s just exhausting.
## What Can We Do?
When you make a product, ask yourself “How can this be **ab**used?” If you can’t think of anything, look around the room of the people you’re working with. Are they all from the same ethnic or socioeconomic background as you? Get people who aren’t. Get minorities in the room. Get PoC, get women, get queers, get *kids*. Get people who didn’t go to college, those who did, those with and without children, those from other nations. Get them and ask them “Hey, what’s the worst thing you could do to someone else with this?” Ask them “Do you see any flaws?”
And then? **Listen to them.** If women tell you “That’s going to make it impossible to stop people from sending us dick-picks” take it seriously. But for the love of Pete the Plug, take them seriously.
This means we are all going to have to accept when we’re wrong, when our ideas have flaws, and learn from those moments. It’s hard! We don’t want to hear our great idea is screwed up, but sometimes it is.
We’ll never change the world for the better if we cannot change ourselves.
**Categories:** How It Is
**Tags:** harassment, safety, self care
---
### [Bad Actors: Block or Not?](https://halfelf.org/2021/bad-actors-block-or-not/)
**Published:** May 12, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Should I block or should I mute now? If I mute there will be trouble. If I block it may be double.
**Content:**
So here’s a fun question… Say you’re being harassed or bothered by a single person. Do you block them?
This should be a simple answer, right? Obviously block. If you block, you don’t have to see them, they can’t get to you, it’s great. Except, as anyone who’s been harassed will tell you, if the person is particularly an asshole, they will make more accounts with which to try and contact you! I’m not joking when I saw my particular headache has used over 100 separate emails. Even if you report them to the email services as soon as possible, some will tell you “There’s nothing we can do to prevent abuse.”
That’s a different issue for another post. This one is … do I block or not?
The ‘dude’ in this story is an amalgamation of at least five separate men, all of whom did the same thing, and all of whom claim to be ‘woke’ feminists. No names are mentioned nor will they be, but I suspect they’ll see themselves…
## The ‘splain Drain
There’s no way around this one, and some people I know on Twitter do this. If you block people on an account, they use another. I’ve blocked people for being perpetual mansplainers. Like someone who was offering advice on how to travel after it was mentioned a friend and I were going to a specific location he was familiar with. Now, you’d think “Oh but he meant well, right?” The problem was he had a history of un-thinking hot-takes. We were going to a specific convention (not WordCamp) and we knew we’d be working that con basically 12 hours a day, making notes, recording interviews, and so on. Our goal was not to to that town and party, it was **work**.
The advice? Lots of places to have fun, how to handle working conventions, etc etc.
Now. Anyone who actually knew us and followed our tweets knew that my friend and I had all that locked down. We’ve worked cons before, ones way the hell bigger than this one, and we knew how to handle ourselves. We knew how to optimize our packing, how to prioritize, and we were not asking for advice or help. Simply, we said we were excited to go to this event.
Again, you could think “Oh but he meant well.” The thing was, he took **zero** time to read the room. He didn’t scroll back and see the older tweets, he didn’t see any of the conversations prior. He saw one moment, and jumped in. All of the other comments were about who we were going to meet/interview, how nice it would be to be at a convention like that, tech talk about devices and charging and packing and carrying. We weren’t going to go to party, we weren’t going to go to fancy restaurants. We had jobs.
If you’re a woman in tech, you’re **tired** of that behaviour. Because now it’s suddenly your job to roll back, re-explain everything, and thank this person for their time but you’re good. And I have to tell you, it’s **exhausting** to do that over and over and over. I cannot begin to tell you how many times my reply to someone has been “Thanks, but per the discussion, we’re doing X. Please re-read the whole convo.”
It is an ongoing, perpetual drain that men (and yes, I do call out men here) jump in with ‘help’ without giving anyone the respect and time to actually read the freaking room. They don’t do the research, they don’t read the scroll back, they don’t even ask “Is this all sorted out or can I help?” They assume that you need help, and they believe they’re the one to do it.
## Mute Them
I’m sure a lot of guys I know are pissed off at me right now, but guess what buddies? That’s why I mute a lot of you. Some women too, yes, and if a single one of you idiots jumps in with ‘not all men!’ I will escalate and block you, because the ‘all’ isn’t the point. The point is that a **majority** of men (especially in tech) do this. They are the Hero. The Saviour. The Champion. They can help YOU!
So when people, of any gender, jump into my timeline and offer advice where they clearly have not read a blessed thing, I mute them. The guy I’m talking about who mansplained? Wanna know what he did? He **kept on** explaining how he was trying to help. My friend told him “Thanks but no thanks.” and I didn’t reply at all, but he went on. So I blocked him. And that sucked, because he was someone I did like as an acquaintance. I’d even gave him asked-for advice to get a better job. He has one now, and I’m happy for him.
Anyway. Blocked him, moved on, and a couple years later he had yet another hot-take which was also entirely wrong. It really doesn’t matter what the subject was, but what matters is I was complaining about a stupid part of a contract that told me I was to do thing A in advance of a release but also not to do thing A until **after** the release.
So I complained about this on twitter, remarking how daft it was. One of the blokes I’d muted hopped on the reply-train to tell me that’s because I wasn’t really part of the process.
Repeat that meme above, eh. Signed contract. Told I was supposed to to X for the process, but also not to do it… And if you’re wondering “Mika, didn’t you block him?” yes, yes I did. He used **another** account to contact me with **another** bad take. A 100% incorrect take, born of his own ignorance about the subject matter and the contract. I replied, correcting his assumption (and at that time not realizing who he was).
The next reply from him was that he actually had understood but he wanted to say something ‘different.’ At that point I thought ‘this sounds like one of those guys …’ and I looked at the account. Oh yes, it was. But I thought maybe he was redeemable, maybe he’d changed, and I asked him if he had any experience or expertise in this area at all (it’s **not** WordPress related). That reply was the nail in the coffin. He said it was a joke, he offered to **explain** the joke, and he said I knew who he was, and his credentials were available.
Right. I replied, told him the joke wasn’t funny and if it needed to be explained, it was a bad joke, and I muted him.
My thought process was as follows:
1. Someone who always replies with ‘jokes’ isn’t someone I feel like listening to.
2. People who reply constantly with ‘jokes’ aren’t listening to me in the first place, they’re listening for bullet points they can joke about.
3. The ‘it was a joke’ defence suggests it wasn’t a joke, he knew that, and he’s hurt I called him out.
4. Anyone who tells me **his** credentials are online, and yet flat-out cannot be bothered to correct his assumptions about mine is disrespectful.
5. I already **blocked** his personal account.
## Why *not* block?
Well. As you can see from this story, I had already blocked him and he was using a secondary account to follow me and comment on things. Did I know, prior to the conversation, that he was in charge of that account? Not at all. I had no reason to look. Now that I have looked, I see his feed is still filled with low-key racism and ignorance all over the damn place. He probably doesn’t even see that, and if he figures out this post is talking about him, he’s probably livid.
But again, this isn’t about Mr. Mansplainer, it’s about why I didn’t block him right away. I muted him.
I didn’t block him because I don’t want to encourage him to make a third account (or use another one he already has) to try and talk to me. I just don’t want to hear from him.
And that is a decision that women online make every day. We recognize that blocking people just makes them madder and that sometimes they jump around and use more accounts to be jerks. It’s happened time and again to me, I’m sure it will again, and it’s why I heavily mute people all the time.
Amusingly enough, I’ve been blocked by a couple people I’ve muted, one of whom screamed murder because I didn’t accept his DMs. I don’t accept DMs from anyone I don’t follow for a reason: I’m tired of people being assholes. So it wasn’t personal, John Doe, but way go.
## Okay but … How can I mute on my site?
You mean comments and contact forms? Good question!
First? Turn off comments and remove your contact form. You don’t need them most of the time. If you **do** want them, for the love of the flying spaghetti monster, use the comment moderation tools! In WordPress go to Settings > Discussion. Now, add in their info. Twitter handles and emails go directly into the Disallowed list. First names (especially if they’re common) go into the **moderation** list.
But this is also where I’m kind of a bad person. See, if I have someone who is a jerk in emails and I know they may use a contact form, but as I’ve been saying since 2014, you should be able to **[blackhole their messages](https://halfelf.org/2016/mailbag-contact-forms-fail/)**. By blackhole I mean their emails should **appear** to be sent, but you never see them.
In short? They’re treated like spam. This sometimes has the side effect of them being flagged as spam elsewhere, which is why I’m kind of a bad person, but to be honest I don’t care at this point. I want them to go away.
The downside to this is [a lot of plugins don’t have a way to do this](https://halfelf.org/2018/spam-your-blacklist/). I have spent a lot of time [writing code for Contact Forms](https://halfelf.org/2021/gravity-forms-and-disallowed-keys/) that actually blocks people (or spams them) when they’re people I’m done wasting my time with. I do think more contact forms need to make this a built in option. “Use your Disallowed lists to block …” but that is a different conversation.
## How can I make sure I’m not muted?
If you’ve gotten this far, and you’re angry or you think I’m an asshole for blocking you or posting ‘about’ you, first you should know this: this post is actually about **five separate guys**. So if you’re seeing ‘you’ in this, you’re not alone, and I’m probably not the only person who wrote you off. Here’s my advice:
1. Think before you reply. Read the tweet/post, look at the other replies or the followup posts. If you’re not sure, err on the side of respectful caution.
2. Stop all ‘hot takes’ and ‘joke’ replies **unless** you know the other person really well.
3. If you met someone at a WordCamp or chatted online, you **DO NOT** actually know them really well! You are causal acquaintances.
4. If someone tells you ‘that isn’t a funny joke’ you reply “Sorry.” and shut the hell up.
5. If you have to explain the joke, you screwed up, it wasn’t funny, and you’re the one in the wrong.
6. If someone **blocks your account** do not use a second account to get around it.
7. If you’re super mad that someone disagreed with you, **walk away**. You don’t owe them your time.
8. If you’re blocked, **don’t** ask why you’ve been blocked.
Now once in a while people will hit me up and ask why they were muted/blocked. I’ve replied to one of them, and that was because I took one look and thought “Hang on, I like him! What the hell?” And I looked and found out my old block tool had caught him for retweeting someone I’d blocked (he was explaining why the other guy was a dingus). I’ve turned that off.
And I know someone is thinking “Wait, you said **don’t** ask.” Here’s the thing, that person I unblocked? Did not ask! He just pinged in another venue and said “Hey, I read about your dad dying and I wanted to say how sorry I am. You always talked about him so kindly. I would have tweeted but apparently I’m blocked. I’m sorry for whatever I said.”
Isn’t that nice? It caught my attention. I looked, I unblocked. Because that was someone who acted like a human, didn’t expect a goddamn thing from me, and wanted to treat me like a human.
It’s tragic that acting like that is rare.
**Categories:** How It Is
**Tags:** harassment, mansplaining, self care
---
### [Vulnerability Reports Miss The Mark](https://halfelf.org/2021/vulnerability-reports-miss-the-mark/)
**Published:** April 29, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Do you get weird 'security' emails that you think may be full of it? Me too!
**Content:**
Lately I’ve been getting a lot of ‘vulnerability’ reports.
I use the term loosely because the reality is these are not actually serious vulnerabilities. A couple months ago I started getting a lot of weird reports like this:
> A FLAW FOUND ON YOUR WEBSITE!
>
> Website Security Vulnerability Notification
>
> Hello, a security researcher reported a security vulnerability affecting \[your\] website via \[company\] coordinated and responsible disclosure program:
Those can be super scary! Is there really a massive issue?
No. But I know why it feels that way. And frankly I think a lot of these people are targeting the wrong group. Let’s get into it.
## Scare Tactics
In the case of all the ones I got, there was only one that I felt actually was. But first, here’s what people reported:
- The PHPInfo Page was public
- Directory indexing
- People can list users (aka User Name disclosures) via the REST API
- Your xmlrpc is showing
- Incomplete SSL Protection
- Your email records allow spoofing/DMARC compliance
The last one? Absolutely an issue. I thanked that person and kicked them some money. But the others? They’re issues, but they’re also incredibly minor! Heck, this user name listing ‘vulnerability’ does not take the following into consideration:
1. It’s on a site where every author has a page
2. We have an ‘about us’ page that lists everyone anyway
3. Strong passwords are enforced
4. We have a firewall
The only way I could really improve that would be to enforce 2FA, which I’m contemplating for admins. But that begs the question… **is this a vulnerability**?
Okay, let’s ask *why* does this work? It’s known that WordPress has a REST API. This API can be used to list **public** information about registered users. Now the API does ‘expose’ the user data for everyone who’s *authored* a public post that is shown in the REST API. Posts and pages and some custom post types included. If the user hasn’t authored posts, you won’t have permission. So again, we’re only able to list public authors. Okay.
*Could* that be bad? Sure. In the same way having a front door *could* be bad if someone kicked it in. But ‘security’ isn’t why I would ever consider blocking that. We literally list all the authors publicly already. If someone wants to use wp-json to grab them, cool. It only shows public information we displayed already, after all.
Why would I consider blocking? To ensure **stability**. That is, people hammering my site to find out that I’m **not** user #1 on HalfElf (surprise!) makes my site slower. But… I have a firewall and Mod\_Security, and IP Tables, which means if you hit my site enough, it’ll block you. Also a lot of stuff is cached, like it should be. Which means this is not a ‘vulnerability’ but more of a ‘best practice notice’ in my opinion.
And finally … FFS why are you telling individual site owners this!? If you **really** think it’s a security issue, take it up with WordPress!
## How Do You Stop Them?
Well, generally you fix the ‘issues.’ Even if you think it’s full of shit, you fix it. So okay, what do we do?
PHPInfo? Locked it down. I use it for regular checks of other things. If you’re not, just delete it.
Directory Indexing? I put this at the top of my .htaccess (and yes, you should, I’d removed it for some tests):
```
### Prevent Directory Browsing ###
Options All -Indexes
```
XMLRPC? I said “Nope, not gonna change.” Because I use the WordPress iOS App.
SSL? You’ll want to check your setup on things like [SSL Checker](https://www.sslshopper.com/ssl-checker.html) or [Immuniweb](https://www.immuniweb.com/ssl/) or [SSL Labs](https://www.ssllabs.com/ssltest/index.html). I found [SerpWorx’s tool](https://www.serpworx.com/check-security-headers/) to be invaluable for spelling out what was missing. The easiest by far was [SecurityHeaders.com](https://securityheaders.com). For that, I ended up adding this to my .htaccess:
```
### Extra Security
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header always set Expect-CT "max-age=7776000, enforce"
Header set Referrer-Policy "same-origin"
Header always set Permissions-Policy "geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);"
```
The one thing I left out was **Content-Security-Policy** because that one is crazy complex and needs a lot of testing since a lot of content on the site is remote and needs special rules.
Email/DMARC? That took a lot longer, and I had to talk to my email provider to sort it out. But you can run your domain through the [MXToolBox checker](https://mxtoolbox.com/emailhealth/) and see what you’re missing. It’s going to make you cry. Email sucks.
## Okay but I wanna hide users!
I hear you. You can do this in .htaccess:
```
### Block User ID Phishing Requests
RedirectMatch 301 ^/wp-json/wp/v2/users(.*) /about-us/
RewriteCond %{REQUEST_URI} !^/wp-admin [NC]
RewriteCond %{QUERY_STRING} author=\d
RewriteRule ^ /about-us/ [L,R=301]
RewriteCond %{QUERY_STRING} rest_route=/(.*) [NC]
RewriteRule (.*) /wp-json/%1 [L,R=301,QSD]
```
Now. This means on that site if you go to `example.com/?author=1` you **will not** go to someone’s page. But if you go to `example.com/author/ipstenu/` you still would. Which IMO points out how stupid that ‘vulnerability’ is. Yes, I am aware you can see the authors. Oooooh. You’re supposed to!
## Conclusion?
A lot of those vulnerability emails are bullshit. I politely reply “Thank you for your concern however we are not blocking access to that because the API is used by other things. It’s considered to be public knowledge anyway.” I may end up writing a form letter.
And the sucky thing is that one of the sites that collects all that stuff relies **only** on the reporter to determine if it’s resolved. Both issues they have for the domain in question? 100% resolved. But they say ‘unpatched’ … probably because I told both reporters I’m not paying them.
I added this to my profile:
> We do not accept reports of basic WordPress functionality, such as the Rest API being active, the use of xmlrpc.php, the enumeration of users, etc. Those are an acceptable risk. Please don’t bother reporting them, they should be addressed with WordPress directly, not end users.
By the way. The bug bounty program that keeps emailing me? Uses WordPress. And guess who’s site has `/wp-json/wp/v2/users` available to list **all** their public authors? Yeah. Because it’s not a goddamn major issue.
I know someone’s gonna point out it could be a major issue. Sure. Like having a window means your house or car could get broken into. That doesn’t mean you remove all the windows!
**Categories:** How It Is
**Tags:** htaccess, rest api, security, vulnerability
---
### [Gravity Forms and Disallowed Keys](https://halfelf.org/2021/gravity-forms-and-disallowed-keys/)
**Published:** March 31, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to send people on your disallowed comment list to the spam bin, and live better.
**Content:**
Recently Gravity Forms was added to a site I work on. Now, I’ve never used it before, so I was hands off (except for changing the email it sent to) and I know pretty much nothing at all about it. But what I do know is that there’s a real jerk out there who’ll spam it, given a chance.
Unlike other contact form plugins out there, Gravity Forms comes with built in **free** integration with Akismet! But, like pretty much every other plugin out there, it does not integrate with my disallowed keys.
I’m a big proponent of not reinventing the wheel, and I strongly feel that being able to block someone from comments and contact forms should be a done deal. I opted to mark people who do this as spam, instead of a rejection, so they will never know if I ever saw their email or not. This is a questionable use of the spam settings, but at the same time, it’s been a rough couple of years.
## The Process
Since the `disallowed_keys` list contains emails and words, the first thing I wanted to do was strip out everything that wasn’t an email or an `@`-domain — that means `foobar@example.com` is a valid entry, and `@spammers-r-us.com` is a valid entry, but `foobar` on it’s own is *not*. I run through my disallowed list, add everything valid to an array in a new variable.
Before I can pass through the email, though, I need to remove any periods from the username. You see, Gmail allows you to use `foobar` and `foo.bar` and `fo.o.b.a.r` all as the same valid username on your email. Yes. all those would go to the same person. To get around this, I remove all periods and make a clean username.
Also I have to consider the reality of jerks, who do things like `foobar+cheater@example.com` — Gmail allows you to use the + sign to get clever and isolate emails, which I use myself to track what sign-up spams me. At the same time, I don’t want people to get around my blocks, so I have to strip everything following the plus-sign from the email.
While I’m doing this, I’ll save the domain as it’s own variable, because that will allow me to check if `@spammers-r-us.com` is on my list or not.
Once I’ve got it all sorted, I do an in-array: if *either* the exact (clean) email is in the array, *or* the exact @-domain is in the array, it’s spam and I reject.
## The Code
```
add_action( 'gform_entry_is_spam_1', 'my_spam_filter_gform_entry_is_spam_1', 10, 3 );
function my_spam_filter_gform_entry_is_spam_1( $is_spam, $form, $entry ) {
// If this is already spam, we're gonna return and be done.
if ( $is_spam ) {
return $is_spam;
}
// Email is field 2.
$email = rgar( $entry, '2' );
// Build a list of valid emails & domains from disallowed_keys
$disallowed_emails = array();
$disallowed_array = explode( "\n", get_option( 'disallowed_keys' ) );
// Make a list of spammer emails and domains.
foreach ( $disallowed_array as $spammer ) {
if ( is_email( $spammer ) ) {
// This is an email address, so it's valid.
$disallowed_emails[] = $spammer;
} elseif ( strpos( $spammer, '@' ) !== false ) {
// This contains an @ so it's probably a whole domain.
$disallowed_emails[] = $spammer;
}
}
// Break apart email into parts
$emailparts = explode( '@', $email );
$username = $emailparts[0]; // i.e. foobar
$domain = '@' . $emailparts[1]; // i.e. @example.com
// Remove all periods (i.e. foo.bar > foobar )
$clean_username = str_replace( '.', '', $username );
// Remove everything AFTER a + sign (i.e. foobar+spamavoid > foobar )
$clean_username = strstr( $clean_username, '+', true ) ? strstr( $clean_username, '+', true ) : $clean_username;
// rebuild email now that it's clean.
$clean_email = $clean_username . '@' . $emailparts[1];
// If the email OR the domain is an exact match in the array, then we know this is a spammer.
if ( in_array( $clean_email, $disallowed, true ) || in_array( $domain, $disallowed, true ) ) {
$return = true;
}
// If we got all the way down here, we're not spam!
return false;
}
```
## Of Note…
Before you use this yourself, you will need to customize two things!
1. `gform_entry_is_spam_1` is actually the specific form I’m checking. Form ID 1. Customize that to match your form ID.
2. `$email = rgar( $entry, '2' );` — you may have noticed I put ’email is field 2′ as a note above it. That’s because email is the second field on form 1, so I hard grabbed it. If yours is different, change that.
Also … I actually broke this out into two files, one that just checks “Is this a spammer?” and the Gravity Forms file, so the latter calls `spammers.php` and checks the email against the `is_spammer()` function. The reason I did that is because I need to run this same check on Jetpack’s contact form. Both call the same function to know if someone is evil.
**Categories:** How To
**Tags:** forms, spam
---
### [18 Months Without Contact Forms](https://halfelf.org/2017/18-months-without-contact-forms/)
**Published:** October 31, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I've decided I like not having a contact form, so let's talk a little about behaviour.
**Content:**
In [February of 2016](https://halfelf.org/2016/mailbag-contact/) I deleted my contact forms (except one).
In the subsequent 18 months, I’ve actually enjoyed it, as the cruft email in my box has dropped significantly. But it led to a few peculiar situations. You see, people *do* still try to get a hold of me personally , and they’ve taken to interesting methods.
Keep in mind. I’m talking about my *personal* contact. Not work. Work is work is work. This is basically you calling my house, not my office.
## Everything Is About Plugins
Every. Single. Time.
I’m only talking about *unsolicited* messages. Not “We’ve been talking about X in the `#meta` and let’s take it to a sidebar.” And it’s not “Last week you said X was okay in `#forums` and I have a followup.”
I mean, literally, people I’ve *never* spoken to before who fall into one of two categories:
1. People looking for help with a plugin I wrote
2. People who got an email from the Plugins address
For group 1, please use the WordPress support forums. For group 2, please press ‘reply’ on your email.
But they don’t. Instead they use…
### Twitter
It’s not a secret I leave DMs open on Twitter. This means, yes, anyone can DM me if they want. So far, I’ve received the following:
- multiple offers to speak at an event
- multiple requests to help with a plugin review
- multiple complaints that blocking their ‘company’ account on twitter was unethical of me
- requests for help from friends
That last one I don’t mind. It’s pretty rare, and it’s from people who are, you know, friends. They’re also incredibly respectful of my time (as I try to be of theirs) and understand when I say no. Pro tip: If someone lashes out or acts up after you tell them ‘sorry, no’ they’re not actually your friend, they find you useful.
## Facebook
This one cracks me up because I limit FB messages to friends only, so I get a lot of friend requests just so people can message me. I decline them. The only trend I’ve noticed there is people who met me at WordCamps (sorry, no), and people from AWP (again, no).
I actually block a lot more people from FB for snide comments than anywhere else.
## Slack
90% of the ‘unsolicited’ contacts on Slack I get are people who, for some reason, instead of pressing the *reply* button in their email, decide to DM me.
The rest are people who have a question about plugins and *even though* they know about the email address, think it’ll be faster to DM me. At 8pm. On Saturday.
## The contact form on my ebook site
I actually went to look at those. The last few emails are:
- Spam to pay someone to write copy for my site for ‘SEO’
- Spam for a VPN
- Someone asking ‘If I can’t use a contact form, how am I supposed to get help?’
- Spam about SEO
Dear person #3 – That’s what the support forums are for.
## How Do You Contact Someone Without A Contact Form?
Generally? You don’t.
Look. There’s no form on my website because I’m not your free support. If you have a problem with a plugin I wrote, go to the plugin page on WordPress.org and ask for help. I get emailed when you do that. If you have a problem with a plugin review, press reply on your email. Shockingly? I get an email about that.
## What About Work?
Oh that pesky professional thing.
First of all – use the established contact methods. WordPress plugins all have support forums. Use those. Did you get an email? Press reply to the email and either propose a different method to converse *or* stick to whatcha got. Sometimes email will be the **only** way to go, as it’s the lowest common denominator (it’s 2017 – everyone has an email since you needed one to get on Twitter or Facebook or Slack in the first place).
Next, if you know how to contact someone, unsolicited, about work things, then just do that. It’s not very complicated. You reach out, you apologize for the interruption, and you ask if I have time to talk about X. Here’s an example for you:
> Sorry to bother you. I’m planning a non-WordCamp event in Dallas for 2018 and I was wondering if you or your company would be interested in sponsoring? You can find the details at `http://event-example.com` and my email is `me@event-example.com`
That works because you’re starting out being respectful of the other person’s time. You’re offering contact information, which demonstrates sincerity, and lets me know there’s a non-platform limited way to get in touch with you.
Here’s another:
> Sorry about the DM, but I don’t know where to go for this. I’m having a problem with DreamPress and I can’t log in to my panel. What’s the right way to get my access back?
This is good because you’re not assuming I’m *the* contact, and you’re asking ‘what is right?’ If it’s me, I’ll happily tell you. Well. Not happily, because I’ll be bummed you can’t log in, but I’ll help you sort it out (BTW: The answer there is the [DreamPress Support page](https://www.dreamhost.com/support/) where someone’s familiar mug can be seen).
The point here is that reaching out to someone, in an unsolicited way, requires you to begin by respecting them as a human. If you can’t do that, you’re basically sending them hate-mail.
Be sincere. Be respectful. Be polite.
And if you DM me about plugin reviews, I’ll just block you and walk away.
**Categories:** How It Is
**Tags:** behavior, communication, email
---
### [When It's (Not?) Burnout](https://halfelf.org/2021/when-its-not-burnout/)
**Published:** February 24, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's not burnout, except that it is, and it's also harassment and abuse and it's exhausting.
**Content:**
I took 2020 as a break from speaking at conferences, live for obvious reasons, and online for a couple different reasons. It took me until November to get my home office set up in a ‘non-embarassing’ way so that I didn’t feel like I was showing everyone my mess when we video’d. Also I was exhausted and realized how close I was to burn out after the last four+ years of stress and travel.
But there has been one other thing. I’d talked to a number of friends. I’ve broken down sobbing after a coworker mentioned what was going on. I’ve had longs talks with therapists and experts in this sort of thing. The issue wasn’t my workload, it wasn’t even the work I was doing. But I absolutely was burnt out.
… But it’s not for why you’re probably thinking. I’m dead ass burned from being harassed.
## Harassment
The largest contributor to my burn-out is an ongoing, over two years, harassment.
A year ago I gave a talk in NYC about [how to deal with being attacked online, and the tools you can use to protect yourself](https://halfelf.org/2019/bummer-of-a-birthmark-hal/). What I didn’t mention in detail in that post was what has been going on since November 2018.
Back then I was watching the Macy Parade (like I do every year), waiting for the oven to heat up, and cleaning out the emails for the plugin review team, when I got pinged by a forum mod. A plugin developer was being cruel to users, making weird threats and claims, and said volunteer wanted to know what to do, since that person had a flag on their account saying “If there are any guideline violations, report to plugins ASAP.” So I threw the turkey in the oven and pulled up the records.
What I found was a series of minor issues, but all repeating. The developer was asked (twice) to change their plugin name to be less spammy (ex. “The world’s greatest slider plugin! Greater than anyone has known! Used by millions!”). There were also multiple emails reminding them not to ask to contact people off the forums.
There was also a strange email from a couple months prior. A woman had emailed the plugins team about this developer, saying that after she left a bad review she was harassed by them on Facebook. At the time, we issued a final warning about behaviour (which is why the flag in the account existed). I had forgotten about it being related to this developer, as it was about their other plugin, but also we get a hundred emails a day, and I don’t memorize everyone’s drama.
In looking at that, and the post the forum mod was worried about, I saw the parallels. This was very obviously repeat behaviour, and at the time I was pretty sure that the developer was account sharing (multiple people using the one dev account), which meant not only did they not understand the message about not being unkind, but they were not making sure everyone who worked for/with them did either, **and** they didn’t understand basic security (there’s no need to ‘share’ accounts on WordPress.org — you can make new ones and ad them to your plugin as support reps after all).
This meant I did what I hate doing. I closed their plugins, locked the accounts, and emailed them saying that they were banned for repeat abusive behavior. After all, they’d had *multiple* warnings.
In retrospect, I should have seen this all coming.
## Megs of Logs
At this point I’ve amassed megabytes of logs on this drama. I’ve written up a nearly 30 page document (with citations no less) of everything that’s happened before and since. I thought about listing everything they did ‘wrong’ here but honestly it doesn’t matter if I list out everything. That was all ‘normal’ poor behaviour by developers. People make mistakes, and many times they really just do not grasp how serious things are **even when** the email says “This is your last chance.” Which means I know I have to be the bad guy to tell people “Hey. This ends *now*.”
Now, banning people, especially existing *developers*, is not a common thing! It’s not un-common or rare, but it’s not like I do it every day. Around 4 people a year get banned following a final warning. Usually it’s only one person each year (though due to people being people, it may involve multiple accounts — we still consider that one). More often, people get insta-banned for trying to use the directory for malware. Once in a while someone will be banned without warning for lying about being previously banned, but usually we catch those pretty quickly these days. Even so, it’s not an every month thing, or even an every season occurrence! The majority of people get that final warning and stop and rethink their choices. That’s **normal**.
What was *abnormal* is what happened *after* they were banned.
Between November 21st and the 27th, the Plugins team received over 30 emails. The first few replies were replied to in kind, pointing out that they had their fair chance (and a couple extra) and they squandered it. At that point, emails were not replied to for 24 hours, when they were informed again as to their numerous violations, and asked to stop emailing or their actions would be treated as harassment.
The emails did not stop. **21** more were sent following that caution.
Yes that means over 50 emails in a 6 day span. Probably closer to 100, since we only tracked them by subject rather than by how many replies they got.
On the 24th, they tried to bribe me by sending me money via PayPal (it was refunded and reported — and yes, this is why generally I don’t like when developers send me a donation, though I understand most are not trying this). The message asked me to ‘forgive’ them and rescind the ban. At that point I blocked their email on all my personal systems and went on my merry way.
Instead, they thought “Well she blocked us on one email, let’s use a different one!” and found my old, only used for Google events, account. By the way, none of those personal emails were ever provided to them. It’s not hard to guess what my email on Gmail might be, though.
On November 27th, a threat was made. They emailed saying they prayed to their god to “take away all your name, fame, respect, wealth everything” and more.
## And then it escalated…
Yeah some of you are thinking “Wait, **THEN** it escalated?”
- From November 24th to the end of the year, 77 separate email chains were sent, using 3 separate emails.
- In 2019 there were over **600** separate email chains from 126 separate email addresses.
- 2020? 34 separate email chains.
- 2021? Only 3 email chains, but it’s only February.
So yeah, 2019 was **rough**. My Dad died in the start, and this developer had the gall to say Dad’s death was my fault, as I was being punished by their (the developer’s) god. Yes, that really happened.
I did a lot fewer talks in 2019 because I was coping with the world without my dad, and in 2020 …. well. We *all* took an in-person break, and I took a virtual one as well, because I was tired of prepping myself before talks.
See, every time I would go to a WordCamp, I had to prepare myself. What will I do if they show up? They had made, after all, ‘threats’ to come to California, and they’d already sent physical items to my office. So how would I handle it? The odds of them getting to the United States, given our then administration, seemed unlikely, but what if… What if?
I rehearsed, I practiced not being alone, I made sure at least one trusted person knew why I was nervous. My wife and I talked about strategies. But online? What if he saw something on my backdrop that let him figure out my home? What if he tracked me? What it he did something to put my family in danger? It was all too much to bear, so I simply didn’t.
Somewhat related, my office knew and went way above and beyond what I had any reason to expect to make sure I felt safe there. I love those people.
## So … where are we now?
The developer still emails, on average twice a month now. We’ve sent a cease & desist (which was repudiated) and I’ve spent a lot of time literally ignoring everything that comes in. I do have a list of all the various claims made, and all the email subjects. I stopped tracking the content of the emails in mid 2019 because they were so outlandish that I couldn’t even anymore. I mean, does anyone think Alexandria Ocasio-Cortez cares that someone in another country is angry they got banned from a website?
Effectively? I am *still* being cyberstalked and harassed. And my god, it’s draining.
I sat here, thinking ‘is this even a good idea? It’s just going to make them be bigger annoyances”
After how disastrous 2020 has been? I think it’s right to step up and say “Hey, so this shitshow happens, and people are out there who are going to make it their mission to make you miserable. You’re not alone.”
This is me, walking back into the fire because I’m refusing to let it make me smaller.
## What I want?
It’s super simple. I want it to stop. I want them to accept that they’ve burnt every single bridge a human can burn, short of physically attacking me, and now, **even if** anyone accepted their apology, we cannot unban.
There’s no way to know they won’t start this up again, or use this as the freedom to be a bigger harm to the community. There’s no way to walk back from this level of harassment. And if that means I have to shoulder this to protect everyone else? Well. I’ll do it, but I’ll do it my way, which means I post this. I share to the world “This is a thing.”
And this sucks. I hate telling someone “Buddy, it’s over. You’re done.” But they are. Even if I overstepped or over-reacted, 700 emails, physical packages, cards, threats, accusations of killing people, etc … how do you go back and say “Oops, I was wrong” and expect everything to be okay.
It’s not, because it can’t be. Things don’t just go away and get better because you said you were sorry. I do believe they’re sorry, but I think they’re sorry *because* they got caught and punished. They aren’t sorry they did harm (if they were, they’d have stopped). Right now, they’re at the point where their argument is “We will stop hurting you when you do exactly what we want.”
And that, I simply cannot do. Not just because I’m standing to protect the rest of the WordPress.org users, but for the principle of the thing.
What I want? I want them to **stop** trying to contact me in any way, shape, or form. I want them to accept the (painful) fact that they made a massive mistake and acted in a harmful manner. I want them to be grown ups and walk away.
Sadly, this appears to be something they cannot do.
## It’s totally Burnout
This absolutely is burnout.
I’m socially burned out in a lot of ways. While I had some phenomenal support from WordPress, from my work, from my friends, from professionals, it was exhausting to have to deal with this. Legally? There isn’t much I can really do. The persons involved don’t live in the US, so our laws are not in play here. International harassment laws don’t really exist. There’s nothing the police can do to stop it unless they show up in the US (which is highly unlikely).
At best, I can file complaints (which I have) and block their contacts (ditto). I can also be proactive, look them up, find out everything that’s them, and block them before they contact me (did that). I’ve done a lot more than I list here, by the way. I don’t want to tip my hand.
People have done everything I could possibly expect from them, and more, but … it’s still going on.
And yes, this is part of why [Plugin Team emails went anonymous](http://make.wordpress.org/plugins/2021/01/19/why-the-plugin-emails-are-anonymous/).
It’s absolutely, 100%, burnout.
## And about speaking at events?
I don’t know.
The last two years I just needed a **break** from all that to process how I felt about the situation. I knew I was tired, but that isn’t really how I feel emotionally. The last year was so hard for everyone, so brutal for us all, that having it sit on top of the pain of loss meant I never really got the chance to process. I don’t feel like it’s been two years since Dad died, I feel like it was yesterday.
What I feel is anger and annoyance and a lot of ‘damn it to hell.’ And I am filled with defiance.
Now that there’s a little less stress in my life (and most of ours), and with the hope that people in charge will be held accountable for their seditious actions, I feel like I’m freer to say that this happens. This happened. This is happening.
Soon, hopefully, I’ll feel like I can safely do interviews and talks again.
## Why did I post this on my Tech blog?
The world is angry right now. Everyone’s at their limit for coping, and for most we’re well beyond what our brains can wrap around. Half a million dead in the United States alone? It’s nearly unimaginable. And I think we’re letting our anger get the best of us.
I posted on HalfElf and not my personal me-blog because in tech, we can easily forget there are other people on the screen. I knew, when I banned this person, that I was harming a human. I felt I had run out of other options to get them to understand that they were doing harm to the world in general, and I didn’t want anyone else to get hurt. This is not an excuse, though. I hurt someone. I hate that I did it. I hate that I have to. But there’s literally no way to stop someone from hurting others without hurting them in some way. At least not that I’ve found.
But if I banned someone from a physical location, I could get the cops to do something (in theory, I know). I could get legal help. I could have security escort them from my location and be within my rights.
Online?
We don’t build our tools to handle harassment. We just **don’t**.
If someone harasses you on Twitter, or Facebook, the ‘solution’ is to turn your account private, because these people will just make more and more accounts. We can’t block by IP, because they can use VPNs. We could ban all VPNs, but that has a negative impact (just for an example, I can’t edit Wikipedia when I’m at my office because we have a firewall and VPN).
Looking at WordPress, how would you stop someone from harassing you? You make use of banned terms and plugins, but did you know most *contact form* plugins don’t have block tools? Logically it’s so if someone’s accidentally blocked from commenting, they can get a hold of you. But most don’t even have this as an option.
So I post this here to put a **human face** on the damage being caused by our own negligence, and to make us more aware of the monster we’ve created.
When you write new code, think about how it can be **ab**used. Think about disrupting harassment. Think about allowing people to protect themselves. And, above all, if someone tells you this is going on? Believe them. I was lucky. Everyone believed me. Most people are not.
**Categories:** How It Is
**Tags:** essay, oped
---
### [Stolen GPL](https://halfelf.org/2012/gpl-and-theft/)
**Published:** December 13, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stealing GPL isn't impossible, it happens more often than I'd like, and it could be easily avoided with a simple attribution of effort.
**Content:**
I made a polarizing comment on Twitter back in November, which was perfectly plain to me, but apparently not everyone else.
“GPL means that you can fork, but it doesn’t mean you can steal, and you know damn well what theft is.”
I should have said ‘doesn’t mean you *should* steal, and you know damn well what *that* is’ but the point is close enough. Forking in GPL is not only okay, it’s encouraged. Many of us get our starts forking and improving plugins. But there’s a difference between that and stealing someone’s work and presenting it as our own. That’s stealing, plain and simple. If you fork, you attribute. I have a plugin that started as a fork and ended up 100% re-written in a totally different way, but I *still* credit my original inspiration.
Why?
Because of the community.
Look, per GPL, taking someone’s plugin is not stealing it, in so far as taking the code goes. You have the right to distribute someone else’s code. And I don’t even think that taking someone’s copyright protected work is actually theft. What I do think is that is taking someone else’s work with questionable motives, and rebranding it as your own, is stealing.
Here’s the [GNU’s take on Copyright ‘Theft’](http://www.gnu.org/philosophy/words-to-avoid.html#Theft):
> Copyright apologists often use words like “stolen” and “theft” to refer to copyright infringement. This is spin, but they would like you to take it for objective truth.
>
> Under the US legal system, copyright infringement is not theft. Laws about theft are not applicable to copyright infringement. The copyright apologists are making an appeal to authority—and misrepresenting what authority says.
>
> Unauthorized copying is forbidden by copyright law in many circumstances (not all!), but being forbidden doesn’t make it wrong. In general, laws don’t define right and wrong. Laws, at their best, attempt to implement justice. If the laws (the implementation) don’t fit our ideas of right and wrong (the spec), the laws are what should change.
I agree with their explanation, and think it’s valid, in so far as it goes.
Where it breaks down is the motive, as I mentioned before. If I buy a plugin or theme to use, I’ve bought it for the intended purpose. If I buy it to fork, I’ve bought it for another intended purses. If I buy it to sell as my own, now I’ve walked into asshole territory. Per the GPL, this isn’t theft and it isn’t stealing (again, forking is okay). But when you look at it dead on, you’ve taken someone else’s work, with the intent to profit from their work, without any attribution or credit or compensation.
In any other situation, that would be, clearly, stealing.
Theft is taking someone else’s property without permissions and with the intent to deprive the rightful owner of it. Obviously we’re not depriving the owner of the product when it comes to software, but we are intended to deprive them of the *profits* of their software, by circumventing their established ‘sales’ procedure. This works the other way, too. If I take someone’s free theme/plugin and sell it, I’m stealing from them as well. However. In both cases, if I’m not selling the product, but selling my support of it, I’m not stealing anything.
Stealing is presenting someone else’s works as your own, among other definitions, and taking without right or permission. When it comes to GPL, you have both right and permission to take, that is unquestioned. But again, once you start presenting this as your own, you’ve walked into asshole territory. You didn’t do the work, you didn’t write the code, and you didn’t do anything except copy/paste. That’s not coding. You’re being dishonest, and I feel you’re stealing.
[](https://halfelf.org/wp-content/uploads/sites/2/2012/11/300px-Alexander_cuts_the_Gordian_Knot.jpeg)
It’s morally ambiguous and sticky for me to just say ‘this is stealing’ which is why I have to come back to the intent and motive. Am I doing this for altruistic reasons? Did the developer take a walk and abandon their work, and I’m simply keeping it alive? Did the developer reject my patch so I forked it? Or am I doing this because I resent them charging $85 for a plugin when WordPress is free? If it’s that last one, then I’m a thief, because my motive is to stick it to the other guy.
Separating ‘stealing’ and ‘theft’ is like undoing a Gordian knot. You can do it, but it starts bumping into all sorts of crazy semantics. That’s why, most of the time, we don’t bother. I have a very strong opinion on the subject of code-theft, and always have. I feel that the only way to keep the GPL going is to not only do what’s right, but mean it, and being a good steward of the community, be it WP or Drupal or even Expression Engine, means you have to do what’s right.
The right thing is to thank the guy who came first. Even an ‘Inspired by a snide comment by Ipstenu’ is being a good steward. You’ve encouraged me to do more by taking the time to recognize my effort. With that encouragement, I’ll go on to do more. It’s positive reinforcement at it’s best.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, license, open source
---
### [Email Verification and Unsubscribing](https://halfelf.org/2021/email-verification-and-unsubscribing/)
**Published:** January 27, 2021
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes you want to scream at the phone when you can't do something as simple as close an account.
**Content:**
If you follow me on Twitter (no you probably don’t want to), you know I’ve been dealing with the messy technical side of death for around 2 years now. My father died, unexpectedly, and I picked up his digital life and dropped it on my laptop in order to untangle things. While my father had shared his login information with me before, I did run into a number of technical issues like needing the phone for an SMS confirmation when I logged in from a new location.
Now all that said… Here’s the technical problem a **LOT** of companies created for themselves.
1. They don’t require you to **verify** an email before sending you advertisements
2. Those emails do not have **unsubscribe** links
Yeah, those two things are killing me, smalls.
### Why not delete the account?
Someone’s thinking this…
Because the last time someone emailed it, legit looking for my Dad to tell him something funny/relatable/personal, was December 2020.
Dad was in his 70s. He had a lot of sporadic friends over that time, and sometimes they would randomly think about him and reach out. Many were long-standing friends, some I knew and hadn’t seen since I was in elementary school. He lived in a lot of places. Those people needed to be told he was dead.
Maybe one day I’ll delete his account and his website, but it won’t be any time soon.
## How to Fix This
The good news here is all this is fixable if people start caring about data properly.
See the problem here stems from companies wanting your data. They want it so much that they use any excuse to grab it and never let go. But this is wrong both legally and morally.
It’s not *their* data. It is **YOUR** data, and you should have a right to it. Per the GDPR, UK’s Right of Removal, and even California’s new laws, my data belongs to me, and I have a right (in most cases) to get it off their system. In the case of my dead father? That data is as useful for you as wings on a mongoose. But as his estate’s legal representative, I legally own Dad’s data, which means I should have control.
### Check The Email First
Anyone who’s signed up for anything online lately knows that you have to opt-in to getting ads. That’s just how the world works now. But you also have to **confirm** your email before you can use your account fully.
At the outset, that sounds great, right? It forces people to confirm! The reality though is that by letting people make an account, **with or without verification of the email**, those companies add the email to their mailing lists. That means that when some moron uses my father’s email to ‘test’ (or because they’re some idiot in the midwest who regularly thinks it’s his email even though Dad made it in the 1990s and has used it since then, seriously buddy, stop it), I get the email. And when they correct the email in the account, they retain access and I keep getting emails that I **cannot** unsubscribe from.
We’ll get to the lack of links in a minute.
The obvious thought process here is “People wouldn’t put in the wrong email!” but the reality? They do. They totally do. There’s a guy who bought a Ford, has a credit line, and a loan from a bank, and I know a whole lot about all this **because** he is a total idiot who keeps using the email that was my father’s. Seriously. It’s never been his email. The first owner of the domain was Dad. The second is me. The email he used has been in use, by my father, since March 2, 1995. Not joking.
Now, if you keep along with the (incorrect) thought train, you’d think “Once someone enters their email, I can add it to my mailing lists as I have their consent.” And again, sure. **IF** the email is actually theirs. And what’s happening is all these sites add in your email to their lists **before** they confirm (if they confirm at all) that it’s really your email. This means my poor Dad’s email is not just added to an account, it’s added to **all their lists** as well.
### Let Us Unsubscribe
The other (related) issue is there’s no unsubscribe *link*.
Look, I get it. There are emails that are not unsubscribeable for as long as you have an active account. There are legal reasons why you have to be mailed some things. However all those emails must have a way you can actually close/remove your account. A link would be great, but even an explanation “Hey, we cannot unsubscribe you unless you close your account, here’s how to do that.” would be better than the message from a certain ISP who told me I had to log in to the account… but were unable to provide me with the login info.
In the case of two separate companies, if you do have to legally send out emails to people because they have an active account, you should be including some information like ‘Your account name is X’ or even ‘Your account number is X’ so that we can have a place to start. Instead, I have a bunch of emails that all say they can’t unsubscribe me while I have an active account, please log in …
And what do you think happens when I go to log in? Of course ‘There is no account with this email…’
Which brings me to…
### Let Us Recover Accounts
It needs to be ‘easier’ to recover account. Especially if someone’s dead.
Now, I’m not talking about Facebook’s idiocy on locking people out and requiring them to have someone else verify them, only to send another email that bounces and you can never log in. Although that was certainly fun to do with my Dad’s stuff.
Take a hard look around. People are dying by the thousands per day, and those are not ‘expected’ deaths by any means. This means the number of humans who were unprepared and unorganized are stuck trying to find things like account numbers, and have no clue where to start. If we’re lucky, we can get into their email and change the passwords so we can keep it but…
This is not actually very easy! The only reason I had Dad’s email was because I was his email admin. If I wasn’t, I’d have to have logged in while I was still in Japan, from his laptop, and then hoped beyond reason that I was able to change the passwords without knowing the current one.
Think about that for a second. My father lived in Japan, had a Japanese number. He’s dead, the phone number was closed, and I can’t get it back as I’m not a Japanese resident. Which means the methods to recover are … email. But that isn’t enough for some companies.
My ‘favourite’ is someone telling me that there was no way to know what account used my Dad’s email. Yeah, they had no way to connect an email to any account, and required me to provide a local phone number to call me about it. I blocked their emails because I literally have no other solution. They can’t tell me what email uses the address I own, and they can’t help me except by a local-to-them phone call.
## Summary? Let People Own Their Data
Okay, here’s your summary:
1. Require email *confirmation* in all cases where an account is being made. No verification? No account.
2. Allow people to correct the emails if they can’t verify. If someone put in `stevejobs@appl.com` and forgot that E, they should be able to fix this.
3. Allow people to unsubscribe from all emails with an *easy to find* method. A link, some explanations, whatever. Make it obvious.
4. If people cannot **legally** unsubscribe while having an account, then you need to make it possible to cancel accounts when a user **DO NOT KNOW** the account name. If you’ve verified emails, yo, magic. “I forgot my account name…” — And again, this needs to be easy to find information.
5. If someone sends you a damn death certificate, you should honour it.
This is not going to fix everything, but it would certainly make us hate a couple companies a lot less.
**Categories:** How It Is
**Tags:** customer service, email, registration
---
### [New Math](https://halfelf.org/2014/new-math/)
**Published:** March 5, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Math and learning isn't just rote memorization, but getting that intuitive understanding of how the numbers relate to the formulas. All roads lead to Rome, once you learn to walk.
**Content:**
I’m not a math teacher. I’m not a mathematician. My father, [the risk analyst](http://woody.com), is a mathematician. We used to play math ‘games’ and I thought that was normal. I was also a very odd child. My mother was convinced something was ‘wrong’ with me because I did “Number Roll” all day at school for the better part of a year. To anyone not from a Montessori school, Number Roll is a bewildering concept, where you just write numbers, incrementing by one, over and over and over again, getting the numbers as high as you could go.
Now, I was always (am still) a hands on learner. Being forced to learn *anything* by rote memorization is painful. But math is a little different. You can’t ‘understand’ math until you’ve mastered counting. You can’t grasp all the relationships between quantities and numbers without knowing the numbers first. It’s like you can’t learn spelling until you memorized the ABCs.
Number roll is crazy basic. On long sheets of paper, I wrote each number in order, beginning with “1”. I should stress, my mom worried about my intelligence, that I spent days and weeks and months doing this. But what I was really doing was following patterns without knowing it. I mean, I can do my nine-times tables because I know the ‘pattern’ is Plus Minus. Watch:
```
09
18
27
36
```
That didn’t make any sense to you? Start with 09. Add 1 to the left and subtract one from the right. Now it’s 18. You do this over and over and over again and it works all the way down. This repetition taught me pattern recognition in a different way and gave me insight into both counting *and* the meaning behind it. The nines work like that because 10 – 1 = 9, so then logically I could apply this to everything! This is where number roll was suddenly magical, as the Montessori concept is that **before** children can gain a meaningful understanding of quantities, numbers, and the relationships between them, they need to learn basic counting, but you should understand what counting means.
In other words, math will make more sense if you can see how the numbers fit together.
This is probably why, when I was a kid, I did my multiplication ‘backwards.’ That is, if you asked me to do 123 x 24, I did it left to right. Let me explain. This is how you probably do it:
```
123
x 24
----
492
246
----
2952
```
Right? You start with the bottom right, so you go “4 times 3 is 12, carry the 1, 4 times 2 is 8 plus one is 9, 4 times 1 is 4.” Most people I know would call this ‘traditional’ math. My math goes left to right, so I get this:
```
123
x 24
----
24
48
72
----
2952
```
1 x 24, then 2 x 24, and finally 3 x 24. I can do this fast because I’ve memorized my times tables, but at one point a friend asked me how this was really left to right, because when you look at 3 x 24, you’re back to the old “3 times 4 is 12, carry the 1. 3 times 2 is 6 plus 1 is 7.” Well, when I do *ALL* all the work, it looks like this:
```
123
x 24
----
2000 (100 x 20)
400 (100 x 4)
400 (20 x 20)
80 (20 x 4)
60 (3 x 20)
12 (3 x 4)
----
2952
```
The difference really is I’m breaking apart multiplication into smaller addition steps. And now it makes sense to a lot more people. “100 times 20 is 2000” and so on. Once it’s spread out, it’s easier for someone new to pick up how I did it, and in a sense, why. It’s true left to right, all the way down. I don’t generally do long-form math this way any more, though, because like everyone else I had to learn the ‘real’ way of doing it, but also I started to memorize the patterns. I know without really thinking that 12 times 2 is 48. It’s a common enough equation that I memorized the answer.
That means I can do all this in that even faster way you saw above. I just know that since 1 times anything is itself, the 4 from 24 goes under the one. Sometimes I have to remember to mark my place, if I’m doing less frequently combined numbers (I don’t seem to use 7s times 9s a lot). When that happens, I usually add on the zeros:
```
123
x 24
----
2400
480
72
----
2952
```
When I don’t, to make sure I keep my place, I go far left top to far right bottom, since those two have to line up. That means I know the “1 times 4” answer (4) has to be under the 1, and the “1 times 2” answer (2) is one to the left. But that’s the advantage of understanding how all the numbers work together, and sets. I know how certain numbers combine, I’ve memorized their patterns, and I can apply them backwards and forwards not because I know the equations, but because I see the pattern.
Now on to the rather controversial image I posted recently:
[](https://halfelf.org/2014/new-math/1982284_675817145814580_2016934226_n/)New Math
This shows you two ways to solve a problem. First is the ‘traditional’ way, or as I’ll call it, the fast way:
```
32
- 12
----
20
```
At it’s heart, this is a simple equation. Most of you went “Sure, 3 minus 1 is 2, the 2’s are the same, so 20.” Some of you went “1 plus 2 is 3, so it’s a 2…” Both are correct. Then you get the ‘new’ way:
```
32 - 12 = __
12 + [ 3] = 15
15 + [ 5] = 20
20 + [10] = 30
30 + [ 2] = 32
--------------
20
```
And a bunch of adults just when “LolWHUT!?”
When I saw this math problem, the first thing I did was the same as you “Why 15!? What?” I mean, we’ve all been told “Show your work, don’t pull numbers out of thin air!” Then I thought back to when I was a kid trying to understand this whole math thing. Fives were easy to remember: 5 10 15 20. It’s either a 0 or a 5, and the number in front went up by 1 every 0. We all kind of got that pretty fast. Number Roll (see?) taught me that concept really early on. That was my lightbulb moment.
“OH! We’re adding X to 12 to get to the 5s, then we add Y to get to the tens, then Z to get to the base of 32 (30), and add the leftovers Q. Add up X, Z, Y, and Q, you get 20!”
This is what I would call “the long way” however the thought occurred to me that this was a number roll-less way to try and teach children how numbers came together! [Common Core](http://www.corestandards.org/Math/) (which is where this comes from) is actually sneak-teaching kids algebra, while at the same time giving them a reference for that rote memorization they had earlier. You remember your 5 times tables? This is how we use that information in a practical application!
Part of the difference comes in if you think about subtraction as ‘Something new’ or ‘backwards addition.’ I tend to think of it as backwards addition, and multiplication is ‘Faster addition’ (division is ‘faster backwards addition’). I was fairly young when I realized that all math was really, at it’s heart, the same, it was just the formula you slapped in to make it messy. Everything comes down to adding for me, always. We’re all just playing fast ways to do things and solve problems, and this is starting with the long way first.
All this comes back to what Richard Feynman wrote in the essay New Textbooks for the “New” mathematics:
> If we would like to, we can and do say, ‘The answer is a whole number less than 9 and bigger than 6,’ but we do not have to say, ‘The answer is a member of the set which is the intersection of the set of those numbers which is larger than 6 and the set of numbers which are smaller than 9’ … In the ‘new’ mathematics, then, first there must be freedom of thought; second, we do not want to teach just words; and third, subjects should not be introduced without explaining the purpose or reason, or without giving any way in which the material could be really used to discover something interesting. I don’t think it is worth while teaching such material.
It’s his third point that I believe Common Core is trying to address. How many of you were taught the purpose of your times tables, after all? How many of you understood the reason besides ‘so I can pass the class’ that we learned to think of numbers and how they were put together? A lot of people seem to think that Feynman didn’t like kids to learn the application of math, to understand what it meant, but that’s incorrect. He rallied *against* new math because it lacked word problems and applications of use! Yes, you hated those word problems, but they were meant to teach you application. Instead most people learned how to pick out the important bits and do the math as a simple formula to which they could apply that rote memorization.
There’s a problem with this, though, and Common Core has the same problem that New Math does and that the ‘traditional’ way did back when I was a kid, so this is nothing new. It forces kids to learn in one way, and one way only. I was incredibly lucky in that my father let me do math my own way (he found it interesting), and once I showed my work (see above) he and my teachers saw that I had in fact achieved the absolute goal of number roll: **I internalized the connection between math equations and the numbers**.
Rote memorization has a place. You memorize the tables, you can do math *faster*, and things like calculus will be surprisingly easier to you because all you have to do is put the numbers into the formula. At the same time, some of the other concepts will be a struggle because you don’t get the connections, you only know memorization and implementation.
I will note that once you’ve memorized this stuff, it’s all a lot faster. I tend to count on my fingers when I’m trying to math days of the week (like today is the 5th, so next Wednesday is 12th) because I’m messing with names (Wednesday) and numbers, and then I have to remember how many days are in March, but I can do all this in my head, including calculating tax. And no, I don’t think it’s ‘cheating’ to use a calculator. The point is understanding what the relationships between the numbers are, knowing what formula to apply when and where, and enjoy it.
That was the goal of New Math, you know. To make math something kids wanted to do. You should read Feynman’s “Surely you’re joking, Mr. Feynman!” and follow his account of being on the board to set up these new curriculums, and you’ll see exactly why they continue to fail over and over. It’s a pity, too, since I bet some kids are looking at the Core method and there’s a lightbulb going on over their heads. I hope parents aren’t scaring their own kids off math because the adults don’t understand this new stuff.
Of course, a lot of this is the fault of the school system, in that the parents aren’t taught what the kids are learning or *why*. If you’re learning something at school, and at home your parents go “What? This is bullshit!” you’re going to have a harder time learning and accepting. Don’t believe me? Creationism. You’re welcome. The point being you have to reinforce what a kid learns at school in the home or they have to come to terms with the dichotomy of difference at a stage when they don’t understand enough of the world to get what that meant.
Not that having multiple choices is great for every kid. Some people freak out when there’s more than one right answer, especially in math which in the beginning is remarkably straightforward (like spelling). There’s *one* right answer, but now you’re giving them multiple paths (spelling has this too, by the by: color, colour; grey, gray). It breaks brains. This, perhaps, is a little bit why WordPress is “Decisions, not options.” Maybe we’re giving people the options too soon, but when it comes to learning, we adults should already know there isn’t one ‘right’ way to learn and master skills. And with math, there isn’t going to be one perfect way to get those base concepts into their minds.
**Categories:** How It Works
**Tags:** learning
---
### [Hey, Twitter, Why Do You Hate Us?](https://halfelf.org/2018/hey-twitter-why-do-you-hate-us/)
**Published:** March 1, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Hey, Twitter. Why don't you like people with multiple accounts?
**Content:**
Hi, Twitter.
I know we fight a lot. You know I report a lot of abuse and harassment, and you do nothing about the Nazis, and we have our differences. But this isn’t about that. I mean, yeah, I’m salty about the Russian thing, but we need to talk about something else.
We need to talk about using Twitter on a desktop when you have multiple accounts.
## Multiple Twitter Accounts Happen
I have a legit reason to have multiple accounts. A good one, in fact. I have my personal account, but I have two others for brands I manage. And that means I kind of need to be able to log in to all three at once and wrangle things.
If you use Twitter on the web, your choices are regular Twitter or Tweetdeck. The latter makes you sign up via a very convoluted process in order to grant access to accounts. Basically, you have to give your ‘main’ account access to the ones you want to manage. It’s not very obvious.
And there are weird things missing from Tweetdeck. Like … no decent notifications. You can’t tell what you’ve read or when people @ you or anything like that. Not easily. Oh, and there’s no GIF button.
Finally … with three accounts I get to have NINE columns. Three each for ‘home,’ ‘mentions,’ and ‘messages.’ Thanks. A lot.
## No Great Desktop App
Here’s my problem. There’s no good Twitter desktop app. Your own app went unloved until you pulled the plug. [In a tweet](https://twitter.com/TwitterSupport/status/964635739517407232). Nice. Really nice. That leaves me with a few choices.
**TweetBot**: I like Tweetbot, except that I can’t see polls in it, and I can’t navigate to embed Gifs. But it has a pretty decent interface. The biggest issue is that you can’t see group DMs. Sometimes keep on top breaks. Sometimes not.
**Twitterific**: This is a wonderful app except that scrolling sucks. If you switch to a different account, keep on top stops working, and ⌘↑ (which should take you to the top of whatever you’re on) doesn’t scroll right. Oh and no embedding Gifs. And again, no group DMs and no polls.
What about TweetDeck’s desktop app? It hasn’t been updated since 2015. The best version I’ve seen is **[Tweeten](http://tweetenapp.com)** but again, I’m back to 3 columns per account.
## What I Want Is Simple
I want the iOS app, but for the desktop. I want to have the following features:
1. Multiple Account Support
2. One visual ‘column’ per account (it can have sub tabs, whatever)
3. The ability to insert and read polls
4. Support for multi-person DMs
5. Notifications
6. A damn GIF button
Instead, I get to use Tweetdeck in my browser. At least, until Twitter dumps that too.
**Categories:** How It Is
**Tags:** oped, twitter
---
### [Algolia: Search Faster](https://halfelf.org/2020/algolia-search-faster/)
**Published:** October 12, 2020
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Being driven to dementia by search woes, it's time to embrace insanity and find out what you really need.
**Content:**
**Note:** While this post is about using Algolia, the irony is that shortly after I posted it, I removed Algolia. The reason being, InstantSearch counts as a separate search *per letter used* — that means I was about to skyrocket over my allowance and hit the thousands-a-month. I feel their pricing was quite unclear about this. But hey, now you know!
My friends, it’s been a while. And if you follow my rants on Twitter (this is not a suggestion you should). you saw I faced off with [ElasticSearch](https://halfelf.org/2016/elasicsearch-service/), my nemesis.
Moons ago, I attempted to use it to make a site I run faster by using ElasticSearch. At the time, I struggled with search ranking and all those things. [Then it broke with Jetpack and made my server core-dump.](https://halfelf.org/2016/lesbians-broke-jetpack/) So in 2016 I tossed it in the can and walked away. After all, I didn’t *need* it. WP’s search was sufficient.
Fastforward 4 years and with around 12k posts to search, guess what isn’t so okay anymore?
## What’s Wrong With WordPress Search?
Nothing.
When you search on WordPress, it uses SQL queries to check in and find all instances of ‘a thing’ (whatever it is you searched for). So logically if you have a lot of posts (or a lot of content, be that in the form of a few huge posts or a high number of smaller ones), you’re going to experience slower searches.
Also WordPress’ search isn’t customizable. You can’t tell it “Don’t search page X” or even “Prioritize post titles over content.” This leads to some odd results.
But realistically neither of those issues are ‘wrong.’ Those are broad choices made to support 80% of WordPress users.
This means your question of “What’s wrong with search?” is really “Are there specific cases wherein the default search won’t be the best choice for me?” And those two issues? They’re why. If your site is large (or getting there) and if you need to ‘weigh’ search results to prioritize A over B, then this post is for you.
## Solving The Right Problem
While the first thing you always look at is “What do I need to solve?” by the time you get around to ranting about how WP search sucks, you kind of know where to start. That is, either search is too slow or you need to customize it. Or both.
If you need to customize your search results, I recommend you look at plugins like [Relevanssi](https://wordpress.org/plugins/relevanssi/), which does a great job of handling that. **However** there are two critical flaws for most (if not all) self-hosted plugin solutions. They’re going to make your database **big**. And let’s be clear here, a bigger DB is not going to help your speed issues. It becomes harder to back-up and more fragile. Relevanssi is refreshingly honest about this, warning you that your DB will triple in size, but also making sure you know that [over 50k posts won’t work](https://www.relevanssi.com/knowledge-base/cant-build-index/).
Subsequently, a large site means you need to start looking at *services*. [Algolia](https://www.algolia.com), [Swiftype](https://swiftype.com), [ElasticSearch](https://elastic.co), and [Solr](https://lucene.apache.org/solr/) are all amazing, viable, services. Some have plugins for easy WordPress integration, some do not. Some are open source, some are not. Some let you build your own… Let me just show you:
NameOpen
SourceServiceRoll Your
OwnPluginAlgoliaNoYesNoUnofficialSwitftypeNoYesNoOfficialElasticYesYesYesUnofficialSolrYesNoYesUnofficialYou get the idea. Lots of options. And I did not pick Elastic (who owns Swiftype now, BTW).
You see, Elastic is more than *just* a search. It’s really a whole database of your content. This means you can hook into it to speed up WordPress queries for long/large tables. But … That isn’t my problem. My problem is just search.
## Services are Spendy
I ended up using a service because I was going bonkers. Seriously. The ‘directions’ for both Solr and Elastic are really terrible. They go in with some assumptions that you’ve done similar things (haven’t) and don’t have what I would call an ‘intro doc.’ Solr I got a lot further than Elastic, but WP integration was weird. And Elastic … No.
Installing it was weirdly easy. The problem was I could not find any information about configuring it. People say “You must secure it.” Okay, sure, I can do that… But no one sat and explained why you want the nodes, what they do together, why you want them on separate servers (or even *that* you do) and .. Honestly I wanted to throw my laptop out the window.
It does, mind you, bring up an important note. Search storage and Elastic services are **expensive**. Even Jetpack, who offers a bundled Elasticsearch integration (yes, that’s what [Jetpack Search](https://jetpack.com/support/search/) is) would cost a site with 10,000 posts around $600 a year. Even using Amazon’s Elasticsearch it’s going to run you a lot. How much? Well if you just toss in their defaults and accept the large settings, it’s to the tune of $22 a day. Give or take. Small settings for my site? Around $8 a day.
ElasticPress (whom I do recommend if you’re using Elastic) starts at $79 a month. Jetpack’s new search is free for small sites, but for mine (again, we’re over 10k posts) it would **begin** at $60.
Algolia though … 12k records is about $3 a month. And it’s all search.
## Enter Algolia
The name meaning delights me:
> inability to speak due to mental deficiency or a manifestation of dementia.
Because when you are searching, you often feel like you’re losing your mind and you have a problem. Search is **hard** okay? There’s a reason AltaVista, Lycos, Yahoo, and now Google are important. Searching is crazy weird and hard and sometimes it’s faster to go “lezwatchtv ACTOR NAME” than to search on our site.
That was not good at all.
Algolia is one of the more straightforward setups I’ve had in a while.
1. Register on algolia.com
2. Spin up a new app
3. [Install WP Search with Algolia](https://wordpress.org/plugins/wp-search-with-algolia/)
4. Add in your keys
5. Tell it what to search
6. Tell it if you want auto-complete
7. Tell it if you want a new search-result page
8. Index
9. Done
Oh you know there’s a little more.
## Reducing Records
I decided to make my records smaller. Algolia only cares about the number of records, not the size, as long as each record is under 10k. I have a lot of meta data and a lot of records. If I was to index everything, I’d be around 15k records, which isn’t bad but I really only needed about 12k of them.
One of the odd things the plugin does is that it uses separate indexes for Auto-Complete. So I could store all my searchable posts *and* all my shows, characters, etc etc. Which would make for 50k records, and I didn’t want that. Sure it makes some aspects of search easier, but I knew I could do this a better way.
I started by making a plugin and removing some records:
```
add_filter( 'algolia_should_index_user', 'my_prefix_algolia_never_index' );
add_filter( 'algolia_should_index_term', 'my_prefix_algolia_never_index' );
function 'my_prefix_algolia_never_index'() {
return false;
}
```
This tells the plugin “Never index users or taxonomies” Most of you will want the taxonomies! I don’t, mostly because they don’t impact how people search really. And yes, I did study my logs. No one cares who wrote what for my site, and that’s okay.
## Refining Search Results
Next I needed to make sure that autocomplete (which I use) and the search page both put the right content to the top.
There is one and only one ‘flaw’ with Algolia, and that’s they don’t make it easy to define a ‘perfect’ match. I have a case where I have 5 post types (posts, pages, shows, actors, characters) and there’s crossover. If I search for “One Day at a Time” I get everything that mentions it. Which is not what I wanted. And while the title of the post I wanted to find was the TV show “One Day at a Time”, it was bringing up my blog posts (and the page!) first.
This was solvable because the plugin is amazing. I filtered and told it what attributes to remove:
```
add_filter( 'algolia_post_shared_attributes', 'my_prefix_algolia_attributes', 10, 2 );
add_filter( 'algolia_searchable_post_shared_attributes', 'my_prefix_algolia_attributes', 10, 2 );
function algolia_attributes( array $attributes, WP_Post $post ) {
// Remove things we're not using to make it easier.
$remove_array = array( 'taxonomies_hierarchical', 'post_excerpt', 'post_modified', 'comment_count', 'menu_order', 'taxonomies', 'post_author', 'post_mime_type' );
foreach ( $remove_array as $remove_this ) {
if ( isset( $attributes[ $remove_this ] ) ) {
unset( $attributes[ $remove_this ] );
}
}
return $attributes;
}
```
This ensured I keep my records small enough because I had some math to do.
The `function algolia_attributes()` needed to promote certain posts over others, so I added in a switch using some data I already saved
```
// Add Data for individual ranking
switch ( $post->post_type ) {
case 'post_type_shows':
// Base score on show score + 50
$attributes['score'] = round( get_post_meta( $post->ID, 'lezshows_the_score', true ), 2 );
$attributes['score'] = 50 + (int) $attributes['score'];
break;
case 'post_type_characters':
$attributes['score'] = 150;
break;
case 'post_type_actors':
$attributes['score'] = 150;
break;
default:
$attributes['score'] = 0;
break;
}
```
This *adds* an attribute of ‘score’ based on post type. I could weigh the up or down as I wanted.
Then I went into Algolia’s admin, and this is where the search tool becomes a champ. under Indices -> Configuration, I changed up the Ranking and Sorting:
Their default is: \[“typo”,”geo”,”words”,”filters”,”proximity”,”attribute”,”exact”,”custom”\]
Mine is: \[“exact”,”score”,”post\_title”,”attribute”,”post\_type\_label”,”typo”,”proximity”,”words”, “is\_sticky”, “post\_date”\]
This actually handled 90% of what I needed without any custom tweaks or rules.
## But weight, there’s more!
Those ‘Attributes’ are the searchable parts of the attributes I was messing with in the refinements section. Most of what they’re used for is helping rank and sort the relevant data to make sure Sara Lance is on top. Which she always is. But. I always wanted to make some *related* data show up.
By default, the searchable attributes were title and content. I added in a new attribute called `lwtv_meta` and in it I added more data. When the index is built for a character (say), it adds a list of all the actors who play the character and all the shows they’re on into that meta attribute. Then I added that attribute to the search. This means if you look for “Legends of Tomorrow” you will see our girl Sara Lance.
That has a small side effect though… Where’s the show!?
So I still have some kinks to work out, but the point is that with a couple tweaks and some extra data, I got everything set up in 3 days. Bonus? The plugin came with templates I quickly tweaked to match my theme. And I’m bad at design!
Algolia? Let’s be demented together!
**Categories:** How To
**Tags:** algolia, elasticpress, search
---
### [The Importance of Correct Casting](https://halfelf.org/2020/the-importance-of-correct-casting/)
**Published:** July 21, 2020
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When upgrading to PHP 7.4 makes your plugins throw errors about string offsets and broken arrays, we have to read the notes.
**Content:**
So PHP 7.4 is rolling out, WP is hawking it, and you know your code is fine so you don’t worry. Except you start getting complaints from your users! How on earth could that be!? Your plugin is super small and simple, why would this happen? You manage to get your hands on the error messages and it’s weird:
```
NOTICE: PHP message: PHP Warning: Illegal string offset 'TERM' in /wp-content/plugins/foobar/search-form.php on line 146
NOTICE: PHP message: PHP Warning: ksort() expects parameter 1 to be array, string given in /wp-content/plugins/foobar/search-form.php on line 151
NOTICE: PHP message: PHP Warning: Invalid argument supplied for foreach() in /wp-content/plugins/foobar/search-form.php on line 153
NOTICE: PHP message: PHP Warning: session_start(): Cannot start session when headers already sent in /wp-content/plugins/foobar/config.php on line 12
```
But that doesn’t make any sense because your code is pretty straight forward:
```
[...]
$name_array = '';
if( !empty( $term_children )){
foreach ( $term_children as $child ) {
$term = get_term_by( 'id', $child, $taxonomy );
$name_array[ $term->name ]= $child;
}
if( !empty( $name_array ) ){
ksort( $name_array );
foreach( $name_array as $key => $value ) {
[...]
```
Why would this be a problem?
## Error 1: Illegal string offset
The first error we see is this:
`Illegal string offset 'TERM' in /wp-content/plugins/foobar/search-form.php on line 146`
We’re clearly trying to save things into an array, but the string offset actually means you’re trying to use a **string** as an array.
An example of how we might force this error is as follows:
```
$fruits_basket = array(
'persimmons' => 1,
'oranges' => 5,
'plums' => 0,
);
echo $fruits_basket['persimmons']; // echoes 1
$fruits_basket = "a string";
echo $fruits_basket['persimmons']; // illegal string offset error
$fruits_basket['peaches'] = 2; // this will also throw the same error in your logs
```
Simply, you cannot treat a string as an array. Makes sense, right? The second example (peaches) fails because you had re-set `$fruits_basket` to a string, and once it’s that, you have to re-declare it as an array.
But with our error, we can see line 146 is `$name_array[ $term->name ]= $child;` and that should be an array, right?
Well. Yes, **provided** `$name_array` is an array. Hold on to that. Let’s look at error 2.
## Error 2: ksort expects an array
The second error is that the function wanted an array and got a string:
`NOTICE: PHP message: PHP Warning: ksort() expects parameter 1 to be array, string given in /wp-content/plugins/foobar/search-form.php on line 151`
We use `ksort()` to sort the order of an array and here it’s clearly telling us “Buddy, `$name_array` isn’t an array!” Now, one fix here would be to edit line 149 to be this:
```
if( !empty( $name_array ) && is_array( $name_array ) ){
```
That makes sure it doesn’t try to do array tricks on a non-array, but the question is … why is that not an array to begin with? Hold on to that again, we want to look at the next problem…
## Error 3: Invalid argument
Now that we’ve seen the other two, you probably know what’s coming here:
`NOTICE: PHP message: PHP Warning: Invalid argument supplied for foreach() in /wp-content/plugins/foobar/search-form.php on line 153`
This is `foreach()` telling us that the argument you passed isn’t an array. Again.
## What Isn’t An Array?
We’re forcing the variable `$name_array` to be an array on line 146. Or at least we thought we were.
From experience, using `$name_array[KEY] = ITEM;` was just fine from PHP 5.4 up through 7.3, but as soon as I updated a site to 7.4, I got that same error all over.
The issue was resolved by changing line 141 to this: `$name_array = array();`
Instead of defaulting `$name_array` as empty with`''`, I used the empty `array()` which makes it an array.
An alternative is this: `$name_array = (array) '';`
This casts the variable as an array. Since the array is meant to be empty here, it’s not really an issue either way.
## Backward Incompatibility
Where did I learn this? I read the PHP 7.4 migration notes, and found it in the [backward incompatibility section](https://www.php.net/manual/en/migration74.incompatible.php).
> **Array-style access of non-arrays**
>
> Trying to use values of type [null](https://www.php.net/manual/en/language.types.null.php), [bool](https://www.php.net/manual/en/language.types.boolean.php), [int](https://www.php.net/manual/en/language.types.integer.php), [float](https://www.php.net/manual/en/language.types.float.php) or [resource](https://www.php.net/manual/en/language.types.resource.php) as an array (such as `$null["key"]`) will now generate a notice.
The lesson here is that PHP 7.4 is finally behaving in a strict fashion, which regards to data types. Whenever a non-array variable is being used like an array, you get an error because you didn’t say “Mother May I…” it was an array.
Whew.
Now to be fair, this was a warning previously, but a lot of us (hi) missed it.
So. Since WordPress is pushing PHP 7.4, go check all your plugins and themes for that and clean it up. Declare an array or break.
Oh and that last error? Headers already sent? Went away as soon as we fixed the variable.
**Categories:** How To
**Tags:** array, debug, php, string
---
### [Shlinky Dinks](https://halfelf.org/2020/shlinky-dinks/)
**Published:** June 23, 2020
**Author:** Ipstenu (Mika Epstein)
**Content:**
For a number of reasons it was time to move on to new things. I was looking for a better, more modern solution to running my own short URLs.
There are a lot of reasons people want these. When I started with them, it was because Twitter had limits and I wanted to control my tweets and short URLs. But then time moved on, Twitter decided to meh, not care about URL length, which meant I didn’t really need the extra weight.
But I had a reason to keep mine around, and that’s WordCamps. 99.999% of the use of have for short URLs is to link people to things for WordCamps, like my slides but also related links that otherwise would be too long for anyone to write down in a reasonable time frame.
And while I’d been using the same old, functional, system, it had quirks that had long since frustrated me, including not being a modern design. I felt like I was stepping back into the early 2000s, and yes, that UX matters to me.
## Enter Shlink.io
After experimenting around, I found [Shlink.io](https://shlink.io/), a GDPR (yes!) friendly self-hosted URL shortener that is a little more tech, but a lot more smooth. It has a full blown API, a deep command line, and an (optional) admin that is, well, nifty.
Features include:
- Custom short URLs
- Multiple Domains
- QR Codes
- Tags
- Robust stats
- Validates URLs before linking
It’s not a set-and-forget install, to be sure, and each server is going to have some quirks, but overall I’m happy with it already.
## What’s Missing
There’s no WordPress plugin. Yet. I suspect this will happen once people realize the API is so freaking crazy.
There’s no way to import everything from another service, but I did a fast export of my DB and then grep’d and search/replaced so I could run commands like this:
```
php bin/cli short-url:generate -c SHORT https://example.com/
```
Done and done. Imported a few thousand URLs. I will note that most of those links don’t matter, since nearly no one hit them, but I’m just a stickler for old URLs continuing to work. Most of the time. I went back through all the failed import and found I had old links to things like test sites.
Also the admin backend is an add-on (or non-hosted but I’m neurotic). I installed the [web client](https://github.com/shlinkio/shlink-web-client) at a subdomain and then used the configurator to allow passwordless logins. No, I didn’t *leave* it unprotected! I went old school:
```
#Protect Directory
AuthName "Dialog prompt"
AuthType Basic
AuthUserFile /home/ipstenu/example.com/admin/.htpasswd
Require valid-user
SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "sub.example.com"
ErrorDocument 403 https://example.com
Order Allow,Deny
Deny from all
```
## What Was Messy
The GeoLiteDB stuff was weird. It took me a while to realize I was running out of space in `tmp` and that was blocking me from doing anything. Since I host this VPS on DreamHost at the moment, and I work there, I went and set `tmp` to disk instead of memory and that magically worked.
Now. Would I like the admin stuff to be built in and easier to manage? Of course. And would I like ‘better’ security when I use the server.json file (like maybe telling people to protect it and hide their API keys, hey) but I’ve [properly opened up a ticket](https://github.com/shlinkio/shlink-web-client/issues/286) for them on that one.
## End Result?
I like it. So I’m using Shlinks now and there you go.
**Categories:** How It Is
**Tags:** coding, open source
---
### [Critical Math](https://halfelf.org/2020/critical-math/)
**Published:** June 16, 2020
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Never tell me the odds, give me an hour and a lot of paper and I'll figure them out.
**Content:**
In this downtime of little new TV and a need to distract once in a while, I proposed we watch all of S1 [*Critical Role*](http://critrole.com/) (which I really only half ass watched until Percy died and came back). So on Thursday at late Saturday nights we watch old-school Critical Role. Sometimes we sneak in another episode but basically we’ve been grinding through.
The other day we got to Omens and had to pause while we argued about math.
We’d hit a point where Matthew Mercer was rolling for an absent Ashley Johnson. She was the cleric and he rolled her healing spell which restores people for 4D8+5 hit points. Matt got a total of 20.
“Oh,” says my wife, disappointed. “Below average.”
I mused aloud, “I know the average of 2D6 is 7, but I forget the math.”
This led to an old argument about the law of averages and statistics, which is to say there is a one in eight chance of rolling an eight (8) on any given roll of a 1D8. No matter how many times people say the dice are good or bad, you have the same chance every time. Flipping a coin 100 times will give you roughly 50 heads and 50 tails. Over time, the wiggliness of Xeno’s Paradox will keep the numbers from a true 50-50,but the point remains you will **always** have a 50% chance of tossing a heads or a tails.
Related to this, though, are the odds of two heads in a row. The problem with the math is a combination of fairness and a concept known as “the Gambler’s Fallacy.” It’s also called “the Monte Carlo Fallacy” because of the time it happened at Monte Carlo. See if the odds of a heads is 1 in 2, then the odds of heads twice in a row is 1 in 4. Three in a row is 1 in 8, because you double it on down. Four in a row is 1/16, and five is 1/32, and this goes on.
And this confuses people because even if the odds of flipping a coin to heads 20 times in a row is 1 in 1,048,576, this does not change that the odds of flipping heads for #21 is **both** one in 2 **and** 1 in 2,097,152. To bake your noodle a little more, if you’ve flipped a coin 20 times for heads, the odds of flipping the 21st to be tails is … also 2,097,152.
This is because we’re looking at two different things here. The probability of a heads or a tails will always and forever be 50%. Period. The odds of rolling a Natural 20 on 1D20 will always be 1/20th (5% for those wondering). Those will never change. This is Bayes’ theorem in action.
We all get screwed up about this because we believe that fairness (i.e. the permanent 50%-ness of the toss) means that previous failures (or successes) will change the probability of the next toss. It won’t.
Let’s say we’re rolling 1D20 and it’s a fair roller. Our goal is to get a 20 and the probability of that is 5%.
But what about the odds of rolling a 20 at least once in 20 rolls? Well that’s 64%.
There’s a 95% chance of *not* rolling a 20 (or any other given number) but again that doesn’t change. Every roll you have a 95% chance of not rolling a 20 and a 5% chance of rolling a 1 or a 20 (unless you’re Wil Wheaton or Taliesin Jaffe). But this makes us ask another question. If there’s a 64% chance of a critical success (i.e. a 20) in 20 rolls of 1D20, does that change if my first roll is a non-20?
Kind of. It’s 62%.
Yes, it went down. Why? Because you have **fewer** chances to win! So the odds of a critical drop every time you roll a non-critical. And frankly this explains half of Wil Wheaton — he’s rolled so many non-critical, the odds are astronomical for him to actually roll one. On the other hand, his capacity for rolling 1s makes him the Joe DiMaggio of Failure for D&D. Sorry, Wil.
This is exactly the same kind of argument my father made back in 2016 (see [Hot Hands And Playoffs](https://halfelf.org/2016/hot-hands-playoffs/) from 2016). And I came to the same conclusion. Wheaton and Jaffe are what we call outliers.
An Aside: For anyone who’s confused, Wil Wheaton (yes Wesley Crusher from Star Trek, also a great writer, a gamer, and a generally amazing human) plays D&D. He has an incredibly capacity to fail his rolls, to the point that a term was coined: [Wheatoning](https://www.critrolestats.com/blog/the-odds-of-wheatoning) (see also [the math on Wheatoning](https://www.critrolestats.com/blog/the-odds-of-wheatoning)). Opposite this is Taliesin Jaffe (an actor, director, voice actor, an all around cool guy) who has a bizarre talent at successes. At least, he did as Percy in Series 1 of Critical Role, with a dice called “The Golden Snitch.” This die was later stolen. Long story. Taliesin still rolls crazy high, so most Critical Role fans see them as the opposite ends of the spectrum.
Whew. Okay that was a lot of math to tell you that while people want to think “If I roll a non-20 10 times in a row, the odds go UP for my next roll to be a 20!” and the truth is that the odds go **down**. There is no universal mathematical law of fairness, just of averages.
Back to the Critical Role episode in question. So Mercer rolled a 20 for 4D8+5. That’s pretty normal for Ashley Johnson (she has a tendency to roll below average, but not to the point that you think she’s cursed like poor Wheaton). At the time, I couldn’t remember the math, but I remembered the experiment, which was that the majority of the faces on a d6 add up to 7.
You may be thinking “Mika, there are only three: 6 + 1, 5 + 2, 4 + 3.” and that’s *true* but it’s actually 6 because the inverses are true. But ask yourself how many *possibilities* are there with 2D6? There are 11. (2 through 12, you can’t roll a 1 on two dice). And 3 of the 11 are a seven so that’s 27% odds of a 7?
No. It’s 16%. Again we’re talking about frequency versus probability. There are 11 possible outcomes, but there are **36** possible variants. You always have six chances to get a 7, one to get a 2, and one to get a 12. This means that to get the probability (i.e. the odds) of rolling a 7, you have to take the frequency of getting a 7 (again, that’s 6) and divide it by the total number of frequencies (36). And 6/36 is 16.67%.
Here’s a table to help:
**Dice Roll****Frequency****Probability**212.8%325.6%438.3%5411.1%6513.9%7616.7%8513.9%9411.1%1038.3%1125.6%1212.8%It’s annoying to think that you always have two sets of probabilities, but if it helps we’re talking about *likelihood* versus probability. The likelihood of rolling a 7 on 2D6 is 16.8% (rounding up). The probability is 1 in 11. With one die, it’s always a flat sameness (likelihood of rolling a 20 is 1 in 20, so is the probability).
We’ve gone around a bit. I know. Here’s the fun stuff. Before arguing math stuff, my wife says “Oh just add up the opposite sides of a die.”
In my defence I never looked.
A quick check on this and we learned some really hilarious factoids:
1. She’s right (12+1 = 13 and 2d12 is in fact average 13).
2. This works because the math is “highest number on the die plus the lowest number equals the average of two dice of the same face.”
3. On *standard* dice the 1 and the high number are opposite (6 and 1, 8 and 1, etc).
4. All the opposite sides add up to the average.
5. On a D10 this breaks because the 0 is opposite a 9, which is technically highest and lowest, but they add up to 9 (or 19, D10s are weird). The average is 11.
6. One of my D8s is misprinted and has 8 opposite 7. It was the first one we checked..
Of course the first die we checked happened to be the misprint. The purple die in the photo below is buck wild and all wrong.
This is the only die in that set (in fact, of all our regularly used dice) that has been misprinted. And while *technically* the change in weight (different numbers are different sizes and have a different amount of paint on each bit) means the die rolls wrong, it’s not statically significant for me to worry much. Dice have a standard set so that numbers can be trusted. Also it makes math easier for people. The average of 2D20 is \*drumroll\* 21.
Let’s go back to Ashley Johnson. Mercer rolled a 20 on 4D8+5. Is that below average? Oh yes it is.
The average of 4D8 is 18 because 2D8 = 8 + 1 – 9 times 2 is 18. Add 5 and the new average becomes 23. a 20 is 3 points under. But at least you can’t roll under a 9!
## Bonus Section
The wonderful thing about Math is you can see parallels. Once you know 2D6 is 7, you can start to jump. 4D16 is 14 and so on. But… what does ‘6 + 1’ mean. How would you get there?
Me I look for patterns. 6 is the maximum of one die. One is one-half the number of dice rolled. Then it stands to reason that 4D6 is going to be 6 plus something with 4, right? 6 plus 8 is 14, so is that our pattern? No because going back one means “6 plus 2 is 8” and that isn’t seven. So how did we get the one? One is one half the number of dice…
DiceAverageMax + DiceMax + 1/2 Dice2D676 + 2 = 86 + 1 = 74D6146 + 8 = 146 + 2 = 86D6216 + 6 = 186 + 3 = 9None of those are right but … Do you see the patterns?
First the average starts at 7 and you add 7 for every 2 dice you add.
We need to add something to a six, but it has to factor in with the number of dice. So how do we get to that one again? We know that the only way to make a one out of the first example (2D6) is to divide the dice by 2. For 2D6 we’re adding 2, which means what plus 2 gets to 14? A 12. And what is 12 divided by 6? A 2…
Hang on then. We have a possible pattern!
`( maximum score of one die * half the dice rolled ) + ( half number of dice rolled )`
DiceAverage( Max \* 1/2 Dice ) + ( 1/2 Dice)2D67( 6 \* 1 ) + ( 2 / 2 ) = 6 + 1 = 74D614( 6 \* 2 ) + ( 4 / 2 ) = 12 + 2 = 146D621( 6 \* 3 ) + ( 6 / 2 ) = 18 + 3 = 218D628( 6 \* 4 ) + ( 8 / 2 ) = 24 + 4 = 2810D635( 6 \* 5 ) + ( 10 / 2 ) = 30 + 5 = 35Bingo baby! We have our pattern! But does this work for odd numbers? It must for the formula to be correct…
DiceAverageForumula1D67( 6 \* .5 ) + ( 1 / 2 )3D610.5( 6 \* 1.5 ) + ( 3 / 2 )5D617.5( 6 \* 2.5 ) + ( 5 / 2 )7D624.5( 6 \* 3.5 ) + ( 7 / 2 )9D631.5( 6 \* 4.5 ) + ( 9 / 2 )Yep, the math keeps working!
And this, friends, is how you reverse engineer a formula.
**Categories:** How It Works
**Tags:** averages, dice, dnd, math, probabilities, statistics
---
### [How the WordPress Upgrade Works](https://halfelf.org/2011/how-the-wordpress-upgrade-works/)
**Published:** January 5, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Every time WordPress upgrades, someone is going to bitch that WordPress 'deleted' their stuff. Guess what? It can't.
**Content:**
*Edited: This post was linked to by the folks at [WTC](http://weblogtoolscollection.com/archives/2011/01/08/how-do-wordpress-upgrades-work/), so I’m getting a lot more traffic! If you asked a question, I will try to answer it promptly, but if you need serious help fixing a problem, please consider posting in the [WordPress forums](http://wordpress.org/support/) for help.*
I was 90% sure about this before I started writing the post, and [Andrew Nacin](http://andrewnacin.com/) was nice enough to tweet me the exact file I needed to look at, so when I got home to look, I was ready to go!
There are two kinds of automated upgrades for WordPress. The main ‘core’ upgrader and then the ‘child’ upgrades used for themes and plugins. They behave differently.
Most of the time, we all see the plugin and theme installer, where it downloads the plugin to `/wp-content/upgrade/`, extracts the plugin, *deletes* the old one, and copies up the new one. Since this is used more often than the core updater (most of the time), it’s the sort of upgrade we’re all used to and familiar with. And we think ‘WordPress deletes before upgrading, sure.’ This makes sense. After all, you want to make sure to clean out the old files, especially the ones that aren’t used anymore.
This **is not** how a core update works.
WordPress core updates, the ones to take you from 3.0.3 to 3.0.4, do not run a blanket delete. They don’t even run a variable delete. They don’t even run a wild-card delete on files in `wp-admin` (which they could). Instead they have a manually created list of files to delete, files that have been deprecated, and delete *only* those files. Here’s a snippet of what it deletes:
```
$_old_files = array(
'wp-admin/bookmarklet.php',
'wp-admin/css/upload.css',
[...]
// MU
'wp-admin/wpmu-admin.php',
'wp-admin/wpmu-blogs.php',
[...]
// 3.1
'wp-includes/js/tinymce/blank.htm',
'wp-includes/js/tinymce/plugins/safari',
[...]
'wp-admin/images/visit-site-button-grad.gif'
);
```
As you can see, the files and folders are all very carefully specified. They are not ac-hoc, they are all determined based on what WordPress has removed. If you read the whole thing, the part that would impress you the most is, perhaps, the folder `wp-content`, where your themes and plugins are installed, is nowhere on that list. Don’t believe me? Go look at `wp-admin/includes/update-core.php` and search for it. It’s not not there!
Once the old files are listed, remember that we have not deleted anything, the upgrader runs through 9 steps.
1. Download the zip file of the new release, unzip it and delete the zip
2. Make sure the file unzipped!
3. Make a .maintenance file in WordPress base (this makes your blog ‘down for maintenance’ so no one can do anything and screw you up mid-stream
4. Copy *over* the new files. This is a straight copy/replace. Not delete.
5. Upgrade the database. This may or may not happen.
6. Delete the unzipped file
7. Delete the .maintenance file
8. Remove the OLD files. This is where it goes through the list of deprecated and unused files and deletes them.
9. Turn off the flag that tells you to upgrade every time you’re in wp-admin
Nowhere in there is wp-content and your themes mentioned.
Well, except in this one weird way.
See, in order for WordPress to work out of the box, a theme *must* be included, right? WordPress has the default theme of **Twenty Ten**. Now, I’ve mentioned before that you should never update your themes directly, and instead make [child themes](https://halfelf.org/2010/child-themes-learn-them-love-them/). This is why. When the WordPress core files update the *copy* over *everything*. Included in everything are two plugins (Akismet, Hello Dolly) and one theme (Twenty Ten).
Normally this isn’t a problem. Sure, someone always edits those files directly and lives to regret it, but they do live. This last cycle, with 3.0.4, Akismet was accidentally rolled back from 2.5.1 to 2.4. Again, normally? Not a problem. We just upgrade our Akismet installs, remark on the silliness and annoyance, and move on. The problem for one user is she had another plugin or theme edit that hooked into the new Akismet. With the way WordPress updates core, it only deletes the files it knows to delete (and Akismet isn’t any of them) and it copies over the ‘new’ files. Or in this case, the old ones. Which broke her site. Her fix? Just re-update Akismet manually. Not a big deal and an easy fix. (Personally I think NOT updating core, even a security upgrade, with the latest Akismet is a poor choice, but the rational is that they want to keep it small and easy to maintain. So okay, I get why, I just don’t like it. I will support that as their choice, and continue to do my manual upgrades, which include deleting Akismet, Hello Dolly and Twenty Ten before I upgrade.)
So then, why doesn’t this work 100% of the time? (Yes, I mentioned this before in the 3.0.1 days, but apparently it bears repeating. Read [Why doesn’t the WordPress Auto-Upgrade Work?](https://halfelf.org/2010/why-doesnt-the-wordpress-auto-upgrade-work/) for more thoughts on the subject.) Well, to start with, that’s impossible. *Nothing* works 100% of the time. Me submitting this post won’t work 100% of the time. You safely walking up the stairs won’t work 100% of the time. This is just how the world works. There are, simply, far too many variables out there to allow this. Even though I make part of my living ensuring that I have an automated process run in a repeatable fashion, I tell people that I only ask for a 75-80% success ratio on the process before I’ll agree to automate it. Why? Because that’s actually phenomenal.
If you take into consideration all the moving parts, variables, and possibilities that goes into any one individual WordPress install, it’s sort of impressive this stuff works at all. In baseball, if you hit a ball and get on base 33% of the time, you’re considered a fantastic hitter. If you do it 40% of the time, you’re pretty much promised a slot in Cooperstown. Whenever I try and sort out if something is worth the risk, I quote my father “What can go wrong? How likely is it? What are the consequences?” It boils down to an understanding of risk analysis, and what that actually means. The problem is that most of the people using WordPress are *users*. They’re not generally expected to think about risk. Not that many don’t, but just that Joe Blogger doesn’t tend to look at an upgrade as a ‘risk.’ After all, WordPress tested this, so it should be easy.
Most of the time, it is. And when it’s not, it was an acceptable risk. All those horrible and terrifying outcomes you read about (from a very vocal minority) are gut-wrenching when they happen to you, don’t get me wrong, but at the end of the day, you have to ask ‘If I use the default WordPress theme and no plugins, do they happen?’ If the answer is no, then WordPress has done all the testing that is required. The onus is not on WordPress to test every upgrade with every theme and plugin. That responsibility is firmly on the shoulders of the person *using* the themes and plugins. A good developer tests their plugins and themes the moment a release candidate comes out for a new version of WordPress, and sorts out how best to support both the current users and the future ones.
It’s what we call ‘acceptable’ risks. You take them all the time. You took an acceptable risk brushing your teeth. You take one every time you walk out your door. You know the risks and you accept them. So when you get to arguing that ‘WordPress upgrades always break’ or ‘I hate upgrading because it means my themes/plugins won’t work’ and using these as reasons to show that WordPress is bad software, then I think you’re missing the point. The more you customize, the more things break. This is something I mentioned in [When To Code](https://halfelf.org/2010/when-to-code/), and it bears repeating. The more you customize, the more things will break when you upgrade.
But this is an *acceptable risk* for most of us!
So when the WordPress auto-upgrade breaks, and I promise you, it will for you at least once in your experience, you have to learn to accept this. It’s not going to work on every server, it’s not going to work on every host. Your server is being constantly upgraded and tweaked. Security patches for PHP, FTP and everything else are applied, most of the time automatically so you don’t have to waste time thinking about it. And when you combine all those things, yeah, it’s going to break.
This isn’t meant to scare you off of upgrading, but an attempt to raise your awareness of what’s going on, so when things break (and they will), you have a better understanding of why, and what to do. If the automated upgrade of WordPress breaks, upgrade manually. If every single automated install (upgrades, plugins, themes) always breaks, then start to diagnose your server. But if it’s a one off, just do it manually. It is, literally, copying files up to your server. If that’s too hard for you, you may not want to run your own, self-managed, WordPress install.
As a blanket reminder, in order to prepare yourself for an upgrade, always make backups of your database and your files. A good backup. Never edit core files (even themes) and always remember that the computer is out to get you.
**Categories:** How It Works
**Tags:** wordpress
---
### [Bummer Of A Birthmark, Hal](https://halfelf.org/2019/bummer-of-a-birthmark-hal/)
**Published:** December 31, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Just because you're the bad guy doesn't mean the other person is a hero.
**Content:**
I gave a talk in 2019 at WordCamp NYC about what happens when you’re the target. Anyone in any form of a ‘leadership’ or visible role of authority in any community has had a bad day where they woke up and found out everyone hates them.
Not that they’re actually doing anything wrong, but people are targeting them for perceived slights. Regardless of right or wrong, all anyone wants is for their phone to stop pinging, their email to calm down, those Facerange and Twooter groups to stop attacking, and maybe everyone could have a beer.
I have absolutely been there before. For the last decade I’ve worked with the support forums and plugin review teams in myriad roles, including representing those teams to the community. I’ve had a lot of bad days. The good news is I’ve learned that **are** things you can do to protect yourself and to alleviate the problems.
## It Is/Isn’t Your Fault
If you’ve been in any sort of leadership or front-facing role, you’ve probably gotten this at least once. Someone has a bad day, maybe they got banned, maybe they got fired, maybe they just failed on their own. Whatever the reason, it’s YOUR fault. They shouted at you, they screamed in person perhaps, and they left you shaking and a little scared about what the heck was going on and what do you do?
Before I jump into how to protect yourself, which will be the majority of this talk, I want to stress something. No matter what, these situations are not ever *entirely* your fault. Any time something like this happens, it’s from a breakdown in communication, and that speaks to both sides.
However. You do have to take some responsibility here for your own actions. If you don’t, you’ll find yourself here again and again, over and over, and that’s really stressful. So when these things happens, yes, reflect on what you did, but also keep in mind you didn’t do this alone.
Regardless of fault, you have a right to protect yourself. This isn’t an inalienable right. This isn’t a law. This is my firm belief that you have a *right* to take measures to protect yourself from people who have gone crazy on you. It doesn’t matter if it’s your fault or not, it matters that you should protect yourself.
## What Happened?
In order to understand how to protect yourself, you need to be aware of what you did. That’s why I said it’s your fault. You did, or you were *perceived* to have done, something. Keep a hold of that word, **perceived**, because it matters a great deal. If people think you did a thing, it has the same net effect on their actions, but drastically changes your emotions.
More than once I’ve woken up to my Twitter mentions and emails filled with people losing their minds about how evil I am. In 2018 it was all about Gutenberg. To be clear, I was accused of deleting bad reviews on the Gutenberg plugin. Since I hadn’t been doing that, it took a lot of stress and reading to figure out why the mob was actually mad at me. In one case, it was a developer who tweeted, at-ing me, complaining it was unfair that Gutenberg had reviews removed, but he couldn’t get his one-star’s removed. That one tweet, for some reason, infuriated the masses and I had DMs and @-messages *demanding* I explain myself.
I had to ask myself “Did I **actually** do this?” Did I actually delete reviews in a way that could cause this reaction? This was false and I knew it, because I had not deleted a single review about Gutenberg. However due to my *history* as a forum moderator, the finger was pointed at me. Here, what I had done was act as a moderator of some renown at some point in my past.
Now that I knew what was going on and where it started and that I didn’t do anything, I had to uncover what actually happened. I’m still a forum admin, so I logged in and looked at the posts and I could see who had moderated what. And then I *privately* pinged those people and asked for details. In talking to the other moderators, I determined that the removal of Gutenberg reviews were valid. The 1-stars were made by sock puppets, which is to say fake accounts made by people to unethically alter a star rating. It happens a lot.
## Now What?
Okay great, now what? Now it’s time to take action and decide what to do about these people. You have two options though. You can respond to them or … not. They both have a lot of pros and cons, but there is one universal truth you need to know going in: **Whatever you chose, to reply or not, you will be wrong.**
There is absolutely **no way** to ‘win’ or even come out ahead here. You just can’t. If you reply, people will hate your answers. If you don’t, people will claim it’s proof. There’s no safe course here. So you need to make sure you understand **why** you’re doing this.
Why You ReplyWhy You *Don’t* ReplyReply if you want to have your say in the matter. That’s it. It doesn’t matter if you’re right or wrong, or if you’re apologizing or not. You’re trying to have your chance to talk. By replying you’re opening up the doors for a discussion. Don’t pick this option if you don’t want to talk to people!Don’t reply if you know it’s a muggs game and you’ll just waste time arguing with people who’ve made up their minds about you. Not replying feels like a safer choice, except it eats at you so much. You’re going to hear people rip into you over and over, and you will have to stick to your guns and not reply.And if you’re still not decided, remember that sometimes you ***can’t*** reply. That usually happens when you’re aware of a bigger issue that’s preventing public disclosure, or you’ve signed an NDA, or your company asked you not to… Those are really hard because you absolutely cannot engage with people when this happens. You have to suck it up.
There’s one middle road here. You apologize. This is really hard, though, because no matter how you do it, someone will grab on your word choices and use them as proof one way or the other. Usually it’ll be how they prove you’re terrible.
> It is a good rule in life never to apologize. The right sort of people do not want apologies, and the wrong sort take a mean advantage of them.
>
> P.G. Wodehouse, [The Man Upstairs and Other Stories](https://www.goodreads.com/work/quotes/2725977)
## How to Apologize
I have three rules for how to apologize. Those three rules have served me well, because it reminds me to level-set that no matter what I say, I’m not going to come out ‘ahead’, and I should expect nothing at all in return.
1. Be respectful
2. Be sincere
3. Expect nothing
There are some things you can be mindful of. Don’t use ‘if’ statements, like “I’m sorry **IF** this hurt you…” Take ownership of the consequences, regardless of your original intent. It doesn’t matter why a thing happened, it matters that you actually apologize for **what** happened. You can use “But”, just be mindful that it’s not for making an excuse.
You still should consider an apology when you’re **not** the reason for the drama. However this gives you a little room, because now you **can** use those weasel works. “I’m sorry you feel this way.” Notice the **feel** part? That should normally be avoided. Here, we want to use it because it’s actually the only thing you can claim auspice over. You acknowledge their emotions as valid. Which they are.
The follow up to that is you need send them to the right people. “I’m sorry you feel this way. You should talk to X about that. Here’s how…” This is **not** the equivalent of sending someone to your manager, you’re just getting them to the right people. Oh, but be a mensch and tell the other person what’s incoming.
And remember: **forgiveness is not the point**
I know this is hard to swallow. When you apologize, you **never** do it in order to **be** forgiven. Never. Ever.. If you are, then you’re going about it all wrong. You apologize **because you hurt someone**. It doesn’t matter if you meant to or not, and it doesn’t matter if you can fix it or not. It matters that **someone is hurt**, and you did it. It’s up to them to forgive you if they want to, but you owe them a sincere apology.
And just so we’re clear, I’ve screwed this up too. Just as recently as last spring. It’s going to happen. No one is perfect. Try not to do it again.
## Practical Defense
Now that you’ve done some ‘active’ things, you need to take the steps to protect yourself. These are hard because it starts with not looking at it.
Don’t look at what they say about you. Its in our nature to want to know what people are saying about us, but I’m here to tell you not to look. Don’t look. Ignore the comments on other forums and blog posts. Walk away from what’s out there.
If you do look, document. And there will be things that come at you regardless. You’re going to want to keep a record. I have a spreadsheet with the title and date of every single email someone sent regarding an altercation with Plugins. 300 emails a month, on average, for three months. It was painful to record, but I did it to have a history of his behavior. Which is still going on.
Are you getting emails? Block them. Did they make a secondary account? Block that. Did they make 69 accounts over multiple email providers and rotate through the accounts to try and talk to you? By the way, yes, that happened. You block them **all** and you report them. You keep doing this.
Put their emails in your comment blacklist. Don’t dismiss this. If you use Jetpack contact forms, you can use the blacklist to block them from that. IP block if you have to, though I don’t recommend that. Do what you can stop them from getting to you. If you can’t turn off comments (like I did here), then I recommend requiring all first-time comments be approved, and using the [Comment Probation plugin](https://wordpress.org/plugins/comment-probation/).
What about social media? If they’re ‘friends,’ I recommend you unfollow and possibly mute. There are people in WordPress whom I’ve muted, because we don’t get along and will argue about everything. It’s not worth it to fight, so I block and I mute **very** fast. This is for my own sanity because emotional attacks hurt worse.
It someone calls you names, it hurts. If someone attacks your choices, it hurts. Well when someone continues to belabor a point, argue past the point of sense, and absorb hours of your time, they’re hurting you. You are **allowed** to ask them to stop and leave you alone. Of course, this doesn’t often work.
## The Warning Signs
As many people will tell you, asking someone to stop, even a simple “I don’t want to continue this conversation here, please email X,” can result in unexpected explosions. This is an escalation in behaviour, as someone is demonstrating a distinct **lack** of respect for you, and human decency. Usually this is because they’re hurt too and lashing out, and it’s hard for people to look past that.
Bear in mind, a threat doesn’t just mean “You better not walk down a dark alley alone” — and yes, someone said that once. Sometimes a threat is “I sent a package to your office.” Now, I bet nearly every non-male reading this just nodded. For those of you who didn’t, let me elaborate.
When an online conversation crosses into the ‘physical world’ (for lack of a better term), it’s a major red flag. If you’ve been tweeting or emailing someone, and they send you, say, an apology letter, or email a photo of their company apologizing, you need to worry. This is because they’re attempting to play to your emotions.
When they make that next step, though, claiming to send you flowers, that’s when you need to get a hold of authority figures and friends. Fast. I will warn you, if the person making the claim is out of state or out of country, it’s **very** hard to get legal help. You can, but it’s hard. If you work at a specific location, make sure they know. Make sure people you live with are aware. Anyone you think **might** be targeted, you need to warn.
There are a number of micro-aggressions that indicate this behavior, from Sealioning to Gaslighting. But that’s a talk in and of itself. What you should hang on to here is that you need to trust your gut. Women, people of color, queers, any minority, we’re pretty in tune with that bad feeling that a conversation is going to go sour. Trust that. If someone turns to you and says “Hey, this person looks like they’re escalating,” then you should listen.
## Get Help
I said it before, let me say it again. Give your teams a heads up. I had someone follow me all the way to my company, and we had to get legal involved because of threats expressed. I’ve even had to have a security officer on site for a WordCamp talk because someone went far enough that I felt concerned for my physical safety. These aren’t jokes. These are people who have lost the ability to see reason.
You need to tell people in charge. If you’re afraid to tell your boss, you can try this with them or your HR rep or a trusted co-worker:
> I’m sorry to bring some personal issues into work, but there’s someone who has been harassing me, and I think they’re going to bring it into the workspace.
No template is perfect or nuanced enough to handle all situations, and if you need help figuring out how to tell your employers, grab a trusted friend and ask for help.
Beyond warning people you work with, **get help**. Ask for what you need, even if you know it’s the wrong person to ask. They may know who to talk to. I needed a new feature built into WordPress’ tool for plugin reviews to blacklist people so we stopped getting 30 emails in a day in our inbox. Speak up. Your teammates and friends should have your back. And if they don’t listen, go louder and over their heads as high as you need to. Go public if you have to.
## Practical Defense
Even if you do all this, you have to keep in mind that once you are pointed at as ‘the bad guy’ people will go bonkers. They will be obsessed with every single thing you do. And this means you cannot bait them. Look, I love a good subtweet as much as anyone, but for the duration of this drama, you must **not** poke the bears. Don’t even drop a hint. While being harassed by said the aforementioned serial emailer (we’re up to 1000 emails now by the way), I complained about someone else, my cable company as it happened, but he took it to mean I was talking about him. It sucked.
This is the scary thing, and the reason you’ve **got** to walk away from them. When they get obsessive, reading thousands of tweets deep or dredging up a forum post from before you were a moderator to prove a point, they’ve gone **past** sense and into obsession. This is **terrifying**. Which is why you’ve got to put your shields up.
I want to point out the specific things you can do here. These are generally easy to do from a technical perspective, but not emotionally.
**Twitter**
First you de-friend. If they’re not a friend, you mute. If they escalate, you block. Some people you will jump right to a block because they’re just so wrong. But do it and walk away. The nice thing about a block and a mute is that it prevents you from reading their tweets at all.
Turn off Twitter notifications for young accounts and people who don’t follow you. Use the quality filters. Disable DMs from people you don’t follow.
If somerone attacks you or is vulgar, report the tweets and block them. Blocking an account you’ve reported **will** increase the chances that Twitter will actually do anything. Also ask your friends to report and block anything else they made public. It will help.
**Facebook & Instagram**
So I hate Facebook for a lot of reasons, and this is one. See, pretty much all you can do is build a wall. Facebook cares more about selling your personal information than protecting you from harassment. All you can do is lock your account away and block people. Report, yes, but if my wife’s death threat is any hint, they will do *nothing*.
Still, I recommend you report content. You need to report the individual posts as well as the user account.
Also curate the hell out of your friends. If you can’t remember why you friended them, it’s a good time to un-friend.
Everything Else? You set your account private and block judiciously. You don’t have to worry about Google+ any more, but lordy, I promise that was a nightmare trying to block people. Snapchat is pretty ephemeral, things don’t stick around long, so it’s not an easy place to manage but still [report and block](http://onlinesense.org/snapchat-report-abuse/).
I have to mention this because we use Slack for WordPress.org work. And here, there is only one thing you can do when someone’s harassing you. You need to find an admin. Go into the Slack group and click “Customize Slack.” Then pick “About this workspace”. Click on the “Admins & Owners” tab. Ping one, explain the tl;dr and make sure you have **logs** of your harassment. Good luck.
On a forum? Ask for moderator help. If this is an in-public ask, keep it simple. “I need a moderator. Someone is harassing me. Who can I speak to about this?” If you’re on WordPress.org’s forum, tap the ‘report topic’ button after you post and a Moderator will be alerted. Or come to the `#forums` slack channel and ask for help.
## I Hope You Never Have to Do This
I really do. I hope none of you ever have to do this, and that your takeaway is “Gosh, I should make it easier for people to protect themselves on my systems!” And if you are going through this, protect yourself as best you can and remember, just because you’re the bad guy doesn’t mean the other person is a hero.
**Categories:** How It Works
**Tags:** bullying, ethics, harassment, wordcamp
---
### [There Are No Top Influencers](https://halfelf.org/2019/there-are-no-top-influencers/)
**Published:** December 11, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We need to care less about the personal aggrandizement of a few select individuals, and more about the collective success of the WordPress project.
**Content:**
It’s that time of year where people post their ‘top X influencers’ for whatever they happen to be blogging about. It’s not a secret I hate those lists. In fact, I ask to be left off of them entirely.
## All Lists are Incomplete
No matter what, no matter if you list 100 people, you’re going to leave someone out. This is a huge problem because those people will be hurt. The common complaint you hear is that a list cannot possibly list everyone, and that’s exactly the point. You know from the start you won’t have everyone listed, so you’re just going to pick the people you like best. And this is because…
## All Lists are Biased
A couple years ago I saw a top-40 list that was 97.5% male. That means there was **one** woman on that list. Equally bad, there was only one non-white person on the list. They were not the same person, which meant this list left off someone who should have been terribly important since she led a major WordPress core release that very year. Leaving off hugely qualified people because of your unconscious (I hope) bias means you further work against the progress to be found with representation. And really that points to the next problem….
## All Lists are Personal
If I was to list the biggest influences on, say, WordPress for me, I would include my father and my wife. To his dying day, my father emailed me a PDF and asked me to upload the content to his blog. My wife constantly asks me for help remembering the rare parts of WordPress. It’s that kind of experience that drives me. They influence me every day to make things easier for the non-technical. Another major influence are my co-editors on LezWatch.TV who ask me things that I feel should be obvious but clearly are not. Which means …
## All Lists are Pointless
My mother is a huge influencer in my life. But you’re not going to get anything from following her. The developers I follow are ones who speak and talk in ways my brain has no problem following. The designers have taught me how to visualize (something I’m terrible at). The political wonks aren’t just an echo chamber, they’re thoughtful and educational. I follow a Sappho bot because I like her poetry. But none of that, not one thing, will help *you* get better at development or WordPress or anything really other than knowing I’m a human who likes a lot of weird stuff.
## We’re Solving the Wrong Problem
What’s the point of these lists anyway?
I can only come up with a couple reasons people make them:
1. Currying favour with the people on the lists to make them feel important
2. Lists are easier than actually writing a post with content
That’s all I’ve got. And that brings me to my point.
## *No One* is a “Top Influencer Anyway”
The person who influences WordPress the most is probably someone you never noticed.
People tell me I should be listed and I point out that my ‘influence’ is not seen by the majority of people who use WordPress. They never see a plugin review or the work we put into making things safe and stable for them. And that? That is as it should be! How many users can name the release leads? Those names don’t matter to them, and they shouldn’t.
Dad never cared if Nacin or Helen or Mel or Matt lead a release. He didn’t even care that I know them. He cared that WordPress worked and did what he needed.
Isn’t that what we all care about? Not the personal aggrandizement of a few select individuals, but of the collective success of the WordPress project.
## Make Lists Matter
If you want a list that matters, make a list of the best talks/blog posts/event-things you experienced in a year and explain how they influenced you. Tell people about what you learned and how you use it. Explain why things matter.
But lists?
Come on, we can do better.
**Categories:** How It Is
**Tags:** essay, oped, open source
---
### [Shut Your Pi-hole](https://halfelf.org/2019/shut-your-pi-hole/)
**Published:** September 27, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Blocking ads and reducing traffic on your home-network can totally be done with $30 and an hour.
**Content:**
One of the things that bothers me about the internet is tracking and ads. Mostly I hate trying to read things like IMDB and having it take a minute (60 to 90 seconds) to load, because of ads.
Now I have nothing against ads! I use them on my sites to limited success. I click on them on Instagram from time to time. But the way many sites use ads and tracking is a little obscene to me. It makes it impossible to browse the net. And worse, the add-ons for our browsers don’t always work.
## Enter the Pi-hole
I blame my friend Jan, who loves Raspberry Pi’s, for the thought. A Raspberry Pi is a mini computer. It’s the bare bones you need to computer. If you think about how small something like an Amazon Fire Stick is, you have the idea. They’re itsty. But they work. And they work because they have a stripped down operating system that does very little but the basics.
On top of that, we can add software like [Pi-hole](https://pi-hole.net). A Pi-hole is custom software that watches your internet traffic and blocks ads before they get to your computer. It works by intercepting DNS traffic and checking it against blacklists. If something, like an ad network, is on a blacklist, it blocks.
## Finding Your Pi
In order to build this you need a Pi. I bought a kit. I don’t want to hear about it. I don’t need more, I didn’t want more. I wanted, and I got, the basic kit that had what I needed. I bought a [Vilros Pi Zero W](https://www.amazon.com/gp/offer-listing/B0748MPQT4/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=B0748MPQT4&linkCode=am2&tag=ipsteorg-20&linkId=15ecfd79abd35f131a49edc8fd825f2c), which means it’s the smallest, least extendable Pi out there.
The kit came with the following:
- A Pi circuit board
- A case (with three lids)
- Rubber feet for the case
- A heat sink
- A camera connector (but no camera)
- A 2×20 pin set
- Adapters for HDMI and power and USB
In addition I bought an [Ethernet connector](https://www.amazon.com/gp/product/B00RM3KXAU/ref=as_li_tl?ie=UTF8&tag=ipsteorg-20&camp=1789&creative=9325&linkCode=as2&creativeASIN=B00RM3KXAU&linkId=f5a1660fdf88811f393379ffe7168911) because I didn’t want to use WiFi, and a [mini SD card](https://www.amazon.com/gp/product/B00CNYV942/ref=as_li_tl?ie=UTF8&tag=ipsteorg-20&camp=1789&creative=9325&linkCode=as2&creativeASIN=B00CNYV942&linkId=0b1d571dfa51ec490807b6c7a07bce1f).
Putting it together is like LEGO’s, however there were NO directions. Did I need the pins? Did I need the camera? In the end, I attached the heat sink and left it at that. The pins only matter if I’m soldering things and I don’t want a camera.
## Installing the OS
The tricky part here is normally people say “connect a monitor and keyboard…” but I didn’t want to do that. I don’t have a spare monitor (though I could use my TV and briefly did for a debug) and I don’t have a spare keyboard. All of this I did on my MacBook.
Go to the official page and download [Raspbian LITE](https://www.raspberrypi.org/downloads/raspbian/). This is the minimalistic version of the official operating system. Download the zip and open it. You’ll get an IMG file. Hold on to it. You also want to download an image builder. I used [Balena Etcher](https://www.balena.io/etcher/), which is a free and open source tool to flash an SD card with an operating system. Or in layman’s terms, it installs that image you downloaded onto the card and magically makes it work.
Insert your SD card and run Balena. Tell it to install your image to the SD card. This takes about 5 minutes, depending on your systems. Once it’s done, you will need to eject the card and then *reinsert* it. This is because the MacOS can be tetchy. Once the disk is mounted on your Mac, you need to add an empty file called SSH to the main folder. This will allow you to SSH into the Pi when you’re done.
## Plug It In
Okay! Now we go back to the hardware. Eject your disk from your Mac and insert it into your Pi. Put the Pi into the case and click it into place. Make sure the various ports line up with the holes. Once that’s in, put the lid on and attach the HDMI adapter (just in case), the Ethernet Adapter (and plug that cable in) and the power.
Your Pi will boot in a matter of seconds. Go get a glass of water. Come back. Now we’re ready to go!
## Update All the Things
Before we install Pi-hole, we want to upgrade everything.
To do that we need to know our Pi’s IP. I went to my router’s web interface and scanned the list of devices for raspberrypi. It’s under the DHCP allocation table. Get the IP address of your Pi. With that address, SSH into your Pi.
```
ssh pi@123.45.67.89
```
The default password is `raspberry`.
You will be shown [`raspi-config`](https://www.raspberrypi.org/documentation/configuration/raspi-config.md) on first logging in. Press the number **2** and change the password to something better. If you want to run that screen later, you’ll need to run `sudo raspi-config`
Now we update! To update everything, run `sudo apt-get update` — this downloads all the things you need. Next you run the upgrader – `sudo apt-get dist-upgrade` – to install it all. If this fails, it will have advice on how to proceed. Read carefully!
We also want to install Git tools: `sudo apt-get install git net-tools`
And you *may* want to change your timezone: `sudo dpkg-reconfigure tzdata`
## Install Pi-hole
You can one-line this, but I prefer to use git:
```
$ git clone --depth 1 https://github.com/pi-hole/pi-hole.git pi-hole
$ sudo bash pi-hole/automated\ install/basic-install.sh
```
This will take you through the installer. You’ll have some options to pick from:
- Interface — I’m using eth0, which means wired Ethernet and **not** WiFi.
- DNS — I picked OpenDNS but for most people Google is fine and reliable.
- Blacklists — Accept the defaults.
- Protocols — Most people will use IPv4. You’ll know if you use IPv6.
- IP Address/Gateway – The system does a good job getting the IP of your Pi. The gateway needs to be the IP of your existing router.
- Web Admin — Yes, we want the web admin.
- Web Server – You want this if you picked yes for Web Admin.
Whew. That was a lot, right? And the install takes a bit (don’t panic if it stalls). You’ll get your password for the web admin in this process, so please make a note of it.
## Configure Your Pi-hole
At this point, you can visit `http://pi.hole/admin` to get to your admin page. If that doesn’t work, try `http://123.45.67.89/admin` (changing that to your Pi’s IP) and that will get you in. It does not *log* you in. You can log in, and you’ll want to because we have to do some extra configuration.
Also it looks really cool:
If you’re lucky enough, your router lets you change the DNS servers. And if that’s the case, just change it to the IP of your Pi-hole. Done and done. **However**. If you’re like me and use the router that came from your ISP, you may be surprised to find out they don’t trust you in the slightest and you cannot change the DNS settings.
After you’re done swearing at your ISP, and you’ve decided you *don’t* feel like shelling out a couple hundred for a router that may or may not work, it’s time to play magic with DHCP.
DHCP (Dynamic Host Configuration Protocol) is the service that lets your router give all the devices on your local network (LAN) an internal IP address. It also handles all the traffic from your device to the rest of the Internet.
1. Log in to your router and disable DHCP
2. Log in to Pi-hole admin and *enable* DHCP
3. Make sure the Router Gateway address is the correct IP for your router (if it’s not, nothing will work)
If you want to switch everyone over right away, reboot your router. If not, just wait for everyone to pick up the new service.
## How Have You Pi’d Your Hole?
What extra tricks have you spun up? Do you have a perfect blacklist? Do you use it for a VPN as well? Did you figure out how to beat the AT&T modems into submission?
FYI. Do not reply to this post with “You should use X hardware instead” or even “You need own your own router.” Telling people they’re wrong about choices they made when the choices are perfectly valid is an 🍆 move. Be helpful and lift up. Don’t gatekeep.
For the people who still have questions, here are some useful posts:
- [What Pi model should I use?](https://discourse.pi-hole.net/t/what-model-raspberry-pi-should-i-use-for-pi-hole/9635)
- [How should I pick an upstream DNS Server?](https://discourse.pi-hole.net/t/how-do-i-choose-an-upstream-dns-server/258)
- [How do I use the Pi-hole DHCP service and why do I want to?](https://discourse.pi-hole.net/t/how-do-i-use-pi-holes-built-in-dhcp-server-and-why-would-i-want-to/3026)
- [Commonly whitelisted domains](https://discourse.pi-hole.net/t/commonly-whitelisted-domains/212)
**Categories:** How To
**Tags:** hardware, pi-hole, raspberry pi
---
### [Saving Theme Data to a File](https://halfelf.org/2019/saving-theme-data-to-a-file/)
**Published:** July 17, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Including HTML content from WordPress when it's not your post content but your theme settings can be done! It's just a mess.
**Content:**
Your life isn’t all WordPress.
I know, I know, I said a dirty thing, but let’s be honest, everything isn’t always all WordPress. And when that happens, you have to do some weird things to make your data shared.
One of the things I needed one day was a way for non-WordPress files to get access to a *theme* setting. See, the theme let me set a top-bar and customize it. Sometimes I did that to share news, sometimes to link to latest posts. Regardless, I updated it via Customizer, and it worked great for WordPress.
Not so much for my static HTML site, or my non-WordPress PHP site.
I dwelled on it for a while and then thought “Wait, if the theme knows how to echo a specific setting, then there has to be a function for that. And if there’s a function, then can’t I hook into Customizer saving to trigger the creation of an HTML file with the data and call that from my other sites?”
And guess what? You can!
## The WordPress Code
Toss this in an MU Plugin and it’ll save a file to `wp-content/top-bar.html` when you save customizer settings.
```
**Categories:** How To
**Tags:** embed, javascript, wordpress
---
### [Rolling Your Own Related Posts](https://halfelf.org/2019/rolling-your-own-related-posts/)
**Published:** June 12, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Related Posts that are extendable and customizable are within your reach!
**Content:**
To start out at the top, I did not write a whole ‘related posts’ plugin. As with all things, I started by asking myself “What’s the problem I’m trying to solve?”
The answer is “I have a custom post type that needs to relate to other posts in the type, but based on my specific criteria which is currently organized into custom taxonomies and post meta.” And from the outset, that certainly sounds like a massive custom job. it was one I was dreading until I remembered that a developer I respected and trusted had once complained to me about the problems with all those other auto-related-posts plugins.
1. They’re heavy and use a lot of ram
2. They don’t let you customize ‘weight’ of relations
3. They’re not extendable
So I did the next logical thing and I looked up their plugins.
## The Plugin
> [Related Posts by Taxonomy](https://wordpress.org/plugins/related-posts-by-taxonomy/)
The crux of why I chose this plugin was simply that it’s extendable, but also that it started out with what I had:
> Posts with the **most terms in common** will display at the top!
Perfect!
## Design The Basics
Before you jump into coding, you need to know what you’re doing. I chose to isolate what I needed first. I made a list of everything I thought was relative:
- Taxonomies: Tropes, Genres, Intersectionality, Tags, Stars
- Post Meta: Worth It, Loved, Calculated Score
Yes, it’s that site again.
I read the plugin documentation and verified that for most of that I just needed to list the taxonomies in the shortcode like this:
```
[related_posts_by_tax fields="ids" order="RAND" title="" format="thumbnails" image_size="postloop-img" link_caption="true" posts_per_page="6" columns="0" post_class="similar-shows" taxonomies="lez_tropes,lez_genres,lez_stars,lez_intersections,lez_showtagged"]
```
Initially I didn’t list the stars because the way the code works, it would say “If you have a Gold Star, show other Gold Stars.” And that wasn’t what I wanted to see. I wanted “If you have ANY star, show other shows with a star.” That said, once we got over 12 shows in each ‘star’ category, this became much easier to match and I could add it in.
The rest of the code, those checks for meta, needed actual code written.
## Meta Checks
There’s a helpful filter, `related_posts_by_taxonomy_posts_meta_query`, that lets you filter the meta queries used by the post. Leveraging that, we can make our checks:
1. Match the ‘worth it’ value of a show
2. If the show is loved, list other loved show
3. If the show isn’t loved, use the score to find show with the same relative value
Both Worth It and Loved are post meta values. Mine happen to be added by CMB2, but the logic remains the same regardless how you add it. Worth It has four possible values (Yes, No, Maybe, TBD), and the check is either the value or false. Loved is a checkbox, a boolean exists or not, which means it’s a true/falsy. The score is a number that’s generated every time the show is saved, and it’s crazy complicated and another story.
The code I use looks like this:
```
add_filter( 'related_posts_by_taxonomy_posts_meta_query', 'MYSITE_RPBT_meta_query', 10, 4 );
function MYSITE_RPBT_meta_query( $meta_query, $post_id, $taxonomies, $args ) {
$worthit = ( get_post_meta( $post_id, 'lezshows_worthit_rating', true ) ) ? get_post_meta( $post_id, 'lezshows_worthit_rating', true ) : false;
$loved = ( get_post_meta( $post_id, 'lezshows_worthit_show_we_love', true ) ) ? true : false;
$score = ( get_post_meta( $post_id, 'lezshows_the_score', true ) ) ? get_post_meta( $post_id, 'lezshows_the_score', true ) : 10;
// We should match up the worth-it value as well as the score.
// After all, some low scores have a thumbs up.
if ( false !== $worthit ) {
$meta_query[] = array(
'key' => 'lezshows_worthit_rating',
'compare' => $worthit,
);
}
// If the show is loved, we want to include it here.
if ( $loved ) {
$meta_query[] = array(
'key' => 'lezshows_worthit_show_we_love',
'compare' => 'EXISTS',
);
}
// If they're NOT loved, we use the scores for a value.
if ( ! $loved ) {
// Score: If the score is similar +/- 10
if ( $score >= 90 ) {
$score_range = array( 80, 100 );
} elseif ( $score 'lezshows_the_score',
'value' => $score_range,
'type' => 'numeric',
'compare' => 'BETWEEN',
);
}
return $meta_query;
}
```
## More Similar
But there’s one more thing we wanted to include. When I built this out, Tracy said “There should be a way for us to pick the shows we think are similar!”
She’s right! I built in a CMB2 repeatable field where you can pick shows from a dropdown and that saves the show post IDs as an array. That was the easy part, since we were already doing that in another place.
Once that list exists, we grab the handpicked list, break it out into a simple array, check if the post is published and not already on the list, and combine it all:
```
add_filter( 'related_posts_by_taxonomy', array( $this, 'alter_results' ), 10, 4 );
function alter_results( $results, $post_id, $taxonomies, $args ) {
$add_results = array();
if ( ! empty( $results ) && empty( $args['fields'] ) ) {
$results = wp_list_pluck( $results, 'ID' );
}
$handpicked = ( get_post_meta( $post_id, 'lezshows_similar_shows', true ) ) ? wp_parse_id_list( get_post_meta( $post_id, 'lezshows_similar_shows', true ) ) : array();
$reciprocity = self::reciprocity( $post_id );
$combo_list = array_merge( $handpicked, $reciprocity );
if ( ! empty( $combo_list ) ) {
foreach ( $combo_list as $a_show ) {
//phpcs:ignore WordPress.PHP.StrictInArray
if ( 'published' == get_post_status( $a_show ) && ! in_array( $a_show, $results ) && ! in_array( $a_show, $add_results ) ) {
$add_results[] = $a_show;
}
}
}
$results = $add_results + $results;
return $results;
}
```
But … you may notice **$reciprocity** and wonder what that is.
Well, in a perfect world if you added *The Good Fight* as a show similar to *The Good Wife*, you’d also go back and add *The Good Wife* to *The Good Fight*. The reality is humans are lazy. There were two ways to solve this reciprocity of likes issues.
1. When a show is added as similar to a show, the code auto-adds it to the other show
2. When the results are generated, the code checks if any other show likes the current show and adds it
Since we’re already having saving speed issues (there’s a lot of back processing going on with the scores) and I’ve integrated caching, it was easier to pick option 2.
```
function reciprocity( $post_id ) {
if ( ! isset( $post_id ) || 'post_type_shows' !== get_post_type( $post_id ) ) {
return;
}
$reciprocity = array();
$reciprocity_loop = new WP_Query(
array(
'post_type' => 'post_type_shows',
'post_status' => array( 'publish' ),
'orderby' => 'title',
'order' => 'ASC',
'posts_per_page' => '100',
'no_found_rows' => true,
'update_post_term_cache' => true,
'meta_query' => array(
array(
'key' => 'lezshows_similar_shows',
'value' => $post_id,
'compare' => 'LIKE',
),
),
)
);
if ( $reciprocity_loop->have_posts() ) {
while ( $reciprocity_loop->have_posts() ) {
$reciprocity_loop->the_post();
$this_show_id = get_the_ID();
$shows_array = get_post_meta( $this_show_id, 'lezshows_similar_shows', true );
if ( 'publish' === get_post_status( $this_show_id ) && isset( $shows_array ) && ! empty( $shows_array ) ) {
foreach ( $shows_array as $related_show ) {
if ( $related_show == $post_id ) {
$reciprocity[] = $this_show_id;
}
}
}
}
wp_reset_query();
$reciprocity = wp_parse_id_list( $reciprocity );
}
return $reciprocity;
}
```
There’s a little looseness with the checks, and because there are some cases were shows show up wrong because of the ids (ex: show 311 and 3112 would both be positive for a check on 311), we have to double up on the checks to make sure that the show is really the same.
## What’s Next?
There are still some places I could adjust this. Like if I use more filters I can make the show stars worth ‘more’ than the genres and so on. And right now, due to the way most Anime are based on Manga (and thus get flagged as “Literary Inspired”), anything based on Sherlock Holmes ends up with a lot of recommended Anime.
Still, this gives me a way more flexible way to list what’s similar.
**Categories:** How To
**Tags:** related posts, search
---
### [On Behavior and Respect](https://halfelf.org/2019/on-behavior-and-respect/)
**Published:** April 5, 2019
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Reputation is what other people know about you. Honor is what you know about yourself. The friction tends to arise when the two are not the same. There is no more hollow feeling than to stand with your honor shattered at your feet while soaring public reputation wraps you in rewards. That's soul destroying. The other way around is merely very, very irritating.
**Content:**
I’ve had an interesting week with WordPress. It’s been bad enough that I have to preface this post with a note.
**I have no plans to quit WordPress at this time.**
## Good Faith and History
This morning, I woke up thinking about a statement I picked up from Wikipedia. **Assume good faith.** I like that. I try to do it. The concept is simple and direct. Don’t assume everyone’s evil, instead assume they do mean well, but sometimes they may have trouble expressing it properly.
And while I do believe that most people don’t *mean* to be evil (there are exceptions…), I think that more people remain concerned about themselves over anything else. And this self-involved nature causes problems like happened recently, with choices certain companies made to self-promote in ways that other people found offensive and harmful.
So when I think about ‘good faith’ I do it with a look back to the previous actions someone (an individual or a company) has taken. How have they behaved before? Have they constantly shown poor choices? Is this a first? What happened the last time I tried to talk to them about it? Did we have a discussion? Did I get 15 emails in a row, alternately being called names or being begged to give them another chance?
That means I find it strange to watch people use the concept of ‘Good Faith’ to argue that they don’t look at people’s past actions to judge their current ones.
I’d like to think that my consistency would be something people would use to judge my actions, but I’ve learned people whom I’d trusted don’t. And yes, that’s sad. It’s depressing to find out people would rather jump to outrage and pointing fingers and blaming me than taking into consideration 10 years of work.
## Respect and Doubt
Respect is both given and earned. You give people respect for a position, under the assumption they deserve it, and people either live up to that respect and thus earn more, or they don’t. But when you have an unknown person, you start from assuming good faith based on the hope that they have legitimately earned the position.
Obviously when you know someone, hung out and had dinner, your assumptions are based on more than that. And if someone has a public history you can turn to, you can use that to base your assumptions.
That’s not what happened to me this week. Instead, I found out people actually assume bad faith, because perhaps my opinions are different than theirs, or because I saw something in a different way. It felt like “Assume good faith, but only if you’re on *my* side.” And that? That is sad.
I imagine how different things would have been to say “Hey, y’all. Mika’s been really careful about using her power here for five years. Give her the benefit of the doubt.”
Instead, people said I was seeing things that weren’t there. I was playing a victim. It was all in my head. There’s a word for that: **gaslighting**. God help you if you call them out on it.
## Damage and Care
It’s in a week like this where I totally understand why so many people have been quitting WordPress. People have worked hard to do good for a community, without any expectations of compensation, but they find out their opinions are dismissed and their word discarded or minimized. They feel disrespected, and it’s worse when they feel made fun of by the community they’re trying to help.
Some of them have chosen to walk away from WordPress, and I fully support that choice. To do anything less would be like telling someone that the beatings will stop once morale improves. It would be cruel and unkind to dismiss their feelings, and it would mean I’m not listening to them and have no empathy for them.
Also I’d have to be blind not to see it, because it happens to me all the time. This week? People I thought I knew assumed the worst in me. They didn’t give me the benefit of the doubt and, when I asked what I’d done to deserve that, they said I’d done nothing. They said they were just being fair and hearing all sides.
In other words all the work I’d done, being consistent and fair, acting carefully and listening to everyone was pointless. In the end, they were just going to dismiss all of that and jump on the bandwagon with everyone else.
And it was more than one person I’ve know for about a decade who did it.
For a while I wondered “Did I really mess up here?” And then I asked myself if I’m told I did *nothing* to be not-trusted, but I was going to be anyway, was there a possible positive outcome here?
## Empathy and Power
It really boils down to empathy. If someone says “Hey, this hurt me.” and your reply is “Yeah, I don’t see that” then you’re dismissing what they said. And it’s not just because I get treated badly that I have empathy, it’s because my parents, my family taught me to have empathy and care about the strangers as much as I cared about myself. We don’t live in isolation, we live in a community.
You can see why I call myself a Socialist, right? I care not just about the people I know, but the people I don’t know. I think about the impact my choices have beyond me, and given the amount of power I wield, that has a lot more weight than you might think.
Oh yes, I have an **insane** amount of power, and it scares the hell out of me. I could destroy a company with a click. I could insta-ban people for wrongs. I could close plugins for every single security and guideline mistake. I could publicize exactly what specific people did to get permanently banned. Worse, I could spread fear and doubt in the entirety of WordPress, just by closing a plugin.
I don’t. I handle the majority of that quietly, on the books but privately, because I **assume good faith** in everyone, even people who make massive mistakes. And because I consider the negative impact to the community in general before I take an action.
How much trust do I erode in WordPress as a whole with what I do or say? How much damage do I cause? How many people do I hurt? How many people will this person hurt if I permit them to carry on as they have been? Will their uncensured actions damage the reputation of WordPress? Will the community forgive a mistake?
That’s what I think about, every single day, before I approve, reject, close, or open *any* plugin.
## Alone and Together
If you look at some of the people who’ve left the WordPress Community recently, you’ll see a trend. They feel alone. They feel like they’ve been tasked with ever increasing, insurmountable, chores, and they have no support or backup.
I feel that way too. It took months to be taken seriously about a problem, to the point that serious action was taken. Months, in which I questioned myself. Was I seeing something that wasn’t there? Was my value so little that I’m not worth taking the time to address this problem?
To put it in perspective for you, someone told me that my father’s death was my fault for banning them for abusive behavior.
When you look at it, you’d wonder how I could ever doubt myself. Well, that’s what happens when people don’t step up and ask how they can help. And certainly I could have been more vocal about it, but at the same time, it illustrates the invisibility problem in our community. People are hurt all the time, and no one is looking out for them.
Should I have to scream that someone is hurting me for it to be seen? There’s no oversight in all things, but there’s also no clear way to ask for help. How much worse would this have been if I didn’t have support from people in the community, people in places who could (and did) help me?
What about everyone else?
## Unending and Critical
Now look back at Slacks and Blogs and Twitter. You know which ones I mean. Read what people are saying and assuming, and ask yourself “Is this making a **welcoming** environment?”
Far too many of us have used our critiques as excuses, without caring for the damage they cause. Dismissing people’s pain. Not offering honest and sincere apologies. We hide behind the veneer of “I’m just passionate” or “I’m being critical.” And instead of discussing the idea, we sling ‘understandings’ like accusations, and we cut at people for disagreeing. We assume the worst and treat people shamefully.
And worst of all? Our comrades allow this to happen in their backyards. They won’t remove a homophobic ‘joke’ comment because clearly it’s not meant sincerely. They will allow someone to be called a powerless puppet. They give space for hateful comments that barely even have a veneer of merit.
We’ve stopped encouraging meaningful discourse and regressed into screaming across the aisle that the other person is wrong. We believe our way is the only valid way, and we will tear people down, all the while claiming we’re doing it for the greater good.
And yet people can look at all that and not see the pitchforks and tiki torches.
## Comments are Disabled
There’s a reason I disabled comments and mute and block people on twitter with ruthless abandon. It’s not that I don’t want to hear different voices, it’s that it’s stressful to be attacked all the time. It makes a person physically ill. Certainly it’s made me that on more than one occasion.
I don’t leave comments open, I don’t engage with certain community news sources, I left many Slack groups and I don’t offer comments when asked very often. You see, I can either do good work for the community, do my best and keep things safe, secure, and as fair as a human can, or I can wade through toxicity.
I decided to do good work.
I would like to think that a decade of it would allow any perceived missteps of mine to be taken with a grain of salt and a sip of trust. I will still believe in the inherent goodness of people, and their ability to make colossal mistakes. I will still accept an appology when sincerely given.
But I will not forget and I may not forgive.
Then again, forgiveness should never be the point of your apology.
**Categories:** How It Is
**Tags:** community, essay, wordpress
---
### [Spam Your Blacklist](https://halfelf.org/2018/spam-your-blacklist/)
**Published:** December 24, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Tired of cranky people being jerks? Want to stop them from abusing your contact form? It's sadly harder than it should be.
**Content:**
As mentioned when I began my hiatus, there would be the occasional code post. Here’s one that is born from how annoying someone is.
## The Situation
I have a serial harasser. He’s a troll and a semi-stalker who doesn’t understand the meaning of “No.” I’ve blocked him on social media, his emails are blackholes, and as I don’t have contact forms on my sites, nor do I have open comment forms at the moment, it’s a non-issue here.
However, I do have another site which he found and decided to use my contact form to spam me and my co-admin with 10+ emails. When I found out, I blocked his IP address. He was on mobile, though, so I knew this would only last as long as he was on his phone. I needed a better solution.
This is not a *rare* problem. Especially not for women online. One of the many ways in which men drive women offline is by upping the emotional labor needed to be online. That is, they attack us with message after message, generally in the guise of being ‘a nice guy,’ or ‘just trying to have an open conversation.’ But the reality is that they want to wear you down and get you to do what they want.
It’s exhausting. If you’ve ever gone car shopping and had the dealer call you over and over with the hard sell, it’s like that.
## The Paradox
Contact Forms are meant to be a way for people to contact you, outside of the comments on your site. That being so, they really do need to exist *outside* the confines of the comments, which means your comment moderation list is a bit inappropriate. You want people who are having comment problems to get a hold of you.
At the same time, if you’ve blackholed someone, you don’t. You don’t want them to bother you at all, as reading their messages, even though you’re deleting them, is draining. So you want to be able to block them.
Here’s the problem: most contact forms don’t let you do this out of the box.
Yeah, think on that for a moment.
Here are the top four contact form plugins:
- [Contact Form 7 uses WordPress’s Comment Blacklist](https://contactform7.com/comment-blacklist/)
- Jetpack Contact Form (aka Grunion) has no blacklisting ability
- Ninja Forms has no (apparently) blacklist
- WPForms has no blacklist (however [Bill Erickson has some code](https://www.billerickson.net/code/wpforms-email-blacklist/) for you)
I use Jetpack, and while I may be annoyed I’m also a developer. So I did made an answer.
## The Caution
This will not block everyone. If your harasser changes emails a lot, you’re out of luck. And this is the ‘excuse’ I see a lot of the time. Why bother if they’re going to change emails? The answer is obvious. If I can inconvenience them enough, and make it clear I don’t care, they’ll go away.
Also if you do this right, they never know they’ve been blacklisted, so they think they’re getting to you and you’re sipping a damn mai tai.
## The Solution
In [March 2014](https://github.com/Automattic/jetpack/issues/430), I opened a ticket asking for a way to blacklist people. They have made zero forward momentum on this in the 4.5 years since. So this little red hen is doing it herself.
By using the built in filter for spam (which Akismet uses), this code checks if someone’s on the comment blacklist by IP or email, and if so, flags the message as spam. You don’t get an email. You *do* still get the message in your spam, which is not a great fix. I’d rather it just get dumped into trash, but there’s no filter I can find for that.
Still. This works, and it shut the guy up.
```
add_filter( 'jetpack_contact_form_is_spam', 'jetpack_spammers', 11, 2 );
function jetpack_spammers( $is_spam, $form ) {
if ( $is_spam ) {
return $is_spam;
}
if ( wp_blacklist_check( $form['comment_author'], $form['comment_author_email'], $form['comment_author_url'], $form['comment_content'], $form['user_ip'], $form['user_agent'] ) ) {
return true;
}
return false;
}
```
But. That only helps what’s on the blacklist. And the blacklist has a couple drawbacks. First of all, while it absolutely does handle multiple words (so I can block ‘milady mika’ if I want), it’s a little more complex if you wanted to block someone using gmail and a plus sign in the email address. So if you want to block `example+spammer@gmail.com`then you either have to add that in literally or you get creative. I went creative.
```
add_filter( 'jetpack_contact_form_is_spam', 'jetpack_harassment', 11, 2 );
function jetpack_harassment( $is_spam, $form ) {
// Bail early if already spam
if ( $is_spam ) {
return $is_spam;
}
$badlist = array();
$blacklist = explode( "\n", get_option( 'blacklist_keys' ) );
// Check the list for valid emails. Add the email _USERNAME_ to the list
foreach ( $blacklist as $spammer ) {
if ( is_email( $spammer ) ) {
$emailparts = explode( '@', $spammer );
$username = $emailparts[0];
$badlist[] = $username;
}
}
// Check if the comment author name matches an email we've banned
// You'd think we didn't have to do this but ...
if ( in_array( $form['comment_author'], $badlist ) ) {
return true;
}
// Check if the email username is one of the bad ones
// This will allow spammer@example.com AND spammer+foobar@example.com to get caught
foreach ( $badlist as $bad_person ) {
if ( preg_match( '/' . $bad_person . '/', $form['comment_author_email'] ) ) {
return true;
}
}
return false;
}
```
My original take was hardcoded in, but this way is more elegant and covers the majority of the ways ‘nice’ people try to get around blocks. Now, if you’ve blocked `spammer@example.com` and someone submits a form with `spammer+avoid@example.com` this will catch them. It has a higher chance of catching ‘innocents’ (like `innocent@spammer.com`) however considering I’m looking for something like `rosbeitam@example.com` I’m reasonably confident in this for my personal application.
## The Take Away
If you make a contact form, you damn well better make a way for users to block people from the *back end*, without having to code it.
Merry Christmas, ya filthy animals.
**Categories:** How To
**Tags:** blacklist, contact form, harassment, wordpress
---
### [Hiatus: Irregular Updates](https://halfelf.org/2018/hiatus-irregular-updates/)
**Published:** October 4, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** From here out, updates will be irregular.
**Content:**
This will not be the final post on this site, however after six years of regular, two to three times a week posting, I am putting a pin in the promise of two posts (minimum) a week.
The reality is that I’m just too busy now with writing to write.
You can pause for laughter there.
I’m busy with another site, and writing and the various work that it entails. Shockingly to me, I’ve found I’d rather work on it *than* this. For a long time, I was super happy to do both, but the reality now is that I’m not.
Of course if something comes up in my regular work that I can share, I will, or if I find a wild bug or a cool workaround. But I don’t actually have the time to dedicate to that amount of blogging here.
And so, at 1035 posts, I thank you all for reading. This blog absolutely changed my life.
**Categories:** How It Is
**Tags:** hiatus
---
### [Monitored Automation](https://halfelf.org/2018/monitored-automation/)
**Published:** October 2, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Trust but verify what your systems are doing.
**Content:**
One of the things I touched on in my talk at WordCamp NYC in September was the fact that automation has it’s flaws. The problems we face with automated systems flagging LGBTQ videos as ‘restricted’ or trending horrific topics or promulgating fake news is all because of automation. We did this to ourselves.
## Computers Share Our Biases
Humans have biases, which color the ways in which we develop code. If we feel no one should be able to use a lower case P in WordPress (because that’s it’s name) then we can use our biases to programatically force that. Right or wrong, we are biased in many other ways.
The bias of robots is limited to what we’ve taught the robot. There’s no such thing as a true AI yet. Yes, I know European Parliament has declared robots to be ‘electronic persons’ and therefore responsible for their actions. In the case of automated reviews, the robot lacks the ability to detect nuance. It lacks ethics and morals. It cannot make a judgment of what is worth more than something else.
The flip side to this is that humans do what we’re told to do too. Sort of. If I tell you to download a file, review the code for security and sanity, but *not* make a moral judgement on it’s use, you will and you won’t. Oh sure, you understand it’s not your job, or responsibility, so you’ll try not to. We don’t ask the TSA to make a value judgement on what’s in our luggage, we ask them to determine if it’s allowed or not.
## Biases Drive Design
Computers, even the most advanced, make decisions based on how we program them. If we tell them “The word Nazi is bad” then anything with that term that is submitted will be rejected. Even a tool by, say, the Holocaust Museum, talking about how their skill provides trivia about the Nazis’ rise to power.
The reason a computer has bias is because **we**, the people who program the computers, have bias. We are capable of discussing the paradox of tolerance and, in many cases, of coming to an agreement as to what should and should not be permitted. It’s easy to say that guns are illegal on airplanes. It’s not easy to say that being mean will get you kicked off a plane, because that’s subjective.
Back to the TSA. If you brought a pair of fuzzy handcuffs in your carry on, which is legal as of the time I wrote this, you would be permitted to do so, but someone would comment. You may even end up having a very public conversation about your private life. And yes, that TSA agent is totally making a value judgement about you.
## Who Watches the WatchMon?
The answer, the solution to these problems, is difficult. On the one hand, a computer won’t judge you for the fuzzy handcuffs. On the other, it may also decide you’re a criminal for having them in your luggage. A human would understand the purpose of a skill that talks about Nazis not being hate speech, but they also may judge you for having some Nazi swag in your bag for your demonstration class.
Curiously the solution comes with a blend of automation and humanity. There are some things that should be auto-rejected. If you have a rule based on a clear technical limitation, then a computer should be relied on to process those. Except in practice, this is not the case. Instead, we need a human to check, approve or not, and move on to the next possibility. That’s right, the solution to the automation problem is human monitoring.
## Human Bias Isn’t Solveable
We can’t stop people from being biased.
We can meet regularly to discuss the situation, but something needs to go over all the approvals and rejections to see what people are actually doing. So then we have automation monitor the human in reverse. A computer monitors and makes its calls “It looks like X is trending.” A human checks the trends and, if they notice something abnormal (like Betty White trending on a Tuesday afternoon), then can check if she’s done something.
If a human manually removes Betty White from trending every time is shows up, a computer can flag that for their supervisor to ask why the hate for *The Golden Girls*. But this means someone has to sit down and talk about removing one’s personal biases from work, and I promise you, it’s harder than it looks.
## Automate But Verify
The ultimate answer? If you’re not monitoring and verifying your automation, you’re doing it wrong. Much like we say ‘test your backups,’ you have to test everything you task a computer to automagically do.
**Categories:** How It Is
**Tags:** development, ethics
---
### [ES5, ESNext, and a Headache](https://halfelf.org/2018/es5-esnext-and-a-headache/)
**Published:** September 25, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you're confused about the weird "ES" names with regards to Gutenberg and Javascript, there's some history that may help you out.
**Content:**
You may have noticed, [reading the Gutenberg documentation](https://wordpress.org/gutenberg/handbook/blocks/writing-your-first-block-type/), that there are two ways to add new blocks. There’s ES5 and ESNext. The two code bases are similar, but they certainly can confuse new developers. And while it’s possible to migrate from one to the other, that too can be a bit of a headache.
## Consistently naming versions? HAH!
Providing a consistent naming pattern is important for people to be able to understand what version of a software they’re using, and what’s next. Whatever you pick, when you decide how to go. you’re pretty much stuck with it forever. There are exceptions, but even Apple and Microsoft had semi-logical explanations for their names. I can’t really justify Windows ME to anyone, though.
In Open Source land, people love to complain that WordPress itself doesn’t use semantic versioning (aka SemVer). That is, a jump from 4.2 to 4.3 is a major release, where as if it were SemVer, that would be a minor change.
SemVer uses the concept of MAJOR.MINOR.PATCH with regards to numbers, which means you increment:
1. MAJOR – when you make *incompatible* API changes,
2. MINOR – when you add functionality in a backwards-*compatible* manner
3. PATCH – when you make backwards-*compatible* bug fixes
WordPress does MAJOR.MAJOR.MINOR-OR-PATCH which really confuses a lot of people, and I understand that.
Of course, then you look at the history of JavaScript and you cry a little.
## JavaScript isn’t Java, and neither are coffee.
We have to go back a while here. In 1995, Netscape Navigator was releasing a new coding language called LiveScript. In 1996 they renamed it to JavaScript, presumably to capitalize on the whole ‘Java’ craze. I actually took some Java classes back in those days. Anyway, Netscape tossed the deal over to [ECMA International](http://www.ecma-international.org) for some standardization, and got us ECMAScript.
ECMAScript is the language, Javascript is the most popular *implementation* of the language. Its like [HTML and XHTML](https://www.w3schools.com/html/html_xhtml.asp), and when you get down to brass tacks, most people don’t care. They use the terms interchangeably. And that’s okay.
From 1996 to around 2010, nothing changed. Javascript trucked along doing what it did, and ECMAScript didn’t change much at all. There was ECMAScript2 and ECMAScript3, but after that, we had a decade of nothing. The astute reader now has gone “ECMAScript… ECMA Script. ES?” And they would be correct.
## What is ESNext?
ECMAScript 5 (aka ES5) came out in 2009, but really it didn’t get picked up until 2012. This is because of our old nemesis, Internet Explorer. In the last 6 years, developers have pretty much stuck to ES5, since it works in all modern browsers. We have ES6, also known as ES2015, but not every browser supports it yet. Which is why we have ESNext.
To put it simply, ESNext (or ES.Next) is the future version of ECMAScript which is yet to be released. If you hear ES7 or ES2016, that’s actually the same thing. The naming system is a little janky and confusing, if you hadn’t already noticed.
And this is why you’ll hear it called ESNext in WordPress. It encompasses ES6/ES2015, ES7/ES2016, and whatever comes *next*. Aaaaaah you see?
ES4 was abandoned by the way.
## It’s Not Dangerous.
While not all browsers support ESNext, there’s good news for WordPress. It doesn’t matter because we transpile (I’ll get there in a second). For WordPress and Gutenberg, the primary difference is going to be in the ‘style’ of code and the build process. The break down is as follows:
- ES5 is more obscure to write, but runs immediately
- ESNext is more clean to write, but requires post compilation (transpilation) to run Gutenberg
That probably didn’t help. Okay, how about this. There a way to write CSS (called SASS) which lets you add programatic features to your CSS. ES5 and ESNext are the same way. You totally *can* write ESNext without compiling, but not yet for Gutenberg. This is kind of the same thing, except when we transpile ESNext, we’re converting it to ES5.
Now, we use ES5 in the end for a couple reasons, but primarily it’s because Gutenberg uses React, and React JSX (which translates Javascript to XHTML). That requires us to transpile back to ES5 in order to be used by all browsers. For now.
Browsers update a lot faster than they did when we were trying to get rid of IE5. Still, Internet Explorer is around and will be for a while at financial institutions, so don’t get super excited yet.
## Where does this leave us?
When you go to write your first Gutenblocks, I recommend ES5 for the simple ones and ESNext for the complex ones. ESNext is more semantic, in that it’s laid out in a more human readable way. ES5 is faster to edit and test.
**Categories:** How It Is
**Tags:** javascript, wordpress
---
### [Being Aware about Safe Spaces and Self Care](https://halfelf.org/2018/being-aware-about-safe-spaces-and-self-care/)
**Published:** September 27, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Taking care of yourself, even in work, may mean walking away.
**Content:**
One of the things people complain about is that I will walk away from a conversation that’s going nowhere. This extends to my worklife, and of course my WordPress work. Related to this, I will also choose to not engage with argumentative demands like “Why did you do X?” on places like Twitter and Facebook.
This is often considered to be cowardly, an admission of wrongdoing, avoidance, or proof I’m not “up” for the job. Sometimes people jump into the special snowflake argument (that is: I am one) or that I’m too sensitive and need a safe space.
Okay, let me explain why I don’t defend myself, or even generally reply to people who demand explanations.
## Social Media is Unsafe
I like social media. I like reading thoughts and replying, expressing my own short form feelings, and so on.
But by its open nature, social media is incredibly dangerous. Anyone can talk to anyone, and if we’ve learned anything from recent days, there are a lot of naive people out there who fall prey to any con man who walks up and tells them it’s not their fault their life sucks.
It also lends itself to a mob. And mobs are the most dangerous sorts of people. They’ve fallen in truck with a group and they believe everything they’re told. Worse. They are regularly aggressive when they face adversity, and they take justice upon themselves. This means, should you ever happen to upset one of them, you will end up with a mob on your doorstep. Or your DMs.
## A Place For Everything
Recently, a plugin developer made what *should* have been an innocuous question. Why was a post moderated. This is the sort of question I get a lot, and in general I press mute and ignore it, because if you want to ask me a question about plugins, there’s an email address you already have. Press reply. And if you want to ask about forums stuff, there’s a channel on Slack.
The problem here was in the hours leading up to this, he’d also spoken with people about another plugin. This plugin happens to be contentious for many reasons, including overmoderation of bad reviews. Someone decided that one and one meant four, and I was the fault of the reviews being removed.
I think that if you have questions about a team, you logically ask the team. Or the team management. When you ask someone whom you presume to be the point person on Twitter, you run a risk of a public misfire. You also run a risk of signaling to the mob who their new target is. Which is what accidentally happened that day.
## Angry People are Stressful
If you’ve ever tried to reason with someone who’s angry, you’ve probably reached a point where you thought it was better to bash your head in than try to explain facts. When you get a mob, it’s even worse. The people start out super angry, they refuse to accept any viewpoint but their own, and they make you angry too. This begins a vicious cycle where you overreact, they get angrier, you get angrier, and bad decisions are made.
It goes without saying, I’m not exempt from this. I make bad decisions when under anger and stress, same as pretty much everyone. While I strive not to, this is nearly impossible, and that is when I will disengage. Because I can tell I’m not going to be reasonable, and that would be harmful.
But what changes when you’re the end stop of a team? When you’re the rep and you have no choice but to make the decisions and the hard calls and continue to try? Well, you draw a line about **where** you will have those conversations. And you draw a line about with whom. Like saying “I won’t do this over Twitter.”
## Say No, Even When You Feel Bad
The main reason I won’t have a conversation about why decisions are made on Twitter is that there is no accountability for actions.
Anyone can make an anonymous account and troll people, telling them off for perceived slights. But to take your regular, daily use account and step up to ask a question, in the official location for those discussions, takes courage. More important, it takes a quality of human that will accept responsibility for their actions.
Most of the time. The odds are at least higher that people will be willing to discuss when they come into a discussion room. Obviously not always, and unlike Twitter I can’t mute or block people who are incapable of accepting ‘no’ as a valid answer.
Because you see, the main reason I don’t want to have the conversation on Twitter is that I worry you’re going to out yourself. That you will embarrass yourself when I say that leaving a review on the *moderators* in a plugin review is not appropriate. Or if I explain “You made multiple accounts to leave 5 star reviews on your own plugins.” Or worse, when I have to point out that “You called the moderators Nazi c\*\*\*s.”
None of those are made up.
## Emotional Labour
There’s one more thing.
When someone walks up to me and demands I explain myself to them, they place a burden on me. Literally they ask me to defend my actions. While the word “explain” is in there, it’s not what they mean. What they mean is for me to justify my actions and choices.
Usually when I attempt to explain the situation, or if I suggest the one they’re comparing to isn’t the same at all, I get called defensive. Or I’m trying to hide the point. And I’m expected to do it with a smile. If I call someone out on their inability to reason, I’m a bitch and making excuses. If I’m polite and respectful, I’m hiding something.
Simply put, if I can’t have a civil, reasonable, conversation with them about it, I’m not going to waste my time. No matter what, they’ve made up their minds going in.
Now, I will note that after some time doing this, you can tell who is going to be a stubborn jackass and who is not after about two passes. I can tell, on Twitter, from their previous tweets. That’s why I’m quick to mute and block. It’s not to silence them, it’s to sufficiently ignore them and not spend energy on someone who begins a conversation from a place of disrespect.
## None Of This Changed Your Opinions of Me
If you’re reading this, you’re probably a regular who knows you’re getting an opinionated, open minded, person who looks as intently at herself as she does everything else. In order to be truly honest, I have to be honest about myself, who and what I am, and what I say.
The other person who’s reading this probably came from a link someone gave you, following a discussion about my flaws. Let’s be honest, I’m a big fat target for those posts on Twitter, Facebook, and other various blog sites around the planet.
You both probably got here and thought “Yep, she’s exactly what I thought.”
Funny how that works.
I’ll leave you with this relevant article about [why YouTube stars are heading for burnout:](https://www.theguardian.com/technology/2018/sep/08/youtube-stars-burnout-fun-bleak-stressed)
> Lees began to feel a knock-on effect on his health. “Human brains really aren’t designed to be interacting with hundreds of people every day,” he says. “When you’ve got thousands of people giving you direct feedback on your work, you really get the sense that something in your mind just snaps. We just aren’t built to handle empathy and sympathy on that scale.” Lees developed a thyroid problem, and began to experience more frequent and persistent stretches of depression. “What started out as being the most fun job imaginable quickly slid into something that felt deeply bleak and lonely,” he says.
>
> [The Guardian](https://www.theguardian.com/technology/2018/sep/08/youtube-stars-burnout-fun-bleak-stressed)
**Categories:** How It Is
**Tags:** community, essay, oped
---
### [Blocks: Another Way to Adjust Settings](https://halfelf.org/2018/blocks-another-way-to-adjust-settings/)
**Published:** September 20, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding buttons to a Gutenberg block can indeed be done. Dare I say it? Simply.
**Content:**
As I’ve mentioned a few times, one of the ways you can adjust settings on a block in Gutenberg is via the sidebar. In fact, this is the default way most people will interact with block settings.
If you make a paragraph today, you can see it like this:
But. I don’t actually like it very much. I appreciate that I have it, and I love that I can get it out of the way. But sometimes I like settings to be a little more contextual.
## It’s Easy to Add Sidebar Settings
One of the reasons we all use sidebar settings is that, well, they’re easy. When I built out my listicles plugin, I could use the inspector controls and automagically I have my own settings.
This:
```
setAttributes( { items: value } ) }
min={ 1 }
max={ MAX_ITEMS }
/>
checked ? 'Reversed order (10 - 1)' : 'Numerical order (1 - 10)' }
checked={ props.attributes.reversed }
onChange={ () => props.setAttributes( { reversed: ! props.attributes.reversed } ) }
/>
```
Looks like this:
But like I said, I don’t like it very much. It’s clunky, it’s touchy, if you delete the number and type in a new one it’ll wipe all your data. And worst of all, my partner in crime, Tracy, hates it. If your work partners hate a tool, then it’s serious problem. I’ll put up with annoyances to me, but I’ll learn new code for the team.
## Think About What’s Easier
Before I get into the code I used to solve the issue, I want to take a moment to talk about theory and understanding usage.
One of the critiques about Gutenberg is that it’s changing too much too quickly, and it’s not listening to users. The problem with that complaint is it lacks context. I’m big on context because I believe that only with understanding the usage and context can we as a whole make the correct decisions going forward. What changes, when, and why depends entirely on what’s being used, for what, and why.
It’s much more direct to understand this when I look at my little listicles block. You see, we use it for one thing: to make lists with a specific format. And we have few requirements.
- Add and remove items
- Add content of myriad types to each item
- Be able to reverse the item count (1 to 10 *or* 10 to 1)
That’s really it. Except now I’m adding one more thing:
- An easier, inline, way to add/remove/toggle items.
So I sat and I thought about what would be the easiest to use, and I came up with a simple solution. Three buttons, one to add an item, one to remove, and one to toggle the order. Have those show perpetually at the bottom of the list, and you could easily add and remove as needed.
## It’s Actually Easy To Add Buttons
Once I knew what I wanted, I took a page from some work Yoast is doing and sketched my idea to look like this:
In order to do this, I needed to add some code to the bottom of my `` code:
```
setAttributes( { items: parseInt(`${ items }`)+1 } ) }
className='editor-inserter__toggle'
>Add Item
setAttributes( { items: parseInt(`${ items }`)-1 } ) }
className='editor-inserter__toggle'
>Remove Item
setAttributes( { reversed: ! reversed } ) }
className='editor-inserter__toggle'
>Toggle Order
```
This sits inside the `` and just below my `` insert. It generates the buttons, which change when you hover by default.
Now it’s not perfect. If you deleted all the items and pressed delete again, it would sure try to delete. I didn’t put in checks to make sure we didn’t go below 0 or above 18 (which is my current limits). But this is the start to make sure we can keep improving and iterating.
**Categories:** How To
**Tags:** gutenberg, javascript, wordpress
---
### [WordPress Reviews: The Good, The Bad, and the Stalker](https://halfelf.org/2016/wordpress-reviews-good-bad-stalker/)
**Published:** July 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
The following is the original notes on my WCEU talk about WordPress reviews. It’s more or less what I said, though the video will no doubt be up soon.
## 30 Months In Jail Over a One Star Review
This is a true story. In late 2014, a man violently assaulted a woman who left a bad review on his self published ebook. He stalked her, sorting out her pseudonym, finding her real name, address, and work location. He traveled 500 miles, found her at work in Scotland and hit her over the head with a full bottle of wine. He received 30 months in jail for the assault and stalking.
## An Extreme? Not So Much
Every day people leave hundreds of reviews on WordPress themes and plugins. They talk about how much they love or hate a plugin, there is rarely any middle ground here, and they are as passionate as the developers themselves. This passion leads to a large amount of confrontation on the WordPress Review Systems.
## Your Code Is Bad< And You Should Feel Bad<
We are all going to get the bad reviews, and while you might want to dismiss the idea of being a stalker or a violent offender, because YOU would never do it, I promise you this. You will react badly to a poor review. It’s human nature. You’ve worked for hours on something and someone just said your code sucks. It hurts. And while I say this simply, it’s incredibly hard to do what I’m about to tell you…
## Learn: Reviews Are Lessons
You have to learn from the reviews. Even the worst review has something you can take from it. If you can put aside your own ego to try and see the world from their side, you can many times take the lessons, apply them to your code, and make everything better. Maybe it’s a fix to code, but more often it’s a documentation issue. There is no 100% perfectly intuitive system out there. Not even life itself. We all had to learn how to use a toilet after all. So what can we learn from reviews?
## The Points Don’t Matter; Everything Is Made Up
People concentrate on getting good reviews, on getting five stars. That’s the wrong approach. A five star review is useless for your ongoing improvement of your product and tells you nothing. All you can do is begin a humanization of your code, leaving a reply of ‘thank you’ perhaps, but you can learn little from these.
## Context Is Everything: Room For Improvement
The review you want is the one that tells you they *mostly* like your work, but can see room for improvement, and they leave you suggestions. The review where someone has trouble finding information is another good one. That tells you what your FAQ is lacking, for example. These are people who are probably willing to have a conversation and just need you to begin it. Don’t be afraid to ask “What was it about the cowbell feature that bothered you?” or “I do explain this in the FAQ. Would it have helped you if I put an in-line note?” Engage them and learn from them.
## There Will be Anger: To The Pain
The review you don’t want is the one where people are livid. Where they all you names and abuse you. No one wants that, and sometimes you can talk to them and get details, but you’re starting in a disadvantageous position and you have to fight to get answers. If you talk to this person, which I do recommend, be prepared for snarky replies and snide remarks. When you get to the troublemakers who complain they wanted to leave a ZERO star review, you have to be strong and not reply in kind. Sometimes there’s no salvaging the relationship.
## A Review Is An Experience, And It’s Not Yours
The trick of all this is to remember that a review is not always a review on how a product worked. It’s also about how someone FEELS when looking at and using your product. A review is THEIR experience with your product, and the users experience with your code doesn’t necessarily start with them using your code. You need to understand who they are, why they feel this way, in order to properly handle their review. The experience begins with how people are introduced to your product, so if that’s an email marketing campaign or a website with a lower-case P, this will impact their experience and thus their review.
## Handling A Review… It’s Not Easy
You’re going to get angry. If you’re like me and sometimes, when you’re mad, you feel your face heat up and you literally see red? Walk. Away. Don’t reply. If you cannot reply, in public, politely, DO NOT REPLY. Okay? Shut up, don’t do it. What you do in response to a review will be PUBLIC and you WILL be weighed by it. So don’t shoot yourself in the foot. Once you’re calm, you can process the reviews.
## The “Support” Review: “I don’t know how to use it.”
This one drives people nuts. A review that should have been a support ticket, or maybe it could have been solved by looking at the FAQ. While you can’t make them do the right thing, you can offer help in the review. Explain how they should report this next time and try to find a solution. These suck. A lot. I hate them. But they happen everywhere, even Amazon. Try to fix the issue, but don’t give it any more attention than you would a normal support post. Be careful not to let these become the next kind of review…
## The “Blackmail” Review: “You don’t have a feature I want.”
This is my least favorite. One star review because a plugin didn’t do something they wanted. It feels unfair, too, because you’re being judged on something you didn’t do and weren’t even planning on doing. It makes me seethe. And there isn’t a fix here. You have to be able to say “no” and not feel guilty, which is hard. Your trick here is remembering it’s okay to not have your code do everything. If your theme changes colors based on photos, it’s okay not to want to support changing for animated gifs. Speaking of reviews of the wrong things…
## The “Commercial” Review: “I bought the pro version and it sucks.”
The reviews on WordPress.org *should* be for your free product on WordPress.org. Sometimes they’re not. If you’re upselling your products from the free version, if you have ads on your plugin and tell people “for more features, use the pro version!” then you’ve opened yourself to the painful review of how that upgrade process goes. The best you can do is offer to help them via official channels, but if someone’s upgrade to your pro version goes poorly, you’re going to get a bad review. You cannot ask people to upgrade and give you money and not expect them to have an opinion.
## The “Way Too Angry” Review: \[CENSORED\]
Oh boy. This one. The review that you read that is insane. You know this one, right? It’s filled with language so foul and so appalling you can hardly process. Don’t reply. Don’t. This person is a lost cause. If you say anything, keep it to “I’m sorry you feel this way” but frankly I wouldn’t.<
## The “Mistake” Review: Spam, sockpuppets, wrong plugins, and more!
I actually like these reviews. They’re easy to deal with because all I do is have them deleted. Tag the post ‘modlook’ and then spam or sockpuppet or wrongplugin and walk away. I wish they could all be this way…
## Learn: Mistakes Will Happen
The biggest takeaway from this, if you want to distill this entire talk into a tweet, it would be this: Don’t post angry. Don’t attack anyone. Remember we are, all of us, humans. And really, this should be simple for everyone and every thing. This is humanity at work, we can be nice and respectful in the face of adversity, thinks would be be better all around. But maybe that’s the wrong take away. The wrong drive. So let me say this a different way.
## Your Business Is Not Code, It’s You
Read that. Your business is not your code, your product, your output. Your business, every business, is people. If you’re replying to the reviews, you are the face of your product, and if you’re here, I’m assuming your company. One or five people, ten or ten hundred, your company is the face and if you’re the face then how you act, in public, will impact your business more than any one-star review ever will.
## A Final Thought… Don’t Be The Bad Guy
Let me conclude with another true story. There was a plugin that had a troubling user. The user bought the premium upgrade and was disappointed. Nothing worked right. The plugin developers tried to fix it, but were unable. It was an incompatibility between their plugin and another. The user wanted his money back. The developer argued they’d gone above and beyond the call of duty and were not going to refund as per their policy. The user threatened to leave bad reviews if there was no refund and carried through this threat. The developer capitulated BUT *held onto the money* and said they would only refund if the reviews were altered. The user said no and things went even more downhill from there.
## You Can Say No; Defeat Does Not Mean Loss
This is the hardest lesson of all. It’s okay to say no. It’s okay to walk away. It’s okay to tell someone “I’m sorry, but I can’t help you.” or “I’m sorry, but this is against our policy.” This hurts. It makes you feel inadequate and like you’re a faker. You’re not. It’s mathematically impossible to be perfect, so while you should try to be the best you can, it’s okay to concede to defeat. The trick is understanding that defeat, accepting you cannot help everyone, does NOT mean you lose. It doesn’t kill your plugin or theme or business. It teaches you what you can do better next time.
**Categories:** How It Is
**Tags:** essay, plugins, review
---
### [FacetWP: Making Sorting Suck Less](https://halfelf.org/2017/facetwp-making-sorting-suck-less/)
**Published:** April 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using Facet is fascinating.
**Content:**
Sorting data in WordPress is generally done in the most basic of ways. You want to see all posts that are in a specific category, you go to `example.com/category/drinks/` and there you are. But if you want to see everything in the category ‘drinks’ with the tag ‘bourbon’ and the custom taxonomy of ‘ingredients’ and a value of ‘mint’ *AND* ‘simple syrup’ to get the recipe for a mint julep, then you have a pretty crazy complex query.
## Enter FacetWP
[FacetWP](http://facetwp.com/) is a premium plugin that, for $79 a year, handles all that crazy sorting for you. And yes, it’s worth it.
FacetWP introduces advanced filtering to WordPress, which lets you do things like get that list of all drinks made with bourbon that include a simple syrup, in a dynamic way! It’s incredibly fast, since it’s using ajax and javascript, and as long as you have enough server memory to index all the data in the first place, it’s faster than reloading a new category page.
## Downsides
In order to be that fast, you do not get pretty URLs. Let’s say you have your drinks category at `example.com/category/drinks’ and you want to list all those things. Your URL will look like this:
`example.com/category/drinks/?fwp_alcohol=bourbun&fwp_ingredients=simple+syrup%2Cmint`
The realistic reason they don’t try to make it ‘pretty’ is that it would create a lot more rewrite rules than would be sustainable, if you have a lot of facets. The number of checks would slow your site down, and that would kind of suck.
## Compatibility Notes
If you use CMB2 you’ll need [FacetWP + CMB2](https://github.com/FacetWP/facetwp-cmb2).
If you use Genesis themes, there are two tricks. First, you’ll want to use the [following function](https://facetwp.com/integrating-facetwp-with-genesis/) to add FacetWP’s CSS to your theme:
Second, if you’re like me and you use a lot of custom loops, they *may not* behave as expected. If you call the loop multiple times on a page (which is bad behavior in the first place and I know it), FacetWP has a bit of trouble knowing what javascript to apply to what section. That should be expected, and once I cleaned it up, it worked great.
## Should you use it?
If you have a lot of complex intersectional queries to sort through, yes.
If you need dynamic result updates, yes.
It works.
**Categories:** How It Is
**Tags:** facetwp, plugins, review, wordpress
---
### [Review: FacetWP](https://halfelf.org/2017/review-facetwp/)
**Published:** December 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Review: I love FacetWP and so should you.
**Content:**
I’ve been using [FacetWP](https://facetwp.com/?ref=91) since April 2017 and I can unequivocally say that it was one of the best purchases I’ve made.
## Search Is Hard
There’s no two ways around this. Search is difficult. You have to guess what peoples’ intents are, and you have to order the results in a way that is meaningful. While it would be great if people searched for keywords, they prefer to look for things in whole phrases like “jackets made of feathers.” Those are terms and presentations that make sense to the human mind.
On top of that, there are different kinds of search.
Most people are familiar with **document search**, which is more or less what WordPress and Google do. Since webpages are just text documentation at the end, Google searches all the text, figures out how many people link to the page, use some secret dipping sauce, five spices, and determine relevancy. WordPress’ own search is much simpler and consequently less effective. [Not that Google gets it right all the time either, though…](https://www.thoughtspot.com/codex/why-relational-search-harderand-why-we-it)
Another common type of search, also used by Google, is **graph search**. This is popular on Facebook and Twitter, but it uses connections between your friends to prioritize and determine depth of search.
Finally there’s the concept of **faceted search**. This is useful when a site knows you’re looking for a product, like a shoe, and you just need help narrowing down the size, the color, the fit, etc. And that’s where [FacetWP](https://facetwp.com/?ref=91) comes in.
## Facets vs Filters
You might have heard about search ‘filters.’ If you’ve ever used Google’s image search, or news search, and you tried to narrow down results based on dates or colors or formats, you’ve used filters. They help you filter the results by changing the parameters. A faceted search is similar, in that it uses the same concepts as filters to toggle multiple aspects of the search item, giving you even more flexibility in your results.
The term ‘filter’ and ‘facet’ are oft used interchangeably, and since they’re so similar and related, this does not help a single person at all. They both help reduce large data sets into something manageable, but filters are relatively easier than facets. In fact, your WordPress site already does basic filters. Ever gone to a category or tag page? That’s a very basic example of a filter.
## Faceted Search Is Hard
If regular relational searches are hard, it shouldn’t surprise you to hear that faceted search is too. A faceted search has the job of analyzing a large data set and excluding anything that doesn’t fit your specific criteria. This means it uses multiple filters, once for each aspect of the data set.
Okay, let’s make this a little easier to understand with a practical example!
Let’s say you have a database of 750 TV shows. You’ve identified what you feel to be the key components of the shows, such air dates, countries, ratings, specific genres, and if the reviewer liked it. Now, if someone comes to your site and wants a list of crime dramas that aired between 2000 and 2017, in the US, that the reviewer hated, you don’t need filters, you need a faceted search.
By building in options to sort each of those things, you reduce the dimensions of content and offer a structure to help your users understand the contextual construct of the data. You are giving them ideas about what data is available, and how they can search through it without having to guess at keywords.
## FacetWP Does All That
Simply put, [FacetWP](https://facetwp.com/?ref=91) does that.
It does all of that. It even lets me add in a sort-by so once a user has narrowed down the shows, they can reorder them based on name, date added, number of characters, and show ratings. If I wanted to extend that to order based on airdate, I could do that too. People can toggle criteria on and off and the content updates *dynamically*
If you have a large amount of data (like 750 TV shows or 2250 TV characters), and you want to organize them sanely, swiftly, and not crash your server, use FacetWP. It even works with WooCommerce and EDD, so if you want to be the next Amazon, you need this.
**Categories:** How It Is
**Tags:** facetwp, plugins, review
---
### [Small Steps with Composer](https://halfelf.org/2018/small-steps-with-composer/)
**Published:** August 14, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Getting started with Composer sure feels daunting. How about we start small and make something straightforward?
**Content:**
Like a great many people before me, I use composer to manage packages. In my case, I have a WordPress plugin that contains some fairly significant packages that other people have written. They’re libraries, and I have a bit of a love/hate relationship with them. Mostly, I hate keeping them up to date, which is where composer comes in for me.
## Composer?
Composer bills itself as a package manager for PHP. This means it will download all the code you need for your plugins, toss it in a folder (usually called `vendor`) and let you get busy with the coding and not worrying about if your PHP library is out of date.
It’s very similar to [bower, which I’ve been using for a while now](https://halfelf.org/2015/bower-master/), and [grunt, which I sometimes use with bower](https://halfelf.org/2015/updating-bower-grunt/). However unlike those, Composer hooks in to [Packagist](https://packagist.org), which allows you to include pretty much any library with a `composer.json` file to generate your builds. And this is where it gets hairy.
## Conceptualizing Composer
The basics are these: You need a `composer.json` file to tell Composer what to do, and in that file you need to tell Composer what to do. Yep, that’s it. The complications come in with understanding *exactly* what it is you’re trying to do. So let’s start small.
Today, you want to use Composer to update a library, say the AWS SDK for PHP, so you can include it in your plugin. That’s it. Like I said, small. We’re going to assume you’ve written everything else, and you went to the [AWS SDK library on Github](https://github.com/aws/aws-sdk-php) to get the files.
The *old* way would be to download the zip, unzip it, and include it in your PHP code. The new way is is to make a Composer file.
## Constructing Composer
Windows users, you need to download the setup file from [getComposer.org](https://getcomposer.org/download/). Mac/Linux users, I recommend you use the [global install method](https://getcomposer.org/doc/00-intro.md#globally), or if you’re lazy like me, `brew install composer` will get you done.
Now that you have it installed, you need to make your file. There are a [lot of options and possible calls](https://composer.json.jolicode.com) to put in the file. All you **need** is the ‘requires’ section, which literally is going to tell Composer what it requires. I recommend a basic file that lists what it’s for, who wrote it, and what it needs.
Example:
```
{
"name": "example/my-project-name",
"description": "This is a very cool package that uses AWS",
"version": "1.0.0",
"type": "wordpress plugin",
"keywords": ["wordpress", "plugin", "self-hosted"],
"homepage": "https://example.com",
"license": "MIT",
"authors": [
{
"name": "Test Example",
"email": "test@example.com"
},
],
"require": {
"aws/aws-sdk-php": "3.*"
}
}
```
The secret sauce is that teeny requires section at the end, where I say what I want to require and what version. That’s how `composer update` knows what I need.
You can also make the file without that requires section and then tell Composer to include it via command line: `composer require aws/aws-sdk-php` — That will write the line for you.
## Calling Composer
So once you have that and install it and run Composer, how do you get it in WordPress? By default, Composer makes an autoloader file called `autoload.php` – and that will require everything it is you need. That means all you have to do is require that file in your plugin, and you’re done.
What? You wanted more?
## Conclusion
Getting started with Composer isn’t harder than writing a readme, even if it’s formatted pretty weirdly. It can make including large libraries a snap. But don’t worry, you can get really complicated if you want to.
**Categories:** How To
**Tags:** composer, plugins, wordpress
---
### [More Complicated Composition](https://halfelf.org/2018/more-complicated-composition/)
**Published:** August 16, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A slightly more complicated setup for Composer? Why not!
**Content:**
Once you’ve made your basic `composer.json` file and you’ve got your library included, it’s time to consider a more complication situation.
Let’s take the following example. You want to include two plugins/add-ons, a javascript library, oh and one of those plugins doesn’t use Composer. Don’t worry, we can do this.
## Organize Your Notes
Step one is to make a list of what you need to install and where it needs to go. Because in this situation, due to the use of the javascript, we’re *not* going to be using that autoloader.
1. list all your repositories
2. mark which ones do and don’t use Composer
3. determine where they need to go
For this example, we want the javascript files to go in the `assets/js/` folder in our plugin, and we want the plugin/add-ons to go in `plugins/`
Okay, that’s straightforward. But we need to address something.
## Avoid AutoTune
I mentioned we’re not using the autoloader and I cited the javascript as why. That was a partial lie. You see, even though Composer makes an autoload file, and even though it is a dependancy manager, it actually tells you **not** to commit your dependancies to your own repository.
> The general recommendation is **no**. The vendor directory (or wherever your dependencies are installed) should be added to `.gitignore`/`svn:ignore`/etc.
>
> — [Official Composer Documentation](https://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md)
The biggest reason why is one you absolutely will run into here, and it’s that when you add dependancies installed via git to another git repo, they end up as **submodules**, which are a special hell of their own. Only it’s worse. They’re not even really submodules, and you end up with empty folders.
Seriously, I wasted two hours on this when I first ran into it.
But that said, it’s really wise to omit your vendor folder because your plugin *does not* need 3 megs of files if all you want is one javascript file. Right? This means we need to add one more dependancy to Composer, and that’s [Composer Copy File](https://github.com/slowprog/CopyFile).
## Adding The Normal Dependancies
Right now, our requires section looks like this:
```
"require": {
"slowprog/composer-copy-file": "^0.2.1"
}
```
So when you add in your normal dependancies, like the PHP library, you get this:
```
"require": {
"slowprog/composer-copy-file": "^0.2.1",
"example/php-library1": "^1.3"
}
```
You’ll do this for the javascript libraries as well:
```
"require": {
"slowprog/composer-copy-file": "^0.2.1",
"example/php-library1": "^1.3",
"example/js-library1": "^0.2.1",
"example/js-library2": "^2.30"
}
```
## Adding the Weird Stuff
Okay but I mentioned one of the PHP libraries I wanted to use *didn’t* have a `composer.json` file, which means I can’t include it like that. Instead, I have to add this section above the requires section, in order to create a new package to add:
```
"repositories": [
{
"type": "package",
"package": {
"name": "example2/php-library",
"version": "1.0.0",
"source": {
"url": "https://github.com/example2/php-library",
"type": "git",
"reference": "master"
}
}
}
],
```
Right? That’s all kinds of weird, but basically I’m telling Composer that there’s a package called `example2/php-library` and it gets its data from `https://github.com/example2/php-library` – which means I can then add it to my requires like this:
```
"require": {
"slowprog/composer-copy-file": "^0.2.1",
"example/php-library1": "^1.3",
"example/js-library1": "^0.2.1",
"example/js-library2": "^2.30",
"example2/php-library2": "dev-master",
}
```
## Copy Everything
Once you have your files in and required, everything gets put in `vendor` which is great *except* for the part where we’re not going to use the autoloader. In fact, we’re going to add `/vendor/` to our `.gitignore` file to make *sure* we keep our plugin small.
No, we’re going to use that copy code we mentioned above like this:
```
"scripts": {
"post-install-cmd": [
"SlowProg\\CopyFile\\ScriptHandler::copy"
],
"post-update-cmd": [
"SlowProg\\CopyFile\\ScriptHandler::copy"
]
},
"extra" : {
"copy-file": {
"vendor/example/php-library1/": "plugins/php-library1/",
"vendor/example2/php-library2/": "plugins/php-library2/",
"vendor/example/js-library1/dist/js/file.min.js": "assets/js/file.min.js",
"vendor/example/js-library2/dist/js/file2.min.js": "assets/js/file2.min.js"
}
}
```
The first portion triggers a copy every time you install or update the Composer setup, and the section section (in extras) is what runs.
Now you include the libraries in your code like you’d downloaded and copied them, only you don’t have to worry so much about keeping them up to date. As long as you’ve got your composer versions, you’re good to go.
**Categories:** How To
**Tags:** composer, plugins, wordpress
---
### [Genesis: Overriding a Child Theme](https://halfelf.org/2017/genesis-overriding-child-theme/)
**Published:** December 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Changing the credits without editing a child theme is hard, but not impossible.
**Content:**
There are some odd tricks you end up learning when you use [StudioPress’s Genesis Frameworks](http://shareasale.com/r.cfm?b=346200&u=728549&m=28169&urllink=&afftrack=). Since no one actually uses the framework as the theme, we’re all downloading children themes and then editing them.
I have to be honest here, I *hate* editing child themes. That’s why I’ve begun making a [functional plugin to ‘grandchild’](https://halfelf.org/2017/grandchildren-themes/) the themes. There are some subtle differences, however, in how one approaches code for a grandchild vs a child ‘theme,’ and one of them is how the credits work.
## Normal Genesis Overrides Are Simple
At the footer of every page for a StudioPress theme is a credit line. It reads out the year and a link to your theme and Genesis, and done. If you don’t like it, [you can edit it](https://my.studiopress.com/documentation/snippets/footer/customize-the-credits-text/) like this:
If you’re not comfortable with code, I recommend you use the [Genesis Simple Edits](http://wordpress.org/extend/plugins/genesis-simple-edits/) plugin. But …
What happens when your child theme *already* filters the credits?
## Grandchild Genesis Overrides are Not
My child theme includes a filter already, called `CHILDTHEME_footer_creds_filter`, and it’s *not* filterable. That means I can’t just change the add filter line to this:
That’s okay, though, because I knew I could use could use `remove_filter()` to get rid of it like this:
Except that didn’t work. I kicked myself and remembered what the illustrious [Mike Little](https://mikelittle.org/replacing-a-filter-in-a-twenty-twelve-child-theme/) said about how one could replace filters in a theme (he was using Twenty Twelve):
> … your child theme’s functions.php runs before Twenty Twelve’s does. That means that when your call to `remove_filter()` runs, Twenty Twelve hasn’t yet called `add_filter()`. It won’t work because there’s nothing to remove!
Logically, I needed to make sure my filter removal runs *after* the filter is added in the first place. Right? Logical.
## The Credit Removal Solution
Here’s how you do it:
That first `add_action()` is called after the theme is set up. Then it removes the filter I don’t want and adds the one I do.
Done and done.
**Categories:** How To
**Tags:** genesis, studiopress, themes
---
### [Pagination and Static Front Pages](https://halfelf.org/2016/pagination-static-front-pages/)
**Published:** August 12, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Page numbers, pagination, and three lines of code.
**Content:**
This is a post skewed towards the [Genesis Framework](https://helf.us/genesis). Actually, if you’re not using the Genesis [Metro Pro theme](http://www.shareasale.com/r.cfm?b=453419&u=728549&m=28169&urllink=&afftrack=), I don’t know how well this will work.
My problem was simple. I used the [Metro Pro Static Front Page](https://my.studiopress.com/setup/metro-pro-theme/home-page-setup/home-page-layout/) to show some widgets and then custom displays of posts via those widgets. It works pretty darn well and looks like this:
There was just one small issue. It doesn’t show me pagination at the bottom of the page. Oh and the normal method of `example.com/page/2/` just showed me the same front page over and over. Not what I wanted.
One way I could work around this would be to treat the front page as a static front page and make a “blog” page. Except then my urls would be `example.com/blog/page/2` *and* I’d have duplicate content on `example.com/blog/` which is not desirable. Causing me more frustration was the fact that the documentation said this:
> If no widgets are placed in any of the home page specific widget areas, a blog-style home page will be displayed.
What I wanted was that blog-style page on the *sub* pages, along with navigation.
## Show Navigation Links
This part was easy. In the file `front-page.php` I edited the function `function metro_homepage_widgets()` to have this at the bottom:
`genesis_posts_nav();`
Really, that was it. Now I had navigation! But (as I already knew) the navigation didn’t work properly.
## Fix Paged Content
At the top of the `front-page.php` file is a call to add an action with all the `metro_home_genesis_meta` content. I wrapped that in a check to see if the page we’re on is a ‘paged’ page using [`is_paged()`](https://developer.wordpress.org/reference/functions/is_paged/), which specifically checks if the query is for paged result and **not** for the first page.
Again, really, that was it.
**Categories:** How To
**Tags:** genesis, themes, wordpress
---
### [A Fully Functional Alexa Skill](https://halfelf.org/2017/fully-functional-alexa-skill/)
**Published:** June 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A fully functional example of a WP JSON API powered Alexa app. Fork it.
**Content:**
I’ve been talking a lot (a *lot*) about my Amazon Alexa skill.
First of all, it’s done. It’s published and working. [You can check it out on Amazon.com.](https://www.amazon.com/dp/B071SKYP22/)
Secondly, a lot of people are like me and need a real, concrete, working example. So I’ve decided to post the entirety of my Amazon Alexa Skill.
This file, which is actually found on a site in `/lwtv-plugin/rest-api/alexa-skills.php` consists of two endpoints: the flash briefing and the skill. The skill is called “Bury Your Queers” and while I suspect that part of the code is the least ‘useful’ to people, it’s also good to see the real code.
Here, then, is the original approved and certified WordPress code for an Alexa Skill:
## The Code
## Some Explanations
The functions `bury_your_queers` and `bury_your_queers_rest_api_callback` are the important ones. The flash briefing is there because I was tired of Amazon being picky about embedded media in RSS feeds.
The way `bury_your_queers_rest_api_callback` works is it takes the request data to generate the type of request, the intent, and the date information. Then it passes the full request data to `alexa_validate_request` which is the part you’ll really want.
That function, `alexa_validate_request`, is what’s validating that the request came from Amazon, that it’s got a legit certificate from Amazon, and that the request was made in the last 60 seconds. While all those checks kick back an error, the development tools from Amazon *will not* show you them. Yet. I’m hoping they will in the future so we can more easily debug, but it was a lot of blind debugging. Not my favorite.
## Some Custom Code
In the `bury_your_queers` function, I make some calls to other code not included:
- `LWTV_BYQ_JSON::last_death()`
- `LWTV_BYQ_JSON::on_this_day( $this_day )`
Those both reference another rest API class in a different file. What’s important here is not what the data is, but that I’m calling those functions and getting an array back, and using that to fill in my reply. For example, here we have the call for ‘last death’:
From this you can infer that the array kicked back has key for name and died. And in fact, if you look at [the JSON output](https://lezwatchtv.com/wp-json/lwtv/v1/last-death/), you’ll see if has that and a bit more. I’m just extracting what is required. The same is true of the other function, `LWTV_BYQ_JSON::on_this_day`, to which I’m passing a parameter of a date.
**Categories:** How To
**Tags:** alexa, amazon, echo, json, php, wordpress
---
### [Shortcodes Aren't Leaving Us](https://halfelf.org/2018/shortcodes-arent-leaving-us/)
**Published:** September 18, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Don't panic about shortcodes going away. It's not all what you think.
**Content:**
In a recent post, someone asked:
> We have this scenario a lot:
>
> Lorem ipsum some text `[shortcode]affected text[/shortcode]` more text, all within one parapgraph.
>
> How can this be solved with Gutenberg?
Quick answer? It won’t.
Just like `[shortcode]` that outputs a single content, or `[shortcode text="affected text"]`, there will remain a need for singe, inline, in context, shortcode for a while.
I know it’s confusing. This is because there are different kinds of shortcodes for different purposes. Some, yes, will no longer be needed as much.
## Shortcodes for Inline Content
This is the easiest one to understand. Think about videos. Or my example of [inline editable blocks](https://halfelf.org/2018/shortcodes-vs-blocks/#inline-edits). Those are a very clear one to one. If you’re inserting a shortcode (or an embed) on it’s own line today, that will be ‘replaced’ in time with a block.
Embeds are already supported, by the way. If you create your own embeds, they too are automatically blocked.
## Shortcodes for Layout
This is harder to understand, since it’s not fully ready yet. But if you’ve used a plugin or a theme that told you to use a lot of shortcodes to make a two column layout, guess what you’re not going to be doing anymore in the future? That’s right, using shortcodes. Instead, we’re creating listicles, tables, how-to directions and more.
Example of [Yoast SEO’s How To Block](https://yoast.com/content-blocks-future-benefit-seo/) — coming soon. (Credit: [Yoast.com](https://yoast.com/content-blocks-future-benefit-seo/))Their looks a lot better than my basic blocks, but it shows you what we can do and how great we can do it. Those simple and complex layouts will become blocks, where we will be able to actually *see* what it’s supposed to look like. This includes the Gallery shortcode we all know and love.
## Shortcodes for Text Insertion
And finally we have the ‘classic’ block. This is the sort the poster was asking me about. Guess what? Nothing’s going to change with those any time soon. Oh, I’m sure eventually someone will take my inline-editable-block concept and make it so when we add the shortcode, it’ll adjust the text accordingly right before our eyes.
And really, if we look at the concept of `[shortcode]affected text[/shortcode]` we realize how much more we can do already with Gutenberg. What are we affecting the text with? We can already make it **bold**. But can we make it blue? Not *yet*. But I can see this coming soon.
But right now? Those inline shortcodes, in the middle of your block, are staying put.
**Categories:** How It Works
**Tags:** gutenberg, shortcodes, wordpress
---
### [Context is Everything](https://halfelf.org/2018/context-is-everything/)
**Published:** September 13, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It matters not just how we do a thing, but what we do it for and what
**Content:**
In the uptick of automated scans, we come to the place where we realize it’s not just the quality of content that matters in our success, but the context.
## Context in Content
When you write content, the body of your work depends on the literary context of the words. Writing about technology on a non-tech site requires you to step back and explain the tech in a little more detail than you normally might. For example, if I were to post about shortcodes here, I would not bother to give you the history of what they were or why they’re used. I would trust you to know those things, or be ready and able to research them.
By contrast, when writing about code used on a journalism site, and explaining we had a nifty new shortcode to do a thing, I absolutely would take time to explain. I would not expect my readers there, who care about the goings on of television, to understand about the weirdness of a shortcode. At the same time, I may not need to delve into details quite so much. I could just say “We have a new, faster way to add whatever, which will make it easier for us to report on X.”
In short, I consider the audience when I write the content. I write contextually.
## Context in Code
When it comes to writing code, there is a similar mindset. The code should make sense contextually and be consistent. If you’re using underscores for filenames, always use underscores, just to give one example. But this goes further than having a same prefix or formatting (tabs or spaces, eh?). It also means that when data is processed, it should be done so contextually.
If you have a form, and you allow people to enter data to send to you, and that data is saved to a database, you have to sanitize the data. That’s a no-brainer for every developer worth the time of day. Never save unsanitized data, and sanitize as early as possible to minimize the possible damage. But deciding how best to sanitize can be tricky. PHP comes with `stripslashes()` for example, however consider that PHP says this:
> An example use of **stripslashes()** is when the PHP directive magic\_quotes\_gpc is *on* (it was on by default before PHP 5.4), and you aren’t inserting this data into a place (such as a database) that requires escaping. For example, if you’re simply outputting data straight from an HTML form.
In other words, you *shouldn’t* use that to save data. Thankfully in [WordPress](https://developer.wordpress.org/plugins/security/securing-input/) (and [Drupal](https://api.drupal.org/api/drupal/core%21includes%21common.inc/group/sanitization/8.6.x) and everything else) there are many ways to sanitize your inputted data based on … you guessed it, *context*. You don’t sanitize a URL as a plain text field, and you don’t sanitize an HTML form as a filename.
When you write your code, sanitize, validate, and escape it *contextually* based on what it is.
## The Bottom Line: Context Matters
This is the thing that automated checkers can’t quite do. They don’t know what the input is supposed to be unless you tell them, so they can’t verify your sanitization as well as a human can. Even grammar checkers can’t tell you when it’s okay to use slang and when it’s not, when you’re trying to explain a new concept.
In the end? We need humans.
**Categories:** How It Is
**Tags:** development, essay, oped, writing
---
### [Show Feedback in "Right Now"](https://halfelf.org/2018/show-feedback-in-right-now/)
**Published:** September 11, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding Jetpack messages to At a Glance in WordPress isn't all that complicated, and it works out nicely.
**Content:**
The “Right Now” section of the WordPress dashboard is a great way to get an overview of the goings on of your site. But it doesn’t quite list everything. What if you could add things like ‘messages’ to the the “At a Glance” section like this:
Guess what? You can!
## The Code
Presmuing you’re using Jetpack’s contact form module, you automatically get a new kind of post called ‘Feedback.’ In order to make it display it’s count in “At a Glance,” there are two parts. First we add the CSS, which does the styling. Then we add the PHP that counts and displays the number of posts in feedback.
```
add_action( 'dashboard_glance_items', 'helf_dashboard_glance' );
add_action( 'admin_head', 'helf_dashboard_glance_css' );
/*
* Show Feedback in "Right Now"
*/
function helf_dashboard_glance() {
if ( class_exists( 'Jetpack' ) && Jetpack::is_module_active( 'contact-form' ) ) {
foreach ( array( 'feedback' ) as $post_type ) {
$num_posts = wp_count_posts( $post_type );
$count_posts = ( isset( $num_posts->publish ) ) ? $num_posts->publish : '0';
if ( 0 !== $count_posts ) {
if ( 'feedback' === $post_type ) {
// translators: %s is the number of messages
$text = _n( '%s Message', '%s Messages', $count_posts );
}
$text = sprintf( $text, number_format_i18n( $count_posts ) );
printf( '%2$s', esc_attr( $post_type ), wp_kses_post( $text ) );
}
}
}
}
/*
* Custom Icon for Feedback in "Right Now"
*/
function helf_dashboard_glance_css() {
if ( class_exists( 'Jetpack' ) && Jetpack::is_module_active( 'contact-form' ) ) {
?>
**Categories:** How To
**Tags:** jetpack, wordpress
---
### [Selective DeGutenberging](https://halfelf.org/2018/selective-degutenberging/)
**Published:** September 6, 2018
**Author:** Ipstenu (Mika Epstein)
**Content:**
Okay let’s be honest, friends. Not *everything* is ready for Gutenberg. In fact, I myself have certain sites that aren’t ready for it today. That’s why there exists an excellent plugin known as the [Classic Editor](https://wordpress.org/plugins/classic-editor/). This allows you to decide it you want to block Gutenberg (which is the default option) or if you want to allow users to chose between Gutenberg and Classic editors.
But what if you want to go a step *further*?
What if you want to have Gutenberg on by default for posts and pages, but *not* for a custom post type?
Don’t worry. We can do that.
## The Code
The basic idea is that if WP is 5.0 or higher, make sure that the Classic Editor is installed. If it’s less than 5.0, make sure Gutenberg is installed. Then block the code as needed:
```
class HELF_Gutenberg {
public $gutenfree = array();
public function __construct() {
$this->gutenfree = array( 'post_type_ONE', 'post_type_TWO', 'post_type_THREE' );
add_action( 'current_screen', array( $this, 'gutenberg_removal' ) );
}
public function gutenberg_removal() {
// WP 5.0+ requires Classic Editor
// WP 4.9- requires Gutenberg
if ( ( version_compare( get_bloginfo( 'version' ), 5.0, '' ) && ! is_plugin_active( 'classic-editor/classic-editor.php' ) ) ) {
return;
}
// Intercept Post Type
$current_screen = get_current_screen();
$current_post_type = $current_screen->post_type;
// If this is one of our custom post types, we don't gutenize
if ( in_array( $current_post_type, $this->gutenfree, true ) ) {
remove_filter( 'replace_editor', 'gutenberg_init' );
remove_action( 'load-post.php', 'gutenberg_intercept_edit_post' );
remove_action( 'load-post-new.php', 'gutenberg_intercept_post_new' );
remove_action( 'admin_init', 'gutenberg_add_edit_link_filters' );
remove_filter( 'admin_url', 'gutenberg_modify_add_new_button_url' );
remove_action( 'admin_print_scripts-edit.php', 'gutenberg_replace_default_add_new_button' );
remove_action( 'admin_enqueue_scripts', 'gutenberg_editor_scripts_and_styles' );
remove_filter( 'screen_options_show_screen', '__return_false' );
}
}
}
new HELF_Gutenberg();
```
**Categories:** How To
**Tags:** classic editor, gutenberg, wordpress
---
### [Shortcodes vs Blocks](https://halfelf.org/2018/shortcodes-vs-blocks/)
**Published:** September 4, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Thinking about blocks vs shortcodes and what's coming next.
**Content:**
One of the things that Gutenberg changes for everyone is the concept of shortcodes not being absolutely necessary anymore.
## Shortcodes Today
One of the nice things about WordPress is that we can use shortcodes to insert dynamic content into our posts. For example, I could use `[ copyright ]` and have it echo © 2026. And when you have inline dynamism, that works great.
One of the other cool things you can do is to have an embed like `[ embed height="400" width="600"]...[/embed ]` to embed a video:
Yes, you could just paste in the video URL, but this is a demonstration of a shortcode as a sort of block. And speaking of blocks…
## Blocks Tomorrow
In Gutenberg (which this post was written with), you can keep using in-line shortcodes and even add a shortcode as a block:
To a degree, that works well. But there are other options with Gutenberg.
### Sidebar Edits
First, you can see this in a normal paragraph block. Adding options to the sidebar:
This allows you to edit the various options on the right sidebar and, thus, change the customizable aspects of the block. For many shortcodes, you can keep that interface and have everything be perfectly functional. Have a block that shows user information? Put a dropdown for the users on the sidebar, and so on.
### Inline Edits
The other options is an integrated block. For example, here’s my example of a review block, with text fields and dropdowns to allow you to edit in situ.
In my opinion, this is a more fluid interface, as you can see example what you’re doing and what it’s going to look like.
## How Will You Use The Future?
There are still hurdles to overcome with Gutenberg, but as we step forward, we’re getting a better look at an integrated editor that gives you a lot of that desired ‘What you see is what you get’ experience.
**Categories:** How It Works
**Tags:** gutenberg, wordpress
---
### [Gutenberg Spoiler Blocks Redux](https://halfelf.org/2018/gutenberg-spoiler-blocks-redux/)
**Published:** August 30, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Another version of a repeatable spoiler block with Gutenberg.
**Content:**
While I did write up [Spoiler Blocks for Gutenberg one way](https://halfelf.org/2018/slightly-complex-sample-box-spoilers/), I also sat down recently and rewrote it a little cleaner. The primary difference here is how I’m *properly* using defaults:
## The Code
```
( function( blocks, element, editor, components ) {
const { registerBlockType } = blocks;
const { RichText } = editor;
const { createElement } = element;
const { InspectorControls } = editor;
const { SelectControl, ToggleControl } = components;
registerBlockType( 'library/spoilers', {
title: __( 'Spoiler Warning' ),
icon: 'vault',
category: 'halfelf',
customClassName: false,
className: false,
attributes: {
content: {
source: 'children',
selector: 'div',
default: 'Warning: This post contains spoilers!'
}
},
save: function( props ) {
const content = props.attributes.content;
const container = createElement(
'div', { className: 'alert alert-danger' },
React.createElement( RichText.Content, { value: content })
);
return container;
},
edit: function( props ) {
const content = props.attributes.content;
const focus = props.focus;
function onChangeSpoiler( newContent ) {
props.setAttributes( { content: newContent } );
}
const editSpoiler = createElement(
RichText,
{
tagName: 'div',
className: props.className,
onChange: onChangeSpoiler,
value: content,
focus: focus,
onFocus: props.setFocus,
}
);
return createElement(
'div', { className: 'alert alert-danger' },
editSpoiler
);
},
});
})(
window.wp.blocks,
window.wp.element,
window.wp.editor,
window.wp.components,
window.wp.i18n
);
```
Learning more and more about Gutenberg, and javascript, I’ve been able to iterate on the existing code and keep improving.
**Categories:** How To
**Tags:** gutenberg, javascript, wordpress
---
### [Gutenberg Categories](https://halfelf.org/2018/gutenberg-categories/)
**Published:** August 28, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Want to make your own category for Gutenberg Blocks? You can!
**Content:**
No, this isn’t something snazzy about doing cool things with categories within Gutenberg (although you could). This is about making a section for your own blocks. A category.
## What’s a Category?
I’m incredibly lazy, so when I use blocks, I type `/head` and make sure I get the right block, hit enter, and keep on typing.
But. Sometimes I think I need a specific block and I don’t know the name, so I click on the circle + sign and I get a list of categories!
You won’t see reusable if you didn’t make some, but the point is that you could make a custom category for your custom blocks.
## Show me the code!
Glad you asked! You’re gonna love this one.
```
add_filter( 'block_categories', function( $categories, $post ) {
return array_merge(
$categories,
array(
array(
'slug' => 'halfelf',
'title' => 'Half-Elf',
),
)
);
}, 10, 2 );
```
Yep. That’s it! It’s an array, so you can add more and more and more as you want. Don’t go too wild, though, or you’ll make it too long.
**Categories:** How To
**Tags:** coding, development, gutenberg, wordpress
---
### [Advanced Block Behaviour](https://halfelf.org/2018/advanced-block-behaviour/)
**Published:** August 23, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some more extra things with Gutenberg that are on the wild side of advanced.
**Content:**
Making a straight forward block to insert content in Gutenberg is (relatively) easy. I hate using the word ‘easy’ here, because in order to do it you will need to master a whole new world of coding, but all things considered, yes. It is easy. In fact, Gary (aka Pento) wrote a sample plugin that will let you [convert a shortcode to a Gutenberg Block](https://gist.github.com/pento/cf38fd73ce0f13fcf0f0ae7d6c4b685d).
I myself have written a mildly complicated Spoiler Block (there’s a new version of it I will share soon). But then the day happened that my cohort in lesbian TV crime, Tracy, expressed annoyance at how Gutenberg destroyed her listicle.
## What is a Listicle?
Have you seen those posts that show you the top ten ways to LifeHack your used egg cartons? Those are listicles. They’re lists (*list*) articles (*icle*). Makes sense, right? Listicles have a pretty basic format as well, there will be a header with some sort of numerical mark, then content with images etc. This repeats for the number of times you have an article.
Most people make them by hand by manually editing the numbers in their header. That’s all well and good until you want to craft better formatting and have a listicle look somehow ‘different’ from the rest of your content. Maybe you want them to have a special background color, or a different design for the header.
If we were doing this in the old, simple, HTML way, it would look like this:
```
The Title
The Content
```
Of course that doesn’t make anything look like a list until you put in some CSS magic:
```
.listicle {
counter-reset: listicle-counter;
}
.listicle dt:before {
content: counter(listicle-counter);
counter-increment: listicle-counter;
margin-right: 6px;
}
```
What this does is create a CSS counter and increment it every time you use `` creating an auto incrementing list.
## No HTML for Gutenberg
Now, if you know the HTML, you can still do this in Gutenberg in HTML by using the HTML block.
Example of summoning the Custom HTML block.But if you *don’t* know HTML, then this is a bloody nightmare to handle. And part of the reason why I’m very pro-Gutenberg is that it’s 2018, and expecting people to know all the myriad magical steps of HTML, in order to create a webpage, feels passé. No, it feels restrictive. We can’t expect websites to advance and become more than just pages if we don’t give them the tools.
## Complex Design
Unlike the relatively simple javascript I used to make my Spoiler Box block, to do this requires the use of a feature called ‘[Inner Blocks](https://github.com/WordPress/gutenberg/blob/master/packages/editor/src/components/inner-blocks/README.md)‘ which is effectively putting a block inside a block.
My original idea was to have a multiple nested block with the following:
1. Listicle Block that calls a template of a list item
2. ListItem block that calls a title and description
3. ListDT block that calls the title
4. ListDD block that allows you to add whatever more inner blocks you want
It sounds incredibly complicated, and sadly the perfect version was so difficult I actually started with a pared down version.
1. Listicle block that sets up a template of title and description
The problem here is that I end up having a separate `dl` for each block. I can work around it with some CSS magic, but it’s not perfect. So I knuckled down and actually wrote the code that does exactly what I want. Whew.
## Some Code
… Actually I’m going to do something I hate and that’s link to an external directory.
I’ve build out [Listicles for Gutenberg](https://github.com/Ipstenu/listicles-gutenberg) for you to peruse and fork and enjoy. Or even use if you want, becuase it does work. But it’s big. No, it’s *huge* for an in-post example. And to explain everything line by line wouldn’t help.
If you go to the repository, the Gutenberg source code is located in `/src/` – that’s where most (if not all) of your work will happen.
- `blocks.js` – A list of all the separate JS files included
- `/block/listicle.js` – The main listicle file
- `/block/listitem.js` – Individual list items (this is only usable inside the Listicles block)
- `/block/listdt.js` – The list title
- `/block/listdd.js` – The list content (this allows you to add as many sub blocks as you can)
And yes, not only does it auto increment as you move the slider (or bump the counter), you can flip it into reverse mode:
The real trick of it all was the copious use of templates.
## It’s all Complicated
Besides the fact that the blocks aren’t *quite* where I want them to be, I also have to use a block builder to convert that javascript into my real files. I chose the [Create Guten Block](https://github.com/ahmadawais/create-guten-block/) builder, instead of building out my own NPM build script.
That too illustrates some of the concerns people have, and rightly so, about blocks being incredibly more complicated than they need to be. And yet, having gone through the exercise myself, I think that it’s perhaps not going to be that much of a drama.
For those of use who generally just make new shortcodes, the world won’t change too much. Gutenberg [supports inline shortcodes](https://github.com/WordPress/gutenberg/pull/6329), after all, which is the majority of what people need from it. We want to be able to make our own embed blocks, which again isn’t terrible, and when someone gets to the complicated point of needing something advanced like a listicle, well eventually there will be a plugin that will handle this better than a shortcode.
Or you could just use that HTML block.
**Categories:** How To
**Tags:** gutenberg, javascript, wordpress
---
### [Post Editing Is Broken](https://halfelf.org/2018/post-editing-is-broken/)
**Published:** August 21, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Today, the editor is broken and we need a revolution to correct it.
**Content:**
By now I’m sure most of you have seen Gutenberg. And I’m sure you all have a lot of opinions about Gutenberg and why it’s absolutely not needed. You may also have read conversation about how we totally need Gutenberg, and it’s [part of the long view of the future](https://pento.net/2018/08/06/wordpress-gutenberg-the-long-view/).
I’m going to tell you something that may be difficult to accept.
We need Gutenberg because post editing is broken.
## The Visual Editor is Limited
The current visual editor, which uses TinyMCE, is incredibly limited. It’s awesome, as you can make a WYSIMWYG (What you see is *mostly* what you get) post, but it can be really hard to get layout and design flow to look ‘right.’ And if you want to insert custom content, you’re left using embeds or shortcodes.
I love shortcodes. But. They’re weird and complicated and no two work exactly the same way. People don’t always document them, they’re *not* discoverable, and they can be incredibly obscure to use. Which ones take input and which are nested and so on.
This means that advanced customization of post content is left to templating engines in those page-builder plugins, which either have to re-jigger the whole screen (like Gutenberg) or utilize a complex nesting of shortcodes (like that other plugin you’re thinking about). Neither is a great experience for users, especially when no two page builders work the same way.
## The HTML Editor is Cryptic
If you’re not a developer or someone who read the original HTML 2.0 spec book (hardcover, y’all), then HTML may be a beast you don’t understand. It’s complicated, it has a lot of weird quirks, and you’ll hear people tell you to use tables (or not), or use divs (or not), or only troglodytes use spans and colors.
Basically it’s confusing unless you know HTML, and that means if you’re *not* an advanced user or a designer/developer, you’re screwed. You’re expected to learn a whole new suite of complex arcana just to make a table with today’s WordPress. Or you use a plugin and then you find out the semantic HTML it used was problematic, and you have no idea how to fix it.
Anyone who supports end-users who know MS Word and not WordPress have dealt with this drama. It’s real, and WordPress is still struggling to address it. Which is why we have Gutenberg in the pipeline.
## Gutenberg Isn’t Perfect
None of this is to say that Gutenberg is perfect. I’ve had experiences with exactly how hard it is to wrangle. Building new blocks is crazy hard if you’re not using simple reusable blocks like my favourite spoiler block:
If you want to make a complicated nested block it’s frustrating. You have to decide what flavour of Javascript you want to use and how to build it. Let’s be honest here, folks, it’s tough to be a developer in this new land.
And as a user it’s no picnic either. It’s a lot of change and kicking yourself out of old habits and into embracing the new. Which we’re all generally terrible at. You have to shift from a fundamental concept of “Big Chunk of Content” and into “Smaller Blocks of Content.” Meta boxes and data like we add with ACF and CMB2 isn’t perfect yet either. Heck, I can’t even customize my Jetpack sharing with Gutenberg yet.
But. As we use Gutenberg and as we inch forward, we start to see the progress. I can still insert tables via HTML *inside* a Gutenberg post. I can build (or hire someone to have built) a block to tweak things to my heart’s content. Things may be hard, but they’re possible.
## You Must Break a Bone to Set It
When I was 11, I broke my arm. And I remember the feeling of abject horror when the doctor told me they’d have to break my arm again in order to set it. I used some language they’d never heard from a child my age. And it hurt like hell. It was the most pain I’d been in my young life.
My arm never worked the ‘same’ way afterwards either. Oh sure, I could do pretty much everything, but I had to compensate and learn new ways to do other things. I don’t have full rotation in my wrist still, though it’s much better, which meant I had to change how I did certain motions. Like typing, that hand rarely rests on the keyboard. In short, I had to adapt.
The current editor is imperfect and broken. In order to fix it, we must shatter it and move forward. It hurts, it’s a struggle, but if we push each other, we can do this. Continue to criticize the things that are missing ([not being able to hide taxonomies from use](https://github.com/WordPress/gutenberg/issues/6912), for example), but do so in a way to help it forward.
**Categories:** How It Is
**Tags:** essay, gutenberg, oped, wordpress
---
### [cPanel ❤️ DreamObjects](https://halfelf.org/2018/cpanel-❤️-dreamobjects/)
**Published:** August 2, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Backups aren't impossible anymore.
**Content:**
This is something I’ve wanted for a long time. I [opened a ticket with cPanel about it yonks ago](https://features.cpanel.net/topic/ceph-backups) as Ceph storage is offered by more than just Amazon, and yet cPanel was making it super hard to use for backups.
Well in the next release of cPanel, this will no longer be the case! If you’re on version 74 (which is in release stage, but not current, so most people do not have it yet) you can do this.
## Add A New Backup Option
Go to Home > Backups and open up the settings.
In there, you can add a new Backup option. Pick **S3 Compatible**:
## Configure for DreamObjects
Now just throw in the right data:
You’ll want to use `objects-us-east1.dream.io` for the endpoint, and then your bucket and keys.
## Back it Up
And with that you’re done. Thank you, cPanel!
**Categories:** How To
**Tags:** backup, cpanel, dreamobjects
---
### [Recording Phone Conversations](https://halfelf.org/2018/recording-phone-conversations/)
**Published:** July 31, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to record a phone call on an iPhone. Legally and safely.
**Content:**
If you have an iPhone, it’s annoying hard to record phone conversations these days. In Apple’s defence, that would be because it’s *illegal* to record someone without their consent in many places and, let’s face it, expecting users to know what the law is everywhere is pretty unlikely.
Still, I had the case where I needed to record someone’s phone conversation, with their consent, for an article I was working on. And while I thought of a bunch of solutions like [Audacity](https://www.audacityteam.org) and [Skype](https://skype.com), I hit a wall when they said they could *only* use the phone.
Well now it’s on to a hardware solution.
## What You Need
The basic solution is to connect your phone to an external recording device. This is not exactly simple, as it isn’t ‘just’ plugging your phone into a recorder and pressing go. To do this with an iPhone you need:
1. [an iPhone/headphone adapter](https://www.amazon.com/gp/product/B078XHHQ8P/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B078XHHQ8P&linkId=13cf52284b9dd6681e721fd70af8b6dc) – I recommend one that allows you to use a power adapter while you’re on the phone. In case the call goes long.
2. [a male/male mono stereo cable that can convert 3.5mm to 1/4″](https://www.amazon.com/gp/product/B000068O3F/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B000068O3F&linkId=e4936e28e2ee2b6862f621f986c1a4f4) – Alternatively you can get a [3.5mm cable](https://www.amazon.com/gp/product/B001O5J47U/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B001O5J47U&linkId=90b0a6cdb08d808552f437bedc650b06) and a [1/4″ adapter](https://www.amazon.com/gp/product/B000068O3U/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B000068O3U&linkId=128429d84213c3ed67959c64996c74c2).
3. [a decent XLR microphone](https://www.amazon.com/gp/product/B00X87FAOI/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B00X87FAOI&linkId=5d3dddb962966b2fe62f109656d4aab9) – I prefer a lav mic (the kind you clip on) but if you want a handheld, go for it.
4. headphones – You probably have these already. The regular 3.5mm ones.
5. a recorder like a [Zoom H4n](https://www.amazon.com/gp/product/B01DPOXS8I/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B01DPOXS8I&linkId=170d6271b40990a6550cbf154a45fa97) or a [Tascam DR-40](https://www.amazon.com/gp/product/B005NACC6M/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B005NACC6M&linkId=9dc498a636fa90125de10ddb533bf7e4) – It must have at *least* four input channels. The ones that have ‘two’ channels don’t allow you to plug in the phone or mic.
There’s no software needed here, because that recorder saves to an SD card, so you’re going to be able to use that directly. I do recommend a power adapter for your recorder, as the XLR mic will be using power from the recorder and you don’t want it crapping out.
## Putting it Together
The connection method (which you can see on my setup above) is as follows:
1. headphones in so I can hear everything
2. lav mic so people can hear me
3. 1/4″ to 3.5mm adapter
4. 3.5mm male/male cord
5. 3.5mm to iPhone adapter
When someone calls, I answer, make sure they’re okay with being recorded, and off I go.
## Gotchas
There are a couple things to keep an eye on that *will* trip you up.
First of all, you *must* use a mono cable from your phone to the recorder. Stereo will make a weird buzzing sound.
Next, I recommend plugging in everything (including the recorder) because the XLR mic uses phantom power.
Make *sure* you set up your recorder to use input 1/2 as your input. By default, mine is set to ‘mic’ which is the two channel microphone on the top of the recorder. Using that won’t do you any good at all.
And finally? Even if you live in a one-side-consent state (all US states **except** 12 have this, which includes my current of California so yes, I have to ask for consent first), please please please remember to ask the person *before* you press record.
**Categories:** How To
**Tags:** audio, hardware, recording
---
### [Do Robots Dream of Electric Smut?](https://halfelf.org/2018/do-robots-dream-of-electric-smut/)
**Published:** August 7, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** "I'll know it when I see it" works for humans, but not robots.
**Content:**
In July of 2018, I was informed by Google Adsense that specific content on my site was going to have “restricted ad serving” and I needed to go to the policy centre on Adsense to find out why. There was no link to this centre, by the way, and it took me a while to figure out I went to Adsense > Settings > Policy where I saw this:
Yes, that image says that the post about [Legitimate Porn Plugins](https://halfelf.org/2012/legitimate-porn-plugins/) was deemed to be sexual content. My guess is that they don’t like the image, because my post about how [GPL says Porn is Okay](https://halfelf.org/2011/gpl-freedoms-porn-is-good/) did not get flagged.
My friend pointed out that it was ridiculously damaging to moderate content (or at least in this case, revenue) by “casting a wide net based solely on the presence of key words” and she’s quite right. Now I did attempt to get Google to reconsider, but like my past experiences with their censorship and draconian view, they don’t give a damn if you aren’t ‘big.’ And even then, important people get slapped by Google all the time.
## History? What History?
In 1964, there was a landmark case in the US, Jacobellis vs Ohio, about whether the state of Ohio could, consistent with the First Amendment, ban the showing of the Louis Malle film *The Lovers* (*Les Amants*), which the state had deemed obscene. During that case, and the reason it became so well known, was not the content matter.
In fact, the decision remained quite fragmented until 1973 Miller v. California decision in which it was declared that to be smut (i.e. obscene) it must be utterly without redeeming social importance. The SLAPS test addresses this with a check for “serious literary, artistic, political, or scientific value” – and yes, the acronym is hilarious.
No, everyone knows about the first case because of the following quote by Justice Potter Stewart:
> I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that.
## Tea, Earl Grey, Hot
When I was very young, maybe six, my father did a talk about artificial intelligence with a slide of Captain Kirk ordering things from the ship’s computer. It stuck with me, which Dad finds amusing, and I’ve often reflected back on it as an understanding of what an AI can and cannot do.
The ship’s computer on *Star Trek* can do a great many things, but it cannot make ‘decisions’ for a person. In the end, a human always has to decide what to do with the variables, what they mean, and how they should be used. Kirk has to ask the computer to chill the wine, for example, and if he doesn’t specify a temperature, the computer will go back to what some other human (or more likely Mr. Spock) has determined is the optimal temperature.
AIs don’t exist. Even as useful as I find digital assistants like Siri and Alexa, I know they aren’t intelligent and they cannot make decisions. They can follow complex if/then/else patterns, but they lack the ability to make innovation. What happens if Kirk just asks for ‘white wine, chilled’? What vintage will he receive? What temperature?
To a degree, this is addressed with how Captain Picard orders his tea. “Tea, Earl Grey, hot.” But someone had to teach the system what ‘hot’ meant and what it meant to *Jean-Luc* and not Riker, who probably never drank any tea. Still, Picard has learned to specify that he wants Earl Grey tea, and he wants it hot. There’s probably some poor tech boffin in the belly of Starfleet who had to enter the optimum temperatures for each type of tea. Certainly my electric kettle has a button for ‘black tea’ but it also tells me that’s 174 degrees Fahrenheit.
## Automation Limitations
My end result with Google was that I had to set up that specific page to not show ads. Ever. Because Google refused to get a human to take a look and go “Oh, its the image, remove that and you’re fine.” But even then a human could look at the image, recognize it’s not pornography, and flag it as clean.
What we have is a limitation in the system, where in there is no human checking, which results in me getting annoyed, and Google being a monolithic annoyance. Basically, Google has automated the system to their specifications, and then instead of putting humans on the front lines to validate, they let it go.
This makes sense from a business perspective, if you’re as big as Google at least. It costs less. But we’ve all read stories about people [getting locked out of their Google accounts, for a month or more](https://techcrunch.com/2017/12/22/that-time-i-got-locked-out-of-my-google-account-for-a-month/), and facing drama because there’s no way to get in touch with a human being.
## The Heart of It All is Humans
And that’s really the heart of the problem.
Have you ever visited a forum or a chat site and it’s full of people acting like decent people to each other? Humans did that. A human sat down, purged the site of the vile content, and had to sit and read it to be sure. They pushed back on trolls and other problematic people, all to help you.
Don’t believe me? Okay, do you remember the WordPress plugin WangGuard by José Conti? He shut the service down in 2017 because it was giving him a mental break down. The plugin worked so well because he, a human being, evaluated content.
> WangGuard worked in two different ways, one an algorithm that had been perfecting for 7 years, and that was perfecting as the sploggers evolved, so it was always ahead of them. And a second part that was human, in which I reviewed many things, and among them sploggers websites to see their content, improve the algorithm and make sure that it worked correctly both when a site was blocked and not it was. The great secret of WangGuard, was this second part, without this second part, WangGuard would not have become what it was.
>
> José Conti – [The True Reason for the Closure of WangGuard](https://www.joseconti.com/2017/07/03/la-verdadera-razon-del-cierre-wangguard/)
Basically, Conti gave himself PTSD trying to make the internet a better place.
Because the absolute only way to make sure something was evil was to look at it. And the only way to make sure something is porn is to look at it.
An AI can’t do that yet.
**Categories:** How It Is
**Tags:** censorship, ethics, google, oped
---
### [Disable Google Ads on One Page](https://halfelf.org/2018/disable-google-ads-on-one-page/)
**Published:** August 9, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** So you've given up on whitelisting your page with Google ads and want to get that one page out of the way?
**Content:**
After my adventures with Google telling me I was hosting adult content (again, this is actually my third go-round with them), I’m here to inform you that you can now block Google Ads on one page only.
## Add a URL Channel
First you have to tell Google what your URLs are that you want to treat differently. For that, we’ll use a URL channel which you can find at My Ads > Content > URL Channels. Now, you only get 500 of these, which means you can only flag 500 unique URLs as … well … unique.
You may notice, no wildcards. So I can add `halfelf.org/2012/legitimate-porn-plugins/` but not `halfelf.org/.*/.*[porn].*/` which would be pretty cool. Once you’ve added your URL, you’ll see it like this:
## Edit Ad Settings
I’m using [Auto Ads](http://auto%20ads) because I’m incurably lazy, as my friend Syed knows. So I go to My Ads > Auto Ads, but if you were using specific units, you’d go to My Ads > Ad Units. There you go to the **Advanced URL Settings** section and click on the add button for a new URL Group.
This brings you to a page where you can select the URLs for this group.
When you’ve picked all your URLs (and yes you can add more later), click next and you’ll get a list of all the possible ad units. *Uncheck them all*. That’s the point of this, right? Finally you’ll review the group and give it a name. I picked “No Ads” since that’s what this was.
## Annoyances
1. You have to add in each URL one at a time
2. There’s no wildcards or regex
3. You only get 500 urls
4. You still can’t talk to a human
All in all, it’s another day with Google.
**Categories:** How To
**Tags:** ads, adsense, google
---
### [You'll Probably be Fine with Gutenberg](https://halfelf.org/2018/youll-probably-be-fine-with-gutenberg/)
**Published:** July 26, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You're probably going to be just fine with Gutenberg.
**Content:**
With WordPress 5.0 getting closer and closer, I know a lot of people are worried about Gutenberg and what that will mean for their themes and plugins.
## Most Themes Will Be Fine
The majority of themes, every single one you can download from WordPress.org, and the ones from reputable theme shops like StudioPress, will be just fine. Nothing will break, and other than getting a new editor experience, there’s no change.
What will happen, and yes people will call this breaking, is that not all features will be *supported*.
Right now, most themes *don’t* support some of the more outré block types. And a lot of themes don’t support text columns like this:
And then again, Genesis? Does!
This is a left column
This is a right column
And every theme is going to support [repeatable blocks](https://halfelf.org/2018/you-dont-need-a-block/) which means you’ll be able to build out some nice defaults and standards.
The reason for all this is that if you’re just using Gutenberg as an editor, not a whole lot has changed with your *content*. It remains the same as it ever was, just with a fresh coat of paint.
There *are* exceptions, like themes that rely heavily on features that alter the post editor. I’ll get there in a minute.
## Most Plugins Will be Fine, Too
Here again, unless your plugin interest with the post editor, you are going to be *just fine*. You use Jetpack to publicize your posts? Cool. No change. AMP? No change. Go look at most of your plugins. Caching? No changes. Google Analytics? No change.
The reason here is, again, *most* plugins don’t mess with post editing. I should know. I review them.
I know what you’re thinking, though. What about plugins like Yoast SEO, which add in a bunch of extra boxes at the bottom and sides of a post? The boxes are called Meta Boxes, and they’re already supported. Plus Yoast went to the extra effort of being on the forefront of Gutenberging.
The colours to indicate how good your post’s SEO is, however, are missing right now. So is the field to customize your Jetpack publicize content. Basically everything that went on that sidebar on the post edit screen (the Publish Box) isn’t done yet.
Which brings me to…
## The Exceptions Will Hurt
Okay. I won’t sugar coat this. If you use a complex post editor, like Visual Composer or Bold Grid, or if you use a plugin with a lot of custom meta boxes, the world will be *very* different, and probably unhappy.
Now that said, [Visual Composer *will* work with Gutenberg](https://visualcomposer.io/docs/content-elements-structure/gutenberg-element/)! And so will ACF and CMB2 is well on it’s way. But. The problem is people who have *bundled* those plugins in their themes. And those themes will have to update their packages *and* make sure users update.
Anyone who just had a mental image of how many premium themes bundle Visual Composer and tried to calculate the number of users who *don’t* properly update themes regularly… welcome to my world. I’d like to say I’m ‘against’ the bundle, but the reality is that I’m against premium products using libraries and then not managing those libraries properly. Not that it’s easy, and that’s a different topic.
The problem in the exception is that there will be a non-insignificant number of people who have no idea they’re using a problematic library that needs an update.
## Where Do We Go From Here?
This problem is WordPress’ own doing, make no mistake. If the ability to add custom meta boxes and settings and the like was less complicated to begin with, we wouldn’t have needed tools like these to work around it. We still have no decent meta box API, and the settings API is something I regularly call “as intelligent as a bag of wet hair.”
But. Innovation is necessary. We can’t just *not* move forward because we didn’t do things right the first time. And in WordPress’ defence, there was no way to know or even write the ‘right’ way back 15 years ago when all this started. The best tools didn’t exist. And all those ways we built to hack around the problem made it more clear what the right way needed to be.
Which brings us here.
Most of what you do won’t be impacted by Gutenberg. What is adversely impacted won’t break most things, but it will be really annoying. And then those rare edge case exceptions? Well. We’re back to the words (paraphrased) of [Hecht](https://halfelf.org/2011/failure-of-imagination/).
When infrequently used systems break, they do so in big ways.
**Categories:** How It Is
**Tags:** gutenberg, wordpress
---
### [Hashtag your Jetpack with Taxonomies](https://halfelf.org/2018/hashtag-your-jetpack-with-taxonomies/)
**Published:** July 24, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A different way to customize your hashtags.
**Content:**
So maybe you read my post about hash tagging Jetpack Publisher posts with a complex check of “Is this tag *also* a custom post type?” and you thought “Mika, that’s awesome. But I don’t have a database of shows!”
To my reporter friend who lamented this to me, I have a solution.
## The Real Problem
I think most of the problem with Jetpack’s custom Publicize message is that it’s (rightly) hidden by default. *Most* people don’t need it. But those that do want to *see it* so we remember “and do this…”
And let’s be honest, this visibility issue is going to be *worse* when we move to Gutenberg.
Again, I don’t think Jetpack is in the wrong here. The majority of users don’t need to be so aggro about their messages. There are a lot of WordPress sites that we would classify as ‘smaller’ sites. And those who aren’t tend to need very bespoke/custom solutions, which is the problem.
My solution works for me because it’s easily automated and checkable. We’re very pedantic about tags (seriously, Tracy went through all our tags and cleaned them up), we have a great system to match tag to show, and, most significantly, we know that our social media engagement relies on not just content, but the *appropriate* hashtags. That is, the shows we’re talking about.
This means there are two types of ways to do this:
1\) Make *all* your tags (and/or categories) into your hashtags
2\) Make a custom taxonomy for your hashtags
Since using *all* the tags might be a bit much, I went with option 2.
## The Code
## A Little Explanation
You may notice I added in a bit that looks for a specific category:
The reason here is that on the specific site I wrote this for, they have four (yes four!) categories:
1\) Announcements
2\) News
3\) Fandom (actually named FOR the fandom)
4\) Miscellaneous
They wanted item #3 to be a tag, so it would always `#JanelleMonae` (for example). For them I did a super basic ‘if the fandom, then the hashtag’ but a slightly more common situation would be someone having a category for ‘Fandoms’ and then *subcategories* our fandom. For that you’ll want something like this:
Enjoy your hash tagging!
**Categories:** How It Is
**Tags:** jetpack, wordpress
---
### [Hashtag Your Jetpack with Custom Post Types](https://halfelf.org/2018/hashtag-your-jetpack/)
**Published:** July 19, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Want to put a hashtag on your Jetpack'd tweets? You can do it with a little magic.
**Content:**
The brunt of this code comes from Jeremy Herve, who was explaining to someone how to [add Category hashtags prefixed to Jetpack Publicize tweets](https://gist.github.com/jeherve/7990726).
That is, someone wanted to take a category for a post (say ‘How To’) and convert that into a hashtag (say `#howto`).
I too wanted to do this, but like my [weirdly related posts](https://halfelf.org/2017/demi-related-post-types/), I needed to do the following:
1\) Get the tags
2\) Check if the tag slug was the same as a post slug for a specific custom post type
3\) Output the hashtag as all one-word, no spaces, no hyphens
## Here’s The Code
No more explaining, here’s the code.
The only ‘catch’ you may stumble on is that I’m checking against the post type of `post_type_shows` – just change that as you need to.
Voila! Instant hashtags.
Oh and if you’re wondering why I didn’t put in a check for “Is Jetpack active…” the reason is that this is adding a post meta, and doesn’t actually depend on Jetpack being active at all. Will it ‘clutter up’ your database if Jetpack *isn’t* active? Yes. But it won’t break your site so it’s safe enough for me.
**Categories:** How To
**Tags:** coding, jetpack, wordpress
---
### [Custom Admin and Tool Bar Icons](https://halfelf.org/2018/custom-admin-and-tool-bar-icons/)
**Published:** July 17, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Messing with toolbars and icons.
**Content:**
When you’re making a plugin, sometimes you need a sidebar icon. And adding those in is relatively simple, depending on how you do it. But when you’re adding in something to the toolbar, things get a little messier…
## Dashicons and the Admin Sidebar
The easiest way to add in an icon is to use a [Dashicon](https://developer.wordpress.org/resource/dashicons/#carrot) – part of a set of icons developed by WordPress itself. These are designed to just work with WordPress, and you can include it in your call to add a menu page like so:
These will *automatically* change colors for you when people change their profile colors.
## Dashicons and the Toolbar
But what if you want to add a menu to the toolbar? Well this is a little bit more complicated, due to the fact that there just isn’t a built in way to add that icon.
When you add in a toolbar menu, it looks like this:
While I think the array should accept ‘icon’, it doesn’t, which means you have two choices to add in your icon:
1\) Put `` in front of the ‘HalfElf’ on the title line
2\) Use some CSS
Personally I pick option 2, because that will allow the icon to show when the screen is in mobile view, and all you see are the icons.
For *that* to work, I have the following custom CSS:
I call it on the front and back end, and this works pretty well.
## Adding a Custom SVG
But. What happens when your coworker doesn’t like your joke about the carrot? Well now we’re into the weird land of “I want to use a Custom SVG for my admin bar and my toolbar.” And this is strange because while you can just echo out the SVG, the *color* can be a bit of a mess. Unlike a font-icon, SVGs don’t always play nicely with the sidebar. You have to define their colors in order for the fill replacement to work, and even then I found out that it *doesn’t* go well with the toolbar!
I lifted a page from Yoast SEO, who uses a function `get_icon_svg()` and calls it in place of `'dashicons-carrot'`, making my menu this:
Yoasties, if you’re wondering why I have the extra variable, let me explain.
In their default, they have a one parameter, the true/false, and it defaults to true, so they just use `get_icon_svg()` and call it a day. But I had cases where I wanted things to have specific colors, so I added in a parameter for the color. In addition, I put in some extra checks on how to determine the color based on what admin colors the user had selected:
Personally I find it pretty crazy, and the icon on the toolbar doesn’t reflect the changes until the page is reloaded, but that’s a small price to pay since it doesn’t happen all that often.
**Categories:** How To
**Tags:** admin menu, icons, toolbar, wordpress
---
### [Image Attribution](https://halfelf.org/2018/image-attribution/)
**Published:** July 12, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to add more fields to your images in WordPress.
**Content:**
Did you know you could add fields to the media uploader?
In my case, I was at a convention and a fellow reporter (welcome to my new weird life) muttered she wished it was easier to have just a photo ‘credit’ line when she uploaded media from networks. I asked what system she used to run her site and when she said WordPress, I gave her my biggest smile.
## Image Filters
There are two things we need to filter here.
1. Add our attribution field to the editor
2. Save the attribution data
That’s it. WordPress handles the rest.
## End Result?
It shows up a little lower down than I’d like (I’d prefer it to be up where the URL is) but it works:
Oh and yes, I emailed her the code as a stand-alone plugin. Her IT person was thrilled.
**Categories:** How To
**Tags:** code, filters, wordpress
---
### [Protect My Plugins, Please](https://halfelf.org/2018/protect-my-plugins-please/)
**Published:** July 10, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Managing sites involves managing plugins. No. Not like that.
**Content:**
I have a site that literally requires a specific plugin always be active for things to work. It has a lot of very complicated code, and two things must *never* ever happen to this:
1. It should never be disabled
2. It should never be updated by WordPress
Well. Okay. Let’s do that.
## A Caveat
If you don’t have a way in place to update and secure the plugin you’re hiding, *DON’T DO THIS*. Once you hide it, people won’t know to update it and, in fact, won’t be able to. Because you’re also preventing traditional updates. In my case, I have a git repository that triggers a push (plus some other magic).
Again. Unless you’ve got something set up to handle updates, don’t do this.
Now let’s do this.
## Never Disable Me (by Hiding)
To do this, we need to know the folder name and filename of the plugin, such as ‘my-plugin/my-plugin.php`. If you want to hide the plugin you've put the code in, you can use`plugin\_basename( **FILE** )` instead, which is what I’ve done.
If you were writing a plugin to hide a lot of things, you would change the array to list all of them. But since this is a ‘hide myself’ deal, it’s easier to put it in the plugin itself.
The added bonus to making the file path dynamic is that if someone gets clever and renamed the folder or file, it would still work. Neener.
## Stop My Updates
Now this one again is easier if you put it in the plugin you’re disabling updates for, because again you can use `plugin_basename( __FILE__ )` to detect the plugin. If you’re not, then you’ll need to make an array of names. But that should get you started.
## What Does It Look Like?
Nothing, really. You’ve hidden everything. Congratulations. Now you don’t have to worry about admins or WordPress updating your plugin. Or worse.
**Categories:** How To
**Tags:** administration, plugins, wordpress
---
### [Query Vars, Post Titles, and Yoast SEO](https://halfelf.org/2018/query-vars-post-titles-and-yoast-seo/)
**Published:** July 5, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to customize your post titles with query variables and Yoast SEO.
**Content:**
Most people who use WordPress use query vars every single day without knowing. Back in the old days, we used to have websites with URLs like `example.com/?p=123` and we called those ‘ugly’ permalinks. This encouraged everyone to make pretty ones, like `example.com/2018/post-name/` instead. What many people don’t realize is that those `?p=123` calls are query variables.
WordPress, and most modern CMS tools, take that pretty permalink, translate it back to a query variable, and go get the post ID with 123. The variable `p` (which stands for post) has a value of 123. It makes sense.
And you can make your own.
## Pretty URLs Are Better
If you have a choice of telling people to visit `example.com/?p=123` or `example.com/2018/post-name/`, I feel confident most of you will pick the latter. And if you’re writing code and you need a consistent location to call, would you rather try to assume that everyone’s using `wp-content` and look for `example.com/wp-content/plugins/myplugin/my-file.php` or would you rather use `example.com/myplugin/`?
Now. This post is *not* about how to make those awesome virtual pages. There are some good tutorials like [Metabox.io’s](https://metabox.io/how-to-create-a-virtual-page-in-wordpress/) to get you started there. This is about when you have a *slightly* different scenario.
## Using Query Variables in Titles
For a number of reasons, I have a page built out to manage my custom query calls. This allows me to edit the content of the page like it was, well, a page! Anyone can edit the page content, change the information, and then everything else is magically generated, it can be easily tweaked to fit my theme, and it basically works for me.
What *doesn’t* work well is that all the pages have the same title. And that, as we all know, is bad SEO. I don’t want all my pages to have the same title, and it’s confusing for users because they go to `example.com/my-thing/sub-thing/` *and* `example.com/my-thing/other-thing/` so logically the page title should be different, right?
Changing the display title on the page isn’t too terrible. I have this code at the top of the page to grab the query variable:
And then when I echo the title, I do this:
Which means my titles are either “My Things” or “My Thing on That”. If I had multiple ‘words’ in my query variables (separated by a – of course) then I’d use a string replace and capitalize each word with `ucwords()`.
## But Page Titles aren’t Title Titles
The problem is the page title isn’t the … well … title title. Have you ever looked at your browser bar? Assuming you don’t have 94 tabs open at once…
Then your browser would look a little like this:
Imagine if they *all* said “My Things | Half-Elf on Tech”? Well that would suck. It sucks for you reading, it sucks for screenreaders, and if you have Yoast SEO, it’s quite easy to fix.
## Custom Yoasty Variables and Titles
Step one is to revisit something I did two years ago, [making a custom Yoast SEO variable](https://halfelf.org/2016/yoast-custom-meta-cpts/). This time I want to make a variable for `%%mything%%`:
And the code will be to grab the query variable and parse it:
Step 2 is going into the page, popping open the snippet editor, and making the title this:
And then? Pour a beer and watch some sports.
**Categories:** How To
**Tags:** seo, wordpress, yoast
---
### [Conceptualizing Privacy](https://halfelf.org/2018/conceptualizing-privacy/)
**Published:** July 3, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some thoughts on what the difference is between the US and those folks across the pond about privacy.
**Content:**
I know a wonderful human named Heather Burns who cares about privacy and GDPR and has made me quite passionate about understanding what the heck I’m talking about. She’s infectious, smart, and well worded. When she talks I listen.
Earlier this year, she posted [her slides from a speaking event, PHP Yorkshire](https://webdevlaw.uk/wp-content/uploads/2018/04/PHP-Yorkshire.pdf). One of them resonated with me to the point that I keep thinking about it:
 Source: [Heather Burns’ PHP Yorkshire Slides](https://webdevlaw.uk/wp-content/uploads/2018/04/PHP-Yorkshire.pdf)I sat and read it a few times, and I realized that I absolutely 100% agree with all of the UK/Europe concepts and only **one** of the US’s. I won’t touch on all of them, but here are the ones I spend a lot of time pondering.
## Ownership vs Freedom
In the US, there’s a massive misconception that you have a right to say what you want about what you want *without consequences*. This is absolutely not true. [Freedom of speech](https://halfelf.org/2013/censorship-in-moderation/), in the United states, does not exculpate me from what happens to me after I say a thing. But we have a big bugaboo here about how our freedoms are fundamental rights. So even though the first few Amendments to the Constitution are quite clearly about their direct applications to ‘against the government’ and ‘in a militia,’ people take them, twist them, and make them apply to everything else.
This runs into an issue with GDPR and people in the UK and Europe, where the law is that you own your own data. You have a right to it, and to what’s said about you. Yeah hang on there. Folks in the US have a right to say what we want. Folks in the UK/Europe have a right to make us shut up.
That’s working out about as well as you’d think, mostly because we disagree about this other thing…
## Data Ownership
Really, it should be pretty simple for the freedom of speech to coexist with the right to be private. If I post lies about you, you are legally within your rights in the US to demand I take them down. If I post information about you that wasn’t public, like I know you like burn Beanie Babies (those are stuffed animals, folks), then in the US you’re kind of out of luck unless you can prove it caused you ‘harm.’ Across the pond? I have to delete it.
And right there, I agree with the Europeans. If I take *privileged* information and make it public, I’m a horrible human first of all. I’ve betrayed your trust, and I’ve probably done it for financial gain. On the other hand, if I take **public** information (like a photo of you from the Associated Press of you burning a Beanie Baby in Central Park) and share it, I’m still a pretty horrible human, but not in the same way.
As a human, I think I should have the right to own my own data. But this comes with a measure of responsibility. In other words, I’m responsible for what I put out there. If I make it public that I’m a lesbian (which I did), am I legally allowed to demand you remove all references to me being one on your site? In other words, do I get take-backs if I make things public?
Maybe, but over yonder, I should at least ask first!
## Cooperation Before Court
There’s a concept called “[Assume good faith](https://en.wikipedia.org/wiki/Wikipedia:Assume_good_faith)” and it’s one of Wikipedia’s fundamental principles. It’s related to the concept that we should never attribute to malice that which can be ascribed to ignorance. Generally this comes up when I talk to people about copyright or trademark violations. I never assume people meant to violate those things, just that they were unaware of things.
The idea that someone has to ask me to remove a thing before suing me would be a lovely thing. The closest I can think of in the US is the way DMCA requests are handled. That is, I can issue a counter notice and either state “Hey, removed it!” argue back that it’s fair use. But that isn’t the same as the idea that we should talk before we go to lawyers. And that’s, you know, respectful.
I spend a lot of time thinking about this based on two other sites I run, where there *is* personal information of other people. It’s all public-personal information, but in general if someone asks me to remove data, I’ve complied. There was one instance where I didn’t, and I explained why not and the other person agreed it was a fair representation of the situation.
## What Happens Now?
Well. A lot of confusion and arguments about who has the right to what and where and when.
There’s going to be a lot of change in your future.
**Categories:** How It Is
**Tags:** ethics, gdpr, privacy
---
### [HTTPS and HSTS](https://halfelf.org/2016/https-hsts/)
**Published:** August 31, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little ditty about HSTS and making things even safer! Oh my!
**Content:**
HTTP Strict Transport Security (HSTS) is a standard to protect visitors by ensuring that their browsers always connect to a website over HTTPS.
Basically you have your server say “Everyone who accesses my server should use secure connections.” This matters because it prevents man-in-the-middle attacks that change HTTPS to HTTP and steal your credentials. Bad days. If you are using HTTPS/SSL on all your domains you should totally enable HSTS.
Okay, great. How?
Well if you have one domain, this is as easy as tossing this into your htaccess:
But … I have 20+ domains on this server. That would suck to have to edit! In fact, this is really closely related to my issues [combatting referrer spam server wide](https://halfelf.org/2016/blocking-referrer-spam-server-wide/). This stuff isn’t always obvious. For cPanel, I just added that code to my `pre_virtualhost_global.conf` file, same as I did for a certain referrer spam company.
If you’re using NGINX, you should read their [blog post on the subject](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) for full details but the basic code is this:
And if all else fails and you *can’t* set this on the server, you can always edit your .htaccess or nginx.conf file locally.
**Categories:** How To
**Tags:** htaccess, nginx, security
---
### [Blocking Referrer Spam Server Wide Sucks](https://halfelf.org/2016/blocking-referrer-spam-server-wide/)
**Published:** June 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Blocking them before they get to you isn't easy.
**Content:**
A while back I talked about [Referrer Spam in Google Adsense](https://halfelf.org/2016/referrer-spam-adsense/) and I mentioned how you could block referrer spam with some .htaccess calls. That’s cool, but when you have 12 sites on a server, making this one more thing to manage per site is a pain in the ass. Well okay, what can we do constructively? And sadly the answer is “Not much.”
First of all, forget the idea of using a `robots.txt` file. If they were *real* seo crawlers, they would honor this. They don’t and that’s how I know they’re evil.
Secondly, this will only work if you have server wide access. That should be obvious, but server wide settings need server wide access, and that’s just how it is. I say that it sucks because it can be a little complicated and messy to understand where you put things.
If you have your own server, like I do, then you can make a [custom VirtualHost template](https://documentation.cpanel.net/display/EA/Custom+Templates#CustomTemplates-Customtemplatesthatwillapplytoallvirtualhosts)
Since I’m using Apache 2.4, I made local templates:
If you’re using 2.2 then the files are in `/var/cpanel/templates/apache2_2/` instead. In each file, I added this to the top of the VirtualHost settings.
What that does is it tells Apache that it should inherit Rewrite rules from the main server. That means each virtual host (i.e. each website) will abide by any rules in the local settings.
*Where* you put this in that file can be weird. I ended up looking for this section, and putting it right below:
Put that in *both* files. Because you use HTTPS, right? Then you need to bounce httpdconf:
`/scripts/rebuildhttpdconf`
Since I’m using WHM, the next step is to go in to the Apache Configuration section and open the Include Editor. Then you want to add your blocking directive in ‘Pre-Virtual Host Include’ for All versions. If you don’t use it, you’ll want to edit `/usr/local/apache/conf/includes/pre_virtualhost_global.conf` and bounce Apache after.
As you can see, I have some content in there already.
I added this below:
Does it work? Yes. It blocks ‘spammerseocompany’ from all my domains on my server. I put in the other URL since that’s the one they have that’s currently spamming the heck out of my stuff. There are a lot of other options with Apache 2.4, like sending them a 403 and so on. You should read up on [using mod\_rewrite to control access](https://httpd.apache.org/docs/2.4/rewrite/access.html) and pick the method you find most sustainable. For example, you could single like it:
I find that a bit clunky.
If you’re using nginx, you’ll want this I believe:
A big note of caution here. If your list gets too long, you’ll end up slowing your server down. A lot. So keep it as simple as you can. I find that [CSF](http://configserver.com/cp/csf.html) does a dandy job of blocking the most of my trouble makers, and I only need this for the unnamed spammerseocompany because they don’t abide by the common rules of robots.
If, one day, they do, I will stop blocking them and allow their robots. As it stands, they’re idiots and need to go away.
**Categories:** How To
**Tags:** performance, servers
---
### [Caching Dismissible Alerts With localStorage](https://halfelf.org/2018/caching-dismissible-alerts-with-localstorage/)
**Published:** June 28, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using Javascript loclaStorage to store persistent string data and have it keep alerts dismissed.
**Content:**
There are a lot of reasons to want to have a temporary, but dismissible, alert on the front end of your website. And there are a million different ways to do that. The trick is … how do you do that and make your site remain *cacheable*?
## Web Storage (Maybe) Is the Answer
I preface this with a warning. I’m going to be using Local Storage, and that is *not* something I generally advocate. Web storage (aka DOM storage) is the practice of storing data in the browser. You can do this in a few other ways, such as sessions or cookies. But both of those can be detrimental to caching. After all, PHP Sessions and cookies tell systems like Varnish and Nginx “Don’t cache this.” They’re also persistent, so if I get a cookie once, I keep it until it expires or I delete it.
On the other hand, web storage is outside the website entirely, that is my *server* has no idea about them, and it doesn’t really impact caching at all. Varnish, Nginx, and all those sorts of server-based services don’t care about it, and if implemented properly, there’s no problem. You can store the data locally or per-session, which means ‘forever’ or ‘for as long as this browser window is open.’
## Don’t Use localStorage (Most of the Time)
That all sounded awesome. So then why are there so many articles advocating you *not* use localStorage? Well there are some massive caveats:
1. It’s pure javascript, so PHP doesn’t easily get it
2. If you store *sensitive* data in it, you’re a numpty
3. It can ‘only’ store 5 megs
4. The content has no expiration
5. You can only use string data
6. *All* your localStorage is loaded on every single page load
7. Any other javascript can see it and play with it
That’s starting to sound squidgy, right? [Randall Degges has a good writeup of the drawbacks](https://www.rdegges.com/2018/please-stop-using-local-storage/).
Well good news here. This use is *possibly* the only time I’ll ever advocate it’s use. I’m going to us it here because it works with caching, it works with most browsers (IE8+), and the worst case scenario here is that people will always see my alert.
## Pull Up With Bootstrap
I’m using [Bootstrap](https://getbootstrap.com/) on this particular site, and it makes my life hella easy because they built in [dismissible alerts](https://getbootstrap.com/docs/4.1/components/alerts/#dismissing). But the gotcha? Those alerts *aren’t* persistent. Which means if I want an alert to go away forever, then I’m SOL.
Except I’m not. Bootstrap includes a way to run an ‘action’ on dismiss, which means I could do something like this:
What this does is it sets a variable (`gdpr`) based on the content of my item in localStorage (`gdpr-alerted`). If that value is yes, it closes the alert. Otherwise, it sets it to yes when someone closes the alert.
That actually works just fine, but it has a weird blip if the javascript is loaded in the footer, where you would see my alert for a split second before the page finished loading. So I decided to go another way, and factor in some expirations.
## The (GDPR Related) Code
First up the PHP:
Now my sneaky JS:
The reason this works is that I *remove* the `show` class from the PHP and by default assume it *shouldn’t* show. Then in the javascript, I set up the value as ‘a year from now’ instead of ‘yes’, and check. If the localStorage value is less than ‘now’, then it’s expired and we should show the class (and delete the storage). Otherwise, it’s the same old same old.
## But Should We?
That’s the big question though. Is this the best way to go about it? The next best choice would be IndexedDB, however that is not supported by ‘enough’ browsers yet, so yes. For now, this is the best choice.
**Categories:** How To
**Tags:** javascript, wordpress
---
### [How Many Plugins Is Too Many To Create?](https://halfelf.org/2018/how-many-plugins-is-too-many-to-create/)
**Published:** June 26, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** No, not how many is too many to use. How many is too many to make, support, manage, and wrangle. As a developer.
**Content:**
That wasn’t the way you expected that title to end, I bet. You were thinking “How many plugins is too many to have on my site” and that’s absolutely *not* the topic here. No, instead I’m asking how many plugins is too many for a developer to create?
## I Got 99 Problems …
I think that plugins should be specific. That is, I’m not a fan of a conglomerate of plugins like Jetpack, that do a little of everything. Instead, I like a plugin that does the thing it’s supposed to do, preferably simply and well, and it moves on. That means I often have 20-30 plugins installed on a site, and that’s okay.
At the same time, as a developer, having to support 20-30 plugins is a drain on my limited resources. Becuase here’s what I have to do:
1. Keep up with all core changes
2. Include and test all library updates
3. Test with every release
4. Update my readme
5. Review reviews and support posts to make sure I’m not missing things
Multiply that by 20 and it’s a lot of work. And is that work I feel like I *must* do?
## Gimmie One Reason …
The reality of having plugins for WordPress, or any add on for any project, is that it’s generally thankless work and you will have more bad days than good. That’s true of many things in life, and as depressing as it can be, it’s important to keep an eye on the reality of the situation.
Developing software is very analytical art. You create something out of nothing, you design and test and change and tweak, and then present it to the world. Of course those days when people tell you “I don’t like the color” suck, but being humans, we discard that and grab on to the days when someone says “I love the carrot!”
And the reality of the question at hand isn’t how many is too many, but how many are *worth* the work and the little reward?
## Bring it Together …
Lately I’ve been advocating something different. Instead of making 13 separate types of gallery plugins, I’ve suggested people make one plugin for galleries and include those 13 types as display options. The amount of work is roughly the same, but it means I only have one plugin to manage instead of 13 separate readme files to edit and installs to spin up. I also have *one* place to look for any support posts or reviews.
Obviously this doesn’t always work. Sometimes you have to split things up. There’s little point it combining a WooCommerce plugin with a NextGen Gallery one (unless the plugin is implementing NextGen with Woo products…). But if you can connect your projects by type, you may find out that there’s crossover. Instead of spreading your user base out over 10 plugins, you can keep them manageable with 5 to 8.
## Working For The Man …
And what about Jetpack? It’s effectively XX separate types of plugins:
- Writing
- Sharing
- Discussion
- Traffic
- Security
Except when you look at that, it suddenly all connects. When I write I want to share and I want people to discuss. I also want to keep an eye on my traffic *and* being secure…. Okay that last one might be better off on it’s own, but it’s a suite of *related* apps. 43 separate apps, but they are all related when you get down to it.
Which means even if you’re making a plugin for your company, you can *probably* combine it with other things safely. And that means less access and security concerns for you too, as you only have to keep track of who has access to *one* plugin instead of 50.
## How Many Is Too Many?
This is as subjective as all get out, but I’ll say this. Once you personally support 20 plugins for WordPress, take a good hard look at how much time you’re spending and ask yourself… is it worth it?
It’s okay to say no.
**Categories:** How It Is
**Tags:** management, mental health, plugins, wordpress
---
### [Future Proof Names](https://halfelf.org/2018/future-proof-names/)
**Published:** June 21, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Names are hard, so try to make yours one that lasts.
**Content:**
The other day I was talking to someone about the name of their plugin.
No, not about copyright and infringement, though that comes up a lot. I was talking to them about the meaning of the plugin name. They wanted to pick a name that was memorable, meaningful, and descriptive. I wanted them to drop the last one. Or rather, to reconsider the last one.
## Names Aren’t Descriptions
My name, Mika, is not a description, it’s an identifier. Even my handle, Ipstenu, is an identifier. My domain ‘HalfElf.org’ actually *is* a bit of a descriptor, but it’s also an identifier. I am a Half Elf Rogue to many people, and that’s as it should be. But a descriptor is “Professional Lesbian” not “Half Elf on Tech” and yes, this matters.
A good name is memorable (check), meaningful (check), and descriptive without being a description. Because a name is how we identify and remember the weird tech site we went to, versus the tools we use.
In so far as plugins go, however, you have one more thing to think about, and that’s the plugin *slug*. The slug is like this post’s URL. Changing it comes at a cost and in the case of plugins, it’s impossible. So while I’m content to allow people to pick some silly names, I’m pretty sticky about the plugin url.
## Woo(Commerce) There It Is
Whenever people submit plugins named “WooCommerce Thingy” they find their slugs changed to `woo-thingy` instead of the expected `woocommerce-thingy` because, well, they’re not WooCommerce. This sometimes incurs their ire, generally because they didn’t read the FAQ, and I’ve become resigned to linking them back to it. Most of the time, people just go “Oh, okay I get it.” and move on. Sometimes when the slug is less easy to ‘correct’ for them, like if they call a plugin “Google Fast Typing” (slug `google-fast-typing`) I have to email them and sort out a new name (probably “Fast Typing for Google” unless “Fast Typing” is trademarked by the Googs).
Like I mentioned before, I don’t really push too much about a display name. You can change it as many times as you want, and coming back in a month to remind you “Hey, if you’re not *Google*, you shouldn’t start your plugin display name with ‘Google.’ They may get snarky at you.”
But the display name is also very much abused. People use it as an extra ‘short’ description, which really only goes to annoy people who see “Luxembourg – A new plugin that will solve all your woes!” as a plugin name. Thanks. But that’s what the *description* is for.
## Gutenbye-bye-bye
Gutenberg is a very popular plugin to make an add-on for these days. And a lot of people want to name their plugins things like “Joe’s Author Blocks for Gutenberg” which nets them the slug `joes-author-blocks-for-gutenberg` and I don’t know about you, but I find that excessive.
See, you don’t want to have “Gutenberg” in your plugin slug at all. Unlike WooCommerce (or Google, or Facebook), we know Gutenberg is going to go away. Remember, the goal of Gutenberg is to be in WordPress 5.0!
So that means naming your plugin `author-blocks-for-gutenberg` is shortsighted. In another four years, will anyone remember Gutenberg was the project name? Quick way to check, ask people at a local meetup “What’s MP6?” and see who knows.
## Name Better
Think about the future of your plugin, the project, and the related items. Locking yourself into a name you regret later is one thing, but since a display name can be anything, you can name your plugin anything! Making a feature rich Gutenberg add on? Manutius is a great name! Changing the look entirely? Call it Reformation. Making a simple author block editor? `halfelf-author-blocks` is an okay slug, but “Block Your Authors” sounds pretty bad.
Just remember, it’s eye before flea, except after sea.
**Categories:** How It Is
**Tags:** names, wordpress
---
### [It's Just Math: WP-CLI Edition](https://halfelf.org/2018/its-just-math-wp-cli-edition/)
**Published:** June 19, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A quick WP-CLI example of running calculations.
**Content:**
Remember how I talked about [doing math on a post when it was saved](https://halfelf.org/2018/its-just-math/)?
Well what if I wanted to run that at another time? Like what if I knew I needed to update one show and I didn’t want to go in and save the post?
I can to this with WP-CLI:
## WP CLI Magic
## What the What?
The one for shows is a lot simpler. I literally call that `do_the_math()` function with the post ID and I get back a number. Then I output the number and I’m done. If I wanted it to run for all shows, I could use WP-CLI to spit out a list of all the IDs and then pass them to the command one at a time. Or I could write one that does ‘all’ posts. Which I may
But the point is that I now can type `wp mysite calc show 1234` and if post ID 1234 is a show, it’ll run.
**Categories:** How To
**Tags:** math, wordpress, wp-cli
---
### [jQuery Tablesorter](https://halfelf.org/2018/jquery-tablesorter/)
**Published:** June 14, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Put them in the order you want without having to hard code things.
**Content:**
So you want to sort tables on your WordPress site, without learning a whole mess of code.
Good news. [There’s a plugin called Table Sorter that can do this](https://wordpress.org/plugins/table-sorter/) and in pretty much just works. Except… There are cases where you’re outputting data in a theme (or a plugin) and you can’t use that plugin to do it.
Don’t panic, we’ve got you.
## Enqueue The Right Tablesorter
I’m aware there’s a `tablesorter.com` – Don’t use it. It’s out of date at the site is possibly hacked. Instead, grab [Tablesorter from RobG (aka mottie)](https://mottie.github.io/tablesorter/). Rob is still updating this plugin and debugging it, so it’s a better bet that the various other forks.
You’ll enqueue this the ‘normal’ way:
There’s a second part to the enqueue though. You see you *also* need to tell it what to sort. That is, tell the javascript what to pay attention to.
That’s done by using a class and an ID: ``
If you’re using the plugin I mentioned above, you only have to do the latter, because it accounts things differently but, properly, you should be using the ID. Then you have to insert this javascript:
Which is actually wrong. For WordPress. Again, no panicking!
See? That was easy. If you wanted to be more WordPressy, you do this:
## You were expecting more?
That’s really it. I do some extra weird stuff, since I call it on one page only (statistics) and that pages uses query variables so you can have `/statistics/nations/` without me needing to make multiple sub pages, and it looks like this:
Oh right that also demonstrates a theme!
[Tablesorter lets you use themes like Bootstrap 4.x](https://mottie.github.io/tablesorter/docs/example-option-theme-bootstrap-v4.html) so your tables can be all matchy-matchy.
But at this point, it should be enough to get your tables sorted.
**Categories:** How To
**Tags:** javascript, wordpress
---
### [Bad Faith Names](https://halfelf.org/2018/bad-faith-names/)
**Published:** June 12, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's not the weirdest copyright case I know of, but it's cock of the walk.
**Content:**
One of the things about Open Source is we can name things whatever we want. This comes with a great amount of responsibility though, since we have to both come up with unique, memorable names that make sense *and* respect everyone else.
Respect is a funny thing with names. For example, in order to respect my friend Tracy, I wouldn’t name my company LYKES Inc, because that would be very similar to her company of [YIKES Inc](https://www.yikesinc.com). But also I know she’s trademarked the domain, which is a smart choice, and that means I have to respect her trademark as well.
## Speaking of Trademarks
When it comes to trademarks, everything’s a little messier too.
This isn’t about not naming your plugin “Google Analytics.”
This is about when you own a trademark and people are infringing on it, and how you can chose (or nor) to behave.
This is about being cocky.
There’s no other way to explain this, but a romance novelist trademarked the word ‘cocky.’
No, this isn’t a joke. Since 2015, for a number of reasons, the word ‘cocky’ has been super popular with romance authors, and one of them decided to trademark the word. In 2018 she applied for, and got, a trademark on the word. Not just the word mark (which is like Pepsi’s trademark on the word and the font), but also [the actual word cocky, as used in romance novels](https://trademarks.justia.com/876/04/cocky-87604348.html).
And then she did exact what you’re thinking, and she decided to sue everyone else who was using it.
## Trademark Bullying
Fallen Hopkins said her reasoning was her users. “I receive letters from readers who lost money thinking they bought my series. I’m protecting them and that’s what trademarks are meant for.”
When you hear it that way, it does sound a little sensible, doesn’t it? She wanted to help her readers be less confused that “The Cocky Cowboy” isn’t a book in her series “The Cocky Series” (in which there is a book called “Cocky Cowboy”). She kicked the author of “The Cocky Cowboy,” who renamed **her** book “[The Cockiest Cowboy To Have Ever Cocked](https://www.amazon.com/gp/product/B07B9MCHW7/ref=as_li_qf_asin_il_tl?ie=UTF8&tag=lezpress-20&creative=9325&linkCode=as2&creativeASIN=B07B9MCHW7&linkId=dc349672abc7809dd859f9e0a888153d)” and now I’m a little in love.
Now *most* of the time you can’t actually do that! I mean, I could name a book “Catcher in the Rye” if I wanted to, because you *can’t* copyright book or story titles. What you *can* do is the title of the book as it pertains to non-book goods and services, as long as the goods aren’t the book. With a trademark, if I have a book *series*, I can trademark the series name (see “Harry Potter and …”), but not a single individual title. Until I make a movie.
But more to the point here, Hopkins was being a damn bully by deciding she was going act in bad faith.
## This is Legal?
Yes. It’s legal, but it’s bad faith.
Bad faith is simply you doing something that is *legal* but you know it’s the bad thing to do.
That’s not a legal definition, by the way. If you look it up in a law dictionary, it involves the intent to deceive, which is a weirder thing. The real question is why is this legal? Right? Why would someone possibly be able to trademark cocky!?
Turns out, it’s actually not hard to trademark a common word *if* you do it right. Take Apple, for example. You know, Macintosh the company? apple.com? Right, they trademarked Apple, but only as it relates to computers. I can name my car company Apple Cars if I wanted, but I better keep away from self-driving cars, eh?
## Legal Doesn’t Make it Right
There’s a catch to all this. If you’re in the USA, you may be aware of the First Amendment. You know the one? Well there’s a doctrine about all this that basically exists to stop trademark law from stomping all over our rights. People build careers on this stuff, so the short version for you is that folks who are chapped about this have a damn good case against her doing this maliciously, and getting the trademark overturned.
The problem is they need lots of money, which they don’t have. We’re talking about a bunch of indie e-book authors, after all. They may not have money but they have the internet, and they’ve been using it to savagely take down Hopkin’s reputation.
You really should never piss off people who are good with words.
## Cockygate Doesn’t Hold Up
The good news in all this is the trademark’s being canceled. The bad news is that someone else with deeper pockets probably has a great idea now and is going to be an even bigger problem for people later on.
People *will* get confused. People can’t even tell differently named web hosts apart, so of course someone will think “Joe’s Google Analytics for Sports Sites” is an official Google plugin on WordPress.org (seriously someone did). They just don’t read and think, and all the trademark protection in the world isn’t going to help them out.
But think about how you’re approaching this. Ask people to change the display name of things, and ask them to make sure it’s clear they’re not related to you. And when someone gets confused, point out “That plugin/app doesn’t have my trademark’d logo, so you can see it’s not mine. Sorry about the confusion, here’s mine.”
If you’re interested, read [Vox’s explanation on cockygate](https://www.vox.com/culture/2018/5/15/17339578/cockygate-explained-romance-publishing-faleena-hopkins) and please, don’t be a cock when you’re protecting your trademark.
**Categories:** How It Is
**Tags:** essay, names, oped
---
### [A Case Sensitive Headache](https://halfelf.org/2018/a-case-sensitive-headache/)
**Published:** June 7, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes computers exist to make us cry. When it can't tell the difference between FOO, foo, and Foo, it make actually manage it.
**Content:**
Like most people, I pull my site down to develop locally. After all, it’s safer. But also like most people, my live machine is a linux box and my personal machine is not. In fact, it’s a Mac, running whatever the latest OS X is. But don’t worry, today’s drama happens on Windows as well.
You see, I downloaded my local data, imported my database, changed my URLs to local, and stared at a page that had the wrong data. Or rather, the right data and the wrong *image*. The page for “Sam” was showing me a photo for another character named “Sam.” But on my live site it was fine.
## Commence the Debugging
The first thing I did was copy the image to a new folder to try and re-upload it. Only that didn’t work out the way I thought it would. You see, I knew the filename was `Sam.jpg` so I tried to copy that over:
```
cp ~/sites/example.com/wp-content/uploads/2018/05/Sam.jpg ~/Downloads
```
Only when I went to look, it was *again* the bad image. In fact, when I looked at all the files in the folder, there was only one file named ‘sam’ when there should be two
 Local site is on the left, live is on the rightThings were starting to become clear. Next I copied it and renamed it `sam.jpg` and got an error:
I’ve got it now. Mac doesn’t understand the different between upper and lower case. It’s not case sensitive.
## Bad News: No Easy Fix
I’m really sorry about this. There isn’t an easy fix.
First of all, if you wanted to fix your main hard drive, you would have to reformat it. That’s a pain in the ass. Second? Your Mac will not be happy and things will break. For example, the Steam app doesn’t like it if your Mac is case sensitive. Seriously, I have no idea why. But it’s what it expects.
This means the ‘fix’ is to partition your hard drive. Since I’m using AFPS, I opted to [make a volume instead of a partition](https://support.apple.com/guide/disk-utility/partition-a-physical-disk-dskutl14027/mac), which feels pretty much the same but it’s not. I opted for AFPS with case sensitive *and* encrypted because I’m generally a neurotic. Making a volume is very fast, and once I was done, I copied everything in my `~/Sites/` folder over to `/Volumes/websites/` (where `websites` is the name of my new volume).
And now it looks great!
Except… I still only see one in terminal. I freaked out for a moment and then I realized that while the GUI is smart enough to know that Sam and sam are both S’s, terminal put the capital letters *above* the lowercase. So all the S’s came before all the s’s.
The last step was to move my copy of Chassis over to the new websites volume, spin it back up, and *finally* it was working properly.
## The Moral?
Don’t use case-sensitive filenames. Or filenames with special characters like á or í because operating systems are stupid.
No seriously, that’s it. Haven’t you wondered why people advocate we all use all lower-case for filenames in our code repositories? Because different operating systems are stupid. They don’t always talk properly to each other, they have different ideas of right and wrong, and they’re never going to agree. If you work with multiple operating systems, aim at the lowest common denominator, pick a style, and stick the hell to it.
That’s your moral.
**Categories:** How To
**Tags:** macintosh
---
### [Customizing Login Pages](https://halfelf.org/2018/customizing-login-pages/)
**Published:** May 24, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Not everyone wants to flip you off with an error, but you could if you wanted.
**Content:**
Most of the time, the default WordPress login page is fine. The vast majority of the time it’s fine. Once in a while, you want it to look a little more custom. So let’s talk about what you can do.
## Change the Login Logo
This involves three things:
1. Making a logo of the appropriate size
2. Uploading it
3. Pointing your code to it
The default size of the logo is 80×80, which I’m using below. You can make it as wide as 312px, and as tall as you want, but I recommend not going too tall. I like mine to match my Site Icon, personally.
The path to the file is going to depend on where you put it, obviously. Remember it should be the *URL*, so you can’t use relative paths here.
Don’t want to code? Try using the [Login Logo](https://wordpress.org/plugins/login-logo/) plugin.
## Change the URL (and Alt Text)
Now that we’ve changed changed the logo, we should change the link and the alt text. After all, if the logo is your site, why should the URL be to WordPress?
You can change the URL and text however you want, but I find it easier to just link to the site itself.
## Bonus! Change the Errors
Okay this is rarely going to matter to anyone. But Tracy has a new favorite GIF:
And me, I wanted a nice, sneaky place to have it show up appropriately. So I decided to have it pop up when someone put in the wrong credentials while logging in. And I did that like so:
Now this doesn’t actually do anything other than be amusing. Let’s have a more practical example of wanting to change the invalid username/password messages to *not* tell people what they got wrong and not offer a password reset.
That would look like this:
There is not a good list of all the errors you may want to filter, I’m afraid.
**Categories:** How To
**Tags:** filters, hooks, login, wordpress
---
### [FUD: The Sky Is Not Falling](https://halfelf.org/2018/fud-the-sky-is-not-falling/)
**Published:** May 22, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** (Except when it is)
**Content:**
Every day it seems like there’s a new Zero Day vulnerability about our websites. SSL is being deprecated, PHP is out of date, the CMS we use has a critical vulnerability, security isn’t all that safe, and OMG we’re all going to get our identities stolen and our lives hacked.
Making matters worse are those myriad security tools we use to keep ourselves from getting hacked or attacked, and they alert us to horrible things. I say worse because they terrify people without actually explaining and educating them, so the uninformed users come running to complain the sky is falling. And when those people are told an answer by other experts, they don’t know *who* to believe.
Can you blame them?
## Responsible Disclosure
It’s four years now, and Nacin’s post about how [security is nuanced](https://nacin.com/2014/05/30/security-is-nuanced/) is still required reading.
The problem we face is that telling the world about a security issue is complicated. We definitely need to tell people who are responsible for fixing it, and in a perfect world we should trust that they’ll push out that fix in a reasonable time frame. We also should be able to trust they’ll tell the appropriate people.
But who, exactly, is the *appropriate* person to tell about a Drupal patch? Not the hack, the patch. In a different light, who are the right people to tell that a new security fix for an operating system has been released?
There are *millions* of users. How do you get to all of them quickly, with the right amount of information so they can understand how important this patch is to them, and how quickly they should apply it?
## Enter Security Companies
Many companies make their milk and meat off being the people who monitor and announce security releases. There’s nothing wrong with this. In fact, I laud them for being a much needed service. With so much data flowing, it’s important to have a service that can help users winnow down what’s critical to them and their setups.
But… That’s not what’s happening.
Security companies face the same problem we do. There’s just too much data, and it’s being updated *all* the damn time, and there’s no way to keep up with all of it. Which means that they do what I tend to do when I’m trying to explain things to a wide variety of people. They simplify as much as possible.
The problem with simplification is that you have to skip over things and leave out the nuances that help people understand what’s actually going on. They have no idea what they actually need to worry about. And we’re back to zero.
## To Know When To Worry …
You have to actually understand context to know what to worry about.
There’s literally no other way around it. There’s no shortcut, there’s no cheat sheet, there’s just knowing what your site is doing.
Let’s taken **OpenSSL** as an example. Back in 2014, a serious issue called HeartBleed was discovered. The bug was phenomenal in that it allowed people to steal and read secure data. If you ran a website, this was a massive issue. For your webhost.
Was it a huge issue to you? Well. Maybe.
A lot of people sounded the alarm and declared this a crisis, and we should all grab our web hosts and asks what they were doing and when would we be fixed. And the rest of us said “Hang on. Webhosts are aware. See if they have an announcement, which most will, and if they say they’re working on it, trust them.”
Sounds like I’m passing the buck, but the reality is that unless I’m using my site for privileged data (like a private blog, or a store), then the odds are for my individual site … I **don’t** need to panic. Especially if I use unique passwords and take regular backups.
This doesn’t mean Heartbleed wasn’t a huge problem, and that I didn’t want to see my host putting this as their number one priority, but it means that I’m aware of the risk (private data being stolen) and the likelihood of it happening (moderate to high) *and* the level of risk. That last one is the most important.
What’s the worst that could happen, today, on this site if someone stole private data? Well. They’d see my password maybe, and some draft posts, and have access to my API keys for a couple services. Nothing I can’t fix relatively quickly. They can’t log in to those API services and they can’t destroy my life.
If I was still running a store (like I was at the time of the initial vulnerability), I paid close attention to the fixes being released and the moment one was out for my system, applied it. But there was no need to panic or rush about. I understood what was going on.
## If You Don’t Know …
If, however, you have no idea how it all works and what it means, then I recommend the following checklist:
1. Do I have good passwords?
2. Do I have good backups?
3. Does my web host have a reliable track record for fixing this stuff?
4. Do I run any private/privileged data on my site that could be dangerous to release to the public?
If that last item is 4, then I better be paying my host (or an expert) a lot to protect me ASAP. If you’re still on budget web hosting, it’s time to move up to something managed, or hire someone to manage for you.
Otherwise, if the first three are all ‘yes’ then I’m not going to panic. I’m going to trust in the experts to do their job.
**Categories:** How It Is
**Tags:** essay
---
### [Data Deletion May Not Be What You Think](https://halfelf.org/2018/data-deletion-may-not-be-what-you-think/)
**Published:** June 5, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Deletion of data may not be entirely what you think.
**Content:**
So you’re handling GDPR and you have a privacy doc and policy and a plan for people requesting data and, yes, deleting it.
Eventually someone is going to ask you to delete their content from your site. This is the scary part for most people. Remember, you get 30 days to reply, so don’t panic. Next, figure out what they’re asking for, and if you can say no.
This is the fun part. You can say no. Sometimes.
## When You Can Say No
In general, yes, you should delete people’s information if they ask. But if your website stores complicated information this is not actually as black and white as all that. The right to erasure does *not* apply if retaining is necessary for one of the following reasons:
- exercising your right of freedom of expression and information
- meeting any legal obligations
- performing a task for and in the public interest or in your legal authority
- archiving information of public interest or for research where deletion would impair the work significantly
- related to and legal claims you have (or may have)
This helps you balance out the problem of being told to delete things you need to keep for tax reasons. It also keeps sites that may collect public data for the general public (like wikipedia or a website that tracks queer characters on TV) from losing everything. It won’t protect you from other lawsuits, of course.
It’s that last one I feel is really important to everyone. That’s the one that means if I block you, I *may not* have to delete your data, even if you ask, because I may need it for the establishment of legal claims. But that has to be a legit claim.
You can also just say no for any reason you feel is justified. Now again, do not use this flagrantly. You still have to turn around and tell someone that you’re *not* deleting their data, so you need to be serious about this.
## Self Protection
And speaking of being serious, you can actually say no to protect yourself. You see, people can only ask for deletion if the data is no longer needed for the reason it was collected. So if they want to delete their account but keep shopping at your store, you can say no since the information is needed to keep shopping!
So remember *why* you track the data in the first place. When people leave a comment, for example, you track their username, email, and IP (and web address if they provide it) in order to know who they are and prevent spam, but also *abuse*.
Here’s an excerpt from one of my privacy policies:
> **Comments:** When visitors leave comments on the website, the collected data shown in the comments form, as well as the visitor’s IP address and browser user agent string are saved in order to help spam detection and abuse.
Since I retain data to prevent abuse, that is serial internet harassers, you can ask me all you want for me to delete any data I save about you, but I can say no to protect *myself*.
## When You Say No
If you decide to tell someone no to a deletion request, you must:
- provide the reason
- inform them of their rights to make a complaint
- inform them of their right to a ‘judicial remedy’
That last one means yes, they can sue you to delete the data. If they’re abusing you (harassing etc) and you’ve saved all that, you’ll probably win. Which is one reason you should actually save and document people’s actions. I hate having a whole folder on my laptop that documents a bunch of people hating on me, but I need it.
Basically if you’re going to say no, have a damn good reason, document it, and be prepared for a fight.
## Say Yes If You Can
Most of the time, it’s no skin off your ear to delete a comment or edit a post. But sometimes it’s going to be a huge deal. And in fact, you can turn around and tell people “If I delete all your data, I will retain information required to identify you in order to prevent you from returning to this site. Deletion requests means you will not be welcome back.”
If that sounded harsh, well, it can be. Because for most small blogs, consider what they’re asking. When someone asks to delete the content of a personal blog, it’s most likely going to be for a pretty petty reason. Unless they’re asking you to remove information that shouldn’t be public (like their phone or email – and yes, someone’s asked me to delete that before), it’s probably going to be someone asking you to remove a comment that makes them look foolish. Or at least it has been in my experience.
## Make Your Life Easier
Keep this in mind too. Make your life easier. If you don’t *need* comments on your site, don’t have them. Turn off that contact form too. But there’s no law that says you need to let people talk to you on your blog.
This won’t be true for all situations, but do as much as you can and save yourself that GDPR headache.
**Categories:** How It Is
**Tags:** administration, gdpr, privacy
---
### [Consent and Awareness](https://halfelf.org/2018/consent-and-awareness/)
**Published:** May 29, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** GDPR terrifies a lot of people. It's a lot to take in, it's a lot to learn, and yes, we all need to do it.
**Content:**
GDPR.
It’s the bane of many headaches for many web developers, web admins, and in general anyone who uses the internet. If you’re reading this, it’s probably a headache for you too. So let’s have a real, non-lawyer talk about what’s going on and why you need to care.
**Notice:** I’m *not* a lawyer. This post is not legal advice. Please read the EU GDPR Information Portal and research your specific situation.
## Everyone Needs to Care
If you thought this only has to do with people who use eCommerce products, think again. The centre of the GDPR is data privacy. That is, the right to have your data removed from websites, when you want. The point to all this is if you have a website, and people visit, you need to care because the following reasons:
- You have ads on your site
- You allow comments
- You use custom avatars (Gravatar)
- You track visitors (Jetpack, Google, etc)
- You embed content (Twitter, YouTube, etc)
Does any of that sounds like you? It sounds like pretty much every public website in existence. And congratulations you need to care about GDPR.
## What You Need
There are a lot of moving parts here, but the pared down version is this:
- Know what 3rd party services you use
- Know what your CMS tool tracks
- Have a privacy policy
- Have a way for people to request data deletion
The first two are surprisingly complicated because, in the case of WordPress, you might be tracking a lot more than you think. Remember all those things I mentioned above? They all are *common* situations where your CMS might be tracking people. But what if I told you that a lot of plugins you use also add on tracking? Or record more data than WordPress knows about?
Like. I wrote a plugin that adds in the IP address used to register an account to the user meta. This means WordPress now records more data. Thankfully that gets deleted when you delete a user account, and it’s generally covered under the broad disclosure that you track users IPs (which every website does). But I have to make sure people who use the plugin know that, and communicate to others.
That’s a very simple example. Take a plugin that logs user activity for, oh, let’s say security. Now you have to tell everyone about exactly what it tracks (browser information etc) and what you use it for. And you get to figure that out for every single plugin you use.
This won’t be easy. Unless you read every single plugin you use, you’re going to be at the behest of developers who may not be aware of exactly what they need to disclose.
## Privacy Policies Are a Must
Every site should have a privacy policy. While for most smaller blogs, the odds are low that anything will happen, you should have one anyway. The problem is that no one can tell you exactly what yours needs to have. I try to cover the four basics:
- Terms of Use: all the things you agree to by using this site
- Data Collection: what situations result in my tracking your data, including details on 3rd party services regularly used
- Data Usage: what I do with data and how long I keep it – also how to request it
- Policy Changes: a CYA that they’ll likely change
There are a lot of details in those four sections, especially the Terms, which exculpate me if I get information wrong, allow me time to handle a DMCA, and a whole lot of things. And yes, it’s super daunting, I know. I mean, the privacy policy here isn’t half as robust as some of my other sites.
## The Bottom Line
You can distill all this into consent and awareness. People need to know what they’re getting into on your site (or at least be able to know – you can’t help people who refuse to read). And you need to understand exactly what your site does. You need to be aware, as a website owner and a user.
All those terms you ignored when signing up for Google Adsense and Analytics? Now is the time to knuckle down and read, because you need to cover that. All those extensions (plugins and themes) you added? Read up on them too. If they don’t explain what they do with data, ask the developers.
Developers? Step up. Document exactly what data you save. If you allow for the saving of different kinds of data, based on what the user picks, explain that. But you have to tell people what’s being saved and how to delete it. Most CMS apps now have tools to hook into to aid deletion, so research.
GDPR kicked in four days ago, but it’s not to late to fix things.
**Categories:** How It Is
**Tags:** essay, gdpr, oped, privacy
---
### [CMB2: Conditional Meta Fields](https://halfelf.org/2018/cmb2-conditional-meta-fields/)
**Published:** May 31, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Hiding parts of CMB2 fields is necessary to make like less confusing and easier.
**Content:**
Even though Gutenberg is on the rise, and every day gets us closer to using a whole new editor, we still use the ‘classic’ editor and we’re still beholden to it’s space limitations. I have [strong feelings about how to properly utilize space when using CMB2](https://halfelf.org/2017/cmb2-size-matters/), but not included in that specific post is this.
## Fields You Don’t (Always) Need
There are three types of fields for CMB2.
1. Fields you always need to use
2. Fields that are optional
3. Fields that are needed only in specific situations
Most of the time we use option 2. Option 3 is the tricky one, though, since most of the time we end up having things show based on actions. That is, I save a post, and new options show up. When it comes to CMB2, we really don’t want to have to save and then edit and save and edit.
Yuck!
Thankfully this is all possible.
## Practical Example: Affiliates
Today we’re making a box to handle affiliate links. There are three types of links: Amazon, Genric, and ‘Unique.’
The Amazon one will link directly to a signup link and the generic one links to the same thing only on Click Junction. Both of those links will have affiliate details backed in so I don’t have to look them up later. This also means any partners I have on the site don’t need to know all the gory details. Bazinga.
The last one, though ‘Unique’ is tricky. You see, when someone picks that, I want them to be able to put in a specific URL that may be affiliate linking somewhere else. But let’s start out with how it *normally* works.
## Make Your Fields
That’s pretty normal for CMB2 and looks like this:
Normal, but … I want to hide that Link field unless a specific option is selected. Enter *javascript*.
## Hide That Field (Conditionally)
Make a file for your javascript. I’ve called mine `cmb2.js` and put it in the same folder as my file that will enqueue the scripts.
And then call the enqueue, but only when appropriate (because we want to keep the load low):
add\_action( ‘admin\_enqueue\_scripts’, ‘my\_site\_admin\_enqueue\_scripts’ );
function my\_site\_admin\_enqueue\_scripts( ) {
$screen = get\_current\_screen();
if ( ! isset( $screen->post\_type ) || ‘post\_type\_shows’ !== $screen->post\_type ) return;
```
wp_enqueue_script( 'custom-js', plugins_url( '/cmb2.js' , __FILE__ ), array( 'jquery' ) );
```
}
And that works like this:
## A Word of Warning
While all this is great for the sighted people, hiding things is *not* actually all that great for those who use screen-readers. For that you’d want to toggle the field to be disabled.
**Categories:** How To
**Tags:** cmb2, javascript, wordpress
---
### [Facebook to Automation: Nuts](https://halfelf.org/2018/facebook-to-automation-nuts/)
**Published:** May 1, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Facebook will be removing the ability to post automatically ... awesome. Nothing will go wrong.
**Content:**
Massive hat tip to [Amanda Rush](http://www.arush.io/?p=92209) for pointing this out to me.
Facebook is dropping support for apps to publish. I quote their [recent post on policy updates](https://developers.facebook.com/blog/post/2018/04/24/new-facebook-platform-product-changes-policy-updates/):
> The `publish_actions` permission will be deprecated. This permission granted apps access to publish posts to Facebook as the logged in user. Apps created from today onwards will not have access to this permission. Apps created before today that have been previously approved to request `publish_actions` can continue to do so until August 1, 2018. No further apps will be approved to use `publish_actions` via [app review](https://developers.facebook.com/docs/apps/review). Developers currently utilizing `publish_actions` are encouraged to switch to Facebook’s Share dialogs for [web](https://developers.facebook.com/docs/sharing/reference/share-dialog), [iOS](https://developers.facebook.com/docs/sharing/ios) and [Android](https://developers.facebook.com/docs/sharing/android).
## What is a Publish Action?
Facebook uses actions to do ‘things’ within Facebook itself. A publish action is, logically, an action that triggers a publish of a post. When you create a Facebook app, you grant it special permissions to do specific actions, in order to prevent people from posting to your Facebook feed when they shouldn’t. If you’ve ever seen one of those popups like this, Facebook is asking you to *confirm* permissions:
Most common are things that read content, like your posts and your friends, and so on. A `publish_action` would be like having your WordPress site automatically make a post on Facebook when you publish a post on your blog.
## Why Are They Doing This?
The argument is that Facebook is maturing and “taking user privacy seriously” because the majority of people never read what permissions they’re granting, or who they’re going to be spamming with the cross posts. The reality? They’re locking down Facebook so if you want to get traffic from Facebook and your articles, you have to *manually* post them.
Now. I hate artificial (and real) monopolies as much as the next nerd, and I do think this is a really cretinous move. But at the same time, by preventing auto-posting, they actually now have a way to combat fake news.
If you watch *The Good Fight*, then you may have seen an episode where a bot script auto-generated posts, purporting to be someone, using fake news sites that people spun up. In season one, that was used to discredit Maia on Twitter. In season two, they took it to Facebook and demonstrated how the fake news sites could be used to target jurors and ensure they got the news.
Seriously everyone needs to watch *The Good Fight*. They’re brilliant.
But the point is this, by restricting people from auto-posting, then someone has to log in and make connections and it’s much easier to track behaviour. Facebook can block a VPN, but they can’t block Amazon AWS servers, after all. And those auto-posts are going to show as coming from your server, not your personal account.
## Do I Need to Care?
Do you use Jetpack’s Publicize to post to your personal account? Then yes. Maybe. I don’t actually know what Jetpack’s going to do about this. My contact (i.e. my friend) just said they were on it, but I imagine there’s a lot of cursing in the background.
Now, notice how I said *personal* account? And *maybe*?
I noticed that Buffer, an app that auto-posts tweets and Facebook posts, said they’d be fine. On the other hand, Bridgely said they’re [killing off their Facebook publish](https://brid.gy/about#facebook-publish) because of this. And on Facebook’s documentation for the APIs, the post to personal timelines information is gone, but the post to *pages* is still there.
Which means I have no idea how horrible this will be. An incomplete block means spammers and fake reporters will move to posting to pages, which many users can post to. I can’t see how that will move the needle very far at all.
Overall, I hate this **and** I think it’s a good thing.
**Categories:** How It Is
**Tags:** facebook
---
### [It's Just Math](https://halfelf.org/2018/its-just-math/)
**Published:** May 17, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Understanding a little more about hooks explains how I run simple math on post saves.
**Content:**
Recently I posted about how I added new features to a show scoring system, over on LezWatchTV. We added in what we call [Intersectionality](https://lezwatchtv.com/2018/introducing-intersectionality/), which is rewarding shows for *positive* representation of diversity in the world. Naturally that begs the question of what is show scoring (answer: it’s calculative a qualitative value of how good a TV show on a scale of 0-100). And *that* makes people ask …
How do you do that?
## It’s really math
Look, the bare answer to all of this is that it’s math. I’m taking the meta data we assign to shows, like how much screen time characters get and how good the show is for them, and so on, and assigning numbers to those values. Then I add up the numbers, in various ways, and determine what the over all score is.
It’s a little more complex than that, and if you’re super interested in how it all works, we wrote up an explanation as to [the framework I created to value shows](https://lezwatchtv.com/about/scoring-queer-shows/).
But most people who ask me how I did this aren’t asking about the math, they want to know about the code. That is, how did I get WordPress to automate all this, because you *know* I don’t do it all by hand. No, I do it when the post saves.
## Magical Hooks
Let’s take a moment. What’s a hook anyway?
A hook is an action or a filter in WordPress, which allows you to write code that ‘hooks’ into the rest of WordPress code. You can use this to trigger your code to run at specific times.
For example, if I had a hook called `publish_post` (which we do – WordPress has that built in), and I wanted to run my show calculations when I publish a post, I would do this:
```
add_action ( 'publish_post', 'shows_calculations' );
```
That would of course require me to have a function called `show_calculations()` that does the math, which is fine. But. I don’t want to do this on post publish. I want to do it on post save, and *only* if the post is of the shows post type. And that sounds like a lot of if/then statements until you learn about *dynamic* hooks.
You see, I’m using the `save_post_` hook, which runs when a post is saved, and it’s a little special. Unlike a hook like `publish_post()`, this hook lets me customize it how I want by being `save_post_{$post->post_type}` …
Yeah those curly brackets are weird, right? That’s the dynamic part. That part changes.
## Dynamic Saving
To understand how the hook name changes, you should know that in my case, I have a post type called `post_type_shows` — logical right? Well the subsequent hook is called `save_post_post_type_shows` — that is, I’ve *replaced* those weird brackets with the post type.
Once you know your new hook name, it’s like every other hook:
```
add_action( 'save_post_post_type_shows', 'shows_calculations', 10, 3 );
```
What that does is call the function `post_type_shows_calculations` on every post save. And that function calls another one I called `do_the_math()` which passes the post ID to the myriad complications of calculations I perform.
But the magic literally is in that post save hook.
**Categories:** How To
**Tags:** actions, hooks, wordpress
---
### [NoEmbed: Embedding What's Not oEmbed](https://halfelf.org/2018/noembed-embedding-whats-not-oembed/)
**Published:** May 15, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Instead of a shortcode, how about a URL?
**Content:**
We all love oEmbed with WordPress. Want to include a YouTube video? Paste in the URL and call it a day!
The magic is that WordPress sends data to the YouTube oembed endpoint (i.e. a special app on YouTube that translates URLs to embed things) and says “Hi, I have this video URL here, what can I use to embed it?” And YouTube replies back “This javascript, my fine friend!” WordPress tips it hat and carries on, swapping the URL out for javascript on the fly.
Awesome.
Except when it doesn’t work because it can’t because there isn’t an oEmbed endpoint.
## What Now?
Usually I [make a shortcode](https://halfelf.org/2017/indiegogo-embed/). But my man Otto always grumbles and tells me to make an embed instead.
The concept of the embed is that we register a ‘fake’ oembed. It’s not an endpoint, it’s just saying “Hey, WordPress. When you see this kind of URL all alone, let’s make magic.”
It’s surprisingly straightforward. All we need to know are two things:
1. What is the URL people are going to paste in?
2. What is the output supposed to look like?
Since we’ve already done this as a shortcode, we’re ready to go.
## Register the Handler
First we have to tell it that we’re making a new handler, called `indiegogo` and this is the kind of URL to expect:
The first part, `indiegogo`, is the name. It should be unique.
The second part, `'#https?://www\.indiegogo\.com/projects/.*#i'` is saying “http OR https” and “as long as the URL starts with `www.indigogo.com/projects`” — it’s ‘basic’ regex.
The last bit, `indiegogo_embed_handler` is the function name we’re going to need.
## Write the Embed Function
This is *very* similar to the shortcode. We take the data, make sure it’s formatted correctly, and output the (in this case) iFrame:
I’ve left the filters in place in case I decide I want to do more weird things to it, without having to edit the core part of my code.
## A GutenGotcha
For some reason, this doesn’t work in Gutenberg, and it tells me it cannot embed the content. Except when you visit the page, everything is embedded perfectly.
**Categories:** How To
**Tags:** coding, embed, wordpress
---
### [A Slightly More Complex Sample Box: Spoilers](https://halfelf.org/2018/slightly-complex-sample-box-spoilers/)
**Published:** May 10, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a very simple Gutenberg block that is editable isn't impossible, and is very much like a shortcode.
**Content:**
Round two!
Once I [made a simple, sample spoiler box](https://halfelf.org/2018/a-sample-block-spoilers/), it was time to jump into the next stage. Customizable, editable, not simple, sample spoiler boxes!
Here’s the best part. All I had to change was the `index.js` file from the previous example.
## The Javascript
## What’s Different?
A few things. A lot of things. The idea is that we need to pass the content attribute (i.e. our warning) to be processed. This is very much like how you pass attributes through shortcodes, so don’t panic.
This says “Set the content to ‘Warning: This post contains spoilers!’ if there’s nothing there. Then watch the focus. If the focus changes, use the new content to replace the original content.”
Down in our `return el` section, we’ve changed it to be Rich Text (so people can use bold and so on… even though it’s always bold), and the `value: content,` is the variable content we edited above.
## What’s It Like?
It’s just like any other Block. It inserts itself when you click the icon, it loads the default, and you can edit it:
And that is a simple, editable, Gutenberg Block
**Categories:** How To
**Tags:** gutenberg, wordpress
---
### [A Sample Block: Spoilers](https://halfelf.org/2018/a-sample-block-spoilers/)
**Published:** May 8, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A simple block for Gutenberg. No frills. Well. One frill.
**Content:**
Before I jump into this, I have to say .. this post was *not* written in Gutenberg.
Sadly the plugin I use for code display, when I need it to be colored and easy to read, isn’t *yet* Gutenberg friendly. And, worse IMO, there’s a bug that causes [multiline shortcodes to be smashed into one line](https://github.com/WordPress/gutenberg/issues/4456), which makes a code block unusable. My two fixes are either the plugin I use be updated (which is beyond my skills at the moment) or I find a new plugin (looking). Or I wait.
Anyway.
Let’s make a simple block that you *can’t* edit!
## There are Four Files Needed
1. `spoilers.php` – This is the main PHP file
2. `spoilers/index.js` – This is the code
3. `spoilers/editor.css` – This formats what you see on the editor
4. `spoilers/style.css` – This formats what you see on the front end
The last two aren’t *required* but I use them to make things pretty.
## The PHP
The PHP file will need to be included in your code however you want to do it. I have a file called `_blocks.php` which includes all my Gutenblocks. In turn, it is included in my plugin’s main file.
## The JS
Here’s the weird stuff. And I’m going to be honest here … I don’t understand all of this yet. But I picked this very simple example because it lets you see what’s going on in a concrete way.
## The CSS
There are two CSS files.
**editor.css**
**style.css**
Back in the js there was a bit that looked like this: `{ className: props.className },`
That’s what tells it to use these. In addition, I use this to call some theme specific code: `{ className: 'alert alert-danger'},`
## The Output
On the editor, I see this:
I included the block icon so you could see the little vault I used to indicate the block.
On the front end, everyone sees this:
## What’s Next?
Making it editable, of course!
**Categories:** How To
**Tags:** code, gutenberg, wordpress
---
### [When You Need Blocks](https://halfelf.org/2018/when-you-need-blocks/)
**Published:** May 3, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Getting started with Gutenberg takes a little effort but it's working just fine.
**Content:**
There are a lot of cases where you don’t need a custom block. My spoiler block [(from last week)](https://halfelf.org/2018/you-dont-need-a-block/) is a great example of that:
But. What about when you want to have that spoiler have choices? Now you’re outside the shared content block territory and into the confusing land of Gutenberg plugins.
## Blocks Are Not Simple
I’m the sort of person who abhors boilerplate plugins. I just do. I feel that they divorce you from understanding what the code is and does, and how it all plays together. The more you rely on them, the less you can debug when it goes sideways. Oh, and it will. It always does.
But. Gutenberg requires a lot more Javascript than I happen to be good at. Or rather, it requires *new* Javascript. Which is why I did exactly what I did the first time I ever made any plugin. I went and found one that did *mostly* what I wanted, and I edited it.
Whaaaaat?
It’s true. And I want everyone to take a moment and realize this is a perfectly normal, okay, thing! In fact, I would like to see Hello Dolly converted to include a Gutenblock because learning by example is a valid, tried and true, way to teach someone how things come together.
## What Examples Are Good?
Okay so where is a good place to start?
- [Modular WP: How to Build Custom Gutenberg Blocks](https://modularwp.com/how-to-build-gutenberg-blocks/)
- [Pantheon: Converting a Shortcode to a Gutenberg Block](https://pantheon.io/blog/how-convert-shortcode-gutenberg-block)
- [WordPress Gutenberg Examples](https://wordpress.org/gutenberg/handbook/blocks/)
- [WP-CLI Scaffold Block Command](https://github.com/wp-cli/scaffold-command#wp-scaffold-block)
That’s enough to get you started, I think. I went with WP-CLI since I like it and I’m used to it. Of course, it came with a small problem. In order to make a block via wp-cli, you *have* to put the code in a plugin (or a theme). Well fine. I did that to scaffold it and then I moved it to where I was developing. Most people aren’t so particular.
## Is It Hard?
Not really. Once you get used to editing the js file instead of PHP, it’s just like hacking any other plugin. Start with the simple thing. Make a block that just does one thing and isn’t editable. My one tip is that when you call your blocks, make sure to wrap it in a check if the function exists:
```
if ( function_exists( 'register_block_type' ) ) {
include_once( dirname( __FILE__ ) . '/spoilers.php' );
}
```
Otherwise there’s a chance that a non-Gutensite will die on you.
Good luck and happy Gutenberging!
**Categories:** How To
**Tags:** gutenberg, wordpress
---
### [You Don't Need a Block](https://halfelf.org/2018/you-dont-need-a-block/)
**Published:** April 26, 2018
**Author:** Ipstenu (Mika Epstein)
**Content:**
Like a great many people, I recognize the need to learn the new world with Gutenberg and adapt my code as well as my writing to the platform. But, like a great many people, I recognized my coding ability might not *quite* be up to snuff with the javascript required for blocks.
But then I asked myself something important. And you should ask yourself this, before you lament about how much work you have ahead.
Do I **need** a new block?
## What’s a Block Anyway?
The concept of ‘block’ writing is one people who use Scrivner may be familiar with. Or maybe if you’ve ever been a part of a writer’s room, breaking down a season of a TV show. The idea is that each index card is it’s own entity.’ Or rather, in the case of WordPress, each paragraph is it’s own entity.
This means you can move the paragraphs around, which for paragraphs makes little sense. But for layout? Oh it makes a great deal more sense. A block is, literally, a block you move around until your page looks the way you want it to. Awesome.
## Why Don’t We Need Them?
Actually the question should be **when** don’t we need them? Obviously we need blocks. That won’t change. But by default WordPress has quite a number of blocks out of the … block. And that begs the question of when and why do we need to make *new* ones?
This is a question many developers who have shortcode plugins will be asking themselves, and the realization I stumbled across at WordCamp San Diego is that … a lot of developers don’t need to make new blocks! Because a lot of shortcodes aren’t actually going to be all that necessary in the future.
Let’s use an example of something common…
## Example Shortcode: Spoilers
Let’s say you have a WordPress site and it sometimes talks about spoilers.
Today in WordPress an easy way to put a warning at the top of every page would be with a shortcode that looks like `[spoilers]` or if you’re feeling puckish, `[spoilers warning="OMG SPIDERS!!!"]`
Those would output a simple paragraph that warned people about spoilers.
Right away, I thought “Oh, that would be a nice, easy sort of thing to turn into a block.” It’s just a direct output of some code:
```
' . $warning . '
```
But then I thought …. What if I *don’t*?
## Enter Shared Blocks
Shared Blocks, formerly called reusable blocks, are blocks of content defined by each site, specific to the site, that are .. well .. reusable. You don’t need to know how to code to make them, either. Which means you don’t need a developer to do this. Start by just making a new block with the content:
**Warning:** This post contains spoilers!
That’s easy. But what we want is to apply color to it. And that can be done in a number of ways. The easiest would be to use the advanced section in the block editor and add an additional CSS Class of, in this case, alerts.
But that isn’t the only way…. Because I can also make this:
Whaaat? Total game changer!
## Gutenberg Blocks Are Editable
In every single Gutenberg block you can change text and color to suit your needs. I edited that particular block and said I wanted the background to be one color, the next another, and I wanted the size to be Large. I’m aware the large size doesn’t show properly… I also told it how I wanted the block alightment to look:
## Okay, But Reusing?
Don’t worry, I didn’t forget. When you hover over a block there are three vertical icons on the right indicating a menu. Click on the menu and you get options and one is to convert it to a shared block. Click on that, give it the name you want, and you’ve created a block!
 The share icon in the lower right is how you know.
And now, when you go to enter a new block, you click on the plus button on the left, click on ‘Shared,’ and you have this:
## What’s Missing?
Right away you’ll notice you can’t edit the shared block without editing it for everyone. So if you made it “Aaaaaahhh! Spiders!!!!!” everything would change. And that’s not great for everyone. But for a lot of people who just want a simple, repeatable, notice or signature, this is just fine.
It won’t spare you having to convert some of your shortcodes to blocks, but it may make life easier for people who don’t want to have to use them in the first place. And that, I think, is a win.
**Categories:** How To
**Tags:** blocks, gutenberg, wordpress
---
### [AutoDeploy: Github to DreamObjects](https://halfelf.org/2018/autodeploy-github-to-dreamobjects/)
**Published:** April 24, 2018
**Author:** Ipstenu (Mika Epstein)
**Content:**
There are a lot of things that Github makes easy. One of them is a great way to keep versions of data publicly accessible, trackable, and deployable.
Well. Not so much that last one.
Automated deployment with Github can be incredibly convoluted, twisted, and perplexing. If you don’t speak high geek, it’s worse. Thankfully there are services like [Codeship](https://codeship.com) that let you ship code, run tests, and more importantly, run some hefty commands.
When the day came that I wanted to keep some JSON files on Github for version control, but deploy them to the cloud, I knew what to do. I was already doing a version of the process, in reverse, for my [Remoteless SVG](https://halfelf.org/2018/remoteless-svg/) images, after all.
## Create Your Repository
Now I’m using Github, but Codeship supports Bitbucket or Gitlab, so that’s also an option. Once you’ve made your repository, commit your code but *don’t* push anything yet! We have to make a couple decisions first.
First: Branches.
I have two philosophies of this. If I’m working on something like a plugin or a theme or an app that needs versioned releases, I’m going to name my branches `REL_1.2.3` and so on. If, instead, I’m maintaining a theme or plugin for personal use, I have a `development` branch that I use for all normal dev work. I may spin up a special branch for some new feature, but it always goes into that dev branch first.
Second: Deployments.
The reason I use that branch system is that when I push to the dev branch, it pushes code to the dev server.
 Mind? Blown.Once you decide how you want your set up to deploy, and when, you’re ready to Ship That Code.
Gettit? Right…
## Setup Codeship
If you’ve never setup Codeship before, I explain how you do that in my post about [Deploying from Github with Codeship](https://halfelf.org/2017/deploying-github-codeship/). The special sauce here is your Custom Script.
Before you write the script, add in [Environment Variables](https://documentation.codeship.com/basic/builds-and-configuration/set-environment-variables/) for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` with those names specifically. This way you won’t have to write a mess of custom code.
```
pip install awscli aws s3 --endpoint-url https://objects-us-east-1.dream.io sync ~/clone/ s3://bucket-name/
```
The important bits:
- Endpoint URL is my S3-esque host
- `bucket-name` is my bucket name…
## Push Your Code
Once that’s saved, you can push code and it’ll automatically kick the code to the cloud.
A lot of this is obviously a backwards implementation of code I already described, but sometimes we need something explained in the straightforward way to help us move forward.
Enjoy your deploys!
**Categories:** How To
**Tags:** Codeship, deployment, github
---
### [Posts by Day, Every Year](https://halfelf.org/2018/posts-by-day-every-year/)
**Published:** April 19, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Get a list of all posts on a day, regardless of the year.
**Content:**
In my previous post I mentioned a site that has a tag for a date. That is, it uses `25-march` (or `march-25`) to tag it’s posts so someone could conceivably find all the posts made on March 25th in every single year.
WordPress makes it easy to list all the posts on a specific date. Just visit `example.com/2018/04/19/` and you’ll see all the posts made on April 19th of this year. Remove the 19 and you get everything from April and so on and so forth.
But you can’t, out of the box, list everything on April 19th from every single year the site’s been up.
## WP\_Query has Dates
As of 3.7, WordPress has a `date_query` aspect to `WP_Query` which lets you do this:
That generates an array of every single post that has the same month and day of today, but does not check the year. If you don’t want all the posts, just the last ten, use `'posts_per_page' => 10,` instead.
Once you have your list of posts, you can use a normal loop to display the content:
**Categories:** How To
**Tags:** coding, wordpress
---
### [Organization](https://halfelf.org/2018/organization/)
**Published:** April 17, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Understanding tags vs categories vs custom taxonomies vs custom post types, and how they all mesh together.
**Content:**
In September 2005, Lorelle wrote what I consider to be the [definitive piece on tags vs categories](https://lorelle.wordpress.com/2005/09/09/categories-versus-tags-whats-the-difference-and-which-one/). In 12 years, my opinions have not changed and I still feel her explanation is correct. That said, there is room for improvement at scale.
## The Gist
Her advice boils down to this:
- Categories are a table of contents
- Tags are index words
By this we mean that categories are the high-level, big ticket items, and tags are the smaller, more precise terms. This is, I feel, the heart of understanding the two.
Further down, Lorelle states that at around 25 posts, a tag is ‘big enough’ to be a category, and that if a category dominates a blog, it should perhaps be a separate blog. And that’s where I disagree.
## On Beyond Zebra
When she wrote her post, the concept of custom taxonomies was barely a gleam in someone’s eyes. Multisite was still WPMU, and a separate installation. Today we have the ability to add our own taxonomies (either in category or tag styles) and we can create a network of related sites on our own. All we need is a little more technical know-how.
When we add on custom taxonomies, we afford ourselves a new way to classify posts, so to the above I would add this:
- Custom Taxonomies are critical but exceptionally unique index words that must be grouped together
Okay that was long, I know, but a Custom Taxonomy is in essence a new subdivision of your site. You can either make it a new table of contents or a new index … or a combination of the two. It’s a little wild, especially when you factor in custom post types.
## Overwhelming Category? Custom Post Type!
Instead of making a new blog when your category gets too large and unwieldy, I would recommend making a new custom post type. If I use my helpful example of LezWatchTV, we currently have three custom post types: Shows, Actors, and Characters.
While we could have made them into posts, and used categories to index them, having them be their own post type means instead of a table of contents, I’ve made an appendix. This gives me access to all the cool WordPress features, like archives and sorting and organization, but it does so outside the realm of posts which restricts crossovers. Unless you’re really clever with cross-related content.
A custom post type keeps it all on one blog, but separates them like your laundry.
## Too Many Tags? Custom Taxonomy!
If you find yourself having too many tags, it’s time to consider a custom taxonomy. Again, pointing to LezWatchTV, actors have two custom taxonomies: gender identity and sexuality. While those are the same as we use for characters, by having them separate and only applicable to the actor post type, we are able to give a list of all trans female actors with a click. In other words, we’re using WordPress’s native features.
But if we look at the custom post type for TV shows, we have a lot more taxonomies, including two that are constantly being added on to: nations and stations. Every time a new station airs a show, we have to add it in. And there, as of April 1, we end up having 29 nations and 168 TV stations.
Which brings up the next problem, and one that Lorelle does indeed address, but not the way I would.
## When Tags Go Rogue
Can tags still go too large? Yes. Oh my lordy, yes.
Recently I saw a site that used unique tags on every single post. I physically flinched when I realized that.
You see, they had around 30,000 posts and 48,000 tags, and for the life of me I couldn’t understand why until I read the site and looked. For every single post there was a commensurate tag for the post title and the date. After 365 dates they thankfully started to repeat, so you might have 10 posts for the `march-25` tag. Except they weren’t consistent and someone else used `25-march` and now you can see the rabbit hole fall into infinity and beyond.
Now that said, I have 168 tags for TV stations, each TV show has one, maybe two if they’re lucky or weird, and some tags only have 1 show listed. Others, like ABC, NBC, and CBS, have around 60. Do I think any of those are ‘too large’?
I don’t. Because the number of 25 posts to a tag only holds up at a smaller scale. With 100 to 200 posts, yes, that starts to make sense. At 600 to 3000 posts, suddenly having 198 posts tagged with “Bury Your Queers” doesn’t sound so out of place. It’s about the percentages, somewhat, and also the use-case.
If I know people are looking for a smaller tag (say they really want to see the 10 shows that have the ‘Fake Relationship’ tag), then for the purpose of *this* site, it’s important. On the other hand, if only one character was tagged cougar, I might not keep the tag as it’s too small to make the data useful.
## Optimal Organization
There is no magic number of tags to categories to custom post types to taxonomies. It all comes down to understanding the goal of your site, the way users look for data, and what is maintainable to you.
In the case of the site with 48k tags, I would have them delete all the date ones, as well as the ones with the same names as posts, and stick to using topical tags. After all, if a tag is only used once, or duplicates some feature already found in WordPress, it’s perhaps not the best idea.
**Categories:** How It Is
**Tags:** administration, essay, taxonomies
---
### [Shortcode Example: Reviews](https://halfelf.org/2018/shortcode-example-reviews/)
**Published:** April 10, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A shortcode for reviewing things in a standard kind of way.
**Content:**
Sometimes people want to have reviews mean ‘people leave reviews on my work.’ But the other kind of reviews are the ones where I review other peoples’ works. And for that, I found it helps to have some kind of standard.
Let’s say I’m reviewing a TV show for overall quality but also overall gayness. That is, I want to be able to write up a post and then, at the bottom, put up a shortcode to say “This show is really good but has no gay characters.” To do that, I made a list of the important factors to distill:
- Name: The name of the TV show
- Summary: A short, 140 character summary of the overall show.
- Queer: A 1-5 rating of how queer the show is
- Rating: A 1-3 scale (yes, meh, no) for how good the show is overall
- Warning: Is there a trigger warning (or CW) to be aware of
The intent is to make it easy for someone to scroll down and find what they want to watch. Right?
## The Code
A bit of warning. There are two specific to my site bits of design in here. First are the icons. While I’ve generalized them for you as Emoji, keep in mind you probably want to have your own style here. Second, I’m using Bootstrap, so I’ve leveraged some of their default code. You’ll want to tweak the CSS.
## The Future
I’m thinking about changing the scores from numbers to stars, and adding in a link if the show has been added to the site. But it being a shortcode, it’s reasonably extensible.
Enjoy, and export to your own review sites.
**Categories:** How To
**Tags:** shortcode, wordpress
---
### [WP-CLI Tables](https://halfelf.org/2018/wp-cli-tables/)
**Published:** April 12, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Aiding debugging efforts with WP-CLI and table output.
**Content:**
I was working on an update to the Varnish plugin I’ve adopted, and one of the requested features was for more debugging tool. I’d added in a status page, but this plugin is also used by web hosts, and sometimes asking a customer “Can you go to this bad and send me the results?” is a time sink.
So why not add in a command line tool?
## WP-CLI?
I love [WP-CLI](https://make.wordpress.org/cli). It’s a command line interface (CLI) for WordPress (WP) that lets you do most anything via the command line. You can install and activate plugins, update themes, even write posts and add users. But if you’re tech savvy, it’s also a great tool to automate and manage the minutia of WordPress maintenance drudgery.
I’d already built out a basic varnish flush command (`wp varnish purge`) so adding on to it isn’t terribly difficult. But what was difficult was making the output what I wanted.
## Start With an Array
No matter what you need an array of the correct format for this to work. I was already storing everything in an array I save in a variable called `$results` that looks like this:
I was initially doing this so I could loop and output all results with an icon and message on the status page, but translating this to wp-cli was a matter of taking the array and repurposing it.
## WP-CLI Tables
In order to add in a table output to WP-CLI, you use the `format_items` function:
The `$format` value is taken from `$assoc_args['format']` (I set mine to default to table if it’s not defined). The `$items` are your array, and the `$headers` are another array of what your headers are.
This is the tricky part. You have to make sure your array of headers matches your array of items, *and* fulfills the output you desire. In order to do this, start with figuring out what you need to output.
In my case, I wanted a name, a status (aka the icon), and the message. This means my array looks like this: `$headers = array( 'name', 'status', 'message' )`
## Rebuild The Array
Once I sorted out what the format was like, based on the headers, I built the items array as follows:
Remember, my `$results` were already an array. I’m just making it look right here.
## Final Results
How does it look? Like this:
And that is a nice tool for people to debug.
**Categories:** How To
**Tags:** debug, wordpress, wp-cli
---
### [Google Auto Ads](https://halfelf.org/2018/google-auto-ads/)
**Published:** March 22, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Automagical ads from Google.
**Content:**
After upgrading my theme, I saw a note that I could add my Google Adsense ID, but “Auto Ads must be enabled in your AdSense account for this feature to work properly.”
Auto Ads?
## Auto Ads
[A month ago](https://adsense.googleblog.com/2018/02/introducing-adsense-auto-ads.html) Google introduced a new way to handle ads, and simply that is you don’t have to mess around with placing adds. You put your code in and then you tell Google “Gimme them auto ads!” and they add in … well … ads.
Depending on your options, you can show in-article ads or just section ones, and it comes out looking a bit like this:
## Not Perfect
There are some issues with this.
There are obvious pros to this, and mostly it’s that I don’t have to think about where an ad is going to go. I can tell Google “Show a medium amount of ads where you think is best” and walk away. I don’t have to worry about which ads to use. Also they use Google’s ‘what fits with the content’ magic algorithm.
But.
I can’t exclude certain areas.
Which means on one of my sites has an extra hunk of ads in the headers, as Google inserted an ad in each section. And I can’t tell it not to put adds in specific sections. I *can* tell it not to put ads on specific pages, and with Genesis I can do that from within WordPress, but the options just aren’t quite where I want. Yet.
## Setting It Up
Like all
1. In the left navigation panel, visit My ads and select Get Started.
2. On the “Choose your global settings” page, select the ad formats that you’d like to show and click Save.
3. On the next page, click Copy code.
4. Paste the ad code between the < head > and tags of each page where you want to show Auto ads.
It takes about 20 minutes for ads to show up
If you’re using Genesis themes, [upgrade to 2.6](https://studiopress.blog/genesis-2-6/) and paste your Publisher ID in the new setting field for Auto Ads, in either the Theme Settings, or the new Customizer panel.
If you don’t *want* that at all, Gary Jones made a plugin to [remove it entirely from Genesis Themes](https://github.com/GaryJones/genesis-disable-adsense-auto-ads). Though I’d point out you don’t have to use it if you don’t want.
**Categories:** How To
**Tags:** ads, genesis, google
---
### [Genesis Theme: Anonymize Posts](https://halfelf.org/2018/genesis-theme-anonymize-posts/)
**Published:** April 5, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Removing ego from posts by removing the author.
**Content:**
Actually, I anonymize my *pages*.
See, I have multiple authors on a site, and one of the things I like is to celebrate them when they post. Awesome. But I *don’t* want to highlight who wrote the pages on the site. Or who posted the videos. Those are informational and don’t need any ego attached.
When using StudioPress’ Genesis theme, you can edit the post authors by filtering `genesis_post_info`
## The Code
Now all my posts are by Barbarians!
**Categories:** How To
**Tags:** genesis, themes, wordpress
---
### [Light Fingered Fish](https://halfelf.org/2018/light-fingered-fish/)
**Published:** April 3, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stealing hooks to make your fish fly with Jetpack's contact form.
**Content:**
To explain the joke before we get too far, Jetpack’s contact form was originally called Grunion. The book “Memory” by Lois McMaster Bujold uses the phrase “light fingered fish” to talk about fish who elude hooks.
I was building a site for my father and he wanted the contact form to redirect to another page. Thankfully you can do this with a filter on `grunion_contact_form_redirect_url` (see? Grunion? Fish?)
## The Code
If you use the official code, then you’re going to need to know two things:
1\) What is the page *ID* you’re redirecting from
2\) What is the page *slug* you’re redirecting to
Yes, it’s weird that you have to know those, but … well. That’s what we’ve got. I tried to come up with a reason why, and I think it’s just that searching for posts by slug is hard.
Buuuuut what if you wanted to do it by slug?
The benefit to this is you can change the post ID and, as long as it has the same slug, you’re good to go. Also let’s say you have a bunch of separate contact pages (contact-me, contact-mom and so on). You could use the logic to redirect all pages that have the word ‘contact’ or ‘about’ or ‘surprise’ …
**Categories:** How To
**Tags:** contact form, hook, jetpack, wordpress
---
### [Safari and SameOrigin](https://halfelf.org/2018/safari-and-sameorigin/)
**Published:** March 20, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes Safari is a special snowflake when it comes to clickjacking. Who knew that would break Customizer?
**Content:**
I was updating a site I’ve been neglecting. Due to reasons, it’s been about four months since I’ve looked at it, let alone done any work. But as I was cleaning up the data, moving ads around, and messing with widgets, I found myself stumped.
Customizer was a blank screen.
## Debugging Javascript
Now I happen to know that the WordPress customizer makes heavy use of javascript, so I popped open the console and found this error:
Right away, I knew that the problem *wasn’t* Javascript.
## Safari is Special
A quick search netted me two possible tickets. First, there’s the problem with [customizer failing to load if there was a home/siteurl domain mismatch](https://core.trac.wordpress.org/ticket/39128) and second, [there’s the issue that customizer fails to load in Safari due to X-Origin Header mismatch](https://core.trac.wordpress.org/ticket/40020).
In reading those tickets, I determined that it was *possible* that since this site has WordPress in a folder (yes, named `wordpress`) but runs from the main domain, that could break it. There was also a possibility that NGINX or Apache were set to restrict SAMEORIGIN. Finally, there was the absolutely daft problem that Safari was special and didn’t like extra rules.
Now, since this server runs multiple sites, and only *this* one was having any problems, I threw out all possible server related causes. I also discarded any Multisite related causes, as the site wasn’t the network. Next I determined it absolutely was Safari, by testing on Firefox and Chrome. That left me with the following probable causes:
1. Some code on my site was breaking customizer
…
No, really. That was it.
## The Solution
Two choices here. Figure out what was broken or stop using Safari.
I have reasons for using Safari, so I knuckled down. I searched all lines of my code for anything related to `X-Frame-Options` and came up empty. I tested by commenting out the relevant lines in WordPress core, which worked, but wasn’t tenable.
Then I changed my search and looked for `X-Frame-Options` in all `.htaccess` files, and found this:
Removed that, and done.
## Why Was It There?
I actually put that code in to prevent clickjacking. Clickjacking is what’s called a “UI redress attack.” It happens when a malicious attacker uses transparent or opaque laters to trick someone into clicking a button or a link on page, when they were intending to click another. Usually this is to steal private information.
WordPress already does this for the login page, and for this site, that’s actually the only time ‘private’ data is sent on this site. Which means it’s mostly safe enough to leave be. There are ways I could do this in PHP code, but since WordPress isn’t the only tool on the site, it’s harder to maintain.
The better fix would be to, with Apache or NGINX, check the domain and URL, and only apply clickjacking when I’m not in Customizer.
Of course I have no idea how to do that. Yet.
**Categories:** How To
**Tags:** customizer, debug, safari, wordpress
---
### [Types of Related Posts](https://halfelf.org/2018/types-of-related-posts/)
**Published:** March 29, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's all about relativity.
**Content:**
At it’s heart, related posts are the drive to help people find more content on your site. They serve no other purpose than keeping people on your site by piquing their interest in your words.
But what if I told you there were multiple types of related posts for WordPress?
## Categories and Tags
The first type of related posts are really just organization. I have three main categories on this site: How It Is, How It Works, and How To. I also have a million tags, like everyone else. If you wanted to read my thoughts on how things are, or rather why they are, you’d scroll through the category of “How It Works.” If you wanted to see everything I wrote about SVGs, you would check out my tag of ‘svg’ or possibly ‘images.’
The point here is that categorization is a type of related posts. It’s entirely manual, but it’s the best way to say ‘These posts are like each other.’ And they have a fatal flaw. You see, if I wanted to read all the “How To” posts about SVGs, WordPress doesn’t easily cross relate. That is, I can’t list all the items in a category *and* a tag.
Which is why we have …
## Related Posts Plugins
There are two main types of plugins for this. There are the services, like [Jetpack’s related posts](https://jetpack.com/support/related-posts/), that scrape all your posts, toss them into a database, and use some complex algorithms to sort out what is and isn’t related. The other sort scan your posts locally and figure the same thing out.
So which is better? Well. Jetpack requires you to trust Jetpack, or whatever service you pick, with your data. For some people, this can be a deal breaker. On the other hand, if you run it locally, you’re at the behest of how fast your site runs. For example, if it scans your posts live and you have, say, 300k posts, then that could be really slow. Or if it makes it’s own database table, how often is it going to update and cross relate?
By the way, the 300k posts is not an exaggeration. That’s a site I looked at recently.
## Alertnative Relations
There’s a secret third option, actually.
I called it [Semi Related Posts](https://halfelf.org/2017/semi-related-posts/), and while I did it across post types, you could use the general logic. The concept is that instead of letting your site try and divine relations, you could manually connect them. It does require more upfront work, but cross relating posts by hand gives you the ultimate control.
Of course, you’ll note that I did automate this as much as I could. I’m not crazy you know. If you can find a way to do that, maybe code a way to list 4 other posts in the same category *and* tags as this post, then you’ve automagically automated the simple.
Until you hit that 300k post limit. Then you’ll have to rethink things again.
**Categories:** How It Works
**Tags:** related posts, wordpress
---
### [A Name is Not A Description](https://halfelf.org/2018/a-name-is-not-a-description/)
**Published:** March 27, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** "Hello, I'm female developer."
**Content:**
One day, you found a app or plugin or add-on for something. It was a feature you always wanted, did exactly what you needed, was well written and supported. It was that panacea of perfection. You loved it. Then you had a computer crash, or a house fire, or moved, and you forgot what the name was. All you could remember was the name was *something* about what it did. So you decided to Google for it, and quickly found a billion things that fit the bill.
## SEO vs Generic
When you’re naming your product or company, you work very hard to think of a name that encapsulates what you are, what you do, and what makes you unique. For example, you don’t name yourself “Shoe Company” and expect people to be able to find you. With very few exceptions (and really only [No Name](https://www.loblaws.ca/collections/No%20Name/) comes to mind), if you want to stand out, you pick a good name where you are prominent.
This directly relates to SEO, and people’s ability to find you. Ever used Apple Pages or Sheets and tried to Google something? Like “How do I make Pages Templates” perhaps. You often feel damn lucky when you get the right result immediately:
But you’re not Apple, are you? So if you named your product “Foods,” you’d probably have a devil of a time getting ranked so people could find you in search!
## Unique vs Memorable
Take a look at WordPress. Pretend you’re looking for a slider plugin. Hush, just come with me here. Now. You remember a really cool slider plugin, but all you remember is it was named something like “Best Slider Plugin.” Yeah. You ain’t gonna find it. Probably ever. But what if you were looking for a lightbox plugin, and you remembered the name as “Foobox Lightbox” … Hang on a second. That’s one you’re going to be able to find. It has a unique name, but better than that, it has a *memorable* name!
The only reason Apple Pages actually works is that Apple is *huge* and also the fact that most of us Google “Apple Pages whatever” and not just “Pages.” It’s the same with the Apple Watch. It’s nice they call it “Watch.” We call it the “iWatch” because we have to be able to find it, and they picked stupid generic names. Being Apple, they can get away with it.
To their credit, the name is memorable. It’s not unique, but you will remember it. Even if you remember it as “That stupid Pages app Apple made.” You remember Microsoft Word, but you also will remember WordPerfect, and possibly WordStar. But if you listed four Twitter apps, could you remember what differentiates each one without looking? Definitely unique names, like Tweetbot and Twitterific, and certainly memorable, but in the wrong way.
## Names vs Descriptions
Many people make a common mistake. They remember the tools they use on their computers, like “TextEdit” and “Notepad” and they think that in order to be found, the name must be short and descriptive. That’s why we get Notepad++ and iTerm. To an extent, this works. LastPass and OnePassword are going to be memorable *and* unique *and* descriptive names. But the longer a product, or suite exists, the more likely they are to corner a market and make it harder for the little people.
Let’s go back to WordPress. You’ve made a great popup plugin and you want everyone to know it. There are roughly 500 plugins that use ‘popup’ or ‘popups’ as a tag. There are 2500 or so plugins that show up for a search on ‘popup’ in the directory. Besides the fact that you really should use the ‘popup’ tag in your plugin, there’s no way in the world you’re going to get your new popup plugin to the top of the list in a day.
But … users don’t look for ‘popup’ or even ‘best popup plugin.’ They look for something else. “WordPress popup plugin with call to action on page exit.” They may simply that to “wordpress popup plugin call to action page exit” but they’re going to look for what they need. And they’re going to *remember* the plugin named “Wait Don’t Go! Popups” that has a nice plugin description of “Grab your visitors’ attention one more time before they leave your page forever.”
## Humans vs Robots
Putting a million buzzwords in your product’s name, the description, and the URL aren’t ever going to make you popular. The only thing that does is bring people in the yard. If they see your website is fill with upsell and hyperbole, they’re going to walk right out again. If they see features and explanations and proof that you are, indeed, the bees knees, they’ll stay. If you have a catchy or unique name, they’ll remember and recommend you to their friends.
And then, then you will be a success.
**Categories:** How It Is
**Tags:** development, essay
---
### [Reordering Facet Displays ... For Death](https://halfelf.org/2018/reordering-facet-death/)
**Published:** March 8, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using FacetWP to tackle multiple deaths, sort ordering, and of course, Sara Lance.
**Content:**
Isn’t that a catchy title?
I’m using [FacetWP](https://facetwp.com/?ref=91) to help me order and sort archives in ways that are reflective of the content. One of the things I sort are characters (yeah yeah yeah) and some of those characters are dead. It occurred to me that wouldn’t it be nifty if I could sort the characters by *when* they died?
There was just one problem. Actually there were two. One was Sara Lance, and she’s my personal demon. The other was my own stupidity and lack of foresight. Neither were insurmountable.
## How FacetWP Changes Sort Order
Before I get into the weeds, let’s have a moment to talk about sort order. FacetWP has a way to [filter the sort orders](https://facetwp.com/customize-the-facetwp-sort-options/).
So for an example, I have post meta value for the number of characters saved as `lezshows_char_count` for all shows. If I wanted to sort shows by the most characters to least, I can add this in:
It looks very similar to `WP_Query` and that’s what makes it easy. Except for my two problems…
## Problem One: Formats
The first problem was **not** the Sara Lance problem. It was the ‘Mika didn’t think about things 4 years ago’ problem. I was saving the dates of death in the format of `MM/DD/YYYY`
If you’re an American, you’re wondering “So what?” and if you’re anyone else, you’re giving me a death glare because “08/05/2010” could be August 05 *OR* May 08, and damn it, I knew better. For what it’s worth, the output on the front end is always “05 August 2010” but that’s not here nor there.
You see, the issue isn’t that I was using stupid date/time formats, the issue is *sorting*.
In the previous example, I have an order of `meta_value_num` which is literally a number. What’s the one for dates? You get `meta_value_date` or `meta_value_datetime` and *neither* of them work with the date format I’d chosen.
So for this to work, I had to go and change everything from `MM/DD/YYYY` to `YYYY/MM/DD` – Not fun, but doable. And it led me to my Sara Lance Drama…
## Problem Two: Arrays
How many times has Sara Lance died? Right now, three.
When I decided to sort by the date of death, which one did I pick? Long pause.
I decided to pick the last one. That is the most recent death. If someone’s actually still dead, the most recent death is the one that stuck. If they’re not, then death was pretty arbitrary to begin with and there ya go.
The question became how and where did I save the death? I went with a post meta of `lezchars_last_death` and had it auto update on post save, like this:
If there is a latest death, we get to set it as the `YYYY-MM-DD` value and off we go. But…
## Problem Three: Orderby Hellscape
Surprise! I ran into a third problem! Remember how I was using the `orderby` of `meta_value_num` in my example? And I mentioned that I wanted to use `meta_value_date` or `meta_value_datetime` to sort by date?
Yeah no.
If I’d converted the date into unix time, sure. But I was reusing this logic in a couple places, and I didn’t want to re-save *everything* like that. I also use a query to grab all deaths in a year, and basically I do need to keep it with the format I have. That just messed up my sort until I found the magic of `orderby' => 'meta_value',`
## End Result?
It works. It’s got yet *another* post meta, which I’m not super happy about, but sometimes that’s really just the simplest way to solve a problem. The data is always updating itself, and it’s relatively easy for me to tweak it. Also now I can do a lot more searches in different ways.
Since I don’t have to worry about database size at the moment, nor speed, since I’ve designed it well, this works for me.
**Categories:** How To
**Tags:** facetwp, sorting, wordpress
---
### [CORS - Not Beer](https://halfelf.org/2018/cors-not-beer/)
**Published:** March 13, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making remote files accessible isn't always as simple as a link.
**Content:**
I’ve been struggling with the idea of remote loading SVGs. There are a lot of problems with this, mostly due to the DOM structure of how your browser loads an SVG file.
## What’s an SVG and the DOM?
Scalable Vector Graphics, or SVG, is a special XML file. It’s generally used like an image, like JPG or PNG, and contains vector graphics. This makes it smaller than PNGs and scalable without resolution loss. Pretty nifty for icons. In fact, better than my beloved Fonts.
This is a part of the Document Object Model, or DOM. In the file, you tell it how you want the content to render. It’s why an SVG can be so powerful, having all the code you need inside a small file. It’s also why it’s so dangerous. Specifically if can contain Javascript code, which can be embedded and hidden in an image. And that can do a lot of damage. If you’re not paying attention, you can upload an SVG with javascript that runs code on the user’s browser. Bad times all around.
Making this worse, if you use `` tags to embed the SVG, many browsers will execute the code. Even today. Yeah… Not really a good thing.
## Embedding SVGs externally has a cost
If you want to include an SVG file in your web page, you *can* use that dangerous `` tag, but you can also use `` code right in the document. The problem there is that requires the SVG to essentially be pasted into the code. For PHP, you can use code like `file_get_contents()` (which doesn’t always work remotely) or if you’re WordPressy, `wp_remote_get()`
The catch there? They’re slow if you list, oh, 69 images on a page. You can, of course, use `` tags and that loads the SVG remotely, perfectly happily. If you’re sure about your SVGs, this is okay. You’re just going to lose one big, super big feature about SVGs.
You can’t use CSS to edit them (color, resizing, etc) anymore.
And that, my friends, is a big problem.
## Javascript End Run
I wasn’t willing to compromise speed or flexibility. I’m particular like that. So I looked up how you can use javascript to hack the DOM. I quickly found [SVGInjector](https://github.com/flobacher/SVGInjector2), a fast, caching, dynamic inline SVG DOM injection library. Installing and configuring was easy buuuuut…
You saw that but coming, right?
Right.
It didn’t work. Because of CORS.
## What the heck is CORS?
Cross Origin Resource Sharing, CORS, is that magical thing that says “Hey you can’t run this resource remotely, yo!” Generally it’s related to Fonts (if you’ve ever tried to embed your own fonts from your own servers, you’d have run into this). I happened to hit it on SVGs, and basically the server where I host the icons wasn’t allowing my servers (local or otherwise) to load the icons.
Thankfully! I use DreamObjects, and you can totally set up [CORS on DreamObjects](https://help.dreamhost.com/hc/en-us/articles/216201557-How-to-setup-Cross-Origin-Resource-Sharing-CORS-on-DreamObjects). You can do it on Amazon S3, and I think all the various CEPH-esque services let you.
The catch here (hah you saw that coming, right?) is that not all *clients* let you do it. Lucky for me, I have [s3cmd](http://s3tools.org/s3cmd) on my laptop (you should too if you’re going to work with S3 type services – it’ll make your life easier). Installing is easy, and you just have to make a `.s3cfg` file ([DreamHost has some instructions](https://help.dreamhost.com/hc/en-us/articles/215916627-S3cmd)).
Once that’s set up, you can make your rules file like this:
and then you can set (and check) your CORS:
And now you can embed your SVGs remotely.
**Categories:** How It Works
**Tags:** cors, dom, external, image, svg
---
### [Remoteless SVG](https://halfelf.org/2018/remoteless-svg/)
**Published:** March 15, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Copying code to the cloud and syncing it locally isn't impossible. Just annoying.
**Content:**
I spent about half a year working on being able to remote load my SVG, and I wanted to for a few reasons:
1. Having only one place to update my icons is more efficient
2. They don’t need to be in code versioning control (like GitHub)
3. Licensing (not all are free)
I solved those problems when I finally figured out SVG Injection (via javascript) and CORS to allow the scripts from my objects.
## It’s not all lollipops and sunshine
However. There was, and is, one really big issue. The icons being remote mean if the remote server isn’t accessible but my site is, I got no icons. Now, the smart dev in me knows that I should have a check. If the server is up, use the icons remotely. Otherwise, use a fallback.
There was one big, and in the end insurmountable, problem with that. There was no way to do that without slowing my site down, [which was the headache in the first place](https://halfelf.org/2017/curious-case-comatose-cloud/). If I check the uptime for every icon on a page, the site went from a 1 second load to up to 20 seconds. In the best solution, I added 2-5 second load to every page checking if the server was up on every page load. Which is kind of the problem with `wp_remote_get()` in the first place.
## Make ’em local again
This meant the ‘best’ solution was to make them local. Again. Yaaay.
But I really didn’t want to have them stashed in GitHub. I wanted my ‘base’ to be the cloud storage, and then that needed to sync. Normally I would use rsync for that but you can’t rsync from CEPH storage.
Don’t panic. There are answers.
### Boto-Rsync
If you’re on DreamPress or any DreamHost server, they’ve forked [`boto-rsync`](https://help.dreamhost.com/hc/en-us/articles/217473218-How-to-use-boto-rsync-with-DreamObjects) and (if you set up a `.boto` file) you can do this:
Using cron or some other scheduling tool, setting up a server to run that at regular intervals isn’t too terrible.
### AWS CLI
There’s also the option of [AWS CLI](https://help.dreamhost.com/hc/en-us/articles/216335908-How-to-use-AWS-CLI-with-DreamObjects), which is very similar, only it’s actually maintained. The advantage with `boto-rsync` is that it’s installed on the servers at DreamHost. If you have AWS CLI on your server, you can do this:
Keep in mind, you need to configure this either with `aws configure` or an `~/.aws/credentials` files.
## Pushing from the outside inside
You may have noticed that, unlike `rsync`, I can’t tell it to push to another server. That is, I can say “sync files from server A to server B” with `rsync` and I *can’t* with either `boto-rsync` or the AWS CLI.
And no, you just can’t.
Unless you use [rclone](https://rclone.org). Which is a little messy but totally do-able.
There’s one other option though… I’ve been using [Codeship to push code](https://halfelf.org/2017/deploying-github-codeship/). That is, every time my GitHub repos update, it triggers a Codeship deploy. And in that deploy I usually just say “Rsync a git clone, k’thnx’bai.”
Now I tell it this too:
I will note there’s *one* extra trick. You have to add [Environment Variables](https://documentation.codeship.com/basic/builds-and-configuration/set-environment-variables/) for AWS\_ACCESS\_KEY\_ID and AWS\_SECRET\_ACCESS\_KEY on Codeship.
This works for me since there are few times I push an icon without also making some code changes to the server code anyway.
Hopefully if gives you some directions.
**Categories:** How To
**Tags:** aws, Codeship, dreamobjects
---
### [Let's Talk, Slack](https://halfelf.org/2018/lets-talk-slack/)
**Published:** February 27, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Dear Slack, I want to like you more, but you don't understand adults.
**Content:**
Hi, Slack. You’re the cool product everyone uses to communicate on scale. You’ve introduced a lot of features and aspects that are great. We all like to use you for our non-company work, but I’ve noticed something interesting.
See. You constantly remind us that Slack is for Business. But you don’t seem to have actually spent enough time in corporate land to understand what that means. So, as someone who worked for nearly 15 years (and recently at that) with The Man, and the last five with a smaller company, let me try to explain to you what mistakes you’re making. Oh, and before anyone asks, yes, I’ve pitched **all** of this in tickets/suggestions to Slack already.
## Constant Barrage
Being able to tune alerts on Slack is basically the only way you have to live or die. I can mute channels or group-chats pretty easily, to allow a conversation I need to be aware of, but not right **now** to carry on around me.
What I can’t do is mute my really, really, really chatty and annoying coworker for an hour so I can get work done.
Oh sure, Slack, it’s passive aggressive to just mute Bob over there who knows I love the Cleveland Problematically Named Baseball Team, and wants to tell me something I will care about in an hour or so. But right now? I have a job. And I want to concentrate without your alerts popping up on my screen and showing that dreaded unread icon. And yes, Slack, I could mute everything, but what about my coworker Jane, the nice one who pings me with an apology because she knows I’m super busy, but she has a critical work problem, and I’m the expert.
Come on, Slack.
## Asynchronicity vs Work/Life
While everyone in startup land likes to brag about how they work 80 hours a week, the reality is that most business aren’t actually that stupid. We take vacations. We don’t work weekends. We like to spend time with family, go to a sports game, and *not* be distracted by the ping of work.
While you have [do not disturb settings](https://get.slack.help/hc/en-us/articles/214908388-Do-Not-Disturb-and-snooze-settings), Slack, I can only set them for specific hours. So yes, I do set them for 4pm to 7am, because I actually do have an end of day. But I can’t set my work **days**, I can’t connect Slack to (say) my Google Calendar and have it automatically detect that I’m out of the office. I have to constantly fiddle and tweak things. It’s a mess.
## Out of Office Messages
Speaking of this, if I (perchance) happen to forget to mark myself as out of the office, I’m going to get alerts. Fine, that’s on me. But. You introduced [custom status messages](https://get.slack.help/hc/en-us/articles/115002531586-Create-custom-status-suggestions), which you tout I can use to announce I’m on vacation. Awesome! Now can you make them useful?
See the problem is I put in “Out of the office until Feb 20” pretty recently, and I thought “My coworkers are intelligent, they’ll see this message and know ‘Aha! Mika is out!’ They don’t. And looking at this, I can’t blame them becuase of two things:
1. Readability on MacOS is shit
2. The message doesn’t fully show on iOS
Don’t believe me? Here:
[](https://halfelf.org/wp-content/uploads/sites/2/2018/02/iOS.png)Slack Example from iOS[](https://halfelf.org/wp-content/uploads/sites/2/2018/02/MacOS.jpg)Slack example from MacOSThose are hard to read! And why don’t they auto-alert like a DND message does when someone DMs me? “Mika is currently \[status message\]” — Oh yes, Slack, I know people like to use those for jokes. Want to stop them? Make them auto-reply. Then people would only use them for real.
And by the way…
## You’re Ageist
Let me tell you a story.
Once upon a time, not very long ago either, I supported desktop software. I received a phone call from someone in the Big Building, aka where the real bankers worked, and she couldn’t use a product because the screen was unreadable. She couldn’t see the buttons or dropdown. I asked her to give me 30 minutes and I would call her back. Quickly I went through a few steps to size and resize the window, and I couldn’t figure it out. I called her back and asked if I could come to her office.
One 20 minute bus ride later, I’m at the fancy building, going through metal detectors, and I head up to her floor. I apologize for not being in a suit and ask her to please show me her desktop. One glance and I realized the problem was that her desktop itself had been resized. I explained I was going to change the resolution, resize it, and see if that fixed it. I promised I would reset everything.
Nervous, she allowed this. After all, if I closed a specific window, I could cost the company a hefty bit of money. I very cautiously (without minimizing anything), changed the resolution.
“Oh, that’s how it was this morning! My coworker was using my workstation.”
After I head-desked a few times, I checked the app I was responsible for. It was set to take up most of the screen but not all. I resized it, manually, and then restored her preferred resolution. I then wrote down how I did that, how to fix it in the future, and went to give her coworker a stern word that began with “The first rule of using someone else’s workstation is *THOU SHALT NOT MESS WITH THEIR SETTINGS*.”
A few years later, when I no longer worked on that team, I got a phone call from her again. “My new coworker is having the weird screen problem I had a million years ago. Can we pay you with lunch to fix it again?”
Of course I said yes.
Now re-read those problems I have with you, Slack. Because you’re worse.
## To Review
I look at Slack, and I look at the problems I have, and I think “If I wasn’t technically competent, I would be lost.” And I realized “I **am** technically competent and I still get lost.”
Slack. If you want to make it bigger, if you want big companies and banks to start using you instead of Lotus Notes Messenger, you need to step up your game. Provide business tools, the ones they need to make sure if they’re not available, someone knows who to contact next. Treat people like grown ups with mortgages, not 20-somethings who exist on packing peanuts and internships.
Basically, Slack, you want the grown ups? Grow up.
**Categories:** How It Is
**Tags:** oped, slack
---
### [The Invisible Facets](https://halfelf.org/2018/the-invisible-facets/)
**Published:** March 6, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sorting data that doesn't exist can be difficult, because there's nothing to save. So you have to think around it.
**Content:**
I’ve been using [FacetWP](https://facetwp.com/?ref=91) for a year or so and it’s, hands down, the smartest WordPress plugin I’ve ever bought. Certainly I could have coded it, but not having to and being able to extend it to do what I need has saved me months of work and support.
This is not to say it’s perfect. I’ve run into multiple quirks and headaches that resulted in me writing weird code to solve. And the solution to the null entry was no different. But it was, at the end, solvable.
## A Null Entry
The majority of my data is saved in custom taxonomies. This makes it easy for me to grab and process. It’s also easy to list, because I can point people at `/taxonomy/term` and FacetWP magically populates properly in the sidebar.
However. In one case, I have a checkbox. This is a simple post-meta to say if we love a show or not, and that check box, if it exists, is detected by FacetWP and I can easily get a list of all loved shows. The reverse is, sadly, not easy.
That’s because if the checkbox is empty, there is nothing saved. No post meta. And if there’s no data, then when FacetWP builds out it’s list, there’s nothing saved for the non-existent data, and therefore no way to list nothing.
## An Imaginary Entry
The other problem, related to this, is that I use Taxonomies in a different way. That is, while I use them like everyone else does with tags and categories, I also use them to track ‘stars’ – gold or silver etc. Obviously that makes it easy to track with `/stars/gold/` buuuuuuut what if I wanted to list all the shows *without* any stars?
How do I tell FacetWP ‘if there’s no taxonomy data saved for this, use a default?’
## A Fake Facet
The answer lies within making a fake, that is unused, facet.
The tl;dr to [how FacetWP works](https://facetwp.com/documentation/how-facetwp-works/) is that it generates it’s own table with the data it collects from it’s facets. In general, there’s a 1-to-1 relationship with the facet and how it outputs. If you’re saving the terms of a taxonomy (like star colors), then there’s an entry in the database for the show and it’s star. If something has multiple values (like tags) then it has multiple entries.
You can then alter the
## The Facet
In order to make entries for my null or imaginary values, I made a facet that I didn’t use that I called `all_the_missing` and I gave it the data source of “Post Types”:
[](https://halfelf.org/wp-content/uploads/sites/2/2018/02/all_the_missing-facet.jpg)
The rest doesn’t matter. I’m not planing to display this, and I picked post types because it’s a quick bit to add the database without making it too heavy or complicated. Also I know it’ll exist for all my data.
## The Filter
The magic to all this is my [filter for `facetwp_index_row`](https://facetwp.com/documentation/facetwp_index_row/):
Now this is *also* wrapped in an `if ( get_post_type( $params['post_id'] ) == 'post_type_shows' ) {...}` check so this particular one only runs when shows are saved. But you can see what I do is when I run that specific facet, I check if the *other* data is available and if so, save it.
## Improvements
I’d like to actually not have to save data when I don’t need it, but the need is enough that having this work was paramount. I can now sort when there’s no data, and that was what I needed.
**Categories:** How To
**Tags:** facetwp, wordpress
---
### [What Is The Measure of a Site?](https://halfelf.org/2018/what-is-the-measure-of-a-site/)
**Published:** February 22, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** What are you measuring? What is useful? What is the right way to explain it all?
**Content:**
After you think about where you’re saving your data, internally or externally, you’re going to be faced with the biggest problem known to exist.
What do you *do* with your data?
## Common Data is (Mostly) Obvious
Some data, as I’ve said before, is obvious. That is, you know what you want to do with statistics of visits. The base outset is ‘figure out how many people visit my site.’ Right? Not too hard. But that isn’t all you want to know. You want to know when your site is busiest, what content people read, and maybe you want to know on what device.
You want to know these things because they can help you optimize what you do next. If, for example, your Monday posts are super popular, then you want to make sure you post them at the time the most people are going to visit your site. If you know only 2 people view your site on an iPad, maybe fixing that little annoyance can wait a bit.
## Rare Data is A Headache
On the other hand, when you look at statistics for your complex data, like a site with TV shows and characters and actors, you have a completely different problem. What public stats are both relevant *and* meaningful? And how do you represent them in ways that people can understand?
Like, do you use piecharts?
[](https://halfelf.org/wp-content/uploads/sites/2/2018/02/pie-charts.jpg)
They can be helpful but only if you don’t have a large number of data slices.
I made a pie chart with 28 slices and it was unreadable. Though that was mostly because everyone had between 1-5% except for one that had 75%.
## The Question Is Usage
This is a problematic question because it has no easily defined answer *before* you start building out your site. We’ve all seen an image of a paved path and then a foot-trail cutting away from it, or winding around an obstacle. People like to joke about how it’s design vs usage. While our goal when making any product is to avoid people walking off the paths, it’s unavoidable. And in the case of public statistics, it’s even harder to predict usage.
A large reason for the problem is what is called a failure of imagination. This is, in part, the fault of the designers. That is, they didn’t predict things properly. Which requires metrics. Which can’t be gathered until people have used the site a little.
You see the problem, I hope.
## Start With The Easy
When I built out stats on my site, the ones I wanted people to use, I made sure to start with some easy things. Like those pie charts. Those are just pulled from a custom taxonomy which every character has. They’re simple. They’re easy. And they let people visualize.
After I released it, someone asked “Could we have a chart to show how many actors a character has?”
[](https://halfelf.org/wp-content/uploads/sites/2/2018/02/actors-per-char.jpg)
That was actually not easy, but the point is that by starting with something ‘easy’ I was able to inspire people to ask what they wanted to see.
## Don’t Be Afraid to Be Wrong
Remember I mentioned that evil pie chart? You’re going to be wrong. You’re going to assume that the best way to show a specific data point is a pie chart when it really should be a bar chart. If you pick the right chart systems, it shouldn’t be too horrible to switch between them. But sometimes it will be.
Just remember, it’s okay to make mistakes. You can dig up a path and repave it after all.
**Categories:** How It Is
**Tags:** chart, statistics
---
### [Processing Numbers with WordPress](https://halfelf.org/2018/processing-numbers-with-wordpress/)
**Published:** February 20, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Getting at your data to make meaningful metrics starts with saving them smartly.
**Content:**
The very idea of ‘I should make statistics’ or ‘what are the metrics of this’ starts from the same place. We have a desire to understand what a thing is. Statistics, like traffic, and metrics, like speed, can tell us obviously important information about our sites. Faster sites do better. More traffic gets you more… whatever.
But those are the obvious things. There are easy to understand numbers and there are difficult to process numbers. And it all matters where you save the data.
## Getting At The Data
When I set about making statistics for LezWatchTV, the biggest problem I faced was determining what I wanted to show. Some things were simple. How many characters died and what percent of *all* characters was that? How many shows have dead characters?
Since I chose to use WordPress features, like custom taxonomies, for the majority of the aspects of the site, getting those numbers was simple. There were, of course, some that were very difficult to get at, and this is fully of my own design. Sometimes there will be data you want to use that is just harder to get at than others.
This means the question of understanding your numbers begins with understanding where they belong.
## Save Data in Smart Places
I say this over and over. Use WordPress’ native features *first*.
I mean use the taxonomies and the custom post types and the post meta wisely. But. When you’ve got a lot of data that needs to be cross related, consider saving it someplace else. For example, the reason [FacetWP](https://facetwp.com/?ref=91&campaign=HalfElf) is so damn fast is that it doesn’t query WordPress all the time, and instead uses it’s own tables.
Having it’s own table means there’s less overhead as they can make direct SQL calls to pull the data. When you have data spread across three post types, this becomes pretty much an imperative. You just have to script the code to save it properly.
## External Data
While FacetWP does save data to it’s own tables, there is another option, and that is external locations. You’re most familiar with this with regards to Google Analytics. Some data makes sense to keep local, but keep in mind what you’re doing and what you’re generating with the data. When it’s just posts, local is perfectly logical. When you get into statistics… Well. Maybe you should export it.
That brings up the next question. What data to you export, and to where.
**Categories:** How It Is
**Tags:** data, stats, wordpress
---
### [Customizing Which Random Post](https://halfelf.org/2018/customizing-random-post/)
**Published:** February 15, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little customized randomness to make it more sane.
**Content:**
Back in December, I posted about how I generated a [random post of the day](https://halfelf.org/2017/random-post-day/).
After running it for 60 days, I realized I needed to exclude three things:
1. Posts with a specific ‘placeholder’ image
2. Posts with content ‘TBD’
3. Posts with one of two specific meta values
So today we will talk about how awesome WP\_Query is.
## The Basic Query
As a reminder, your basic query for a random post is this:
Now, let’s extend it!
## Posts With An Image
In this example, I have a very specific default image I use – the mystery person – to indicate the post doesn’t have it’s own image yet. I went and found the image in my media library and took note of the value – 949. Then I added a meta query which said “If the `_thumbnail_id` does *not* equal 949.”
Seriously. It’s magic.
## Posts Without ‘TBD’
We also have a standard convention for when we have a pending data post, but we need it for statistical reasons. Since, as of WP 4.4, you can use negatives in searches, just add this to the basic query:
This could be useful for your stores, if you wanted to list a product of the day but perhaps not ones with “Coming Soon” in the description. Of course, you should also have some meta flag but you get the idea.
## Posts With One of Two Values
Okay. Here’s fun. Let’s say you have a post meta field called `example_site_group` and there are six choices in it but you only want one and two. Well, for that you need to use an array and a LIKE:
This is a little messier, but it certainly does work. Even with serialized data.
## Put It All Together
Here’s the real code:
And voila.
**Categories:** How To
**Tags:** query, random, wordpress
---
### [Stacked Charts Part 3: The Javascript](https://halfelf.org/2018/stacked-charts-part-3-javascript/)
**Published:** February 13, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Finally there's the outputting of the javascript.
**Content:**
Finally!
We have our data in a properly consumable array. It’s formatted the way we need. Now we just need to script the java.
Take a deep breath.
## What We Want
What we want is simple. A stacked bar chart that shows the values of *all* possible permutations. It looks like this:
A stacked chartThat shows how many characters there are per gender orientation, and stacks it for a total count (which is why we needed that count you see).
## Send In The Clowns
Since I’m already using Chart.js, I just need to have a function to output the javascript. But. Since I *also* have to loop through the arrays to get the collective data, I need a bit of PHP:
## The Color
You may have noticed a strange variable:
Which was then called in the javascript here:
I have this in a javascript file that is loaded on that page:
The reason it’s ‘undefined’ is that things got weird when I had a variable with a name of undefined.
**Categories:** How To
**Tags:** chart, javascript, taxonomies, wordpress
---
### [Stacked Charts Part 2: Rebuilding the Array](https://halfelf.org/2018/stacked-charts-part-2-rebuilding-array/)
**Published:** February 8, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stage two is taking all the data, shoving it back together, and splitting it out in a totally different way.
**Content:**
I’ve talked about this before [in category statistics](https://halfelf.org/2016/chart-js-category-statistics/), but in order to get the data from a simple array into a Chart.js consumable one, we have to rebuild the array.
## All Arrays are not Equal
In order to save the data in a way I could use and reuse, I had to aim at the lowest common denominator. But also I had to save the arrays at a *per show* basis, which is not the same as what I was going to need to output.
Instead of just outputting the averages for the show, I needed to combine all this into a ‘by nation’ statistic. That is, I needed to get a list of all shows that were associated with a taxonomy value for that country (easy) and combine all their arrays (not quite easy) and order the data in a way that would make sense (not easy).
So again we start with understanding the array. Here’s a show that happens to air in Argentina:
This is the data for one show. Argentina has 2, oddly both with the same stats breakdown by gender identity. What I need to do is loop through both those shows and add the arrays to be this:
## Get the Base Arrays
Just like before, we make an array of the base data as we have it in the gender, sexuality, and romantic orientations. In this case, we’re adding in a query to change the order to be largest to smallest overall from the taxonomy. While this may not be true for all nations in the future, it is today:
I need to pause here. Everything from here out goes in that foreach. We’re going to be looping for each nation in the list of nations. Now… I re-use this code for multiple taxonomies, so `lez_nations` is actually `lez_' . $data` and it dynamically changes based on how I call this function.
On we go!
Now that we have those base arrays, again set to zero,
By the way, `$subdata` and `$data` are parameters sent to the function that runs this. `$subdata` is for the taxonomy we’re calculating (sexuality etc) and `$data` is for the overall taxonomy (Nations or perhaps Stations or genres – we use a lot of those).
This gets us started.
## Queery the Posts
Next we need a `WP_Query` of all the posts in the taxonomy.
Remember, this is still within that foreach above. And once we have the posts, let’s query all the shows:
The weird section you see, `// Add the character counts` is there because *every* character has a gender, but not everyone has a sexuality or romantic orientation. Because of that, I decided it was safest to use that as my baseline count.
The second section that checks `if ( !empty( $dataset ) ) {...}` is what adds things up for the array.
Speaking of…
## Output the New Array
Once I have those counts, I generate different arrays depending on what I’m outputting. The basic barchart is different from a percentage, which is different from the stacked bar.
And all of this is so I could get that silly stacked bar, which will have the count of total characters, shows, and the data.
Whew.
**Categories:** How To
**Tags:** charts, coding, taxonomies, wordpress
---
### [Stacked Charts Part 1: Understanding Your Data](https://halfelf.org/2018/stacked-charts-part-1-understanding-data/)
**Published:** February 6, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Chart.js, WordPress, and taxonomies begins with understanding the data you're processing and saving it in a retrievable way.
**Content:**
There are a few different type of charts. Actually there are a lot. I find a nice bar chart fairly easy to read and understand. So when Tracy said we should generate some nice stats about nations, like how many shows there were per nation, I was able to do that pretty easily:
An excerpt of shows by nationAnd as far as that goes, it’s pretty cool. It’s really just the same code I use to [generate category statistics](https://halfelf.org/2016/chart-js-category-statistics/) already. This is, by the way, why using WordPress to generate your data is useful. It’s easy to replicate code you’ve already got.
But then Tracy, who I think derives some perverse joy out of doing this to me, says “Can we find out how many trans characters there are per nation?”
## Use WordPress First
If you heard my talks about Sara Lance, you’ve heard me tout that data based sites should always [use WordPress functions first](https://halfelf.org/2017/data-based-sites/). By which I mean they should use taxonomies and custom post types when possible, because accessing the data will be consistent, regular, and repeatable.
Ironically, it’s *because* I chose to use WordPress than I was in a bit of a bind.
You see, we have three post types on the site right now: shows, characters, and actors. The shows have the taxonomy of ‘nation’ so getting that simple data was straightforward. The characters store the taxonomies of gender identity and sexual preference. That sounds pretty logical, right?
So how, you may wonder, do we get a list of characters on a show? A query. Basically we search `wp_post_meta` for all characters with the array of `lezchars_show_group` and, within that multidimensional, have a show of the post ID of the show saved. Which means the characters are *dynamically* generated every single time a page is loaded. And yes, that is why I use *The L Word* as my benchmark for page speed.
However by doing all this dynamically, generating the stats for characters per nation would look like this:
1. Use `get_terms` to get a list of all shows in a nation to …
2. Loop through all those shows and …
3. Loop through all the characters on each show to extract the data to …
4. Store the data per nation
Ouch. Talk about slow.
## Solution? Use WordPress!
Thankfully there was a workaround. One of the other odd things we do with shows is generate a show ‘score’ – a value calculated by the shows relative awesomeness, our subjective enjoyment of it, and the number of characters, alive or dead, it has.
In order to make that generation run faster, every time a show or character is saved, I trigger the following `post_meta` values to be saved:
- `lezshows_characters` – An array of character counts alive and dead
- `lezshows_the_score` – The insane math of the score
So I added three more:
- `lezshows_sexuality`
- `lezshows_gender`
- `lezshows_romantic`
All of those are generated when the post is saved, as it loops through all the characters and extracts data.
## Generate The Base
In order to get the basics, we start by generating an array of everything we’re going to care about. I do this by listing all the taxonomies I want to use and then loop through them, adding each slug to a new array with a value of 0:
That gives me a multidimensional array which, I admit, is pretty epic and huge. But it lets move on to step two, of getting all the characters:
Next I stop everything as a new array. Which is where we get into some serious fun. See, I have to actually *double check* the character is in the show, since the ‘like’ search has a few quirks when you’re searching arrays. The tl;dr explanation here is that if I look for shows with a post ID of “23” then I get “23” and “123” and “223” and so on.
Yeah. It’s about as fun as you’d think. If I wasn’t doing arrays, this would be easier, but I have Sara Lance to worry about.
You’ll notice there’s a quick `$tax_data[ $title ][ $term->slug ]++;` in there to increment the count. That’s the magic that gets processed all over. It tells me things like “this show has 7 cisgender characters” which is the first half of everything I wanted.
Because in the end I save this as an array for the show:
## How Well Does This Run?
It’s okay. It’s not super awesome, since it has to loop so many times, this can get pretty chunky. See *The L Word* and it’s 60+ characters. However. It only updates when the show is saved, or a character is added to the show, which means the expensive process is limited. And by saving this data in an easily retrievable format, I’m able to do the next phase. Generate the stats.
**Categories:** How To
**Tags:** charts, development, taxonomies, wordpress
---
### [Restrict Site Access Filters](https://halfelf.org/2018/restrict-site-access-filters/)
**Published:** January 25, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Handling restricted access and caching together, without going crazy.
**Content:**
I have a demo site I use to for development. One of the things I want is to be able to lock the site to logged in users only and that I can do via [Restricted Site Access](https://wordpress.org/plugins/restricted-site-access/) by 10up.
One of the things the plugin also allows is to open up access to an IP, so someone who doesn't have an account can check the site before you go live. The problem with this feature is caching.
## Caching Restricted Pages
It doesn't really matter what kind of caching system you use, the point is all the same. People who aren't logged in should get a cached version of the content. People who are logged in, or whom you've determined need a unique experience, don't get cached content. That's the barebones of caching.
The problem I ran into with restricted site access is that if I whitelisted an IP range, and someone from that range visited the site, they generated a page which my cache system … cached. That meant the next person got to see the cached content.
Now this may not actually be a problem in all cache systems, but I happened to be using Varnish, which is fairly straightforward about how it works. And, sadly, the plugin I'm using doesn't have a way around this. Yet.
## Filters and Hooks
Like any enterprising plugin hoyden, I popped open the code and determined I needed to address the issue here:
```
// check if the masked versions match
if ( ( inet_pton( $ip ) & $mask ) == ( $remote_ip & $mask ) ) {
return;
}
```
This section of code is checking "If the IP matches the IP we have on our list, stop processing the block. It's okay to show them the content." What I needed was to add something just above the return to tell it "And if it's Varnish, don't cache!"
At first my idea was to just toss a `session_start()` in there, which *does* work. For me. Adam Silverstein was leery of that having unintended consequences for others, and wouldn't it be better to make it hookable? After all, then *any* caching plugin could hook in! He was right, so I changed my pull request to this:
```
do_action( 'restrict_site_access_ip_match', $remote_ip, $ip, $mask ); // allow users to hook ip match
```
The next version of the release [will have that code](https://github.com/10up/restricted-site-access/blob/develop/restricted_site_access.php#L249-L253).
## In The Field
Now, assuming you've slipped that code into your plugin, how do you actually *use* it?
Since I need to have this only on my 'dev' site, and I'm incredibly lazy efficient, I decided to put this code into the MU plugins I use for the site:
```
if ( DB_HOST == 'mysql.mydevsite.dream.press' ) {
add_action( 'restrict_site_access_ip_match', 'mydevsite_restrict_site_access_ip_match' );
}
function mydevsite_restrict_site_access_ip_match() {
session_start();
}
```
This is not the only way to do it. I also happen to have a define of `define( 'MYSITE_DEV', true );` in my `wp-config.php` file, so I could have checked if that was true:
```
if ( defined( 'MYSITE_DEV' ) && MYSITE_DEV ) { ... }
```
Now, you'll notice I'm using sessions, even after Adam and I determined this could be bad for some people. It can. And in my case, in this specific situation, it's not dangerous. It's a quick and dirty way to tell Varnish not to cache (because PHP sessions indicate a unique experience is needed).
The downside is that not caching means there's more load on my server for the non-logged in user who is legit supposed to be visiting the site. Since this is a development site, I'm okay with that. I would never run this in production on a live site.
**Categories:** How To
**Tags:** filters, plugins, wordpress
---
### [Structured Data](https://halfelf.org/2018/structured-data/)
**Published:** February 1, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes structured data exists to vex me.
**Content:**
Every month around the 15th and 30th, I check Google Webmaster to see if there are any 'errors' I need to address. Most of the time this is 404s on pages that were wrong for 30 minutes, and Google decided to crawl me right then. In January, I got a bunch of new alerts about 'structured data.'
## What is it?
Google uses *structured data* that it finds on the web to understand the content of the page, as well as to gather information about the web and the world in general. Which is a fancy way of saying Google looks for specific classes and attributes in your page to determine what's what.
Most of the time, your theme handles this for you. It's why you see `hentry` and `authorcard` in your page source. This is part of telling Google what the content is, contextually.
## Bad Errors
Sadly, Google's report just said I had "missing fn" errors and gave me this:
itemtype: http://microformats.org/profile/hcard photo: https://secure.gravatar.com/avatar/CODE?s=118&d=retro&r=g That's not very helpful unless you already know what you're looking for. And even then… There was a link to [test live data](https://search.google.com/structured-data/testing-tool) and I clicked on it, only to get a report back that I had *no* errors. Frustrating, right?
Then I checked a different error:
Missing: author
Missing: entry-title
Missing: updated
That was a little better, I thought, and I found out that since we'd removed author and updated from those posts, for a valid reason mind you, that was showing an error. The 'easy' fix was to make this function:
```
function microformats_fix( $post_id ) {
$valid_types = array( 'post_type_authors', 'post_type_characters', 'post_type_shows' );
if ( in_array( get_post_type( $post_id ), $valid_types ) ) {
echo '
' . get_the_title( $post_id ) . '
' . get_the_modified_time( 'F jS, Y', $post_id ) . '
' . get_option( 'blogname' ) . '
';
}
}
```
And then I just tossed it into my post content.
## Does This Matter?
Kind of. It doesn't appear to actively *hurt* your SEO but it can *help* a little. In my case, I'm not actually using 'Author' so it's an inconvenience. And I don't want to make public when a page was last updated, since it's meant to be static content, but also it gets 'saved' a lot more than it gets updated, due to how I process some data. Basically it would lie to users.
But. Apparently I get to lie to Google.
Yaaay.
**Categories:** How To
**Tags:** code, seo, wordpress
---
### [Customizing Jetpack Feedback](https://halfelf.org/2018/customizing-jetpack-feedback/)
**Published:** January 30, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Messing with Jetpack's feedback forms for fun and management.
**Content:**
Fair bit of warning, this is a **big** code heavy post. I use Jetpack to handle a variety of things on my sites. Contact forms, stats, embeds, monitoring, backups, a bit of security (brute force prevention), and in some cases Photon and galleries. Oh and I *especially* use it for the tweeting and facebookieing of posts. Love it or hate it, it has it's uses and as a user, I find it easier to work with than its alternatives. However! Jetpack is not perfect. And my current drama llama was that I wanted to do two things:
1. Show on my dashboard how many messages I had
2. Mark a feedback message as 'answered' without deleting
The second item was very important as on a shared-management type site, it's hard to know who did what and did everyone handle an email or what have you? Really a better tool would be something that you could reply to from within the admin dashboard, versus emailing all over, but that's another day. Instead, I decided to tackle a custom post status. ## This is NOT Fully Supported
This is my caveat. My big warning. WordPress doesn't yet fully support Custom Post Status. That is, yes you can totally register them, but there's no easy way to put in the interface, as [the trac ticket has been around since 2010](https://core.trac.wordpress.org/ticket/12706) (you read that right) and it's still not done. All that said, if you're willing to wrangle a bit of Javascript and sanitize your outputs properly, you can do this. ## Big Block of Code
What this does is create a new status for your feedback of “Answered”. Ta Dah!
**Categories:** How To
**Tags:** jetpack, plugins, wordpress
---
### [Accidental Example](https://halfelf.org/2018/accidental-example/)
**Published:** January 23, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When not thinking about your example data gets you into hot water for someone else.
**Content:**
My father was having email woes, so I undertook the monumental task of sorting out his hellish setup. Among other hurdles, he still uses (and in fact prefers) POP email.
Don't judge him.
However it was in reviewing the POP mail that I found a problem. He had over 145 emails, and of them only 33 or so were legitimate emails. Of the other 112, about 20 were 'mailing lists' (like Safeway and Egencia and crap we do actually use), 5 or so were porn, and then 87 were from a deployment service.
## Not His Monkey House
I double checked that my father didn't use the service and then I looked at the email. They were all emails for an account payable system that he absolutely didn't use.
That's not at all Dad's job, so I agreed they were likely junk but how did they get there?
## A Real Company
The first thing I did was check that this was a legit company. Interesting. I then did the logical step and requested a password reset for his email. It emailed me a link, which I clicked and yes, it let me reset the password… Except it didn't.
I got an error saying that the 'username' was already in use.
Which made no sense. I was on the *password reset* form. Not a create user form. So I tried a few different ways, and then tried to file a bug report or ask for help with is email and it all error'd out. It did not like his email.
## To Twitters!
I then complained on Twitter, which netted me the very helpful Isabelle who DM'd me and knew right away what was happening.
> The hundreds of emails were actually just a mix-up because one of our product specialists had a demonstration company with a database with tons of 'demonstration users' with personalities and characters names and your dad's email got in by accident (due to its homonym toy story character).
>
> Isabelle
Dad's domain is `woody.com` you see.
Suddenly it all made sense.
## Why We Use Example.com
They went ahead and removed his email from all their pipelines and deleted the fake account they'd made for the domain (which explains why I couldn't do a reset). And I haven't seen an email come in after that.
It was a rude awaking for this poor company. We don't use *real* domains in our examples for a damn good reason: people copy/pasta.
No one thought to check if the domain existed, and it's pure coincidence that they picked his email for the demos and examples. And yet it's a good reminder for you too. Those example domains you pick will probably be used by someone in production. Don't spam them.
But a bigger concern is this. How much *private* data got sent to my father over the course of the weeks this was the case? How much information did he have access to that he shouldn't? You're all very lucky he's not malicious.
**Categories:** How It Is
**Tags:** debug, example, sample
---
### [Thimking About Security](https://halfelf.org/2018/thimking-about-security/)
**Published:** January 16, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** No, that's not a typo. I want you to THIMK
**Content:**
It's been a while since I last talked about security and WordPress plugins, so I thought it was a good time to do it again.
I *still* don't use any. But we'll get to that in a minute.
## Don't Be 'Stupid'
> My mother is one of the few people I know who has almost completely conquered the will to be stupid.
>
> Miles Vorkosigan on his mother, Cordelia Naismith Vorkosigan
> *Brothers in Arms* by Lois McMaster Bujold
Understanding what makes something secure or insecure is not as obvious as I wish it was. I often say that the trick to being secure is [not being stupid](https://halfelf.org/2014/the-mindset-of-security/). Of course that's easier said than done, and I know it.
Still, my record holds true that the one time I was hacked, it was from my own stupidity. I knew it was wrong and foolish and I did it anyway. And my guiding principal of security remains a constant reminder "Don't be stupid."
But what is stupid? Every time you leave your house, you lock your doors, right? You do the idiot walk, as my grandmother Taffy called it. Keys, wallet, phone? Is the gas off? Is the heat on? Are the windows closed? You check the normal things and then you lock the door and off you go.
Of course, we all have been an hour into an 8 hour drive and panicked "Did I close the garage!?" And for some people, even the simple act of locking the door is an arduous journey of 10 or 30 or 55 checks. In order to say 'don't be stupid' we have take ourselves honestly and seriously, and remember that 'stupid' just means 'don't *not* think.'
## THIMK
That was not a typo. Nor was the title of this post.
While we all make fun of IBM and MAD Magazine, I recall reading "Welcome to the Monkey House" by Kurt Vonnegut, and Ma Kennedy had the sign over her desk. At the time, I was unaware of the MAD magazine spoof on the matter. THINK was a sign folks at IBM had, and THIMK was the spoof.
When I read it in Vonnegut, and bear in mind I was young and naive, I found it far more compelling than the idea of telling someone to THINK. With the letter changed, it forced me to reassess my assumptions of what the meaning was. After all, telling someone to THINK means, well, think. But telling someone to THIMK is a different matter.
## Eating the Elephant
You know that old joke? How do you eat an elephant? One bite at a time. Well. That's security.
I've been a loud opponent of the TSA, the way it's implemented in the US currently. It makes us feel better by making us think (N) that something is being done. And, yes, the TSA has found problems. But their job is to look through a thousand small things and find the odd-one-out. They're looking for the weird.
When we perform a security audit over anything, be it a plugin or a server, or a door, we look for what we know is likely wrong. When I review a plugin, I look for the common issues. I skim for them, or grep for them, because I know what I'm looking for, and my eyes are trained to find it.
But then, once I see the major and common issues aren't there, I read the whole thing. I look at the plugin as a whole entity, and I think. What does the code *mean*? What is it's *intent*?
## Metaphysical Security
Without the ability to spy into the soul of the developer and glean an understanding of their raisons d'être, we're left with monitoring actions and making best guesses. And we're going to be wrong from time to time.
It's no secret that last year, the WordPress security world found a new villain in the despicable people who buy plugins and slip backdoors into them. I saw some complaints that this sort of vulnerability wouldn't exist in \[insert your CMS here\], except … it will. It can and it will.
We are *all* vulnerable because we choose to trust. We trust the developer to have good intentions. We trust the reviewers to be good people and care more about the security and sanity of code than themselves (which is a whole different ball of fish). We trust the ongoing development not to be handed over to evil people.
That last one is unavoidable. People trust me to review code and react in the 'best' way for the community. But what if someone found my asking price and bribed me? What if I *let* bad code like backdoors into the WordPress Plugin directory? It would probably get caught, eventually, but still. Even if we locked down plugins to specific users accounts and didn't let anyone but admins (like me and Otto) add users, we would *still* at the end of the day remain vulnerable to humanity.
## Security Is Ongoing
The truth is this.
We are always, every day, insecure and vulnerable.
Having a website that is your 'life' or career or business or even just a passion-project is dangerous.
You should treat your website with as much thought and security as you do your own home. Check the gas. Check the lights. Make sure the door is locked. Get a security system. Hire someone to review the site and the server. But take it *seriously*.
Your website is 'you' on the Internet. And it deserves as much care as locking your car and not parking it in a shady part of time.
## Summary?
Pay attention to what you put on your website.
Trust no one. Not even me.
**Categories:** How It Is
**Tags:** essay, oped, security
---
### [Still Not Using Plugins for Security](https://halfelf.org/2018/still-not-using-plugins-for-security/)
**Published:** January 18, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's not that I don't like them, it's that I don't like them.
**Content:**
Seven years, and my answer to 'do I need a security plugin' is the same.
Nope.
## What is a Security Plugin?
A security plugin is *not* a plugin like 'brute force protect' or 'limit login attempts.'
A security plugin is like Better WP Security or WordFence or a hundred other plugins that promise to scan your site and let you know what's changed.
This is not to say that first set of plugins aren't there to make you 'safer,' it's that those are single use, targeted plugins that address a single issue. Limiting login attempts prevents someone from trying the same attack over and over and over until they get in.
By contrast, all-in-one security plugins try to do everything. They scan your code, your data, and your site. They look for all the possible attack vectors and they try to plugin them.
## What Makes That Secure?
That's the question I ask people. If a plugin adds in 2-factor authentication, I ask them what it does for them? Password expirations, captchas, file compares etc. Those are all good things, individually, but are they applicable for all people? What, specifically, about those things makes you more secure or not?
Now. Before you get all shirty with me, I am well aware of what all of those things are good for. With the exception of captchas (which are not accessibility friendly, please stop using them), all of those things make a lot of sense. You expire passwords and, one hopes, require *strong* passwords to make it harder to break in. But if you have a 2FA setup, do you *need* to require rotating passwords?
## It's All About Thinking
Security plugins stop people from thinking about what's going on.
I've seen it time and again, people install a plugin that 'makes them safe,' follow the bare minimum of requirements, and then install whatever they want without thinking about it, leave registrations open, and oops, get hacked.
This is not to say that security plugins don't prevent some of that from happening, but they're often an 'after the fact' solution. That is, usually a security plugin doesn't know to block X until X has been exploited. That's kind of the nature of the beast, though, and why WordPress and many other CMS developers don't release full details on security fixes until they've been out there for a while. They want to give people a chance to upgrade before saying "Hey, y'all who didn't are *super* vulnerable."
## It's Also About Speed
Security plugins also have a tendency to make your site slower. This usually comes up when people have turned on *everything* that comes with a security plugin. Which goes right back to my point about thinking. The user doesn't think, because they're not yet educated, about the impact of the code on their site.
To put it simply, the more things you ask WordPress to do before it can load a page, the slower it will be to load a page.
Pretty cut and dried, right?
## What's My Answer?
I don't call this the 'right' answer or even the best one. Not everyone has access to my resources after all, so it's not fair to say "Hire Mika to think for you!" But to me, the best answer is to use the resources you have intelligently.
**Firewalls**, from a server side, are all but a requirement to me. If your web host doesn't have one, and most at least have ModSecurity, get a new web host. If you disabled it on your site because a random plugin doesn't work with it, delete the plugin and turn it back on. If you can't move to a new host, look into firewalls like Incapsula or Sucuri. Put *something* between users and data.
**Site Scanning** is a great tool, but don't run it *on* WordPress. A great example of smart security scanning is VaultPress. It's a remote service that has a copy of all your files and it scans the copy, not your site, for issues. There are other services you can use that scan your site without affecting traffic. Again, web hosts often have tools for this.
**Be Aware** of what's going on. Don't just let security be a black box. Make sure you know what kinds of attacks are common on your site. If you're hit by a DDoS, for example, where they're just hammering your site to take it down, a 2FA plugin will not help. If they're trying to log in all the time, a scanner is probably not what you need.
**Lock It Down**. If you don't need it, don't use it. If you don't need it *on*, turn it off. Update regularly. Don't install everything under the sun.
## Don't Buy Into FUD
This is a tricky balance. On the one hand, I want to say 'don't panic if your favourite security plugin of choice tells you everything doomed!' Remember, they're trying to sell you things. But on the other … don't think everything's fine and dandy.
It's not a simple solution. You have to simultaneously be aware of problems and not overwhelmed by them. You have to learn how to care about which ones are important to you and which are not.
In a word, you have to think.
And there is no plugin on the planet that can think for you.
**Categories:** How It Is
**Tags:** essay, security, wordpress
---
### [Mindful Development and Misunderstandings](https://halfelf.org/2018/mindful-development-misunderstandings/)
**Published:** January 4, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Being classified as hate speech when you’re the opposite gives a person some perspective.
**Content:**
I consider myself a mindful developer. I strongly feel that morals and ethics and intent are important. In order to continue making the world better, we have to think about the worst thing our code might be used for and prepare for that. This means I spend a lot of time thinking about usage and intent.
However, like anyone else, I have my blind spots. And it’s amusing to me that I stumbled right over one when it came to an automated submission check.
## Automation
I made an Amazon Echo skill that tells you when the last queer female died on TV. In November, we noticed it had three negative reviews, all of which misunderstood the purpose of the application. They all thought we were pro-death. Now to me this meant the description of the skill and the output needed to be modified.
No big deal, right? I’ll just go in and make an edit and I’ll be done.
Wrong.
> Your skill contains content that violates our content guidelines. You can find our content guidelines here.
>
> Specifically, any promotion or praise of hate speech, inciting racial or gender hatred, or promotion of groups or organizations which support such beliefs, such as the Ku Klux Klan are not appropriate for the Alexa Skills catalog.
My change was rejected because it was hate speech.
No matter how I wrote the description, or phrased the commands, it was getting flagged as hate speech automatically. That’s right, automatically. There was no human to contact, in fact the email said I had to fill in a contact form and maybe I’d get an answer.
Instead I went to my cohort in computing, who said she was certain it was the phrase “bury your queers.”
## Documentation
I’ve had a lot of code reviews in my life. I’ve done a lot. There really two aspects of a review that help you survive it:
1. A robust, if generic, explanation, with specifics outlined.
2. Clear documentation to help resolve the specifics.
Amazon doesn’t give either of those.
There are no specifics that said, outright, “The problem is your content looks like your promoting the death of a specific type of people.” No matter how I tried to rewrite it, was rejected.
Finally I realized I was going to have to write it all over again, from the ground up, and explain it all better.
## People over Process
I get grief from plugin developers for being reluctant to specify what is bad and what is good. This probably stems from my upbringing, where I was taught about right and wrong as relative concepts. Is it alright to kill? No. But if the choice is killing a child or yourself, because your car brakes went out, you have to be able to weigh the situation at hand.
Computers can’t do this. There is no artificial intelligence that can weigh the soul of a person and know if they’re going to do evil. If there was, the face of air travel and politics would be wildly different.
And the point I make here is that we cannot simply say “this description hits all our buzz words and triggers for badness, therefor it is clearly a bad thing.” It’s just not the case. In restricting us from being able to speak about such horrible things, we give them room to grow in the darkness.
But that is neither here nor there.
## A More Positive Message
As Tracy put it, it was a damn good lesson in perspective.
She didn’t say damn.
While the “bury your gays” trope is well known to me, it is not universal. And while I feel queer is a perfectly acceptable term that has been in use for a very long time, others do not. People inside and outside our community are often unaware that one of the first pro-gay posters said “queer power” and not “gay power.” It’s just one of those things.
So the right path is to go forward in a positive way. I’ve rewritten the code to give you more details than just who died. It will now tell you what was posted, how many characters were added, who’s on the air and who’s not.
And yes, who died. Because that matters too.
**Categories:** How It Is
**Tags:** amazon, echo, oped
---
### [The Purpose of a Case Study](https://halfelf.org/2018/purpose-case-study/)
**Published:** January 11, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a case study begins with nothing. And that is the hardest start of all.
**Content:**
Back in early December I gave a talk at WordCamp US about a website I built with Tracy. The talk was titled “Lesbians, Damn Lesbians, and Statistics.” You can watch it here:
Of all the talks I’ve given, I feel it was the least WordPressy of them all. That is, while I did talk about WordPress and why we made choices that we did, and how they relate to the data design, it wasn’t very code heavy. It was, instead, a case study in how and why and what.
## What
A case study talk is complicated because you have to address what the topic is beyond WordPress. When you start with WordPress, and you’re at a WordPress convention, you don’t have to lay the groundwork. You can jump in and talk about custom post types and taxonomies. At a WordCamp, everyone knows about WordPress, or at least enough to skip over the basics.
On the other hand, your case study starts by explaining what the reason was that you built the site in the first place. What’s the purpose of the site and what’s the relation to WordPress. You start with the narrative of “This is my story.” And you have to do it fast because next is the why!
## Why
Once you have explained what the site is about, you have to explain why WordPress. When you’re doing a normal talk about WordPress things, you skip right over this. Everyone knows *why* WordPress. Because WordPress! But many times we ask ourselves “Is WordPress the *best* tool for this job?” We ask “Is it the *right* tool?” So in a case study, you have to build up your case and explain why.
This is hard, because you already jumped through those hoops to explain to yourself (and any business partners you’re working with) the rationale. Distilling all of that into a third of your talk, which means maybe ten minutes, is not easy. You summarize, you skip over things, and you still have to hit the main points or people won’t be able to make the connections for the next section.
## How
Finally you have to explain *how* you did this. If people don’t understand what you did and why, the how becomes meaningless. This is because the brunt of your talk takes place here. This is the real WordPressy stuff, where you talk about how the what and why came together to be this thing. If people can understand the enormity of the data, they can conceptualize your logic.
If you’ve built everything up before, people will understand “Oh, she couldn’t make death a taxonomy because the overlap would cause problems and become unwieldy.” They’ll follow you when you explain about faceting searches and moving data.
## Because
The purpose of all this is to draw people in with a cohesive story that puts the code and the concept together. People remember songs because of the rhythm and pattern. They will remember your case study because of the story. We remember stories.
The purpose of your case study is to tell a good story that people remember and that connects them to your topic and your code.
**Categories:** How To
**Tags:** essay, speaking, wordpress
---
### [A Difference of Tone](https://halfelf.org/2018/a-difference-of-tone/)
**Published:** January 9, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Rethink the way you ask questions, and you'll find yourself open to learning even more.
**Content:**
The other day I lamented on Twitter that one day someone would ask me “Why did you use X?” and not “Why DIDN’T you use Y?” in a tech talk.
## Think Different
When you go into a talk, thinking you know everything about it and what it means, you close your mind. You start by ignoring the possibility that other people can have amazing thoughts and ideas too. You limit yourself. Your preconceived notions color how you think because you limit your experiences to that which you have personally.
This is much the same as why a number of people seem to lack empathy until they’re personally impacted. That’s why you hear men say things like “I didn’t become a feminist until I had a daughter.” A number of people nod and understand his meaning is that it wasn’t personal. But a number of people also wonder what the hell is wrong with someone not to care about humans in general. Doesn’t that man have a mother? A grandmother?
Once you allow yourself to accept the simple idea that someone else thinks a different way from you, you open your mind to a new world.
## Hear Different
There’s a difference between listening and hearing. We all listen. But once you start thinking about what your reply will be, and not listening to what’s behind what the other person said, you limit yourself. I see a lot of people sit in talks and you can tell when they tune out because they’ve decided “I want to know X.” and that will be their question. Instead of writing it down to ask, they block out everything. They concentrate on their reply.
Notice how I said ‘reply’ and not ‘question’?
Yeah. There’s a reason.
## Ask Different
When you go up to ask someone a question based on their talk, you’re not playing *Jeopardy*. The game isn’t “Phrase my answer like it was a question.” The point is to to ask something to understand a little better how someone else reached a conclusion. It’s the fundamental difference between “Why didn’t you use the Post 2 Posts plugin?” and “What did you use to connect the posts to each other and why?” The first one makes your preference known. It makes an assumption that obviously everyone would use Posts 2 Posts. The second one asks to get into the mind of the speaker, to learn the way another mind works. It assumes the other person is different from you.
When you ask what someone used, and why, you get an insight into their process, which may help you reflect on your own. You may find new answers, and all you have to do is remove your own ego from the question.
## Learn Different
The point of this is not to make a speaker’s life easier, but to make yours better. If you change just two small things in how you ask questions, you’ll find you can learn a whole lot more.
1. Write down the question you want to ask
2. Ask it without assuming you know the best answer
You may be surprised how the tone of the ask changes everything.
**Categories:** How It Is
**Tags:** essay, oped
---
### [Data Structure](https://halfelf.org/2017/data-structure/)
**Published:** December 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Determining the design of data.
**Content:**
At WordCamp US, Tracy turned to me and said “I want to do something about the actors on our site.”
Her idea was that, based on the traffic on our sites, people wanted to know a little more about the actors. The way I’d built out the site, you *could* get a list of all of an actor’s characters, but you couldn’t *really* get at everything. Tracy explained to me what people were searching for (actors who were queer, or not) and I mulled over the possibilities, sketching out three solutions.
## 1. Facet and Smart PHP
We originally added in actors as a plain-text field, saved as an array, for all names associated with a character. In using this, with FacetWP, it was trivial to look for [all characters played by Ali Liebert](https://lezwatchtv.com/characters/?fwp_char_actors=Ali%20Liebert). We also already had in a repeatable field, so we could put the ‘most prominent’ actor on top (see “Sara Lance”).
However what was not trivial was the idea of identifying if an actor was queer. You see some characters have multiple actors, and while today all are either queer or not, one day they may not be. I pointed this out to Tracy using the Sara Lance conundrum and Tracy cried ‘Whhhyyyyyyyy?’ and lay down on the floor.
## 2. Taxonomies
Characters already have a bunch of custom taxonomies, and I considered extending that to a new taxonomy for actors. That would immediately provide organizations, and adding new actors is easy on the fly. With auto-complete, we could get away from the drama of my inability to spell names (or autocorrect’s inability to believe me that in this case, I is *before* C).
But… Taxonomies lack extendability. Even with a mess of custom meta added in for featured images, we wouldn’t have an ‘easy’ way to track all trans actors. And we wouldn’t have enough of a future.
## 3. Custom Post Types
This is what we actually decided to use. [A custom page for each actor](https://lezwatchtv.com/actor/ali-liebert/). We added in two new taxonomies for actor gender identity and sexual orientation, which are then used to determine if the actor is queer or not. It gives us the most control and extendability of the choices, and the nice permalink.
There are two significant downsides to this. First, you have to add in a page for the actor *before* you add in the character page. Second, I had to ‘reproduce’ a loop to list all the characters played by an actor. However I was reusing the same logic as I do for shows which made it easier than it might have been.
## What It Means
Understanding and predicting an unknown future is hard. It’s near impossible. You have to guess what you want things to be, and as I have said many times with the building out of LezWatchTV, you must be alright with being wrong.
**Categories:** How It Is
**Tags:** code, data, design
---
### [Migrating from Post Meta to Custom Post Types](https://halfelf.org/2018/migrating-post-meta-custom-post-types/)
**Published:** January 2, 2018
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** One way to migrate post meta to it's own post type.
**Content:**
There are, as it happens, a lot of ways to do this. This is a way that I tested and it works, but it’s not the final way I did things. That said, this does work and, if you’re not on a shared server, is just fine.
## The Concept
I have (roughly) 2200 posts in a custom post type (`post_type_characters`). Each of those posts has a post meta field for actors (`lezchars_actor`). The content of the post meta is an array of text fields, that looks something like this:
I wanted to take the post meta and split it into a post for each actor, however I wanted to remove any comments in parenthesis. I also wanted to change the content of `lezchars_actor` to be the IDs of the new actors pages.
Did I mention I had 2200 posts? And some actors were there multiple times? And I didn’t want to make a lot of duplicate posts.
## The Code
If you want to do this with PHP, it’ll look something like this:
## Notes
The reason this really works is this:
That actually checks if the page with the slug already exists and if so, uses it to edit the post meta.
If you don’t have robust hosting, or you have a lot of posts, you’ll need to edit the `$char_queery` like this:
Run it once, bump the offset from 0 to 300, and repeat until you get through all your posts.
**Categories:** How To
**Tags:** custom post types, migration, post meta, wordpress
---
### [Random Post of the Day](https://halfelf.org/2017/random-post-day/)
**Published:** December 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Tweeting random content on the regular part 1: JSON, WP_Query, and Transients. Or not.
**Content:**
I wanted to make a random post of the day. In this case, I wanted it to be a random post of one of two custom post types, and I wanted to output it as JSON for a variety of reasons, including future plans. Like tweeting that post.
I’ll get to that later.
## Overview
To do this, I have the following moving parts:
1. The RESTful routes
2. The random post
3. The expiration (i.e. each post lasts a day)
I’m going to skip over how to make a REST API route. I talked about that earlier in 2017 when I explained [how I made the Bury Your Queers plugin](https://halfelf.org/2017/json-rest-api-peace/).
What’s important here is actually the random post and spitting out the right content.
## Getting a Random Post
This is cool. WordPress can do this out of the box:
And at that point all you need to do is have the API return the array, and your final output is like this:
This is a simplified version of my code, since in actuality I’m juggling a couple post types (shows or characters), and outputting more data (like if the character is dead or alive). It’s sufficient to prove this point.
## Expirations
Okay. Now here’s the fun part. If you go to your JSON page now, it’ll show you a new character on every page reload, which is absolutely *not* what we want. We want this to only update once a day, so we can do this via Transients like this:
But.
[Transients kinda suck](https://journal.rmccue.io/296/youre-using-transients-wrong/).
## Expirations 2.0
Alright. Let’s do this differently. The server this is on has object caching, and it gets flushed every now and then. While it doesn’t matter if the post is re-randomizes in this case, it’s still not a great practice. So let’s use options!
And now you see my `$type` variable and why it matters. There’s more magic involved in the real world, but it’s not relevant.
**Categories:** How To
**Tags:** query, time, wordpress
---
### [Zap a Daily Tweet](https://halfelf.org/2017/zap-daily-tweet/)
**Published:** December 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Tweeting random content on the regular part 2: The Automation
**Content:**
Last week I told you how I made a random post of a day. Well, now I want to Tweet that post once a day.
Now there are a lot (a lot) of possibilities to handle something like that in WordPress, and a lot of plugins that purport to Tweet old posts. The problem with all of them was that they used WordPress.
## There's nothing wrong with WordPress
Obviously. But at the same time, asking WP to do 'things' that aren't it's business, like Tweeting random posts, is not a great idea. WordPress is the right tool for some jobs, but not all jobs, after all.
What *is* WordPress' job is generating a random post and setting a tracker (transient) to store for a day. And it's also WordPress' job to output that data how I want in a JSON format.
The rest, we turn to a service. [Zapier](https://zapier.com).
## A Service?
Like many WordPressers, I like to roll my own whenever humanly possible. In this case, I could have added an OAuth library and scripted a cron job, but that puts a maintenance burden on me and could slow my site down. Since I have the JSON call, all I need is 'something' to do the following:
1. Every day, at a specific time, do things
2. Visit a specific URL and parse the JSON data
3. Craft a Tweet based on the data in 2
I dithered and kvetched for days (Monday and Tuesday) before complaining to Otto on Tuesday night. He pointed out he'd written those scripts. On Wednesday, he and I bandied about ideas, and he said I should use [IFTTT](https://ifttt.com). Even using IFTTT's Maker code, though, the real tool needed is one that lets me code logically.
## Zapier
The concept of IFTTT is just "If This, Then That." If one thing is true, then do another. It's very simple logic. Too simple. Because what I needed was "If this, then do that, and tell another that." There wasn't an easy way I could find to do it with IFTTT so I went to the more complicated.
Three steps. Looks like my little three item'd list, doesn't it?
The first step is obvious. Set a specific time to run the zap. It's a schedule. The second step is just a web hook saying 'Get the data from URL.' And the third step is aware!
Pretty nice. If you click on the 'add field' box in the message content (upper right), it knows how to grab the variables from the previous steps and insert them. Which is damn cool.
**Categories:** How To
**Tags:** automation, cron, twitter, wordpress
---
### [Data Based Sites](https://halfelf.org/2017/data-based-sites/)
**Published:** December 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Or: How Sara Lance Made Me Cry
**Content:**
Designing your website involves understanding the structure of the data within. Designing your data comes down to how you store it. At its base level, everything on your site is a post, but the way you handle the data WITHIN the posts is how you can plan for growth, adaption, adoption, and the future. Building a site today involves making sure the data is easily consumable by multiple formats, like AMP, JSON APIs, and Alexa Echo Skills. And it all starts with understanding the data you’re using. Even if that data is from TV.
## Television is chewing gum for the eyes
I love television. I love books, I’m always reading and writing, and I love radio. I like movies. But TV is something weird and wonderful. TV is escapism when a story brings you someplace new and amazing.
One of the reason I love tv is that I see myself reflected in media. I’m a Jewish lesbian. Growing up, I didn’t see a lot of me on TV. Any, really. If I think about it, the first Jewish Lesbian I can remember seeing is Willow Rosenberg from Buffy. Yeah. I was out of college by then.
## Representation Matters
In the entirety of television, world wide, there are about 2000 queer females. Total. Yeah. 2000. That’s on about 600 shows. There are not a lot of them, and I know the numbers because I run, with Phillys very own Tracy, a site that uses WordPress to record all of them. That’s right, I have the data.
## Data Driven Design
This isn’t about themes. I can’t design themes. I don’t. I’m bad at it, I know that, sorry Tracy. And when we set about making this site, we had some lofty goals and ideas and we learned some lessons by prejudging the data. Originally we wanted to simply list shows and if you should watch them or not, and list the characters but…
Somewhere around 100 characters and fifty shows, it became clear that the datasets we’d defined were underestimated and over-complicated *and* over-simplified. We had to consider what made a show good or bad. We had to consider the situation. And we had to make changes.
When you build out any site, you have an idea of what you want. Maybe like us you make a massive list of everything you want to track and get dragged down into the weeds fast. Maybe you make a small list and have to go back and edit. In the end, the trick of it all is planning your site based on your data.
Even after you do all that planning, you’re going to find out you missed things. You’ll overestimate things. You’re going to underestimate others. People are going to use your data in unpredictable ways. This is just how the world works. So you have to design your code to adapt.
## How to Design for Data
This is about *planning* code. Designing your site for data comes down to how you store it. At its base level, everything on our site is a post. There are two types, shows and characters, and all posts have a bevy of ‘meta’ data for the various bits of information.
What information?
> Shows: tropes, airdates, thumb score, why that score, tv stations, nations, genres, formats, gold star, trigger warnings, quality rating, screentime rating, realness rating, timeline, episodes, & ‘ships.
>
> Characters: clichés, actor, sexuality, gender, date of death, tv show & role on show.
So all that is what we record. It’s grown and shrunk. We had urls in there and removed them because it was impossible to upkeep when fansites vanish. I removed and restored ‘ships, after figuring out how to store all of it in a searchable way. But with all that data, we started to see the big picture. And then … we realized how the data was stored mattered.
## Understand What Your Data Is (And Isn’t)
Most of the data is simple. Ratings are a 1-5 option. Trigger warnings were check boxes for a binary on or off … Were. Sexuality and gender are dropdown lists, and so are tropes and cliches. Managing those is easy. Ish. We understand taxonomies, at least, being WordPess developers.
Most of the time, data is obvious. Again, I have items that are a binary. A yes or a no. And while I personally believe that sexuality and gender are a spectrum, TV hasn’t caught up there, so that can be stored as a one to one dropdown. You are what you are. The same goes for a character being on a TV show. It’s all one or the other.
Having said all that, let me introduce you to Sara Lance, as played by Caity Lotz. Schrödinger’s bisexual time traveling action hero.
## The Complex Data: Sara Lance
Schrödinger’s bisexual time traveling action hero assassin pirate captain.
Sara Lance has two actors. She’s been on three shows in three separate capacities; guest, recurring, and regular. She’s died and came back to life. Sara Lance exists to make me, as a developer, cry. Because for her I have to store all of that data in a searchable manner that plain-text post meta doesn’t make easy. She made me rethink *all* our data storage.
Nothing about Sara is simple. Nothing is straightforward. Not even the existing taxonomies and lists stayed the same. Both gender and Sexuality went from a simple dropdown to a taxonomy. We moved from gay, straight, or bi, to include pansexual and asexual and I’m just waiting for Sara to step into pansexuality, y’all.
## Use WordPress First
As much as possible, use WordPress. Taxonomies are heavily used for ‘lists’ like cliches and tropes and tv stations, because they come with built in sortables. I can easily list all shows on NBC or all characters who are parents, because those are taxonomies. Even short lists like sexuality and gender work well for that. For the rest, it’s all post meta.
Sara exists beyond taxonomies. Originally, we had death stored as a simple taxonomy item for character cliches. If you were dead, you got the cliche of dead. Sara came along and died. And came back. So suddenly we had to rethink if someone kept the tags if they died and came back. Pro tip? They don’t. That was a quick decision, though. Don’t worry, she made us make harder decisions.
## Use Plugins Second
I mentioned everything that isn’t a taxonomy is post meta. Adding metadata to posts that aren’t taxonomies sucks. Yes, I said it. It sucks. Plugins like CMB2 or ACF will save your vegan bacon by making it easier to create a check box or a dropdown or a plain text field, like for actors.
Sara had two actors. While the field for actor is only plain text, and that’s relatively simple, we had to make it repeatable so we could add multiple actors. God help me, date of death had to be repeatable too. What if Sara dies again!? CMB2 has repeatable fields built in.
## Use Third Party Add-Ons Third
The bigger the data got, the more important admin design became. The more tropes, the worse a dropdown or multi-check section was. By using a select2 addon, and some custom save code, I was able to convert taxonomies into an auto-complete, which is a lot easier to visualize. So are groups. By clumping related data together, the brain makes the right connextions. And when it’s repeatable, your page grows with the data is uses, not with the data total.
Sara has three TV shows. *THREE!*
Sara’s page is much bigger than anyone else’s because she has three shows, and each show section has a dropdown for character role and another for the show name. And I can’t guess if she’s going to show up on another, like *Supergirl* maybe. CMB2 does have a limit to repeatable fields and groups, though. I hope Sara doesn’t hit it…
## Be Willing to Make Changes Fourth
You will be wrong. I removed the list of ships, relationships, from shows. Tracy was sad. I added it back. My bad, totally, and my reasoning was that it was not easy to maintain and manage in a searchable way. It wasn’t. But it *could* be. And I made it. Be willing to be wrong, to make mistakes, and to recover from them.
Because … Sara is always changing. Alive, dead, new show, new actor… Sara is always changing and always adapting and always being more awesome. She’s anything but static, and that’s a good thing. Sara Lance made me throw my preconceived notions of data storage and organization out the window. And I’m better for it.
**Categories:** How It Is
**Tags:** data, design, sara lance
---
### [Hey You Gays Filter](https://halfelf.org/2017/hey-gays-filter/)
**Published:** December 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Degenderizing guys since 2017
**Content:**
Are you tired of people always saying ‘guys’ when they’re talking to a mixed gender group of people? I know I am. One weekend I got four (yes four) comments about my code saying “You guys should…” or “Ask the guys who …” and so on.
All implied I wasn’t the human who wrote the code. Spoiler alert. I was. While I can’t fix the world out there, I do tend to reply with a handy gif:
But I can fix *MY* site. Since I only need this for comments on my site (I’m in charge of how I write), I can use this:
If you need to use it in titles and post content, steal the code from [capital\_P\_dangit()](https://developer.wordpress.org/reference/functions/capital_p_dangit/). After all, that’s what we do.
**Categories:** How It Is
**Tags:** filter, wordpress
---
### [Mapping Domains Without a Plugin](https://halfelf.org/2014/mapping-domains-without-plugin/)
**Published:** May 12, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How I broke my ecommerce store on the day of a big book release, and subsequently fixed it.
**Content:**
Recently I wrote [WordPress Murder Mystery](https://store.halfelf.org/ebooks/murder-at-wordcamp/). The day I released it, I got on a plane to fly to Miami, and proceeded to have a pretty awful travel day, thanks to a storm that pretty much knocked travel to the SouthEast out of commission. While I waited for my flight to DFW, I got pinged. “Hey, I can’t add anything from your store to my cart!”
I pulled up my laptop and thought about what I’d changed. Oh. I’d turned off domain mapping. But not really.
You see, I love the [WordPress Domain Mapping](https://wordpress.org/plugins/wordpress-mu-domain-mapping/) plugin. But I’m not using it here. No, I’m actually doing something I expressly and patently tell people not to do … because time has changed with 3.9 and it’s almost okay to do things this way. The change here is that WordPress is smarter now, and it’s safer, and you actually can just edit the home and site URLs in the Network Dashboard. But you know how I said ‘almost’ back there? Your ability to shoot yourself in the foot is directly proportional to how smart you *think* you are.
What I did? It’s basic but assumes you already know how to add a domain onto another.
1. Go to Network Admin -> Sites
2. Edit the site in question
3. Change the URL to the mapped domain, check the ‘change home and site URL’ box, and click update
That was it! Three steps and everything still worked! This also let me force change a site to https all the way, and since I didn’t have content, I didn’t bother with a search/replace. If I *had*, I’d use that [Interconnectit Script](https://github.com/interconnectit/Search-Replace-DB) or [WP-CLI](http://wp-cli.org/) for it. Still, like a wise person, I always get the domain ‘right’ before I add content.
And at this point, everything seemed to work just fine! And so I left it as is and published my book. And as you know, it all failed, spectacularly. I rolled everything back (because I knew what I’d changed last, see? always remember that!) and it worked again, so I knew I had to have missed something big here. Since I was stuck in an airport with choppy wifi, I disconnected everything and fired up my localhost version of my site. Banging on that for a while, I saw I missed a small, but hugely important factor in the plugin.
See most of what it does is that pretty interface to say “Pull domain.foo content from site #2 (aka foo.example.com)” and force redirects. It also lets you do cool things like “Allow users to log in from foo.example.com instead of domain.foo” but really I didn’t need any of that. The meat of the code is in the sunrise.php file, which when I studied, I realized was just doing the redirects “Send Site #2 to domain.foo” and for me, by renaming the home and siteURLs, I was already doing that.
So what had I missed?
`define( 'COOKIE_DOMAIN', $_SERVER[ 'HTTP_HOST' ] );`
That was it. I forgot to tell it “Cookies belong to the domain you’re *on*.” What this means is that if you log in at example.com, the cookie you get is for example.com and not domain.foo! For the most part, this isn’t a problem since no one logs in but me … until you try to make a purchase and it validates a cookie which doesn’t match the domain. I added that to my wp-config.php (down at the end of my Multisite section, where the SUNRISE define had been earlier) and everything magically worked.
Two lessons! First, test everything. Second, you can map domains without a plugin, safely.
I will note that, over time, it’s possible those settings for home and site URL may vanish from display. They’re powerful and dangerous settings, and you should not mess with them without a good backup.
**Categories:** How It Is
**Tags:** domain, multisite, plugins, wordpress
---
### [Subdomain vs Domain](https://halfelf.org/2012/subdomain-vs-domain/)
**Published:** December 18, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
When two words are very similar, it’s easy to get confused. Which witch is which? Whether, weather, and wether. Affect vs effect… Okay, you know, English sucks. We have way too many words that will drive you to drink, and if you know anyone who’s learned English as a second language, please take time to tell them how amazing they are. My father’s wife is Japanese, bilingual in French, and is learning English. I know a smattering of French. Our conversations are fantastically amusing and thankfully we have great senses of humor.
Because I’m that familiar with the crazy of my native language, I have no surprise that people get subdomains and domains confused. Here’s the basic statement:
**A subdomain is not the same as a domain.**
That’s it. But since I don’t expect everyone to know what the heck I just said, I’m going to explain. Remember, don’t think you’re stupid for not knowing this! You can’t magically know everything, you have to learn it, and there are people like me who want to help you. Where the confusion kicks in isn’t that we call it a ‘subdomain’ but that the official definition is “a subdomain is a domain that is part of a larger domain.” So we’ve just said a domain of a domain, and yet here I am pushing you and saying that a subdomain isn’t a domain when it clearly is.
It is and it isn’t.
- A domain is pretty simple: **elftest.net** is a domain. It’s the solid basis that all websites are built on.
- A subdomain is a subset of the domain: **tools.elftest.net** is a subdomain on elftest.net.
Notice how ‘tools.’ is in front of elftest.net? That extra period between tools and elftest is how we know this is a *sub* domain. The .net part is called the ‘Top Level Domain’ and any time you see www, that actually *isn’t* a subdomain, but a special term… You know what, let’s break this down with a picture.
[](https://halfelf.org/wp-content/uploads/sites/2/2012/12/domainex1.png)
You can ignore protocol for now (we can get into that another time). What we’re looking at is this:
**URL:** http://www.example.com/index.html
**Top-level domain name:** com
**Second-level domain name:** example.com
**Host name:** www.example.com OR example.com
Why is www special? It has to do with a lot of boring history, but suffice to say that used to be how we knew it was a webpage! Now we use http:// to say ‘This will be a webpage’ so many of us (myself included) [feel that www is unnecessary](https://halfelf.org/2012/dont-use-www/) and just makes URLs longer. However because of history, `http://www.elftest.net` and `http://elftest.net` will forever point you to the same place. This actually means that www *is* a subdomain, but it’s a very special one that points to the same place as no www at all. In very rare cases, a fancy website will redirect www and non-www to different places, but this is the exception, not the rule. Good SEO practices are to have the www and non-www point to the exact same place.
The meat of the matter is that most of the time, when someone asks ‘What’s your domain?’ they really mean ‘What’s your host name?’ My host name is elftest.net (or ipstenu.org or halfelf.org…. I have a lot of domains
Now let’s look at a subdomain.
[](https://halfelf.org/wp-content/uploads/sites/2/2012/12/domainex2.png)
They look shockingly similar, except that instead of www in front, I have sub. So what’s the deal here? Well because I’m using something *other* than www, I’ve designated sub.example.com as a subset of example.com, and thus a subdomain. Yes, it’s backwards. Sub should be below or behind, but remember, we’re calling .com the *top* level domain, so right-to-left this makes more sense.
I know. It’s all clear as mud. Even writing this I sat there and muttered “This stuff is nuts.” I know all this didn’t explain everything as clearly as I could wish, but I’ll break it down into the simplest terms that, while not 100% technically accurate, will tell every decent web tech what you mean:
When someone asks “What’s the subdomain?” you answer ‘sub.example.com’
If someone asks “What’s the domain?’ you say ‘example.com’ (sometimes they’ll ask “What’s the main domain?”)
If you’re on Multisite and someone asks “What’s the mapped domain, and what subdomain does it point to?” you say ‘mappeddomain.com and it points to mapped.example.com’
And never ever use domain mapping plugins for your subdomains. Those are for grownup domains only, not your subdomains.
For extra credit: Third level domains are what you get when you see things like example.co.uk – example isn’t a subdomain here, it’s the main domain. co.uk is the TLD. Why third? Well, we’d already used sub and second, and we needed some way to say that this is part of the primary URL, and not a subset. Also geeks love to confuse people.
**Categories:** How It Works
**Tags:** domain, wordpress
---
### [Reordering Sort Order Redux](https://halfelf.org/2017/reordering-sort-order-redux/)
**Published:** December 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A repeat on some cleverly done sorting.
**Content:**
Earlier this year I talked about [removing stopwords from sort queries](https://halfelf.org/2017/stopwords-sort-queries/).
Sadly I ran into a problem where the code wasn’t working.
## The Original Code
Here’s the original code.
This worked, mostly, but it somehow broke pagination. Every page restarted the order. This had to do with complications with the Genesis theme but more importantly it messed up the order on the *back* of WordPress **and** it didn’t play well with FacetWP. So I rewrote it a little to be more specific:
## The New Code
First of all, I got smart about only loading this when it needed to be loaded. Next I told it to only sort on archive pages, because I was also outputting recently added lists in other places. Finally I forced it to understand Facet, and that if I wasn’t sorting by alphabetical, it didn’t matter at all.
**Categories:** How To
**Tags:** coding, query, sorting, wordpress
---
### [Why I Do This](https://halfelf.org/2017/why-i-do-this/)
**Published:** November 30, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Why? Because.
**Content:**
Every once in a while someone makes a few veiled statements about how I must be on some kind of power trip, and that’s why I took control of the Plugin Review team as the rep. It’s not true.
## Why I am a Forum Moderator
I was helping people and one of the mods asked if I’d join. I said yes. I’m currently still on the team, but I no longer am super active. I’m kind of on the cusp of the requirements for being a moderator, and if they removed me, I’d be okay with that.
## Why I was the Forum Representative
We were just deciding who should be the very first reps for teams, and I was asked (along with someone else) if I’d be willing to try to help us figure out how we wanted to do this. I stepped down from that responsibility after a few years to lower my personal stress.
## Why I am a Plugin Reviewer
I had been reporting a bunch of plugins doing bad things, as well as helping the gents figure out some crazy stuff. They abducted me and asked me to help. I did and bit by bit learned how to properly handle reviews. I keep doing reviews because I enjoy it.
## Why I am the Plugin Review Representative
No one else wanted to do it and we needed someone to take responsibility and make some changes. Like with the guidelines. The directory etc. I still do it because it’s a needed job.
## But … WHY!?
None of that answers the real question of why I do this at all though. If it’s not apparent, I literally fell into this job by accident and stuck around. I stick around because I enjoy what work I do and I learn from it. Learning about how people write code, the assumptions they make, teach me more about accidental security than all the time I worked at the Bank.
But also I believe that any social organization that advocates that the means of production, distribution, and exchange should be owned or regulated by the community as a whole. And to that end, I feel that the only right way to make plugin code reviews, or the forums, work is to get the community self-regulating.
The problem with that theory is that not everyone is altruistic. If people within the community have a desire contrary to the rest of the community, it causes conflict and drama. Therefore, a true ‘socialist’ society requires people willing to be the ‘baddie’ and say things like “No, you can’t do that.” Basically, we need a parent who’s able to explain to the children why putting their hands on the stove is bad, and why throwing rocks at their friend was mean.
I certainly don’t think I’m the only person who *can* do this. I just seem to be one of the few *willing* to do it in a consistent and continuous fashion. And that’s the reason I stick around. I’m trying to build a future where anyone can do technical code reviews for submitted plugins. Anyone. However that comes with a lot of responsibility for the community.
While there are many people capable of doing a technical review, and many people competent at explaining bad code to developers, and many people wise enough to handle angry developers, that Venn Diagram has a *very* small crossover. And if you factor in people *willing* do to it, it gets smaller.
For example. Everyone complains about the WordPress Plugin Guidelines being too strict and too vague. Last year I undertook the monumental effort of rewriting them for clarity and fairness. I asked people at multiple WordCamps to help. We sat and discussed what the guidelines meant and why they were worded in the way they were. Then I posted on the Make blog asking people to help.
Of the few hundred people who complained, less than 20 had anything to say.
From that, and other times I’ve reached out to the community and asked for help, and the results I’ve had, I feel that people aren’t willing to embrace all the aspects of the job. Yet. That’s why I’m slowly, carefully, working my way through the changes. I’m trying to lower the bar for them, to make them more amenable to join.
It takes time.
## Yes, but that isn’t WHY!
Oh right. Why do I do this?
I review plugins because I legit enjoy seeing the crazy code people come up with. I help in the forums for the same reason. I like seeing what people do, and solving problems. I like writing the code to solve the problems too.
I’m the plugin rep because it’s a dirty job, but someone has to do it, and I’m okay with being hated by people. I know I’m doing it to make code better and safer for users, to encourage developers to engage in ethical and kind business practices, and because I learn from them too.
At the end of the day, I do this, all of this, because I can, because I enjoy it, and because I feel good when I help people.
One day that may change. When it does, I’m sure I’ll walk away. That’s just not today.
**Categories:** How It Is
**Tags:** essay, oped, wordpress
---
### [Accepting Failure](https://halfelf.org/2017/accepting-failure/)
**Published:** November 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Learning from failure.
**Content:**
This is a difficult thing to do, so let me share some briefs of recent failures.
## Failure To Launch
I recently retired a plugin. It’s a good plugin, complex and clever and does things in a wickedly smart way. And its an absolute failure because it lacked the ability to solve one problem, perhaps the biggest problem it was intended to solve.
The plugin was more complex in ways that it didn’t need to be. I spent a lot of time thinking about one use case, and I never looked far enough to think about the real world, which ended with this plugin only being used by 600 or so people, and most of them grumblingly.
Accepting my loss, I recognized that I’d coded myself into a hole, wrote uninstall code, and apologized. A lot.
## Failure to Maintain
I closed my ebook store recently. Quietly. Because it was so much work to update and maintain, and it was draining me. I kept all my books on Amazon, where they sell much better with much less work, and redirected everything.
The problem was I wasn’t making enough money on it to justify it. While I had intelligently made changes to inspire people to purchase instead of download for free, and I strongly believe in letting them be free when they need to be, it’s just a lot of work. A lot. I was spending time I wasn’t earning on. Nor enjoying.
## Failure to Communicate
There’s someone who hates me right now. They think I’m a terrible person, that I hate them, that I want them to fail. Because I was unable to explain sufficiently why what they were doing was wrong. I’ve tried appealing to them, offering them more exceptions and time than I usually do (ever) for a fix that should be simple.
For some reason, we just can’t bridge the gap. They won’t listen. And no matter what I say, they only see hatred in it. I can’t convince them otherwise. And yes, that smarts. It’s a terrible feeling to not have failed myself, but to have failed someone else, to the point they feel they have no recourse.
## Accepting Failure
Accepting you’ve failed at something is hard. Thankfully in all three cases, I feel like I’ve learned something from them. I learned how to control my temper, how to watch the weight of my words. I’ve learned how to properly write and run an ebusiness, and why I don’t want to. I’ve learned how to gracefully degrade a plugin.
But knowing I failed still does hurt.
So all I can do is learn from it and move on.
**Categories:** How It Is
**Tags:** failure, oped
---
### [Cron Caching](https://halfelf.org/2017/cron-caching/)
**Published:** November 23, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Tricking caching into grabbing a page with cron and wp_remote_get.
**Content:**
WordPress' relationship with cron is touchy. It has it's own version, `wp-cron` which isn't so much cron as a check when people visit your site of things your site needs to do. The problem is that if no one visits your site… nothing runs. That's why you sometimes have posts that miss schedules.
One possible solution is to use what we call ['alternate cron'](https://halfelf.org/2013/wp-cron-it-up/) to trigger your jobs. That works pretty well as it means I can tell a server "Every 10 minutes, ping my front page and trigger events."
But in this case, I didn't want that. I receive enough traffic on this site that I felt comfortable trusting in WP cron, so what I wanted was every hour for a specific page to be visited. This would prompt the server to generate the cached content if needed (if not, it just loads a page).
## WordPress Plugin
I'm a huge proponent of doing things the WordPress way for WordPress. This method comes with a caveat of "Not all caching plugins will work with this."
I'm using Varnish, and for me this will work, so I went with the bare simple code:
```
class LWTV_Cron {
public $urls;
/**
* Constructor
*/
public function __construct() {
// URLs we need to prime the pump on a little more often than normal
$this->urls = array(
'/statistics/',
'/statistics/characters/',
'/statistics/shows/',
'/statistics/death/',
'/statistics/trends/',
'/characters/',
'/shows/',
'/show/the-l-word/',
'/',
);
add_action( 'lwtv_cache_event', array( $this, 'varnish_cache' ) );
if ( !wp_next_scheduled ( 'lwtv_cache_event' ) ) {
wp_schedule_event( time(), 'hourly', 'lwtv_cache_event' );
}
}
public function varnish_cache() {
foreach ( $this->urls as $url ) {
wp_remote_get( home_url( $url ) );
}
}
}
new LWTV_Cron();
```
Yes it's [*that*](https://lezwatchtv.com/) site. This very simple example shows that I have a list of URLs (slugs really) I know need to be pinged every hour to make sure the cache is cached. They're the slowest pages on the site (death can take 30 seconds to load) so making sure the cache is caught is important.
**Categories:** How To
**Tags:** cache, cron
---
### [Github Introduces Archiving](https://halfelf.org/2017/github-introduces-archiving/)
**Published:** November 9, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Yes, you can archive repositories now.
**Content:**
One of my laments has been that I can't (easily) flag a repository in Github as archived.
https://twitter.com/ipstenu/status/926529534580555777 As of today, you can!
Github just announced the ability to [archive repositories](https://github.com/blog/2460-archiving-repositories), and yes, it can be undone.
To archive a repository, go to your Repository Settings Page, scroll down to the **Danger Zone** and click **Archive this repository**. It will pop up with a screen to warn you that this is a serious change, and while it *can* be undone, it will ask you to type in the repository slug to confirm.
Once you've closed the repository, you'll see it has a new banner at the top, announcing "This repository has been archived by the owner. It is now read-only."
The repository will also have a little 'Archived" badge in the regular view.
So. YAY!
**Categories:** How It Is
**Tags:** github
---
### [Deploying from Github via TravisCI](https://halfelf.org/2017/deploying-from-github-via-travisci/)
**Published:** November 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Deploying code with Travis is powerful, but incredibly complicated for a hobbyist.
**Content:**
When you develop your code on Git, you can automagically (and easily) deploy to places all you want, [if the repository is on the same server](https://halfelf.org/2013/deploying-with-git/). If it's not, you can use something like [Codeship to automate pushing for you](https://halfelf.org/2017/deploying-github-codeship/).
## Free Services Have Limits
Codeship, which I like a lot, has a limit of 100 pushes a month. In October, when Tracy and I finally deployed the newest version of our website, we actually hit that. In part, this is because we don't have a great 'test' environment where we can internally develop *and* share the results with the other. We both have our own versions of local environments, but you can't show your cohort 3000 miles away what you've done without pushing the code to the private development site and letting her see it.
After 100 pushes, it's $490 a year for unlimited. While the product claims to be 'free forever' for open source, there's actually no documentation that I could find on how one gets added to that list, or what the qualifications are. Does my personal open source project qualify? I'll have to email and find out.
## TravisCI Is 'Free'
All 'free' services have a paid component. Travis, like Codeship, is free for public, open source, projects. And like Codeship, it doesn't require you to host (and thus) update anything yourself. Which is nice. In fact, it only has a few pre-requsits:
- [GitHub](https://github.com/) login
- Project [hosted as a repository](https://help.github.com/categories/importing-your-projects-to-github/) on GitHub
- Working code
- Working build or test script
Sounds like a match made in heaven, except for the part about documentation on GitHub being out of date. I don't begrudge them, as keeping up docs is a pain and if it's with another service it's nigh impossible.
Awesome. Sign up for Travis, activate your repositories, add a `.travis.yml` file with the programing language, and you're ready to do… what?
## Writing The Build Script
This is the weird part. You have to invent a way to push the code. Unlike DeployHQ or Codeship, there's no place to type in the code on their servers. You have to make a file and write the script.
The scripts look like this (cribbed [from Florian Brinkkman](https://florianbrinkmann.com/en/3485/deployment-travis-ci/)):
```
language: php
addons:
ssh_known_hosts:
- $DEVELOPMENT_SERVER
- $PRODUCTION_SERVER
before_script:
- echo -e "Host $DEVELOPMENT_SERVERntStrictHostKeyChecking non" >> ~/.ssh/config
- echo -e "Host $PRODUCTION_SERVERntStrictHostKeyChecking non" >> ~/.ssh/config
script:
-
before_deploy:
- openssl aes-256-cbc -K $ENCRYPTED_KEY -iv $ENCRYPTED_IV -in deploy_rsa.enc -out /tmp/deploy_rsa -d
- eval "$(ssh-agent -s)"
- chmod 600 /tmp/deploy_rsa
- ssh-add /tmp/deploy_rsa
deploy:
- provider: script
skip_cleanup: true
script: ssh -p22 $DEVELOPMENT_SERVER_USER@$DEVELOPMENT_SERVER "mkdir -p $DEVELOPMENT_PATH_STABLE" && ssh -p22 $DEVELOPMENT_SERVER_USER@$DEVELOPMENT_SERVER "mkdir -p $DEVELOPMENT_PATH_TRUNK" && rsync -rav -e ssh --exclude='.git/' --exclude=scripts/ --exclude='.travis.yml' --delete-excluded ./ $DEVELOPMENT_SERVER_USER@$DEVELOPMENT_SERVER:$DEVELOPMENT_PATH_TRUNK && rsync -rav -e ssh --exclude='.git/' --exclude=scripts/ --exclude='.travis.yml' --delete-excluded ./ $DEVELOPMENT_SERVER_USER@$DEVELOPMENT_SERVER:$DEVELOPMENT_PATH_STABLE
on:
branch: DEVELOPMENT
- provider: script
skip_cleanup: true
script: ssh -p22 $PRODUCTION_SERVER_USER@$PRODUCTION_SERVER "mkdir -p $PRODUCTION_PATH_STABLE" && rsync -rav -e ssh --exclude='.git/' --exclude=scripts/ --exclude='.travis.yml' --delete-excluded ./ $PRODUCTION_SERVER_USER@$PRODUCTION_SERVER:$PRODUCTION_PATH_STABLE
on:
branch: master
```
And to be honest, it's really not that explanatory. I read it a few times and sighed. While I'm (obviously) not opposed to learning new code to do things, I am opposed to all these services making it needlessly complicated.
## One Big Problem…
You can't (easily) set up SSH keys on Travis for free. That's because they're [restricted to the pro version](https://docs.travis-ci.com/user/private-dependencies/). Now you totally can set it up, but it's [incredibly insane](https://oncletom.io/2016/travis-ssh-deploy/) and not something I was willing to do in the long term. And since the cost of TravisPro is $69 a month compared to Codeship's $49 or so a month, it was a no brainer.
I emailed Codeship to ask if I qualified for 'open source.' Most likely they'll tell me no, because I deploy *to* a closed system, but it doesn't hurt to ask.
**Categories:** How To
**Tags:** deployment, github, travis
---
### [Indiegogo Embed](https://halfelf.org/2017/indiegogo-embed/)
**Published:** November 16, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Don't use iframes, use shortcodes.
**Content:**
Indiegogo doesn't have oEmbed, which means you can't just paste in a URL and expect it to work on a WordPress site. And worse, their directions are "Use an iframe plugin!"
NO.
Just say *NO* to iframe plugins!
Use a *shortcode* instead!
If you're brand new to shortcodes, check out [Sal Ferrarello's awesome post about it](https://salferrarello.com/shortcode/) (I saw him talk at WC Philly 2017 and he's amazing). I'll give you the highlights for this one code though.
## The Code
```
/*
* Embed an IndieGoGo Campaign
*
* Usage: [indiegogo url="https://www.indiegogo.com/projects/riley-parra-season-2-lgbt"]
*
* Attributes:
* url: The URL of the project
*/
add_shortcode( 'indigogo', 'helf_indiegogo' );
function helf_indiegogo() {
$attr = shortcode_atts( array(
'url' => '',
), $atts );
$url = esc_url( $attr['url'] );
$url = rtrim( $url, "#/");
$url = str_replace( 'projects/', 'project/', $url );
$return = '';
return $return;
}
```
## What It Does
The code is as basic as I could made it, and it takes the URL of the campaign, strips out the trailing hashtag, changes projects to project (singular – and yes, that gave me a headache), and punts out an iframe.
Thankfully they make this easy unlike places like CrowdRise where you have to magically know the ID number in order to pull this off.
**Categories:** How To
**Tags:** embed, indiegogo, wordpress
---
### [Grunt Can't Build Sass on High Sierra](https://halfelf.org/2017/grunt-cant-build-sass-on-high-sierra/)
**Published:** November 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We are the crystal gems, we'll always save the day. And if you think we can't, we'll always find a way.
**Content:**
Working on a site, I went to run my grunt command to compile sass, I got an error.
```
Running "sass:dist" (sass) task
/usr/local/Cellar/ruby/2.4.2_1/lib/ruby/2.4.0/rubygems.rb:271:in `find_spec_for_exe': can't find gem sass (>= 0.a) (Gem::GemNotFoundException)
from /usr/local/Cellar/ruby/2.4.2_1/lib/ruby/2.4.0/rubygems.rb:299:in `activate_bin_path'
from /usr/local/bin/sass:22:in `'
Warning: Exited with error code 1 Use --force to continue.
```
No good, right? And googling around for that didn't help me at all until I drilled down and realized the sass error was a *Ruby* error.
## Upgrade Ruby
First, install [Homebrew](http://brew.sh/). I know there are many other ways to handle installs on Macs, but Homebrew has been my go-to for a few years. It makes my life easier.
Once Homebrew is installed run the following command: `brew install rbenv ruby-build`
If this gives you an error, like missing xcrun, then run this: `xcode-select --install`
Once you have rbenv installed, it's time to upgrade ruby:
```
rbenv install 2.4.2
rbenv global 2.4.2
```
Awesome! But grunt still doesn't work. And this is because *Sass* isn't installed.
## Install Sass
This should be easy, right? `sudo gem install -n /usr/local/bin sass` and off you go. The problem is you may get this error:
```
ERROR: While executing gem ... (TypeError)
no implicit conversion of nil into String
```
Not so helpful. The magic here is going backwards to go forward. Update your gems first: `sudo gem update --system` and *then* run the installer for sass.
## Why Did This Happen?
The short answer is that Mac changed versions and everything got out of sync. I'm not a system code expert so I can't explain it better than that.
How you fix these things is by understanding how to logically step backwards through the errors. Most of the time, we see it as "Grunt says Sass is broken!" and the trick here is to ask yourself "What runs Sass?" and the answer is "Ruby." So instead of looking up "Why can't I run sass on grunt?" we look up "Ruby can't compile SCSS on Mac High Sierra" because that's the ultimate answer.
Walking backwards is the secret sauce for all solutions with software, I feel. Why can't Grunt run Sass? Because Ruby can't compile? Why can't Ruby compile SCSS? Let's reinstall Sass! Oh wait, that has an error. Okay, let's upgrade Ruby. Oh *that* has an error too? Let's solve that.
It's not fun, unless you're me and think snarling at a laptop in the conference room of your friends' office is cheerful.
**Categories:** How To
**Tags:** fix, grunt, homebrew, sass
---
### [The Never-ending Progress Bar](https://halfelf.org/2017/the-never-ending-progress-bar/)
**Published:** November 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Getting rid of something from your dock on a Mac can be a real pain.
**Content:**
When you download a file from Safari, it shows you a progress bar for how it's going along. If you happen to download files to a folder in your dock, you'll see a line grow as it downloads, and then vanish.
Except… sometimes it doesn't.
And then it gets worse if your bar changes size…
Well *great*. Now what?
**To the terminal!**
No really. It's one command:
```
killall Dock
```
That's it. It restarts the dock, the download bar goes away, and you can relax.
**Categories:** How To
**Tags:** GUI, macintosh
---
### [PHP Spaceship](https://halfelf.org/2017/php-spaceship/)
**Published:** November 2, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We built this operator on PHP.
**Content:**
It’s no Jefferson Starship, but in PHP 7 there’s an awesome new comparison operator called ‘Spaceship.’
## Dragon Fly
Operators are those things we use to tell PHP what ‘operations’ to perform on variables and values. Comparison operators are used to compare two values (like a number or string). And Spaceship — `` — is a cool new one.
It’s a *combined* comparison operator and returns:
- 0 if values on either side are equal
- 1 if value on the left is greater
- -1 if the value on the right is greater
## Red Octopus
So why would anyone use it?
Let’s say you have an array of characters with lists of when they died. But the characters are ordered alphabetically. Sara Lance comes after Lexa, even though Sara died first. And let’s say you want to take the list of all the characters who died and put them in the order of death, not their names.
To do this in PHP, you would use `usort` or `uasort` to ‘user sort’ the array. The A in the sort is if you have an associative array, and you want to keep ‘name’ and ‘date of death’ connected when you sort. Which you do.
## Spitfire
In PHP 5, the sort would look like this:
Which isn’t bad, but it’s messy right?
## Earth
In PHP 7, the sort would look like this:
Way nicer, and faster, isn’t it?
## Freedom at Point Zero
Why not use it all the time? Because it’s PHP 7+ only, and for some reason not all servers have PHP 7 as the *command line* version of PHP. Which means if you use it, sometimes wp-cli commands don’t run.
However. If you have PHP 7 all across the board, then use the starship and save yourself some flying time.
**Categories:** How To
**Tags:** development, php
---
### [Find It, Write It, or Buy It?](https://halfelf.org/2017/find-write-buy/)
**Published:** October 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Should you use the free one, build it yourself, or buy it? The answer is yes.
**Content:**
When you need to extend WordPress, you have three main choices for how to do it. You can find the code on WordPress.org, you can write the code, or you can buy premium code.
Which is right depends more on your situation and skills than your space cash.
## Find It
This is the cheapest, though it can be time consuming. Finding a good plugin or theme on WordPress.org is less a factor of the search function, and more a function of being unable to codify ‘need’ clearly. For example, if you want a slider plugin (no judgement here), there are around 2000 possibilities. Newspaper themes? You’re looking at 70 or so that may fit the bill.
Finding what you need means you must narrow your search. You have to decide what kind of sliders, or what format of newspaper, you feel is the most important. You want a slider with text overlay? That’s different than one that supports animated images. Newspaper themes don’t always have the same formatting options.
Once you find the features you want, you still have the headache of reviewing the developer and the code. Oh yes. If you’re installing plugins without looking into the developers or the code, you run a high risk of damaging your site. This isn’t a huge deal for a hobby site, but if you’re trying to make a business or a successful niche site, this can make or break you.
So. Should you rely on what you find? For the most part, yes. Provided you *can* vet the code, you’re going to save yourself time, effort, and money. There’s no sense in reinventing the wheel.
## Write It
This is the *most* expensive choice. Seriously. Think about how much you get paid a year. Let’s say you make $80k. Divide by two to get $40k. Now. You’re worth about $40 an hour. So if it takes you ten hours to write a plugin or theme, that’s $400. Surprise.
So why would anyone write their own code? Basically because you cannot find what you’re looking for in a way that meets your requirements, be it security, stability, or functionality. Often you will find very *close* versions of what you’re looking for, but when the magic bullet is missing, it’s up to you to build it all your own. This is how forks happen, in software, by the way.
There’s nothing inherently wrong with this, but it requires time and skill you may not have. But should you do it? Yes. If you can’t find what you want, and you know you can write *and support* the code, this is a perfectly viable option.
## Buy It
People always seem to not want to do this. And really the only reason I can understand *not* wanting to buy premium code is that you can’t vet the usability or security until you buy it. That makes freemium code like Yoast SEO or Monster Insights my favourite kind. You can use their free code, see how well it works and if these are people you could work with.
But when you argue that you shouldn’t have to *pay* for code, I gesture towards the door and ignore you. Because yes, yes you should. Remember how 10 hours of writing your own code is around $400? Plus ongoing upkeep? Okay, that plugin you want is $60 a year. That means *six years* of the plugin is the same cost as writing it yourself. Which is a way better deal.
Should you buy it? Yes! Absolutely yes, buy the plugins but only *if* you can vet the plugin shop first.
## Wait… You said yes to all three!
Surprise twist ending!
Here’s the thing. Every single decision you make has a cost and repercussions. They’ll all cost you time, money, and a bit of a headache no matter what you pick. So the real answer, the one I *can’t* give you, is what’s worth more to you?
For me, I will use free if it exists, I’ll write my own if it doesn’t, and I’ll buy premium if they do it so well I’m just whistling dixie.
**Categories:** How It Is
**Tags:** decisions, wordpress
---
### [Crypto Mining on Websites Isn't Evil](https://halfelf.org/2017/crypto-mining-websites-isnt-evil/)
**Published:** October 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How you chose to use it on your website may or may not make you evil, though.
**Content:**
A recent hot button topic in WordPress has been Crypto Mining.
## What is Crypto Mining?
Mining is a way to use your computer hardware to ‘mine’ for Bitcoin (or whatever cryptocurrency). Cryptocurrency is a digital currency, generated by performing computationally expensive tasks that use a lot of your computer’s processing power. Basically a computer is paid for solving math numbers. This math solving verifies transitions, and effectively runs the cryptocurrency Wall Street.
Mining is earning money.
## Why is it bad?
The problem is that you can’t actually do any profitable mining on your laptop. It’s not powerful enough. People have to build out crazy computers dedicated to mining, and those use a lot of power, which means you’ll end up paying more for electricity than it’s worth. Somewhere along the line, people decided to use the power of the crowd to make the money for them, and started to bundle mining tools in their software. uTorrent, for example, did that so every time you used their app, you made them a few thousandths of a penny. With millions of users, they make money and you pay more for electricity.
## Isn’t that illegal?
Well. No. You agreed to their Terms of Use and guess what got buried in those EULA’s you clicked “I Accept” on? Surprise! Technically this means its legal. Ethical is, of course, a different matter. Mining without reporting your income on your taxes is illegal (surprise again), but the actual mining itself isn’t. But the reason why people say this is unethical is less that people are using your computer to mine, but that you don’t get *any* of the money from it!
## How did websites get involved?
People figured out how to embed, via javascript, a mining program in websites as an alternative to those ads no one clicks. While most (if not all) web hosts will kick you off their services for using their servers to mine, this instead uses the computers of site visitors to mine. Which brings us back to the part where your laptop (or worse – phone) is being used to mine without your knowledge or real permission. Because in the case of the javascript, most aren’t asking you to opt in. All the visitors make thousandths of a coin for the website, all without knowing (except maybe wondering why the website is a little slow).
## It’s THAT illegal?
Apparently not. Which is why I recommend you install and use an adblocker. I currently use [Ghostery](https://www.ghostery.com), which is an add-on for your browsers. It stops most bad actors from being loaded if they’re tracking you, but it doesn’t block all javascript. Which yeah, it shouldn’t! You need javascript for the modern web to run.
Instead, you could block *bad* javascript, which I do via [jsBlacklist](https://code.google.com/archive/p/jsblacklist/downloads) – a Safari extension. I’m sure it exists for other things, and my friend Jason has a [Javascript Blacklist](https://github.com/boogah/javascript-blacklist) of all the naughty miners and services he knows.
Amusingly, [Showtime’s website was mining](https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script/), and we’re not yet sure how or why. It was removed quickly.
## Is there a good way to use this on my website?
If you absolutely must, I recommend an approach like [AuthedMine](https://coinhive.com/documentation/authedmine). This legit *enforces* opt in. But check with your web host *first* to make sure it doesn’t violate their terms. And above all, make sure people know what they’re agreeing to.
**Categories:** How It Is
**Tags:** advertising, bitcoin, mining
---
### [LGBT+Allies At WordCamp US - 2017](https://halfelf.org/2017/lgbtallies-wordcamp-us-2017/)
**Published:** October 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's time for the Big LGBT+Allies Party again!
**Content:**
Yet again, Tracy and I have gone a little insane and we’re throwing another fabulously big queer party at WordCamp US. This year the venue is Nashville, which made an interesting turn as Tracy’s in Philly and I’m in SoCal. We drafted some local help and, after a series of emails, phone calls, and one text in all caps, we are happy to announce our second ever LGBT+ Party.
Friday, December 1, at Suzy Wong’s House of Yum.
[Grab your tickets now before they’re gone](https://lgbtwp.ticketleap.com/lgbtwp2017/)!
And we’re still looking for sponsors to cover the cost of the food and drinks, so [please contact us](https://lgbtwp.ticketleap.com/lgbtwp2017/contact/) if you’d like to chip in.
> #### Back for the *second* amazing year is the *faaaabulous* **LGBT+Allies Meetup for WordCamp US**!
>
> WordPress as a community has been welcoming and inclusive to people of all backgrounds, sexual orientations and gender identities. To celebrate our wonderful diversity, we’re bringing the party to Nashville, for an evening of honky tonking at a brothel of epicurean delight.
>
> This year, the party will be at [Suzy Wong’s House of Yum](http://www.suzywongsnashville.com/), located in the heart of Nashville’s trendiest alternative night life scene. Suzy Wong’s House of Yum is a creation of Chef Arnold Myint (and his alter-ego Suzy Wong). Prepare yourself for a cornucopia of vegetarian friendly Asian delights, creative cocktails, sleek décor, and of course seriously campy music.
>
> #### We will have the entire venue to ourselves with delicious food and drinks!
>
> But we wouldn’t be able to bring you all this without the help of our amazing sponsors. In 2016, thanks to the help of our sponsors we not only had a private room, but drinks, food, and amazing exclusive t-shirts. The event is fully funded by the community, and all help is welcome.
>
> ### Venue Sponsor: [DreamHost](https://www.dreamhost.com/)
>
> #### Sponsors
>
> - [YIKES, Inc.](https://yikesinc.com/)
>
> If you would like to support the community and sponsor this event, [please contact us](https://lgbtwp.ticketleap.com/lgbtwp2017/contact/).
>
> We hope to see you there!
**Categories:** How It Is
**Tags:** lgbtq, wordcamp
---
### [Dynamic Amazon Associates](https://halfelf.org/2017/dynamic-amazon-associates/)
**Published:** October 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Dynamic advertisement isn't as difficult as all that, provided you have the data you need.
**Content:**
I preface this with a note that there are actually a lot of WordPress plugins that purport to do this.
## Stable, Topical, Content
Sometimes a blog is just a blog, and you write what you write. Other times you have a site that covers an ever expanding, diverse plethora of topics. When you have topical content that can be easily identified and codified, the game changes. You no longer are forced to rely on generic ads, you can pick and chose what works best for your specific content.
There are two general ways to achieve this. The first way is adding a specific ad to each page, manually, and the second is figuring out how to automate it.
## Using an API
Amazon has a Product Advertising API which gives developers access to the entire product catalog, which can let you programmatically determine what links to call and when. Like a lot of Amazon APIs, it’s not exactly written in low-geek levels of usage. This is my constant complaint about Amazon and their services: they were not written to be easily understood.
Thankfully, unlike my experience with [making a custom Alexa skill](https://halfelf.org/2017/custom-alexa-skills-wordpress/), I did not actually have to invent the wheel. This time there *is* a fully functional, if poorly documented, [Amazon Product Adverstising Library based on PHP REST and SOAP using the Product Advertising API.](https://github.com/Exeu/apai-io).
## A ‘Simple’ Application
The API is best installed via composer, which isn’t my favorite method. Nothing against composer, it’s great to pull down a library and it’s dependancies. My issues with it are that people don’t properly flag their archives so even if you use `--prefer-dist` on your build, you *still* get all the tests and documentation and that annoys me.
Anyway. Use composer, get the files, and then you can use it to call Amazon searches and build links:
Obviously you don’t ‘var\_dump’ for real, but it’s a good way to get an idea of what kind of data you’ll be getting back. You can also reformat the output by changing the response transformer. For example, if you want an array, you can add this to your `$conf` setting:
## Customizing Keywords
Of course not everyone wants every search result to be about a warrior princess. Pity, but that’s the world for you. These three aspects are the ones most people will care about:
All of that data was actually saved in the post, so I wrote my code to extract it. That is the actual magic, though. On pages for characters, we had their actors. On pages for shows, we had the show title and genre. Using that, we were able to logically extract the information to generate the appropriate ads.
## Why Not a Plugin?
I did mention there were plugins that do this. The problem was that I needed to mess with that customization so much. I had to hand code in the logic (which was not perfect) to show the ‘right’ links on the right pages. No plugin met all my needs nor permitted enough customization in the right ways.
**Categories:** How To
**Tags:** advertising, development
---
### [The Curious Case of a Comatose Cloud](https://halfelf.org/2017/curious-case-comatose-cloud/)
**Published:** October 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** In learning how remotely hosted images aren't always all that.
**Content:**
The summary here is that [remotely hosting SVGs](https://halfelf.org/2017/remotely-hosting-svgs/) caused a massive slowdown.
## Isn’t the Cloud Magic?
Nope. Well. No. It is totally magic, in that they’re great for large files and are an inexpensive storage alternative. But the cloud is, at the end of the day, just another server out there in the world, holding your data. Unless that cloud server is behind a CDN, you may not see a great deal of speed improvements on your site.
And in my case, it didn’t.
## Diagnosing the Problem
In building out a dev site with Tracy (LilJimmi), we noticed certain pages were really slow to load. 35 seconds slow. That’s unacceptable. I compared it to the live site, and it was faster, but some specific pages were still incredibly slow. What pages? *The L Word* for the most part. And as we inched closer to being done, I said “I’m going to fix this speed stuff before the weekend!” because you can’t go-live on a slow site. You just *can’t*.
Once I was home, I fired up a local site, installed Query Monitor, and had a serious sit down with everything.
## It Wasn’t What I Thought
My initial thought, the one I ruminated on during my bike ride home, was that it was the database queries. Most shows have one or two queer characters, but *The L Word* has 60 right now. While I may joke about wanting nine more, it’s a weird situation where I need to get the number of characters on the show without knowing the number of characters on the show. My assumption was that it was my calculation loop that caused the issue. That I was querying the queers too many times.
Turned out it wasn’t (just) the number of characters, it was the number of tags.
## How It Got So Slow
Most of the issue is my fault. Every single tag has a custom image associated with it. These images are stored remotely, in the cloud, and called as part of the design. The issue was that when calling the images I ran a check “Is the service available?” and if not, it would stop. When you make one or two calls, it’s no big deal. When you make a couple hundred, it adds up.
*The L Word* had 2 icons per 60 characters, and then 15 tags, and then 30 more icons.
## Remote Get Is Slow
I used `wp_remote_get` to process my images, and it was taking between .1 and .4 seconds per image. That adds up. At first I simplified my check-if-exists routine and more than halved the time to load from 35 to 15 seconds. But in order to drop the page back to 1 second-ish load times, I had to put the images local again. No matter what I did, if I loaded them remotely the best I could get was a 13 second page page load.
Sometimes, local is better.
## What’s the moral?
Obviously the moral is test before you rollout. Which we certainly did! By using Query Monitor, I was able to narrow down the speed for the database queries as well as the speed for all the HTTP requests. In doing so, I lost a CDN but gained speed. I’m trying to figure out how to speed up the CDN, maybe by finding a different front-end proxy, but right now I’ll keep using it for the large files like videos rather than the hundred small ones.
I think it it’s worth it.
**Categories:** How It Works
**Tags:** cdn, debug, development
---
### [FacetWP: Spinning While Updating](https://halfelf.org/2017/facetwp-spinning-updating/)
**Published:** October 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to use FacetWP and Font Awesome to make a spinning icon while your data loads.
**Content:**
When you use FacetWP you can do some cool things like change the ‘count’ output of a page. Using the function `facetwp_display()` you can add `facetwp_display( 'counts' )` to your page title, and then a boring old archive title goes from “List of Characters (2022)” to “List of Characters (1-24 of 2022)”
But… What if you could do *more*?
## What Could Be More?
If you have a lot of data, sometimes a page can load and FacetWP spins while it collects everything in it’s wee javascripty brain. When that happens, you have a cognitive moment of “What?” And in order not to lose a user, you want to indicate, somehow, that an action is happening. A spinning icon is, I think, a great way to do that.
So with that in mind, I want to do this:
And I did.
## The Code
This needs javascript. I used some logic from the [FacetWP documentation](https://facetwp.com/documentation/facetwp-refresh/) and some memories about how you can replace text with javascript and came up with this:
Then I slap it into my PHP code like so:
The content for `$count_posts` shows nothing while it’s loading, so the check for `facetwp-loaded` will handle it perfectly.
**Categories:** How To
**Tags:** archives, facetwp, javascript, wordpress
---
### [Alternate Symbols](https://halfelf.org/2017/alternate-symbols/)
**Published:** October 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making symbol icons with a Font Awesome fallback? Why not!
**Content:**
I like to [remotely host my SVGs](https://halfelf.org/2017/remotely-hosting-svgs/) and then call them in my code. For the most part, this works well, and I wrote out some basic code to check if they’re defined and accessible before displaying.
But what if you wanted your fallback to be a font-icon?
And remember, you want your code to be DRY as a bone. So no repeating chunks of code all over the place, please and thank you.
## The Code
There is but ONE requirement here. You have to define `HALFELF_SYMBOLICONS_PATH` as the path to your SVGs. In my case, mine is something like `http://my-cool-icons.objects-us-west-1.dream.io/svgs/` because I’m using DreamObjects for them. Any cloud host works great for this, mind you.
This checks for the existence of the server used *and* if the actual icon exists before it sets things.
## Usage Example
In my code, I define it like this:
This sets the icon and then calls the span which will help make this more accessibility friendly. I could have coded the span into the function, but since I often have it all dynamically generated, it worked more sustainably this way.
In this example, I call it like this:
And voila. Icons in my page title.
**Categories:** How To
**Tags:** cloud, code, images, svg, wordpress
---
### [Git: Combining Your Messy Commits](https://halfelf.org/2017/git-combining-messy-commits/)
**Published:** October 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Merging all your messy development commits into one isn't impossible with Git. In fact, it's easier than a lot of other things.
**Content:**
Sometimes I end up making a lot of commits while I’m working on a branch in order to get the code right. It mostly happens when I’m going back and forth between my new branch and the old (live) one to double check some code that I think got lost. It happens when changing theme structures.
However. This left me with a conundrum. I had about 100 commits and really it was going to be the messiest pull request ever. Which I didn’t want.
## One Branch to Rule Them All
In order to fix this, finished up all my errant commits, as messy as they were, and then I went back and checked out the clean development branch (named `development`). Since everything was up to date, I went and made a new branch.
That gave me three branches:
1. `development` – The actual dev branch
2. `messy-dev` – My super messy branch
3. `clean-dev` – My clean branch
Of course, nothing of mine was actually *in* that clean branch.
## One Branch to Find Them
Once I switched to my new branch ( `git checkout clean-dev` ) I imported my old branch with this: `git merge --squash messy-dev`
Yep, that was it. I then went though all my regular checks, made sure the code was working, did a few more fiddly changes, and then I ran a `git commit` to run the last pull.
This gave me a commit message filled with … well … this:
## One Branch to Bring Them All
Don’t worry. I didn’t keep that. In fact, I’d been writing a log of the entire work, listing out what was changed, fixed, added, deleted, etc. So I deleted that entire commit message and pasted mine in it’s stead.
Well written inline documentation is one thing, but a good commit message saves lives. Since I planned to submit this as a pull request, I knew I had to have a good, simple, commit that listed things that had changed.
But there also had to be more…
## And In The Pull Request Bind Them
I’m rather pedantic about all that and wrote about 500 words to explain what all the code was in that Pull Request. Since I’m working with other people, and I’m *not* the lead developer on this project, I know not to commit my changes to the dev server right away.
Instead, I made a pull request with a repeat of data in my commit, but also a different and more detailed explanation. A pull request has to explain why the work was done and why the pull is needed.
**Categories:** How It Works
**Tags:** development, git
---
### [Query Strings vs Static Resources](https://halfelf.org/2017/query-strings-vs-static-resources/)
**Published:** September 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** What are those variables and why do I care?
**Content:**
If you ever do a page speed check on your site, you may have seen the notice to “Remove query strings from static resources.”
## What Are They And Why Do I Care?
At their most basic, a query string is any URL that has a `?` in it. For example, if you go to a url of `https://example.com/?lang=en` then that last bit is the query string. It’s job is to tell the browser to pass on specific information to the website. It’s essentially a variable that will be read by the website or the browser.
A static resource is a file used by a website that doesn’t change much (if at all). These are usually images but also CSS (style sheets) and javascript files. These resources can be stored on web servers, proxy/CDN servers (like Cloudflare or MaxCDN), or even a web browser, which makes your sites run faster.
However. The explanation is that browsers don’t cache anything with a query string. Which means, yes, if your static resources have one, they won’t get cached.
Or will they? (It’s complicated.)
## Why Do My Resources Have Query Strings?
If query strings break caching, why would anyone have them? Because we don’t always put version numbers in our paths for common files. For example, in WordPress if you call jQuery (a common javascript library), you’re calling a path like `https://example.com/wp-includes/js/jquery/jquery.js` and that has no version number. But WordPress has certainly updated that a number of times.
In order to make sure that jQuery gets properly cached when you upgrade, WordPress adds a query variable like this: `https://example.com/wp-includes/js/jquery/jquery.js?ver=1.12.4`
This is important because otherwise when you upgraded WordPress, you’d see a page formatted weirdly and misbehaving, all because the wrong (cached) jQuery was loaded.
## Should I Remove The Query Vars?
Maybe.
Yes, allowing your resources to be cached will make your site faster, and it will get you a higher score in those page speed checks. At the same time the speed benefit is pretty low compared to the dangers of those files *not* being properly updated. Features on your site will, literally, cease to function.
So you’ll need to decide for yourself which is more important.
**Categories:** How It Is
**Tags:** development, website
---
### [Targeting Ads](https://halfelf.org/2017/targeting-ads/)
**Published:** September 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Figuring out how to handle more targeted ads means understanding what you signed up with.
**Content:**
Selling things on your website isn’t a strange concept. A lot of people have sites where they want to do that if only to break even. And most people do it with generic ads. When, for whatever reason, Google and such aren’t a viable option, it’s time to consider targeting your advertising a little pragmatically. Or rather, more specifically.
## Take Aim At Your Content
One of the reasons Google Adsense is so popular is that it claims to target your readers for you. It does the hard work and you can just walk away. But the reality is that it’s targeting your readers based on *their* search patterns, not necessarily based on *your* content.
Now. Google *does* [target ads based on content](https://support.google.com/adsense/answer/9713?hl=en). However it’s not the way I felt would make the most sense. You see, when I think about content targeted ads, I would think “this post is about bicycles, I should have ads about bicycles.” What actually happens is you get some bicycle ads and then some ads for table wax, because you were shopping for that earlier in the week.
## Advertisers over Content
The problem arises in prioritizing advertisers over readers. It’s one of those peculiar paradoxes. Ads are made by people to make money. They pay you to put them on your website. But that only works if the people who visit your website click on their ads and buy their things. That means it’s more beneficial for advertisers to aim at the visitor directly than via your website’s content.
Most people don’t actually go to their [ad preferences on Google](https://www.google.com/settings/ads) and fiddle with their personal preferences, so the default ads are always going to be based on *everything*. Since some people have weird interests, the ads on your site might be geared towards beds instead of bicycles.
## Taking Control
If your goal is to have fewer generic ads then the only solution is to take charge of what ads are on your site. And that’s work. Not many of us have the time to pick our ads every single day, and even if we did, we’d be set with the ones offered to us. I’ve used Project Wonderful before, and it lets you pick what ads you show. But only from the ones that submit to your site.
The next choice is cherry picking ads from what’s available on a service like [Amazon’s Associate Program](https://affiliate-program.amazon.com). That shows you *all* of Amazon’s available bounties and promotions, which you can put on your site and leave them alone. Some even last ‘forever’ so you don’t have to worry about expirations.
## More Control?
Of course, there’s also the work of adding individualized ads on each page, for the product you’re talking about. But that is another post.
**Categories:** How It Is
**Tags:** advertising
---
### [Make WordPress Gay](https://halfelf.org/2017/make-wordpress-gay/)
**Published:** September 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Give yourself a rainbow admin bar on WordPress.
**Content:**
In September, WordPress.com changed their admin bar from the normal black or blue to a rainbow color. Why?
> Australia will be holding a national survey on marriage equality over the next two months. To show our support as a company for marriage equality, we’re showing the rainbow bar in the WordPress.com admin bar to all logged-in Australian visitors. You can read more about the marriage equality campaign here: http://www.equalitycampaign.org.au/
And this was super cool. They’d done it before when Gay Marriage was legalized in the US and it’s much appreciated as a show of solidarity. But… The menu bar only shows if you’re visiting WordPress.com from Australia. This causes two problems for me:
1\) I’m in the US
2\) I self host
Don’t worry, there’s a solution.
## The ‘Official’ Solution
The code for what WordPress.com does can be found on the [Github repository for Calypso](https://github.com/Automattic/wp-calypso/pull/17669). But that’s all mixed in with a lot of extra ‘stuff’ that has to be there for their services, like geo-location and so on.
The rest of us don’t need that, and since Gary (the fellow who wrote the ticket) is a friend of mine, I asked him if the code was available. [It is](https://gist.github.com/pento/bc4574b8eb0f4500efbeb75ec7d8630c).
## Rainbow Bar Code
Install that to get this:
## Small Changes
In order to make it look ‘right’ for me, I changed two things
I removed this:
And I added this:
## Caveats
Even with my changes, the color for my Jetpack stats looks wrong. It’s too washed out. And that’s because it’s apparently hardcoded into the plugin in a way I can’t overwrite. I can live with that problem.
The other issue is that this will only show for logged in users (unless you’re using some code to always show the admin bar). That begs the question, of course, of *why* would you do this if only logged in users?
If you’re running a queer themed website that happens to use WordPress … like, say, [Autostraddle](https://www.autostraddle.com), then this makes perfect sense. For me, it just makes me feel happy to see that pride rainbow all the time.
**Categories:** How To
**Tags:** coding, lgbtq, plugins, pride, wordpress
---
### [Admins Are Humans Too](https://halfelf.org/2017/admins-are-humans-too/)
**Published:** September 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Humans are the most dangerous creatures.
**Content:**
This conversation happens often enough that I've ceased to be mind boggled by it. A developer will submit code, I review it, and I'll tell them to please sanitize the input. Instead of just using the functions, they'll come back and ask why? Invariably they'll point out that they're using nonces to make sure only authorized actions can happen (no cross site scripting), and they're checking user permissions too, limiting access to only admins. So why am I being pedantic? My default reply:
> Admins are humans. Humans make mistakes. Computers do exactly what they're told to do.
## Admins Are Humans
I'm often a broken record, telling people to sanitize, validate, and escape. When people ask me which sanitize function to use in WordPress, I play Socrates and walk them through the logic process. What kind of data are you saving? What will it look like? Okay, now what of these looks the most appropriate based on their descriptions? Sanitizing data is contextual. By this I mean we sanitize for what the saved data should be. If you're saving an email address, make sure you sanitize for email and so on. This has a side benefit of helping validate your data as well. If you check that the email address entry actually is an email, you're both sanitizing and validating. Now you've prevented someone from putting in a domain instead of an email! ## Humans Make Mistakes
The details of 'best practices' for coding change often, as we learn about how to make code safer and smarter. That said, the ultimate best practices have nothing to do with the language you're writing in, the app you're writing for, or even the platform! - Restrict access to only the people who need it
- Sanitize and validate the data you're given
- Provide helpful error messages
- Test your code with good and bad data
- Document what the code does and what the errors mean
Those practices transcend every single minutia of programing. If you do those five steps, your code will be robust, sane, and safe. Because you will have taken the steps to ensure that humans can make as few mistakes as possible. You don't save 'Dog' when true/false is the only valid answer. ## Computers Do What We Tell Them To Do
The real problem is that AI doesn't exist.  Source: [CommitStrip.com](http://www.commitstrip.com/en/2017/06/07/ai-inside/)Computers can't think for themselves, and humans have a tendency to stop thinking at weird moments (or just go on auto-pilot) which means nothing can destroy work faster than a human. And since a computer does what it's told, the most dangerous computer tool is the one that doesn't account for how big a mistake a human can make. ## Sanitize, Validate, Escape
*Especially* when it's an admin.
**Categories:** How It Is
**Tags:** development, essay
---
### [Plex + Roku = TV](https://halfelf.org/2017/plex-roku-tv/)
**Published:** September 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Watching TV from the computer on the TV can totally be done.
**Content:**
I’m really trying *not* to add new devices to my life. I picked up a Roku last year so that I could watch CBS’ internet TV on my regular TV. I chose that instead of the Amazon or Apple TV because the Roku also let you add ‘apps’ for regular TV channels (SyFy, Freeform, PBS) and if I missed a TV episode due to travel, I could watch it on the big television.
Then I wanted to play some shows that I’d saved as MP4s from my laptop to my TV, without a new device like a Chromecast.
The solution was [Plex](https://www.plex.tv)
Plex is a media server you can run on your computer that lets you add all your media, even things that don’t exist in iTunes, and organize them sanely. You can manage it in your web browser (or command line) and while you do have to have an account with Plex the service, you don’t have to pay or sign up for any of the services.
If you have an Apple TV or an Amazon Fire you can use those too, but I used my Roku, added my media, and boom. Watching videos I own from my laptop on my TV.
A couple caveats:
1. If you download MP4s from *cough* torrent *cough* places, you’ll need to get their subtitles too.
2. TV show files need to named `SHOWNAME - S##E## - EPISODENAME.EXT` to work properly.
It’s not perfect, but it’s better than trying to watch TV on your computer.
**Categories:** How To
**Tags:** software, television
---
### [Housing Large Media Files](https://halfelf.org/2017/housing-large-media-files/)
**Published:** September 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The woes of big files on WordPress. Or anything really.
**Content:**
For the most part, the WordPress media library is fine. It falls down when we start needing to upload large files, though, for a variety of reasons. When we look at files like large PDFs or movies or podcasts, it’s really not a great solution to upload through WordPress itself. It’s slow, it’s clunky, and worst of all, those large file downloads can slow your site.
The ‘right’ fix is to offload large media to servers that are built for this sort of thing. And in this case, I’m talking about Amazon AWS or DreamObjects.
Of course, if you search for solutions like this, you’ll be disappointed. You will mostly find plugins that are geared towards syncing your media library with the cloud services. To be honest, the more I think about doing that, the less I feel like it’s a sustainable idea. Unless the CDN is super fast, it could actually make your site worse off by adding another domain to download from.
## I Don’t Trust Simple CDNs
I’ve always been skeptical of CDNs in general. When there’s a shared library, it makes sense for everyone to call the same library. That keeps the world in sync. But your own media? The reason a CDN is good is that you can distribute your content across multiple locations. Provided you can actually, you know, do that. And keep them all in sync.
Before hosting, I worked at a bank, and one of the headaches we had was pushing software updates across multiple servers and locations. After all, you can’t just upgrade the Chicago servers and not the LA and Atlanta ones. Plus you have to do them all at the same time, or make sure Jane in Idaho isn’t in the middle of depositing money when we reboot her server.
Knowing how crazy all that is, I worry about keeping data in sync across all the servers. What happens when media is updated? Is the CDN built so that my primary location properly triggers updates for everything else, and the data is updated? No matter what, I’m sure I’ll end up with some data out of sync for at least a little while.
In short, CDN synchronization isn’t simple and anyone who tells me it is, is selling something.
## So Why A CDN At All?
Big files.
The goal of a CDN is to speed up delivery of content without slowing down your website. For most images on a website, this isn’t a huge issue. But for those big files, it sure is. And uploading them to the could means three things:
1. No lost disk space
2. No lost bandwidth (if someone’s watching a movie for example)
3. No lost speed (see the aforementioned movie)
The rest of your CDN ‘needs’ can be handled properly by caching. I prefer server side, but as you like it. This means if I upload my large files to the CDN, I can link directly to them in my post content. Everyone wins.
## Except Uploading Sucks
The common solution is to manually upload the file via a client like Cyberduck or Transmit, copy the URL, and then paste it into a blog post. Yuck. What I need is a file manager for the cloud. And that doesn’t seem to exist for WordPress.
So I made something. [DreamHost Objects Dropzone](https://github.com/Ipstenu/dho-dropzone) lets me upload files to DreamObjects, through WordPress, without touching the file server at all. It’s not perfect. It can be slow when trying to get stats on all the items in a bucket, and I don’t quite have an interface to make it easy to insert links and content into posts. Yet.
Something to look forward to though.
**Categories:** How It Is
**Tags:** amazon, cdn, dreamobjects, wordpress
---
### [But Seriously...](https://halfelf.org/2017/but-seriously/)
**Published:** September 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The art of being taken seriously begins with taking things seriously.
**Content:**
In reviewing people’s code for WordPress, I’m constantly struck by the lack of foresight people put in to their success. When a developer makes it clear they intend to run a business or have some modicum of popularity, one would expect them to put a bit of effort into it. Instead, I’ve watched people make the same mistakes over and over. And they complain to me about why their plugin is failing to become “the one” to use.
The answer always seems to surprise them. People don’t take them seriously because they are unprofessional.
## WordPress Basics
First of all, no one magically knows all this when they start. So it’s alright not to know. However. If you’re going to go into business based around anything, you need to learn the rules of the road. Take the time to learn that it’s WordPress with a capital P, that there’s a foundation, a trademark, and, yes, that you cannot use WordPress in your domain name.
If you were going into business with PayPal or CitiBank, that’s all legwork you are expected to do beforehand. This is a business, and when you don’t take WordPress seriously, you won’t be taken seriously by WordPress.
## SEO Basics
Pick a good domain name for your business site. Make sure you’re not violating a trademark or copyright. Pick a good name for your product. For the love of all things whiskey, don’t name your slider plugin “Slider” and stop using “Mega” as a prefix for anything. Remember, the name of your product cannot infringe on *anyone’s* trademark. So while “Shoppable Cookie Cutters” is not trademarked, “Shoppable” is. And yes, you’ll get a C&D for being similar.
Write good copy for your website. Have a clear mission statement, a human about page, and some semblance of being real people. This extends to your documentation. Write it. Write it good. Write a readme that tl;dr pitches your product, explains why someone needs it, and details out what kind of services it uses (if any). Remember that most of your SEO comes from humans. Write for them.
## Community Basics
The OpenSource community in general will help anyone who asks politely. So be polite. Be respectful. Be courteous. Be generous. If people are helping you for free (and most of them are) then thank them and ask how to pay it forward. Offering services, answering generic questions, educating users, or even just publicly thanking volunteers helps.
The community also includes your users. Respect them. Especially when they’ve gone off the deep end and accuse you of wild impropriety. Your plugin hacked their site? Probably not, but treat them with respect and kindness. It goes a long way to inspiring the volunteers to back you up. But also don’t spam your users with a million in-product reminders to review your product, give it five stars, or otherwise distract them from actually using your plugin.
## Universal Basics
Do your research. There is nothing on this earth that is a get-rich-quick, so study what you’re getting into. Don’t jump in blindly. Make sure the community is one you can work with, that they have ethics similar to yours. And if not, make absolutely sure you really are comfortable with going for the money.
Set your expectations realistically, and be willing to have them reset. Take your work seriously, don’t make excuses like “someone else did this first!” Own up to any mistakes or missteps you make. Remember, you absolutely will screw something up along the way. The measure of success can be found in how you handle it.
**Categories:** How It Is
**Tags:** business, development, essay, oped
---
### [Be Nice to Future You](https://halfelf.org/2017/be-nice-to-future-you/)
**Published:** September 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Six simple rules for making your future you love you.
**Content:**
Sometimes the brunt of my education of developers is a constant reminder to be nice to the future them. Future you, or Drunk You if you’re Otto, loves you most when you take the time to prepare things for them. A little bit go foresight and planning will make life so much better for future you, and I’m going to break down six tips to make you love yourself in the future.
## Document, Document, Document
Yes. Document everything. Did you make an API for your system? Document it somewhere everyone can get to. For my LezWatch TV project, I painstakingly documented out all of that, plus how the git repositories worked, how they deploy code, and how to get access. This is for something that two people work on. But by documenting it, we all know what to do! The better my documentation, the less likely I get a panicked message from my cohorts in crime.
## Make Good Commit Messages
I’m terrible at this when it’s for personal use (the number of commits that are ‘I am stupid’ cannot be counted), but at work I’m pathological about a good subject and a descriptive summary. I want someone down the road to know what the patch does, but also why I did it.
> icons: Add new icon set
>
> Add 17 new icons from LIBRARY. This adds support for iconography with job descriptions, as well as better defaults for taxonomies and categories.
It’s not complicated, but it’s helpful when someone wonders “When *did* we add those new icons?”
## Inline Document Weird Stuff
One of my coworkers is great at this. Ben litters his code commits with them, and I’m sure some people find them annoying but I see them as helpful and amusing. Sometimes he puts in “I hate that we do this, but I needed to pass X.” That tells me two things: First, this code could be better. But second, I know what he’s trying to do and generally why. He’s given context to the situation, and future us will hopefully be able to make this better.
## Make Note of To-Do Items
Another great habit is to put in notes, as inline comments sure, but also in the documentation. I’ve been using Trello in addition to inline comments (usually things like “To Do: Add in a check for foobar”) to make sure that my future plan is known. You want to make sure future you knows where you were going, and those to-dos are your sticky notes.
## Follow Existing Project Standards
Okay. I hate this one. But. If your project has a standard, keep using it. The other day I ran into a problem where a new version feature wasn’t behaving the same way as the old one, but only in very specific situations. I walked backwards through the code until I determined a parameter didn’t exist on the new version. I had two options. One was to edit the code to check “If this new version, also…” and the other was to add the parameter to the 500 or so impacted items and then fix my code so it was always fixed going forward.
The project had been using the parameter method for years, so that was my solution. It followed the standards.
## If You Have A Plan, Use It
This sounds weird, doesn’t it? It came up when I was reviewing a plugin and noticed that some code looked very ‘generic’ while still being specific. I thought that it had to be a library the company had made for themselves, and asked if that was the case. I explained, if it *was* an original library they planned to reuse, they should use an if-exists check.
## What Are Your Tips?
What tips do you have to make life better for future you?
**Categories:** How It Is
**Tags:** documentation, website
---
### [Loading Common Libraries Smartly](https://halfelf.org/2017/loading-common-libraries-smartly/)
**Published:** August 30, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Including common libraries doesn't have to be complicated.
**Content:**
When you’re writing code, there’s a desire to not reinvent the wheel. This is a *good* desire. If someone else has made the code you need, using it is a better use of your time. But there’s a right way and a wrong way to include those common libraries, especially in WordPress themes and plugins.
## PHP Is Dumb
Okay, PHP isn’t dumb, but it’s a very top-down/left-right kind of language. The whole reason we tell people to name functions and classes uniquely in WordPress plugins and themes is that if two people name a function the same thing, PHP gets dumb and errors, telling you it can’t define the same function twice.
This means that commonly used PHP libraries should also be uniquely named. To their credit, most do. But still, what happens if two WordPress plugins or themes include the same library? That same error comes back about not defining the same function twice!
What this means is that when using a common library, it’s important that you enqueue it *safely* and *smartly*.
## Check If The Library Exists
The magic is that you need to detect *if* the code is already included and not re-include it. PHP gives you two straightforward ways to do this: [class\_exists](http://php.net/manual/en/function.class-exists.php) and [function\_exists](http://php.net/manual/en/function.function-exists.php).
It’s much easier for me when the code is wrapped nicely in a class. Assuming you have a library file that includes the class but doesn’t call it, you can check like this:
If it *does* include the class (with a `new MyLibraryClass()` in the library) then you can leave that bit out.
When you have a library that perhaps predates classes, you’ll want to pick the primary function and call it like this:
## What About The Weird Stuff?
There are two things I left out. What about namespaces and javascript libraries?
First of all, it’s *impossible* to check for the existence of a namespace. You see, a namespace doesn’t really exist. What does exists are the structures within the namespace. That means if you wanted to check for the class `ClassName` in the namespace of `MyName` you have to do this:
Second, if you’re looking for javascript libraries, and you’re using WordPress, you don’t have to. Just enqueue it.
The WordPress function [wp\_enqueue\_script()](https://developer.wordpress.org/reference/functions/wp_enqueue_script/) registers the script but does *not* overwrite and enqueues it.
Now there is a trick to all this. If you use the enqueue command properly, then this always works. By this I mean if you do it this way, it’ll work:
But… A lot of people do this:
And that means WordPress will load both `chartjs` and `my-plugin-chartjs` which sucks.
Also you don’t need to append `-js` (or `-css`) to your enqueues, as WordPress will do that for you.
**Categories:** How To
**Tags:** development, plugins, wordpress
---
### [You Don't Know Paths](https://halfelf.org/2017/dont-know-paths/)
**Published:** August 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Avoiding calling files directly in WordPress can be done even in the weirdest circumstances.
**Content:**
A common issue with plugins is where people insist they must call `wp-load.php` directly so that they can call WordPress functions and data when WordPress isn’t loaded. When I push back on that code, the common rationale is that there’s an external service that needs to ping a reliable URL to run code.
## You Don’t Know Where WordPress Is
When you hardcode in paths, or assume that everyone has WordPress in the root of their domain, you cause anyone using ‘Giving WordPress it’s own directory’ (a *very* common setup) to break. In addition, WordPress allows users to change the name of the `wp-content` folder, so any plugin that tries to guess where it is would break on any site that choses to do so.
This cuts both ways. First your clever script that tries to go to `example.com/wp-content/plugins/your-plugin/yourfile.php` is going to fail if someone moves that folder. Second your clever file that looks for `wp-load.php` by going up a couple folders will also fail.
You *can’t* know where WordPress is. The only way to know all that would be to do things from within WordPress.
## Never Call Files Directly
The only files you should ever call directly in your code is your code’s files *or* if you’re checking for the existence of another plugin or theme. This is the *only* time it’s smart to be hardcoding in paths of other code directly into your code.
Since most people call these files to have access to WordPress ‘without loading WordPress,’ the actual correct fix is to tie processing functions (the ones that need but don’t have access to core functions) into an action hook, such as “init” or “admin\_init”.
Code you add to WordPress should be inside WordPress, only accessible to people who are logged in and authorized, if it needs that kind of access. Plugin’s pages should be called via the dashboard like all the other settings panels, and in that way, they’ll always have access to WordPress functions.
## What’s The Right Answer?
Okay. There’s one case where it makes sense that you might possibly need to call a URL directly. If you’re hooking WordPress up to a service and you want to have a good URL to call, then yes, you would be well served by having one of the following:
- `example.com/?myplugin=runstuff`
- `example.com/myplugin/`
Don’t those look nice? There are two main ways to get there.
### External Rules
An external rule is basically you adding an redirect rule for a URL to point to a file. You could do this in `.htaccess` or `nginx.conf` but if you do it in WordPress, it looks like this:
Now the obvious issue here is that you’re still calling a php file directly, which means you don’t get any access to WordPress functions. Boo. Thankfully there’s another answer.
### Internal Rules
While more complicated and weird, this is a better solution.
First you need to actually make the rule:
This means that those two example URLs I pitched before are the same thing.
Next you need to tell WordPress not to stomp all over the query variables:
You have to do this because otherwise WordPress won’t know what to do with the query variable.
Finally we tell WordPress what to actually do with your variable:
You’ll notice that `// your functions here` code is waiting for your code. That’s because this time we’re including the PHP file and then in there you’ve theoretically written your code in a nice little function. And that function? Uses WordPress functions because it is one.
**Categories:** How To
**Tags:** development, wordpress
---
### [Is This A Good Idea?](https://halfelf.org/2017/is-this-a-good-idea/)
**Published:** September 1, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some thoughts on ideas that have been done before.
**Content:**
I’ve joked about this a few times, that I should go into business telling people if their web idea is a good one or not. The prices would be simple.
- $25 – A quick yes or no.
- $100 – I’ll tell you if it’s dangerous or possibly illegal.
- $500 – Details of everything.
While I doubt anyone would ever actually pay for that, let me tell you some things I think *are* bad ideas for the web, and why.
## Obvious Bad Ideas
Excluding the whole “Facebook but for pets!” and “Uber but for Pizza!” ideas, and dismissing every single ‘disruptive’ concept out there (seriously, no they’re not), some ideas are really easy to point at and say ‘this is a bad idea.’
If you’re thinking about making something new for WordPress, *before* you start coding, please use google. Because the first kind of bad idea is the idea that’s been done before, ad nasueum. For example, sliders, snowfalls, BMI calculations (actually ANY sort of calculators including loans), ‘simple’ contact forms, and Google Analytics.
These are bad ideas because they are *overdone*.
If it’s been done more than 10 times, and you’re not introducing something totally new (this includes the fellow who made a ‘login logo slider’ – no, it wasn’t new), then file it away as a good experiment. Write the code, but don’t publish it.
## Illegal/Dangerous Ideas
Depending on how often you hear me rant, you may or may not be surprised to find out how often people write code that’s illegal.
Now hold on. Before a single one of you says “But the GPL!” let me remind you. The GPL doesn’t make things magically legal just because it’s open source. You can use GPL code to break laws (like, say, make a child porn website), and while that’s fine for the GPL, it’s still illegal.
On a less creepy but still illegal note, the Yahoo! finance APIs aren’t actually legal for you to use in your code. Yes, I am well aware of the number of people who make packages for it. I’ve actually spoken to Yahoo about this and the way they explained it was this. Their Finance API is for your *personal* use. You’re not meant to use it to retrieve data for apps (and yes, plugins are apps) or any third-party usage (again, plugins). Also they do make it pretty clear with this comment:
> By accessing the Yahoo! site, you agree not to redistribute the information found therein.
A lot of public APIs have these restrictions, including Airbnb and even some Google APIs (finance again). And using them without checking the terms of use and verifying they’re allowed to be used in your situation puts you at risk for breaking the law and that is dangerous because, in the case of a plugin, it’s not *just* you who pays the price.
## Ignorant Code
Really the magic of everything, the answer to all ‘is this a good idea’ questions can be found in this. Did you bother to do the research *first*? And no, I don’t mean did you do market research (though that’s a good idea too).
Did you check if the idea existed already? Did you check if the tools you want to use permit that kind of use? Did you read the terms of use of any service? Did you listen to your gut or not?
Think first. Look before you leap. And above all, please don’t make yet another snowflake tool. No one actually likes them.
**Categories:** How It Is
**Tags:** development, essay, open source
---
### [Dogfooding DreamPress](https://halfelf.org/2017/dogfooding-dreampress/)
**Published:** August 25, 2017
**Author:** Ipstenu (Mika Epstein)
**Content:**
While I work for [DreamHost](https://www.dreamhost.com), and I’ve used [DreamPress](https://www.dreamhost.com/hosting/wordpress/) since day one, I haven’t have the opportunity to put a serious, stress site up on it. The reason for that is simple. The two sites I have that I might do that for are ineligible for pretty much all managed WordPress hosts … because they’re not 100% WordPress.
But. There is one domain that is, and I’ve moved it over. And this gives me an opportunity to determine what needs to be done to *this* site to make it fly on a different host.
## All Hosts Require Site Tuning
This is possibly an unpopular opinion, but no matter which host you pick, there will never be a ‘drop it in and forget it’ option for any web host. The reason is that no two sites are the same. No two sites use the same code, have the same data, and have the same traffic patterns. And *all those things* come together to determine how well your site will run.
No matter who your web host is, you will have to adjust. It may be something as simple as editing an .htaccess file or removing a plugin you no longer need. Maybe it’s as complex as PHP settings or having someone write you custom code.
I don’t mean to say that no two hosts are equal, or that one is better than another. What I mean is that no two situations are identical. Of course a site will work, out of the box, better on one site than another. But when we have the capacity to understand what it is that makes our site work, what it does and how it does it, we can make any site work on nearly any host.
## For DreamPress, I Made Four Changes
After I moved the site over to a test setup, I quickly debugged the ‘big’ issues. I had a white screen of death. Thankfully I knew right away what it was, because I was clearly aware of what went into my site and how it worked.
First, a lot of sanity checks I’d put in to my .htaccess didn’t work. Primarily it was a case of how I’d handled redirects, since I was using an Apache4 format that didn’t work universally.
Second, I wanted to use a phar file, so I had to add custom lines to my PHP settings to let it know how to run properly.
Third, I replaced the old caching system with the new one. DreamPress has Memcached and Varnish, so I removed some of the object caching I didn’t need anymore.
Fourth, I wrote some customized code to teach my site how to talk to Varnish, since I do weird things.
That’s it. Four things. And I was able to debug this in about an hour because I took stock of the moving parts of my website. Not everyone can do this, I understand that, but when you build out a website, even if you can’t code, it’s incumbent on you to document what you did.
When you add a plugin or a theme, you need to make a note somewhere of what it is and why you did it. I recommend someplace *not* on WordPress, since if your site is down, it won’t do you any good at all.
## The Immediate Impact
With those four changes, the result was immediately obvious.
In the chart above, there are two major drops in speed (in this case, a drop is good). At the end of July, I reoptimized how images were processed by using Photon via Jetpack, I applied caching for FacetWP, and I removed all Google Ads. In doing so, I **halved** my time to load. This is a great thing.
But then, just by moving to DreamPress and doing *no* changes to code, I halved it again.
The average site load is now .8 seconds. It ‘spikes’ to 1.2 seconds if you hit a non-cached page. The time to first byte, which is shown on the graph as the yellow/orange line, went from 1.6 second to .1 second.
## Was Everything Perfect?
No. But as it turned out, everything that wasn’t perfect had *nothing* to do with my new hosting setup. I reproduced the site locally and found I had some seriously slow database queries on a couple pages, which resulted in poor load times. Once I fixed that, a few of my archive pages began to fly.
Also as I mentioned in the four things I changed, I did have to write new code. The bonus for the new code is that I was also able to back port some of that into the Varnish plugin itself, which means fewer people will have to write that code. You’re welcome. But that really was more for convenience as the site ran fine, it was just a bit overly aggressive in caching.
## Is DreamPress Right For Everyone?
No host is right for everyone. Period. End of conversation.
Is it right for *you*? Maybe. It certainly can be, and not just for generic ‘blog’ type sites. But you have to know what your site does, who uses it, and what they do to really know the right questions to be asking.
The question isn’t “Is this good for me?” but “What does this do to a site that does what I do?”
**Categories:** How It Is
**Tags:** dreamhost, dreampress, review
---
### [Remotely Hosting SVGs](https://halfelf.org/2017/remotely-hosting-svgs/)
**Published:** August 16, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Moving SVGs to the cloud for multiple sites.
**Content:**
I prefer to use SVGs whenever possible instead of pngs or font icons. They can be resized, they can be colored, and they’re relatively small. But I also have a set of 700 icons I use and I don’t want to have to copy them to every single site. Instead, I’d like to have them all on a central repository and call them remotely.
## To The Cloud
You can use S3 or really anything for this, but I chose [DreamObjects](https://www.dreamhost.com/cloud/storage/) since it’s open source and I work for DreamHost.
For this to work, you create a bucket in DreamObjects with whatever name you want. I tend to name them after the website I’m working on, but in this case I’m making what is essentially a media library so a better bucket name would be the service. Keep in mind, while you *can* make a DNS alias like `media.mydomain.com` for this, you *cannot* use that with https at this time. Sucks. I know.
On DreamObjects, the accessible URL will be `BUCKET.objects-us-east-1.dream.io` — hang on to that. We’ll need it in a bit.
## Upload Your Files
Since I plan to use this as a collective for ‘media’ related to a network of sites, I named the bucket for the network and then made subfolders:
- backups
- site1
- site2
- svg
- svgcolor
Backups is for everything you’re thinking. Site1 and Site2 are special folders for files unique to those domains only. Think large videos or a podcast. Since they’re not updated a lot, and I want them accessible without draining my server resources, the cloud is perfect. I separated my SVG files into two reasonable folders, because I plan to generate a list of these later.
## Calling An Individual File
This is the much easier part. In general, PHP can use `file_get_contents()` for this. But we’re on WordPress and there is a more reliable way about this.
By using `wp_remote_get` it’s possible to check if the file exists before displaying the content of the body. Which is, indeed, how one displays the content.
The reason, by the way, we want to use `wp_remote_get` and not `file_get_contents` is that there’s no way to check if the file exists with the latter. You could still use `file_get_contents` to display the file, but once you’ve done the remote get, you may as well use it.
## Getting a List Of All SVGs
I’d done this before with local images, [getting a list of all the SVGs](https://halfelf.org/2017/taxonomy-icons/). You can’t do a foreach of a remote folder like that. So this is a little messier. You’ll need the [Amazon AWS SDK for PHP](https://docs.aws.amazon.com/aws-sdk-php/v3/guide/index.html) for this. I’ve tested this on the latest of the 2 branch – [2.8.31](https://github.com/aws/aws-sdk-php/releases/tag/2.8.31) – and the 3 branch – [3.32.3](https://github.com/aws/aws-sdk-php/releases/tag/3.32.3) and the code is different but can work.
In both cases, I downloaded the .phar file and included it in a function that I used to save a file with a list of the image names in them. By doing that, I can have other functions call the file and not have to query DreamObjects every time I want to get a list.
I left out the SDK code. Let’s do that now.
### SDK V2
The V2 is actually what’s still officially supported by CEPH, but the PHAR file is larger.
### SDK V3
I would recommend using V3 if possible. Since you’re only using it to get data and not write, it’s fine to use, even if it’s not supported.
### Side Note…
If you’re on DreamHost, you’ll want to add this to your `phprc` file:
That way it knows to run phar files properly. And by the way, that’s part of why phar files aren’t allowed in your WordPress plugins.
## Which is Better?
That’s a difficult question. When it comes to loading them on the front end, it makes little difference. And having them on a CDN or a cloud service is generally better. It also means I don’t have to push the same 400 or so files to multiple servers. On the other hand, calling files from yet another domain gets you a down check on most site speed checks… But the joke’s on them. The image is loaded in PHP.
Of course the massive downside is that if the cloud is down my site can be kinda jacked. But that’s why using a check on the response code is your lifeline.
**Categories:** How To
**Tags:** cloud, design, wordpress
---
### [Flushing Another Post's Varnish](https://halfelf.org/2017/flushing-another-posts-varnish/)
**Published:** August 23, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some fun with Varnish and updating a post not your own.
**Content:**
The other day I talked about [updating another post’s meta](https://halfelf.org/2017/updating-another-posts-meta/). That’s all well and good, but what happens when you’ve cached that other page?
Most cache tools work via the simplistic understanding that if you edit a page, you want to empty the cache for that page. The problem with my clever post-meta updating is that *doesn’t* actually update the post. Oh, sure it updates the data, but that doesn’t perform an update in a way that most plugins understand.
Thankfully this can be done programmatically in a few different ways, depending on what plugin is used.
1. Tell Varnish to empty the page’s cache any time post meta is updated
2. Add a force-empty command to the function that updates the meta
## Using Varnish HTTP Purge
Since I’m running on DreamPress, my plugin of choice is [Varnish HTTP Purge](https://wordpress.org/plugins/varnish-http-purge/). This is a very simple plugin that has no real interface by design. Mike Schroder and I picked it for use because of it’s beautiful simplicity, and when it was abandoned, adopted it. I’m rather well acquainted with it and at the behest of others, I wrote in code where people could add extra URLs to flush as well as extra events to trigger. [There’s even a wiki doc about it](https://github.com/Ipstenu/varnish-http-purge/wiki/How-to-Use-Custom-Filters).
However. That’s not what I did here because I wanted to limit when it runs as much as possible.
## When To Empty Cache
There’s a part of caching that is always difficult to manage. When should a page be emptied and when should a whole section of pages be emptied? The obvious answer is that we should retain a cache as long as possible, emptying select pages only when necessary.
With WordPress posts and pages it’s pretty easy to know “Update the post, empty the cache.” But when you start talking about things like the JSON API, it’s a lot harder. Most plugins handle the JSON API for you, but if you’ve built your own API (like say `/wp-json/lwtv/`) and built out a lot of custom APIs (like say stats or an Alexa skill) you *will* want to flush that whole darn thing every single time.
## The Code
Okay so how do we do that easily?
In the function I showed you the other day, I added this right before the re-hook at the end:
That makes sure the Varnish plugin is running and calls a URL to flush. Done. If you want to have it do more URLs, you can do this:
And then you can add in as many as you want.
**Categories:** How To
**Tags:** custom post types, varnish, wordpress
---
### [Updating Another Post's Meta](https://halfelf.org/2017/updating-another-posts-meta/)
**Published:** August 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A brief note about updating a different post type's meta.
**Content:**
Over on LezWatch TV we have two post types, shows and characters. In an added wrinkle, there’s data that exists on the show pages that is updated by the character pages.
That means when I save a character page, I need it to trigger a series of updates to post meta of whatever shows the character belongs to. But because of the complexities of the data being saved, I need to run it when the show saves too.
## The Code
This runs three actions, saving shows and characters, and also a custom one that the character page will call. It needed to be split like that because some characters have multiple shows.
**Categories:** How To
**Tags:** custom post types, wordpress
---
### [I Hate Migrating Sites, And That's Okay](https://halfelf.org/2017/hate-migrating-sites-thats-okay/)
**Published:** August 18, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Mansplaining migrations to a professional.
**Content:**
Friday I tweeted coming up for air after migrating a 1 gig website. And I had hated doing it.
Apparently that was a signal for men with whom I’m acquainted with but am not friends to drop unsolicited advice on me, most of which I’ve already written about on this blog.
I found this incredibly condescending from most people. When someone says “I hate X…” and your reply is “Have you tried…” then you **aren’t** listening to them. You’re addressing them from a place of superiority and arrogance. “I know better than you. Let me tell you what to do.” Or worse, you’re listening for keywords and then pitching your wares.
Let me put this clearly:
1. I did not ask for help (I didn’t need it)
2. None of the men *asked* if I needed help (they assumed I did)
3. None of them were friends.
That last one is important. If my good friends, the people whom I play CAH with or share drinks, offer unsolicited advice, they know me well enough to do so intelligently. They do it respectfully and sometimes sarcastically. But they are friends. When non-friends, Internet people with whom I’ve exchanged words or reviewed code, do it, it’s not at all the same.
Here’s a selection of how my weekend went:
## “But I love it!”
That one wasn’t advice, and as it happened, he didn’t *like* moving sites, he liked writing the code to do it. Me too! But watching a site move is as fun as watching paint dry. And testing everything to make sure the code works on the new server is similarly dull. And yet you have to do it.
## “That’s not a large site.”
Didn’t say it was. Again, not advice, and this was from someone I know fairly well, so I was more inclined to chat about it. Turns out he has to move a 5 G site multiple times a year. Which … something’s wrong there, first of all. But also his users need to sit down and talk about image sizes, because daaaaayyyyyyymmmmmnnn.
## “You should use wp-cli.”
Funny thing, I did. I love using wp-cli for updating the database, and since I happened to be unraveling a multisite, it was perfect. But you know… I’ve written tutorial on it, added documentation, written extensions, and talked about that tool multiple times. Including on this site. Know your audience, folks.
## “You should use zip \[instead of rsync\].”
When you’re looking at large files, like gigs, sometimes zip is stupid and won’t unpack. PHP has limitations of 2G you see. I did zip up the plugins and themes and then the uploads, but I had to move them from server A to server B. And I did that with rsync. My other option was to download and then re-upload. Maybe if you’d suggested SCP you would have been helpfull. Rsync made sure I didn’t re-copy anything.
## “You should use \[my service\].”
No. Absolutely not. No. JM Dodd is the *only* human I would trust with that kind of a migration. Why? Because it was WordPress Multisite. None of your tools, not even VaultPress, is capable of handling that well. Plus, the added wrinkle was moving one multisite into it’s three separate sites.
Also … I am very very very skeptical of using anyone’s tools. I review their code and their websites and their communication skills. And honestly, I’m not impressed by that company. They just don’t give me the feel-goods I’d want when going into business. To be fair, I’m not sure how I feel about VaultPress either, but they’re my experiment.
To be fair, one of the services apologized after.
## “Why not move things manually?”
I … did? This one takes the cake because when I pointed out that I did know that stuff, and perhaps one should think about to whom they are offering unsolicited advice, I got told that I should use a specific host and service. After I blocked him, he subtweeted about women/lesbians and their egos. Not a great way to win your case, buddy.
## “You should use host X.”
Stop. I didn’t ask for hosting advice, nor was it mentioned. People move sites on the same host sometimes, you know. And once I had the site up on site.dream.press, moving it live was ten seconds of work.
## I Never Asked For Help
This is the big deal. The word ‘help’ never came out of my mouth. I didn’t even break DNS or forget TTL this time. I didn’t need help. All this was, was me saying I hate moving sites when they’re a gig (or more) of data.
Not single man asked me “Do you need help?”
They all assumed I did.
That, friends, is why I called it Mansplaining, and blocked over ten men on twitter.
*Comments on this post are disabled. Don’t reply, just think about it.*
**Categories:** How It Is
**Tags:** essay, oped, wordpress
---
### [Deploying from GitHub with Codeship](https://halfelf.org/2017/deploying-github-codeship/)
**Published:** August 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Deploying from Github to your server, pretty much any server, via Codeship.
**Content:**
For the longest time I self-hosted all my git repositories not so much because I enjoyed doing so but because there were limited options for *easily* pushing code from git to my servers. Invariably you will end up using an intermediary because GitHub and their peers have no real reason nor inclination to make those things easy for you. After all, if they can keep you in their systems, more money to ’em.
And while that’s perfectly understandable and logical, it’s annoying. And if you’re on a budget and not a Git Expert, it’s extremely frustrating. The [deployment API](https://developer.github.com/v3/guides/delivering-deployments/) was written in High Level Geek, and I found it a headache to decipher and test.
Thankfully there are tools for that, and one of them in [Codeship](https://codeship.com). Codeship is free for 100 builds a month, and unlike [DeployHQ](https://www.deployhq.com), it uses rsync, which meshes with my preferred way of moving data.
## The Plan
My plan is simple. I want to push code to a Github Repository and, when it’s a push to master, it would rsync the files over to my server. This will allow multiple people to work on code, among other things.
## The Setup
First make an account with Codeship. You can log in as Github which is useful since you’ll want to connect your Github account with Codeship anyway. When you create a project, you’ll be prompted which SCM you want to use:
I’m using Github, but it’s nice to see GitLab in there as well. Once you pick your SCM, paste in the clone URL.
Examples:
- `git@github.com:/.git`
- `https://github.com//.git`
- `https://github.com/codeship/`
Finally you can pick [Codeship Pro or Basic](https://codeship.com/pricing) – I picked Basic because it required the least amount of know-how. Not that it’s easy, but I don’t have to configure the server or anything annoying. In fact, Basic is so basic, than you can just accept the default setup commands and go. Which is what I did.
## The Settings
Once you’ve done all that, you’re on a new screen that tells you to push code. Of course, you can’t do that until you set up a couple more things. Like tell it *where* to push the code.
Click on “Project Settings” and go to the **General** tab. You’ll need to get that SSH key and add it to your server’s `~/.ssh/authorized_keys` to allow passwordless deployment. I strongly recommend that.
Now you can click **Deploy** and add a Deployment Pipeline. Pick ‘master’ unless you’re using something else.
Now you have to add a deployment to your pipeline. There are a lot of options here, but for my plan of an rsync, the choice is “Custom Script”. Since I’m pushing code to my DreamPress server, the rsync looks like this:
You can customize your rsync commands however you want. I like mine to delete files I’ve removed.
## Deploy the Ships
Everything is set up so go back to your project page and push some code to Github
Magic happens.
The code deploys.
Huzzah.
On the free version you only get 100 private builds and five private projects. Mine are public (so’s the Github repo for that matter) so it doesn’t matter. The only downside is only getting one push at a time, but since they take less than five minutes, it’s perfectly acceptable for a free solution.
**Categories:** How To
**Tags:** Codeship, deployment, github
---
### [Review: Twitter vs Twitter](https://halfelf.org/2017/review-twitter-vs-twitter/)
**Published:** August 11, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some thoughts on the two twitter desktop apps I've used, and why.
**Content:**
Like most people, I use Twitter. I don’t always use the official Twitter tools for that, though. For example, I rarely use the website itself as it’s slow and annoys me. I’ve almost always used Twitter apps on my computers, too.
In July I decided to try using the official Twitter app again. I’d stopped when, at some point, they stopped working on it. Since they’ve picked it back up, I felt I should try it out. As a whole, I like it 90% but … well let me explain.
## Tweetbot
This is my normal, go-to Twitter app. I’ve used it for a couple years, and it meets nearly all my needs for a Twitter app. I can have multiple accounts, which is a must-have for me, and it separates my @-replies from my likes/retweets. I really like that. It also makes those @-replies a different color in my timeline so they stand out.
But… It only tracks likes/retweets for while the app is open. So if I log off, get a million retweets, and log back in, I’ll never know. Also it lacks some of the basic Twitter features like being able to report users and seeing if my other accounts have messages etc I need to pay attention to. I have to click to expand the other accounts to see what’s going on.
Interestingly, *all* third party apps, be it iOS or MacOS, seem to have this issue with the notifications. They just can’t keep track if you’re not logged in. I’m guessing it’s a matter of the API and limiting calls. Most annoyingly, recently Twitterific has just stopped showing me @-mentions from people I don’t follow.
## Twitter
Currently it has a brain and does everything you can do on the web. Multiple accounts, which I can see at a glance who has an alert or message, and it’s easy to switch between them. One click. I can see
Downside? Sometimes when I log back in, the Live Stream is messed up. Also the notifications and mentions and replies are all jumbled up, in the worst ways. I can’t just see replies or likes or mentions. There’s no indication that a message IS a mention in my main-timeline. And the alerts that tell me I have an unread are for notifications and mentions combined.
That I can’t easily find my mentions, which I want to reply to, sucks.
## So Which Wins?
Right now, Twitter’s app is winning for the simple reason of easy user status, easy user switching, and actually being able to see all my likes/retweets. Which is important in some cases. It certainly sucks that I can’t easily identify my replies, and I can’t separate mentions from notifications like I can in the web-app, but the reliability of the API is (currently) worth it.
**Categories:** How It Is
**Tags:** app, apple, macos, twitter
---
### [Demi Related Post Types](https://halfelf.org/2017/demi-related-post-types/)
**Published:** August 9, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Related posts and custom posts, based on tags.
**Content:**
In my last post, I talked about relating posts to a custom post type. That is, how I listed the blog posts tagged with a show on the show page. Let’s do the reverse!
## Continuing the Click Hole
While we’re very good about remembering to tag the posts we write with the shows they’re about, we’re not always as good with remembering to link the first instance of the show name to the show. That is, when we write about *Supergirl* we sometimes forget to link that to the page for her.
That said, we still want to make it ‘easy’ for people to figure out where they can read more about the show. The ‘simplest’ way to do that would be to have a block at the bottom of each blog post. “Want to know more about the shows in this post?” or something along those lines.
## Relations Back Across Post Types
The difficulty here is that if you want to get post data based on a post name, it’s easy. There’s a handy little function `get_page_by_title()` where you can put in this: `get_page_by_title( 'Supergirl', OBJECT, 'post_type_shows' );` where Supergirl is the name of the show and `post_type_shows` is the post type.
That’s well and good, but I knew there would be cases where the tag wasn’t going to match the name. People name shows pretty weird stuff (`#hastag` for example is the name of a show). Instead, I knew that I needed the tag *slug* and for that, I needed a different function: `get_page_by_path()`
## The Code
Here’s the magic sauce:
This has a few failsafes in there, like it only runs on single posts, it has to have at least one tag, and it has to have at least one tag that’s a show. Whew.
After that, it’s just the CSS.
**Categories:** How To
**Tags:** code, custom post types, wordpress
---
### [Semi Related Posts](https://halfelf.org/2017/semi-related-posts/)
**Published:** August 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Content:**
Once in a while you write some code that you’re pretty sure will never be useful to anyone else on the planet, but the idea is cool, so you want to share it.
Hence this post.
## The Power Of Relations
I was making coffee one Sunday morning, thinking about how I could keep turning a site into a wiki-level click hole, where a person could get lost for hours and days reading article after article. The reason WikiPedia works so well is that the content is all interlinked. Now, if you’ve never been a wiki editor, and you’ve just noticed that there are a billion links on every page, taking you around the universe, I’ll let you in on a secret. Those links are all human-made. A person goes in and makes those links, giving you ‘related’ posts.
But WikiPedia really only works well due to the massive amounts of people who know weird shit and are willing to help and share. When it’s just you and your crazy friend running a site, that’s a lot of work. And you have wives and pets and kids to take care of. No, you want– you *need* to automate the heck out of this stuff.
## Related Posts are Hard
Making related posts is a hard thing. There are myriad algorithms out there to calculate ‘relatedness’ and they’re all crazy complex. Worse, they all require a *lot* of processing power. There’s a reason Jetpack’s related posts feature runs on their servers. They’ve got more power than you do, and it stops people on shared from being nasty neighbors.
This code is not a replacement for that code. This code is very specific and very targeted. It relies on people being clever (but not too clever). But when it works, it makes the interwoven data sets of a site work well. Because you see, we’re not talking about ‘If you like this article, read this other one…’ No. No we’re talking about crossing custom post types.
## Relations Across Post Types
Hold on. I know what you’re thinking.
The point of separate post types is *not* to cross the streams. Yes, I know. But that’s actually not true. Menus, for example, are a post type, and you a great many people want to have specific menus to their post types. That sounds logical, doesn’t it? Well, in this case, I have a post type for TV Shows, and I have regular old blog posts.
My lightbulb moment was three-fold:
1. When we write articles about the TV Shows, we logically use tags of the show name.
2. Those show name tags match the slugs of the TV shows.
3. If we link back to the articles from the TV Show page, then we’re getting people down the click hole.
This meant my logic was simple: On the TV show page, check if there are any blog posts tagged with the show name and, if so, that post was ‘related’ to the show and therefore we should link back to it.
## The Code
I put all this into a function so I could re-use it in a couple places. I like not repeating myself with code. I also have the function call another function, because I actually re-use this to connect different post types that all use the same tags. If you don’t need that, you can tighten it up.
### The Display
This is in the theme:
### The Functions
And here’s the function it calls:
And here’s the function *that* calls:
## The Result?
An unordered list of the last five related posts. You could add a link to ‘show more’ if you were so included.
**Categories:** How To
**Tags:** coding, development, wordpress
---
### [The Monetization of Edge Sites](https://halfelf.org/2017/monetization-edge-sites/)
**Published:** August 4, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The headaches of pains of when you're not able to use Google Ads, but you still want to monetize your sites...
**Content:**
When you’re starting out, the idea of making some passive income on your website is pretty appealing. So you look at services like Google Adsense or Project Wonderful, and you think that’s it. Sign up, toss some ads up, and you’ll make $.50 a month (yes, that’s fifty cents). For most people, that works quite well. But what happens when you’re not ‘most’ people?
## What Is an “Edge” Site?
An edge site is a site that has a very niche audience. For example, 10 years ago, WordPress would have been a very niche subject and thus an ‘edge’ site if you were trying to get advertising. But if you said “It’s a technology blog” then you’d have a broader set of possible advertisers.
Paradoxically, niche sites do better in Google search results, which makes them better traffic but harder to target. However, that’s not what an edge site *really* is. An edge site is a site that has content on the edge of what the various ad hosts would be comfortable allowing. And if they’re not comfortable, then they’ll close your account even if it’s just one of your domains that they don’t like.
## What Makes It Questionable Content?
Have you ever read those terms of service? The ones you agree to when you sign up for ad companies? Of course not. But you kind of get the gist of what they’re on about. Basically they don’t want anything offensive on their networks, like promoting racism or bigotry. And there’s *always* a clause in there about “pornographic or sexually explicit material” — to whit, don’t have it.
But what you may not realize is that sexually explicit also covers talking about sex. No, I don’t mean the erotica kind of content, I mean if I use Google Ads, I can’t have a website that gives you advice on sexual dysphoria, or even sexual health issues.
## How Do You Know if You’re Edge?
You don’t.
I found out because Google AdSense decided that a picture of two women in a bubble bath (which was a promo picture for a TV show) was too much. They cited it as being ‘adult’ and there was no further information as to if it was actually the image or if it was the post content. Yes, you read that correctly. They just said “This page is naughty!” and didn’t give me a chance to figure out what or why or how, except to experiment.
Oh and if you experiment and get it wrong, you run the risk of losing the whole AdSense account, not just that one domain. Have a nice day.
Google effectively doesn’t care about you. There’s no way to email someone and say “Hey, is the problem this one image or the subject matter of my site, which you approved 2 years ago?”
## What Are The Options?
Now that I’ve scared you a bit, your choices boil down to:
1. Find a lenient service
2. Host ads yourself
3. Rely on affiliate links
They do really suck.
### Services
The biggest issue with the services is that unless there’s a human-contact available, there’s very little you can do if you ‘break’ guidelines by being on that edge. I mentioned Google as the worst (if you have less than 500k page views a month, you’re outta luck), but Amazon’s not really much better unless you like auto-replies and stock answers. In my experience, the best people behind ads are Project Wonderful, but the quality of ads can be a bit low.
### Self-Host
Even though I run my own, self-hosted, WordPress site, I loathe the idea of a self-hosted ad service. You can do it via WordPress plugins, but if you’re thinking they all look a bit janky, you’re right. They do. They’re all clunky in my eyes. Revive (formerly OpenX Source) is the nicest, but they’re not very fast and you have to maintain them. Which is an extra burden. And then it’s the damn hustle to get ads and manage them.
### Affiliates
Lastly you have affiliates. Now they’re a curious mix of the most lenient, whereby I mean some like ShareASale will let you do anything but ‘adult’ and hate sites, and others like Amazon are super super picky. In both cases, though, they let affiliates approve you as an individual, so there’s that.
## Conclusion?
If you want ‘easy’ money and you’re an edge or niche site that is *possibly* on that inane ‘family friendly’ bubble, you’re going to need to go with Project Wonderful. At least until you get big enough for BuySellAds to pick you up. Otherwise it’s a hustle to get the attention.
Or you could try selling things…
**Categories:** How It Is
**Tags:** monetization
---
### [Stopwords and Sort Queries](https://halfelf.org/2017/stopwords-sort-queries/)
**Published:** August 2, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Rejiggering the sort order to ignore specific stop words.
**Content:**
The code I use is part and parcel from a comment [Pascal Birchler made in 2015](https://css-tricks.com/ignoring-the-in-wordpress-queries/#comment-1594211) and [Birgir E. riffed on in 2016](https://wordpress.stackexchange.com/a/216944). I made one small change.
## The Problem
People like to name TV shows with ‘The’ or ‘A’ or ‘An’ as the first word. “The Fall” and “The Good Wife” for example. However, when we order such things in a human sensible way, “A Touch of Cloth” should be listed behind both of those.
- Frankenstein
- The Fall
- Grey’s Anatomy
- The Good Wife
- A Touch of Cloth
WordPress, though, sees them as absolutes and you get this:
- A Touch of Cloth
- Frankenstein
- Grey’s Anatomy
- The Fall
- The Good Wife
Not quite right, is it?
## The Fix
This code does two things.
The first part is the filter on the `posts_orderby` function. That checks if the post type is the one I want to filter (in my case, only shows), and if so, use regex to filter out my stop words of ‘the ‘, ‘an ‘, and ‘a ‘. The extra space in each word is important. I want to reorder “The Fall” and not “Then They Fall” after all!
The second part is the actual filter on the title, to mess with it *only* for the ordering of posts.
If you’re using MariaDB, this can be even easier, but I have to test on my dev site, which uses MySQL.
**Categories:** How To
**Tags:** search, sql, wordpress
---
### [The Passion of Change, Part 2](https://halfelf.org/2017/passion-change-part-2/)
**Published:** July 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Part Two: How we get it done and what we use to do it.
**Content:**
This is part 2 of [The Passion of Change](https://halfelf.org/2017/passion-change-part-1/). Last time I talked about some theory and decision to make about why to do this with WordPress. Now let’s talk about how it’s done.
## Collecting Data
There’s no way around this. To collect data that’s … well … never been collected in one place before, you have to sit down and do the work. And it’s hard. This is why companies hire interns, but really you need a researcher who is an expert in the field. And you have to guess and what data is going to be important. Do you just want names and shows, or do you want death days, actors, and cliches and tropes? Decide on your datapoints, but collect more than you need. Trust me on that one. Backfilling dates for 1000 posts wasn’t fun.
The trick with WordPress is understanding how to organize your data. With Hugo, there’s the basic concept of “everything is a post” and really that’s what WordPress does too. Everything is a post TYPE. By making a custom post type for your data, you can have it listed and organized how you want. We opted for a type for shows and characters, with post meta to store the complex and unique data and taxonomies for the common and shared.
## Display The Data
Part of displaying your data properly is to do so in a way that is conducive to your SEO. Yeah I said a dirty word. CMB2 lets you add in post meta easily. Yoast SEO lets you add that information to your meta data. AMP makes it better to read on mobile, and FacetWP makes it dynamically sortable. And the Rest API? Well that makes it *easily* consumable. Anywhere.
To make it easy to enter and maintain the data, we use CMB2. You can also use PODS or ACF to do this, and really it’s its own post. But the point here is you need to go back to that data you collected and figure out how it needs to be presented. While you could code it all by hand, I strongly recommend a plugin that will let you add in these fields more easily. You need to make sure you data can repeat what needs to be repeated.
### SEO
And the best part here is that if you have good data and you’ve entered it in a smart way, it will lead to good SEO by doing things like this:
With Yoast SEO in conjunction with CMB2 I was able to auto-populate a unique and yet repeated description for my meta desc in all my posts. The goal here is to optimize smartly. You want your research to be found, so you need to make it easily finable for the right search queries.
### Mobile: AMP
I use Automattic’s AMP plugin combined with Yoast’s AMP Glue plugin for mobile optimizations. By default it only adds posts as AMP data. I built out custom templates for my CPTs to allow those to show up as AMP pages as well. I did this because I wanted the data to be accessible in more ways than just normal WP pages. Democratizing consumability means being flexible about your displays. Get the data out there clearly.
## Don’t Predict Paths
Putting the data out there in easy to find ways is step one. When you have lists of data, you also need to make them sortable. FacetWP is a tool for advanced filtering. It lets you sort and resort your data, so if you wanted a list of blue eyed, left handed, centipede groomers, and you had all that data stored, you could find it. It’s a little tricky sometimes to build out your facets the way you want, but they let you refine searches and drill down so you can find everything in the way the users want. The goal, and FacetWP meets it, is to make finding the data people want easier.
But… There’s another path to consider. The REST API.
This is hands down my favorite part of the whole thing. It’s great we have all this data we collected, and we can show it in myriad ways. We can get stats to show you trendlines and averages and percentages. But… How do we get the data back out there so other people can consume it? What if you wanted to take the data to make stats we didn’t? This is all done via the Rest API.
## JSON: It Gets The Job Done
The Rest API made it EASY for me to export all this data into a format anyone could take and expand on. I made them simple, with just names and dates, and complex with everything I could think of. And by doing so, other people DID start to grab the data and use it to construct their own narratives and find their own answers.
It also let me make a plugin!
The irony of using a Rest API to power a plugin that lists dead female queers is not lost on me, by the way. I built out a JSON powered plugin that calls the data and uses it to output the data in widgets or shortcodes. It’s possibly the most simple and basic way you can do anything with this, but it demonstrates the extendability. It’s fast, it’s low load for my site which is always good, and it’s easy for me to update.
All that work that went into the plugin, with the JSON API, was transformed into an Amazon Alexa skill, where you can ask it “Hey Alexa, ask Bury Your Queers who died on March 3rd” and your Echo or Dot will reply. At it’s heart, it seems silly and trivial. The more I worked on the code, though, the more I realized how you could extend this to share more data. Trivia and minutia are small beans, but they’re the beans we REMEMBER. And what we remember is what changes the world.
## Open Data – Sharing Passion Enhances Everything
Hopefully the story you got from all this is that with WordPress you can share your passion for … well. Anything. And you can use it to fuel change. In the last 18 months, I’ve had the opportunity to talk to people world wide about how just seeing the representation and the statistics have helped them. Including TV producers. And yeah, that was weird. But more over, I’ve helped get data out there and used it to change one thing. And that is the passion that causes change.
**Categories:** How It Is
**Tags:** activism, essay, wordpress
---
### [How Mobile is AMP?](https://halfelf.org/2017/how-mobile-is-amp/)
**Published:** July 31, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Should you use AMP to power your mobile site? No. Here's what you do instead.
**Content:**
There are pros and cons of using AMP, the biggest being [Alex Kras’ discovery that Google is kinda stealing your mobile traffic with AMP](https://www.alexkras.com/google-
may-be-stealing-your-mobile-traffic/). But since [WPBeginner lays out the pros and cons really well](http://www.wpbeginner.com/wp-tutorials/how-to-properly-setup-google-amp-on-your-wordpress-site/), I’m going to skip over that and discuss something else.
## Responsive Themes
The concept of a ‘mobile only’ theme is one I generally deride. After all, if you’re on a website in 2017, it should have been written with the concept of mobile *first*. Most people design a site for their computer/browser of choice, and then add in resizes for mobile. Contrasting this is the idea that you build out your website for mobile browsers first, and then go back in and add in the larger views. That is Mobile First.
It’s an ideal, I agree, and while I love it (and Carrie Dils who made the beautiful [Utility Pro Theme](http://www.shareasale.com/r.cfm?b=778546&u=728549&m=61628&urllink=&afftrack=) as a mobile first them), it can’t always be achieved. Some websites are written to be ‘apps’ and they’re intended to be used as a browser app.
In general, I support the use of a responsive theme, be it mobile first or not. This kind of theme will react based on browser size, or operating system type. But a mobile ‘only’ theme? I dislike them a great deal. They create headaches with caching (ask anyone who’s had their cache catch the mobile page for everyone!) and they can be difficult to jump back from, if someone is perhaps on a tablet that can handle the ‘full’ site. They also double your work.
## AMP
[AMP is a project by Google](https://www.ampproject.org). The concept is a super light, ultra-fast mobile page for your sites. AMP is fast, it’s simple, and it’s a stripped down version of your normal site. How it works is that When Google searches your site and adds it to their big giant database, they can can see “Aha, this site has AMP! I will use it for mobile!” And then, when someone surfs to your site via a Google search, Google would notice “This user is on mobile! I will show it AMP displays!”
The downside you *might* have noticed is that the AMP pages only get called when you’re doing a Google search. That means if you go to a website on your phone, you get the mobile responsive site anyway. Which is what Paul (and I) think you *should* be doing. And right away, you might think “Hey, I should make all my mobile visitors go to AMP!” and you may come up with code like this:
That looks great, doesn’t it? It’s smart enough to check if the URL ends in ‘amp’ and, if so, not redirect. Plus it uses `?amp` which means if the page doesn’t have an AMP URL, it won’t fail an ugly 404 death.
There is, however, a **big** problem with AMP. You end up having *two* sites. [Paul Bakaus talks about the pitfalls of a separate mobile site](https://paulbakaus.com/2016/07/01/about-that-mobile-in-accelerated-mobile-pages/), and how you should keep a responsive theme for your site, and *not* use AMP for Mobile. This is not a good thing in the long run.
## A RESTful Alternative
So let’s think about this differently and not in the simple “Mobile vs Non-Mobile” way. Let’s ask ourselves the *real* questions. “What is this site doing?” and “How will people be using this site?” Because the crux of the matter is really how is the data from the site being consumed!
Recently, with the advent of the REST API, WordPress has as new way for people to eat your data. Much like I’ve talked about before, using the REST API to power an Alexa app or a plugin, the REST API can be used to power mobile apps! Yes, people are running iOS apps with the REST API. This lets you display the content however you want, even audio only, and yet power it fully with WordPress.
In a way, you’re still making two sites, the app and the theme, but… You’re not making a generic theme that fits all users. You’re making a real application that fits the specific use case.
## What’s The Answer?
Let’s break this down.
1\) Your theme should be responsive for mobile. Period.
2\) AMP is great for Google searches.
3\) The REST API can, and should power your apps.
That’s it. Three steps to amplifying your site.
Oh, and please don’t use that code I showed you. It’s sad.
**Categories:** How It Works
**Tags:** amp, mobile, wordpress
---
### [The Passion of Change, Part 1](https://halfelf.org/2017/passion-change-part-1/)
**Published:** July 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Part One: What is the change and why do we use WordPress?
**Content:**
One of WordPress’ big claims is that it democratizing publishing. In recent years, it’s also begun democratizing the distribution and consumption of data via the Rest API, and it’s helped push the openness of data, which can be used by anyone to make the world a little better.
Change is born of many things but it always stems from a refusal to accept the norm. When Shay died on the TV show *Chicago Fire*, many of us were angry. When Lexa died on *The 100*, we became irate. And then we organized. Multiple groups, separate, all used WordPress and social media to power our desire to show the world what was wrong and what needed to change. We took our hobby of television and made it our passion, and we let our passion start to change the television landscape.
## WordPress Enables Change
Having built many sites in many different CMS tools, ranging from Jekyll and Hugo to MediaWiki and Sharepoint, WordPress still makes it easiest to share the data in more ways than just plain old HTML. By allowing us to output our content in JSON with that API, we can create paths for people to transmute our data and display it in new ways we never dreamed of.
In the last two years, I’ve been able to take my simply hobby site from a list of information to a open API for people to get lost in like Wikipedia to an open-data resource for all people to generate dynamic results. Without data we cannot come to accurate conclusions about the world, and without OPEN data, we cannot work together to make the world better.
Taking a hobby as a vector for change didn’t happen overnight. It came with toil and hard work. It came with research of plugins and solutions. It came with hours and hours of watching TV just to come up with a reasonably accurate list of all the queer females on television, and if they were alive or dead. And with this data, we’ve been able to help news reporters and tv show writers visualize the impact on the world. We’ve started to change the world, just a little, with WordPress.
## Bury Your Queers
Just telling people “Hey, WordPress helped me power a site that publicized the information of a hitherto uncollected dataset” would be a pretty short post.
I mentioned change was born of a refusal to accept the ‘norm’ in our lives. As it happens, being a queer female on television is more dangerous than being on the Titanic. In 2014, it was reflecting the darkest aspects of ourselves. In 2015, 33 queer females died on TV. Over 40 in 2017. Trans people are being murdered in record numbers today in the real world. All of this is related to the Dead Lesbian trope, AKA Bury Your Queers.
My theory is that the more we accept death in our media, the more we accept it in reality. The media is pervasive and colors our lenses to accept normal when it’s not. There are a lot of hills to stand on and make this point, but I picked the one that reflects me the most, and the one I felt I could tackle. My hope was that it would just be the start.
## A Brief History
- December 13, 1971 – Julie Solkin / *Executive Suite*
- August 15, 1995 – Talia Winters / *Babylon 5*
- May 7, 2002 – Tara Maclay / *Buffy The Vampire Slayer*
- May 13, 2014 – Leslie Shay / *Chicago Fire*
- March 3, 2016 – Lexa / *The 100*
- June 4, 2017 – Barbara Keen / *Gotham*
It would take me a while to list all the deaths, so I’ve listed six of the more prominent deaths here. Julie was the first recorded death. Lexa set the world on fire. These deaths, out of well over 270 since 1971 by the way, shaped our perceptions. They told us it was okay to kill off the queers for shock value. But the thing is, with Lexa, last year, people lost their minds.
[](https://halfelf.org/wp-content/uploads/sites/2/2017/07/lexa-billboard.jpg)
If you were in the LA area, you may have seen some surprising billboards in 2016. There were four all told, four separate billboards crowdfunded globally via Tumblr, Twitter, Facebook, and a WordPress site. They collected the money and put the billboards up and said that WE would not stop. That wasn’t the end of it. There’s been a convention, ClexaCon, and more activism.
## Why WordPress?
One of the interesting things was we all sat down, in our various corners of the internet, and asked “How bad is this, exactly?” Sites like AutoStraddle made a straight up (heh) list of all the dead and all the happy-endings. Spoiler, very few have happy endings. Other sites, like LGBT Fans Deserve Better and LezWatchTV started to make lists of everyone we could find. And we all actually used WordPress.
There are pros and cons for every platform. There was never a doubt in Tracy’s mind that we were going to use WordPress, but I always think about pros and cons. MediaWiki is amazing when you want anyone contributing becuase it allows anonymous edits. But there was too much possibility for abuse so MediaWiki was out. Static site generators like Hugo or Jekyll are fast and secure (go on, hack my html please. Knock yourself OUT). But they’re not very flexible and can be difficult to manage with multiple contributors or non-technical ones. WordPress, though, is flexible, allows for multiple editors, processes images easily, and is incredibly extendable.
## What Next?
Obviously I haven’t even begun to touch on the code part, of how you build out the data and make it beneficial to people via tools like plugins or Amazon Alexa, and not even how you build the data so you *can* do those things.
**Categories:** How It Is
**Tags:** activism, essay, wordpress
---
### [Date, Time, and PHP](https://halfelf.org/2017/date-time-php/)
**Published:** July 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some thought on handling time and space without a TARDIS.
**Content:**
I had a case where I needed to convert time from the format of the US centric dd/MM/YYYY to something a little more sane.
## A Very Bad (and Stupid) Way
Since I was starting from a set position of `18/07/2017` (for example), the first idea I had was to use `explode` to do this:
I did say this was stupid, right? The reason I’d want to do that, though, is that gets it into a DD-MM-YYYY format, which can be parsed a little more easily. Unless you’re an American. Which means this idea is useless.
## A Less Bad, But Still Bad, Way
What about making it unix timestamp?
Now I have a unix timestamp, which I can output any which way I want! At this point, if I’m not sure what version of PHP people are using, as long as it’s above 5.2, my code will work. Awesome.
But we can do better.
## A Clever Way
Instead of all that, I could use `date_parse_from_format`:
And this will convert “18/07/2017” into “18 July, 2017”
Which is far, far more understandable.
## So Which Is Best?
If it’s your own code on your own server, I’d use `date_create_from_format` to control the output as you want.
If this is code you want to run on any server, like in a WordPress plugin, use the unix timestamp, and then use [`date_i18n`](https://developer.wordpress.org/reference/functions/date_i18n/) to localize:
**Categories:** How To
**Tags:** coding, php, time
---
### [Hello Trello](https://halfelf.org/2017/hello-trello/)
**Published:** July 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes there isn't the answer you expect when you look for a plugin. In this case? It doesn't exist yet.
**Content:**
Organizing my life is usually done on the Apple Reminders app. I shove my to-dos in there and it alerts me when I forget about scheduled, repeated, events. Like mailing in a rent check.
But when you have a group of people, it can be trickier, especially if you all use different devices and have different workflows.
## Enter Trello
There are a lot of options out there, but Trello is free for the small scale. It’s easy to set up and my friend Tracy uses it a lot. When I realized we needed something better than my list to keep track of everything, I popped over to [Trello](https://trello.com) to make it work.
I’ve used it before, and I use Jira — which is owned by Trello’s [Atlassian](https://www.atlassian.com) — so I’m familiar with the basic style of Kanban boards for tracking work. Every project has a ‘board’ and on the board you have ‘lists.’ In each list you have your ‘tasks’ which you drag from list to list to list. The general concept is you have a list of ‘backlog’ where you store *everything*. Tasks move from there to ‘in progress’ and then to ‘done’ (or they get archived).
There are some things about the flow I find annoying. Like there isn’t a way to mark something as ‘done’ unless it’s scheduled, it just gets archived, but it can work. And you can [integrate it with Slack](http://help.trello.com/article/1049-slack-app) so that’s nifty.
## What About WordPress?
I’m going to shoot your hopes and dreams. There isn’t a WordPress plugin for Trello.
Oh fine, there’s [WP Trello](https://wordpress.org/plugins/wp-trello/) but that actually is meant to display your boards as widgets or shortcodes. For the life of me, I can’t figure out *why* anyone would want to do that. No, what I mean is there’s no back-end WordPress plugin where I can go to, say, the dashboard and check out what boards and tasks are being worked on.
I suppose that’s much the point, though. You shouldn’t be managing those things *in* WordPress. In fact, if you look into it, embedding Trello anywhere is kind of a mess. They clearly don’t want you to miss out on their API and their apps. Their experience matters.
On the other hand they’re very hip on integration, letting people stick in one tool and access everything. I suspect the brunt of the lack of a WordPress tool is due to the fact that there’s no one recommended PHP API. If you go to their [community page](https://developers.trello.com/community), you’ll see a lot of python and Ruby, but no PHP.
## What Can You Do With WordPress?
Thankfully, you can integrate WordPress and Trello. There are extensions for [Ninja Forms](https://ninjaforms.com/extensions/trello/) and [Gravity Forms](http://www.gravityforms.com/add-ons/trello/) which let you integrate your form submissions and make them into Trello Tasks. If you use those plugins to allow visitors to post submissions, it’s a near perfect idea. They submit a post, you make a to-do, and your life remains organized instead of wondering who handled which submission.
But if you’re looking for more, you need to consider a 3rd party integration via [Zapier or IFTTT](http://embolden.co/how-to-use-trello-as-a-content-calendar-for-your-wordpress-website/). There isn’t even a Jetpack contact form to Trello plugin.
Yet.
**Categories:** How It Is
**Tags:** essay, plugins, wordpress
---
### [Yes, You Can Use Enqueues](https://halfelf.org/2017/yes-can-use-enqueues/)
**Published:** July 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to enqueue inline parameters with your WordPress enqueued javascript. Because yes, you can.
**Content:**
One of the battles I face with plugins is explaining to people that they really do need to use `wp_enqueue_scripts()` for their code. And often I get an argument back that they can’t because they need to include parameters.
Hold on to your hats. You totally can.
## The Misconception
It’s easy to get confused with code. There are so many different ways to solve the same problem, we get twisted around. Let’s say that you wanted to include the following script in your website:
That’s pretty straightforward in WordPress:
But. What if you wanted to add *this* as well:
Now you clearly have to hand-code this into WordPress. Right?
Wrong!
## Use Inline Scripts!
You may have heard about `wp_add_inline_script` before. If not, don’t feel bad. What this does is [add extra, inline, code to an already enqueued script](https://developer.wordpress.org/reference/functions/wp_add_inline_script/).
Which means that to add the extra code, you do this:
Which will echo out exactly what you need.
The cool thing about this, is what if you want your plugin to have a lot of options? Like you want to use the value for an option to determine what your script should do?
And now you’ve got flexibility.
## Keep In Mind…
First, the name of the script matters. If you enqueue it as ‘my-widget’ then you call it as ‘my-widget’ as the first parameter in your inline script.
Second, you can change ‘before’ to ‘after’ if you need it to be after the script.
Third, as with all things, make sure you only load your javascript when you must. No one likes a slow site because you’re loading your javascript on every page when it only needs to be on a specific custom post type.
**Categories:** How To
**Tags:** enqueues, javascript, wordpress
---
### [Fight The Future](https://halfelf.org/2017/fight-the-future/)
**Published:** July 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Life in the slow lane isn't okay.
**Content:**
## Life in the Slow Lane
Imagine a world where you couldn’t read these posts because your ISP didn’t like one I made about how to download video from your DVR?
Imagine an internet where a site like [LezWatch TV](https://lezwatchtv.com) was blocked because someone was homophobic?
That’s what could happen.
Americans, please [contact your representatives now](https://www.battleforthenet.com). Non Americans? Social media please and thank you.
## Still not sure about this?
**Categories:** How It Is
**Tags:** oped, protest
---
### [Git Attributes: Control Your Vendor Folders](https://halfelf.org/2017/git-attributes/)
**Published:** July 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A simple way to hide your vendor folders from everyone on Git and Github.
**Content:**
When you’re developing code, a lot of the time you have `vendor` or `bower_component` folders that you don’t need. That is, you don’t need them for the code, but you do for the development.
A year ago I explained how I [handle my vendor folders](https://halfelf.org/2016/resource-folders/). Essentially, I use SVN to ignore things so they don’t get uploaded to WordPress. And that’s great *but*…
What about Git?
## Enter Git Attributes
The `.gitattributes` file lets you [define attributes for paths](https://git-scm.com/docs/gitattributes). What that means is you can assign an attribute to a file which will then impact how various Git operations occur.
Operations are things like checking your code out or pushing a release (something familiar to Githubbers). Basically an operation is when Git does a ‘thing.’ Whatever that thing will be. And the Attributes file allows you to specify what happens to specific files (or folders) when that thing happens.
## How Do You Use It?
There’s a lot more to it than this, but if your goal is to exclude vendor folders and `.git` files from your zips to send them off to people, then you’ll want to have your `.gitattributes` file look like this:
This results in when you use GitHub and tell someone to download the zip from it, it will *exclude* those files.
## What Else Can I Do With It?
Have a problem with line endings because one person on your dev team uses Windows? [gitattributes can help](https://help.github.com/articles/dealing-with-line-endings/#example).
Need to make a change like that for everyone on a system? Or maybe you want to make sure you never include those vendor and documentation folders? The [Pro Git Book says this](http://git-scm.com/docs/gitattributes):
> Attributes for all users on a system should be placed in the `$(prefix)/etc/gitattributes` file.
Before you ask, unless you changed it, `$(prefix)` is nothing for pretty much everyone. You may have a `/usr/local/git/etc/` location though.
**Categories:** How To
**Tags:** development, git
---
### [The Unbearable Uniqueness of Functions](https://halfelf.org/2017/unbearable-uniqueness-functions/)
**Published:** July 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Thinking about the reasons we need unique and distinct names in our code.
**Content:**
PHP 7.2 is on the horizon and one of the battles that we’re still facing is how to name our functions and classes. In WordPress, this is especially hard because we have to consider how our plugins and themes will be used in the global landscape.
## Everything Must Be Unique
If you’ve written a self-contained PHP app, you know that you can’t give two functions the same name. So you have `function enqueue_scripts` and `function enqueue_styles` and `function embed_content` but you can’t declare them twice. Names must be unique within an app.
When you consider the fact that all plugins and themes are third-party add-ons to WordPress, the naming situation gets messier. You can’t, for example, use `function get_the_excerpt()` because WordPress is using it. So you have to introduce prefixes to your plugin (let’s call it “Caffeinated”) like this: `function caff_get_the_excerpt()`
That works well until someone creates an add-on to your plugin, call it “Decaffeinated”, and they need to use `function decaff_get_the_excerpt()` which isn’t *so* bad, but “Tea Caffeinated” has to either use a prefix of `tea_caff_` or `caff_tea_` and the more you travel down the road, the messier it gets.
## Prevent Collisions
The whole point of this exercise in naming is, you see, to prevent collisions between your code and the parent projects you’re working with. You can’t use `__` as a function prefix, for example, because that’s magical in PHP land. You can’t use `wp_` or `wordpress_` in WordPress, because … well. You’re not WordPress.
But preventing collisions gets long and messy and convoluted and you end up with prefixes like `edd_stbe_` which *is* unique but can be difficult to remember what it’s for. That’s why, thankfully, we have the option of a little more selective naming.
## Selective Uniqueness
Back in PHP 5, the object model was rewritten to allow for better performance and more features. And this allows us to make Classes which contain our functions, named whatever we want:
This is extended to the add-on plugins, So we could have `class Decaffeinated` and `class Caffeinated_Tea` but within the classes, our functions are more simply named. Also we can call functions from one class into another, like Tea could call `Caffeinated::get_the_excerpt()` and easily filter that function.
Why is this good? Well it lets you keep the function names simple, but the class name distinctive and thus easier to remember.
## Simple Names are Better
One of the cardinal rules about domain names is that shorter is better. The same goes for functions and classes, to a degree. As Otto likes to say, a well named function doesn’t really need documentation. And one of the ways you can get a well named function is by putting it in a well named class. You can also use Namespaces.
Namespaces are magical. By adding `namespace Caffeinated;` to your plugin file, for example, you can then have a classname of `class Settings` and not have to worry about collisions, because your class name is prefixed automatically by the namespace. This extends to functions, as you can us `function admin` for admin settings in the Settings class, in the Caffeinated namespace. And to call that? Use `Caffeinated\Settings::admin();`
There’s a lot more you can do with Namespaces, of course, but using them to stop your code from crashing into other people’s, while still keeping names obvious, unique, and memorable? Well they’re pretty nifty.
## Remember: What’s Your Global?
At the end of the day, the big thing to remember is what your globals are.
- Outside of a class or namespace, a function is a global.
- Outside of a namespace, a class is a global.
- Outside of a namespace, a namespace is global.
Yes, you can have sub-namespaces. But the point is that top-level whatever you pick, be it a function, class, or namespace, *must* be named uniquely and distinctly and, in my opinion, relative to the code it’s in. Naming things generically ends in tears as they’ll probably conflict.
**Categories:** How It Is
**Tags:** development, php, wordpress
---
### [Fight For The Future: Battle for the Net](https://halfelf.org/2017/fight-future-battle-net/)
**Published:** July 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The Battle for Freedom continues. Here's how you can fight back.
**Content:**
On July 12, 2017, we fight for the internet. Again.
I know. Didn’t we *just* do this? Well we did, and we have to do it again.
## What Is Net Neutrality?
Net neutrality is the principle that Internet providers don’t get to control what we see and do online. Think of it like if your phone company got to decide what numbers you could call and when. Back in 2015, we managed to get fairly strong net neutrality laws from the FCC (the US Federal Communication Commission) which stopped Internet providers from blocking, throttling, and paid prioritization—”fast lanes” for sites that pay, and slow lanes for everyone else.
## Isn’t that like TV?
Yes it is! On your TV, you can only watch the stations you pay for. Now imagine the Internet that way. The problem though is that we don’t just use the Internet to watch movies. We use it to work, to develop code like WordPress, and to communicate world wide with like minded people to do all of that.
## What’s the battle for?
Comcast and Verizon want to end net neutrality so they can control what we see and do online. It’s that simple. They want it to look like TV so they can say that we can’t work with our fellow developers in Serbia or Iran. They want to monitor all our communication with those people as well (which in the case of WordPress isn’t really a hinderance but still…).
## What can we do?
[Fight back](https://www.battleforthenet.com)!
Change your websites so people see the damage being done. Inconvenience the hell out of them. Make everyone notice and get them aware. Even if they watch Fox News.
The [Fight for the Future](https://www.fightforthefuture.org) has started the [Battle for Net Neutrality](https://www.battleforthenet.com) just like they did in 2014 with [The Great Internet Slowdown](https://www.battleforthenet.com/sept10th) and like they do today with [Blackout Congress](https://www.blackoutcongress.org).
## How do we fight back?
Add the [Battle For The Net Widget](https://github.com/fightforthefuture/battleforthenet-widget) to your website.
If you’re running WordPress, I made a [Fight for the Future Alerts Plugin](https://wordpress.org/plugins/fftf-alerts/), which lets you decide which alerts you want to show. It currently only supports the upcoming Battle for the Net and the Blackout Congress, but I plan to add other on-going events as they occur.
You can also use [the Cat Signal](https://wordpress.org/plugins/cat-signal/) which dynamically loads the right alert for you at the right time. The reason this is different is that not everyone wants to run an extra javascript all the time on their websites. Page speed is important after all. Plus they may not *want* to show every single alert.
**Categories:** How To
**Tags:** coding, freedom, wordpress
---
### [FacetWP, JSON API, and WP_Query Searches](https://halfelf.org/2017/facetwp-json-api-wp_query-searches/)
**Published:** July 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Telling FacetWP not echo it's code comments in certain places. Like JSON API output.
**Content:**
One of the ways that [FacetWP](https://facetwp.com) works is that it adds `\` to the source of your outputted page when it detects you used a search query and it can’t find it’s usual classes. This is so that it’s various features like refreshes and so on. It’s a good thing.
At least it is until you’re trying to use a WP\_Query based search to find titles “like” something, and you find your JSON output prefixed…
## Mostly Harmless
Most of the time when you see `\` in the source code, you don’t care. It doesn’t impact anything and it helps Facet work. This is especially important when you have a ‘weird’ theme or plugins that mess with output.
The issue is that this is how Facet decides if you need that output:
Most of the time, that makes perfect sense. It just happens that I’m calling search in a place where that output is a bad idea. Like this:
{“id”:6294,”name”:”Alex”,”shows”:”Witches of East End”,”url”:”https:\\/\\/tv.lezpress.dev\\/character\\/alex\\/”,”died”:”alive”}
Whoops.
## Annoying, But Not Impossible, To Fix
After bashing my head in for a while, I grep’d the code for Facet, found where it was being set, and then read the [help document on `facetwp_is_main_query`](https://facetwp.com/documentation/facetwp_is_main_query/) which told me that I could filter the function.
In this case, I needed to set the value to false to get it to stop outputting, so I used this:
Be careful *where* you put that by the way. If you put it on all pages, you’ll break your Facets. I put it in the function that generates the JSON output which limits it heavily, just as I want it to.
**Categories:** How To
**Tags:** facetwp, json, wordpress
---
### [This Post Was Written on Gutenberg](https://halfelf.org/2017/post-written-gutenberg/)
**Published:** June 30, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Overall, I like Gutenberg, but it's rough and has some bugs.
**Content:**
I think … I like it and I don't like it. Yeah that was the worst review ever, so let me explain.
## Overall, I like the direction
I'm a big text-editor person. I like the control, I'm comfortable in HTML, and I really only used the visual editor in the last 3 years because I felt to *fully* support people with WordPress, I needed to do so. Naturally this means I'm probably the least likely candidate to like Gutenberg. But I do. ## I don't like the animations
The transition animations feel 'off' to me. When I start typing, the icons for styles (bold and italic and so on) vanish, which is nice, but they reappear when I move my mouse. This is a problem if I want to go back and edit a previous block. Things are cut off. ## I like that everything is a block
The simple idea "Everything is a block" is really nice. I can understand this easily, and it was no hard jump to think of my content as blocks. Moving blocks around is also nice. The idea of blocks and modular content suits me. ## I don't like that 'tab' doesn't work
When I'm writing in sections, blocks, I can't use TAB to navigate back and forth. Yes, I want too. Since I can't use my arrow keys either, it's really annoying. Navigating by keyboard is a huge part of what I do daily, and I like to keep that. ## I like that I can use Markdown\* The `\*` is because I can *kind of* use markdown. And by kind of what I mean is in the above line, I used `##` to make the H2 block. On view, it works. In the editor though it looks like this: I'm not super fond of that. I expected it to magically transform. ## I don't like the meta-box experience Okay. This is the advanced user stuff. But I use meta boxes. I spend a lot of time [making my meta boxes fix the screen space](https://halfelf.org/2017/cmb2-size-matters/). I [added content to the publish box](https://halfelf.org/2017/add-item-publish-box/). And I'm not the only one out there who customizes the heck of the sidebar and the below the post area and … Yeah. I'm seriously concerned about that. Right now, all I see on the sidebar is a 'drop cap' toggle, which I probably won't use. I'm watching the [Advanced Drawer](https://github.com/WordPress/gutenberg/issues/952) discussion very closely with that in mind, since I have a post type with, literally, a dozen meta boxes. And no, not all will fit on the sidebar. ## As a whole… Gutenberg is really neat. It has some serious quirks, but that's why it's in beta testing at the moment. So please. Test it. As Chris Lema said, the people working on this plugin need our feedback. If you're a hardcore WordPress user, be that a developer or an advanced user, please [download the latest plugin](https://wordpress.org/plugins/gutenberg/) and [leave your comments over here.](https://github.com/WordPress/gutenberg/issues) To that end, comments here are closed.
**Categories:** How It Is
**Tags:** behavior, editor, testing, wordpress
---
### [Still Don't Disable Right Click](https://halfelf.org/2017/still-dont-disable-right-click/)
**Published:** July 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Protecting your site by disabling right click is the wrong answer.
**Content:**
Back in 2011, I wrote about [not disabling right-click](https://halfelf.org/2011/dont-disable-right-click/). That page still gets a reasonable amount of traffic and it's time for a brief revisit.
## The Only Way to Protect Data Is Not To Have It Online
Let's start with the lesson everyone needs to learn. There remains but one and only one way to protect your data online. There is only one sure-fire way to make sure your photos aren't stolen, your videos aren't leaked, and your content isn't ripped off. Don't put anything online that you're not alright with having taken from you. This sucks. I know. This is pretty horrid life advice, but the fact is that as soon as you put something up on the Internet, and people like it, they will take it. Worst, they'll claim it as their own. I really hate that one. ## You Can Still Protect Content
This isn't all bad news. You can still have content that is protected from re-use, it not actual theft, but you have to be intelligent about it. You have to think about what you're protecting and why. Protecting all the images that viewers see on your site is a lost cause. There are just too many ways to download them. Instead, it's a matter of cutting your losses, protecting only what *must* be protected, and then intelligently guarding what's left. And here are my simple rules for content protection: 1. Watermark images you don't want reused
2. Server protect folders that store downloadable data (i.e. .htaccess )
3. Hide the URLs for downloadable data
That's it. Three rules. ## But What About…
No. What? You want me to talk about how Instagram protects images from right-clicks and, thus, downloads? You want me to point out that even [Wix tells you how to protect right-click](https://support.wix.com/en/article/adding-and-setting-up-the-right-click-protect-app)? You think I should tell people how Getty images uses code to watermark *and* right-click protect? It doesn't matter. As Wix so rightly points out, anyone who knows how to view source code could get the images anyway. And trust me, people who want your images will work hard and learn that. They'll quickly figure out how to get around it. You can get around Getty images, but they do the most important thing of all. They *know* you're going to take their low-resolution images. They're okay with that loss kind of – I don't recommend it as they'd sued people over re-use. But they will *absolutely* take you down if you 'steal' their high resolution images, because the only way to do that is to make an account with them and purchase. They out and out hide the images from anyone who didn't buy them. They're locked behind a user-account. The lesson you can take away is this: The only winning move? Is not to play.
**Categories:** How It Is
**Tags:** development, images, website
---
### [Review: Do The Twist](https://halfelf.org/2017/review-do-the-twist/)
**Published:** July 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The Twist+ charger from OneAdaptr really was perfect in Europe and beyond!
**Content:**
When I got ready to go to WordCamp Europe this year, I realized I needed a new adapter. I had one, and it worked, but it also was highly imperfect as it required me to charge everything through my laptop. You know that drill, right?
Like a lot of road warriors, I travel with about four USB plugs and it’s a mess. It’s always looking for good plugs in a hotel room, and hoping I can charge everything. I used to have a cheap USB hub, but it shorted out. Cheap. I knew what I needed, and it was a charging ‘station.’ But I wanted one that would work ‘universally.’
## The Drama Of Plugs
I don’t actually remember how I found this. It may have actually been an ad that popped up when I was searching for chargers. I’d been thinking about getting a multi-outlet travel power strip with a couple USB ports. My constant worry with those is the 3-prong US outlet isn’t actually universal here. I’ve been in a lot of nice hotels that don’t have them. Worse, converting from 3-prong to European outlets has, in summer at least, caused a power short.
Seriously, I blew out the power on my floor in Spain once. Sorry.
## OneAdaptr to Bind Them
And then I ran into OneAdaptr. At first I was skeptical of the idea. While I had a universal adapter, the sort you can plugin anything into and get anything back out of, this was slightly different.
If you’ve got a Mac laptop, you’re familiar with the odd way you can change your power adapter to use the 2-prong or grab an extension and use a 3-prong. Backpacking off that concept, the Twist+ adapter lets you plugin your laptop right into the base, while leaving you **four** USB outlets.
This is the [TWIST+ World Charging Station](https://oneadaptr.com/collections/oneadpatr/products/twist-plus-world-charging-station). And I’m a super fan.
## How I Use It
First, yes, I use it entirely as intended, plugging my laptop and all my devices in. But I actually use it *more* as a USB hub. Shoving it into my purse, I was able to whip it out at a dinner with friends and plug *all* our devices in to charge. One of them had a 3-in-1 USB charging cable, and we ended up with 6 devices all plugged in and charging.
This works well with my ‘style’ as I tend to plugin laptops to charge while I shower and clean up at the end of the day. By the time I’m done, the laptop is charged and goes away, and the hub gets plugged in at my nightstand to charge a Watch, a phone, and an iPad. It could even do another phone without breaking a sweat. And in the absolute worst case? I could plug in my laptop and get two more ports.
If you just want a USB hub, they (will soon) have a [World Charging Station](https://oneadaptr.com/collections/oneadpatr/products/twist-world-charging-station) which looks about perfect for a lot of things.
**Categories:** How It Works
**Tags:** hardware, macintosh, review, travel
---
### [Plural URLs](https://halfelf.org/2017/plural-urls/)
**Published:** June 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some fun with plurals and WordPress URLs.
**Content:**
URLs can be hard. When you have custom post types in WordPress it can be harder.
Take, for example, a custom post type for videos. Do you want your URLs to be `http://example.com/videos/video-name/` or `http://example.com/video/video-name/` ? And do you want the archive to be `http://example.com/videos/` or `http://example.com/video/` ? And what happens when you change your mind?
Thankfully, WordPress lets you do some weird things.
## Pick Your Default
Let’s look at the video/videos idea for a moment. Individual posts should be `video` but the archive should be `videos` in order to grammatically make sense. When you make your custom post type there’s a parameter called `has_archive` – by default it’s false. If you make it true, then it’ll have the same ‘base’ as your custom post types.
But. If you make it a *string* then you can make it ‘videos’ or ‘photos’ and magically your archives will have those names. That makes it pretty easy to change, just remember to re-save your permalinks after. I personally recommend doing a redirect so that `video` goes to `videos` (and `videos/postname` go to `video/postname`) so that any random bad URLs would still be caught.
Remember that you can leave it false and make a page to be a placeholder page, or you use `archive-{post_type}.php` to customize it further.
## When You Need Both
But… What if you need both?
This is probably a bad idea, but let’s pretend you want to have both video and videos work for all cases. That’s when you’ll need something like this:
In that example, I have the slug for my custom post types set to the singular, and then the `$plural_types` array has the correct plural and the associated custom post type. This is tossed into a for-loop that creates a custom rewrite rule that will redirect.
**Categories:** How To
**Tags:** custom post types, urls, wordpress
---
### [Expect the Unexpected](https://halfelf.org/2017/expect-the-unexpected/)
**Published:** June 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Never, ever, trust anyone to be right all the time. Especially you.
**Content:**
The other day, while reviewing a plugin, I told someone that their code was okay, but it could be better.
They had this:
And I said they should do this:
They asked why, since the only possible input were 1 and -1.
## Users Are Weird
It’s hard to explain why users are so weird, but they are. Any time you have post data that a user can input, a user will find a way to intentionally or accidentally put in bad data. I think perhaps the best way to explain it is that users are like toddlers. You can baby proof your house, but they’ll figure out how to get into the flour and suddenly your kitchen looks like an episode of *Cutthroat Kitchen* and good luck cleaning it up.
The point is this. Even if your data is only *meant* to be a 1 or a -1, you have to think beyond what the code should be and assume it will, one day, be what it’s it.
## Broaden Your Mind
The basic rule of any input screen is that users will do what they do. They just will. They use code in ways you didn’t imagine, and that’s okay. And *even if* you have a check box, which logically cannot be altered beyond checked or un-checked, someone will do something outside your expectations.
The easiest way to understand it is to think about hackers. The whole reason we sanitize checkbox data is not that we expect a user to make a phenomenal mistake, but we expect a hacker to show up and try to back-door our work. We cannot trust that every user has good intentions. This is even more common in WordPress, since anyone can download your code, examine in for weaknesses, and then attack.
## Angry People Do Bad Things
If I had a nickel for every time I heard “But an admin would never…” I’d be rich.
A *good* admin would never, intentionally, break their own system, this is true. But an admin who was just fired, and hasn’t had their credentials revoked yet? Oh gosh, can they *ever* be evil. When a person was fired at a job I once had, they went into the test lab, took *all* the diskettes, and tossed them in the dumpster. The protocol for handling people being fired was changed that day, but all it took was one angry admin, and we had to go dumpster diving for 3.5″ floppy disks.
No, it wasn’t fun.
## Trust No Data
I never trust data. Not even on code only I use. I always assume I can be tricked into doing something dangerous, or that I’ll make a mistake while using a system. Humans make mistakes. You can’t trust them to be right all the time, and you can’t trust them to be *good* all the time.
That means it becomes our responsibility, as developers, to do the following:
1. Make sure the data entered is sanity-checked
2. If it’s not sane, fallback to a safe default or throw a good error
But never, ever, trust anyone to be right all the time. Especially you.
**Categories:** How It Is
**Tags:** development, security, wordpress
---
### [Linear Regressions in PHP](https://halfelf.org/2017/linear-regressions-php/)
**Published:** March 22, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using PHP to calculate trendiness
**Content:**
Sometimes math exists to give me a headache.
In calculating the deaths of queer females per year, my wife wondered what the trend was, other than “Holy sweat socks, it’s going up!” That’s called a ‘trendline’ which is really just a linear regression. I knew I needed a [simple linear regression](https://en.wikipedia.org/wiki/Simple_linear_regression) model and I knew what the formula was. Multiple the slope by the X axis value, and add the intercept (which is often a negative number), and you will calculate the points needed.
Using Google Docs to generate a trend line is easy. Enter the data and tell it to make a trend line. Using PHP to do this is a bit messier. I use [Chart.js](http://chartjs.org/) to generate my stats into pretty graphs, and while it gives me a lot of flexibility, it does not make the math easy.
I have an array of data for the years and the number of death per year. That’s the easy stuff. As of version 2.0 of Chart.js, you can stack charts, which lets me run two lines on top of each other like this:
But. Having the data doesn’t mean I know how to properly generate the trend. What I needed was the most basic formula solved: `y = x(slope) + intercept` and little more. Generating the slope an intercept are the annoying part.
For example, slope is `(NΣXY - (ΣX)(ΣY)) / (NΣX2 - (ΣX)2)` where,
- x and y are the variables.
- b = The slope of the regression line
- a = The intercept point of the regression line and the y axis.
- N = Number of values or elements
- X = First Score
- Y = Second Score
- ΣXY = Sum of the product of first and Second Scores
- ΣX = Sum of First Scores
- ΣY = Sum of Second Scores
- ΣX2 = Sum of square First Scores
If that made your head hurt, here’s the PHP to calculate it (thanks to [Richard Thome](https://richardathome.wordpress.com/2006/01/25/a-php-linear-regression-function/) ):
That spits out an array with two numbers, which I can plunk into my much more simple equation and, in this case, echo out the data point for each item:
And yes. This works.
**Categories:** How To
**Tags:** charts, math, php
---
### [Secure Mindsets in Plugins](https://halfelf.org/2017/secure-mindsets-plugins/)
**Published:** June 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Keeping the mindset of security and what it means to you yesterday, today, and tomorrow.
**Content:**
At WordCamp Europe last week, I talked about the basics of plugin development. Since I had a mixed bag of experiences, I decided not to actually write a plugin in the class, but instead I took Hello Dolly and edited it. I discussed how the plugin worked, that an action called a function, which returned a value, and showed the interconnectivity. In this way, the attendees could understand the big picture of how code comes together.
But at the end, with five minutes, I touched on an important aspect of plugins that Hello Dolly doesn’t do much with, because it doesn’t have to.
I talked about security.
## Past You
In the past, you probably done insecure things. Have you ever left your car unlocked in the driveway while you ran the groceries inside? We all do things that are insecure or unsafe. This is normal. Similarly, we have done insecure code. In the past, all of us, when we begin, we write code to perform actions without thinking about how it will be used globally. We don’t worry about safe, we worry about functions.
There’s nothing wrong with this. We are often focus driven designers, fueled by passion and desire, so we want to *do* and not worry about the details.
## This Morning’s You
That said, when we do work in that way, we get ourselves into trouble when we ignore security. We assume people will only use the code in the right way, because it’s obvious what is right and what is wrong. I try not to say ‘obvious’ or ‘simple’ when talking about code or interfaces, because they are absolutely never, not once, obvious or simple. When I got my Apple Watch, the UX of Force Touch wasn’t obvious to me. It’s not simple now, since it can be a bit touchy, but it’s not difficult.
In the same vein, we all know that users do weird shit. Really weird shit. They put text in fields that should only gen numbers. They put numbers in for email. They copy paste without thinking. And you know that. You’ve seen it.
## The Right Now You
Having read that, you’re hopefully thinking “how can I make my code secure?”
When we talk about basic security, we mean four things:
1. Validate your data
2. Sanitize what you save
3. Escape what you output
4. Verify a human meant to do it
That’s it. Make sure a date is a date and an email is an email. Make sure you save the data in a way that doesn’t put other data at risk. Remove any possibly dangerous characters from what you show to users. Always make sure someone meant to do the action. WordPress has [over a dozen Sanitize and Escape functions](https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data) to help make sure you save the right data and it has [nonces](https://codex.wordpress.org/WordPress_Nonces) to help make sure you save when you should.
They’re very complex, but at their heart, they do those four things.
## Future You
The you of tomorrow will appreciate the you of today, if you remember to never trust your data. People typo. People make mistakes. People do bad things on purpose. All of that just happens. And if today, you learn how stop those bad things, tomorrow’s you will look back on you with love and thanks. Your users will thank you. Your next future will love you even more.
Security isn’t just https and good passwords. It’s a mindset to remember that anything passed to your code *might* be attacked. It’s a mindset that good users do bad and dumb things. It’s a mindset that mistakes happen. And it’s a mindset that being aware of the whole of your code, how it all comes together, must always include validation, sanitization, escaping, and nonces.
**Categories:** How It Works
**Tags:** essay, security, wordpress
---
### [Chassis - When VVV is Too Much](https://halfelf.org/2017/chassis-vvv-much/)
**Published:** June 23, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It won't be everything to everyone, but it can be something for most people.
**Content:**
When I need to do WordPress core development, I use [VVV](https://varyingvagrantvagrants.org). It’s great for multiple versions of WordPress, a copy of [WordPress Meta](https://github.com/WordPress/meta-environment), and it’s all done in one go.
But when I’m developing my *own* code, I want something a little lighter and simpler. I’ve been using [Local](http://local.getflywheel.com) for that for a while now. It involved [a few weird tweaks](https://halfelf.org/2017/local-dont-need-kitchen-sink/) but I was quite fond of it until the 2.0 upgrade. That’s because they broke the tool I needed most: [Addon Volumes](https://github.com/getflywheel/local-addon-volumes).
The current status is that [it’s broken](https://github.com/getflywheel/local-addon-volumes/issues/4) and the developer misjudged how many people used it. These things happen, but for me this was the *primary* reason I used it. So that meant it was time to look at my options again!
## Chassis
Made by the quirky and original [Human Made](https://hmn.md), [Chassis](http://chassis.io) is a cross between VVV and Local.
Like VVV, it’s Open Source. Like Local, it’s fast. Like VVV, it’s command line. Like Local, you can map to your hard drive. And that last reason was why I wanted to use it.
Look. There are a lot of reasons to use Chassis. The fact that it’s a server, so you can test out things like Memcached and PHP versions and upgrades is a big one. The fact that it’s fast to install and setup is another. But at the end of the day, I need my dev environment to do the following things.
1. Be ‘easy’ to rebuild
2. Have access to WP-CLI
3. Boot fast
4. Have a GUI SQL editor
5. Use my dev code, where I want it used from
## My Development, My Way
The thing I hate about most dev environments is that they want you to put your code in their locations. MAMP, VVV, Local, and DesktopServer *all* prefer you to put your dev code in the folder for your dev site.
I don’t work that way. All my code for all my WP sites live in `~/Development/repositories/NAME` or `~/Development/github/NAME` or `~/Development/wordpress/plugins/NAME` and this is a system that works for me. I have all my dev code in the Development folder, and I’m consistent about it.
Furthermore, when I use a local host install to test, I may use the same plugin on multiple sites. I try to reuse as much code as possible, after all.
This means my headache is *always* trying to some how symlink my development folders to my development site. With MAMP and Desktop Server I used rsync (and I was sad). With Local I used the broken add-on. With Chassis, it’s actually built in!
## Build The House
Chassis touts that it wants to be invisible. In order to do that, they separate WordPress and your code, recommending you put your code in the `/content/` folder. This is great, but as we mentioned, I want to have my code in another spot, so I need to map folders.
This can be done in the “Synced Folders” of the `config.yaml` file. I’ve added this:
Run a reload and a provision of vagrant and it all worked. That’s right, it was all silently symlinked and had full access to all my code in all the right places… Except…
## Mostly Ugly Plugins
You may notice this:
The first one didn’t work. The second one did, but *only* when I added this to my `local-config.php` file:
I’m still not sure if I broke it or if they did. What I do know is that I can rather easily build out my dev server, point it to my dev code, and everything’s working.
## Conclusion: Should you use Chassis?
I firmly hold that *all* developers should be familiar with the shell. Maybe they’re not all golden goddesses, but they should know how to get around, list files, and Google the basic commands like links, rsync, move, copy, and delete. With that in mind, if you’re a developer (be it a code developer, a design developer, or anyone else who peeks under the cover at the code), you should give Chassis a try.
It’s open source, so you can learn from it if you’re so inclined. It’s command line, so you can script it if you’re so inclined. You can separate your plugins from the plugins of the extensions, like [debugging](https://github.com/Chassis/Debugging), and you can write your own if you want.
Basically yes, you should use Chassis. It won’t be everything to everyone, but it can be something for most people.
**Categories:** How To
**Tags:** chassis, local development, wordpress
---
### [POST Isn't Just For Posting](https://halfelf.org/2017/post-isnt-just-posting/)
**Published:** June 16, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When is a post not a post?
**Content:**
I’m taking a moment here to explain something that confused the hell out of me when I was getting into the JSON API. In short, I was confused about what POST meant in the JSON API.
## POST vs GET
The official documentation mentions this:
> Want to get your site’s posts? Simply send a `GET` request to `/wp-json/wp/v2/posts`. Update user with ID 4? Send a `POST` request to `/wp-json/wp/v2/users/4`. Get all posts with the search term “awesome”? GET `/wp-json/wp/v2/posts?search=awesome`. It’s that easy.
From that I inferred that if I was updated content on my site, I would use a POST call. Otherwise, I’m always going to be using GET to get data. Makes sense. If you want to get the data on a specific post, you do a get for `/wp-json/wp/v2/posts/1234` and get that post’s data. Store the JSON output as a parameter in your plugin, let’s say, and Bob’s your father’s brother’s husband.
I was wrong.
## Alexa Posts
When I started working with Alexa I was confounded. It told me [it sent a `POST` request to my site](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/alexa-skills-kit-interface-reference#http-header). I stared at that for a while. I’d been assuming that when I asked Alexa something, I’d be able to tell it to do a `GET` request from `/wp-json/MYAPP/v1/MYSKILL/parameter`. After all, I’m not *posting* data.
But then I thought about it a little bit more. A straightforward `GET` request gets data from a URL without interaction. A `POST` posts data to a site, and you decide what to do with it. Most of the time when we think of a `POST` action happening, we think of updating data.
## POST doesn’t have to mean update
A `POST` is just sending data to your JSON API. It posts to your site.
That’s why passing the `WP_REST_Request $request` data to your function gives you magical access to the request data. And from that we can grab all the data [Alexa requests send to your site](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/handling-requests-sent-by-alexa#getting-the-application-id-for-a-skill), which lets us parse the data and make decisions on our replies.
Now like I said before, what you do with the POST is up to you. But that explains a lot about why Amazon is so picky about making sure a request came legit from them. Especially since you can order stuff from Amazon…
“Hey Alexa, can you tell TV shows to stop killing off queer characters?”
**Categories:** How It Works
**Tags:** alexa, json, wordpress
---
### [Custom Alexa Skills and WordPress](https://halfelf.org/2017/custom-alexa-skills-wordpress/)
**Published:** June 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Connecting Alexa and WordPress, securely.
**Content:**
Before you start, please note that there is no Amazon Alexa SDK for PHP. And this is a *big* problem.
An SDK is a software development kit that helps standardize the development of apps for the software. Using an SDK is basically using a standard library that everyone can access and call and not reinvent the wheel all the bloody time. And Amazon, for whatever reason, has decided that they’d rather push their Lambda hosting, which yes they charge you for, instead of clearly and cleanly document PHP code. Node.js? No problem. PHP? You’re on your own.
Rant aside, I have now a custom Amazon Skill, self hosted, and powered by WordPress.
## Amazon’s Requirements
On Monday I showed you how to build a very generic skill. It had no options, and it was actually missing a critical piece. You see, Amazon has [six basic requirements to be an app](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/developing-an-alexa-skill-as-a-web-service#requirements-for-your-web-service):
1. The service must be Internet-accessible.
2. The service must adhere to the Alexa Skills Kit interface.
3. The service must support HTTP over SSL/TLS, leveraging an Amazon-trusted certificate.
4. The service must accept requests on port 443.
5. The service must present a certificate with a subject alternate name that matches the domain name of the endpoint.
6. The service must validate that incoming requests are coming from Alexa.
The first five are pretty normal. If it’s not internet accessible, its not going to work. Same with the adherence to the skills kit interface. But that last one was surprisingly difficult and annoying. Mostly because of that lack of a standardized PHP SDK.
Basically there *isn’t* a standard way to validate that incoming requests are coming from Alexa, but boy howdy, are there requirements.
## Validating Requests for Alexa
While it says the requirement is to validate the requests, that’s only one aspect of the game. The three basic parts are these:
- Verifying that the Request was Sent by Alexa
- Checking the Signature of the Request
- Checking the Timestamp of the Request
And none of those are really well documented for PHP. Thanks.
## The Code
In Monday’s post, I framed out the majority of the code that will be used. The change will be in this section:
It now shows this:
This makes two changes. First it’s grabbing the date from the weirdly stored JSON POST from Alexa and passing it to my `last_post` function. That code I’m skipping since taking the date, parsing it, and changing your output from `last_post` is beyond the score. No, I’m going to concentrate on the `alexa_validate_request` function.
You should take note of the success check `if ( $validate_alexa['success'] !== 1 )` however. You *must* use a rest response with a 400 because Amazon is very picky.
## alexa\_validate\_request
The brunt of the validation is to check if the URL came from Amazon, if the URL is on the certificate chain, if the certificate is legit, and finally if the request was made in the last 60 seconds. Which is a lot to look for.
In order to write this function, I forked [Rich Bowen’s Validate Echo request via PHP code](https://github.com/rbowen/validate-echo-request-php/) for WordPress. This takes into account some WordPress code that isn’t otherwise available:
Within that function, I reference two more: `alexa_valid_key_chain_uri` and `alexa_valid_cert` which parse the chain and validate the certificate.
## A Word About Testing…
The problem with all this weird code is that the only way to test is to use Amazon’s testing platform and that doesn’t actually throw back errors. The testing environment is fun, because you can type in ‘when was last post’ and it prepends “Alexa, ask HalfElf…” for you. And it shows you exactly what JSON it’s passing to your API *and* what your API retuned.
But…
In the event your API throws an error, you don’t get to see what the error was. No, you get a message saying that the API returned an invalid output.
Basically the Amazon API has no actual debugging if you’re trying to debug the connection requirements.
There may have been a lot of swearing involved on my end.
**Categories:** How To
**Tags:** alexa, amazon, echo, json, security
---
### [Hello World: WordPress, the Rest API, and Alexa](https://halfelf.org/2017/hello-world-wordpress-rest-api-alexa/)
**Published:** June 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A simple hello-world style skill for the Amazon Echo, powered fully by WordPress. No SDKs, no libraries.
**Content:**
I have a big issue with Amazon’s ‘documentation.’ Trying to learn how to do anything is akin to sniffing your cat’s butt to find out where the dog is. It’s written from a mindset I don’t share, it rarely has *practical* and functional examples, and the font is maddeningly small.
How I learn best is by creating a “Hello World” type app. Even if it’s just copy and pasting, by doing that, my brain is able to follow the pathways and understand the logic steps.
If you’re like me and have been swearing at Amazon just trying to make a simple ‘Hello World’ app for your Echo, here we go.
## The Outcome
To summarize what we want here, is we would like to be able to do is turn to our Echos and say this:
> Hey Alexa, ask HalfElf what the last post is.
And we want Alexa to reply:
> The last post on HalfElf was \[Post Name\]
This is really simple on purpose. While eventually we want to be able to ask for a post on a specific date, we’re not there yet. You’ve got to run before you can walk.
## The Design
Designing your API requires forethought. In a previous post, I named my flash briefing URL `/MYSITE/v1/alexa-skills/briefing` and, in keeping with that, this one will be named `/MYSITE/v1/alexa-skills/last-post/`
You’ll need to hang on to your URL – `https://example.com/wp-json/MYSITE/v1/alexa-skills/last-post/` – as you will need to put this into your Amazon Skill. This will be a custom skill and you’ll need to have the intent look like this:
Remember, the goal is eventually to be able to use that date slot. We’re not right now, but be prepared, as Mr. Lehrer would say.
With that in mind, the sample utterances look like this:
You’ll notice I’m trying to think of every which way someone *might* ask the question. You need to do this. Alexa is very picky.
## The Rest API Code
Once you’ve built out your Amazon Skill (and yes, that really is the easy part), you have to have the response. This is built off the same model I used before, and can be slipped in and shared.
As I said, it’s pretty simple. The output looks like this:
This is not the most efficient way to grab one post, but for the purposes of this example, it does get your head around the basic idea.
## Next Up?
There are two issues with this code. First of all, it doesn’t meet Amazon’s requirements. Secondly, it doesn’t accept parameters. The first issue is much bigger, because as it turns out, Amazon *requires* you to check if the requests are coming from Amazon, are valid, and aren’t a bot-net attack. This is actually very smart, but very annoying, since they don’t make it easy to figure out how to do all that.
But that’s next.
If you hear screaming from California, it’s just me.
**Categories:** How To
**Tags:** alexa, api, echo, json
---
### [Flash Briefing JSON Feed](https://halfelf.org/2017/flash-briefing-json-feed/)
**Published:** June 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a JSON Feed acceptable for Amazon Alexa Skills.
**Content:**
The other day I mentioned a ‘solution’ to my problem of video enclosures would also be to use a JSON feed. As much as I’d like to tell you just to use [JSON feed](https://jsonfeed.org), you can’t because their specs don’t match Amazon’s.
The creation of a JSON Feed that does match their specs is somewhat peculiar, but still straightforward. I went with making a JSON API output instead of making true feed, since frankly I don’t think Amazon’s all that consistent with their own spec, and I’ll need to tweak it later. I’d like to do so without breaking everything else.
## The Code
## Some Notes…
This is built out with the assumption I will later be adding more information and skills to this site. That’s why the class is named for the skills in general and has the rest route set up for sub-routines already. If that’s not on your to-do, you can simplify.
I also made the point to strip out the possibility of a StreamURL, which I don’t plan to use at all on this site. If you do, I recommend having a look at [VoiceWP’s briefing.php file](https://github.com/alleyinteractive/voicewp/blob/master/alexa/skill/briefing.php#L47) which does a nice job with handling that.
**Categories:** How To
**Tags:** feed, json, rest api
---
### [Alexa Flash Briefing Skills and Video Enclosures](https://halfelf.org/2017/alexa-flash-briefing-video-enclosures/)
**Published:** June 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Amazon's Flash Briefing RSS scanner has some flaws when it comes to videos.
**Content:**
One of my goals this year, aided by the inimitable Chris Lema, was to make an Amazon Echo app.
There’s a lot more to the whole plan, but I want to start with the simple stuff first. So the very first step is that I want to make a “Flash Briefing” app. That will allow people to get the latest posts from my site.
For the most part, this is trivial. Creating a [Flash Briefing Skill](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/steps-to-create-a-flash-briefing-skill) is fairly well documented and essentially is this:
1. Make an account
2. Create a Skill
3. Point it to your RSS feed
4. Give it an icon
And that works great. Unless, of course, you have videos in a post.
You see, when I went to add my RSS feed, I got this rather useless error:
## What Went Wrong?
The error was caused by having a video in a post. Now, I need to stress the stupidity here. I have a video inside the post. It’s not a video post, it just has an embedded video because it was contextually needed.
Logically I googled the error and came up empty. This did not surprise me. I’ve been resigned to learn that Amazon is not actually very helpful with their UX or error messages. I’m not sure why this is but their tech UX, the stuff made for developers not the devices made for end-users, tend to be incredibly poorly designed and ill documented for new people.
That said, I understood the error was reflecting on a ‘video’ URL, and I had a video in that specific post. I removed the video, tested, and it worked. Ergo the error was caused by the video’s existence. But as it happened, *Stream URL* had nothing to do with it.
## It Was Elements
The real issue was found when I read through [the feed format details](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/flash-briefing-skill-api-feed-reference#feed-format-details) which had mention of a need, for *audio* content, an “URL specifying the location of audio content for an audio feed.”
This wasn’t an audio file, but the example for a JSON feed was to include a “streamUrl” value. Oh. And for RSS? An “enclosure element with type attribute set to audio/mpeg”
This had to be related.
When I looked at my RSS feed, however, I saw this:
Wasn’t that what I needed?
## A Second Enclosure
Apparently the flash briefing RSS code is stupid and thinks that any enclosure has to have the “audio/mpeg” type. So how do I add in this?
By the way yes I reported this to them as a bug. Anyway, the first attempt at fixing this was for me to add a new custom post meta for the enclosure like this:
That auto-added the proper enclosure code because WordPress knows what it’s doing. Once I was sure that worked, I filed the full bug report and then went the *other* way.
## Remove The Enclosures
This is not something I generally recommend. However if you’re not podcasting or vlogging and you have no need to encourage people to download your videos and media via RSS, then you *can* get away with this:
That removes the enclosure code.
## Build Your Own
Another fix would have been to make a JSON output or use something like [JSONFeed](https://jsonfeed.org) itself. Or of course I could have auto-duplicated the embeds, but that just felt wrong to me.
**Categories:** How To
**Tags:** amazon, echo, feeds
---
### [Tracking Changes On Sites](https://halfelf.org/2017/tracking-changes-sites/)
**Published:** June 9, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Trying to track changes in webpages when they don't make it easy isn't easy.
**Content:**
When you make a site dependent on others for your data, it’s important to be able to get updates on those sites promptly. Most of the time, a site has way to see what’s recently updated, be it by a page that lists what’s new, or an RSS feed, or an email list.
But what happens when they *don’t*?
Well. Then you need to look into monitors. And the bad news? Nothing is perfect. I’ve picked the top two services I tried over the month of May
## [VisualPing](https://visualping.io)
If the content of a page is HTML only, then it’s great. But if you’re trying to monitor a highly dynamic javascript site, it can time out. Especially if the site has a lot of data. The interface of the site is nice, having a simple UX that was easy to understand. At the same time, it doesn’t handle abnormal well, and often wouldn’t tell me there were changes because simply it couldn’t tell.
Overall, it was a disappointment for me and not useful for the javascript heavy page I was trying to monitor. As such, I’m not using it anymore.
## [Versonista](https://versionista.com)
This is much better for a javascript heavy page that has a long load time. It can list out the URLs added that are new, and you can review the changes into the minutiae. But. The emails are incredibly inconsistent and the UX is overly complex. While I can go in and see what’s changed, down to the source-code, I’m supposed to get a daily email about that and I don’t. Also the options are too much. I just want to see what changed. A list of the changes, maybe a list of the new links. Instead I have to click around to figure out how to see the list better.
Between that and the email situation, I’m unhappily still using it.
## Overall…
The real issue I have is not with these services, but the fact that the webpage I’m trying to monitor was not intelligently designed. It’s trying to list everything on one page, using javascript, and sadly it’s not well optimized. I can’t even get the page to load properly on my iPad. The content is also not sortable. It’s always alphabetical, no matter what.
My biggest takeaway from this is that with *some* content it makes sense to hard define your content. That is, sorting everything by name and not allowing it to be restored may make sense for many people. But you have to allow people an easy way to see what’s new if you want them to keep coming back.
**Categories:** How To
**Tags:** apps, monitor, sorting
---
### [SEO and URLs and Indexes](https://halfelf.org/2017/seo-urls-indexes/)
**Published:** June 2, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Index pages aren't hurting your SEO, though your content may be.
**Content:**
The question of the day. “Does having all your posts indexed on the main page of your site cause the highest SEO value to be in your main domain name and not the individual posts or categories?”
No.
## What is your homepage for?
As a reminder, you don’t have to have all your posts listed on your main page, or any page when you get down to it. When you don’t we call those ‘static sites’ but really what we mean is “A non-newspaper site.”
Yoast talks about this with regards to what they call [homepage SEO](https://yoast.com/homepage-seo/). As Michiel notes in that post, the point of your homepage is to load fast, explain the purpose of the site, and direct people to where they need to be.
## Where Is SEO Value?
The SEO value in your site is not going to be in the homepage or the category pages. It’s not in the archive pages either. The value of your site is found in your important content. We call this your flagship or cornerstone content. Those are the pages you want to drive people to, to get the most out of their visit.
There’s a lot of good advice about how to make good content like that, from [CopyBlogger](http://www.copyblogger.com/how-to-create-cornerstone-content-that-google-loves/) and [Yoast](https://yoast.com/cornerstone-content-rank/) and more. But the point they all make is that the mead and meat part of your site is the content and not the index.
## Do index pages lose SEO?
Again. No. Look. I get it. The real question is “Will sending everyone to my home page screw up my cornerstone SEO?”
No. That’s not how it works. If people are looking for “your website topic” then yes, they will end up on the home page. And if your home page is a constantly rotating list of pages, then yes, they will see links to some deeper content.
But that doesn’t hurt your SEO. Google will rank your cornerstone pages properly because they will rank higher. They will have more specific content. They will be your centers. So spending all your time coming up with fancy ways to get rid of content that is underperforming, hiding it and removing it, it’s just a waste of time and energy. Of course that’s a bit of a different topic.
## Your homepage won’t hurt your SEO
Listing your recent posts on your home page doesn’t hurt your SEO. Actually it helps a little to have a ‘recent posts’ section. But no, having the posts lists doesn’t hurt the SEO. Your site will be just fine. Don’t make weird CPTs to shuffle things around.
**Categories:** How It Is
**Tags:** essay, seo
---
### [Calm Under Pressure](https://halfelf.org/2017/calm-under-pressure/)
**Published:** May 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We must chose control.
**Content:**
A friend remarked she was impressed I was able to stay calm under the abuse slung my way. I have a secret.
## I’m Often Very Angry
I’m not calm. I’m often quite irate and I froth and I rant. Some of my friends hear those rants. The complaints about how can people be that myopic and obtuse run rampant. I also do on occasion see red and feel my blood pressure rise and I want to reply to people so angrily.
I really do. I want to scream and use all caps to emphasize that lying to people, trying to trick them, or otherwise doing bad things makes them bad people. I really want to shake some people to make them see they’re hurting themselves more than anything else. Some people I want to take their computers away because clearly they’re too immature for even free plugin hosting.
## That’s My Secret
If you saw the movie *The Avengers*, then you may recall a moment when Bruce Banner said he controlled the Hulk by always being angry.
The trick of that is its simplicity. You see, if Banner could only control the Hulk by not getting angry, then he’d lose. But by accepting his anger and being always angry at the state of the world, at his situation, and so on, he doesn’t have to control the *anger* anymore. He has to control his *temper*. That is, he controls his response to anger, but he allows the anger to happen.
## It’s Okay To Be Angry
We all get angry. We see people doing stupid things and we get mad. But we have a choice in how we respond and react to those things. You can’t stop yourself from being angry, but you can stop yourself from being an uncontrolled Hulk when you’re angry.
Seeing people not care about others gets me madder than anything else. Be it cutting in line, stealing, abuse, or the government. Or, yes, plugins. I get pissed off. I find that lack of humanity, lack of humanitarianism, to be appalling and disgusting.
But I don’t lash out and hurt people (at least not intentionally) when it happens. I try to educate, to discuss, and to communicate.
## We Have A Choice
We usually have a choice on how we react. There are, of course, situations where we are not in control of ourselves, where we react before we can control. Trauma triggers cause that in many of us. But where and when we do have a choice, we must remember our humanity. We must chose control.
**Categories:** How It Is
**Tags:** essay, oped
---
### [Adding Sort Options to Facet](https://halfelf.org/2017/adding-sort-options-facet/)
**Published:** May 29, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding sort-by options to your Facet powered site.
**Content:**
As I implement more and more aspects of [FacetWP](https://facetwp.com), I find more and more ways to manipulate the searches. At first I only added in the features that let people easily search for multiple aspects at once. But I hadn’t yet added in any features to sorting.
## Sorting and Ordering
The way Facets generally work is that you can easily organize all ‘types’ together, so if you wanted to search for everything that crossed four separate categories, it was very easy. In addition, you can extend it to search meta data as well.
Sorting, on the other hand, is changing the *order* of the results. For example, if you wanted to search for everyone with terms A, B, and D, and post meta foo, but order them based on post meta bar, you can!
## A Practical Example
I always do better with examples I can wrap my hands around.
Take television shows. Take a list of 500 TV shows, and have them include the following taxonomies:
- Genres (drama, sitcom, etc)
- Airdates (Year to Year)
- Tropes (common tropes)
- Number of characters
- Number of dead characters
That’s enough for now.
With that list, and a couple facets, you can concoct a smaller list of all sitcoms that aired in between 2014 and 2016 (inclusive), with a trope of ‘sex workers.’ The answer is 4 by the way. By default, the list displays alphabetically.
But. What if you wanted to *order* them by the ones with the most characters first?
That’s sorting.
## The Code
Okay so how do we add this in? Functions!
Facet comes with quite a few defaults, but it lets you add your own [sort options](https://facetwp.com/documentation/facetwp_sort_options/). The two things I’m going to show below are how to rename the display labels for some of the defaults, and how to add in one new option for the most number of characters:
I have this wrapped in a check for `is_post_type_archive` because I don’t want the options to show on other pages. The meta key is the name of the meta key you’re going to use to sort by (I have key that updates every time a post is saved with a count of characters attached) and the orderby value is one of the ones [WP Query can use](https://codex.wordpress.org/Class_Reference/WP_Query#Order_.26_Orderby_Parameters).
## End result?
Looks nice!
**Categories:** How To
**Tags:** code, facetwp, wordpress
---
### [FacetWP, Genesis, and Archives](https://halfelf.org/2017/facetwp-genesis-archives/)
**Published:** May 31, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Changing the archive header dynamically based on your Facet choices.
**Content:**
In my ongoing use of [FacetWP](https://facetwp.com) and [Genesis](http://www.shareasale.com/r.cfm?b=346198&u=728549&m=28169&urllink=&afftrack=), I ran into a case where I wanted to change the archive description content based on what sorts of options had been selected in the search. In part I wanted to remind visitors of what they’d picked, but also I wanted to easy to remove a search facet.
## Before
In the beginning, the archive was a static thing:
This is intentionally boring. It lists the archive title, how many posts, and a description.
## Filtering the Content
Since this is Genesis, the first step is to know how to filter at all. Since I’m only doing this on custom post types, I went with the very precise action and that is `genesis_do_cpt_archive_title_description` (aptly named).
I remove it and then add in my own:
From here out, all the work will happen in the function `DOMAIN_do_facet_archive_title_description` which lives in my `functions.php` because it’s all theme specific.
## What Gets Added
Now it’s time to decide what you want to add. I picked three things:
1. Change the post count based on the results
2. List the selections chosen
3. Change the title based on the sort order
Those are two simple asks and one weird one.
Facet comes with the ability to display counts and selections:
- `facetwp_display( 'counts' );`
- `facetwp_display( 'selections' );`
The problem I had was that the counts were formatted in a way I didn’t like, so I quickly cleaned it up by [filtering the result count](https://facetwp.com/documentation/facetwp_result_count/):
That means the count and the selections can simply be tacked on to the description.
## Adding the Sort Data
The hardest part was figuring out how to add the sort data. Since FacetWP uses a lot of javascript, I spent half an afternoon ranting to myself and trying to figure out how to do this in javascript. And then I did what I usually do when confused. I read the code.
As I read, I realized some of FacetWP’s magic is that they pass the GET parameters of the search over to javascript… And if they were doing that, then I could just use PHP to grab those parameters.
All I had to do was pass `$_GET['fwp_sort']` into a variable.
## The Code
Enough talk. Here’s the code:
You’ll notice that I’ve kept in all the regular Genesis filters. This was so that my theme can take advantage of whatever magic Genesis invents down the line.
## How It Looks
Now the default looks like this:
And after you’ve picked a few options, it changes to this:
If you click the little x’s on the side of the selections, they’re removed.
There’s still room for design improvement, but remember folks. Release and iterate.
**Categories:** How To
**Tags:** facetwp, genesis, wordpress
---
### [Taxonomy Icons](https://halfelf.org/2017/taxonomy-icons/)
**Published:** May 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Giving each taxonomy an icon. Not the term, the taxonomy.
**Content:**
Last year I talked about how I made icons for my taxonomy terms. When you have a limited number of terms, that makes sense. When you have a taxonomy with the potential for a high volume of terms, like nations (192), or worse an *unlimited* number of terms, this approach looses its value.
Instead, I realized what I needed for a particular project was a custom icon for each taxonomy. Not the term.
I split this up into two files because I used a slightly different setup for my settings API, but the tl;dr of all this is I made a settings page under themes called “Taxonomy Icons” which loads all the public, non-default taxonomies and associates them with an icon.
For this to work for you, you will need to have your images in a folder and define that as your `IMAGE_PATH` in the code below. Also mine is using `.svg` files, so change that if you’re not.
## File 1: taxonomy-icons.php
The one gotcha with this is I usually set my default values with `$this->plugin_vars = array();` in the `__construct` function. You can’t do that with custom taxonomies, as they don’t exist yet.
## File 2: view-appearance\_page\_taxicons.php
Why that name? If you look at my `render_view` function, I pass the ID from `get_current_screen()` to it, and that means the ID is `appearance_page_taxicons` and that’s the page name.
## End Result
And in the end?
By the way, the image has some wrong text, but that is what it looks like.
**Categories:** How To
**Tags:** coding, plugins, taxonomies, wordpress
---
### [While Not Being Consumed](https://halfelf.org/2017/while-not-being-consumed/)
**Published:** May 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When you're evil for doing good.
**Content:**
I get painted as a bad guy a lot. I’ve been called names, everything you can think up. I’ve had my gender, sexuality, appearance, and ability all mocked and derided. And most of this has happened since I took up the role of a volunteer in WordPress.
## Creation, Editing, Fitting In
As a writer, which is how I’ve always seen myself first, I’m used to the ruthlessness of the editing process. I’ve seen papers torn apart and painted red with corrections and commentary. Why this? What are you saying here? I understand the reason for ripping apart creativity to find it’s heart and crux and meaning. Art for the sake of art is different than art for the sake of consumption, after all.
But instead of a career in the arts, or journalism, I had a different path. Out of college I went to work for a bank and quickly learned how to fit myself into the cog of a machine. I had a role and a life that did not encourage innovation and uniqueness, but that of interchangeability. And in that work, I began to understand the reason for patterns and the similarity.
I’ve always been fascinated by patterns. I liked to see how the number went from 09 to 18 and 27 and obviously the first number goes up while the second goes down, and isn’t math cool? Seeing the pattern in the work at the bank taught me that while we are all creating and inventing, what we make has to be used in many different ways, and they all need to talk to each other. So we have to make sure all the little cogs and wheels interlock properly.
## It’s Still Creation
I like to watch the behind the scenes parts of movies. It’s why I prefer to own physical copies. I have watched all the extras for the *Lord of the Rings* movies. That’s why I know Tolkien disliked when people were obsessed with his work. Because he was not obsessed. He liked what he did, but it wasn’t the end of the world if people didn’t care for it. He made something neat to tell the story he wanted to tell
Often we as developers fail at this. It’s not entirely our fault. We’re told that what we do is engineering or science, and we forget to stress the creative aspect of inventing that which has never been seen before. We forget progress is forged by dreams. And that’s why, when you see a one star review of your work, it flays you open, leaving you chained to the rocks for the crows to eat your innards. You gave fire to man, and this was your reward?!
Let’s breathe. What Tolkien didn’t seem to understand was that he had created life. He had made a world so amazing and vibrant, people saw it and wanted to be a part of it. Similarly, when we create code, we give life to others.
## The Good, The Bad, The Ugly
I’ve gotten the greatest compliments on my work in the form of someone telling me it helped them achieve their goals. People have started businesses, found success, and made something of themselves, all because of something I did.
But more often, or at least what I remember more, are the names and the anger and the harassment. The people who stalk me down on Slack and Twitter, demanding that I pay attention to them right now and that they are the most important thing… while being angry when I do devote that time, but that my answer is not what they wanted.
## Remember Your Self
Originally I titled this post “When you’re evil for doing good.” Really that didn’t touch on the real feeling I have about this. Because at the end of it all, I sit and look at the work I’ve done and I ask myself “What was this for?”
I have a strange life. I have a job that is essentially trying to keep 26% of the internet safe from itself. So my answer for “What was this for?” has become a question of itself. “Is this going to make it better or worse?”
When I come to decisions, like to tell someone we cannot host their code because they have lied and broken the guidelines too many times, it always comes from this place. Will I make things better for *the majority* or worse? And in that moment, I ignore the other question. “Will this hurt me?” Because the answer to that is “Yes, probably.”
## “Honor is what you know about yourself.”
There’s no way I can make hard decisions and not get hurt. There’s no way I can do it and not hurt others. But I sit and I remember my self. My inner self that wants to make things better, safer, and as fair as possible. I remember the me who wants to say “What I do makes the internet better.” And if that comes at a personal cost, well. I will know this.
I have integrity.
I have honesty.
I have empathy.
As long as I have those, and as long as I do my best and keep learning and becoming better, I will be doing the right thing. And I can live with being ‘evil’ when I’m doing good.
**Categories:** How It Is
**Tags:** essay, oped
---
### [Defining Yourself](https://halfelf.org/2017/defining-yourself/)
**Published:** May 12, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Defining yourself requires a lot more guts than people warn you about.
**Content:**
If you took the 2016 WordPress survey, you were asked to define yourself. Blogger, developer, designer, and so on. It’s a profound question, and not just in the metaphysical way.
## More Than One
I am many things because I represent many things. When I speak, I speak forever with the weight of who I am. I speak and it reflects on DreamHost, my company. On WordPress, where I volunteer. If I were to say I hated Akismet, for example, it could end up on various sites and Facebook groups that the Plugins Team hates Akismet.
I’ll get back to that in a minute. [Last summer I talked about handling bad reviews at WordCamp Europe](http://wordpress.tv/2016/06/30/mika-epstein-reviews-the-good-the-bad-and-the-stalker/). I don’t want to repeat that, you can watch it. People leave angry, mean, and outright bad reviews for a lot of reasons, and you can handle them constructively or not, as you like. Obviously I think constructive is better, because those bad reviews, the way you handle them is what’s going to make your reputations.
## The Forest for the Trees
The problem is that you, the creator, feels so close to your code and creation, that you have trouble divorcing yourself from the review. I find that the more someone has worked in journalism or writing, the less personally they take the reviews, because they have seen their works ripped apart by a red pen before. Artists have to learn how to handle being edited.
But the other problem is that you forget you’re NOT an artist. If an actor or a musician blows up at people and rants and raves, it may hurt their career, but… people still hire Mel Gibson after his anti-Semitic rant. And Tiny Fey, love her, has been rather transphobic. No one is perfect, not even our idols, and we accept that.
## The Goose vs the Gander
People are less accepting of their peers. If you get a bad review and explode on someone, calling them names, you’ve hurt yourself and your brand more than any single one star review ever could. Worse, they may treat you like a celebrity, over analyzing every word you say. That one’s a hoot.
The truth of all this is depressing. You will be hated, intentionally misunderstood, thrown under a bus, leibeled, and slandered. People will assume the worst of you. And because of this, they will assume to worst of your project, your brand, and your company. Forever.
And this too is depressing, because you will never be free of it. I posted on my blog, sometime last year, a post called “[What they don’t tell you](https://halfelf.org/2016/dont-tell-you/).” It listed the downsides to the community, and how these days happen and they suck. And you can’t stop them. I walked away from things decades ago, and they follow me. They haunt me.
## Is There a Truth?
The obvious question now, the one I am reluctant to answer is HOW do you cope?
I don’t know.
I can tell you how I cope, but I don’t know if my answers will help you. I can tell you that it does all suck sometimes, but not all times, and you should have other outlets. I cannot offer the answer, though, because there isn’t just one.
The one truth I have is that defining myself as someone I can live with being is my answer. For the truth within myself is that as long as I know I am being good and honest and as fair as I can be, I am a good person. And being a good person is what matters most to me.
**Categories:** How It Is
**Tags:** oped
---
### [Grandchildren Templates](https://halfelf.org/2017/grandchildren-templates/)
**Published:** May 22, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Templates in a widget instead of a theme? We can do that too!
**Content:**
When I posted about my cleverness with grandchildren themes (which as Cosper pointed out was a plugin), reader [Damien mentioned templates](https://halfelf.org/2017/grandchildren-themes/#comment-78996). He said:
> I have considered using template\_redirect() to override template files in the child theme. I’ve experimented with providing selectable page templates where the template file is not in the child theme directory (not so easy).
Well Damien, I think you’ll be pleased to know there *is* a solution.
[WPExplorer has made a WordPress page templates plugin](http://www.wpexplorer.com/wordpress-page-templates-plugin/). My caution is not to use the GitHub repo, which is not up to date, but copy the one in the post.
However … I forked it. And my fork is only going to work if you have both WordPress 4.7 and PHP 7. That’s because in PHP 7, PHP finally decided to allow defines to have arrays.
## The Pre-Code
I use the template in an MU plugin. It sits in a folder called “cpts” and is summoned by my master `index.php` file that has this:
As you can see, I define my array and then I call the CPT file and the templater itself.
## The Template File
This is 90% the same as the original. The two changes are I removed the check and failsafe for pre-WP 4.7, and I changed the section to add templates to call my define.
So long as you have PHP 7+ and WP 4.7+, it all works great.
**Categories:** How To
**Tags:** plugins, themes, wordpress
---
### [Grandchildren Themes](https://halfelf.org/2017/grandchildren-themes/)
**Published:** May 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The solution to children of children themes is a plugin.
**Content:**
I’m a fan of [Genesis themes](https://helf.us/genesis). They look nice, they’re secure, and they’re well coded. A lot of things I have to reinvent in other themes are done out of the box in Genesis.
But they’re not perfect.
## Frameworks Beget Children Themes
The problem with Genesis themes is that if you use them, you’ll end up using a Child Theme and not Genesis. Unlike boilerplate themes like [Underscores](http://underscores.me), you’re not meant to edit the theme itself but make a child theme.
For the most part, this doesn’t bother me. I don’t generally edit the child themes, except in two cases. Both of my fan sites run highly modified versions of the default themes, and one of them uses the amazing [Utility Pro](http://www.shareasale.com/r.cfm?b=778546&u=728549&m=61628&urllink=&afftrack=) theme by Carrie Dils.
And that was my problem. I knew Carrie was working on a new version which would have some amazing updates. And I? I had forked her theme.
## Marrying Forks
Merging my fork to her new theme had, generally, not been an issue. I’ve updated it a dozen times already and I just run a tool to find the diff between the files. I’m a [Coda](https://panic.com/coda) fan, and I use [Comparator](https://panic.com/coda/plugins.php?id=110) to check out the differences between files. Doing this is time consuming and annoying, however, and generally leads to people *not* making changes they should.
As time went on, I made fewer and fewer changes not because I didn’t want to, but because I had gotten increasingly smarter. Why edit out what I could de-enqueue, for example?
## Grandchildren Plugins
The solution to my woes was a grandchild. Except instead of a grandchild theme, I made a plugin. Actually I have an mu-plugin called “Site Functions” and in that file is this call:
That file has 300-ish lines of code, which sounds like a lot now that I look at it. Except it boils down to 6 actions and 7 filters:
Everything I did editing the theme, I can do in those 6 actions and 7 filters. It’s positively amazing. For example, I mentioned dequeueing? I don’t like using Google Fonts if I don’t have to, so I remove them. But I also needed to change the backstretch arguments to properly force my image in the right location, so I can do this:
That removes the fonts and backstretch arguments, and then adds my own in. And yes, I know my method of calling `mu-plugins` is not great. I do it this way because I have symlinks, and `plugins_url()` manages to call that URL instead of the one I want it to.
## The Benefits
Doing my code this way means it can’t be deactivated. It also is called by checking the theme, so if that changes then the files stop being called. I keep my own work under version control, letting me go back any time I need to. I’m no longer duplicating Carrie’s work either, speeding up my development time.
It’s a win all around.
**Categories:** How To
**Tags:** development, themes
---
### [Hugo and Lunr - Client Side Searching](https://halfelf.org/2017/hugos-lunr-search/)
**Published:** May 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little javascript and JSON make searching an at-home affair for Hugo.
**Content:**
I use [Hugo](http://gohugo.io) on a static website that has few updates but still needs a bit of maintenance. With a few thousand pages, it also needs a search. For a long time, I was using a Google Custom Search, but I’m not the biggest Google fan and they insert ads now, so I needed a new solution.
## Search is the Worst Part
Search is the worst thing about static sites. Scratch that. Search is the worst part about *any* site. We all bag on WordPress’ search being terrible, but anyone who’s attempted to install and manage anything like ElasticSearch knows that WordPress’ search is actually pretty good. It’s just limited. And by contrast, the complicated world of search is, well, complicated.
That’s the beauty of many CMS tools like WordPress and Drupal and MediaWiki is that they have a rudimentary and perfectly acceptable search built in. And it’s the headache of static tools like Jekyll and Hugo. They simply don’t have it.
## Lunr
If you don’t want to use third-party services, and are interested in self hosting your solution, then you’re going to have to look at a JavaScript solution. Mine was [Lunr.js](https://lunrjs.com/), a fairly straightforward tool that searched a JSON file for the items.
There are pros and cons to this. Having it all in javascript means the load on my server is pretty low. At the same time I have to generate the JSON file somehow every time. In addition, every time someone goes to the search page, they have to download that JSON file, which can get pretty big. Mine’s 3 megs for 2000 or so pages. That’s something I need to keep in mind.
This is, by the way, the entire reason I made [that massive JSON file the other day](https://halfelf.org/2017/hugos-making-json/).
To include Lunrjs in your site, download the file and put it in your `/static/` folder however you want. I have it at `/static/js/lunr.js` next to my `jquery.min.js` file. Now when you build your site, the JS file will be copied into place.
## The Code
Since this is for Hugo, it has two steps. The first is the markdown code to make the post and the second is the template code to do the work.
### Post: Markdown
The post is called `search.md` and this is the entirety of it:
Yep. That’s it.
### Template: HTML+GoLang+JS
I have a template file in `layouts/_default/` called `search.html` and that has all the JS code as well as everything else. This is shamelessly forked from [Seb’s example code](https://gist.github.com/sebz/efddfc8fdcb6b480f567).
It’s important to note you will *also* need to call jQuery but I do that in my `header.html` file since I have a bit of jQuery I use on every page. If you don’t, then remember to include it up by `` otherwise nothing will work.
## Caveats
If you have a large search file, this will make your search page slow to load.
Also I don’t know how to have a form on one page trigger the search on another, but I’m making baby steps in my javascripting.
**Categories:** How To
**Tags:** hugo, javascript, search
---
### [Hugo Making JSON](https://halfelf.org/2017/hugos-making-json/)
**Published:** May 15, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Building a JSON file with all the data from all the posts in a Hugo site is actually not only possible, but it won't drive you insane.
**Content:**
While it rhymes with bacon, it’s not at all the same.
There are a lot of reasons you might want a JSON file output from your static site (I like [Hugo](http://gohugo.io)). Maybe you’re using Hugo to build out the backend of an API. Maybe you want to have it include a search function. Today I’m going to show you how to have a JSON file created with a complete site archive. The end goal of this example is to have a searchable JSON file that you can use with Lunrjs or Solarjs or anything else of that ilk.
## The Old Way: Node
Since I was initially doing this to integrate Hugo with [Lunr.js](https://lunrjs.com/), I spent some time wondering how I could make a JSON file and I ran into [Lunr Hugo](https://github.com/gwleclerc/lunr-hugo), a fork of Hugo Lunr but with YAML support (which I needed). I actually use a private fork of that, because I wanted to change what it saved, but this is enough to get everyone started.
To use it, you install it via Node:
Then you add the scripts to your Node package file (normally called `package.json`):
Change the value of “site/content/” as you see fit. Once installed you can build the index by typing `npm run index` and it makes the file in the right location.
The obvious downside to this is I have to run it outside of my normal build process.
## Another Old Way: Grunt
This idea come from [Seb](https://gist.github.com/sebz/efddfc8fdcb6b480f567), one of the lead developers for Hugo, and he uses a Grunt script to do this. First you have to install node and things via this command:
`npm install --save-dev grunt string toml conzole`
Next you make a `Gruntfile.js` file like this:
Take note of *where* it’s saving the files. `site/static/js/lunr/PagesIndex.json` That’s works for Seb because his set setup has everything Hugo in a `/site/` folder.
To build the file, type `grunt lunr-index` and off you go.
## The New Way: Output Formats
All of that sounded really annoying, right? I mean, it’s great but you have structure your site to separate Hugo from the Node folders, and you have to run all those steps outside of Hugo.
Well there’s good news. You can have this all automatically done if you have Hugo 0.20.0 or greater. In the recent releases, Hugo introduced [Output Formats](https://gohugo.io/extras/output-formats/). The extra formats let you spit out your code with RSS feeds, AMP, or (yes) JSON formatting automatically.
In this example, since I only want to make a master index file with everything, I can do it by telling Hugo that I want my home page, and only my home page, to have a JSON output. In order to do this, I put the following in my `config.toml` file:
If I wanted to have it on more pages, I could do that too. I don’t.
Next I made a file in my `layouts` folder called `index.json`:
To generate the file, just run a build and it makes a file called `index.json` in the site root.
## How do you statically build JSON Files?
Do you have a trick or an idea of how to make building JSON files better? Leave a comment and let me know!
**Categories:** How To
**Tags:** hugo, javascript, json
---
### [Sharing Content with Static Sites Dynamically](https://halfelf.org/2017/sharing-content-static-sites-dynamically/)
**Published:** May 8, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using a little jQuery to make my static site more dynamic.
**Content:**
When I wrote how to [serve content to Hugo](https://halfelf.org/2017/sharing-content-hugo/), I did so using something that was mostly static. You see, that code requires someone to push a new version of the Hugo site to rebuild the pages.
Now let’s be serious, who wants to do *that*?
## The Concept
Sadly, you can’t just include a PHP file in Hugo (or any static site builder) and have it echo content. Their whole point is to be static and not change. And my problem is that I immediately ran into a week where I knew the message on the header was going to be changing *daily*.
Ew, right? Right. So I looked at that which I should be embracing deeply. Javascript. Or in this case, jQuery and the `getJSON` call. Yes, that’s right, with jQuery you can [call JSON](http://api.jquery.com/jquery.getjson/) and output it where you want.
I *do not* recommend doing this for full page content. This is only vaguely smart if you’re trying to output something small that loads fast and isn’t going to mess up your site if someone has javascript disabled.
## The Code
What that code does is it grabs the JSON, sets the variable `content` to the value of the content’s ‘rendered’ setting. Then using `document.querySelector`, it tosses in the HTML to my class for `wpcontent` and I’m done.
**Categories:** How To
**Tags:** hugo, javascript, jquery
---
### [FacetWP and Genesis Pagination](https://halfelf.org/2017/facetwp-genesis-pagination/)
**Published:** May 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making pagination from Facet match Genesis.
**Content:**
If you use [StudioPress’ Genesis themes](https://helf.us/genesis), you may be used to that pretty numerical pagination instead of ye olde previous and next buttons. And if you use [FacetWP](https://facetwp.com/), you may have found out you need to use their pagination to make things work right.
Thankfully this can be fixed thanks to two people’s previous work.
## Replace the Navigation
First we look to Sridhar Katakam who came up with [an elegant way](https://gist.github.com/srikat/63e37184312d090deb50#file-gistfile1-php) to replace the normal Genesis post navigation. The code is nearly the same, I just single-lined the returns:
The nice part about this is that if you’re not using FacetWP on that page, it reverts to the default pager. I’m not doing a check on if Facet exists because I have this in a giant block that does it for me. If you need to, though, the code would be this:
And yes, you should always check if the plugin is loaded before you break things.
## Style the Navigation
The styling magic comes from a slight fork of Matt Gibbs’ code to [remove pagination if there’s only one post](https://gist.github.com/mgibbs189/69176ef41fa4e26d1419):
This is somewhat obvious. It adds in `` around each page item, and also wraps the entire block in the default Genesis code of `` to produce the default Genesis display.
**Categories:** How To
**Tags:** code, facetwp, studiopress, themes, wordpress
---
### [Why I Write About What I Code](https://halfelf.org/2017/why-i-write-about-what-i-code/)
**Published:** May 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Write and code to be a better writer and coder. Yes, it's that simple.
**Content:**
I was asked this the other day. Obviously sometimes I write about technology in general, or software I find and like, but a great deal of the posts here are about how I figure things out. And the reason I do that is, simply, it makes me a better writer and a better coder.
## Want to write better?
There’s nothing that will make you a better write than writing. You will learn your voice, your tone, and your flavor of writing only if you write. It doesn’t matter if your writing is bad at first. By writing more and more and more you will only get better and better at the process, and more comfortable doing it.
Getting into the habit of writing, where it’s an every day occurrence in your life, is imperative if you want to write better. It’s a talent, yes, but it’s also a skill. And if you don’t practice skills they get rusty. If they get too rusty, they break and you give up.
## Want to code better?
The fastest way to get better at code is to read and review other people’s code and try to figure out how they did what they did. The reason I can continue to think as sharply as I do about plugin reviews is that I do it every day. Every. Single. Day. I look at 30 to 100 plugins, review the code as written by just as many developers, reverse engineer what they’ve done, and I start to understand better. I peer review people’s code, day in and day out.
But nothing makes you a better code than coding. Obviously. And yet there’s one thing most people miss. You see, the critical review of your *own* code is absolutely necessary if you want to become a better coder. And in the absence of peer reviewed code, the best thing to do is rip it apart yourself.
## Can you explain your code?
That’s it. That’s the magic. If you can explain your code, why you did what you did, why it does what it does, then you are at the step of critically reviewing your code. The number of times my code has improved because I’ve blogged about it is uncountable. As I write my post, I find myself typing “I used the function X because…” and I stop. Why *did* I use that function?
It’s in the questioning of my own actions that I begin to understand my own internal logic. You know, the part of your brain your parents and teachers helped you form. Those early days of logic where you learned fire was hot and one plus one was two, you also developed your *own* style of thinking.
## Can you explain why?
My father likes to tell me I used to do my math backwards, from left to right, before my school taught me otherwise. On occasion, I still do it that way because I want to look at my math from a different perspective. Talking about why I do that changes my understanding of the process. The solution was always the same, but the process of getting there is vastly different.
When I talk about why I chose the path I did, I do more than just verbalize to myself what I’ve done, I teach someone else that there’s an answer and there’s a way to their answers as well. I’ve shown a path.
## I write to understand myself
Above all else, I write to understand myself. Only by doing that can I improve at anything.
**Categories:** How It Is
**Tags:** coding, essay, oped
---
### [CMB2: Size Matters](https://halfelf.org/2017/cmb2-size-matters/)
**Published:** May 1, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Size matters. Screens are not infinite and people hate scrolling. So make it suck less.
**Content:**
One of the problems with adding a million custom meta boxes is that you have to arrange them in a way that doesn’t make the post editor suck.
In today’s example I have the following custom meta ‘items’:
- Featured Image: 1
- Taxonomies: 3
- Dropdown selections: 3
- “Rating” scores: 4
- Text Boxes: 6 (1 plain text, 5 TinyMCE)
That’s a lot of data. And it takes up a lot of space. Here’s how I made it less insane.
## Group your data
While it’s tempting to show all your post meta in one giant block, don’t. This can sound counterintuitive because the goal here is to *save* space, but the problem is that not everyone who edits a post needs all the information. Let’s pretend you’ve tasked your intern (or yourself) with going through 560 posts and editing *one* field. You can minimize everything else to make less scrolling, so group your items wisely.
Make a section for ‘These are totally required’ and put it on top. Put the ‘We’d like this data…’ in another section. And then the checkboxes and yes/no dropdown can go into a sidebar. Less space, more filling.
## Use a grid
The first way to not go insane is to use [CMB2 grid](https://github.com/origgami/CMB2-grid). This allows me to combine related boxes into a simple grid pattern (hence the name) so they took up less space. The four ratings have commiserate text boxes, so with the grid I displayed the rating on the left and the text box on the right.
Similarly, all of my dropdown selections are small so I made a grid of two of them. They show up side by side in a sidebar.
## Only use TinyMCE when you have to
TinyMCE takes up a lot of room. But sometimes you really do need it and not just plain text. When you do, consider TeenyMCE instead of TinyMCE. TeenyMCE is a smaller version of TinyMCE, hence the name, and it only shows a small subset of the normal TinyMCE options. The advanced bar is gone completely. To use it with CMB2, you want to make the teeny option true:
And don’t worry, markdown works fine in the teeny window.
## Make TeenyMCE even smaller
Even with TeenyMCE, there were some values I knew we didn’t need. So I removed them:
You may not want to remove them all, but certainly you don’t need fullscreen.
## What are your tricks?
What do you do to keep your meta boxes from getting the best of you?
**Categories:** How It Is
**Tags:** cmb2, plugins, postmeta
---
### [Will You Help Me Sell My Plugin?](https://halfelf.org/2017/will-help-sell-plugin/)
**Published:** April 28, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** No.
**Content:**
I get asked this a lot. It comes with the territory, but people ask me to help them monetize their plugins all the time. And my answer is always the same.
## No
As much as I am a strong advocate of people making money off of WordPress, and as much as I support plugin and theme devs in their work, I’m not out here to help you run your business. While I do spend time thinking of ways to get people to pay for services and software, I don’t prioritize it, and most of my ideas are just that. Ideas.
Really what people are asking for is my ideas and my free work. And to that, I say no.
## Business Help Isn’t Free
If you wanted to *hire* me to help, to look at your code and to assist you in coming up with business strategies, based on my experience in the WordPress world, that’s a different matter. That gets a ‘no’ because I don’t have the time to dedicate to that work. I have a full time job that I do like, and I have some volunteer work I enjoy, and I have a very addictive side project. Since I enjoy being married, I don’t take on extra work right now. I don’t need the money.
But the point here, if you can’t tell, is that yes, I would expect you to pay me for my work.
## I’m No Good At Sales
Of course, keep in mind the fact that I’m a terrible salesman. I don’t like exaggerating what a product can do, I don’t like even suggesting a lie. I downplay. And that’s because I don’t like it when people promise the moon and only deliver low Earth orbit. I want realistic goals and possibilities. Can you do *anything* with this plugin? Sure. But it comes at a cost and I feel people should know that cost.
## I’m Hard to be Bought
Everyone may have a price, but my price is rarely money. I know this sounds weird, since I said I expect people to pay me for my work. You see, asking me to do you a favor for free doesn’t really happen. But also, asking me to do you a favor for *pay* won’t happen.
And by this I mean reviews.
I’ve been asked, many times, to review people’s themes and plugins and post about it here. And in general, I say no. I review the things I use and like *because* I use and like them. I’m driven by usability. If I like your ‘thing’ and I think people should hear about it, I’ll talk it up. If your thing is free or for sale, I don’t care. What I care is if your thing was what I needed and wanted, and I liked it.
## I Won’t Help You Sell
That’s not my deal. It’s not my deal on this blog. I’ve never been bought off for a review, I’ve never been asked “Would you review this product of mine?” unless I’ve already been known to use it. And even then, I’ve told people “You don’t want me to review it. I like it, but you have some bad bugs.”
I’m honest. I’m direct. I’m incurably truthful.
You probably don’t want me to help you sell your stuff, but if I really like it, I may anyway.
**Categories:** How It Is
**Tags:** essay, oped
---
### [CMB2, Select2, and Taxonomies](https://halfelf.org/2017/cmb2-select2-taxonomies/)
**Published:** April 26, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making taxonomies update based on CMB2 options, all so I can use Select2
**Content:**
I’m going to start with “This is not my best work.”
In using CMB2, I have created situations where it’s smarter to have the ‘normal’ WordPress taxonomy fields changed. Oh sure, they work most of the time for most things, but most is not all. In my situation, I had some custom taxonomies that I *did not* want people adding to from the post-edit screen.
To get around the issue, most of the taxonomies were drop-downs using the [`taxonomy_select`](https://cmb2.io/docs/field-types#-types-taxonomy_select) field type. That let me control the display and have the drop-down be the terms they could add. Anyone with admin access could add more, of course, but they’d see special notes about that. It gave me control.
The problem really arose when I had a multicheck list of terms to add. Yes, I had 1 to 20 terms that *might* be added. And while I could use [`taxonomy_multicheck`](https://cmb2.io/docs/field-types#-types-taxonomy_multicheck) to do that, it wasn’t perfect. It made the screen very large.
## Select2 is Better
[Select2](https://select2.github.io) is a jQuery replacement for select boxes. Using it, you can make a simple dropdown where you can have a single (or even multiple) selections, but also it has a nice interface for multiple selections:
That looks much nicer than a list or grid of 20 options. You click on the box and you get a dropdown:
## Select2 and CMB2
Thankfully there’s already a plugin/add-on for this with CMB2. Phil Wylie made [cmb-field-select2](https://github.com/mustardBees/cmb-field-select2) which I pulled into my site and it works quite well. Except… You can’t use it to save Taxonomy data properly!
This is due to a lot of complicated things, and while my first instinct was to complain to myself that core CMB2 could do it, and thus so could everyone, I know it’s not that simple. All the effort CMB2 put into making that work is little short of phenomenal. It was *hard* and it’s complex and it’s outright weird. I looked at the code and backed away slowly.
But that doesn’t mean it’s impossible. It’s just a little weird and it’s not my best work. But it does work.
## Show the Taxonomies
The first step is that you have to make a function to convert the taxonomy to something that can be used in a selection box. Thankfully Phil already did this and his [example code](https://gist.github.com/mustardBees/9eb84e47e8afce5ecad2) works:
Next you call that in your CMB2 code:
And now you can add taxonomy items via Select2. But … It doesn’t save the taxonomy data.
## Saving The Taxonomy Data
This is the part of code I’m not thrilled about. You see, the code in the previous section adds a new postmeta field for `theshows_genre` with an array of the IDs added. And that’s it. That isn’t what I wanted. I certainly could use the postmeta data to generate the output, but I used Taxonomies for a reason. They’re incredibly useful.
In order to save the data, I needed to take the content from the post meta and copy it into the values for saved taxonomies, but *only* sometimes. After kicking around the options, I decided that I would give priority to the postmeta, not the taxonomies. That would allow me to have them save the taxonomies all the time *unless* the post meta was empty.
This is not perfect code. It’s not even very good code, I don’t think. I’m not happy that I had to break the terms out instead of just using the the content from `$get_post_meta` but for some reason, `wp_set_object_terms()` wasn’t happy with an array of terms. It was fine with the slugs, so that’s the way I went.
The logic is basic. If there’s postmeta and it’s an array, it ‘wins.’ If it’s not, take the taxonomy data and push it into the term.
## Triggering The Save
But how to trigger that code? And where and when?
I wrote code for my custom post type that triggered a check every time the page was loaded. Which is why I don’t like it.
Obviously it’s not the best code out there. It runs too often, though at least it’s only on page loads.. It would be better if it only ran on save, however that had a problem with race conditions. I would end up with a case where the postmeta might still be blank. So having it run before the page loaded appeared to be my only hope. I also don’t like having the data stored twice, but there was a limit to how far I wanted to run with this.
Pull requests welcome!
**Categories:** How To
**Tags:** cmb2, jquery, plugins
---
### [Admin Alerts on Posts](https://halfelf.org/2017/admin-alerts-posts/)
**Published:** April 21, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Alerting editors to information in WP Admin makes sure people know what they're doing.
**Content:**
As the new WordPress.org plugin directory rolls out, I know a lot of people are fussing over the front end. I’m not for a very practical reason. I’m working on making the backend functional and educational.
## Information Is Key
A lot of the information about what a various post status means is something I understand from experience. My goal is to expand the team as broadly as possible and in order to do that, I must document. But documentation is more than just writing up a doc and telling people to follow it.
People need contextual reminders of what the status of a ‘thing’ is to understand what they must do next. With that in mind, I leveraged some code by Obenland to make [reviewer alerts better](https://meta.trac.wordpress.org/ticket/2693). Originally, you see, our plan was to let plugin developers edit things from the admin panel. Everything’s moving to the front end *except* for the reviewers you see.
## On Beyond Plugins
That’s all well and good, but what if I want to do it on my *own* sites? What if I wanted to have a site message for the editors on my site, so they’d know what posts are ‘done’ and which need some love? What if I wanted to encourage my fellow editors to edit a post I’d worked on?
I made my plan, based off the old [stub template from MediaWiki](https://en.wikipedia.org/wiki/Template:Stub), because that was always a good way to know if a post did or didn’t need some love.
1. I needed a way to ‘flag’ a post as a stub automatically
2. I needed it to display on the page being edited
3. I would like it to display on the front end but *only* to logged in users (for now)
## Stub Qualifications
In order to flag a post automatically, I needed to come up with criteria or qualifications that would mark a post as a stub. Obviously content was part of it, but measuring the quality of the content was going to be difficult.
My initial criteria for a stub was the following:
- Under 100 words in post content
- Empty meta value for “Worth it details”
Obviously that second item is unique to my situation, but having it meant I could measure engagement by how much someone knew about a show to enter the data. That criteria seemed too strict though. So I tweaked them to be an OR and not an AND. No matter what, if there was under 100 words it was getting flagged. And no matter what, if there was no meta for worthiness, it would be flagged.
- Info: No meta value for Worth It
- Warning: No meta value for Worth It and post content under 200 words
- Alert: No meta value for Worth It and post content under *100* words
## WP Admin Code
The original code that all this is based on is from [WordPress.org](https://meta.trac.wordpress.org/browser/sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php#L221) (not the WordPress code but the stuff that runs the domain).
The reason it uses `edit_form_after_title` and prints the error instead of `add_settings_error` is that I don’t actually want these alerts to be dismissible and I only want it to show on post editor pages.
## The Output
There’s some improvements to be made, but this is a start.
**Categories:** How To
**Tags:** admin, alerts, information, wordpress
---
### [Front Facing Alerts on Posts](https://halfelf.org/2017/front-facing-alerts-posts/)
**Published:** April 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making 'admin' alerts show up on the front end as well as the backend of a WordPress site.
**Content:**
Once I wrote the back-end code to show [admin alerts on posts](https://halfelf.org/2017/admin-alerts-posts/), I decided to add in some front end magic.
Since the original code was written to be called by hooking into the `admin_notices` action, the obvious solution was to hook into something on the front end. But where?
## Genesis
I’m a fan of the Genesis themes. There’s a handy hook for placement called `genesis_before_content_sidebar_wrap()` and the call (based on last week’s code) is this:
And immediately that outputs this below the menu:
Obviously there’s no CSS going on there, but that’s okay.
## Not Genesis
That’s lovely but what if I don’t use Genesis?
While a filter like `add_filter( 'the_title', 'MYSITE_admin_notices', 10, 2 );` would work, it also calls it for every output of the title on a page. If you happen to be using a sidebar that links to your 5 most recent posts, it can get pretty messy.
And the problem here is that WordPress *doesn’t* have standard template hooks like that. You can use `get_header()` but that puts it at the top of every page. There just isn’t a way to say “I want this above the title” and have it work universally on all themes. Bummer.
That said, you can totally make the `get_header()` call work with a little CSS magic and a little extra if-checks.
## The CSS Code
Remember our goal in life is to load as little as possible on pages, so the best thing is to check if this is even the right post type:
The actual CSS is up to you, but mine looks like this and is cribbed from WordPress core:
This basically reproduces the same CSS as you’d see on the Admin Dashboard.
## The PHP Code
While we covered the brunt of the PHP code before, we need to make a few alterations to make sure that the output only shows on the right pages and to the right people.
The first changes will be in this section:
While it’s possible to use `is_admin()` to check if a visitor is on the dashboard or not, this is going to show on both front *and* backend. That means a better choice is `is_user_logged_in()` so our code will look like `if ( $message && is_user_logged_in() )` and now it only shows if you’re logged in.
But. The code shows on *every* page. That meant the code showed up on the static front page because it had no code and just widgets. In order to make it only show up on the right pages, I put in a check for what was called when.
Since I have multiple CPTs, I keep the code that is post type specific in a file that matches the name, and I have an extra file called `all-cpts.php` that calls common code that they all use. This helps me keep my code dry (Don’t Repeat Yourself). That makes it easy for me to use a switch based the post type and output the right code on the right pages:
Now the message shows up for logged in users only, and only on the intended pages.
**Categories:** How To
**Tags:** alerts, information, wordpress
---
### [Add An Item to the Publish Box](https://halfelf.org/2017/add-item-publish-box/)
**Published:** April 19, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Showing post meta (or anything else) in the publish box is just a function away.
**Content:**
You know that box on the side of your posts? With “Publish” and it has some information? What if you want to add *more* information to it?
Jetpack does it. Yoast SEO does it. You can do it too.
## The Concept
We’re going to be using a hookable action called [`post_submitbox_misc_actions`](https://developer.wordpress.org/reference/hooks/post_submitbox_misc_actions/) that fires *after* the post date information.
In this example, I want to grab the content of a post meta variable called `char_count` to list the number of characters associated with the post. And since I like my site to look pretty, I want to use the [nametag Dashicon](https://developer.wordpress.org/resource/dashicons/#nametag) on the side of it.
## The PHP Code
The first part of the code is making it work. I’ve already talked about how I calculated [how many characters belong to a show and shared the data between post types](https://halfelf.org/2016/sortable-custom-columns-another-post-types-data/). At this point, I have the data nicely saved in every show post, as the aforementioned `char_count` post meta.
In order to display it in the publish box, the code looks like this:
You can replace the terms with whatever you want, however please note the naming conventions for the div’s classes. This will come in handy in a second.
## The CSS Code
The problem with the above code is that it’s not *pretty*. And frankly pretty things get used more when it comes to software. In order to handle this, the CSS looks like this:
That’s basically stolen from how Core does it for the publish icon, only changed to the nametag Dashicon. Change `content: "\f484";` to be what you want.
## The End Result
In the end, it looks like this:
Which is exactly what I wanted.
**Categories:** How To
**Tags:** metabox, post meta, wordpress
---
### [Local: For When You Don't Need The Kitchen Sink](https://halfelf.org/2017/local-dont-need-kitchen-sink/)
**Published:** April 7, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A review on the app Local by Flywheel. tl;dr? I like it.
**Content:**
The app formerly known as Pressmatic was bought by Flywheel and converted to be [Local](https://local.getflywheel.com).
I’d been wanting to try Pressmatic for a while, but had some ethical concerns about [paying when I knew the owner wasn’t paying his other employees](https://halfelf.org/2016/trust-money/). At this point, however, the damage has been done in a way I can live with, so I downloaded Local to play with.
## Local Is an App
The best thing about Local is that it’s an app. Vagrant is awesome, but it’s 100% command line, and while I’m fine with that, not everyone else is. The learning curve for VVV is steep and, given what you can do with it, it’s not a bad thing. I love it but it can be overkill when I want to work on my plugins. Local is an app, it looks like a Mac app and behaves like a Mac app, so it makes it more obvious how I use it and what I do with it.
## Syncing Data
My biggest issue with VVV (and VVV2) is I can’t sync folders from Vagrant to my desktop. This is a workflow issue and I know it. For me, I have dedicated folders for my plugin development, all saved in `~/Development/wordpress/plugins-git/` (with a folder per plugin obviously). That makes it easy for me to script updates by saying “For every git repository in this folder, do a pull.”
Since I do my development work on multiple computers, having as much of this automated as possible is important for my sanity, no matter how much Sara Lance tries to destroy it. Every time I log in to my computer, it runs `the update` which pulls everything down and syncs.
And all that means, for VVV, I have two options.
1. checkout a git repository into the plugin locations for my site and edit those, syncing them back up.
2. manually copy files over every time I update them
But with Local, I can use the add-on [Volumes](https://github.com/getflywheel/local-addon-volumes) which lets me map a folder on Local’s virtual machine to my local desktop. Now it’s not perfect, but with this script by Andy Fragen, I was able to set up my site with actual honest to goodness symlinks:
\[gist\]https://gist.github.com/afragen/748e4780b6057d4c41cf9e466557042a\[/gist\]
Now I just edit my repositories and magically they’re updated on Local. Faster development for the win.
(My own fork of Andy’s code [is available here on Github](https://gist.github.com/Ipstenu/f378eaf3779546d385ca7836bc87abc7) – I made some changes but not much.)
## Conclusion
I use both.
VVV is great. I love it when I’m working on WordPress core, or god help me, WordPress.org itself.
But when it’s just me developing my own software and testing? I like Local. It’s good.
**Categories:** How It Is
**Tags:** development, local, review, wordpress
---
### [Multi Faceted Connections](https://halfelf.org/2017/multi-faceted-connections/)
**Published:** April 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Doing a little complex filtering with FacetWP to split apart serialized data into something less messy.
**Content:**
That’s a pun because I’m using [FacetWP](https://facetwp.com/) y’all.
As you probably know by now, I have a site that has a lot of weird data. And one of the problems I ran into with FacetWP and my site was that I saved data in a serialized manner.
## Simple Arrays
Since characters can have multiple actors, the data is saved in a serialized array like this: `a:1:{i:0;s:13:"Lucy Lawless";}`
I want to be able to search for all the characters Lucy Lawless plays, even if someone else *also* played the role, so to do that I need to tell FacetWP to save the data twice, an entry for each actor. To do that, I use this code:
That saves two entries in the FacetWP table like this:
## Complex Arrays
Buuuuut I also have a complex array where I list a show’s airdates: `a:2:{s:5:"start";s:4:"1994";s:6:"finish";s:4:"2009";}`
Now that doesn’t look too weird, I know, but the problem is I wanted to be able to compare the start and end dates, so you could get a list of, say, all shows that were on air between 1950 and 1960 (two, by the way). In order to do that, I had to break the array apart into not only two values, but two separate sources!
In order to make that work, I do this:
That gives me two database entries like so:
The reason this is done is because I have a facet that compares the datasets for `lezshow_airdates_end` with `lezshow_airdates` and if the numbers are between them, that’s what it shows.
And this works because of this filter:
That creates a new custom field based on the values in `cf/lezshows_airdates_end` so I can compare between the two. And with a snazzy slider, I can do this:
**Categories:** How To
**Tags:** facetwp, plugins, wordpress
---
### [I'll Know A Duck When I See It](https://halfelf.org/2017/ill-know-duck-see/)
**Published:** April 14, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Quack. Quack. Quack.
**Content:**
After I complained about [the new SEO scam,](https://halfelf.org/2017/new-seo-scam/) someone pointedly argued it wasn’t spam. And it wasn’t a scam.
It is and it’s both.
## What Is Spam?
By it’s most basic definition, spam is an irrelevant or otherwise inappropriate message, sent on the internet, to a large group of people.
With that definition in hand, someone who interrupts a Slack or IRC meeting to tell a joke is spamming. At the same time, Tweeting inanities is not unless you cut into a conversation thread. And the different being that Twitter is always irrelevant so any comment there is expected to be appropriately inappropriate.
## Spam is More Than Spam
The issue is that spam has expanded to be more than just that simple blast of junk you didn’t care about. Spam now includes things like being added to an email list you didn’t want to join. And it includes people trying to rip you off.
A scam is an attempt to get something from you. The end goal of a lot of spam is to scam you out of money, so the intersection there is pretty high. It always has been. The result of a spambot is to convince you to do something you didn’t want, in order to get something you have. But the target of scams is to out and out separate you from your money.
## If It Looks Like a Duck …
You’ve probably heard of the duck test.
> If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.
When people read an email from some Nigerian prince, they know it’s spam because they’ve seen things like it before. But they also know it’s a scam because they’ve been taught that no one offers something for nothing.
## Unsolicited Emails Are Ducks
If you get an email you didn’t ask for, from someone you’ve never heard of, offering something that’s too good to be true (like ‘free backlinks’), it’s a duck.
If you look at the emails from these people who offer to help you fix your site and improve your links to broken locations, it’s a duck. It’s a scam, it’s spam, and you should delete it. Don’t even ask.
**Categories:** How It Is
**Tags:** ethics, scams, spam
---
### [Sharing WordPress Content with any PHP App](https://halfelf.org/2017/sharing-content-php/)
**Published:** April 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using WordPress to show data on any PHP site, via the JSON API.
**Content:**
Last week I explained how I [shared my WordPress content with Hugo](https://halfelf.org/2017/sharing-content-hugo). Now, that was all well and good, but there is an obvious way I can do this when I don’t have a tool that understands dynamic content?
I’ve got PHP so the answer is “You bet your britches, baby!”
## The First Version
If you just want to grab the URL and output the post content, you can do this:
Now this does work, and it works well, but it’s a little basic and it doesn’t really sanitize things. Plus I would be placing this code in multiple files per site (not everyone themes as nicely as WordPress, ladies and gentlemen). So I wanted to write something that was more easily repeatable.
## The Advanced Code
With that in mind, I whipped up a PHP file that checks and validates the URL, makes sure it’s a wp-json URL, makes sure it’s JSON, and then spits out the post content.
You can see I have some complex and some basic checks in there. The URL validation is done via a [PHP Library called StrictUrlValidator](https://github.com/franksrevenge/StrictUrlValidator). If I was using WordPress, I’d have access to `esc_url()` and other nifty things, but since I’m running this out in the wild, I make do with what I have.
**Categories:** How To
**Tags:** json, php, wordpress
---
### [Sharing WordPress Content with Hugo](https://halfelf.org/2017/sharing-content-hugo/)
**Published:** April 5, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sharing content between WordPress and Hugo with our new BFF, JSON.
**Content:**
When your life is just WordPress, there’s not a lot of headaches involved in making some posts and updating widgets and keeping your whole site in sync.
When your life isn’t *just* WordPress, it gets a little weird.
When you *want* to use WordPress to run your life a little more, you un-weird it by making it weirder.
## Rethinking Where the Content Lives
Normally we think about content living on its own site. Well, I have a ‘message’ that needs to be the same on five different domains. Just work with me here. The point is, if I want to update the header message on the five sites, I have to update five sites. Yuck.
Now, there are a lot of solutions to this. I decided I wanted one, and only one, place to update the header message. The most obvious is making a static text file that I could update when needed and import/include it in everywhere. But as I started looking into how I do that, my eyes drifted to WordPress.
What if I used JSON? What if instead of a file, I made a page on WordPress, grabbed the content from `https://example.com/wp-json/wp/v2/pages/12345` and parsed that so I didn’t have to do a whole mess of editing anywhere but on WordPress?
## Hugo
Guess what. That works. And it works extra well for [Hugo](https://gohugo.io) (a static site generator I’m fond of) because Hugo understands [dynamic content](https://gohugo.io/extras/dynamiccontent/). The one drawback is that it can’t live refresh remote data, so I will always have to push a change to the site to trigger this rebuild.
However if you ever wondered how to include WordPress’ JSON data into a Hugo theme, here’s what I have in my template for `utility-bar.html`:
The reason `safeHTML` is there is that otherwise Hugo wants to escape my HTML. Which is a wise choice! Default to not trusting.
This outputs the post content and I have a happy (enough) day. The more I look at it, the more I realize how much I can do with WordPress and Hugo, since regenerating the site just takes a push of Hugo content.
**Categories:** How To
**Tags:** hugo, json, wordpress
---
### [Genesis Themes: Author Box Shortcode](https://halfelf.org/2017/genesis-themes-author-box-shortcode/)
**Published:** April 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Author boxes as a shortcode? Surely you jest!
**Content:**
In building out a network of sites, I was struck upon by a feature of multisite I love, a feature of a theme I adore, and an inconvenience of the combination.
## Author Box
StudioPress’ Genesis themes include a feature called “Author Box” which allows authors to create bios from their profiles and show them at the bottom of posts. When you have multiple authors on a site, this is a great way to make sure everyone gets credit and that they can control it.
The code to make this show up is included in most (if not all) StudioPress themes, but if you need to add it for your post archives and single posts, it looks like this:
## Multisite Magic
Once the code is enabled, and once someone’s written a bio, their author box shows up for all sites on the network. This is great for what I needed, as it meant everyone had control and I could just set it and forget it. The only ‘annoying’ part is it’s the same bio for all sites, so if you have wildly different sites on your network, this may not be right for you.
This does harken back to my age old comment: WordPress Multisite is for a network of somewhat related sites.
By this I mean if all the sites on your network are related, let’s say for a school, then it doesn’t matter that everyone’s bio talks about their school work. But if you combine the school with hobbies, then it gets weird to announce that the champion archer has a PhD in neuroscience. Although that is pretty cool.
## Display The Author Box Anywhere
The other problem with the author box is you can only use it on pages or posts as context. Which is not what I wanted here. So I made it a shortcode.
This is obviously skewed towards Genesis themes, but realistically other than the code in `$gravatar_size` you can use this for any theme anywhere. The benefit of Genesis here is that most, if not all, of the CSS is done for you. The shortcode is `[author-box user="ipstenu"]` and it dumps out a full width user box of your named author.
## Display Multiple Boxes Instead
But… What if you wanted a grid? Or a group of IDs? Taking advantage of the fact that Genesis comes with columns, the code looks like this:
The shortcode here is `[author-box users="ipstenu, liljimmi"]` and that puts out a column of either fullwidth, half, or a third. The default is a half, and if there’s only one item, it goes to full width, but I only put in a 1/3rd check because I didn’t feel the need to cover everything. If you want to nick the CSS, [StudioPress put it up online](https://gist.github.com/studiopress/5700003), and you can extend it as you want.
**Categories:** How To
**Tags:** code, genesis, shortcodes, studiopress, themes, wordpress
---
### [The New SEO Scam](https://halfelf.org/2017/new-seo-scam/)
**Published:** March 31, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The bottom line is that if it looks too good to be true, it is. No probably about it.
**Content:**
The email looked innocuous.
> I was just browsing Ipstenu.Org and saw in this post (link from 2002) you were interested in tech, and so I thought you might also be interested in linking to a resource we put together on the ways technology is improving health.
It went on to tell me about how they were comprehensive, up to date, etc etc. I admit, I wondered how they got my email in the first place, since it’s not listed on my site on purpose. But barring anything nefarious, I assumed they guessed, and since it wasn’t important to me that a personal blog post from 2002 get updated, I deleted the email.
Every five days after then I got a ‘follow up’ email from this person, Camilla Hathaway, and it was strange. I didn’t reply so why would they keep doing that?
But then I got an email from another company about a different post, asking me if I wanted to link to their article about ddos protection. And another from a third company for a post about cPanel.
They all sent follow up emails and they all were very ‘nice’ about it, praising my writing and telling me about broken links.
## Spam by any other name…
If the email was about running a banner ad on CNN for $725, you’d know it was spam.
If it was from the FBI telling you the corrupt government owed you millions, you’d know it was spam.
This appeared to be from a real person, a real reader. Except for the fact that there was no way they should have been able to find that particular email address. Except for the fact that they kept email. Except for the fact that who the heck reads old posts on a personal site from as far back as 2001 (I’ve been blogging a long time) and tell me that a link is broken or the information is out of date.
It’s weird, isn’t it?
Well, it’s spam.
## The New Spam Game
The old SEO spam was a lot more overt.
> We are a Leading SEO & Web Development Company and one of the very few companies which offer organic SEO Services with a full range of supporting services such as one way themed text links, blog submissions, directory submissions, article writing and postings, etc.
or
> I was doing some research on \[Subject\] and landed on your website.
You know the obvious ones. These new ones are more clever. They sound more like people. And the worst part is they aren’t all fake people.
You see … A real company, a legit company, run by real people in the UK, spammed the hell out of me with offers like this. Every day for almost two weeks before I blocked the accounts. This was after I pinged them on Twitter and asked them to leave me alone.
I shouldn’t have to.
If I don’t reply, I’m probably not going to. But I surely am not going to reply within a day if you email me daily. The new spam game, the new *scam* game is to be nice and hammer you with a request over and over and over.
## If It Looks Too Good To Be True, It Is
The bottom line is that if it looks too good to be true, it is. No probably about it.
**Categories:** How It Is
**Tags:** oped, seo, spam
---
### [The Grammar of URLs in Email](https://halfelf.org/2017/grammar-urls-email/)
**Published:** March 29, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using URLs in your written copy isn't impossible, it just requires a bit of thought. Like everything else.
**Content:**
At many points in time I’ve complained that if you have a URL in your email, don’t use a period at the end of it because that can break links. That led to me being asked what the proper usage of URLs with punctuation actually is.
This is not the law but it’s the rules I’ve come up with to ensure readability, linkability, and sanity when emailing links.
## Assume no HTML
It would be easier if I just said “Visit [example.com](http://example.com)” and it was a link. You’d know what to do. You click on a link. The problem is not all email clients are HTML friendly. I’m aware it’s 2017. The fact is, the world is not as advanced **globally** as you might wish. Thus we have to assume that we will be emailing someone who cannot see HTML.
Arguably that means they’d see `example.com` and that may be okay to some of you. It’s not to me, since I aim for the lowest *common* denominator, and I know that modern email clients will convert `http://example.com` to a link for me. Therefore the correct solution is to send only the URL, without HTML surrounding it.
## Style Manuals
The Chicago Manual of Style, which has been updated a few times, suggests you format footnotes with URLs as follows:
- Fiona Morgan, “Banning the Bullies,” *Salon*, 15 March 2001, `http://www.salon.com/news/feature/2001/03/15/bullying/index.html` (accessed 24 Feb. 2003).
Now in their example, there’s a space before the accessed date, so it’s easy to prevent errant trailing characters, but also they have a space *before* the link to make sure there’s no mistake there as well. The lesson to take away from this is that your URLs shouldn’t be marred with punctuation.
## Punctuation
I believe the correct use of a URL is to *never* prepend or append punctuation. Or in other words: Do not end your sentence wth a URL.
- Good: Please visit http://example.com/
- Bad: Please visit http://example.com/.
That trailing period? That’s bad. That will break on a lot of mail readers. But back to my gleanings from the manual of style, the correct usage is with a space on either side. In order to force that we can just remove the period but then do we use a capital letter for the next sentence?
## The Best We Can Do
Grammar means we put words in a specific order to have a specific meaning. The same holds true for using URLs in our content. We must be aware of their context and placement.
Some good examples:
> Please visit our site at http://example.com for more information.
Or
> If you look at their website – http://example.com – you can see the magnitude of their errors.
In both of those cases, we’ve put the URL in the middle of the sentence either prefacing it with an ‘at’ or using hyphens to indicate the URL is something special. The second way highlights the URL more in a text-only environment.
Alright, what if you want to tell someone to download a link?
> Lorem ipsum blah blah blah
> Download the code here: http://example.com
Notice how I put the download link on it’s own line? That breaks it out visually as well as generating a call to action. Download the code here.
**Categories:** How It Is
**Tags:** email, grammar, internet
---
### [Trust No One](https://halfelf.org/2017/trust-no-one/)
**Published:** March 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The kinds of users and the kinds of trust each user engenders.
**Content:**
A constant refrain for my security reviews of plugins and themes is to sanitize everything. And sometimes my pedantic nature of sanitizing *everything* leads people to ask me why I don’t trust users.
The short answer is “Because I am one.”
The longer answer is that I believe in three types of users, and I’m aware of their character flaws.
## Users
Most people on the internet fall into this category. They know how to log in and check email and read a blog post. Maybe they leave comments, maybe not. These people are the most basic of them all, but that isn’t a bad thing at all. Users do what they want and don’t often think about the consequences, because for them there really are none except saying things they didn’t mean or wanting a comment deleted.
These users are dangerous because they don’t think about what they’re doing. They trust, blindly sometimes, that the websites they visit won’t hurt them. That means that data they input has to be sanitized and validated because they may not realize what they’re doing. They may put a URL in the email field of your comment form, and they should be warned about those things.
You can’t trust the users because they don’t know any better.
## Experienced Users
This is actually *not* the most dangerous category. You might think they would be, because they know enough to be dangerous. Instead, I’ve found these users know enough to be cautious. They know what they don’t know, and they’re careful about what they’re doing. They check six or eight times before they paste in data, and they read error messages. Oh yes, these people. You know them, don’t you? They send screenshots of errors a test out theories before telling you “This is broken.”
We like those people, though you may be wondering what about the experienced users who don’t do the legwork. To me, they’re users. There’s nothing wrong with being a user, but it changes *my* expectations on what they do and who they are. If someone is experienced, though, they’re going to play with things and that means they might break things when they try to recreate the problems.
You can’t trust the experienced users because they mean well.
## Admin Users
These are the users who terrify me the most, and sadly, this is where most WordPress users actually are. Because if you’ve installed your own version of WordPress, you *are* an admin user. God save your soul. And here’s why they scare me: they have more power the an the experience user but the skill of a user. They’re kind of like toddlers.
This is not meant as an insult. The problem is that, unchecked, they can destroy their own sites. They copy and paste code or content into the post editor. In fact, that’s the biggest problem. Many years ago, my friend John and I spent five days debugging a crash, all because we didn’t know that no one who knew what they were doing would ever enter that data format into a field, and since we were admins, the check was overridden.
You can’t trust the admin users because they have phenomenal cosmic powers.
## Trust No One
Not to sound all Fox Mulder on you, trust no one’s data. Especially not your own. Don’t assume you know what you’re doing, that you never typo, that you’re always right. You’re not. No one is. And we don’t trust data because we could be wrong. It’s just that simple.
**Categories:** How It Is
**Tags:** essay, oped
---
### [(Slightly) More Performant WP Queries](https://halfelf.org/2017/slightly-performant-queries/)
**Published:** March 20, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Theoretical performance gains on your WP_Query calls.
**Content:**
One of the things 10up lists as a [best engineering practice](https://10up.github.io/Engineering-Best-Practices/php/) is this:
> Do not use `posts_per_page => -1`.
> This is a performance hazard. What if we have 100,000 posts? This could crash the site. If you are writing a widget, for example, and just want to grab all of a custom post type, determine a reasonable upper limit for your situation.
This is a very valid point, but I found myself stymied at how to work around it in a case where I knew I needed to check *all* posts in a custom type. And worse that post type was growing every week by 10 to 20. In my case, the reasonable upper limit was an unknown that was also unpredictable. But an endless loop would also be bad.
One of the other recommendations from 10up is not to run more queries than needed. I was already using `no_found_rows => true` to prevent counting the total rows, as it’s really only necessary for pagination. I also force in the post type I’m scanning, which again limits how many possible items will be queried. And yes, I have `update_post_meta_cache` and `update_post_term_cache` set to false as in most cases those aren’t needed either.
But what could I do to make the actual query of getting how many posts of type A had a post meta value that matched post type B? And to make it worse, I could have multiple values in the post metas. It’s really a case where, in retrospect, making them into a custom taxonomy might have been a bit wiser.
What I decided to do was limit the number of posts queried based on how many posts were in the post type.
`posts_per_page => wp_count_posts( 'custom_post_type' )->publish;`
I’m not quite concerned with 100,000 posts, and I have some database caching installed to mitigate the load. But also I have set an upper limit and this feels less insane than the `-1` value. Since I had to generate the count *anyway* for displaying statistics, I moved that check to a variable and called it twice.
**Categories:** How To
**Tags:** coding, wordpress
---
### [CMB2: Repeatable Groups](https://halfelf.org/2017/cmb2-repeatable-groups/)
**Published:** March 27, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some data migration of individual post metas into grouped post meta. Part of a continuing saga in how Sara Lance wants to drive me insane.
**Content:**
This is something that the plugin does out of the box, but my reason for doing it was a little odd.
## Background
Originally, I had a set of TV characters as a custom post type and each one had their own TV show. Since the TV shows are a second post type, the data was saved as a number and that number was used to generate data on the show pages. Look for everyone who has a TV show value of the same ID as the post ID. Yay!
The problem with it was spinoffs and crossovers. As time went on, certain characters began to appear on other shows. And it only got worse, until at length there were 30 characters on more than one show, and the number was only growing.
The quick fix was to make the shows value a repeatable field in CMB2, where I could add multiple shows. Done and done. But then we reached critical mass with how we were handling character *roles*. Was the character a main, a recurring, or a guest?
## Shows and Roles
Breaking down the problem to it’s most simple, we have one data set:
- Show (stored as an ID in an array)
- Role Type (stored as plain text)
Instead of saving it as a data set together, the shows were one field (an array, as I mentioned) and the role types were another (a text field).
In order to make this work, I would have to:
1. Create a field ‘group’ in CMB2 that stored both show and role as related to that show
2. Make that group repeatable for characters on multiple shows
3. Migrate the data
## Data Migration
There are a lot of ways around this. I ended up with going for the super simple route. I exported two CSVs from my database: one of the shows and one of the role types. Each one had the Post ID associated with it, so I opened those up in a spreadsheet app and combined them, for all cases where the Post ID was the same.
This gave me a new table that looked like this: `123, 456, regular`
More or less. The ones where shows were arrays looked like, obviously, arrays. I then converted that into a file with 1500 lines that looked like this:
I could have done it differently, grabbing a file with the data and parsing it on the fly, but I like to look at my 1500 lines and make sure I don’t have weird extra quotes lying around.
Once that was done, I ran the file, having it execute every line one at a time. It took about one episode of *House Hunters: International*.
## The CMB2 Code
In case you’re wondering the code to do this in CMB2 looks like this:
You’ll notice the options are a bit extra custom.
### Get Shows
This is done in two parts:
The reason we search for all shows, from draft to future, is that sometimes we like to schedule updates.
### Character Roles
**Categories:** How To
**Tags:** cmb2, data, migration, wordpress
---
### [EasyApache 4](https://halfelf.org/2016/easyapache-4/)
**Published:** June 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's totally possible that I upgraded to EasyApache 4 so I could have PHP 7 on some domains and not all.
**Content:**
While we use Ubuntu and Debian things at work, I have a CentOS server that is (as of today) on CentOS 7. Which means not only is it weird and uses yum, but it has cPanel and WHM installed.
Over the last year or so, cPanel has been working on EasyApache 4 (EA 4). EasyApache is their … easy way to manage Apache and upgrade things. It’s an interface to help make things like your LAMP stack easier to comprehend, and it’s actually pretty nice. EA 3 has been around for a while, and it has serious limitations. Like you have to re-run EasyApache to upgrade PHP (always annoying), and you can’t have multiple versions of PHP. That means when you upgrade PHP to 5.6, *everyone* is upgraded to 5.6, and damned be the conflicts.
This … was a problem.
I have some older code that can use 5.6 but I’ve not been able to fully test it on 7. And I want 7. You don’t even know.
The actual upgrade process is remarkably painless. I had two errors, one of which was my own doing (don’t try to use opcache if you don’t have opcache installed…) and one was math related. The majority of my settings ported over painlessly.
> AH00316: WARNING: MaxRequestWorkers of 40 is not an integer multiple of ThreadsPerChild of 25, decreasing to nearest multiple 25, for a maximum of 1 servers.
Obviously the fix there was to change MaxRequestWorkers to 50.
The interface itself is much nicer. It’s a modern design that is easy to look at with whitespace and tabbing that is natural. The only thing I didn’t like was I couldn’t tell it ‘Install PHP 7 and pick the same options as PHP 5.6 please.’ I ended up copying down what I’d selected for PHP 5.6 and then manually reproducing.
The provisioning process took a little getting used to, after years of EA 3, but once I had used it a couple times, it felt natural. This can be said of all things. Embrace change, right? It’s also faster, which is very welcome. The longest part is the review process, where it checks for conflicts. This used to happen ‘inline’ with the old deploy, so moving it out just changes the when. I found I preferred it, since I didn’t think “And I’m done!” I knew I couldn’t go forward.
Initially it installed suphp. I didn’t notice that’s what the default was and found all sorts of errors because of permissions. Errors like this:
I actually knew the fix for this was to run the following in my public\_html folder:
And yes, that solved everything. I was logged in as Ms. Groves root anyway, so I bounced through my users and ran it.
But… did I want to stay on suphp? Turns out EA 4 only supports FastCGI with the FastCGI Process Manager (PHP-FPM), and while I’ve been using that for a while (instead of the dread mod\_php). The problem there is that suPHP or CGI PHP handlers don’t support opcache. That meant I either had to suck it up and do the [manual install for FastCGI](https://documentation.cpanel.net/display/60Docs/PHP-FPM+User+Pools) *or* I could wait for v58 of WHM, which will have a UI.
I opted to wait and stay on suPHP right now. The domains on my site are pretty fast, thanks to the SSD and a well optimized server. Load time *did* increase, I won’t lie, but it was pretty negligible. I don’t think it’ll really hurt things at this moment. I did some quick tests on [GTmetrix](https://gtmetrix.com) and found my load time for sites on PHP 7 actually *decreased*.
And that’s why I wanted PHP 7. It’s just *faster*.
**Categories:** How To
**Tags:** centos, easyapache, php, upgrading
---
### [A Day Without Me](https://halfelf.org/2017/a-day-without-me/)
**Published:** March 8, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A day without a woman. Today.
**Content:**
For the first time in over three years, there will not be a post about tech or tech adjacent items today.
Today, March 8, 2017, is International Women’s Day. And today I do no work.
Read more about [A Day Without a Woman](https://www.womensmarch.com/womensday).
**Categories:** How It Is
**Tags:** oped, politics
---
### [You Are Not Psychic](https://halfelf.org/2017/you-are-not-psychic/)
**Published:** March 15, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You don't know what will be insecure next. You can't. So secure your code as best you can and secure it better if people point out your shortcomings. Learn. Improve. Protect.
**Content:**
The other day I hear someone mention that they were securing software that they didn’t even have the words for 5 years ago. That reminded me of how fast technology moves. Things that didn’t exist last year are vulnerable today, and the discovery of those things only happens faster as we invent weirder and weirder ways of reinventing the wheel.
## The Myth of Perfection
A well known saying is that the perfect is the enemy of the good. We take that to mean that if we wait until a thing is perfect, we will never feel it is done enough and ready enough for the world. In Open Source technology we’re fond of releasing and iterating, accepting the lack of perfection and aiming instead for the minimum. What is ‘good enough’ to let people use our work and improve on it?
Perfection doesn’t exist. There is nothing on the planet that is perfect and there never will be. But accepting this doesn’t mean we allow imperfection and danger into our lives.
## The Balance of Reality
> Everyone screws up code, no matter how awesome a professional you are. Accept it 🙂
I said that nearly three years ago, and I’ve argued before that it’s okay to screw up. I really do believe that making mistakes isn’t a bad thing. But at the same time, many people understood that to mean I was alright with shipping code that I knew was bad. This is not at all the case.
If you know your code is bad or insecure, you fix it. Period. You don’t let things you *know* are bad out the door. But you *do* release things that work and perhaps lack all the features you want. There’s a difference between releasing bad code and releasing imperfect code.
## The Attack of Security
To turn this on its ear a little, if someone comes up to you and says “This code is wrong, you should do this other thing.” then you have a choice. You can listen and believe them and study if they’re right and test it and fix it, or you can ignore it.
When someone you respect tells you those things, you’re inclined to believe them. But at the same time, your heart takes a hit because “this code is wrong” sounds *a lot* like “this code is bad.” And that sounds like “you wrote bad code” and that *feels* like “you’re a bad coder.”
That slope slipped right down, didn’t it? It’s a reality. It’s in our nature to take admonishments of our work as a personal attack, even if they are rarely meant that way. I can count on my hands the number of times I’ve actually told someone they were a bad coder. I can count on one hand the number of times I’ve told someone who wasn’t *me* that they’re a bad coder. I’ve certainly said it to myself a lot. I believe I’ve told one person directly that I thought they were a bad coder.
I don’t think they actually understood what I meant… Which says something.
## The Shield of Arrogance
We are not psychic. If you are, please let me know who to bet on for the World Series. Being humans, and therefore fallible, we cannot be so arrogant as to presume we know all the possible ways our code might be vulnerable. Technology moves so fast that what looks safe today may turn out to be terrible dangerous tomorrow.
Knowing this, knowing we are imperfect, we know that our fellow humans are also imperfect. The greatest danger to our security is ourselves. And that means, as developer writing code to be used by others, it’s incumbent upon ourselves to protect our fellow humans from innocent mistakes.
## You are not psychic
You don’t know what will be insecure next. You can’t. So secure your code as best you can and secure it better if people point out your shortcomings. Learn. Improve. Protect.
**Categories:** How It Is
**Tags:** essay, oped, security
---
### [A Day Without Women](https://halfelf.org/2017/day-without-women/)
**Published:** March 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A day without WordPress. March 8th.
**Content:**
I am writing to inform you that I will not be working on March 8th.
The [Women’s March](https://www.womensmarch.com) organized this day in the same spirit of love and liberation that inspired the march on January 21, 2017. Today, A Day Without A Woman, is a recognition of the value that women of all backgrounds add to our socio-economic system. It is to raise awareness and remind us all of the pervasive and systemic gender-based inequalities that still exist within our society, from the wage gap, to vulnerability to discrimination, sexual harassment, and job insecurity.
I am one woman. On any given weekday, I read a thousand lines of code. I review between 30 and 60 plugins. I write at least 2,000 words on WordPress.
But not March 8th.
On that day, I will review no plugins.
On that day, I will answer no questions in the forums.
On that day, I will not work on WordPress.
I’m one person, and I do shy away from the political on this blog, but now, this year, this time is different.
I understand if you can’t, we can’t all afford to do this, we can’t all risk this. But I can. And I will. Because I am one person, but my family taught me to care about everyone, not just myself. I am one person, but together we are a nation. I am one person, but I am not alone.
So on March 8th, there will be no WordPress for me.
I hope you will stand in support of me, and any of my friends and colleagues. I hope that everyone will give women workers today off without retribution. I hope you will all stand with me and others.
I know this is a big ask, and I know a lot of you can’t. I understand that, I respect that, and I support that. We need to eat.
I am dedicated to my work. I am dedicated to WordPress and DreamHost. I respect them, the work we do, and their values. And I am grateful my company *does* support me when I chose to do these things. I am lucky and thankful and grateful I won’t be fired for taking this day off.
At an increasingly insecure time for the rights of women and other minority groups, it is important to me that I also stand for the value of equality.
I hope you, the people who read this, will support me in my decision. I hope you will join me if you can.
**Categories:** How It Is
**Tags:** oped
---
### [Access: Denied or Granted?](https://halfelf.org/2017/access-denied-granted/)
**Published:** March 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A nonce of your time to discuss what a user can and cannot do.
**Content:**
One of the topics I discuss regularly with developers it that of access. When writing any code, we must always consider who should have access to it. Not in the ‘who can look at my code?’ aspect, but that of who can *run* the code.
This happens a lot with plugins and themes when people create their own settings pages. While I’m the first to admit that the settings API in WordPress is a bag of wet hair that makes little logical sense, using it gives you access to a lot of built in security settings, such as nonces.
But as I often tell people, a nonce is **not** bulletproof security. We cannot rely on nonces for authorization purposes.
## What is a Nonce?
A nonce is a word or expression coined for or used on one occasion. But in security, a nonce is an arbitrary number or phrase that may only be used once. Due to it’s similarity to a nonce word, it reuses the name. In WordPress, it’s a pseudo-random number created on the click of (say) a save button, to ensure that someone had to press the button in order to run the function.
For example. If your settings page has a nonce, then the nonce is generated on click and passed to the function(s) that validate and sanitize and save. If the nonce doesn’t check out, then WordPress knows someone didn’t press a button, and it won’t run the save. This prevents someone from just sending raw data at your code.
## Why isn’t that enough?
With just a nonce, anyone who has access to the page can save data. This is okay when you think about something like a comment form or a contact form. Those are things that need to be accessible by non logged in users, right? What about the WordPress General settings page? The one that lets you change the URL of the website? Right. You only want that to be accessible to admins. Imagine if all logged in users could change that one. Yikes!
In order to protect those pages, you have to consider *who* should have access to your code.
1. Are the users logged in or out?
2. What user permissions should be required?
3. How much damage can be caused if the data is changed?
That’s it. That’s all you have to ask. If it’s a contact form, then a nonce is all you need. If it’s a site definition change, then you may want to restrict it to admins or editors only.
## The Settings API
When you use the settings API, some of this is made pretty straightforward for you:
In that example, the third value for the options page is `manage_options` which means anyone who can manage site options (i.e. administrators) can access the settings page.
The problem you run into is if you want a page to do double duty. What if you want everyone to see a page, but only admins can access the settings part? That’s when you need to use `current_user_can()` to wrap around your code. Just check if a user can do a thing, and then let them in. Or not.
## What Permissions are Best?
In general, you should give admins access to everything, and after that, give people as little access as possible. While it may be annoying that an editor can’t, say, flush the cache, do they really need to? You have to measure the computational expense of what’s happening before you give access to anyone. It’s not just “Who should do a thing?” but “What are the consequences of the thing?”
Look at the cache again. Flushing a cache, emptying it, is easy. But it takes time and server energy to rebuild. By deleting it, you force your server to rebuild everything, and that will slow your site down. An admin, who has access to delete plugins and themes, should be aware of that. An editor, who edits posts and menus, may not. And while some editors might, will all?
This gets harder when you write your code for public use. You have to make hard decisions to protect the majority of users.
Be as prudent as possible. Restrict as much as possible. It’s safer.
**Categories:** How It Works
**Tags:** coding, security, wordpress
---
### [Datepicker and a Widget](https://halfelf.org/2017/datepicker-and-a-widget/)
**Published:** March 13, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding a jquery datepicker to my widgets.
**Content:**
Last week, I worked on making a plugin that would safely and smartly allow for a date selection, and not permit people to put in junk data. I had my code ‘clean’ and only accepted good data, there was one question remaining. How do I make it look GOOD?
Let’s be honest, pretty data matters. If things look good, people use them. It’s that simple. This let me play with another aspect of coding that I don’t generally look at. Javascript.
## What Code Do I Need?
There are a lot of ways to tackle this kind of problem. If you wanted to just list the months and days, and have those be drop-downs, you could do that. The option I went with was to have a calendar date-picker pop up, as I felt that would visually explain what the data should be.
To do that I needed a date picker jQuery script (which is included in WordPress core) and a second script to format the output.
## My Script
This part is really small:
All it does is force the format to be “mm-dd” – so if you picked the date, that’s what it would be.
## Enqueuing the Scripts
In order to make sure the scripts are only loaded on the widgets page, my enqueue function looks like this:
The CSS is because, by default, WordPress doesn’t include the jquery UI CSS.
## Calling the Scripts
In the widget class, I have a function for the form output. In there, I have an input field with a class defined as `datepicker`, which is used by the jquery I wrote above, to know “I’m the one for you!”
## Making it Pretty
To be honest, once I got the JS working, I left the default CSS alone. Why? Because I’m a monkey with a crayon when it comes to design. The default worked fine for me:
It does make me think that it would be *nice* if WordPress included their own customize datepicker colors in the admin colors, but I understand why they don’t. Not everyone or even most people will ever need this.
**Categories:** How To
**Tags:** coding, development, javascript, jquery, wordpress
---
### [Names, Short Names, and More Names](https://halfelf.org/2017/names-short-names-names/)
**Published:** March 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Naming things is hard. It's harder when you're not sure who's going to be using your things. Thankfully I have a friend who inspires me to think deeply.
**Content:**
I was working on a side project with Tracy Levesque of Yikes! and she lamented at my readme. I had totally half-assed it and I knew it, so she cleaned it up and asked me “What are the shortcodes?” I told her and about a second later she suggested two new names. Hers were better.
## Functionality Based Names
I have a habit to name things what they are. I made a shorcode, for example, for a number of posts in a custom post type, and I called it `[numposts]` because that made sense. But when I added in a new one for number of posts in a taxonomy, I made a *second* shortcode named `[numtax]` which is kind of silly isn’t it?
My problem is that I think about each shortcode as it’s own, stand-alone entity. It’s a functional thing. It does a thing. A function should be named uniquely to be clear what it’s for.
## Usage Based Names
Perhaps without meaning to, Tracy jolted my brain into thinking about not the developer but the end user. Now, in my head, I thought “The user would know which shortcode to use and doesn’t have to think about more.” But. She suggested this: `[plugin-name data="type"]`
I stared at that for a moment and felt the light slap me in the face. I’d named the shortcode for their function, but not for the *plugin* they were in, which is akin to all those terribly named functions and classes I’m always ranting about. In short order, the plugin was fixed and I turned back to my posts code.
## One Name to Bind Them
The code defaults to a data set of `posts` and a post type of `post` since those are the most common usages. After that it’s a fast check “Is this a posts data set or a taxonomy one?” and runs the same code it used to run, passing the data along.
## What’s Really The Difference?
“But Mika, now people have to type in more!” I hear you say.
They do. `[numposts]` defaults to posts like it always did. `[numposts posttype="page"]` is four characters longer. But with the four extra characters (and really I could have left that out) comes something simpler: people only have to think of one shortcode.
If they want to count the number of posts, then they just count the number of posts and call it a day. There’s no headache of realizing they meant to get the number of posts with a specific taxonomy. It all just works with one. Remember your terms, and those didn’t change except for needing `[numposts data="taxonomy" term="wordpress"]` which actually makes it *more* obvious what you’re doing.
I have no idea if Tracy meant for me to get this deep into this, but she also knows I spent an hour contemplating the fact that the word ‘read’ exists in multiple tenses, and it’s only by context that I actually know which one anyone meant.
**Categories:** How It Is
**Tags:** coding, development, wordpress
---
### [REST API - Democratizing Reading](https://halfelf.org/2017/rest-api-democratizing-reading/)
**Published:** February 24, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using the REST API in WordPress will let you democratize your readers' experiences.
**Content:**
Democratize Publishing.
We say that a lot in WordPress. We boldly state that the goal of WordPress is to democratize publishing through Open Source, GPL software.
I’d like to turn that on it’s ear for a moment.
The purpose of the REST API is to democratize *reading*.
## Democratize Discovery
One of the myths of websites is that if you build it, people will come. If that was true, we’d never need plugins like Yoast SEO and we’d never need to self-promote. The reality is that we have to work hard and make our content good. WordPress helps us make it look good, and makes it easier to get it out there, and usually the rest is up to us.
There’s another aspect to discovery, though, and that is the ease of findability. We already address this in WordPress to a degree with RSS, but as much as I’d love to say that was that, it’s not. It’s 2017. People don’t want RSS, they want email and they want the information on social media immediately.
And? They want *apps* on their phones that alert them to new data.
## Democratize Consuming
Reading data with WordPress is easy. We go to a webpage, we see the data, we consume, we move on. With emails and social media, people usually have to click to come to your site and read. While this is good for your traffic, anytime a person has to click you’re running a risk they might not click. That’s why Tweetstorms are more consumable than blog posts. While they are far more transient, they’re accessible in an immediate way.
Making the consuming of data more direct, a more one-to-one relationship, improves the chances that someone will actually read the information. Much of this can be achieved with a good lede, but readers are well to aware of click-bait today. “She tried this blogging software. You won’t believe what happened next!”
Right. You get the point. In order to get people to read, you have to make it *easier* for them to read. Converting WordPress posts to something an app can read needs to be easier for the blogger, or they won’t be able to have success.
## Democratize Reading
The REST API does just that.
It makes the discovery and consumption of your website *easier* by simplifying your output.
When you look at a website you see the design and the layout and the wonderful beauty. When an app reads your data, however, it doesn’t want or need any of that. An app needs the raw data. And the REST API does that. It outputs the data in a super basic and simple way. Furthermore, it lets you add on to this and output specific data in special ways.
## Democratize Publishing
You can publish your data in multiple ways. Today, we all know about the blogging aspect of WordPress. But here are some other ways you could share your data:
- Allow users to download a CSV with all the products on your site and their costs
- Create a plugin that calls custom data, allowing others to have a widget with the data
- Power a mobile app without loading your theme
Could you do all that without the REST API? Of course.
Does the REST API make it *easier* and thus help you democratize faster? Yes. It does.
The REST API can change your life, if you’d only let it.
**Categories:** How It Is
**Tags:** essay, json, oped, rest api
---
### [It Has Been X Days Widget](https://halfelf.org/2017/x-days-widget/)
**Published:** February 22, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a 'how many days since the last death' widget lets me use some functions I've been itching to play with.
**Content:**
[Yesterday I talked about ordering posts by post meta](https://halfelf.org/2017/display-posts-ordered-post-meta/) in a weirdly unique situation. Today I’m going to tell you about an even weirder one.
As I mentioned, what I’m working with is a list of all the dead characters recorded on a site. One of the aspects of this is to allow for us to show a widget that tells visitors how many days it’s been since the last death, and who it was. There are a lot of ways to do this, and one of them is manually updating, but no one likes this. If an event can be automated, everyone wins.
Since I’d already done the lion’s share of the work, forking it over into a widget and grabbing the last (i.e. most recent) death was easier.
## The Code
I broke this up into two classes because it’s habit. I have no other reason.
Which looks like this:
## An Explanation
Some things to note.
While I only allow for customizing the title, I’ve left my arguments as an array in order to let me extend it later. What if, for example, I want to display the featured image as well?
I’ve also left in some ‘default’ calls to [Genesis’ StudioPress theme](https://helf.us/genesis) with regards to the widget layout. That’s because I wrote this for a StudioPress theme.
The whole reason the death year is an array is that, as I mentioned the other day, people may die multiple times. Insert Buffy singing “Hey I died twice” here. I have to get all the dates, pick the largest number (which is the most recent date, remember Unix timestamps are forever increasing), and save that one. Once I find the ultimate largest number, I know that’s my character to save. Problem is I have to go through them all to figure out who died last.
I’m inordinately happy about getting to use `array_slice()` to grab the final item in an array, and ditto `array_shift()` to move the multidimensional array to a single dimension.
Using `array_shift()` changed this:
to this:
And getting to finally use `_n()` in a non-translation sense was fun.
The reason the dead characters are in a function in the first class is that I plan to extend this code later on, maybe making a shortcode or a JSON API call. Who knows!
Finally, I mentioned that there were two ways to list the dead characters. One was by a taxonomy of character clichés and the other was by the death date post meta. In this case, I opted to sort by the taxonomy because if someone has a death date but is not marked as dead, then they were dead and came back to life.
**Categories:** How To
**Tags:** code, widget, wordpress
---
### [JSON Rest API (In Peace)](https://halfelf.org/2017/json-rest-api-peace/)
**Published:** February 27, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making my first REST in Peace API for a site. To show dead people. We all have our hobbies.
**Content:**
This week I’ve been talking about my list of dead characters, which I needed to [order by year](/2017/display-posts-ordered-post-meta) and wanted to display the [most recent death in a widget](/2017/x-days-widget).
Part of my end goal with all this was a dream I had to let people have a widget on their own site where they could display the most recently dead character. There were other ideas I had, like a ‘this day in YEAR, Character X died.’ But for now, I wanted to start my delving into the JSON API with something more simple.
Because this is my first serious go at it.
## Sketching Out The Concept
To do this, I broke my concept down into the logical steps of what was needed.
- Output the data
- Create a JSON URL
- Format the data there
And no, I have no idea how to do any of that, except outputting the data.
## The Rest API
To initialize the Rest API, you have to call a function on `init()` and that’s where it defines the URL that will be called. There are three (or four) parts to a URL:
- Namespace
- Version
- Route
- Arguments
The version isn’t *technically* required, but in the interests of future proofing, it’s probably a good idea. And in this specific case, I don’t have any arguments I want to pass through. You’re going to get *just* the output of the last dead. In deciding that, I was able to determine the most sensible structure.
My namespace should be for my *site*, not just this ‘show the dead’ feature. This is not always going to be the case, but since I’m adding in what I presume will be the first of some APIs, it’s wise to name in a way that is forward thinking. Similarly, I need my route to be logically named, and in this case I’m showing the last death, so I called it `last-death`.
This makes my desired URL `/wp-json/MYSITE/v1/last-death/` and the code is this:
The callback code is what gets my data, and based on my original widget resulted in the page displaying the following:
But I didn’t want it to be formatted like that. Instead, I wanted the code to spit out an array. To do that with my existing setup, I rewrote the `dead_char()` function, taking out all the parts that generated the days since the last death and instead put that in a separate plugin. Now this one gives an API output:
```
{"name":"Gina","url":"https:\/\/example.dev\/character\/gina\/","died":1481068800,"since":"5792233"}
```
That has the added bonus of letting anyone who wants to call it on their own for whatever they want isn’t stuck with my design. Yay, open source!
## The Code
My JSON code went into a class like this:
You may notice that I don’t seem to have a loop, and I call this instead:
For various reasons, I reuse a lot of loop calls. To make my own theme and plugin more human readable, that function does the query. It looks like this:
Since I have to do a lot of odd calls for the statistics on that site, it became smarter to do it that way.
## Calling the Data From YOUR Site!
I made an endpoint! This is all well and good, but the new question is “How does someone else include this on their site?”
The answer there is they need a widget. And it’s a widget I’ve mostly already made! All I had to do was create a plugin that made the widget and instead of calling the loops locally, just call the API.
Whew. That’s huge, I know! And you may have noticed I snuck some translation in there. Always look forward!
**Categories:** How To
**Tags:** coding, plugins, rest api, wordpress
---
### [REST API On This Day](https://halfelf.org/2017/rest-api-day/)
**Published:** March 1, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Extending the existing API to do another thing.
**Content:**
After making a simple REST API output that showed the date (and time since) the last death listed on a site, I had an idea. What if I could list everyone who died on a specific day? I had that data after all, so why not.
## A Word About Evolution of Code
Over time, the code behind my “Bury Your Characters” plugin evolved a great deal. I went from unique function names to singletons to one aspect and now to two. The design changed a lot in the middle as well. I unpacked the parsing of data from being on the data driven site and moved that to the site running the plugin.
The evolution of all this was for a simple reason. I wanted the JSON output to be generated as fast as possible, grabbed, and parsed locally. If the data takes less time to generate on my end, then the speed becomes more of a factor of how fast can the end-user’s site run. That would allow more people to use my plugin.
A secondary bonus reason was that I hate repeating myself in code. If I only have one place to update my code that generates the list of dead characters, for example, then there are fewer odds I’ll screw up and only edit one of the six places it gets used.
This means that the code I posted last week doesn’t look at all like that anymore.
## On My Site (aka The Service)
In a file called `bury-your-queers.php` (yes, this is for that site) I have a class called `LWTV_BYQ_JSON`.
In that class I have a constructor that calls the `rest_api_init` and that’s where I define my URLs. I already had the `last-death` set, so now I’ve added in two more for `on-this-day`:
The reason I have two for my new route is that I wanted both the main URL and the sub URL to work. That is `/lwtv/v1/on-this-day/` and `/lwtv/v1/on-this-day/03-03/` both work. They both call the same callback which checks what was passed to it. If the params for date are empty, it assumes today:
The callback grabs the function `on_this_day()`, passing the date through to it. Now this is the first BIG change. I pulled the code to generate the list of all the dead out of the function for `last_death` because it’s called twice. Now it calls `LWTV_Loops::post_meta_query` which is just a class for all my common loops that get reused a lot. They’re no faster than making the query the regular way, they’re just neater and tidier.
### Output
And all that works to output this (if you pick `03-03`):
or this (if you pick a date where no one died):
Unlike what I did for ‘last death’, here I’m only reporting the year. The reason is that’s all I care about just now. I’m passing the date through, so I don’t need that information anymore.
## On Your Site (aka The Plugin)
The plugin for this has three classes. The first is the master class to build out the widgets and shortcodes and also to parse the data. The other two are for the widgets.
Parsing the data is what we’re going to talk about today.
The function is straightforward. You pass the date to the function, it grabs the data for the date (defaulting to ‘today’ if none is provided) and spit out the resulting data:
I picked paragraphs and un-ordered lists, since I feel those would be easily formatted by most people.
**Categories:** How To
**Tags:** coding, development, rest api, wordpress
---
### [Always Validate Data](https://halfelf.org/2017/always-validate-data/)
**Published:** March 6, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Cleaning data and validate it before saving is just common sense.
**Content:**
In the making of my [REST API plugin’s extension](https://halfelf.org/2017/rest-api-day/), I had written out a way to select what happened on a specific date. While adding that kind of code into a shortcode was something I’d done before, I struggled to try and understand how I could do that with a widget in a way that was safe.
## On Data Validation
The main function that does all the real work expects a date parameter in the format of `MM-DD` which it converts to `YYYY-MM-DD` so I can run `date()` calls on it later on. The reason that works is that the PHP `date()` function can parse the `YYYY-MM-DD` format on it’s own. To that end, I have to write the widget and shortcode in such a way that it’s impossible to pass on bad data.
This is a matter of an age old problem: sanitize, escape, and validate.
If you’ve written a plugin and think that sounds familiar, yes, it is a common sticking point of mine. You *must* sanitize your data before you save it. You *must* escape it before you display it. You *should* validate it to make sure you’re not letting people make silly mistakes.
The ‘problem’ is that there are a lot of ways to do that, and the ultimate question is this “What is the data I’m trying to save supposed to look like?” If it’s a URL, you sanitize for a URL. If it’s a number, you sanitize for a number. That’s the easy part. It’s just really time consuming and difficult. Still. Sanitize early, escape late, and always validate.
## The Main Function Sanitizes and Validates
Instead of only having the shortcode or the widget make sure the date was right, I decided to attack the matter further up the chain. Or down the chain, depending on your point of view. Both the shortcode and widget call the same master function so for that, I make sure that the value of `$this_day` is never anything than what I want:
By using checkdate(), I verify that the value is either a valid date or I force it to be ‘today’. This prevents someone from passing bad data in the shortcode. I sanitize it as well as validate, using `sanitize_text_field()` because there’s no reason to even allow non-safe data anywhere further in my code.
## The Shortcode Validates and Sanitizes
The way a shortcode works in WordPress is you can pass attributes to it and the shortcode parses that for you. My shortcode is pretty basic: `[on-this-day date="MM-DD"]` But since a shortcode lives in the world of ‘users can enter whatever they want’, I have to play Captain Beaver Dam and stop them from using `[on-this-day date="Elvis"]` for example.
I do this by sanitizing the attribute and then validating it’s the format I think it is:
If you’re thinking that looks the same as what I do in the main widget, you’re right! I do it here to make sure I’m never sending bad data to the function. I do it in the function since I’m not actually psychic and people have done some pretty weird things. Also they may decide to extend my code one day and write something that calls the function.
## The Widget Validates and Sanitizes
At this point, you’re expecting this, right? It’s actually *more* important that the widget do this than anything else. The code on my server won’t accept incorrectly formatted data, so the worst that happens is you get a bad data reply. The reason all this matters more for the widget though is that the widget *stores data in the database*.
If you’re saving data and you’re not making it safe, you’re putting yourself at risk. Repeat that until it’s second nature.
In my widget, there’s an update function that saves the data to the database.
You’ll notice that, yet again, I use `checkdate()` to make sure the date is a valid value. But I’m also using `strip_tags()` to remove any HTML. You could use `wp_strip_all_tags()` which is even more hardcore, but in this moment, they both work.
## The Data Is Cleaned Three Ways
In a way, it’s overkill. I don’t need to validate the data in the shortcode really, because I’m doing that in the main function. I *do* need to validate in the widget, since I want to make sure I’m not saving bad data, and I don’t want people to see invalid data on the widget settings page. At the same time, by making sure everything is as sane and secure and valid, I’m limiting possible vulnerabilities down the road.
**Categories:** How To
**Tags:** development, shortcode, widget, wordpress
---
### [A Case for REST API](https://halfelf.org/2017/case-rest-api/)
**Published:** February 17, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Don't disable the REST API.
**Content:**
WordPress 4.7.1 and 4.7 were vulnerable via the REST API. Any unauthenticated user could modify the content of any post or page on a site. Since the release of the information, a surprisingly large number of users failed to update to 4.7.2 and, thus, were hacked.
I say surprisingly because WordPress enabled automatic updates quite a while ago (WordPress 3.7), which will automatically secure your WordPress install. There have been 18 automated releases since then (which is why we have 3.7.18) and the vast majority have addressed security in one way, shape, or form.
But this post isn’t about the reasons why someone might need to disable the automatic updates. No, this is about the argument I saw stem from the vulnerability, whereby people said it was proof the REST API should be disabled by default.
And to them I say “No.”
## The REST API Probably Has More Vulnerabilities
Look, I’m not going to lie to you. The odds are high that the REST API, which is a very new feature, probably has some serious issues still. But, as my friend Helen pointed out to those arguing [for it to be disabled by default](https://core.trac.wordpress.org/ticket/39806).
> Why should this be treated differently from XML-RPC? Have you gone through the history of the XML-RPC setting?
While the REST API may introduce new vulnerabilities to WordPress, and even ones that are horrifyingly accessible to non-logged in users, it is not the first nor the last feature WordPress has added that puts a site at risk. The API, being brand new and not used or tested as much as other aspects of WordPress, is going to be dangerous to exist, but realistically not more or less than any other part of WordPress.
Go through the [list of all WordPress security releases](https://wordpress.org/news/category/security/). A lot of issues have been fixed. This is just the first one for the REST API.
In 2008, XML-RPX in pre-2.3.3 systems allowed remote attackers to edit posts of other blog users, if registration was enabled. That’s a long time ago, and since then the majority of the exploits have revolved around DDoS and pingbacks. But yes, back in the day, this new feature was also problematic.
## Do You Trust WordPress?
Everyone makes mistakes. Every code has bugs. Everything is vulnerable. The question you have to ask is not “Why did WordPress let this happen?” nor “Why did they put me in danger?” but “Did they handle this well?”
The heart of the matter is not if you trust WordPress not to screw up, but that you trust them to react responsibly, quickly, and with the appropriate concern. Some security issues are massive. Others are not. With over 26% of the internet using WordPress, fixing the security issues quickly and properly is a huge concern.
So you have to ask “Do I trust WordPress to fix security issues?” And “Do I trust WordPress has my best interests, with regards to security, at heart?”
I do, but it’s a question of risk.
## Risk = `{si, λi, xi}`
My father, [a risk analyst](https://woody.com), asks three important questions:
- What can go wrong?
- How likely is it?
- What are the consequences?
Obviously a lot can go wrong. So much, in fact, that it can be impossible to wrap your head around the vastness of the possibilities and subsequent probabilities. Even just listing the things you *think* might go wrong is incomplete. You *know* you’re not thinking of everything, so you have to start with the big picture.
Most of us aren’t capable of calculating the risk and reliability of WordPress. Those Six Sigma experts aren’t either. There’s no way I could actually explain well enough how to determine the risk of using WordPress. If I could, I’d start with asking people “What can go wrong if I disable automatic updates?” and “What can go wrong if I *don’t* disable automatic updates?”
The likelihood of the REST API being vulnerable is a little higher than other aspects of WordPress core, but much lower than plugins and themes. The *consequences* are generally higher than that of plugins and themes, but there’s an extra factor you must consider.
- How quickly can it be fixed?
If you leave WordPress auto-updates on, then the answer is “As quickly as humanly possible.” And that, I feel, lowers the overall risk.
## Planned Disclosure
To those arguing WordPress should have told everyone sooner, this is not the first time WordPress waited a while before announcing a security issue. Take, for example, [The Case of the Trojan Emoji](https://poststatus.com/the-trojan-emoji/). That’s not a Sherlock Holmes mystery, that’s the true case of where WordPress hid a major security fix inside the additions of emoji support.
There’s a big difference between the Trojan Emoji in 4.2 and the RESTless Backdoor we faced in 4.7, and that is the exploitability. The vulnerability fixed with emojis was hard to do. The one in the API was super easy. In both cases, however, the moment the vulnerability is disclosed, a ticking clock begins to see when people get hacked.
Sometimes folks tell me I’m hyperbolic or exaggerating when I say ‘attacks will begin within minutes.’ I think that my claim was proven valid, considering how many sites were hacked, and how quickly it happened. Within days of the announcement,
Remember, [security is nuanced](https://nacin.com/2014/05/30/security-is-nuanced/). It’s never as simple as “Hey, I found a vulnerability! Patch it!” It requires testing, validation, more testing, and more testing. A good patch doesn’t introduce worse problems (yes, that’s happened before).
## Rarely Used Code Is More Vulnerable
I bring this guy up every time people argue why WordPress turns on features by default. The WordPress argument is that if they don’t turn it on, people won’t use it. The reason that matters can be found in the works of Herbert Hecht.
Hecht wrote papers about rare conditions and their effect on software failures. The tl;dr summary for you is this: Rarely used code fails *more* often.
Now, Hecht specially was referring to the early days of software use, which the REST API certainly falls under, but the basic philosophy is valid. The less the code is use, the more at risk it is, specifically because it’s used so rarely. People are less familiar with it, they don’t know how to fix it or even test it for all the possibilities, because they don’t *yet* know what they are.
Are those reasons to *not* use the REST API? Not always. You have to consider the risk of using it for yourself. Will your site go down? How bad is that if it happens? Are you doing everything you could to protect yourself?
## Should You Disable The REST API?
No. Unless you’re certain you’ll never use it, ever, leave it on. It will be fixed, and as long as you apply security patches promptly, you’ll be fine.
**Categories:** How It Is
**Tags:** oped, security
---
### [eCommerce Dream](https://halfelf.org/2013/ecommerce-dream/)
**Published:** December 6, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** My dreams about a Multisite eshop where I no longer have to say "Today, there is no plugin that can share an inventory between WordPress sites on a Multisite Network."
**Content:**
At the end of my WordCamp San Francisco talk, I said I had a dream. A dream about a plugin that can share an inventory between WordPress sites on a Multisite Network.
[](https://halfelf.org/2013/ecommerce-dream/firefly_-_whitefall/)Imagine, if you will, a store with a physical products (Geisha dolls). The store has a bunch of different types of dolls. The store has satellite stores, one in Ariel (their flagship store) but now one on Bellerophon and another on Whitefall. While the Companion-Style dolls sell well on Ariel and Bellerophon, the Cowboy-Style ones sell best on Whitefall. Also each store has a different kind of clientele.
So the Dollhouse Store makes a website, and then using Multisite, makes another site for each location: whitefall.dollhousestores.com and so on (or maybe whitefalldollhouse.com even). At first, the webpages are just a list of the local store products, come and buy them here, photos of the locale, employees, and local events. Then they decide to sell stuff on line. But they only want to list items for sale under specific criteria.
1. All items for sale are stored on the network admin
2. Each store can select what products they have at their store
3. Each store controls product volume.
4. Stores can request more product from homebase
Now of course they could have a separate store for each site, but they want to manage what *possible* items could be sold online, so having that controlled by the network makes sense, doesn’t it?
Meanwhile another store sells cows. All the cows live at Persephone, and are shipped out to Jiangyin and other stores. They’re doing well with everyone going to cowship.com, but they too want to have jiangyin.cowship.com and so on. Each store lists what cows are for sale that live *well* in each location because Holsteins’ don’t like Bellerophon, who knew? This way, someone on Jiangyin can order Holsteins but not Texas Longhorns. Obviously they need to control which product can be sold at each location, same as the Dollhouse, but they *also* have a different problem. Their product amounts must also be stored in one location and shipped out from there, so they want to make sure they don’t oversell their cows.
Their criteria:
1. All items for sale are stored on the network admin
2. Network admin controls absolute amount of products
3. Network selects what products they have at each store
4. Orders per store base product volume on the network amount
These are pipe dreams. Today there is no plugin that ‘shares’ an estore across multisite sites on a network. You can’t even do it with ‘digital’ products which now that I say it aloud, I think Pippin should totally get on that.
Today, all sites are separate, and since estores have their content saved per-site, there isn’t an easy, friendly way (if there is at all) to pull data between sites in a way that preserves shopping carts and such. I wish there was. I get asked about this at least once a week, and I have to say “Today, there is no plugin that can share an inventory between WordPress sites on a Multisite Network.”
But this is a complicated thing. Multisite itself isn’t actually built to handle that kind of thing, since the network doesn’t *have* posts or pages. You’d have to dedicate a site on the network to the shop and pull in content from there, which of course has a `switch_to_blog()` overhead penalty. I can’t even begin to get past the paper thoughts I have here.
**Categories:** How It Is
**Tags:** ecommerce, multisite, plugins, wordpress
---
### [Display Posts, Ordered By Post Meta](https://halfelf.org/2017/display-posts-ordered-post-meta/)
**Published:** February 20, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sorting posts based on meta is not easily done out of the box, but it can be done.
**Content:**
One of the things I’ve been working on over on my tv project was getting better lists of characters who died. Initially all that we recorded was the year. However we started getting the idea of a timeline and a calendar and a ‘this year in queer TV’ section, and I realized I needed more precise data.
I’m going to skip the headache part here, but I changed the year dropdown to a calendar date field that stored the date as `MM/DD/YYYY`. While some calculations would have been easier with the time saved as a UNIX timestamp, having it be text let me search as text to collect all the death for a year. There were pros and cons to both sides of the coin of how to save the data. The other trick was I needed to save the data as an array. Just in case someone died twice.
Suffice to say, here’s your scenario. I have meta data in the post containing the date of character death, and I want to display it in a specific way, not supported out of the box by the default queries.
## Display all the dead in a list ordered by date
The simple part in WordPress is to get a loop of all posts in a type that have the meta for death. Using `WP_Query` I grabbed the array and instead of saving all the post’s data, I extracted the data I needed:
- character name and URL
- date of death
- list of shows and their respective URLs
This I turned into a very simple array that I can use in multiple situations:
This array is made by looping through those `WP_Query` results and, for each character, grabbing the post meta data for shows and death. The simple array `$output_array` contains only the data I need for display. So no post content, no author, nada. Just the name, the URL, the shows, and the death. *That said*, I’m omitting my insane extra loop for generating `$show_info` with its links because it deserves its own post. Suffice to say, it’s weird. Oh and `$thisyear` is a page variable based on the URL you visit. If you go to `/this-year/2015/` it will populate as ‘2015’ and so on.
Side note. Characters actually have both a taxonomy for being dead *and* a lost meta for the date. That was a happy accident that allowed me to search for everyone who had died, and perhaps wasn’t currently dead. The time traveling Sara Lance is jokingly called Schroedinger’s Bisexual, since she is both alive and dead at any one given point in time.
### Fix The Date
Okay! With my simple array of data, I can output the list however I want, depending on the way I ordered the query. The problem is that the query has a limited number of possible sorts, and they all have to do with the post subject, the title, not random post meta. Plus my post meta was saved in a way that wasn’t easily sortable.
To solve this, I converted the date into a Unix timestamp:
I put this in the `foreach( $dead_chars_query as $dead_char ) {...}` section and it transformed my date from `01/01/2017` to it’s commiserate Unix timestamp.
### Fix The Order
The next step was to re-order my array based on the value of the death time. I wanted to go from smallest value to largest, as Unix timestamps increase over time.
For this I used `uasort` to order the entire array by the date:
This produced my desired results. Excellent. But now I have the date in a non-human readable format!
### Fix It On output
Thankfully making the date human readable wasn’t all that messy. Once I have my finished array, I output it and clean it up:
Voila!
An ordered list of dead characters.
**Categories:** How To
**Tags:** coding, query, wordpress
---
### [When a Page is an Endpoint](https://halfelf.org/2017/when-a-page-is-an-endpoint/)
**Published:** February 15, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Technically all pages in WordPress are virtual pages. But now it's time to virtualize your virtuality.
**Content:**
In making a site with non-standard WordPress pages, I ran into a common problem. How do I make a page that calls the data? To put it in a different way, I needed a URL (say, `domain.com/stats/`) to show site statistics. A ‘virtual page’ if you will.
## The Easy Way
The first way I did this was the ‘easy’ way, though I’m loathe to really call it that. I made a page in WP Admin called ‘stats’ and I set that page to use a custom page template that, instead of calling post content, called my stats code. [Custom page templates](https://developer.wordpress.org/themes/template-files-section/page-templates/) are pretty powerful, and having the page be a page meant I could allow editors to write and edit the page all they wanted.
But the downside is that making ‘sub’ pages gets messy, and what happens if someone changes the slug or deletes the page or changes the template? No. There had to be a better way that let me force generate the page.
## The ‘Better’ Way
This brings me to custom endpoints.
Now there is a huge problem with this, and it’s that if you want to make your custom virtual pages look like the rest of your WordPress site, it’s … messy. This is why BuddyPress generates pages automatically for you. It needs the pages. No matter what, I was going to have to make pages. But there is a distinct difference between 19 pages and 5.
My (unique) situation was that I wanted to have a series of sub pages. That would let me make one page, for example, for ‘roles’ and then automagically generate pages for `/role/regular/` and `/role/guest/` and so on. And yet, this brings up the other major problem.
You see, it would also mean the slugs `/about/regular/` could exist. Obviously there are ways around it but the point to hammer home here is that endpoints are *not* meant for this. They’re meant for if you want a custom endpoint (hah) on every page of a type.
## The (Really) Better Way
Thankfully, there’s a better way!
Rewrite rules and custom query vars will let me do everything I wanted, with only one page for each item.
### The Setup
I have five types of pages with ‘extra’ sub pages: newest, role, star, stats, and thumbs. Each one has a few accepted types, but I don’t need to really worry about that just yet, because how I handle it differs on each page (more on that in a second). First I made a list of all my pages, the ‘kind’ of extra they had, and their custom template. Because yes, each page has a custom template.
- page slug: `newest`, extra: `newtype`, template: `newtype.php`
- page slug: `role`, extra: `roleype`, template: `roletype.php`
- page slug: `star`, extra: `starcolor`, template: `starcolor.php`
You’ll notice I went with a theme there. It makes it easier to remember what’s what. Each template is heavily customized for the data within, since each page is wildly different from each other. The one check I make on every page though is that the ‘extra’ value matches what I think it should. For example, here’s the stats header:
That means if you go to `/stats/humbug/` it redirects you back to the main stats page.
Cool, right? So the question next is how did I get `/stats/characters/` to work if there’s no commensurate page?
### The WordPress Way
The answer is `add_rewrite_rule` and `query_vars.` I made an array with all my page slugs and their extra, which you’ll remember was the same name as the template file. This let me use a series of loops and checks so my code is simpler.
My query arguments are this:
Notice how that matches exactly what my design was above? That’s why I take the time to plan all this out.
The next thing I did with all this was to set up my query variables. These loop through the query array and set up a variable for each one.
What that does is makes a URL like this work: `http://example.com/?pagename=stats&statistics=death`
It also means this works: `http://example.com/stats/?statistics=death`
Neither of those are particularly ‘pretty’ permalinks, though, are they? That means it’s time for `add_rewrite_rule`!
This code is actually in an `init` function, but what it does is make a custom rewrite rule so we can call the URL like this: `http://example.com/stats/death/`
Which is what I want.
## The Whole Code
The following is actually the code I use. Feel free to fork! I put it into a class and did some extra work to call the right templates on the right pages.
PS: Yes, I totally built it all out in endpoints before I got smarter.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Learning nginx](https://halfelf.org/2014/learning-nginx/)
**Published:** December 15, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I really did try to master nginx, but I still come up short.
**Content:**
I’m an nginx rookie. In fact, I moved a site specifically to nginx so I could sit and learn it. While this site, today, is ‘on’ nginx, it’s actually an nginx proxy that sits in front of Apache 2.4, not because I think Apache is necessarily better, but because after all this time, I still can’t stand the loss of the dynamism of my .htaccess.
When I was experimenting, though, one of the things I started to do was recreate my ‘tinfoil hat’ .htaccess rules in nginx. What are ‘tinfoil hat rules’? They’re things [I’ve tweaked in .htaccess](https://halfelf.org/2013/my-super-secret-htaccess-file/ "My Super Secret .htaccess File") to make it harder for nefarious people to look at my code and get into my servers. They’re also general ‘stop being from being jerks’ rules (like preventing hotlinking).
This isn’t complete, but it’s everything I’d started to compile and test.
## Header
This is pretty basic, I like to document my section before I get too far into this.
## Directory Listing
Directory listing is like when you go to domain.com/images/ and you get a list of all their images. This is just a bad idea, as people can also use it to list PHP files you might have (many plugins lack an index.php, and no, this isn’t a bad thing). This simple rule will protect you.
## Hotlinking
Ah. Hotlinking. This is in-line using images from someone else’s server, like `` – If I’m on example.com, that’s fine. If I’m *not* then that’s bad. *Never ever hotlink images unless the site provides you a hotlinking URL.* I cannot stress this enough.
This code comes straight from [the nginx wiki](http://nginx.org/en/docs/http/ngx_http_referer_module.html), and works great.
## Protecting wp-config.php
This is pretty straightforward. I want to block anyone from hitting that directly, any time, any where.
Done.
## Brute Force Protection
If you have [ ngx\_http\_limit\_req\_module module](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html) then you can rate-limit how many requests an IP can give to a file.
## And that’s all I got to…
And that is, sadly, as far as I got before I started playing with Apache 2.4 and enjoying the ifs of that, over nginx. What about you? What are your nginx security tweaks?
**Categories:** How To
**Tags:** administration, servers
---
### [Hotlinking is Evil (And So Is Google)](https://halfelf.org/2013/hotlinking-google/)
**Published:** February 1, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Google's new image search is twice the evil for twice the speed. But is it worth it to anyone besides Google?
**Content:**
We all know hotlinking is a bad thing. Hotlinking uses up someone else’s bandwidth, which costs them money. It takes away from any profit they might make on ads, because you’re not going to their site. It removes their credit from images. So why did Google decide to hotlink when they made their [faster image search](http://googlewebmastercentral.blogspot.de/2013/01/faster-image-search.html)?
This is what the new image search looks like:
I’ll admit, that looks pretty nifty. It’s a fast way to see images. But it’s also a fast way to lose attribution. Here’s what just the new image box looks like.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/01/close-up.png)
This image now loads ‘seemingly’ locally. It’s totally a part of Google, though, there’s no reference back to how the site looks (it used to be an overlay). In fact, most people will just see the image, copy if they want, and move on to the next site. No one has any reason to dig deeper and to visit the image’s page.
By contrast, the thumbnail images you see on Google, if you viewed source, look like this: `https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcQPNtMLkk8rwj3lLv6a2kEQ8_eo6BuiUZYn3N5z3cbMu6rVPo3Xkw` If you go to gstatic.com though, all you get is a 404 error page, but it’s pretty easy to find out this is where Google saves all their static content. Including images. These thumbnails are in moderate to low quality, and if that was all Google did, show small, iffy, thumbnails and redirect people to the real site, that would be great. Instead, now they actively hotlink from you. Oh yes, that full image you saw in my screenshot was directly linked to the owner’s media file.
The first thing I did after noticing this was to add the following to my robots.txt:
Those directions are [right from Google](http://support.google.com/webmasters/bin/answer.py?hl=en&answer=35308), who doesn’t even pitch you any reason to why you wouldn’t want to do this. Normally they’ll tell you ‘You can, we’d rather you didn’t because of XYZ, but here it is anyway.’ This time, it’s a straight up ‘Here’s how.’ I find that rather telling.
Naturally I went on to read why Google thought this was a good idea
The following points are all reasons Google thinks this is better.
> We now display detailed information about the image (the metadata) right underneath the image in the search results, instead of redirecting users to a separate landing page.
The first part about this, the detailed information, is great. Having the meta-data right there without redirecting to the separate page like the used to, with the data on the side that no one read, is an improvement. Thank you for that.
> We’re featuring some key information much more prominently next to the image: the title of the page hosting the image, the domain name it comes from, and the image size.
Again, this is great. I think that the data should be more visible than it is, especially the ‘This image may be copyright protected’ stuff. Considering Google won’t allow you to use ads if you use copyright protected material (which they claim I do here, by the way), they really have a higher measure of standard to live up to when it comes to informing people of the stick by which they are measured.
> The domain name is now clickable, and we also added a new button to visit the page the image is hosted on. This means that there are now four clickable targets to the source page instead of just two. In our tests, we’ve seen a net increase in the average click-through rate to the hosting website.
I can see this being true. Again, the links should be more obvious, and really they should link not to the image directly, but the contextual page in all cases. Traffic is important, and if you send people to the image page where they don’t see the *ads*, you’re causing them to lose money. So the idea behind this part is really nice, and I’m for it, it just needs some kick-back improvements. Google should give people a good reason to go to the parent site. And this next item is where they fail…
> The source page will no longer load up in an iframe in the background of the image detail view. This speeds up the experience for users, reduces the load on the source website’s servers, and improves the accuracy of webmaster metrics such as pageviews. As usual, image search query data is available in Top Search Queries in Webmaster Tools.
And now we hit the problem. While this is true (it will be both faster and use less of my bandwidth while decreasing load), it’s still showing my image off my servers! Worse? It’s got the *full sized* image from my server, which means if I have a 4 meg photo (and I do), they’ll be pulling all 4 megs down, and the reader can just right-click and save. They never need to touch my site.
As Bill and Ted would say, Bogus.
Go back to how Google shows thumbnails. They have their own, lower-rez version. I regularly post other people’s images on a site, and when I do, I purposefully keep a lower resolution version on my site, and link to them for the best. Why? *Because it’s their image*. They did the work, they made it, I should honor them and respect them, and be a good net-denizen. Google’s failing on that.
For me their search has always been a little questionable for images. Now it’s outright evil.
**Categories:** How It Is
**Tags:** essay, google
---
### [Cacheless (or not)](https://halfelf.org/2013/cacheless-or-not/)
**Published:** February 19, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A lot of words in order to make a smaller, faster, leaner, meaner site. My experiment with going sans Caching Plugins begins.
**Content:**
*ETA: As of a month later, I’ve actually switched [from APC to Zend Optimizer+](https://halfelf.org/2013/trading-apc-for-zend/)*
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/f1fd4.png)Don’t get me wrong, I love caching. I love W3 Total Cache (I’m willing to spend my ‘free time’ testing it, after all), and WP Super Cache saved my life once. So why, on a day where I got a 400-600% uptick in traffic (not a joke), did I turn all my caching off? I’m daring, and a little crazy, but I wanted to see if it could be done. I would not have tried this if I was on a smaller server: if you’re getting as much traffic as I am, and you’re on shared hosting, you really need to move to a VPS or Dedicated Server if you want to turn off caching via plugins. It’s not to say that caching is better or worse than not-caching, or vice versa, or that one is a rich-man/poor-man equivalent of the other. Caching plugins are an inexpensive way to speed up your site, and if you can’t afford a bigger server they will buy you the time you need to figure out a better solution. Even with a good plugin and setup, if you get hammered with a lot of traffic, you will crash your site unless the server’s optimized too. Again, what I’ve done is not something I’d try on a low-end server with high traffic.
When I started measuring the effectiveness of all this, I used:
- [WebPageTest](http://www.webpagetest.org/)
- [GT Metrix](http://gtmetrix.com/) (tests Yslow and Google Page Speed at once)
- [ByteCheck](http://www.bytecheck.com/)
- [Apache HTTP server benchmarking tool](http://httpd.apache.org/docs/2.2/programs/ab.html)
To understand what caching is and why we use it, it’s good to understand the basic concepts, and to start by looking at what caching plugins are, how they work, and where their pitfalls are.
- There are parts of your website that don’t change often (images, javascript, CSS, etc).
- You want the user to only download what’s changed.
That sounds easy, but WordPress isn’t static HTML, it’s PHP, and that means every time you visit the page, it runs various proceses to give you the latest and greatest files. The problem with this dynamic code is where content changes rapidly (think ‘comments’ or ‘forums’ or ‘BuddyPress Groups’). Suddenly caching ‘pages’ as wholesale chunks of html doesn’t help if you have to re-cache when someone leaves a remark. Add in the possibility of 4 or 5 people commenting at once, for 12 hours, and now you’re risking a thrashing situation where you keep trying to cache, but it keeps flushing. This is why most people use plugins that handle things elegantly, or try to, where the ‘static’ part of the page (sidebar, etc) are HTMLized, but the dynamic part is left alone. This helps when you have a portion of every page is dynamic, like a shopping cart with a ‘Your order…’ box.
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/self-storage-units.jpeg)But the downside is that you have to write fancy code that remains dynamic portions, and while it certainly can be done, it’s not fun, and let’s be honest, a theme developer doesn’t know which cache you’re going to use, so how can it write the right way for that? The only way to make a truly dynamic and cachable site is to do it from day one, with your theme, server, and plugins all crafted to provide the best experience. And then we have reality, which is we start with something simple, wake up to something large, and experience growing pains.
Accepting the fact that we’re not starting from nothing, that we have an existing site with content and activity, the first thing most people do is install a plugin. Now, back to what I said before, this isn’t a bad thing. It’s a good first step and will buy you time. It’ll also show you where you need to go. If you don’t have server root access, this may be a your limit, too, as some of the other things I like to do to speed things up without a cache will require it (or you’ll have to ask your hosts and they may tell you to upgrade).
If you’re going to use a plugin, [WP Super Cache](http://wordpress.org/extend/plugins/wp-super-cache/) (WPSC) and [W3 Total Cache](http://wordpress.org/extend/plugins/w3-total-cache/) (W3TC) are the best two. W3TC is way more advanced, and has a lot of extra bells and whistles, but personally I find that once you can master it, you’re well on your way. Remember though, you’re sacrificing a lot of control here by using a plugin. They’re going to, by their nature, cache everything they can, and we’re back to where we were with the dynamic site generation issue. W3TC has a bunch of extra .htaccess/nginx rules which parse data before you hit WordPress. WPSC can do that, or use PHP (which is slower).
The dynamic nature of my site is what drove me away from caching plugins. I use other CMS tools, and for my infrequently updated Wiki and ZenPhoto Gallery, where content is very much static, caching makes perfect sense. But when I want to run a simple community site with WordPress, I have to consider all aspects of user experience. Speed is hugely important, but so is the user getting the content they want. Stale content is a killer.
The reason I decided to see if my site ran slower without caching was that I was reinstalling caching and I thought “This is a perfect time to benchmark.” When I did I was astounded. There was very little difference in a benchmark test. Really no difference between at all, since it was within the results of each other, but I neglected to save the results at the time. I did however snap a picture of my server load(The unrelated part is where I was uploading 10megs of media. Unrelated.):
Browser Caching is the first thing to tweak, as that tells browsers to cache content. The way this works is your .htaccess tacks on extra information while content like images and CSS are being downloaded, to say “This content is good for X days.” With WordPress, you don’t have to worry about changing the CSS, as most themes and plugins are extra smart, in that they append a version to the end of your CSS like this: `style.css?ver=1.9.1` That 1.9.1 is the version of Genesis I’m running, so when that changes, the version changes, and browsers see it as a new file and re-download. That’s pretty cool. (I do wish that child themes pulled in their version, so you could increment that way.) We still have to tell the broswers to cache, and for how long, so near the top of my .htaccess (just below my hotlink protection) I have this:
```
## BEGIN EXPIRES ##
ExpiresActive On
ExpiresByType image/jpg "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType image/png "access 1 year"
ExpiresByType image/x-icon "access 1 year"
ExpiresByType text/css "access 1 month"
ExpiresByType text/html "access 1 hour"
ExpiresByType application/pdf "access 1 month"
ExpiresByType application/x-javascript "access 1 month"
ExpiresByType application/javascript "access 1 month"
ExpiresByType text/javascript "access 1 month"
ExpiresByType text/x-js "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresByType video/quicktime "access 1 month"
ExpiresByType audio/mpeg "access 1 month"
ExpiresByType video/mp4 "access 1 month"
ExpiresByType video/mpeg "access 1 month"
ExpiresByType audio/ogg "access 1 month"
ExpiresByType video/ogg "access 1 month"
ExpiresDefault "access 2 days"
## END EXPIRES ##
```
I’ve added in only the types used by my site. I used to use Pragma caching headers as well, but I noticed that Google PageSpeed Insights and YSlow ignore them. Turns out that Pragma headers aren’t honored all the time, in fact, they aren’t honored often, so I just removed them. I don’t think it slowed my site down to have them, but the less to maintain, the better. This had an immediate positive impact, so it was time to look at the server.
Over the years, I’ve tuned httpd.conf so it doesn’t crash, I’ve got [CSF locked down to prevent people from DoS’ing me over TimThumb](https://halfelf.org/2011/timthumb-pseudo-ddos-effect/ "TimThumb and the Pseudo (D)DoS Effect"), and I of course have APC turned on. Recently I broke down and [installed mod\_pagespeed](https://halfelf.org/2013/centos-and-php-5-4/ "CentOS and PHP 5.4") when I upgraded to PHP 5.4. Just those things have done a lot to make my site run faster. I intentionally skipped things like [Varnish](https://www.varnish-cache.org/) or [TrafficServer](http://trafficserver.apache.org/), as well as a CND or [Google’s PageSpeed Service](https://developers.google.com/speed/pagespeed/service). I (still) don’t need them.
Since I’m new to Page Speed, I decided to look deep into the filters and enabled the following for the whole server: rewrite\_javascript, rewrite\_css, collapse\_whitespace, elide\_attributes. This had a right-away impact of what I jokingly called ‘Effective Minification.’ These filters are new to me, so I spent a lot of time reading up on [all the filters](https://developers.google.com/speed/docs/mod_pagespeed/filters), and I find them highly interesting. By having PageSpeed handle things like [offloading jQuery](https://developers.google.com/speed/docs/mod_pagespeed/filter-canonicalize-js), I take the load off of WordPress and other CMS tools, and don’t have to use a plugin.(Don’t get the wrong idea. There are uses for plugins! But I’m all about using the right tool for the right job. I don’t have plugins handle my WordPress database, because I feel it’s like using a screwdriver to hammer in a nail. You *can*….)
I added in a couple more to my standard: remove\_comments and rewrite\_images. Then I went back to my site’s .htaccess and started turning on the things I wanted per-site.
The ones I picked are:
- [defer\_javascript](https://developers.google.com/speed/docs/mod_pagespeed/filter-js-defer)
- [move\_css\_to\_head](https://developers.google.com/speed/docs/mod_pagespeed/filter-css-to-head)
- [insert\_ga](https://developers.google.com/speed/docs/mod_pagespeed/filter-insert-ga)
Putting those in my .htaccess looks like this (note: no spaces between the filter names, or it all blows an error 500):
```
ModPagespeedEnableFilters move_css_to_head,defer_javascript,insert_ga
ModPagespeedAnalyticsID UA-MYCOOLID-1
```
That also means I don’t have to use a plugin to use Google Analytics for my whole site! This may not mean a lot to you, but I have multiple ‘apps’ on my site (four now) and when I edit themes, if I don’t have to do anything, it’s easier. Google will tell you not to do this, but unless they have a way for me to set pagespeed.conf in the /home/user/ folder of my server, I don’t know another per-user way about this.
Finally I went back on my word, and I installed a plugin. [APC by Mark Jaquith](http://wordpress.org/extend/plugins/apc/). This isn’t a full reversal on my ‘No Plugins!’ stance before, though. All APC is, you see, is but one file that sites in wp-content and kicks things over to APC. Doing this alone moved my TTFB from an F to a B. Which is pretty impressive. Giving it a little time to bake, this worked out okay.
**Categories:** How To
**Tags:** administration, htaccess, performance, plugins, servers, speed, website, wordpress
---
### [Every Site should have a Favicon](https://halfelf.org/2009/every-site-should-have-a-favicon/)
**Published:** July 22, 2009
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Without a favicon, your site just looks naked.
**Content:**
 Imagine summing up everything a website is about in a 16x16px square. That’s the goal of a favicon (short for favorites icon). Pretty much every site out there has one, and it’s a devil of a task to make one that looks appropriate, identifiable and understandable in such a small space. As much time as I spend tweaking a design I spend on a favicon because they are that important for the look and feel of a site. A site without one is nearly naked.
Back in the days of IE 4 (yeah, 4, so 1997), Microsoft hit upon a great idea. If you made a teeny picture and saved the file as favicon.ico in your html root, their browser would pick it up and be the icon on your bookmarks menu. It didn’t take long for people to figure out microsoft.com was doing this, and they began implementing it all over for every site they could. As people got smarter, they figured out how to fake it, so you could have a different favicon for every page, just by manipulating the head of your html document.
Back in the day, you had to use .ico (Microsoft Icon) files as your favicon, but these days most modern browsers pick up .png, .gif and .jpg happily enough. This allows people to make animated favicons, which need to be shot and killed. For maximum compatibility, though, most people still use .ico, since IE doesn’t like the others. Or it didn’t. Someone on IE 8 will have to check.
The real problem boils down to size, for most people. At 16x16px, you don’t have a lot of room. This site actually has a non-recognizable icon (it’s the Xena/Gabby picture). Technically you can go up to 32×32 for an image, and I have one that’s 240×240, but in the end, they all render at 16×16 on 99.999% of browsers, so looking good at that size is your goal.
If you think I’m being silly, about a year ago, Google changed their favicon and admitted that it wasn’t final. Right away they basically started [open submissions](http://googleblog.blogspot.com/2008/06/one-fish-two-fish-red-fish-blue-fish.html) for a better one. When they changed it in January, it became the favicon [ heard ’round the world](http://news.bbc.co.uk/2/hi/uk_news/magazine/7839744.stm). Eventually, Google stepped up to [explain the change](http://googleblog.blogspot.com/2009/01/googles-new-favicon.html). It’s important to have an icon that matches your site, as Google explains, as well as a unified look for all aspects of your design. Should you have a different look for each app on your site, or an all in one? How does it affect the other aspects of your site, like the iPhone’s new icons for saved webpages?
These aren’t simple answers, but to explain how I go about it, here are some favicons that I have made and use out there in the world. Not this site’s though. I need to come up with something better for it.
[](http://jorjafox.net) When I moved JFO from orange to green a year or so ago, I made a new favicon to reflect the design. The image is a cropped shot from the original header (which is now a full color photo, but still), and is a close up of Jorja’s face. It’s JUST recognizable as Jorja, I think.
[](http://jorjafox.net) Alternately, I came up with this image, which is a copy of the shot used on the header currently, done in greens to match the site. In a way, it’s both more and less recognizable, as the image is harder to make out (it’s a head and shoulders) but as it’s the same used in the header, people might make the connection. I’ve yet to use this on a live site, but it shows up on my test sites right now.
For the website ‘SCA Jews’, I had gone with a slightly eastern feel of a website, that evoked both the idea of camping with the concept of days gone by. [Evening Sun](http://spectacu.la/) came from spectacu.la, and took minimal editing to fit my plan. The problem was I had no favicon. Originally I put a little sun up there, but then it struck me that the ‘meaning’ of the site was to promote the meal plan “Meals on Camels”. What better way to express this than with … a camel.
[](http://theyeasticoulddo.net/) I also helped design (or rather optimize the design for) my friend’s site, The Yeast I Could Do. She had no favicon and I spent a couple hours scrounging for something bread-ish, and eventually picked this one, even though it’s questionable. It does look a bit like a loaf of bread, and she recognized it, so I think it went okay. In it’s .ico format, it has a transparent background.
[](http://consensualreality.net/ponywars/) Finally there’s this one. Pony Wars is a joke site I made up with a friend for a “My Little/Pretty Pony RPG”. I mocked up the site because I was bored one day and finding an icon for it has been a bear. In the end, I went with this 33×33 (yes I know) icon of a pink pony. It doesn’t scale very well and looks weird on the site itself, but it’s a hard icon to shrink.
If, in the end, you’re stumped at making one, there are a lot of favicon collections out there to help you. Be warned, they can take a LONG time to load:
- favicoop, a favicon collection with over 43288 icons
- [MpP’s Gallery](http://mppierce66.home.comcast.net/~mppierce66/web/fi/), broken up into multiple pages
- [Favourite Favicons](http://www.deltatangobravo.com/archive/2004/march/favourite), not as many, but easier to see
What are your favorite favicons?
**Categories:** How It Is
**Tags:** browser, design, website
---
### [Updating Multiple Posts' Meta](https://halfelf.org/2016/updating-multiple-posts-meta/)
**Published:** September 7, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I wish my answer was "This is super easy!" Except it's really not.
**Content:**
I had 328 posts that I needed to add a meta field value to. Thankfully they all had the same value at the moment, so what I really needed was to tell WP “For all posts in the custom post type of ‘show’ add the post\_meta key of ‘tvtype’ with a value of ‘tvshow’.”
That sounded simple. It wasn’t.
Googling “Updating multiple posts” or “Bulk Update Multiple Posts” (with WordPress in there) was frustratingly vague and told me to do things like the bulk edit from the post lists page. Well. Sure. If I added my post meta to the bulk editor (which I do know how to do) and felt like updating them 20 shows at a time, I could do that. Heck, I could make my page list 50 and not 20, and do it in 5 ‘cycles.’
But that wasn’t what I wanted to do. No, I wanted to figure out how to do it faster *forever*, so that if I had to update 32,800 posts, I could do it in the least CPU intensive way.
## PHP
If I was to do this in PHP, it would look like this:
I picked `add_post_meta` instead of `update_` because while the update will add the meta if it’s not found, I didn’t want to update any of the shows I’d manually fiddled with already. And to run this, I’d have to put it in an MU plugin and delete it when I was done.
Which… Yes. That could work. I’d want to wrap it around a user capability check to make sure it didn’t run indefinitely, but it would work.
## WP-CLI
Doesn’t a nice command line call sound better, though? Spoiler alert: It’s not.
I knew I could get a list of the IDs with this:
That gave me a space-separated list
And I knew I could add the meta like this for each show:
But who wants to do that 328 times?
The documentation for `wp post meta update` said “Update a meta field.” A. Singular. Now it was *possible* that this could be for multiple posts, since the information on `wp post update` said “Update one or more posts” and “one or more” means one or more. But the example only had this:
Notice how there’s no mention of how one might handle multiple posts? In light of clear documentation, I checked what the code was doing. For the update function, I found this:
The check for `if ( is_numeric( $arg ) )` is the magic there. It says “If this is an ID, keep going.” And no spaces. So the answer to “How do I update multiple posts?” is this:
Great! So can I do that with post meta? Would *this* work?
Answer: No.
So I took that list, used search/replace to turn it into 328 separate commands, and pasted them in (in 50 line chunks) to my terminal to update everything.
Yaaaay.
**Categories:** How To
**Tags:** command line, php, wordpress
---
### [Drop DES Ciphers](https://halfelf.org/2017/drop-des-ciphers/)
**Published:** February 13, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some more cPanel security for your sites.
**Content:**
My (former) coworker read my [recent post about the forward secrecy](https://halfelf.org/2017/ssl-security-forward-secrecy/) and noted the following:
> @*p0pr0ck5*: you really ought to get rid of the DES ciphers too.
As it happened I was looking into that!
## What Is DES?
DES stands for Data Encryption Standard. It’s a symmetric-key algorithm using 56-bit keys, which means it applies its magic to a block of data at once, rather than one bit at a time.
Back in the 1970s, The National Bureau of Standards (in the US) created DES because it occurred to them that secure data was a good idea. A bunch of brains were invited to meet their proposal for a standard, and of them IBM (yes, that IBM) came up with a winner.
## What’s the Problem?
It’s 2017, not 1971, and data is bigger and more complex. First off, 56-bit keys are too small. AES, the current standard, uses 128-bit and 256-bit keys. But perhaps more importantly, we don’t do symmetric encryption anymore. Sending the keys over the same channel you’re going to encrypt is dangerous and easy to snipe.
Back in the late 1990s, a big machine could break a DES key in 22 hours. Today, using a cloud network on Amazon, it could be done in seconds, and be worth it.
Oh and if you’ve heard of 3DES and are wondering if that’s better, it’s not. Remember the massive Target hack in late 2013? A bunch of credit cards were stolen and it turned out Target stored their PINs in 3DES. So no. Not safe at all.
## Why Did You Have It?
Because Windows XP is a sack of shit and up until last year, I had to support it.
Seriously, that was it. Now that everyone I know who use some XP (and NT) are on modern OS’s (or blocked from the server… or dead) I don’t have to worry so much.
## How Do We Ditch It?
Remember, these are the *default* chiphers:
In there you have the following: `ECDHE-ECDSA-DES-CBC3-SHA`, `ECDHE-RSA-DES-CBC3-SHA`, `EDH-RSA-DES-CBC3-SHA`, and `DES-CBC3-SHA`
While I already have `!DES` in my cipher suite (as I posted a few days ago), I should remove it fully. But that *also* means in the Pre Main Include section, I need to change my value for SSLCipherSuite to match!
When I tested, I noticed that I was still pulling a TLS suite with 3DES: `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`
To fix that, I changed `HIGH` to `+HIGH:+MEDIUM:-LOW` and that gave me the following:
The `-LOW` is the magic sauce to say “Don’t use anonymous insecure ciphers.” when you’re on cPanel, you see.
**Categories:** How To
**Tags:** cpanel, security, ssl, whm
---
### [On Uninstalling WordPress Plugins (and Data)](https://halfelf.org/2017/uninstalling-wordpress-plugins-data/)
**Published:** February 10, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Why uninstalling a plugin tells you it's removing data, even when it's not.
**Content:**
Someone asked me why WordPress always says it’s going to delete files and data when it only removes the files and not the database options. There are two parts of the answer to this, one being a little historical and the other being a bit unhelpful.
## The Message: Delete Files and Data
Once upon a time, when you uninstalled a WordPress plugin, it looked something like this:
That was a very simple screen. You were asked to delete the plugin files, you clicked that you were, done.
Now you see this thanks to Shiny Updates:
It’s a different message, telling you it’s deleting *data*!
## What Is The Data?
The part you *don’t* see is that WordPress would also remove all the data as well as those files.
Any time WordPress showed you that message to delete files and data, it was saying that it found a file called `uninstall.php` which would, presumably, delete the data set by the plugin. By this I mean the options and settings you chose for your plugin. Some plugins have data and others don’t. For example, Hello Dolly has no data, just files. It doesn’t need an uninstall file. On the other hand, a plugin like Jetpack has a lot of settings it should remove from the database on cleanup.
## Why Do We See ‘and Data’ If There’s None?
Okay, so if Hello Dolly has no data to delete, why did we see that message? In part, this stems from the following idea:
We wanted it to be more clear as to *what* was being deleted when you delete, and that was part of a proposed change to WordPress core to tell you if and when database settings are removed on uninstall, and let you leave it alone if needed. Wouldn’t that be nice? Letting you pick which way to go?
Well. There’s a problem with that dream, and the name of the problem is “Plugin Frameworks.” No, not the CMB2 stuff, I mean the [boilerplate plugin frameworks](https://halfelf.org/2015/hate-framework/) that are oh so popular.
I hate them. Because they *always* have an uninstall, and most of the time people leave it alone. That’s right, your brilliant boilerplate will flag an alert that it’s deleting data when it’s not. This doesn’t impact the functionality of the base idea, but it does change the message.
## So Why Does It Say Data?
Because when you uninstall a plugin, if it was well written, it removes the files and the data.
**Categories:** How It Works
**Tags:** development, essay, wordpress
---
### [cPanel and Two-Factor Authentication](https://halfelf.org/2017/cpanel-2fa/)
**Published:** February 3, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making life more secure, one two factor at a time.
**Content:**
I’m talking a lot about security. There are reasons for that. If you’re not keeping your online *behavior* safe, you’re in for some headaches. [Two-Factor Authentication (TFA or 2FA)](https://halfelf.org/2013/two-factor-authentication/) is one of the better solutions as it protects you by requiring you to have a password and a physical object in order to log in.
WebHost Manager (the admin part of a cPanel server) has this.
## Let’s Do This Thing!
Go to WHM Home » Security Center » Configure Security Policies and check the box for Two-Factor Authentication.
Next, go to Home » Security Center » Two-Factor Authentication and move the slider to enable:
Click on the tab for “Manage My Account” and set up TFA for your root account.
## The Problem….
Oh there’s a problem? Yeah, and it’s the age old problem of TFA. You can’t enforce it. I mean, you can’t turn it on for everyone and walk away singing the praises of your success. You have to turn it on as each user. That means they have to turn it on. You can’t even require it.
None of that means you shouldn’t do it. Everyone should do use TFA for their server connections. I use it for my servers and for my Gmail accounts. Protect yourself.
## Extra Credit
[Did you know you could turn on TFA for APIs on your server as well](https://blog.cpanel.com/where-is-my-two-factor-authentication/)? Yeah.
**Categories:** How To
**Tags:** cpanel, security
---
### [Show Featured Images on Post List](https://halfelf.org/2017/show-featured-images-post-list/)
**Published:** February 8, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding a custom column to show if you have a featured image or not.
**Content:**
Let’s say you want to be sure every single post, in ever single post type, has a featured image. And you know someone might forget but you don’t want to have to open up every damn post to see.
There are a lot of answers to this problem, and I love that there’s a plugin that will add in a [Featured Image Column](https://wordpress.org/plugins/featured-image-column) that shows a teeny featured image. But it wasn’t what I wanted. It was over kill.
All I needed was a simple check mark for if there was an image and an X if there wasn’t, and that would suit me fine. And I wanted the column to be small, without a lot of fuss or folderol. I wanted something simple:
That gives me a fast overview of if everything is what I wanted and where I wanted.
## The Code
The code itself is the most basic column code, with a little bit of magic to put it as the first column on the list. Since I want to show this on *all* post types, I used the generic functions.
Fork and enjoy!
**Categories:** How To
**Tags:** coding, plugins, wordpress
---
### [Moving cPanel email to Gmail](https://halfelf.org/2016/moving-cpanel-email-gmail/)
**Published:** September 30, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I finally switched to Gmail for my email... And I don't regret it.
**Content:**
There should be a collective gasp here.
It’s no big secret I dislike Google. I don’t trust them at all. I think Cory Doctorow’s story [Scroogled](http://craphound.com/news/2016/03/03/scroogled-the-day-google-went-evil/) is pretty much on the ball. But I also have been struggling with handling my server’s email and spam situations and if there’s one thing Google has turned out to be pretty good at, it’s spam. Also having my email separate from my hosting means if the site goes down, I’ll still get emails… Which is sort of important.
So I bit the bullet, sorted out I needed to pay for three emails (making it $15 a month) and a boat load of secondary domains and filters. Since I’d dropped the cost of my hosting by $20 a month, this worked out alright.
## The Setup
This part is the easy one. Go to https://apps.google.com and put in your information. If, like me, you have multiple domains, pick one to be your ‘master’ domain. I chose `ipstenu.org` because that’s my main domain in Multisite and there’s some parity going on here. Since this is geared to businesses, you do need to give your business a name. Sorry.
Next you’ll pick your users. Like I said, I have three: Me, my wife, and my admin account. Why does admin need it’s own account? It doesn’t. But it might. For now I had them email me at my personal gmail (I can always resend later) since I don’t want them to be alerted to things just yet as I planned to import all their old email.
Finally it does the “Verify your domain and set up email” step. Which failed. And took 50 minutes. Unfunny. Originally I did the TXT domain setup, and when that failed I did CNAME. Longest ‘about 50 minutes’ ever. And that failed too. Finally I did the damned ‘file verification’ which was ridiculous and stupid but that worked and it *still* took another 50 minutes to set up my emails.
Eventually, after talking to Google, my web host, and my domain registrar, it turned out there was a glitch in my domain servers… There was no A record for my nameservers. Thank you Carol, Samuel, and Tatyana for helping that one.
## Migrating Data
I mentioned I have three accounts. They have around 30 megs of email each. But I *also* have secondary accounts which are basically the same accounts only not… And to be honest I don’t know why I have so many. This was a chance to combine everything, so I set up those three accounts and then I used the IMAP importer to pull in everything. And it worked. That simple.
## Configuring Accounts
Now that I have three accounts, I needed to add in my ‘other’ emails. I have a lot of weird aliases. I used to have separate accounts for each email but … well that’s a pain in the ass. So instead of that, I set up *folders*. I made a folder for each domain alias and then set up redirects. If email was sent to the `halfelf.org` domain, then it went to a folder called ‘HalfElf.’ Originally I had a whole mess of weird redirects going on, like if it was from WP then it went to a WordPress folder and so on, but unraveling that and going simple seemed like a wise choice.
I went into the cPanel backups page and downloaded all my forwarder information as well and set up email forwards! Well. Not forwards. Aliases. Same idea really. And it was nice, since I added all my domains as aliases, `ipstenu@[anydomain]` would now work! I set up a lot of filters to keep things out of my inbox and in their proper, attention needing, spots.
## Blocking Users
Finally it was time for my soon to be favorite step. Blocking users. [Blocking senders for every domain is possible in Gmail](https://support.google.com/a/answer/2364632?hl=en) and in my opinion, it’s huge. I have a list of 66 emails that I block on all my servers. This is for myriad reasons, but primarily is these are people who don’t know how the shut the hell up and leave me alone. Since I’m under no obligation to talk to these people, I blocked them.
Exporting that list from cPanel was un-fun. You can either manually copy it out, line by line, or you can find the filter rules. They are, sadly, stored in the `/etc/vfilters` directory, so you need root access (which I have), but it’s not easy to get at. BUT! As of the latest version of cPanel, if you go into backups you can export your filters. They’re in a YAML format, but that’s easier than copy/pasta.
## Cleaning up cPanel
So now that everything is on gmail, do I even need to run email on the server? Yes. I have to be able to send email. I did go through and delete all the accounts, though, freeing up a bit of space, and I turned off Greylisting (I know, [I just did that!](https://halfelf.org/2016/greylist-rbls-spam/)), and I hid the ability to add new accounts.
**Categories:** How It Is
**Tags:** cpanel, email, google
---
### [Gmail: Handling Bad Emails](https://halfelf.org/2016/gmail-handling-bad-emails/)
**Published:** October 17, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sorting emails and sending specific auto-replies is complicated, but doable.
**Content:**
No, not bad emails as in the ones that you consider saving and posting for someone’s everlasting internet shame. Bad emails are the ones that go to the wrong place, through none of your fault. We’re talking about the people using an email you’ve not used in a decade, or someone who can’t remember your name is spelled with an A and not an E, and so on. You know, typos.
One of the things I did on my old email was set up a trash email box. That is, people could email `not-me@domain.com` or `me@olddomain.com` and they’d get an auto-reply telling them the email was no longer in service. It was more important for an old domain I owned but didn’t use and yet people I needed to talk to still thought it was real. I could have forwarded it to me, but after 10 years, I upgraded to the “Folks, seriously!” alert.
Doing this on cPanel was pretty easy, making a custom alias that dev/null’d and sent a reply. Doing it on Gmail was a little weirder and made me think about the situation.
## Canned Replies
First you have to set up [Canned Responses](https://gmail.googleblog.com/2008/10/new-in-labs-canned-responses.html), which is a Lab (go to Gmail -> Settings -> Labs). You made a response like you make an email, only instead of sending it you save it by clicking on the down arrow and saving as a Canned Response:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/10/canned.png)
Once you have it saved, set up a filter so any email to `@domain.com` gets a reply of that Canned.
## Don’t Be Sneaky
If you’re thinking “Aha! I can use this to be sneaky!” with the intent of sending people emails to pretend you really are reading it, there is a problem with that. The email comes back from `YOU+canned.response@example.com` and no, there’s no really easy way around that. Someone did come up with a [Google Script](http://webapps.stackexchange.com/questions/44214/is-there-a-way-to-avoid-canned-response-in-the-email-address-using-gmails-ca) for it, but it’s not for the faint of heart.
Now the question is, is that a bad thing? Is it bad for people to know they got a canned reply? No, not really. By putting in the `+canned.response` it’s obvious that it’s a canned, but it’s also obvious for you and you can filter the emails however you want. People who reply to canned? Auto-trash ’em. Or block them.
## Filters
Instead of the canned reply, though, you can also just discard the email. Either don’t even bother to set up the email (or it’s alias at all), or if you do, filter it out and dump it. The only reason I could see bothering to make an alias for email you don’t want is if you either plan to review it later, or if you have a catch all email address. If you do this, making an alias, make sure you filter the emails and mark them read so you don’t get distracted by them.
## Catch All
There’s a slightly different approach to all this, though. The idea of a catch-all email. By default, G Suites sends all your misdirected emails to trash. Accidentally mailed `bob@example.com` instead of `b0b@example.com` because the numbers and letters look the same? Tough luck. Unless Bob was smart enough to set that up as an alias (which I tend to do), your email was lost. The alternative is to designate a user as a ‘catch all’ account that gets everything that doesn’t belong to an existing user.
That catch-all can auto-reply to all emails, forward ones that are important, and everything else. If you’re a business, you should do this so you don’t lose any misdirected emails from customers (they can’t spell after all), but remember to check that email often as it will also collect all the spam for all your accounts.
**Categories:** How To
**Tags:** email, google
---
### [WordPress Multisite 101](https://halfelf.org/2012/wordpress-multisite-101/)
**Published:** March 30, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I wrote an ebook about running your own network without tearing out your hair. It's a cheat sheet for the rest of us.
**Content:**
So there’s this thing. I blog a lot, but sometimes the ‘lessons’ I want to teach would take up a few thousand words. I’ve sorted out that any blog post over 1200 words is ‘too long’ and I try to split it up. But then how do I organize it? Let’s face it, books are useful for a reason.
After compiling and colating all the emails, IMs, forum posts, and blog posts Andrea and I have made over the last couple years, we realized we had a novel. The problem was organizing it so the scope wasn’t maddening and daunting for us to write, nor for the user to read. Finally inspiration struck. If you’re using Multisite, you really need to know WordPress first. You have to walk before you can run, as they say, and with Multisite, you have to already know how to do the basics.
This book will *not* teach you how to pick a host, copy files up, create a database, or any of those things. It won’t even tell you if you should or should not use Multisite. What it *will* do is help you go from WordPress to WordPress Multisite, configure the options, understand what they mean, sort out the standard problems, and help you figure out what you need to know and where you need to be in your own head in order to do this thing.
And it’s free. Well, no. It’s not. It’s pay what you want.
That’s the other thing. I could go the traditional route with a book, find someone to publish it, etc etc. Or I could self-publish on the iBook store or eJunkie and take a hit for the overhead and the hassles of all that. Or… Or I could address the real problem about making ‘money’ with books. Obscurity. I have a whole [philosophy about paying for ebooks](https://halfelf.org/my-ebooks/) and you can read it if you want. But the tl;dr for you is this.
Pay me whatever you think the ebook is worth. If you aren’t going to pay, you weren’t anyway, and that’s nothing lost from my end. I’d appreciate a fiver if you find it useful. I totally support you downloading it first, reading it, then paying later. After all, how do you know it’s what you wanted without reading it?
Grab a copy of [WordPress Multisite 101](https://halfelf.org/ebooks/wordpress-multisite-101/), it’s in ePub and PDF. You know the drill. Right click and save as.
**Categories:** How To
**Tags:** ebooks, multisite, wordpress
---
### [WordPress Multisite 110 - Electric Boogaloo](https://halfelf.org/2012/electric-boogaloo/)
**Published:** May 31, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The sequel is out. It's still pay what you will. If you like Multisite, this is the next step up.
**Content:**
[](https://halfelf.org/ebooks/wordpress-multisite-110/)
**Introducing [WordPress Multisite 110](https://halfelf.org/ebooks/wordpress-multisite-110/)**
I promised a sequel and I delivered. I hope you guys find it helpful. The sequel is out, and it’s longer than the original. Weighing in at over 80 pages, WordPress Multisite 110 has even more information about WordPress Multisite!
Why a sequel and not a second edition? There were more things to add than a few extra plugins. Branching into a little more philosophy and explanations to the whys, Multisite 110 hopes to be the second handbook you’ll need. The funny thing is most people who read my site regularly don’t need this at all. But your clients might. Imagine being able to hand that off to them saying ‘I’ve got you started, here’s how you can make it epic.’
Oh yes, with a Creative Commons release, you can pass this on to your clients as you like. I won’t stop you, just don’t sell it to them. If you want to get into the shenanigans, you can bill them for it, but not sell it. Yeah, licenses will kill us all one day. Speaking of licenses, there’s code in this one, and it’s all under GPL2 (most of it’s also on this site already).
What’s not in it? Deep diving into the database. Fixing *everything*… There’s no way to cover everything. This one gets into the machinations of how you make a multisite where everything looks the same, or where your admins aren’t admins at all. Favicons? Got that covered too! The White Page of Death? How to figure out what plugin you want? Man, you know I got your back! Backups, control, security, uploads… the list isn’t endless, but there’s a lot going on.
**Check out [WordPress Multisite 110](https://halfelf.org/ebooks/wordpress-multisite-110/)**
The post title of ‘Electric Boogaloo’ comes from a movie that came out in 1984: *Breakin’ Two: Electric Boogaloo*. All sequels should have that sub-title
**Categories:** How To
**Tags:** ebooks, multisite, wordpress
---
### [WordPress Multisite Control](https://halfelf.org/2016/wordpress-multisite-control/)
**Published:** June 20, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Where do the options and settings for network plugins go?
**Content:**
When you write a plugin for WordPress Multisite, you have three options for how to let users control the plugin options. It comes down to the manipulation of the ways we have to activate a plugin on Multisite, which are per-site or network only.
I’m a firm adherent of having the network control as much as it logically should, but allowing each site to pick unique features. Never should someone be shocked to find out they’re on a network. A network is, after all, a collection of WordPress sites. Now your collection may or may not be related, but at the end of the day, someone should never be surprised to find out the site they signed up for is on a network.
With this in mind, I separated the ‘control’ of the plugins into three groups.
## Network Only
A Network Only plugin is one that should be controlled via the Network Admin. While the Settings API is a terrible bag of wet hair for Multisite, if you have a network plugin, then it should be for the network. The plugins that have no interface at all should be network activated. This is really simple, but in general if you’re adding this feature to your network, you probably want it on for everyone. There are some rare exceptions, but in general, network *only* is the key.
Most network only plugins are clever enough to use `Network: true` in their plugin headers, which makes this much easier. If you think your code should only be activated by the network, use that.
## Per-Site
A per-site plugin is activated on each site, controlled from each site, and the network admins have no authority save uninstalling the plugin. These plugins are things that each site should decide how to use. When I look at my own sites, I have a few that are like this. Like [@Reply Two](https://wordpress.org/plugins/at-reply-two/) – when you look at it, you’d think it should be network only, but since it requires some per-site configuration with regards to comments, it’s best left as optional for each site.
There is no `Network: false` setting, I’m afraid.
## Network Only Activation with Per-Site Control
Here’s where it gets sticky, and plugins like Jetpack actually handle this better than most others. Take, for example, something like a plugin that adds features to a specific theme. If that theme isn’t active, the plugin shouldn’t error out. But a lot of us code our plugins to say “If this other plugin or theme isn’t active, don’t activate.” That sounds like a great idea except when you want to have it network activated. In those cases, the checks get weird and don’t run as expected.
And then you have to consider what should control what. I mentioned Jetpack because it has a network admin screen.
There you can enforce connections from your network admin, or not, as you see fit.
## Which One Is Right?
While I’ve postulated this is very simple, it’s not. For example, when you have Jetpack, do I want everyone to edit every setting or just some? I’d want them to have the ability to use the CSS editor per-site, but maybe not VaultPress or Stats. The checks for that code is not as logical as it should be. The whens for running those checks, the priorities and weight given to who is more important, is not obvious.
I would say that the Network Admins should have final say. But many people don’t agree with me on that. Many people think each site on a network would be best to exist on it’s own and stand alone, a part of a secret.
And that too deserves room for thought.
**Categories:** How It Is
**Tags:** multisite, plugins, wordpress
---
### [Genericons Neue](https://halfelf.org/2016/genericons-neue/)
**Published:** December 2, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A neue wave of generic icons.
**Content:**
In 2013 I made a silly little plugin called [Genericon’d](https://wordpress.org/plugins/genericond) which let you include Genericons on your site in a theme independent way, complete with shortcodes and flexibility for other plugins and themes that might be using it. In 2016, Generico became [Genericons Neue](https://github.com/Automattic/genericons-neue).
The changes were small but huge:
1. SVG instead of font icons
2. No more social icons
The problem I faced was equally small but huge:
1. How to seamlessly transition from font icons to SVGs
2. How to handle social!!?!?!
Thankfully Automattic actually did the hardest work for me, with [Social Logos](https://github.com/Automattic/social-logos). I can’t design logos. I didn’t want to abandon people. So for me, to be able to just include a second library in the plugin was a fast and easy fix.
The long and drawn out one was how to make the plugin magically transition. It took me a month, fiddling with it off and on, but as of version 4.0, Genericon’d defaults to using modern SVGs instead of fonts and combines the Genericon Neue icon pack as well as Social Logos to ensure your old code keeps working. If SVGs won’t work for your site, you can either use classic Genericons or the legacy font packs.
Yeah, I gave everyone ‘options’ while still making default decisions. For the most part, no one needs the old legacy stuff unless they’re supporting IE, so this should work right out of the box for everyone, new and upgrades. My only ‘beef’ is that Social Logos doesn’t have a release strategy, so I’m going to have to randomly check for updates.
A lot of the work I did to figure this out was just testing variations. I knew that by default I wanted everyone to use the minified, super fast SVG sprites, and by default you do. There are hidden options that would let you use the slower images, but I didn’t build out that interface because of the annoying complexity with setting up “if you have Genericons Neue, make sure you don’t have Genericons Classic!” That was a surprisingly large amount of ifs and elses to make it logically flow. I wanted to have it magically flip things over for you, but in the end I went with an alert if the plugin is active and you haven’t selected things.
You can also make your load even lighter by not including the social icons, but one thing that’s nice about SVGs over Font Icons is that if you’re not using them, there’s *no extra load* on the site.
**Categories:** How It Works
**Tags:** coding, plugins, wordpress
---
### [Postbox: Desktop Email That Doesn't Suck](https://halfelf.org/2016/postbox-desktop-email-doesnt-suck/)
**Published:** November 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** My desktop mail app of choice is Postbox.
**Content:**
While I greatly prefer to use Apple’s default apps whenever possible, I’ve been using [Postbox](https://www.postbox-inc.com) for my email for a while now, especially since I switched over to [Gmail for my email hosting](https://halfelf.org/2016/moving-cpanel-email-gmail/).
While you can use Mail.app with Gmail, it has a lot of issues. I’m not a fan of Gmail in a web browser, either, though I do use it for other things. I like having an app separate to my browser where I can read email. Gmail was built for … well … the browser. It’s never really been a happy marriage to Mail.app, and that’s because Gmail’s IMAP isn’t really IMAP.
Enter Postbox.
This is an app based on the open source Thunderbird, but I find it much easier to use. It has a Windows and Mac client, and it looks clean. Since the recent update this year, it’s a purchase I’m happy to have made.
I currently have two email accounts, one is my Gmail account and one is my ipstenu.org email… Except that second email actually houses a dozen aliases. They all get funneled to different folders based on which alias they’re sent to (or who sent the email at all). My goal was to have only my important emails land in my inbox, which basically means my wife or my family.
Postbox pretty much just works for me. It’s well documented for how to [configure for gmail](http://support.postbox-inc.com/hc/en-us/articles/202200490-Using-Gmail-with-Postbox) and it lets me use my keyboard to navigate between folders. I love the arrow keys to go up and down and see what my email is.
About the only thing that annoys me is there’s a random `[Gmail]` folder I can’t seem to get rid of. Also you have to be careful about the Gmail [All Mail folder being too large](http://support.postbox-inc.com/hc/en-us/articles/202198700-How-to-use-Postbox-with-a-large-Gmail-All-Mail-folder) but that’s really a problem with Gmail more than any app. In fact, it’s most of why Mail.app is so terrible to use with Gmail.
Postbox isn’t perfect. It can suck up a lot of memory, and there is some hands-on configuration. This is no ‘set it an forget it’ email client, but again, that’s back to Gmail being a giant moron with regards to IMAP. When compared with Mail.App, I find it more reliable if you have multiple accounts, but also if you have a lot of dynamically sorted folders. Like I do.
If you’re just using one Gmail account, or you don’t have a complex set of filters and rules, this is overkill. But if you do, give Postbox a try. It has a free trial after all.
**Categories:** How It Is
**Tags:** app, apple, macintosh, mail
---
### [Hiya: Bye-a Spammers!](https://halfelf.org/2016/hiya-bye-spammers/)
**Published:** November 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Save a headache and kill the robocalls!
**Content:**
Do you get calls from scammers and telemarketers?
Trick question! We *all* do!
I stopped getting so many recently, thanks to [Hiya](https://hiya.com). The claim?
> Hiya identifies the calls you want to pick up and automatically blocks the ones you want to avoid.
And guess what? As of iOS 10.1 it sure does. I installed it after a day when I had *eight* scammer credit card calls in a row. In November, a day happened when I got a series of robocalls, and I didn’t answer any of them. My phone flashed, said it had a call, and then it went away, like a hangup. Curious, I popped into my call log to see who’d butt dialed me and saw Hiya flagged the number as a scammer.
They were right. They’ve been nothing but right since I installed it and configured it, and I’ve been unbothered by crazy phone calls.
Setting up the app is onerous, I’ll warn you. On an iPhone, after I installed Hiya, I had to go in to Settings -> Phone -> Call Blocking & Identification. There I had an option for Hiya to allow the app to block calls and provide caller ID. And once I toggled that on, it took minutes for my phone to sync everything up but … Once it was done, the app worked exactly as expected.
The bother went away.
Now for the dark side. Hiya needs access to your contacts. Their [privacy policy](https://hiya.com/hiya-data-policy) isn’t fully clear on what they do with it, but they do say they take the numbers in your contacts to build a whitelist. After all, people you add to your contacts aren’t likely to be spammers. But they also claim not to use your information, sell it, or market to your contacts. They also don’t sell to 3rd parties.
As a California resident, I can write and request (once a year) for a list of everyone they gave my information to, so I may do that later, but they appear to be on the up and up. They’re FTC governed, though given that the drama with all this started because they’re doing fuck all at stopping spammers, your milage may vary.
Me? I’m kicking scammers to the curb.
**Categories:** How To
**Tags:** app, ios, review
---
### [I'm Fine With Envato](https://halfelf.org/2015/im-fine-envato/)
**Published:** March 2, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I really have no issue with any theme shop. They're doing nothing worse than anyone else.
**Content:**
I just don’t use ThemeForest.
Look. I think Envato is actually pretty awesome. They’ve made a way to help people monetize development within WordPress. I’m all about that! I want to see people making a living from WordPress and I want people to be able to succeed and make WordPress even better. A number of people I know who are currently successfully running their own WordPress related business got started over there.
So why don’t I use their products? I haven’t had a need to. I don’t use WooCommerce either, or their themes. There’s nothing wrong with that. But there is a ‘problem’ with Envato, or rather there’s one with ThemeForest, and it’s the same problem as we have on the WordPress.org plugin repository.
The last (and possibly only) time I mentioned them, I said I had an issue with their [lack of upgradability](https://halfelf.org/2014/self-update-your-plugins/ "Self-Update Your Plugins"). If I buy a theme or a plugin, I can’t easily get updates. I’m stuck on the old way of download when I get an email. There’s no way to do it easily from inside my dashboard. This is a problem of our own creation. Ten years ago, that was normal. Today, we have a reasonable expectation to easily upgrade WordPress, it’s themes and plugins.
I happen to know Envato’s working on it, so I still look forward to their solution.
But they have the *exact* same problem as we have with the WordPress.org plugin repository: crap code.
You see, there’s only no practical difference between the WPORG repository and ThemeForest and how it handles reviews except they actually may be checking on every upgrade. If you didn’t know, [ThemeForest does review things](http://lovethem.es/themeforest-review-process/). But they do it *exactly* like we do! They read the code, they test it, they look for evil things, and they approve or not.
Theme review on WPORG is a tighter ship than plugin, for a few reasons, but frankly I doubt the overall quality of code on WPORG (plugins) or ThemeForest is all that different. We’ve had some pretty insane vulnerabilities in plugins, after all, and the WPORG repository *doesn’t* have a great way of dealing with them. But to say that you don’t trust ThemeForest because the code quality is bad while simultaneously using any free plugin from ORG is naive at best.
The constant problem we have with plugins, and one they have with ThemeForest themes, is that we allow a lot of different types of code. In being liberal like we are, we can allow for a lot more creativity and expression and, well, art. The downside is that there’s a practical limit to what a human being will be able to catch. We’re like the TSA. We try, but we’re fighting a loosing battle and that’s why we’re always going to miss things and we’re always going to be running behind and cleaning up.
And worse they have the same problem with any code they yank. How do you upgrade everyone? When is it right and safe? When is it an overstep? Weighing security risks with information with compatibility is complex. For the WordPress.org repository, we have a long way to go before we’ll be able to push minor security updates like core can… at least not without a lot of fear and consideration. We’re on the road there, though, so one day you may wake up to a plugin magically secured on your site.
Oh and as a reminder? If you see a WordPress.org plugin hosted that is insecure or doing evil things, email with the plugin URL and all the possible information about how it’s insecure. If you know how to hack it, please tell us exactly what you did. You make it faster for us to sort things out.
For Envato, you can report these things via their [Helpful Hacker](http://webuild.envato.com/helpful-hacker/) program.
**Categories:** How It Is
**Tags:** essay, plugins, security, themes
---
### [If You Call Yourself a Developer You Should ...](https://halfelf.org/2015/call-developer/)
**Published:** May 13, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There are expectations that come when you make a claim of being a 'developer of ten years.'
**Content:**
Sometimes people scare me. Mostly it’s people who start a conversation with some variant of “I’ve been a developer for X years and I’ve never experienced a conversation like this…”
It tends to come up when I kick someone’s code back and remark “Remove your own jQuery, delete the demo folders, and your domain name is a problem so change X to Y.”
They get upset because I’ve not spelled out, specifically, to the letter, what’s wrong and where. I’ve had those conversations with everyone from a mom-and-pop shop coder to Microsoft and it really only bothers me when people are running dev companies and ask things like “How do I find that?” or “Where is that code?”
So here are my rules of what a Developer should know:
## Know Logic
You should understand logic. Not Spock Logic. Math Logic. And Computer Logic. Don’t worry. I don’t think you need to be a math rock star to write code. I think that if you understand basic algebra, which you may be surprised to know you do, then you’re okay. But you have to understand the most basic of logic gates:
Can you look at that and understand the differences? Great. Write some code. Understanding the elementary building blocks of circuits, the A or B, the Yes or No, is the crux of programing. If you can’t logic that out, you should stop and read up on it. Most self-taught programmers have intuited that, but at some point they had a class in Boolean Algebra and learned this. Maybe it wasn’t called that, but most of us had that class in at least High School. You’ll need it.
## Know Grep
You need to know how to search all the files in your code. If you’re on a linux flavor, grep or ack are your best friends. So when someone says “I see you’re calling domain.com in your code, why?” you know how to find that, even if they don’t give you a line.
## Know What You’ve Got
You need to know all the packages added to your code. Did you add a library or a sub-module? This is your responsibility to know what they are. That way, when someone tells you to ‘remove the X module’ you’re not surprised. If it’s in your code, you should know what it is.
## Know What You Need
You need to know what those packages are adding to your site. Did you download a whole jQuery library with all the demo files and a version of jQuery and the help docs? Do you *really* need all that? Dollars to donuts, you don’t. Don’t let your code be cluttered by what you don’t need. It’s more work to maintain it, and if there’s a security hole in it, you still have to be aware of it. Save yourself time, effort, and a hack. Leave out what you don’t need.
## Know What To Use
You need to know how to edit the various filetypes. Personally I don’t care what you use. I like Coda. My friends like Sublime. I don’t care. Just make sure you use something that works for you and helps you work better. While you can do all your programing in Notepad, I wouldn’t suggest it. You will need tools to help you keep track of the complex world you’re building. Sometimes you’ll have to use a specialized tool.
## Know How Your Tools Work
Did you know Github makes a downloadable zip of your code? Did you know that zip *doesn’t* include submodules? Did you know Github forks aren’t searchable? You should. I have a few awesome tools, like Coda, which lets me search my repositories and find code. I use BBEdit to search zips. I use a new tool to compare folders when I don’t have version control (for whatever reason). But I know how they all work.
## What Else?
What do you think is imperative for someone who calls themself a professional developer to know?
**Categories:** How It Is
**Tags:** coding, development, essay
---
### [The Trouble With Libraries](https://halfelf.org/2016/trouble-libraries/)
**Published:** March 7, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The recent brouhahah with plugins and frameworks (and libraries) brings up serious problems and no perfect solutions.
**Content:**
I’ve had the same argument over and over, to the point that people follow me here and complain that I suck. You’re welcome. I’m going to spell out the issues, as I **personally** see them with frameworks as plugins. If you want to talk about this in so far as it applies to the WordPress plugin repository, please read [this post](https://make.wordpress.org/plugins/2016/03/01/please-do-not-submit-frameworks/) and keep the discussion there.
## The Problems
Problem 1 – Users have no idea what the ‘library’ plugin is for.
Most users understand “I have an add-on for WooCommerce, I probably need Woo.” They do not always understand “I have plugin Slider Joe. Why do I need Advanced Custom Fields?”
Problem 2 – We don’t have true ‘dependancies’ in WordPress
I think everyone can accept that’s a problem. We literally do not have a perfect way to require things. Look at Themes. If you try to delete a parent theme, you get warned there are children around. We don’t have that for plugins. We probably should.
Problem 3 – Users are responsible for something they don’t understand.
By having a library as a plugin, the onus of version compatibility and updates is now on the person least likely to understand it when it breaks: the user. They have to update the library, and your plugins, every time there’s a new version.
Problem 4 – Frameworks and libraries can no longer break backwards compatibility.
This is hugely restrictive, by the way. With a framework-as-plugin you can’t break things because you (the framework developer) are responsible for *all the plugins that use your framework*. If you break how things work from V1 to V2, and one of the myriad plugins a user has *doesn’t* work on V2, and the user updates your framework, you broke things. True, this was always the case, but at least the plugin contained the library and could use it’s own version.
Problem 5 – Plugins will still break.
I have to say ‘still’ because we have one version of the problem today, and we’ll have another tomorrow. Right now, if four plugins include the same library, and they’re all different versions, we don’t have a clear and perfect way to know which version of the library the user will get. Tomorrow, if a framework is a separate plugin, there’s absolutely no assurance than every plugin that requires that library has been tested with the version the user has install.
## The Options
Today we really have two.
Option 1 – Frameworks are plugins and users have to install them.
This means all new plugins that include said framework have to remove it and change it to a require. All existing plugins should be contacted and told to change their code. Some users will complain about installing ‘extra’ plugins and some developers will lose users (it’s already happened).
All developers have to put in this requirement themselves, possibly using a library like TGM (until we have dependancies). *Also* all developers have to ensure they, now and forever, keep up with the frameworks and ensure compatibility as well as proper alerts if a user removes the framework by accident. Their code has to break elegantly if the user *doesn’t* upgrade the library. Your plugin takes advantage of the latest feature in a framework? Awesome. Make sure your plugin checks “If this feature exists, use it” and fails *gracefully* if not.
Option 2 – Frameworks that are not ‘functional’ frameworks, but really libraries are treated as all libraries are with all projects, and included separately.
Developers have to code the calls to the library, making sure that the ‘right’ version is included no matter what someone else includes. Developers also have to update their plugins when a library updates. though if they properly handle the code calls, they don’t HAVE to. They could use namespaces and cleverly call `use MYPLUGINAWSSDK as /aws/AWS/foo/bar` instead, so their version is what’s used. They’ll probably want to code in a failsafe “If a version higher than mine is used, show a warning.”
## The Solution
Looking at the options we have today, we have to ask “Which is better?”
Neither. They both suck for developers. They both suck for the users. They both frustrate everyone. I have heard arguments from the same number of *developers* for each option. Some developers want to include the ‘core’ or a framework in their plugin because it’s ‘better’ than requiring another plugin. Other developers want the other plugin so they don’t have to be responsible to update the library.
There is, clearly, an argument to be made in both cases. There isn’t a win here. Personally, I think once a framework or library exists as a plugin in the .org repository, you should remove it from your plugins and require it. Of course, good luck figuring out how to do that in a sane way without breaking people. The best I came up with was have a period of time where you keep the library while using TGM or something to require the other plugin. Make an alert or notice to tell users to install the requirement. Keep that for a whole major version. Then, on the next major version release, drop the library.
With all that in mind, we have to ask this instead “Which option annoys users slightly less?”
That’s #2 – libraries as libraries, not plugins. The one where the users don’t have to know (or care) about it anything except “I have plugin X.”
**Categories:** How It Is
**Tags:** essay, frameworks, plugins, wordpress
---
### [Arbitrary Component Upgrades Are Not Helpful](https://halfelf.org/2015/arbitrary-upgrades-harmful/)
**Published:** November 25, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Is Bootstrap making the biggest mistake by upgrading a component when they don't need the benefits?
**Content:**
Often WordPress gets shit for still supporting PHP 5.2. In fact, while they *recommend* 5.6 or up, WordPress still works on 5.2 and probably will for years to come, even though everyone knows PHP 5.2 is buggy, insecure, and not supported. No sensible webhost still uses it if there’s an alternative, but sadly [there are reasons why some hosts are stuck on it](https://halfelf.org/2015/road-php-5-x/).
Why does WordPress still work on 5.2? Because there’s little benefit to be had in upgrading, and only harm. As I’ve said before, [in the name of progress we run the risk of running ourselves right off the cliff](https://halfelf.org/2015/i-am-20/). There’s nothing in 5.4 that WordPress *needs*. Please remember that I am a stickler about needs vs wants, there’s a lot we want, but nothing that is critical and that cannot be accomplished in a PHP 5.2 world. One day that will change, and when it does, we’ll rethink this whole argument. But right now, there is no need.
My fear with a PHP 5.2 upgrade is that the people we would hurt with it are the ones least capable of resolving the problem. If we showed users an alert on their admin dashboard saying “You’re using PHP 5.2, please contact your hosting administrator and ask them to upgrade to a modern, secure, version of PHP” then we’re telling the *wrong* people something. It’s not the users who need to hear this, it’s the webhosts. And speaking as one? We know. Not only do we know, we actually care more than you do, and we’re working on it for everything *not* because of WordPress and it’s 25% market share, but because we know it’s the right thing to do.
But this is not a PHP version debate. This is actually a reflection on something happening today. You see, WordPress still uses the 1.x branch of jQuery. Why? Again, it works. There’s no reason to upgrade to jQuery 2.x and doing so would break things. Among other reasons, WordPress still supports IE 8 which is used by 11% of computers out there. That’s not a small number. In fact, 11% of *WordPress sites* still use PHP 5.2! You see the situation? 11% is not insignificant.
This comes up because [Bootstrap 4 has decided to drop support for the jQuery 1.x branch](https://github.com/twbs/bootstrap/pull/17494). As far as I understand, they don’t want to support IE 8 and it’s 12% smaller. There isn’t a single code benefit that is included in jQuery 2.x that Bootstrap is using and, since jQuery 2.x is compatible with 1.x, you can switch back to it right now without any loss. But they don’t want to support IE 8. In fact, they don’t support it, and from that perspective it sounds wise, doesn’t it?
It’s not.
WordPress includes its own version of jQuery (still on the 1.x branch) and many other similar JS files, which have all been rigorously tested with both WordPress and many of the most common plugins. In order to provide the best compatibility and experience for users, WordPress asks that you *not* package your own (especially not an older version) and instead use `wp_enqueue_script()` to pull in WordPress’s version. There are many reasons for this but the simplest are as follows
1. WordPress *has* jQuery. Save diskspace and leave your own out.
2. If every plugin and theme removes WordPress’ jQuery and uses their own, there’s a potential for conflicts. Who’s jQuery wins?
3. Using your own jQuery changes the way WordPress plugins and themes may work in unexpected ways.
Can you remove jQuery and use your own? Of course! You just can’t host your code on WordPress.org if you do that.
Now, there’s a missing metric here. What the percentage of sites using Bootstrap are on WordPress? For that I’m going to have to extrapolate. Looking at [builtwith trends](http://trends.builtwith.com/docinfo/Twitter-Bootstrap), it looks like 1.8% of the entire Internet uses a site with Bootstrap. Joomla 3.x uses v1.11.3, Drupal 7.x uses jQuery 1.4.4, and Drupal 8 will use 2.1.4. Remember this is a total rewrite of Drupal, though. They do not concern themselves with backwards compatibility when they jump to new versions, and that means you cannot measure the percentage of sites on the internet that will use Drupal 8. We can reasonably assume, since WordPress is fully backwards compatible, that the 80% of WordPress users who are on the 4.x branch *will* upgrade to 4.4 in December, and continue to do so for the future.
Even if we cannot claim that 25% of Bootstrap sites are on WordPress, we *can* argue that with all major CMSs currently using jQuery 1.x, Bootstrap is about to kick a significant portion of their audience to the curb. Of course, not even 2% of the Internet is using Bootstrap. Will that be a great loss for the Internet? Not really. But it will incur a massive lost to Bootstrap.
This real life example is *precisely* what I mean when I say that I worry about the user experience with our bold assumptions in our projects. Bootstrap’s logical assumption, that since they don’t support IE 8 there will be no loss by moving to components that don’t support IE 8 either, is a fallacy. They are thinking only on one level. They’re only seeing the ‘benefit’ (and I use this term loosely) of formally ending support for a user-base they never supported in the first place. This won’t impact *their* users, so it doesn’t matter.
What they’ve neglected to consider is that their userbase actually encompasses *other* people who support IE 8. So while we know that no one using Bootstrap and WordPress supports IE 8, simply by dint of using Bootstrap, this new jQuery version actually forces them to exclude them, instead of passively. And by doing this, they will shortly find plugins and themes that use Bootstrap 4 rejected from the repository, which will only harm adoption of Bootstrap as a framework.
This isn’t a threat. This is reality. This is the difference between “We don’t support IE 8” and “We would rather not support IE 8 than be compatible with 25% of the Internet.”
Looking at it that way, it’s a simple call.
Put jQuery 1.x back in. Make 2.x a recommended option. And move on.
**Categories:** How It Is
**Tags:** development, essay
---
### [The Details of Your Life](https://halfelf.org/2015/details-life/)
**Published:** December 4, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Your pain doesn't really make anything go any faster.
**Content:**
> Becuase it’s my son’s birthday this week, can you please do X faster?
I get emails like that a lot. It has to do with the nature of my volunteer work. It doesn’t really matter what the actual, technical, request is. Pretend it’s a request to reboot a server.
I don’t need to know that your partner left you, took your dog and your truck, and so it’s really the worst day in the universe for your site to be down.
The truth of the matter is I really don’t care. No one in support (dev or tech or any) actually cares about the country song that is your life. This doesn’t mean we don’t emphasize with you and feel sorry that you’re having a crappy day. It means the crappiness of your day doesn’t magically make us be able to do things faster.
That server reboot? All the sob-story in the world will just not make your server reboot faster. Got a security issue? Ranting about how life is unfair doesn’t get it fixed and reviewed faster.
We do get it. You’re having a shitty day and this one thing, this item that appears to be at the arbitrary whim of some relative stranger, is holding up your ability to feel better. Except we’re not. We’re following process and procedure for a reason. The world is bigger than just you, and we have to consider all of it when we do a thing.
If rebooting your server impacts more people than you, say 500 other people, then we can’t just reboot on demand. We have to ensure we won’t break them either. If the security fix isn’t complete, or worse, we find more insecure things, we can’t wave our hands at it. We know what hackers look for and we want people to be safe.
When you’re having the worst day of your life, when your server is down or your plugin is closed or your account is locked out, stop making it worse. Take a deep breath. Remember that the world is a big place. Ask politely and trust that the people are doing things to the best of their ability and speed and safety for you and everyone else.
**Categories:** How It Is
**Tags:** essay, support
---
### [Circular Arguments Need Research](https://halfelf.org/2016/circular-arguments-need-research/)
**Published:** January 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The circular arguments, that silence proves success, or at least an acceptable status quo, need to be thrown out on their ears.
**Content:**
There’s something I hate about the fact that they charge for tampons and pads in bathrooms. I understand the financial outlay of providing a ‘service’ but at the same time, the collection method means that most of us never use them. After all, on those occasions when a woman needs a tampon or pad from those machines right bloody now, we probably don’t have our purses with us. Most women I know keep at least one in there for just such a moment, after all. If we don’t have our purses, guess what else we don’t have? A dime! In my experience, any time any woman has stared at that machine with a look of hopelessness and despair over their lack of a dime, another woman has brandished her personal emergency tampon and handed it over without a second thought.
So why do they charge? Well if they didn’t charge, then people would just take them and that would be a financial loss. I get that. Except, as my friend Mark Jaquith put it:
> Financial outlay is an imprecise way of validating the intensity of a need.
The day I had my great-tampon-rant was the same day I’d argued with some folks about marketing. Someone who is a ‘known’ person in the WordPress community got a bog standard email from a hosting company. It was one of those emails that looked like it was meant to feel personal, but was really just a sales pitch about what the company was and how they worked.
The thing about that is I’m pretty damn sure the person who got the email knew all of that already. He may have known it better than the ‘person’ who sent the email. I say ‘person’ in quotes because I’m sure it was an automated campaign set to hit up people who’d emailed or used a contact form and asked a question.
And this bothered me.
If the email *hadn’t* made an attempt to be personal, and instead just said “Hey, you used our form/emailed our service address recently. Did you get all the help you needed? Do you need to talk?” I would have been just fine with it. And if he’d checked a box to say “Please contact me about stuff!” I’d similarly say “Well you deserved that one, B.”
The reality is that he filled in a form to get a ‘report’ that he wanted to read and got that personalized email within an hour. The company offered something for ‘free’ but the cost really was data collection. Furthermore, the penalization was immediate solicitation.
It doesn’t matter who the company is. This could be mine (it’s not) or yours (it might be). Pretty much every company known to humanity has done this at least once. And every company uses the justifications that the marketing strategy converts people into sales, and thus it’s fine. We all accept that marketing automation is hard, that identifying people we should be reaching out to and separating them from the ones who will just be annoyed by our hard sells is extremely difficult.
Remember what Mark said?
> Financial outlay is an imprecise way of validating the intensity of a need.
Not enough women using the pay-for tampons and pads is (part of) why they’re never going to be free. Women don’t use them because they’re pay-for (and we rarely have the damned dime).
The ‘need’ of tampons is not being correctly measured.
With those marketing emails, I would say this:
> Financial boons are an imprecise way of validating the effects of a campaign.
Yes, I’m aware I just said that “Making money doesn’t mean your campaign was successful.”
Except that’s not what I’m saying. What I’m saying is that the effects of your marketing are more than *just* financial. If you send out 1000 emails and get 1 sale, that sounds like ‘free money.’ Very little output and work nets you money. Everyone wants this. The problem is how many people did you chase away? What *net negative* are you creating? We’re not tracking the information in a way that lets us know this. We’re just thinking that any news, any discussion, and any income means it was good and effective.
Let me ask this differently. How many auto-play ads have you seen on a website that made you like a product *less*? How many websites have you quit visiting because you can’t stand their ad practices?
Not all press is good press. Forbes recently had a snafu where [they asked you to turn off adblocking only to serve up ads with malware](https://www.techdirt.com/articles/20160111/05574633295/forbes-site-after-begging-you-turn-off-adblocker-serves-up-steaming-pile-malware-ads.shtml). They had a rather immediate and vocal negative impact. I doubt that level of embarrassment and pain will hit this company, but at the same time, we should be looking towards other, better ways of attracting new customers.
## This Can Be Fixed
Looking at the situation that led to this in the first place, requiring an email to download a report is an obvious ploy to gain a list of people to contact. There was no attempt to opt in and no information that the email would be used for marketing. Step one is to disclose that. Step two is to actually make that opt-in. Step three is to provide some additional reward. “Do you like reports? Click here and we’ll send you our next one right away!” Then when you send those next reports, you can put a little footer for sales. “Interested in our stuff?”
Step four is the hardest. Curate the damned list. Remove all your customers. You already have their emails, you don’t need to email them about your services. Put them to the side. Next you want to remove people with emails like support or webmaster. In addition, you’ll want to check your list for people who already know about your product. WordPress is an incredibly small community. There are some people who just are not ever going to be your target audience, who aren’t going to need that sale, and you don’t need to bother them. They’re also the ones who will uncheck the marketing email, of course, but just in case…
Step five is handling your existing customers (the ones you removed in step four). Put them on separate list to target with different emails. “Hey, you’re already our customer and we noticed you liked X. Would you be interested in Y and Z?” Of course if your customers have checked that box to say “Don’t email me with marketing stuff” then you damn well better respect it.
For step six I want everyone to *stop* pretending these are personal emails. Shut up. Give up. We know, okay? We absolutely, 100%, without a doubt know that you automated this stuff. And that’s totally okay. But you cannot claim personal emails, from real people, while not vetting the people to whom you’re sending email in the first place. Okay? Good. Now go be quirky! “Hi Mika! I set up our robots to email people who downloaded X because I wanted to make sure they knew about Z and Y! Hate these emails? Click here and we’ll delete you from the database.”
## But Can It Be Automated?
Not entirely. No. The real question is ‘Should it be automated?’
This goes back to Forbes. They automated their ads. They set it and let it run without review. Obviously the answer *there* is ‘No, that should not have been automated.’ It’s easier to ignore them and trust the ad company. That said, regularly I go through the ads on my site and delete them when I find them annoying or offensive. Yes, I curate my ads. And if someone tells me “Hey there was an ad for porn” I go look for it!
As much as we’d love to automate these things, we can’t. We just need a human taking a look now and then to go “Hang on…” Marketing cannot be set it and forget it. We have to look at the return on investment. We have to understand what impact, true impact, our campaigns have. We can’t just look at the net income, we have to be aware of the seemingly invisible loss.
And as for those tampons? We need a better metric than just “Well some people pay for them, but not enough to make us think a lot of women will use them if we give them away for free….” Maybe they could just have a nice box of tampons and pads in every stall, where you can press a lever and one item falls out every X minutes. Or maybe that idea of a drop of menstrual blood works in place of a dime… At any rate. The point is assuming things as successful because of a lack of response does not actually mean they are.
The circular arguments, that silence proves success, or at least an acceptable status quo, need to be thrown out on their ears.
**Categories:** How It Is
**Tags:** essay
---
### [The Despair of Licensed Updates](https://halfelf.org/2016/despair-licensed-updates/)
**Published:** April 20, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The drama is that which we brought on ourselves.
**Content:**
I am a massive proponent of people making money off of plugins. I think they can and should find a way to create a business in this ecosystem we’ve created.
There’s a problem with the approach of some of these products, and in a way we created it ourself, and it hit WordPress 4.5.
There is a plugin, it doesn’t matter which one, that’s a premium plugin. It’s not available for free on WordPress.org. You have to buy it, get a license, enter the license into the plugin, and in that way get updates. That’s fine. But there’s a complication. Actually a couple.
## Licenses Expire and People Aren’t Informed
That’s a big ‘no kidding’ moment, but they do expire. And people don’t always notice that their license expired. Even if you post a big sign on the dashboard and email them.
Worse, people don’t know they have license. One of the major problems with software, when purchased for a company, is ownership. If I buy an app on the company dime, it’s their app. But when I buy an app for someone I’m building a site, and I pay for it myself, even if I charge them for it, who owns it? Who keeps the license? Who has the information for running a site?
This is an aspect of WebDevelopment where we collapse, regularly. Not just WordPress, every single person who builds websites for someone has screwed this up at least once. Either the information isn’t clear, or it’s not there at all. Regardless, what happens in the end is you have someone who lacks the information they need to keep their company going.
## The Plugin Is Often Bundled in Themes
This is worse than you think. The official directions for this says that if your theme bundled it, and you need an upgrade, you need to wait for the theme to upgrade *or* you need to buy a license yourself. That’s perfect, to me, except for the problem I mentioned before. People don’t *know*. I’m not sure how they should know. But those bundlers, they’re so very problematic because they remove users one more step from the information.
If I buy a theme, and it has a library inside it, it’s the job of the theme developer to update that theme regularly, test it with WordPress before the new version comes out, and push fixes. If I buy a plugin, ditto. When the stream cross, though, is where we have the drama. Because I know I bought the theme, but I do not know that I bought this mystery plugin, hiding deep inside. Now it’s the theme owner’s job to update and make sure I get the information right away.
## Pretty Much No One Gets It Right
Not even people I respect get this right all the time.
Let’s say you’ve written a plugin and have decided to handle all the updates yourself. I buy it, install it, and it works, everyone’s happy. What happens when I stop paying my license? Well I stop getting updates, that’s for sure. But do I still get *notifications* about them? Do I get an email? Do I even get an update?
There are some plugins that are free from pay-walled sites, but if you don’t have an active license for that free plugin, you will not get updates. At first I thought it was strange, since if I had a free plugin why wouldn’t I put it up on WordPress.org, right? But then I realized they’re creating the relationship. Once you ‘buy’ the free plugin, you have an account and information in their system. If it’s free, you’re the product.
All that aside, it comes back to the problem of what happens if that license, free or not, lapses? You could be annoying and pop up on the settings page “Hey! The license expired!” but people hate that and ignore it. You could email, but they ignore that too. There really isn’t a great way to remind people that (a) the license expired and (b) there are updates available.
## Or Is There…?
What if the updater kept checking, license expired or not, and when you clicked to upgrade it alerted you?
> You license for Foobar has expired. Please renew it in order to upgrade.
What if you got this email?
> Hey, you bought Foobar back in 2014 and that license lapsed. Normally I’d never bother you, but today I’ve pushed a major security fix. Since this is a security release, I’m offering you a discount. It’s already applied to your account, just log in and you can buy the upgrade at 50% off. If you’re not using Foobar anymore, click here and I’ll have your account flagged so we don’t bother you about this again.
How happy would you be to find out someone saved your soy bacon?
This would require the original developers to have your information, which they probably do, and some way to track those two things. That is, did your license lapse and do you care? That’s all they need to track and only one is an ‘extra’ since I’m reasonably sure everyone tracks the license.
## Make It Easy
If you make it easy for someone to know “This has been expired, here is one click to pay” *people will pay*. Yes, we love free, but we love easy even more. If you make it easy to pay, people will renew and pay. If you inform them of security issues, they will pay and upgrade. If you push them, the good way, about your updates, and make sure they know, they will be safer.
And then, when WordPress upgrades, your users won’t hate you.
**Categories:** How It Is
**Tags:** essay, open source, plugins
---
### [Balancing Information and Monetization](https://halfelf.org/2016/balancing-information-monetization/)
**Published:** July 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some thoughts on monetizing the web.
**Content:**
One of the many ways in which newspapers are failing online is in monetization. We have very few options, when you get down to it.
1. Ads
2. Subscriptions
3. Donations
No company can really survive off donations, so the question really becomes how do we balance ads and subscriptions? Many newspapers have tried the simple tracking method of allowing people to read X number of articles before informing the reader they have to pay. Others throw up splash ads before the article is posted. And another one shows only some of the article before requiring registration.
They’re all problematic.
Users ignore the ads, they don’t register, and they walk away instead of reading. The issue for the user is that they want as few barriers as possible between themselves and the news. They want to pick an article, click the link, and read. To be inundated with ads and signup popups is annoying, and I suspect the attrition rate is abysmal.
This only gets worse when ads get ‘clever’ and make it hard to find the X to click out and get away from them. They trick users into clicking the wrong thing, which only annoys them more. Plus ads can slow things down on mobile, which is increasingly the way for things to go.
Recently I caught myself thinking that one way to encourage registrations in WordPress would be to have the post content ‘disappear’ after X days, unless the user was a member. Of course, that wouldn’t work for all sites, as not everyone wants to register on People.com. Also the old, archival news on The New York Times are things that really only the deep diving researchers (and weird net denizens) are after. Considering we can all go to the library and look everything old up on Microfiche, why do we have to pay for everything old?
So what should be limited?
How about we start with that cesspool of the internet: Comments. This is a double edged sword. If you allow open comments on a news site, consider requiring registration for them. This will allow you to more easily track and ban assholes. Sure, they can make new accounts, but in doing so you can follow them and block them. A win for everyone. Also you can track people who false-report bad people. Spam catchers will stop most bots from signing up at all.
In addition, you can turn off comments for older posts to non-paying users. After 45 days, only paid up members can comment. And make sure you don’t offer refunds if the guidelines are violated. If haters are gonna hate, make ’em pay for it.
Aaron Jorbin – Haters Gonna Hate (by Helen)As for what content to restrict, it has to be more granular than just time. Take an election year. *All* articles about Hillary Clinton and Donald Trump should be readable. But read-only. No comments on any of them. Be realistic. Someone famous dies? Unlock all their posts so everyone can read all about them. The Olympics should have historical, important, events unlocked, but at the same time you don’t need every little detail.
This would be a tremendous amount of work, don’t get me wrong, but the days of assuming the internet is free money are long over. If we want people to pay us for content, we have to make it worthwhile.
**Categories:** How It Is
**Tags:** essay, monetization
---
### [Dog Shaming Disclosure](https://halfelf.org/2016/dog-shaming-disclosure/)
**Published:** August 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Publicly shaming people does not make them better. So stop it.
**Content:**
You’ve probably seen this. A dog with something around their neck saying “I ate the carpet.”
We think that it’s funny because the dog often has no real idea what they did wrong, and we’re embarking the absolute absurdity of the moment. At the same time, we’re terrible people because we’re mocking a creature who can’t understand what we’re doing. So we’re pretty shitty people.
This is not about any one specific company or group or person. This happens weekly. I see people tweet and post and point fingers in public well before they ping people privately or directly. I see people come into Slack and announce “This is vulnerable!” I see people post in forums the same thing. Some of these people don’t know any better, but worst is when they *do* know better.
While we bandy about the need for responsible disclosure of security issues, and the need for quick resolutions, I feel that we are often too quick to point and shame and accuse. We want to get the news out about a problem so fast, to get people’s eyes and attention, that we forget about the humanity behind the product.
Also we forget how hard we hit.
## Public Embarrassment
When someone screws up in public, they are shaming themselves. Like the Olympic diver who belly flopped, or the hurdler who ran right into the first hurdle, when gaffs are televised world wide. They go on YouTube, they’re tweeted and pointed at for years. We will remember them for a long time. But that is embarrassment someone has done to themselves. People are people and release press notices too soon, push code early, and make mistakes. When someone does it to themselves, it’s galling and embarrassing, and they feel terrible. Their friends tell them it happens to everyone, and to learn from the mistake and do better next time.
## Public Shaming
On the other hand, there is the ‘friend’ who publicly shouts that someone screwed up. They are metaphorically hanging a sign around someone’s neck and saying they suck. To the world. Now yes, they screwed up, but a human’s natural reaction to that is anger, pain, and a lack of desire to fix it because they’ll just screw up again.
To make this more simple, public shaming creates a bad environment. It discourages innovation with fear.
## Responsible Disclosure
Two years ago, Andrew Nacin talked about how [security is nuances](https://nacin.com/2014/05/30/security-is-nuanced/).
> There will always be individuals who want everything to be fully disclosed, and there are some great arguments for that. I’m not trying to sway you one way or the other. But if you’re trying to do the right thing — you’re doing full disclosure in the interest of users, possibly even providing a patch or steps to mitigate — working with the vendor is a good way to ensure you haven’t missed anything.
Unlike Nacin, I do want to sway you to one side. I *want* to sway you to the side of communication.
If you find a security hole in a product, the first reaction should be to reproduce it as best you can, write up *exactly* how it can be exploited with examples and Proofs of Concepts, and then contact the developers/vendors about it. Give them some time to reply. Ask them what they would agree a reasonable disclosure timeframe could be, talk and negotiate what would make sense for the product, the situation, and the developers. I want you to think about when releasing the information will harm the *fewest* people.
Being responsible means thinking beyond the simple “This should be fixed for people.” It means “This should not put more people in danger.” It means you have to look at the big picture. Is it reasonable to expect people to update right away and, thus, you can release full disclosure with the update, or is it more realistic that it may take a while? What about bundled products? Will they get the alerts timely or not?
## Forget First, Embrace Most
But above all else, we have *got* to stop this behavior of ‘First!’ Because that’s what’s going on. People are in a rush to be the first to report a problem or an issue, and in doing so they forget who they’re doing this for. Forget being first. Start caring about the people you’re posting the information for. Is this helping the most people?
Publicly dragging someone through the muck, starting a witch hunt, just because they screwed up doesn’t help anything. It makes for an unhealthy developer community, and it makes for user base that cannot trust the developers.
**Categories:** How It Is
**Tags:** essay, open source, rant
---
### [The Time and The Place](https://halfelf.org/2016/time-place/)
**Published:** September 2, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There's a time and place for everything, and this was neither of those.
**Content:**
It was the day of a big release. A major release. A release that had been announced weeks, if not months, in advance. Everyone who was anyone knew that *today* was the day. So why not publicly drop the news of a major issue with the project in the middle of that release?
It was the middle of the development meeting. Everyone was talking about issues with a part of the project. They were deep into the hell that is debugging and backtracking and arguing if things should be fixed or simply noted. So why not ask for help about an issue one user was having?
This is not about WordPress. Well. It is and it isn’t. It’s about understanding who you are, where you are, and what’s going on around you. It’s about awareness and acceptance. It’s about being a part of something greater than yourself.
This is about common sense.
In Festivus, there’s a time and a place for the airing of grievances. In Judaism, we have a time and place for atoning for sins and forgiving others. While you certainly can do these things at any point in time, the purpose of having set and established periods for them is to prevent people from being derailed, to stop breaking the flow.
The time to report a security issue (which should never be ‘in public first,’ IMO) is not the middle of the release meeting. The time to report petty theft is not while your Manager is giving an announcement. The time to tell everyone that Beyoncé’s video was better is not while Taylor Swift is on stage giving her acceptance speech.
Those moments are rude, inconsiderate, and disrespectful.
It doesn’t matter if you’re right or not because yes, *Single Ladies* was a magnificent video and Beyoncé was robbed, it matters if the right people will be able to address the issue without causing harm to everyone else.
No one is more or less important than anyone else. Saying ‘everyone’s special’ is just another way of saying no one is. As painful as that can be to hear, it’s true. Instead of arguing that ‘us’ are more special than ‘them,’ which is purely subjective anyway, we should look at the magnitude of the work we do. Who will be harmed by the choice to publicly state something *now*?
The good of the many often is more important than the good of the few, or the one. That doesn’t mean you should not confront people in public. It means you should not do so *recklessly*. It means that you should not speak up without consideration of who you are, where you are, and when you are. It means you must be prepared to accept the consequences of your actions.
If you decide the best place to speak up against a politician is at his rally, you must accept that you may be throw out. You must accept that protests may end with your arrest. You must accept that being vocally against a decision or an action may result in you being publicly talked back to and possibly shunned.
At the same time, you *cannot* be afraid to do these things. You *should* speak up against wrongs. You *should* speak up against bad decisions. You *should* tell your manager that they’re making a bad choice. But you cannot do those things blindly or ignorantly.
It’s human nature to want to be a part of a group. We’re herd animals. We like the safety it affords us. We like the security. We crave it. So when we achieve acceptance into an ‘inner circle’ we want to protect our standing and not be cast out, and that can cause a bit of a Status Quo mentality.
Some members of the group will always be the ones to shake things up. They will be the ones to speak against the majority, to stand up and say “This is wrong and here is why.” They’re the ones who are brave enough and strong enough to accept the consequences of their actions. They don’t walk into a room, interrupting everything and everyone, to announce something.
They don’t get a free pass, however. They accept the consequences. And the effective ones make sure that when they choose to speak up, they do it in the right place, at the right time, with the full respect given to their group and community. And if they don’t, well again, they know what they’re getting into.
I can’t tell you to speak unafraid. That would be incredibly unrealistic. But I can say to speak boldly and to think about the consequences of your actions. And I can tell you to *ask*. “Will there be a post-mortem of this deployment where we can talk about improvements to the process?” Ask. “I know this is a meeting, and I apologize for interrupting, but I have a security issue. Where would be the right place for this?” Ask.
**Categories:** How It Is
**Tags:** essay, rant
---
### [Bundling - Not What We Wanted](https://halfelf.org/2016/bundling-wanted/)
**Published:** October 21, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The trouble with bundling is the presumptions we make.
**Content:**
There is a problem with bundling.
We like to bundle things together, to say “If you buy X, get Y as well for less!” And the simple problem is that our customers don’t actually always want X. We treat bundling like it solves our problems, but it doesn’t. It just makes angry customers who have more than they need, and pay more than they wanted for things they don’t use.
Let’s think of it like a coffee shop for a moment.
You go to Mooncoins and you want a latte and a gluten free donut. When you get there, you look for your $5 latte and see that you can’t buy it anymore but you *can* spend $10 for a latte and a vegan donut, non-gluten-free. If you want the gluten free bundle that’s another $15 and it comes with a muffin. You don’t want the muffin. You want the option to name your own bundle.
Okay, so how does this relate to software?
If you live in the US, you’ve probably heard about the Progressive insurance company. Yes, the Flo ones. Since they own Jacob’s Field in Cleveland, I hear a lot more of their commercials than I care about, but they have a weird deal with a ‘name your own price bundle’ where you pick what you want, and how much you want to pay for it. Within reason.
This means we ask “What are you bundling?”
I get waxed once a month or so and they offer ‘packages.’ There’s a ‘whole face’ package and a then separate services for lip, chin, and eyebrows. What I want is lip and chin, which they don’t offer, so instead of paying less for two services (which is what you get in a package), I have a choice of paying more for a package I don’t want (whole face) or more for two services I want (lip and chin).
The company wants me to pay for a package, which would save me quite a bit more than buying the lip, chin, and eyebrows as separates would cost. But they don’t have a ‘pick two’ option.
When you decide what you want to put in a bundle, you presume you know more about what the customer wants than the customer. And the flaw in this plan is that you *don’t* know more than the customers. You presume you know what works best, but you don’t.
You may have an idea of what works best for the people you’ve run into, but some of them would look at the price difference between paying for two services and paying for a package, see than it works out to less than $50 a year, and go for it. Then you have someone who thinks that $50 a year isn’t nothing, and would like to save it and not use services they don’t really want.
Bundling is meant to reduce options and let people pick what they need. What it more often does is require people to make different decisions of what they want and need, but also what the value is on those things in time and money.
Maybe we should start rethinking what we bundle and instead consider how we bundle. Let the customers have options. Use features like “People who bought X also bought Y.” Add in discounts “If you buy 3 products, get 5% off your entire purchase.” Offer them example bundles that are your current deals “Most people buy these 3 together. Purchase them now and save 5%, or mix and match your own.”
But start looking at how people purchase your products as a whole, and give them discounts not on the bundle you invent, but on the bundle they create. Guide them to what they need, not what you think they want.
**Categories:** How It Is
**Tags:** essay
---
### [Two Forks In The Road](https://halfelf.org/2016/two-forks-road/)
**Published:** October 7, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Because healthy rivalry between friends and equals is a good thing.
**Content:**
I believe in healthy competition.
Rivals, professionally and personally, have the ability to inspire us to reach great heights. They also have the ability to be terrible, but when a true rival, who respects you and your work, arrives, they should be embraced.
The other day I said that I would love to see a W3TC killer. Killer was the wrong word, as what I mean is that I would love to see something *as amazing* as W3TC that reaches out and tackles caching in a new and inventive way. I’d also love to see a WordPress killer, an iPhone killer, and a Linux killer. And a Hybrid Car killer.
I don’t mean I want *any* of those things to fail, I mean I want to see them have a challenger who does what they do, differently, in a way that inspires them to do more and more and better.
Growth stagnates without good rivalry. When you have a rival who does what you do, and they succeed, you want to succeed. When you’re both healthy rivals, you can carry it even further. Reaching out to your rivals and telling them “I am impressed with how you did X! Nice job!” is the greatest gift. With WordPress code, taking a leaf from their book and forking some of their code (with credit) is another way to hat-tip them.
In truth, W3TC and WP Super Cache never really competed. They can’t. They have wildly different approaches to just about everything, and they’re not even ‘after’ the same customer base. WP Super Cache appeals to people with it’s simplicity and directness. It works and you can (mostly) ignore it. W3TC has an insanely deep and complex set of tools that works closer to the base level of a server. W3TC has options, oh my god it has options, and they can overwhelm.
But the real crux to all this, besides the take away that caching is hella hard, is that there is always more than one way to solve a problem. And there is always room for multiple solutions in any ecosystem. It comes down to needs, wants, and user preferences. Both plugins I’ve named here do a great job at meeting the needs for *their* audiences. And both plugins grew out of someone’s need. Donnacha and Fredrick both created something to solve their own problems. They shared these solutions with the world and became unintentional rivals and kings of caching.
Okay so back to what I said.
Should there be a ‘killer’ caching plugin? *Will* there be one?
Maybe.
There should never be *one* killer app, no matter what it is. There should never be *one* perfect solution. Mostly because I don’t believe there’s such a thing. There’s nothing we can create that will suit everyone’s needs and wants. It’s statistically impossible. So when we talk about a ‘killer’ anything we never mean that. We mean “There should be options and the options creators should be healthy competition with each other to create some awesome things.”
And I really truly thing we should do that. I would love to see someone tackle WordPress with a serious self-hosted alternative. Something easier to install on my own than Ghost, but as easy as Hugo or Jekyll to write a post. Something extendable like Drupal, but with better backwards compatibility. Something next. And I want to see WordPress take what it learns from those other tools to become even more.
Because healthy rivalry between friends and equals is a good thing.
**Categories:** How It Is
**Tags:** caching, essay, plugins, wordpress
---
### [On Trust and Money](https://halfelf.org/2016/trust-money/)
**Published:** September 23, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** This won't have all the answers, and in fact it probably leaves people thinking "But ..." and that's okay. You don't have to like everyone and everything.
**Content:**
So. Headway Themes. In the last two years, they’ve gone from being a pretty interesting drag-and-drop theme that I thought was cool but not for me to a disaster. With the recent posts by former employees, and the complaints of customers, I feel bad for everyone involved.
But this is not about how another company could have handled things better. No, this is about trust.
You see, with the debacle that ensued, while it was going on, I was looking at desktop clients for local development on my new Mac. I have DesktopServer (love it) and VVV (… love it …), but I’d been hearing about this new docker type image set up thingy called Pressmatic.
My buddy Pippin loves it, and I trust him with a lot of things. Pippin and I hate doing things the hard way, and if he found this easier to use then awesome. There was just one teeny problem for me.
You see, it was owned by one of the people behind Headway.
Now I’m not trying to tell you not to buy software becuase of a previous situation. But like I mentioned (in passing), I still don’t like to use GoDaddy because I disagree with their ethics and marketing strategy. It’s not to say they’re right or wrong, but I don’t like it, and since I don’t *have* to use their products, I don’t.
The big difference here, though, is that if you asked me “Should I use GoDaddy” I would tell you the truth and it’s this: Sure. Why not?
It’s hard to explain this in 140 characters, or even a chat at a crowded bar with burritos and beer. I just feel there’s a big difference between the choices I make for me, and the choices you make for you. But there’s also a difference between the choices I make because I must, and the ones I have freedom on.
There are a lot of things I personally don’t like. I had a terrible experience with United Airlines and now I don’t fly them unless I have to. I had a series of shitty discussions with Jeep and now I won’t buy them. I had a horrific Amazon shipment screw up where they wouldn’t refund my pre-ordered copy of a DVD that was *broken* on arrival, because the pre-order was more than 3 months prior.
It took Amazon about seven years for me to get over that.
I’m not quick to forgive, if you can’t tell.
So when I tell you “I don’t feel that I can use \[whatever\]” and that isn’t followed by “And I hope you don’t either” then it’s really just me, having a personal moment where I don’t like a thing or a product or a marketing choice. Where I had a bad experience.
*Everyone* is going to have a bad experience with something. People hate the bank I used to work for, and they hate the hosting company I work for now. It happens. People I like and respect hate choices my company has made, and I understand that. I don’t beg or plead or wheedle or even complain. I nod, I say I understand, and I ask if I can do anything to help them. Even if that helping is helping them move to a new web host.
Trust is a thing that is given, and when broken takes a long time to re-earn. Right now, the situation with Headway gives me serious trust issues with Pressmatic, to the point that today I don’t feel that I can purchase what looks like a damn nifty product from them. And it’s not because I don’t think the product is good, or that I’m trying to punish them. It’s that I have doubts that they care about the little guy. Specifically, I doubt they care about *their* little guys.
When I have the choice to vote with my conscience, I do. When I have the responsibility to vote for my fellow man, I do. And when I have the ability to use something that pleases my little hippy, communist, socialist heart, well god damn it, I am going to do just that.
The converse is also true.
I have freedom to chose. And so do you.
Go use GoDaddy. I’ve heard amazing things about their managed service. And Pressmatic? It works awesomely! Jeep? The new ones are kind of great for off-road stuff and the heated and cooled seats are great in summer. United Airlines? They let me switch a flight around at the last minute for now fee when I had to fly them.
But I won’t use them by choice right now. And that’s okay. Maybe one day that will change, but it’s not today. If you can’t stand those things, that’s okay too. I hope you dislike them for the right reasons, and I hope you can keep yourself away from hatred and anger, but I get that it’s hard.
Like what you like. Dislike what you don’t. Vote with your feet. Trust the ones that you feel you can trust.
**Categories:** How It Is
**Tags:** essay, freedom
---
### [The Problem with Renaming](https://halfelf.org/2016/the-problem-with-renaming/)
**Published:** November 2, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you don't pick a good name, you may need to rebrand yourself. Sure, you can, but at what cost?
**Content:**
If you caught my talk in Seattle last week, I talked about names, versions, and SVN.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/10/jeff-atwood.png)
One of the things I touched on with names was their problematic nature. And believe me, I know about that. You see, I’m a Cleveland Indians fan.
And yes, I think the name (and the logo) are racist.
## You can’t rename things, but you can rebrand
When I said this, I meant that you can’t rename a plugin slug. Yoast SEO will forever have the URL of `wordpress-seo` because we do not have a way to rename the slug and properly redirect everyone. We just don’t. And even if we did, the old URL would need to remain in perpetuity in order for everyone who upgraded super late to still get the new code.
Names are really important. Your name is (often) your brand, and your brand is how people know you and how to find you. When you consider a name like the Cleveland Indians, today we can see the problems with it. Racism. But in 1914, we were a little simpler, a little more naive…. A little stupider. Okay a lot stupider.
The problems that Cleveland faces with renaming are related to the problems you would face in renaming your product.
## Rebranding has a cost, and it could be everything
The crux of all issues with renaming is that if people don’t like the new name, or can’t find you because of it, they will walk away. If you’re a small company with a few sales, and people can’t find your name anymore, you could go bankrupt. For Cleveland, it would be worse. If the baseball team went belly up, it would translate to thousands of people going out of work.
This is not to say the renaming or rebranding isn’t important. Cleveland’s reasons are obvious. Yours may be less so. You may be asked to rebrand to prevent a potential legal issue. Or you may decide that Mailpoet is a better name than Wysija Newsletters. But the rebranding can come at a cost.
## Losing history can loose users
In baseball, one of the rationales for not renaming a team is the team history. A team is known by it’s name and its mascot (and logo). The logos of most team are fairly mutable over time, [you can see the growth and development when you look at it historically](https://halfelf.org/2011/istanbul/). There’s a reason most redesigns are actually *not* dramatic, but careful and planned. That can not be said of the names, which rarely (if ever) change unless a team moves.
The same goes for your name. If Cleveland renames their baseball team to, say, the Lancers or the Blues, how do you handle the change? You have to make sure everyone knows (this is easier for baseball than the rest of us) and you have to make sure they know why.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/11/warner-bros-disclaimer1.jpg)
When a similar warning was put up before Tom & Jerry cartoons, the Internet lost their shit. Go figure. And yet that’s the problem here. People react in unpredictable ways to being told “A thing you liked and empathized with is bad” because they think it means they were bad. Generally no, they weren’t.
That’s a much bigger issue for baseball than for your code though. Unless you decided to name your theme Mien Kampf, or decided to present your plugin as ‘The Final Solution.’ That’s because a name is not isolated. You are not isolated. You live in a world where the implications and uses of a word and a logo can have far reaching effects. People who, for whatever reason, connect with your plugin name can feel left out when you rebrand.
## No matter how deep your pockets are, you will pay
Thankfully you are way luckier than baseball (or football, hello). You have the opportunity to know the world you’re in. Today we are more aware of the implications of our words, but also we now listen to other cultures and viewpoints about how our words and actions are perceived.
The cost of renaming yourself is high, but the ultimate question is not to ask how much the cost is of the renaming. The question is which cost is higher: The loss that stems from renaming, or the loss that stems from defending a name. If you’re being sued by Microsoft for copyright infringement over a name, and yes it happens, it doesn’t matter what your intentions were. What matters is you’re probably going to lose.
If you’re baseball, you generally have a lot more money than the average joe. You might be able to win a lawsuit. But your reputation will be tarnished, and that too will impact your bottom line.
> If you know what to do and you don’t do it, there you bloody well are, aren’t you.
— Lord Buckley
**Categories:** How It Is
**Tags:** baseball, essay, money, names
---
### [The Privilege of Default Settings](https://halfelf.org/2016/privilege-default-settings/)
**Published:** November 9, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When we assume we are the default setting, the baselines, we're making bad assumptions.
**Content:**
You’ve probably heard the analogy that being a heterosexual, white, cisgender, Christian male is playing the game of life at its easiest setting. Most things are aimed at you, from consumer products on down to expectations. Being those things causes you to come from a place of privilege, even if you’re poor. The world is aimed towards you a little more, and your default assumptions are ‘correct’ because media and everything else reinforces them.
Sometimes when I look at the choices and decisions we make in Open Source, I think we’re falling prey to the same concept.
The day after my team lost the World Series in 2016, I found myself struggling through an emotional (and chemical) hangover, whereby I was pretty much half the speed at thinking as I normally am. In this state of mind, I decided it was a dandy idea to sit and do some serious UI testing of products for myself as well as WordPress core. It was surprising, enlightening, and humbling.
I know WordPress. I know it really, really well. I use it daily, I write it in it every day. I monitor and support end users. I review code every day. Rarely has 36 hours passed without me learning something new about it, but also seeing a hundred people making the same mistakes. I often tell people “If I can’t figure out how to use your plugin, based on the readme, you didn’t write it well enough.” A new version of this is that when hungover me can’t figure out what your plugin does, there’s a lot more wrong.
Related to this is the tone and language in which I am wiring to you this very moment. I write from a place of decent education and intelligence. I use words like obsequious and peradventure from time to time, not because they sound cool (though they do, I like the sound of words) but because they draw your attention to the point in different ways.
> This proves beyond peradventure that the intent of the name of the product was to leverage the name of its competitor.
I don’t actually send plugin emails with that stuff, no matter how much I think in that way. It would make people think I’m talking down to them.
Which brings me back to my point.
We, who create for WordPress, are in a place of exceptionally high privilege. We name drop people like Helen and Mark and Matt and Mike (no, the other Mike) without a second thought because they’re a part of our lives. We’re not trying to seem high and mighty, but these are people with whom we’ve played Cards Against Humanity, or had churros, or sat on a bed giggling like tween girls. We’ve made a tribe with people we see daily, virtually, and they’re a part of our norm.
But to the average WordPress user? They don’t care. Or if they do, they care jealously. And worse, when we say things like how we talked and made a decision about them without their input, they feel left out. And they were. They were intentionally, mindfully, willfully left out.
We felt our default assumptions were correct.
We felt that we knew better.
We felt, based on our experiences and usage and tests, that we were right.
Well. We can be wrong. We know this. Often we trust our heads more than our hearts, making amazing mistakes by assuming we know the best from our expertise. And the biggest fallouts when it comes to our work will be in those moments. When we decide “this is right” without taking the time to use our product hung over, or to ask for more help, or to trust that gut feeling.
This is incredibly hard to do. When you consider WordPress, there are times a feature will make it to Beta and we’ll realize we were wrong. Post Formats UI, anyone?
As gutting as it was to pull that so late, the decision was wise and sound. Not because this wasn’t something people wanted (and might use) but because it’s implementation wasn’t up to snuff. It was a fundamental feeling of ‘this is wrong.’ And Mark trusted his heart in the moment and said even if the code was fine, there was something off in the using. He understood the implications, too. That how the UI was implemented would influence future work.
It’s difficult to explain how huge that is without sounding like I’m making a mountain out of molehill or fighting a strawman. The decision we make in WordPress, in any project, do not live their lives out in a vacuum. The decision to make widgets, featured images, categories, custom post types, and on and on *all* have influenced how future features are designed and built. We know this. So when we introduce a new feature, a new flow for using features, we have to consider the future.
And that means we need to forget our privilege of someone who knows the code, who knows the system, and who has all the benefits of experience. We need to be the first time user, the uneducated, the newbie. We have to accept that we will be wrong, and we have to be willing to admit our wrongness. To fail to do this means we’ll never learn.
**Categories:** How It Is
**Tags:** essay, ux
---
### [The Privilege of Privacy](https://halfelf.org/2016/privilege-privacy/)
**Published:** November 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The vulnerability of my security is you. So stop it.
**Content:**
Ask 100 women online where the live, and the majority will give you a vague answer.
California.
Chicago.
LA.
Orange County.
Those are enormous locations. While you probably could have found me in Chicago, if you asked enough people, you’d need to know a lot more than just the city. And now? Good luck. Most of my neighbors don’t know me. Their kids do, go figure, but it’s not the 1950s anymore.
The longer a women (or any minority) has been online, the less likely they are to want to talk about their location online. At least not in public. We get used to the constant, low level, shit throwing people say. People will ask what kind of ‘creature’ we are for posting a Vine, or call us ‘the hot one.’ It’s something I’m constantly pushing back at, and being vocally against, but it’s me against the world, and sometimes it’s a Sisyphean struggle.
But that doesn’t mean some people don’t have my home address. It means the people who do are people I trust and respect. I know that they won’t generally just show up at my house (unless there’s a crisis).
So what happens when you know, say, that I live in New Jersey and someone mentions WordCamp Jersey in a public chat?
You shut the hell up and don’t say “Hey, Ipstenu lives there, you should ping her!” No, you ping me directly and say “Hey, Billy was talking about WC Jersey. I thought you mentioned living nearby. Did you know about that?” And that way you give the public information to the private individual.
This seems to be an odd concept to people who come from a place of general safety and security. Yes, I’m talking about you, heterosexual cisgender white christian men. They tend to be the most flagrant abusers of personal information that I’ve seen online.
When I ran a forum, I had a rule that basically read like this: **People’s personal information is just that, theirs and personal. If they say “I live in Wyoming” that’s cool, but you don’t get to speak for them.** And yes, I banned people for violating that after they were warned.
Most of the time, personal information that is privileged is obvious. If I run a website, I have your IPs and email. I don’t give them away to ad collectors without your consent because that’s just a shitty thing to do. It’s unethical. In some places it’s illegal. That’s why you’ll get disclaimers on what information is tracked, or notes about how to opt-out.
But less understood is the concept that information you and another person discuss in private is just that. *Private.* It shouldn’t be. It’s basically the same thing. You are in a place of privilege where by you have access to information others do not. That privilege comes with responsibility.
So let me lay this out for you.
If someone tells you a thing in private, it’s not always yours to repeat.
If someone tells you a personal thing in private, it’s *definitely* not yours to repeat.
For example, if someone tells you “Hey, I think I’m gay.” you absolutely, 100%, do not EVER turn around and say “Oh, Bob? He’s gay.” *That’s not your information*. And that’s an obvious case isn’t it? Well, where I live is also an obvious case.
The Internet is filled with doxers and harassers and people who jackhammer Hollywood Walk of Fame stars. People are attacked online, usually on Twitter or IRC or 4Chan, every single day.
It’s your job, as the holder of privileged information, to be the secret keeper. Be the friend. Keep it to yourself. And for god’s sake, if they ask you not to repeat something, either don’t repeat it or tell them outright that you will probably forget, so please don’t tell you.
*Comments on this post are disabled.*
**Categories:** How It Is
**Tags:** essay, freedom
---
### [The Perception of Approachability](https://halfelf.org/2016/the-perception-of-approachability/)
**Published:** November 21, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The connections we make foster a strange sense of approachability that isn't always felt on both sides.
**Content:**
I’m speaking at WordCamp US. Someone I don’t know pinged me and said they were happy to see I was speaking, and they’d be there from their country. I haven’t the foggiest idea who they were or why they were telling me this.
A few years ago, at my first WordCamp San Francisco, someone followed me for a few city blocks. Or at least he tried to. I was going out and he followed me out of the area. I paused, we chatted a moment and as I tried to leave, he kept talking. This pattern repeated until I finally said “I need to go. Good bye.” He kept talking. I spotted a female WordCamper I knew and she *immediately* came up and told me my wife was on her phone and was mine broken? Not at all. We lied. But I went with it, checked, looked shocked that it didn’t light up, and said it must be dead. I took her phone and proceeded to start a fake conversation that my wife had locked herself out of the car, 3000 miles away.
In 2015, I was at a WordCamp where someone was *very* much crowing up in my personal space to talk. I quickly stepped back and when he leaned in, held up my hand and asked for personal space. At another WordCamp later that year, a similar thing happened to a friend of mine. I saw she was agitated and wanted the conversation to end, so I walked up and smiled and said I’d been looking for her. I knew the man, I thanked him, apologized for interrupting, wished him a good day, and he nodded and walked off.
These are pretty normal events in my life.
It’s a common, regular occurrence for people like me.
I talk to hundreds of strangers a day in my work. I email at least 30 people a day with notes about their code. I converse with customers, co-workers, and a lot of random people. I don’t know *many* of them. We are not friends, these random people and I. We are not besties. We are not people I hang out with on their couch and play rude games. But the perception is, since we’ve had some conversations, we’re somehow closer than normal.
And yet all four of those people, all men by the way, seemed to assume a level of connection that I did not. They all immediately felt I was ‘one of them’ and monopolized my time, not taking the social cues of ‘no’ until it was stated, and *even then* I had to be forceful.
Flip the tables.
Have I ever felt this way about women? Actually yes. I’ve had women at WordCamps do the exact same thing. 2014 someone kept asking me question after question about being a Woman in WordPress, until I politely turned to another woman and pointed out she too wanted to talk to me. In every case with women, however, they *get it* when I try to redirect the conversation to ‘I need to leave’ or ‘this conversation should end now’ and they get it without rancor or offense.
This happens outside WordPress too. It’s actually a great deal worse outside WordPress. But in many cases, people attribute a greater level of friendship to an online social connection than I seem to.
Of course there are exceptions. Most of my greatest friends came from random internet connections. People who, literally, changed my life with a job recommendation, held me while I sobbed over a death, had a girly sleepover where we giggled until 1am when we *totally* shouldn’t have since we had to be up at 6am for volunteering, offered me a couch, schwarma, or even just a gentle “Hey, I’m here for you. Are you okay?” They too came from this online place.
So what’s the difference?
We’re more approachable online, certainly. We let our barriers down and we engage more because it’s (mostly) safer. We can talk about how we feel, we can sob, and no one sees us. We’re freer. And with this freedom and honesty comes a ‘connection’ that sometimes transforms into true and honest friendship, and sometimes doesn’t.
But when we move the online relationship into a physical one, we worry. We worry if the person is who they presented themselves to be and we worry if we’re going to get hurt. Many women worry if we’re going to be physically hurt. And we can’t tell. We often have no way to figure this out until it’s too late.
I don’t have a solution to this problem, but I can tell you this. When I meet new people, even at a WordCamp, and when strangers reach out and tell me they’re excited to meet me, I receive that with a little trepidation and caution. I text my wife to tell her where I am, who I’m with, and if I’m worried. This is unlikely to change any time soon, and has nothing to do with the US political climate. What it has to do with is the understanding of what exactly makes up our connection.
*Comments on this post have been disabled.*
**Categories:** How It Is
**Tags:** community, essay, rant
---
### [Custom Colors with the Twenty Seventeen Theme](https://halfelf.org/2017/custom-colors-twenty-seventeen-theme/)
**Published:** February 6, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Changing colors on Twenty Seventeen isn't very fun, but that's pretty much the only thing I don't like about the theme.
**Content:**
In building out a site, I had a cause to use [Twenty Seventeen](https://wordpress.org/themes/twenty-seventeen/), the new theme for WordPress. I’d tested it before, helping figure out the usability of features. This time I was using it ‘for real’ and as I often say, there’s nothing quite as impressive as ‘for real.’
Overall, I still find Twenty Seventeen as easy to work with as any other theme I’ve used. Customizing a theme to look like how *you* want is incredibly weird as it’s always a unique experience. This is to be expected. Themes are difficult when we’re trying to guess what people want. They’re second only to search in complex usability. In my use, I found two places where I felt other themes did things better.
## Documentation
While there is a technical document on how to [theme with Twenty Seventeen](https://make.wordpress.org/core/2016/11/29/theming-with-twenty-seventeen/) there is no walk through. For example, when I use StudioPress’ Genesis themes, every single one comes with a walkthrough of “How to make the theme look like our demo!” Twenty Seventeen has the luxury of the new default content, but even then, it’s not the same as directions. I have to do trial and error to figure out things like how to change the ‘section’ images on the front page.
Answer? Change the *featured* image. Of course. That was logical to me because I’m an experienced WordPress user. I can’t say it was logical to anyone else.
A great deal of the theme makes sense contextually. By which I mean if you look at it, it all follows and you can suss out what’s next. But it’s not perfect. No theme is. I still think if a simple walkthrough doc existed, it would help a lot of first time WordPress users.
## Colors
About a day into my project, I’d used Twenty Seventeen, ditched it for something else, wrote a lot of custom post type/taxonomy code, and then came *back* to Twenty Seventeen. By the time I did, I had a very clear-cut idea in my head about what I wanted the base color to be.
I have to explain it like that because that’s pretty abnormal, I feel. Most people don’t go “I want to use `#d1548e` as my base color for links and stuff!” They go “I want pink!” The problem here is that if you look at the color tool for customizing colors, it’s a slider. And worse, it’s a slider without an override.
Now compare that to the picker you get for the *Header* text color:
Right there I can go in and put my color in hex format and it uses it. Perfect.
I can guess why they don’t have this for the custom color, though. Twenty Seventeen does something special with colors and instead of just saying “Links are pink and headers are magenta,” it uses saturation. This lets the theme create a dynamic color scheme based on your selection. Which is fucking awesome, right up until you’re me (or you try to use the exact same color schema twice).
I want to stress that I *do not* feel this was a bad choice for the theme. Since the theme is going to use math to cleverly calculate out what the related colors should be for the theme, it’s genius to set the colors on a slider. This puts the concept in your head, when you move the slider, that the colors are *relative* to each other. It’s a perfect example of seamlessly introducing new users to a tool. It’s actually intuitive.
## How I ‘Fixed’ My Color Woe
First I made a lot of jokes with my buddy James about how they would ‘hue the day’ for this one. Because thats how I roll. Then I dug into where the hell this was set at all. Like all WordPress settings, its saved in the database in the `wp_options` table, under `theme_mods_twentyseventeen` which has a value like this:
Yours may be longer. The important bit is here: `s:15:"colorscheme_hue";i:312`
That number, 312, is the color hue! If you change it, it changes the colors. Once I knew that, I had to reverse engineer a hex code into a hue. To do that, I used [workwithcolor.com](http://www.workwithcolor.com). That site has a color picker, and if you put in the value you want (say [d15483](http://www.workwithcolor.com/hsl-color-picker-01.htm?cp=d15483) it spits back a whole lot of information.
That part I circled, the 337, that’s the important part. I can now go into my database and change 312 to 337 and magically it works.
But boy that sucks. Instead I used `set_theme_mod()` to fix it by putting this in my theme’s function:
If I wanted to get fancy, I’d put in a real control for it, but this at least gets me started.
**Categories:** How To
**Tags:** coding, themes, wordpress
---
### [Secure Your Shit](https://halfelf.org/2017/secure-your-shit/)
**Published:** January 23, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making all your online behavior more secure starts with good passwords and two factors.
**Content:**
Ignore the fact that Google’s going to downgrade your sites if they’re not HTTPS soon. That’s not what I’m talking about.
I’m a strong proponent of Net Neutrality and Freedom of Speech. I certainly intend to speak up and write and protest in the coming weeks and months, just like I have my whole life. I look at the world and I see things that need changing. So while this blog is about technology and computers and the Internet and websites, it has an impact on my political actions.
Or rather, it’s that my political actions impact this site.
People try to hack me all the time. *All the damn time.* Within the last 24 hours, over 400 people have tried to break into my ‘root’ account. It’s not named root. Good luck there. But the point is that people do try to hack me. They attack my WordPress install, my server, my email, my social media accounts, and my home wifi. I suspect the last one is my neighbor being stupid.
This means I know that speaking up will make me a target and, because of that, I need to secure the hell out of my stuff. And that means using [Two Factor Authentication](https://halfelf.org/2013/two-factor-authentication/).
## Use Strong Passwords
I use [1Password](https://1password.com) to both create strong passwords and securely store them. A popular alternative is [LastPass](https://www.lastpass.com), but having used both, I find 1Password easier to use. Regardless, use them. My passwords are things like `4seqKD)CsbG=iQnVoirwZ77+` which I hate typing in when I have to change them, but thankfully with browser extensions I not only don’t have to, but I don’t know my own passwords.
I can just generate and go.
## Secure your Email
I know a lot of people use Gmail. I pay them for email right now ([long story, tl;dr no one does spam better](https://halfelf.org/2016/moving-cpanel-email-gmail/)). That doesn’t mean I fully trust them but, since I pay them, I know I have a different relationship than the free Gmail one. Still [I use 2-step verification on gmail](https://www.google.com/landing/2step/).
If you need super secure and private email, [ProtonMail](https://protonmail.com) is the way to go. Sadly it’d be $30 a month for my multiple domains. I wish they’d charge per email address, but that’s another issue.
## Secure Your Panels
Everyone logs into web hosts the same way. We use a panel. It might be Plesk or cPanel or a home-grown system. It doesn’t matter which. Whichever one you use, make secure passwords, don’t share them with anyone, and if at all humanly possible, use Two Factor Authentication. If your webhost doesn’t offer it, leave. I know what I just said. If they don’t offer some method of verification, they’re not safe.
When you secure your panel, make sure you *also* secure your billing stuff. For example, I use [LiquidWeb](https://liquidweb.evyy.net/c/294289/297313/4464). They use cPanel and I activated Two Factor Authentication for that. But they also have a proprietary manage site where I log in for billing and server allocations. That *also* needs security. Make sure you do it on both.
## Secure Your Blog
If you use WordPress.com, [Turn on Two Step Authentication](https://en.support.wordpress.com/security/two-step-authentication/).
If you self host WordPress, use a plugin like [Two Factor](https://wordpress.org/plugins/two-factor/). That’s the feature project’s plugin that hopes to be added to WordPress core, so it’s a little rough around the edges. While I do have fundamental issues with 2FA being enabled by default for all users of a blog, it’s because I understand that most users are not technical.
It’s a double-edged sword. If we don’t teach people to be a little more technical to be a little safer, they won’t become safer. On the other hand, with things like 2FA and WordPress, there’s no real way for them to contact a person for help. If you turn it on, then everyone who locks themselves out gets to either call their webhost (who isn’t responsible for that) or a young relative (who didn’t sign on for that) or post in the support forums (who *did* sign on for that, but still).
## Secure Social Media
[Twitter](https://support.twitter.com/articles/20170388), [Facebook](https://www.facebook.com/help/148233965247823?helpref=search), and [Tumblr](https://www.tumblr.com/docs/en/account_security) have Two Factor authentication. Use it.
Twitter’s sucks, by the way. It’s text based, which means you can only use it via text-messages. Facebook requires you to use texts, but allows it to be a backup to a code generator like Google Authenticator.
## Be Secure
The moral of all this? Be secure.
**Categories:** How It Is
**Tags:** behavior, security
---
### [SSL Security: Killing RC4](https://halfelf.org/2017/ssl-security-killing-rc4/)
**Published:** January 30, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making your site more secure from the server level.
**Content:**
In the middle of debugging what turned out to be an unrelated problem, my friend James pointed out that my server was throwing a warning about the RC4 cipher.
## Ciphers?
When you want to transmit secure data, you use a cipher to encrypt the data. RC4 is a (hah) cipher. It generates a stream of random bits and bytes (they’re not really random) and combine them with plain text using a pattern to make an encrypted message. The secure connection unravels the bits because it knows the cipher too.
Ciphers only work if no one knows how to crack them. That isn’t the case with RC4 anymore and it was hacked. Sad news. Time to disable it!
## Disable it!
Why was it enabled at all? As it happens, it was enabled on my servers for browsers that can only use it. Old browsers. The funny part is that those old browsers can’t support SNI (which is what lets me have multiple certificates and multiple https sites on one IP address), so the domains were broken anyway.
To disable, I went to WHM Home » Service Configuration » Apache Configuration » Global Configuration and changed my cipher suite to `ALL:!ADH:!RC4:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH`
The `!RC4` is the part that says “Not this one!”
Restart Apache and you’re safe to go!
**Categories:** How To
**Tags:** cpanel, security, servers, ssl
---
### [SSL Security: Forward Secrecy](https://halfelf.org/2017/ssl-security-forward-secrecy/)
**Published:** February 1, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Keeping your readers and customers safe requires a little elbow grease with SSL Ciphers.
**Content:**
Forward secrecy is actually what it sounds like. It forwards on secrecy. This means that the secret keys you have won’t be compromised even if the server’s key gets hacked. The way it works is by constantly changing things. Basically it’s rotating its encryption forever.
> “You’re constantly generating new keys for new messages,” says Nadim Kobeissi, the creator of Cryptocat, one instant messaging app that was early adopter of perfect forward secrecy. That means if a user’s device is stolen or hacked and eavesdroppers steal a decryption key, it doesn’t matter. “The latest message gets compromised, but any message prior to that message or after it can’t be decrypted,” Kobeissi says.
This is a good thing to have on your own server, as it means if a secure transaction (like an ebook sale) is compromised, only that one instance is impacted. No one else gets hacked. No other part of the sale is affected. You minimize damage considerably.
## Let’s do this thing!
On Monday we killed off RC4 by going to WHM Home » Service Configuration » Apache Configuration » Global Configuration and changing the cipher suite to this: `ALL:!ADH:!RC4:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH`
In order to properly handle perfect forward security, we have to reorder things. Instead of using `ALL`, which calls everything, we need to put the ciphers in a preference and omit the ones we don’t want. That gives us this:
Awesome. Once we set that, and restart Apache, we go to Service Configuration » Apache Configuration » Include Editor » “Pre Main Include” and pick ‘All Versions’ from the drop down. I’ve edited this section before, when adding [HSTS](https://halfelf.org/2016/https-hsts/) support. But then I edited `pre_virtualhost_global.conf` (“Pre VirtualHost Include”). This is just a different section.
In the Pre Main Include section, put this:
This forces the SSL protocol to v3 and then v2, but then it demands the order of the ciphers be honored.
Restart Apache and you’re done.
## Testing it
If you want to test, go to [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest) and you should see something that says A or A+. If you don’t have it right, you’ll max out at an A-.
This site? It’s currently an A+, however that target is always moving. Keep safe out there.
**Categories:** How To
**Tags:** cpanel, security, servers, ssl
---
### [Text Alerts and Email](https://halfelf.org/2017/text-alerts-email/)
**Published:** January 27, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Forwarding emails to texts? Yeah, you can do that.
**Content:**
Sometimes there are specific emails you want to be alerted to immediately. While there are a lot of options for this, like scripting things on the server level, most email tools let you handle this on their end.
## Cautions
Short email is better. You get 160 characters. So this is a tweet length of stuff. Whatever emails you decide to do this with *must* be short.
Be very careful based on how many texts you think you’ll get. If you get too many, you’ll blow through your limits.
In order to email anything to your phone as a text, you need to know your email address. They all work the same way, in that it’s a phone number followed by an `@something` – just like normal email. What’s your address? You’ll have to read your network provider’s documentation. Wikipedia has a list of some [US carriers](https://en.wikipedia.org/wiki/SMS_gateway#Email_clients) that can get you started. If you have the option for MMS, and you know your email has pictures and stuff, use that. But again, you should be short!
## How To
All you have to do is create a filter for the emails you want to forward. Seriously, that’s it.
My gmail filter looks for emails with the subject `[Mass WP Upgrade]` and if found, applies a label, moves to a folder, never marks as spam, and yes, texts me.
If you do this you’ll get an alert telling you that if you don’t mark things as spam, you can (heh) spam the hell out of your forward and get in trouble.
This is pretty much the same as for cPanel, who has incredibly [robust filter available](https://documentation.cpanel.net/display/CKB/How+to+Configure+Mail+Filters). The extra fun is that while you can just use “Redirect to Email” to forward the message, you can *also* pipe it to a program on your server. If that made no sense to you, don’t worry about it. Just know it’s there.
If you’re using gmail, you also need to add your text email address as a forwarding address. *Don’t Panic!!* I know it makes it look like it’ll forward all your email. It won’t. For cPanel and other things, they don’t require verification of the forwarding destination.
**Categories:** How To
**Tags:** email
---
### [Can AMP and SVGs Be Friends?](https://halfelf.org/2017/can-amp-svgs-friends/)
**Published:** January 13, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you're too lazy to read, the answer is "Don't use SVGs on AMP pages."
**Content:**
Spoiler: Not at the moment, no.
## Warning: Fix errors on your AMP pages
On January first, I got a scary email with that subject:
> Google systems have detected that some of your AMP pages do not meet our guidelines and will therefore not show in Google Search AMP-related features.
Yikes! I ran over to Google Webmaster Tools and saw I had well over 400 pages with critical issues. Happy New Year to me, right? Looking at them, most of the problems were exactly the same:
- The tag ‘pgfref’ is disallowed.
- The tag ‘pgf’ is disallowed.
- The attribute ‘i:extraneous’ may not appear in tag ‘g’.
- The attribute ‘xmlns:x’ may not appear in tag ‘svg’.
- The tag ‘switch’ is disallowed.
Right away, I knew this was from my SVGs. On this site, I use SVGs instead of PNGs because they look crisper on retina screens and they can be colored on the fly. Basically I really like the power of SVGs. And, as far as I could tell, SVGs worked on AMP pages. I read the details on [SVGs in AMP/HTML](https://github.com/ampproject/amphtml/blob/master/spec/amp-html-format.md#svg) and it’s listed there, after all.
But in reading the errors and looking at my SVGs in a text editor, I quickly saw what was wrong.
## Most SVGs have Extra Data
I use the Block Bundle from [Symbolicons](http://symbolicons.com) for my SVGs. They’re awesome, but once in a while I have to edit them and clean up some extraneous data within. Adobe Illustrator, for example, puts in a lot of junk at the top of my SVGs:
But in the case of the SVG having a problem, it had … well. This:
I’ve truncated the code because it’s insanely long. In fact, it’s so long that with all of it, the file is 25k larger!
Let me explain. The SVG there has ‘switch’ code. The switch code is awesome because it can change what’s displayed based on what the file detects. For example if I wanted to make different text show based on the detected system language, I would do this:
The problem is that AMP? Doesn’t like that.
## AMP Doesn’t Trust SVGs
AMP really doesn’t like fancy things. This makes sense. It’s meant to be faster for mobile browsers, so it’s streamlined and simplified. Fine. It wants simple SVGs. Obviously one fix here is I could clean up all my SVGs. The other one would be to do what AMP suggests and that is to whitelist attributes. Except you can’t do it. Yet.
There is a reason for this, and it’s similar to the same reason WordPress doesn’t (yet) allow SVGs to be uploaded by default. Unlike images, SVG files contain *code*. An user who can upload an SVG has the ability to upload code files which can be executed in the victim’s browser. Picture this. An attacker uploads an image to a forum. If the forum links to the image with `` then the end-user’s browsers load the SVG and run the code. Yaaaaaay.
SVGs are dangerous. And to help this, AMP says SVGs with special tags are not welcome.
## The Fix?
Edit your SVGs or, if you’re me, ditch the images all together. I decided to go with the ditching since I wanted the pages to load fast. It’s the point of AMP after all.
**Categories:** How It Works
**Tags:** amp, images
---
### [Prefix or Suffix](https://halfelf.org/2017/prefix-or-suffix/)
**Published:** January 25, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making your function names readable by humans is, perhaps, the most important thing.
**Content:**
I’ve been seeing a lot of a new trend in coding, which stems from boilerplate plugin code, and that is the use of suffixes in function names. This has become increasingly popular in WordPress code and I, for one, am not a fan.
## WordPress Function, What’s Your Function?
[Otto](https://ottopress.com) likes to say that well named functions don’t need code comments.
While optimistic in this day and age of complex code, the basic concept remains quite valid. If you name your functions well, the chances are that they will trigger your contextual memory and you’ll remember what they are, what they do, and why they’re there. To this end, the difference between `function activate_pluginname()` and `function pluginname_activate()` is miniscule. Both of those are clearly functions that run on ‘activate’ and that makes perfect sense. We can see the purpose of the function by its name, and that is the majority of Otto’s point. They *are* well named as they indicate their job. The issue then does not like in the name of the function but in the *format* of the name of the function.
## Function Name Conflicts
A majority of the time, my argument for having unique function names is that there are over fifty-thousand plugins out there, and the odds of two of them having the same function name is quite high, for cases when the function name is generic. For example, `function my_plugin_init()` is not unique in the slightest. Yes, people literally use `my_plugin_` as a prefix. That’s not a placeholder. That particular error occurs when people use boilerplates and don’t read the directions clearly. Most state “Search and replace `my_plugin` with your plugin prefix.”
Preventing conflicts means it’s incumbent of developers to select *unique* function names. Now this pressure is alleviated by the use of namespaces and classes, but even those have to be unique to their plugin (or theme). After all, `class WordPress` is not a great classname.
Again, in this regard there is very little difference between `function activate_pluginname()` and `function pluginname_activate()` in the real world. Both are unlikely to cause conflicts.
## Internal Consistency is Good
Another aspect of names is that good function names are logical and consistent. Few things pain me more than seeing `function pluginname_init()` and `function pn_admin_init()` (where pn is an abbreviation for the plugin name). What I see a great deal with the plugin name as suffix is this hodgepodge of names:
- `init_plugin_name()`
- `plugin_name_uninstall()`
- `pn_wp_class_list()`
My guess at this point is that any time a particular boilerplate doesn’t specify the name of the function needed, people fall back into old habits. Or rather, they fall back into the *recommended* habits. You know, a prefix. Consistently named functions make it easier for people to recognize what function belongs to what plugin or theme.
## So why Prefix?
This takes us to an interesting point. Both `function activate_pluginname()` and `function pluginname_activate()` meet the requirement of being well named *and* unique (and **can** be consistent). So what actually is the problem here?
The problem is the future.
Your code does not exist in a vacuum! Code that will only ever be used on your own server still runs with the other plugins and themes you add, and they could cause a conflict. It’s somewhat trivial to change those things, but it’s not fun and usually it means that you broke something in your live environment.
- Consistently named functions make it easier to know what function relates to what.
- Uniquely named functions are easier to find.
- Well named functions remind you what the function is supposed to do.
But again, why *prefix*?
## Remember Who Comes Next
I do a *lot* of searches on code in myriad plugins. More than most people involved in WordPress I suspect. I have a very peculiar relationship with plugins, after all. When the core developers want to figure out how ‘well used’ a function is before changing it, I help out by running a search on all the code in the plugin directory. This results in me finding a lot of weirdly named functions that require me to track back through the plugin and find out what it’s really doing. When things are prefixed, this search goes a *lot* faster.
Besides just my convenience, when you remember that your code is used by thousands of people, *they* will have an easier time searching for your code when they have an error. If you got an error that a function named `halfelf_init` was doing something wrong, you could run this to find the file: `grep -r "halfelf_init" ./wp-content/`
Some of the more experienced debuggers out there are probably wondering why I grep from `wp-content` when *most* errors give the full path of `wp-content/plugins/plugin-name/filename.php` in the first place. The answer to that is “most” but also because often functionality plugins that are related to a theme (or other plugins) will cross-reference themselves in ways that can cause PHP to give you the wrong file for the problem.
If you ran my check and found that the function was called in nothing but files in that plugin’s folder, great. But if you found it was called in a theme, you would then want to run this: `grep -r "halfelf_" ./wp-content/themes/theme-name/` — That would reveal *all* the calls for the functions that belonged to a specific other tool.
And what if you got a warning that the function had *already* be declared? `grep -r "function halfelf_" ./wp-content/plugins/other-plugin/` will list all the functions that start with `halfelf_` and save you a headache of solving one warning only to have it be replaced by another. (Of course, if you use namespaces or classes, this gets thrown out the window, oh well).
Finally there’s the human factor. This is exceptionally subjective, I know, but doesn’t a line of functions all starting with the same term feel *cleaner* to you? It demonstrates a repeating pattern that a human mind can follow and feel comfortable with.
## Solution: Be Consistent
There’s only one solution to be had here. While I greatly prefer a prefix, if you chose to use a suffix, *be consistent*. Make every single function *end* with `_pluginname` and don’t skip a single one.
**Categories:** How It Is
**Tags:** coding, names, wordpress
---
### [Copyright Years for WordPress](https://halfelf.org/2017/copyright-years-wordpress/)
**Published:** January 6, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Echoing the year for copyright in a shortcode isn't terribly complicated, and you can even account for year zero.
**Content:**
At the bottom of every page on my site is a little bit of info declaring copyright: “Copyright © 2017 Mika A. Epstein”
How do I do that and not have to update all my site themes and widgets every year? With code, of course! I have both a function I could use in themes and a shortcode I could use anywhere a shortcode can be used.
## The Code
There are two functions, the base code and the shortcode. The concept is that if you don’t put in a year (which is the start year for your copyright) it will only show the current year. If you *do* put in year, it forces it to be an integer and then does a couple checks. The checks were originally as follows:
1. Is `$year` ‘auto’? Force this year.
2. Is `$year` this year? Force this year.
3. Is `$year` equal to 0? Force this year.
4. Is `$year` *greater than* this year? Oh, silly human. Force this year.
5. Is `$year` less than this year? Use the ‘start – end’ format
The reason for this is practical. We’re sanitizing things as early as we can, and then we’re checking for the logical and illogical entries. If someone decides the year is ‘Bob’ then `intval()` throws a 0 *and* since 0 isn’t actually a valid year in the Gregorian calendar, then I can do a simple “if 0” check.
But … I’m not so bold as to assume the only people who will want this are using the Gregorian calendar. To be more universal, I changed the code to make the first check for if the year was set to ‘auto’ (which defaults to this year), *or* if it was a non-number. If it’s not a number, you get forced this year. Otherwise, the code trusts you.
The one failing here is I only account for the common era (or ‘AD’ for those who didn’t know we all switched to CE a while back). I’m sure this can be extended to BCE if so desired. Spitballing, I’d just use negative numbers, check for them and output ‘year BCE – year CE’ instead. But that’s a little much for this use case.
## Usage
As a shortcode: `Copyright 2016 - 2026`
As a function: `helf_auto_copyright_shortcode( '2016', 'Copyright' );`
Both will output the same thing (as of 2017): Copyright 2016 – 2017
And in 2018? It will magically update for you.
**Categories:** How To
**Tags:** coding, shortcode, wordpress
---
### [Mailbag: When Do I Use "If Exists"?](https://halfelf.org/2017/mailbag-use-exists/)
**Published:** January 20, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A quick answer: Use unique names in everything except shared libraries.
**Content:**
Someone pinged me on slack about this. Bear in mind, I tell people “If you got an email from plugins, please press *reply* and email back, don’t slack me.” because it allows me to keep track of the whole history of a conversation, but also because if I’m sick, someone else can reply to you and you’ll wait less. While, in this case, the answer should have been very short, it grew to be a lot longer than he’d expected because he didn’t quite understand what I meant.
## Unique Prefixes
One of the requirements of the Plugin Directory is that all plugins have unique function names, defines, and classnames. This is for a pretty obvious reason: it will prevent your plugin from conflicting with other plugins or themes.
- For plugins, use a function or classname that matches the plugin name: `class ThisPluginName{}` or `function ThisPluginName_FUNCTION()`
- For specific specific sites, use a function class for the domain: `class HalfElfOrg{}` or `class HELF{}` or `function helf_FUNCTION`
This extends to all things, including defines, namespaces, enqueue’d handles, and on and on. As I tell people, “A namespace or class of `MyPlugin` is **not** actually all that unique…” Defines are extra tricky since sometimes you want to define them and allow them to be replaced. But more on that in a minute. No matter what, this is bad: `define( 'PLUGIN_PATH', plugins_url( __FILE__ ) );`
Since it’s 2016, I have to tell people that they shouldn’t use two letter slugs anymore as all the good ones are taken. I also tell them not to use `wp_` or `__` as a prefix.
And then I say this:
> If those are intended to be in shared libraries, please detect IF the code is already included and not re-include it, as doing so will cause conflicts if two people call the same defines and functions.
Yeah. It’s messy.
## If Define Exists…
This is used a lot. Let’s say you know you need the plugin basename (the folder name) in multiple sub folders of you plugin, and it’s a pain in the ass to do `plugins_urls( 'foo.css' , dirname( dirname( __FILE__ )) );` to go up two folders. That’s a case where a global define starts to make sense and it’s a case where *rarely* would you want to bother checking if it exists.
The code is just this: `define( 'MY_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );`
But what if you want to have a default value for an API Key and allow people to override it? Then you can one of these:
What those do is check “Does the define already exist?” for you.
Now keep in mind, I wouldn’t do that. I’d do this:
The best example of this in core WP is how `WP_DEBUG` is handled. If you delete that from your `wp-config.php` file, it doesn’t turn on debugging. The code checks for the existence and if it’s not there, it assumes no. For the most part, if you name your defines properly, there’s no need to allow them to be overwritten because you’re not defining them in advance. But in case you do, this code is a wise idea.
## If Function (or Class) Exists …
Lately I’ve seen a lot of people do this:
Okay look. This *sounds* like a great idea until you realize the fatal flaw. What happens when (not if, when) someone else has a function with the same name and their plugin or theme loads first?
As Lilu Dallas would say “Big badda boom.”
This is a terrible idea *unless* we’re talking about *shared* libraries.
## Use if-checks With Shared Libraries
That’s my answer here folks. The only time you should be checking if-exists is *WHEN* you are using a shared library. If your plugin includes a common PHP library, check for it before you include it.
It’s a little different with Javascript and CSS though. Let’s say you’ve got Bootstrap. This is a commonly used library. A *lot* of plugins and themes have it, and you’re a good person. You want to make sure you only load it one time no matter how many people include it in their plugins and themes. In this moment, you have to do something paradoxically brilliant.
Don’t use a unique name for your enqueues.
The magic here is specific to how WordPress handles enqueues. It knows “There’s already something enqueued as bootstrap! I don’t need this!” and you’ve sped up sites. Of course there’s a risk here when someone might have an older version loaded first. As far as I know, the enqueue system isn’t clever enough to detect what version is included, and use the newest one (I wish it was), so you may have to do some convoluted checks. Also making this worse is that people don’t name things properly. I’ve see people using `bootstrap-js` and `bootstrap-css` for the enqueue names, which is totally unnecessary. WordPress will handle that for you.
Remember: When in doubt, if coding for WordPress do it the WordPress way.
**Categories:** How It Works
**Tags:** coding, essay, mailbag
---
### [PHP Ternary Operations](https://halfelf.org/2017/php-ternary-operations/)
**Published:** January 18, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Understing a faster way to sort through true/false scenarios in PHP.
**Content:**
I mentioned a few days ago that I finally got to use ternary operations in my code and I was excited.
I have a tendency to write my code out long form, which stems from how I actually sit down and think about my code. For example, when I need to check if specific parameters are set, I write it out like this:
> If variable X is equal to FOO, then do BLAH. Else do DEFAULT!
When I translate that to PHP code, it becomes this:
There’s nothing particularly wrong with it, but it can get a little long. And then consider code like this:
That has two issues. The first is that I’m trusting my data a little more than I should and not sanitizing when I save the variable. The second is I’m not validating smartly. If I want to be smarter, I do this:
At this point, I’m no longer allowing my code to be anything but yes or no, and if someone puts in ‘maybe’ as a value for the POST data, that’s nice but I’m forcing no.
Another alternate way is this:
There I default to ‘no’ and only pick ‘yes’ if it’s set to yes. This code is somewhat better because it only has one check and it’s obvious what my default is.
But we can be even smarter! The trick is that I have to rethink how I’m checking for things. If all I care about is if a comparison is true or false, and I want to save a specific value to a variable based on that, then I can do my code all in one line:
This is the magic of the [ternary operators](http://php.net/manual/en/language.operators.comparison.php#language.operators.comparison.ternary). With it I get one line that checks for a specific result and defaults when that’s not it. You can make it more complicated, as long as the result is true/false. Like here:
Obviously they won’t work in all situations, and there are some cases where the two possibilities are going to make the code harder to read, but they can be downright nifty if you do them right.
**Categories:** How It Works
**Tags:** coding, php
---
### [Cleaning up SVGs](https://halfelf.org/2017/cleaning-up-svgs/)
**Published:** January 16, 2017
**Author:** Ipstenu (Mika Epstein)
**Content:**
If you were here on Friday, I talked about the headache of [using SVGs on AMP pages](https://halfelf.org/2017/can-amp-svgs-friends). In that post I mentioned that one of the fixes was to ‘clean’ the SVG file.
Why would be bother? The simple answer is that smaller files are better. But as we learned with AMP being picky, it’s also because we want our files to be fully compatible with all browsers and servers. SVG standards are important, after all.
So let’s clean!
## Remove Headers
If your SVG starts with this, just remove it:
## Remove Less Standard Tags
I wouldn’t have realized these weren’t super standard if it hadn’t been for AMP alerts. But these aren’t:
Again, remove them. But also you want to remove tags like `` and that’s tricky because you’ll usually see it like this:
If you use a regular expression like I did, be *very* cautious. I checked every single one of my 700 SVGs after the edits to make sure they still worked. There were cases where the only call to the `` tag was with the extraneous stuff, so I had to very cautiously replace. I missed about 40.
## Remove Illustrator’s Extra Shit
Here’s where you’re going to save the most space. First remove the `requiredExtensions` stuff:
And then remove the big hunk of PGF:
I can’t show you the actual content. It’s huge. It’s way huge. It’s up to 20k huge.
## Remove Switch
If you’re not using the switch, you want to remove it.
## End Result?
A 29 KB file is 4KB. And that is a faster internet.
**Categories:** How To
**Tags:** images, speed
---
### [Rebranding Featured Image](https://halfelf.org/2017/rebranding-featured-image/)
**Published:** January 11, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Featured Images renamed and rebranded.
**Content:**
WordPress 3.0 introduced featured images, letting everyone designate an image for a post (or page) in a way that themes have taken great advantage of in the intervening years. The concept of a ‘featured’ image was easy enough to understand. An image the content featured. Cool. But it can do so much more.
## The Defaults
The basic box is one all WordPress users are familiar with:
A simple box that says “Featured Image” with a link to set the featured image.
It’s great, but it’s a little boring.
## Changing the Title
The actual trick to this is to remove the metabox. The three attributes you will need are the name of the meta box, the post type, and the location. The post type is the one most of you are going to change. For example, I wanted to change the title for a specific post type so it was clearer what kind of image I was looking for to use as a featured. For TV shows, I wanted it to indicate that I was looking for a Title Card type image.
This little snippet removes the meta box and then *adds it back* with a new title:
## Changing the Main Content
Once the title is changed, the next step is to change the content. I’ve done this before, putting in [the image size to the content](https://halfelf.org/2014/featured-image-size-redux/). What I wanted to do here was change the content from “Set featured image” to “Set show image” and for that, I want to use a string replacement:
But that only changed the one. Once you’ve set a featured image, the language changes to “Remove featured image”. I could add in more replacements, or I could be smart. We like being smart.
And yes, it works.
## Customizing by Type
What if you have ten custom post types? Well then it’s time to get smart! By using anonymous functions, we can do this quite effectively, getting a list of all the publicly registered post types that *aren’t* the built-ins, and then for each one, renaming the content:
This trick uses the values of a custom post type which you already set when you built out your custom post types.
## Customizing the Content Further
Now that we’ve changed ‘featured’ to match our custom post types, it’s time to take it even further. Can we *smartly* add in the image size? Usually the answer here is no, because it’s impossible to know what you want to have as your featured image size for each custom post type. As it happens I can because I was smart.
Every single CPT that has a special image has an image size for it:
And my post-names for those things are ‘post\_type\_characters’ and ‘post\_type\_shows’. This means I can add the following to my filter for `admin_post_thumbnail_html`:
This could even be extended to only show the image size when it was not set. For now, this does what I want.
## How’s it look?
Not bad:
And there you have it. More information for your users to know what kind of and size image to use.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Recoding Taxonomies](https://halfelf.org/2017/recoding-taxonomies/)
**Published:** January 9, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Renaming the secret names of your taxonomies for mental health.
**Content:**
It’s hard to know what the future will be. When initially building out a site, it’s a game of guesswork to name things. You want to name them to be long term sustainable, but without a crystal ball, there will be missteps.
Take, for example, the case of custom taxonomies. When my site was originally built out, it only had one custom set of tags and they were logically called `sitename_tags`. As the site grew, it became apparent that multiple tags were going to be needed and, in the end, it had five.
## What Are Our Names
While it’s relatively easy to rename a taxonomy’s display name by editing the data in `register_taxonomy`, you *don’t* want to rename the `rewrite` after the fact. You can do it, of course, but I recommend you be really up to speed on your redirects before you try. Obviously the best choice is to pick good names in the beginning. But what names are we actually talking about?
1. The Display Name – This is the name your readers (and you) see. Categories and Tags are display names. In my case, Stations, Clichés, and Tropes are display names. You can change these as you need.
2. The Slug – This is the rewrite I mentioned. It’s in your URL. Don’t change this unless you know redirects.
3. The Taxonomy Name – This is secret. You’d only know what it was if you hovered over the links and noticed that tags have a taxonomy of `post_tag`.
Today we’re talking about that third one.
## Why Bother?
If you’re the only one who really sees that you named your stations `show_tag` instead of `show_station`, why does it matter?
As it turns out, if you’re working on the theme and plugins for a site, you will end up running into those quirks when you write a loop to perform complex displays on your data. It’s both annoying to have to always comment things like “Yes show\_tag means show\_station” so that future you knows what the hell you’re doing.
Like my friend says, the best documentation for a function is a good name, and fixing the name will make you feel better and smarter.
## How To Do It
This requires two steps:
1\) Run a search/replace on your files to swap the names out
2\) Run a search/replace on your database to swap the names out
The reason is that those two things have to be in sync. Since my world lives in a git repo and a server with WP-CLI, I ran a search/replace on my files, pushed the changes, and then ran a quick `wp search-replace show_tag show_station` to clean it up.
The important thing to note is that what you’re changing in your database is *not* post content, but meta information and tags tables.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Featured Image Size Redux](https://halfelf.org/2014/featured-image-size-redux/)
**Published:** October 6, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Improving on my display of featured image size for Genesis themes.
**Content:**
One of my themes didn’t have a Genesis Featured Image.
Actually it did, but it didn’t have it as an *named* additional image. And this was a problem because I like to have the featured image size listed in my featured image box, as I explained how to do in my post about how to do this in [Featured Image Size](https://halfelf.org/2014/featured-image-size/ "Featured Image Size"). That theme was using the ‘medium’ size for featured images, which meant by code made the box look like this:
This is because I had no `$_wp_additional_image_sizes`, and that’s what I meant when I said there was no named additional image size. So I had to change up my calculation and check first if the name of the image size was one of the defaults, ‘thumbnail’, ‘medium’, or ‘large’, and size off that and *then* check the other options.
Which gives me this:
Right below the global check, I do an if to scan the array and grab the sizes based on that. It’s exceptionally simple, and the major change was moving it to set variables and then setting based on those outside of the if/else check. But it works perfectly on both my sites with regular sizes and the fancy sizes.
I still don’t have a check to see if the theme is Genesis or not, but this multisite is 100% Genesis for all sites, so it’s not an issue for me. If anyone has a way to check “Is this active theme on this site Genesis or a child,” please share. The world will thank you.
**Categories:** How To
**Tags:** coding, genesis, plugins, themes, wordpress
---
### [Recovering Your Cape](https://halfelf.org/2013/recovering-your-cape/)
**Published:** June 25, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to recover a lost super admin account. Also remember, you are not Oprah.
**Content:**
One of the odder “hacks” out there is one where the person, once they get in, de-frocks your Super Admin on a Multisite. This isn’t always a hack, sometimes it’s just a simple mistake.
To quote my friend [Jen Mylo](http://jenmylo.com/):
> 1. People give away admin rights like logo-encrusted keychains at a car show and then the new admins abuse the power.
> 2. Someone who has admin rights deservedly but doesn’t know code makes a mistake.
>
> \[…\]
>
> Some people make bad decisions about who to give admin roles.
There’s an extra level of problems with making everyone and their pet monkey a super-admin on Multisite. You may think it’s a great thing, because now someone else can add new users, install plugins, edit themes and plugins, and of course, use iframes and PHP and such in widgets.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/06/tumblr_md8hekGkk31qc184to1_500.jpg)We run a Multisite at work, and they let me ‘secure it up’ recently. The first thing I did was demote pretty much everyone except five of us to ‘Editor.’ I told them all that I’d done this, and if they found something they couldn’t do, tell me, and I’d fix it. At this point, I’ve changed only three people to Admin, and dropped even more to ‘Author.’ Why? Because *they don’t need to have high levels of access to do what they need to do*! The admins on the site can tweak theme settings, play with widgets, and add ‘existing users.’ Everyone else? They just write content. Heck, most of them don’t even need to be Editors, but we gave them that level so they could help us copy-edit other posts. Two people complained “I need Super Admin access!” and I gave them my best Enda: **NO CAPES**.
Limit your admins, and there is less of a chance someone will accidentally remove access from the wrong person.
So now that that’s out of the way, how do you get it back?
Normally, reinstating an admin account is pretty easy. You go in via mySQL, pop open the wp\_usermeta table, find your ID, and toss this in for meta\_value for `wp_capabilities`: ` a:1:{s:13:"administrator";b:1;}` That won’t restore *all* the roles, if you happen to be using Role Scoper, or some other management tool, but if you’ve got that, you can do anything. If you’re using WP-CLI, `wp user update 1 --role=administrator` (assuming you’re user ID 1).
[](https://halfelf.org/wp-content/uploads/sites/2/2013/06/Screen-Shot-2013-06-21-at-11.34.20-AM.png)
There’s a sidebar/caveat to this. Sometimes this doesn’t work, and it happens if you change your DB prefix. So normally you have the prefix wp\_ and the table `wp_options`. In that table you have a option named `wp_user_roles` and everything works. But then you make a new site, and you pick a different DB prefix, maybe you heard it was more secure, or maybe you wanted both tables in the same DB. Either way, now you have `wp_wdssrr_options` instead, and when you copy over your old options content, no one can log in. It’s because you have to rename that option to `wp_wdssrr_user_roles`
[](https://halfelf.org/wp-content/uploads/sites/2/2013/06/Screen-Shot-2013-06-25-at-10.00.51-AM.png)
I just had a site with this problem last week.
 On the other hand, getting back *Super Admin* access is less straightforward, but by no means is it impossible.
1. Go into wp\_sitemeta and look for site\_admins.
2. In there you will see something like this: `a:1:{i:0;s:7:"Ipstenu";}`
3. If your userID is ‘superman’ then it would be `a:1:{i:0;s:8:"superman";}`
Capitalization and stringlength matter. Add one user, and use that to correctly restore power to the others.
Can you do this via WP-CLI? Yes, if you’re on the latest versions. Kind of. You can get a list of super admins via `wp network-meta get 1 site_admins` and in theory `wp network-meta update 1 site_admins USERNAME` would work except that the data is serialized. I [opened a ticket with WP-CLI](https://github.com/wp-cli/wp-cli/issues/529), and it’s a ‘plugin territory’ issue right now, so I’ll have to see if I can code it myself.
**Categories:** How To
**Tags:** administration, database, hacks, multisite, wordpress
---
### [Displaying Taxonomy Count](https://halfelf.org/2017/displaying-taxonomy-count/)
**Published:** January 4, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Showing a number of posts from a taxonomy in a shortcode was surprisingly complicated.
**Content:**
Monday we displayed post counts. Well, what about taxonomies? That’s a little more complicated, I’m afraid.
Posts are easy. You pick a post type, you display the number of published posts, you walk away. Taxonomies though are a mixed bag. By default you have categories (`category`) and tags (`post_tag`) and inside them, you have terms. For example ‘Uncategorized’ is a category. The problem is that to check if a taxonomy exists (and display a post count), you have two have both the taxonomy name and the term name.
While you think you could just write a loop ‘If the term name isn’t in categories, it’s in tags!’ the reality is that anyone can add any taxonomy and, worse, term names aren’t unique. It’s ironic here, because I desperately wanted term names and slugs to *not* be unique. I wanted to have a tag for ‘random’ and a category for ‘random’ and they all have the same slug names. So here I am now, realizing I’ve set myself up for disaster.
The options are simple:
1. Force people to use term and taxonomy
2. Somehow be clever
I went with option 2. Allow people to use term and taxonomy, but if they don’t, find the first instance and go for it.
## The Code
There are two moments where I bail out early. If they forgot to put in a term, display “N/A”. The same if we get all the way to the end and there was no found taxonomy.
Also if someone puts in a taxonomy, I treat it as an array in order to be lazy and not repeat myself. Good coding doesn’t repeat, so since I have to loop the array of found taxonomies in order to find the matchup, I may as well use it once to find the same data when I know what I have.
I admit, I was really excited here since I finally got to use ternary operations. I’ve known how they work for ages, but I never had a moment where it was so obvious to use them.
**Categories:** How To
**Tags:** coding, shortcode, wordpress
---
### [Displaying Post Count](https://halfelf.org/2017/displaying-post-count/)
**Published:** January 2, 2017
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Showing a number of posts in a shortcode isn't that hard. Here's the code.
**Content:**
If you need a count of all your posts in WordPress, there’s a pretty handy function called `wp_count_posts()` for that.
For example, if you have a post-type of ‘characters’ and you wanted to show a count of that, you can do this:
And that’s all well and good, but I was working on some SEO thoughts. In doing so, I ran into the recommendation that, for a ‘company’ type page, having a list of your posts was a bad idea. This made sense. After all, a site that is about non-traditional blog content shouldn’t start with a blog.
To correct this, I restructured the front page to show, in order:
1. An introduction to the site
2. The 4 newest characters added
3. The 4 newest shows added
4. The latest 10 blog posts
This keeps the blog information visible (which helps show that content is being updated) but also doesn’t drop people into a cold open. They can understand why they’re on the site, what they’re getting, and where to go.
But part of telling people about the site meant I wanted to indicate the depth of information. When I used to run a MediaWiki site, I used `{{NUMBEROFARTICLES}}` to list the number of articles. It was a very obvious way to display activity and attentiveness. If a site had 500 articles, it was probably getting up there. If it had 1500, it probably knew what it was doing.
That meant with WordPress what I wanted was a dynamic way to show the number of posts in a post type, like `[numberofposts type="characters"]` with the default being posts.
## The Code
What I chose to do here was check if the post type exists and, if not, force it to show posts. That way there will never be an error, though it may not show you what you expected if you put in ‘posts’ as your post type.
**Categories:** How To
**Tags:** coding, shortcode, wordpress
---
### [Prettier Search Queries](https://halfelf.org/2016/prettier-search-queries/)
**Published:** December 30, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making search pages a little prettier is easy. Making it prettier for custom searches is a little harder, but still do-able.
**Content:**
By default, when you search on a WordPress site, your search URL has an `/?s=` parameter. Back in the old days of WordPress, we all had URLs like `/?p=123` where 123 was the page ID. With the advent of Pretty Permalinks, we moved to pretty URLs like `/2016/prettier-search-queries/` and everyone was happier.
What about search?
As it happens, the [WP Rewrite API](https://codex.wordpress.org/Class_Reference/WP_Rewrite) actually has a search base of … search. If you go to your Settings > Permalinks page, you won’t see it there, and yet on every site if you go to `https://halfelf.org/search/apache` you’ll actually get that nice, pretty path.
Because of that, you could get away with adding this to your `.htaccess` file in order to get those pretty URLs.
You can also use a plugin like Mark Jaquith’s [Nice Search](http://wordpress.org/extend/plugins/nice-search/).
Those methods work for nearly all sites.
But you know me. I’m not ‘all’ sites.
## Extra Paramater Headache
I had a different problem. Because my site had specialized data, it had [extra search parameters](https://halfelf.org/2016/search-custom-post-data/). I was intentionally limiting my search to specific post type. This meant my URLs looked like this: `/?s=rookie+blue&post_type[]=post_type_shows`
When I translated that to use the pretty search, well …`/search/rookie+blue&post_type[]=post_type_shows` just didn’t work.
This is for a pretty obvious reason when you study the URLs. The first one has `?s=...` and then later an `&`, while the second only has the `&` in there. If I changed the URL to this, it worked: `/search/rookie+blue/?post_type[]=post_type_shows`
The reason for this was due to how parameters work in URLs. They have to start with `?` at the beginning. All additional parameters are added with `?param=value` after that.
## Semi Pretty Search Permalinks
To me, the nicest URLs would be `/search/rookie+blue/section/shows/’. The reality is that people will search shows *and* characters and I wasn’t quite sure how I wanted to handle that. Did I want them to be sections separated by plus signs, or extra ‘folders’ or what? In the end, I decided that for *now* it was okay to just make these prett**ier**.
Taking Mark’s code as my start point, I came up with this:
And that actually does work exactly as I want it to.
**Categories:** How To
**Tags:** coding, plugins, search
---
### [Where Did Underline Go?](https://halfelf.org/2016/where-did-underline-go/)
**Published:** December 28, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** So WordPress deleted underline and you're losing your mind? Maybe you should rethink your understanding of underscores.
**Content:**
As of WordPress 4.7, the visual editor no longer has a button for underline. There were a lot of reasons for this, but primary are two:
1. Space is not limitless.
2. Underlining looks like links.
Naturally someone complained that we were breaking style guides:
> When referencing a source of information it is correct form to underline the title of the source.
They happen to be wrong. Let me explain.
## The Web Is Not Print
We use double spaces to indicate the end of a sentence in printed works. We don’t on the Internet. It took me a long time to get used to that, and if you look back on my older posts, you’d see it all over the place. The point here is that we know you don’t use the same punctuation and style you might use online as you do on paper.
I look to the grandpappy of web, Jakob Nielsen, for some backup here. Your writing style for the web is *different* from print. A lot different. In [Writing Style for Print vs. Web](https://www.nngroup.com/articles/writing-style-for-print-vs-web/) he says:
> In linear media — such as print and TV — people expect **you to construct their experience** for them. Readers are willing to follow the author’s lead.
>
> In non-linear hypertext, the rules reverse. Users want to **construct their own experience** by piecing together content from multiple sources, emphasizing their desires in the current moment. People arrive at a website with a goal in mind, and they are ruthless in pursuing their own interest and in **rejecting whatever the site is trying to push**. Banner blindness is only the most extreme manifestation of this selfishness.
But that talks about the way we write and not the design of what it looks like. Web and print design are wildly different too. For newspapers, you have to consider the width of the columns. If you’ve never taken a journalism course, there’s as much about layouts as there is about writing a solid lede.
## Good Writing Has Rules
I’m a huge fan of Strunk & White’s[ *The Elements of Style*](http://www.bartleby.com/141/). My wife has a copy and, when we met, she found my grammar to be deplorable and used to wave it at me a lot. Having read it multiple times (yes, I do re-read it) I’ve found my communication skills have been catapulted because of the directions. People ask me why I’m a good speaker and the answer is because I’m a good *writer*.
One of the lessons from Strunk & White is to [use the active voice](http://www.bartleby.com/141/strunk5.html#11), for example, which is something Nielsen points out as well. You need to engage your readers. You need to bring them on a journey and make it theirs as much as yours. To do that, you need to understand the rules of the language in which you’re writing.
## Content Must Not Confuse By Context
Going back to the heart of the matter, why is it okay that WordPress killed the underline button? It was confusing.
Originally we underlined links because it was easy and being consistent about a display reduced the chances for misunderstandings. Why were they underlined and blue? I actually have no idea. I looked it up but was unable to find a solid answer. My theory was that blue would stand out against the standard grey background as well as the black words so everyone knew what it was for. Similarly, on a monochrome screen, which was very common in the day, an underline would stand out (as it happens, [Sir Tim Berners-Lee picked blue totally by happenstance](http://fagerjord.no/blog/archive/whyareli.html)).
Why underline and not bold or italics? My guess is that since underlining is *not* actually standard practice for writers, it was a safe grab. Otto pointed out that old-old systems always had underlines, but not always italics or bold, so that weighed heavily into the decision as well, clearly.
In a word, it wasn’t *confusing*. It was *consistent*.
## It’s Actually Italics
Did you double take when I said underlining wasn’t standard practice? Surprise! Let me appeal to Misters Strunk & White on [a few matters of form](http://www.bartleby.com/141/strunk2.html#6):
> **Titles.** For the titles of literary works, scholarly usage prefers italics with capitalized initials. The usage of editors and publishers varies, some using italics with capitalized initials, others using Roman with capitalized initials and with or without quotation marks. Use italics (indicated in manuscript by underscoring), except in writing for a periodical that follows a different practice. Omit initial *A* or *The* from titles when you place the possessive before them.
>
> > The *Iliad;* the *Odyssey; As You Like It; To a Skylark; The Newcomes; A Tale of Two Cities;*Dickens’s *Tale of Two Cities.*
Notice the direction to use *italics*? The talk of a manuscript is in reference to the fact that most people wrote manuscripts by hand or on typewriters that didn’t have italics. I remember having to type a line, and then backspace to add in the underline manually. Have you ever tried to write italics manually? It’s not easy!
The web is not handwritten. Computers in 2016 can handle italics.
And it’s not just Strunk & White. [Harvard’s documentation on citation](http://isites.harvard.edu/icb/icb.do?keyword=k70847&pageid=icb.page363223) doesn’t recommend underlining at all. The MLA (Modern Language Association) says, as of this year, to use italics for large works like books and magazines, but quotes for short ones in titles. The Chicago Style Guide reads the same.
## Use Italics, Not Underline
If you skip the whole post, let me make this simple for you: The title of a source should be italicized.
**Categories:** How It Is
**Tags:** design, essay, wordpress, writing
---
### [Two Factor Authentication](https://halfelf.org/2013/two-factor-authentication/)
**Published:** April 22, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You want to add something to your protection armor? Two-Factor Authentication it is! But what is it, what does it do, and how do you use it?
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2/2013/04/original.jpg)This is something that Tony Perez and Sam “Otto” Wood both recommend, so you know I have to look at it seriously!
I think I need to point out that I’m willing to accept that I’m wrong about things. After all, I can’t know everything, and I am well aware of that. But one of the things I work hard to do is learn, adapt, grown and get better at all this. The whole reason I started talking about tech on this site was I was trying to understand [cloud hosting](https://halfelf.org/2010/what-is-cloud-hosting/) back in August of 2010(A lot of tech posts were ported over from Ipstenu.org after the fact.).
The point is I do this site because I want to learn, and when I learn, even if I don’t understand all of a thing, I want to share what I’ve learned specifically because I know people will come and correct me. Next to answering people’s questions, this is the fastest way I know of to really understand things.
So.
I didn’t mention Two Factor Authentication in my [security post](https://halfelf.org/2013/false-security/ "WordPress False Security"). Using it certainly *would* have mitigated the brute-force attack, though not the DDoS implications of it, and that remains why [I am a fan of ModSecurity](https://halfelf.org/2013/wp-login-protection-modsec/ "WordPress Login Protection with ModSecurity"). That doesn’t mean I didn’t just add another tool to my arsenal, or that I’m not willing to try something out.
I am now using Two Factor Authentication.
Two-factor authentication (aka multi-factor authentication, or TFA, T-FA, or 2FA) is a way to verify your authenticity by providing two (ore more) of the following factors:
1. Something the user has – aka a possession factor
2. Something the user knows – aka a knowledge factor
3. Something the user is – aka an inherence factor
For most of us, we authenticate only via knowledge – that would be your standard username and password. You “know” your password, thus you pass the knowledge factor. A PIN (like for your bank card) is the same thing. This is simple, it’s easy, and most of us can remember a password.
Something you have is easy to explain if you’ve ever worked for a company and had a RSA ID or a keyfob with a random generated string. That’s the possession factor at work. In fact, your bank card (again!) is one of these too! It’s something else, something physical that you must have to prove you are actually you.
Inherence factors are things like biometrics, so a fingerprint or retina scan. That’s all you need to know about that. Arguably it’s something you have, but it’s a part of you, something you always have with you, so it’s inherent or innate to your very person. Latin. You’re welcome.
It’s pretty obvious that a strong password only goes so far. If I can’t log into my laptop without a USB keyfob, then my site is super secure. This is better than using the picture and keyphrase that a lot of banks use right now, but it’s also harder. It’s very easy for a company to have you pick a photo, a sentence, and a password and make you verify them when you log in. But to instead make sure you have a specific device with you that verifies who you are and that you’re you in this very second?
[](https://halfelf.org/wp-content/uploads/sites/2/2013/04/drew_barrymore_04.jpg)How, exactly, they work depend on which methods your using. There are myriad different methods of possession factors you could use, and how each one works is a little different. But we like multiple factors because if you needed (say) my retina scan and a password to log in *and* a titanium ring, and another person with those three items, then I’ve just described the plot of *Charlie’s Angels: Full Throttle*. I’ve also described a pretty tough nut to crack if you’re not Drew Barrymore.
The issue with these methods is they’re not (yet) practical for the common man, and that’s really a large part of why I *don’t* like TFA very much.
The knowledge factor is the most easiest to hack. We’ve see that. That’s the whole reason we want to use two or more factors to authenticate. I’m not arguing that. The possession factor is the easiest to break (lose your keyfob or be out of cell phone range). Unless there’s some backup to let me in even if I don’t have the second factor, I’m SOL in a lot of ways. Of course, once you have a backup method, then that’s vulnerable. The inherence factor is the least reliable so far and the hardest to implement correctly. There’s a whole Mythbusters on how easy it is to make a fake fingerprint. It’s not that this is easy to hack, it’s that it’s hard to protect.
Okay, so what should we do?
The [Google Authenticator Plugin for WordPress](http://wordpress.org/extend/plugins/google-authenticator/) comes recommended by my man [Otto](http://ottopress.com) and I know I’m not Google’s biggest fan, but this is one instance where I think they did it right.
The plugin uses open source code for [Google Authenticator](https://code.google.com/p/google-authenticator/), which is not something Google really invented so much as perfected. In fact, my old keyfob at work did the same thing.
Here’s how it works. The site you visit generates a string of characters called your Secret Key. This key can be a string (like hE337tusCFxE) or a QR code embedded with all the information from your site (like site name and so on). You enter the data into the app on your phone, and that uses secret string plugins the date and current time, to generate another random number string you use when you log into the phone.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/04/SNP_2909001_en_v0.png)It’s like a password that always changes, and since your phone and your (say) blog have clocks running, they know what time it is, parse the math on login, and off you go. So yes, this will work if you’ve got no cell reception. But no, it won’t work if you’ve lost your phone (which remains an issue for me). Since each site has a unique key and time is always changing, the code is never the same twice. No two users or sites will have the same key either. There’s more math to it, and you can read what [Otto commented](https://halfelf.org/2013/false-security/#comment-5472) about it.
Now to log in to my blog I need the username and password, plus a random number I can only get at if I have my cellphone and know the passcode there too. In my case, if I lose my phone, I can’t get into my site. This is, most of the time, okay. If I’m on a strange computer, I need the phone anyway to get the password out of 1Password, and I tend not to log on when I’m not on my own computer or my iPad (which requires the use of an app password, less secure all around, but needed).
To me, it’s not risk versus reliability, or even risk versus vulnerability. It’s risk verus risk. So far, the risk of losing my phone is less than the risk of what happens if I lose my website. After all, my website is my life.
**Categories:** How It Works
**Tags:** plugins, risk, security, wordpress
---
### [EasyApache 4, PHP, and WP-CLI](https://halfelf.org/2016/easyapache-4-php-wp-cli/)
**Published:** December 26, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little chat about PHP being a tricky thing in EA 4.
**Content:**
Way back in March, I upgraded my server to use [EasyApache 4](https://halfelf.org/2016/easyapache-4/). I did this because I wanted to have multiple versions of PHP on my server and be able to segregate it by domain. I also wanted to be able to upgrade PHP without having to rebuild Apache.
For the most part, it’s been great. There were a couple odd snafus, like when it accidentally installed the wrong [wp-cli](https://wp-cli.org) on a minor upgrade for me, but it magically fixed it.
## PHP Breaks WP-CLI
The problem was when I ran wp-cli commands, I got this error:
Scary! I tried reinstalling and that didn’t work
I took a note of what version of PHP I had running on command line and so something weird:
> **PHP 7.0.10 (cgi-fcgi)** (built: Aug 22 2016 20:34:53) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies with Zend OPcache v7.0.10, Copyright (c) 1999-2016, by Zend Technologies
## The Wrong PHP
PHP 7.0.10 (cgi-fcgi) sounds like it should be okay, except I knew two thing:
1. Fast CGI (fcgi) isn’t supported on EA 4 yet. It’s not even supported today. They’re working on it but it shouldn’t have been a thing installed.
2. That should be `cli` not `cgi-fcgi`!
I pinged a friend at cPanel who said “Oh no!” and promised to look into it for me. The next day I got an email that there was a minor PHP update to my server last night. I knew that meant PHP had been rebuilt. When I went to look, wp-cli was working again.
Ergo – Something was wrong in PHP 7.0.10. It pushed the wrong version of PHP for command line somehow.
## Risk vs Reward
Obviously this is a risk, having a server auto-update itself. It could install a rogue package or someone could typo or worse. At the same time, having PHP apply it’s own security patches for me means I don’t have to worry that I’m in Japan for a week and forget to do something. The risk, knowing that EA will roll out a fix for me, is less than the reward of being secure.
**Categories:** How It Works
**Tags:** easyapache, php
---
### [Damn You, Autocorrect!](https://halfelf.org/2016/damn-you-autocorrect/)
**Published:** December 23, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Autocorrect is great until you have words and names that aren't included in the 'standard' English dictionaries.
**Content:**
After the seventh time I shouted “stop autocorrecting cmb2 fields!” at my site, I knew I had to do something.
When you run a website where you enter a lot of people’s names, Autocorrect is a curse more than a blessing. Of course I want it on my post content, but when I get to the field where I enter someone’s name, for crying out loud, some names like Nuñez just don’t meet a spell check. And don’t get me started on my friend’s names or my own. I’ve lost track of the number of times I ended up as “Mike.”
This issue used to only be on phones and tablets. Then Apple introduced autocorrect to their MacOS, which resulted in a lot of tweets followed up by “Damn you, Autocorrect!”
## HTML Attributes
If you’ve got a form and you want to tell autocorrect to go away, the code looks like this:
For the most part, this will work. You don’t need *all* of them all of the time, but in my case I was adding names and “Debbie van Houten” was one problem and “Dr. el Farad” was another. I wanted it to just shut up and let me type the name as their parents intended, no matter what. I went whole hog.
But as I mentioned, I use CMB2 and I needed to stop my site from autocorrecting CMB2 fields. It was time for some code.
## CMB2 Custom HTML Attributes
This one is so straightforward I was delighted. When you create a new field, you can set [arbitrary attributes](https://github.com/WebDevStudios/CMB2/wiki/Field-Parameters#attributes).
That was all I needed to do in order to get autocorrect to duck itself. Now I was free to write however weird a name I needed without worrying that autocorrect wanted to call me Mike. Again.
Thanks, autocorrect. Thanks a lot.
**Categories:** How To
**Tags:** cmb2, coding, plugins, wordpress
---
### [Custom AMP Design](https://halfelf.org/2016/custom-amp-design/)
**Published:** December 19, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Customizing the AMP design for your pages can be done, but it takes a little elbow grease.
**Content:**
The basic design of a page using AMP works for news articles. This is by design. It’s meant to be fast to load and fast to display, and that means removing the majority of cruft we shove in sidebars and footers. It means a streamlined website.
That’s a basic page but it works well for what it needs to be. The issue happens when you consider pages that aren’t your typical ‘news’ pages.
Compare the information in a character page. On the left is the normal page and the right is the AMP page.
There’s some work to be done, obviously. Enter [Custom Templates](https://github.com/Automattic/amp-wp#custom-template).
## Calling the Right Template for the Job
The example code works great when you want to universally replace things. I don’t. I want to use a different template per-CPT, so my code is this:
That was the easy part.
## Making Your Template
Now I need to make the template. It’s actually not as obvious as it might be. You can’t just copy the `single.php` file from the AMP templates folder and go. No, if you want to use it as-is, you will need to set up how to pull the custom templates.
For the quick example, we have the [Single Template](https://github.com/Automattic/amp-wp/blob/master/templates/single.php) and with that we have to replace all the calls to `load_parts`. They look like this:
We have to change them because the code for `load_parts` is relative to the file, and it doesn’t call .php so it’s a bit of a drama to call them. I replaced it with this:
This is pretty much what I tell plugin developers not to do. Never ever use `WP_PLUGIN_DIR` unless you absolutely have to. Always use `plugins_url()` and `plugin_dir_path()` please and thank you. But since I can’t use a URL in `include_once()` because it’s https) and I can’t use `plugin_dir_path()` because it’s relative to the file it’s called from, and this is called from the theme. So yes, here I have to use the one constant I tell you not to use. I’m aware of the irony.
The rest of the template is mostly removing things I can’t filter out. I removed the feature image, I removed the byline (we don’t care who wrote the CPTs, authorship isn’t an issue), and I removed the taxonomies.
## Fix The Images
Once the main file is loading properly, it’s time to address the two problems with the images: size and location. There’s, thankfully, some default code that can help with this that didn’t need a template. AMP comes with directions on [changing your featured image](https://github.com/Automattic/amp-wp#featured-image) but the example code had to be tweaked in order to handle multiple post types:
But. This made double images! Why? Because this is a lie: “The default template does not display the featured image currently.”
It does. This is why I removed the featured image in my template. If I can figure out how not to do that, I’ll be 90% of my way to not needing a custom template at all, because everything else I did in the filter.
## Add the Extra Content
Remember `function lez_amp_add_featured_image()` above? Yeah I threw it out and made an insanely complex. I renamed it `function lez_amp_add_content()` and the `if ( $post_type === 'post_type_characters' ) {}` section became huge so that I could output the code the way I wanted.
In the image above, you can see I’ve not only added in a lot more meta content from the post, but I also tweaked the CSS to float the image to the left and resize the SVGs. I went super image light on this, loading the smallest image that would work, and the SVGs are very small sized.
## Overall? It should be easier
The biggest issue I have with this is that I wish I could filter more. If I could turn off the featured images and remove the bylines, then I wouldn’t need the custom template at all. At least, not for the characters. The shows? That’s another matter.
**Categories:** How To
**Tags:** coding, google, themes, wordpress
---
### [Security: Do it the WordPress Way](https://halfelf.org/2016/security-wordpress-way/)
**Published:** December 21, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When there's a choice to reinvent the wheel or use the wheel? Use the damn wheel.
**Content:**
Pretty regularly, people complain that I’m being pedantic and stubborn about security. They argue that their home-grown filters and regular expression checks are more than sufficient for sanitizing and validating data. Invariably I tell them “WordPress has a function for that. Please use it. Don’t create your own.”
Most of the time, this gets a grumbling acquiescence. On the rare occasions it doesn’t I get a pretentious email telling me the developer has been working in tech and computers for 10 to 14 years (10 is most common) and they’ve released code before and they know what they’re talking about.
You know what? You do. Most of the time the code you people come up with *looks* fine. But after 14 years working for a bank and around 7 of doing WordPress plugin reviews and nearly 5 of working for a web host, I’ve got a different point of view than you do. I have a mountain of experience that is hard to match. This doesn’t mean I’m the smartest person down the pike, don’t get me wrong. But I’ve seen a lot. I’m like that Farmer’s guy.
## We know a lot because we’ve seen a lot
With all the things I’ve seen, I’ve developed a very different set of criteria for security beyond just “Is it secure?”
I know the following:
- Someone is always going to be smarter than I am.
- Hackers are incredibly dedicated to being shits.
- Users are incredibly inventive with usage.
- People don’t look before they click.
I ask the following:
- Is this the fastest (most efficient) way to sanity check the data?
- Is it being validated to prevent PEBUaK errors?
- How easy will this be to fix when I find a problem?
- How much damage will this cause if it breaks?
## To WordPress or Not to WordPress
When I have a choice of reinventing the wheel or using what WordPress already sanitizes for me, I will *always* pick WordPress. Every. Single. Time. This is for a very practical reason.
- People don’t upgrade plugins.
- People *do* upgrade WordPress security releases.
By default everyone using WordPress gets security releases and they get them within 12 hours (more or less). Yes, people can and do disable that, but they’re the minority. When you talk about securing 26% of the Internet, the ability to patch people quickly is paramount. WordPress knows this.
If I’m using the `sanitize_name()` function from WordPress and not a hand-hewn regular expression, then if there’s a flaw in that function I *know* it will be patched and the patch pushed and my users made safe. If I make it myself, I have to pray everyone upgrades.
## Excellence Uses The Right Tools
Think of it this way. If your plugin becomes a popular plugin and 2% of WordPress users use it, then that’s .5% of all sites on the Internet using *your* plugin. Which is better for them? Which is safer? Do you rely on the tried and true, tested sanitization via WordPress which will emergency self-update or your own code?
Once you think of it not as “How can I make my code succeed?” but “How can I build trust for 27% of the internet?” it’s clearer.
Rely on WordPress and not your own code whenever possible. It’s smarter. It’s safer. It has the long-term view to take you from a newbie to a well-known tool. If there’s a security hole in WordPress, everyone will work to fix it, and it will get out to more people than just your users.
**Categories:** How It Is
**Tags:** coding, essay, wordpress
---
### [You Are Not Your Code](https://halfelf.org/2016/you-are-not-your-code/)
**Published:** December 16, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I'm a writer, an artist, a dreamer, and a contributor to open source. I have the time to give back to the community, to continue to learn and grow, and to make more of the Internet a better place for everyone.
**Content:**
This is not *exactly* what I said at WordCamp US 2016, but it is a great deal of it.
I started my slides for WordCamp US so many times, I probably have enough content for a week of blog posts. The weight of what I was going to say there sat on my shoulders like I’m Atlas. Trying to dredge up the pain from the rejection and harassment I’ve felt over the years, all in order to write, reminds me of the carrion birds, ripping apart Prometheus, while he heals only to be torn anew each day, all for presenting humanity with the gift of fire.
## Perception: We Are What We Code
Too often, when we think about our contributions to WordPress, we think of them in the literal terms. I have written code. I have fixed CSS. I have beta tested. I have created a plugin, a theme, a blog, a store, a book, a career. We make the fatal mistake of boiling down what we are to one thing. The contribution. The code.
## Reality: We Are What We Create
We forget something crucial, that these creations are just that, creations! We have invented something out of nothing, purely with the power of our minds! We’re artists and dreamers and believers and builders. Anyone who’s studied art, music, journalism, knows that there’s a strange dissociation that we have to build in our hearts. The separation between what we create and who we are and what the reviews will be.
## We Can’t See the Forest For the Trees
Artists are, often, seen as temperamental. Capricious creatures who fall to the whim of our desires and passions. People who obsess over one thing to the exclusion of others. Who trash hotels when frustrated. Who lash out. Who take the rejection of a bad review so closely, so personally, they cannot separate themselves from their art.
If you saw my talk at WordCamp Europe earlier in 2016, or read my post about it, that sounds familiar. We, we contributors to open source, are exactly the same. Which is why it is hard, so so hard, to separate our hearts from our heads. We wanted to bring fire to earth. We wanted to share our joy. We wanted to do the right thing and change 26% of the Internet for the better. Give or take.
Instead, we’re told our code sucks. If we don’t offer free help for our work, we’re called greedy and vain. Being driven to fix one part of WordPress is wasting our time, no one uses it. Creating new features? We should fix what’s broken, even if we don’t know how. We are pulled by a million masters, our users, and we can never do enough.
And what about when our contributions are less visible? What about the people who spend hours making sure this WordCamp flowed smoothly? The ones who ensure funding? The one who fixed the inline documentation for core? The people in the support forums who help people for free? The people who review your themes and plugins and try and keep things fair for all. Oh, oh yes. I know that one.
The problem here is that we all do things for good. Everyone you see at a WordCamp, everyone who is a speaker, a volunteer, a contributor, is doing this for good reasons. Maybe not entirely altruistic, we’re not all socialists and software communists like me, but I promise you, every single one of us who steps up and does things for the greater good of WordPress is doing so with the best intentions. We *care*.
And they don’t see that.
> “Reputation is what other people know about you. Honor is what you know about yourself.”
> — Aral Vorkosigan in *A Civil Campaign*, by Lois McMaster Bujold
One of the points I wanted to address in my talk was that there are a LOT of days when you know you’ve done the right thing, and your reputation tanks. While a lot of people here like me, appreciate my work, and respect me, I’m not so naive as to think that’s universal. I know very well that there are people who watched my talk, who read this blog, who dislike me for, say, closing their plugin or deleting their reviews. Or worse, *not* deleting a review.
## The Cost of The Greater Good
I want to say the good of the many outweighs the good of the one, or the few. And there are days where you’re the one. You’re the 20% minority. These days, as my father taught me, will outweigh the ones where you are praised, thanked, lauded, and cherished. It’s the dark part of human nature. You will, you WILL do things for the best intentions, and you will NOT be appreciated for it.
What you do when these things happen? Well you have choices, like I mentioned this summer. And there are downsides to each one. Otto, who’s somewhere around here, spends time talking me down from correcting people. I have a strong urge to “Well, Actually…” the people who insist I have evil in my heart and I’m power hungry. Other people listen to me vent a little. And sometimes I subtweet.
But this is the part that hurts. You can’t win. It’s impossible. People won’t believe you if you defend yourself. They won’t accept your explanations, they’ll see them as excuses. Silence will be seen as proof they were right. Fighting back? A show of weakness or a cover up. There is, literally, no way to win it. Ever.
## Outsmart, Outplay, Outlast
Outsmarting them can be a pyretic win. Outplaying? You can try but I wouldn’t. But what if you keep going. Then the win is not a win but sort of an eventuality. Awesome, I know.
You can’t teach a pig to sing. It frustrates you and annoys the pig. That’s a Southernism from my inlaws. There are some people you just can’t reach, no matter what you do. That’s where the remark of “I’m sorry you feel that way.” comes from. When I say that, I’m not giving up, I’m accepting futility.
And yet. You know that saying? The one about serenity and accepting what we cannot change? I hate it. I don’t believe there’s a single thing we cannot change, just perhaps not as quickly as we’d like. Accepting futility means I accept that there is no way I can, right now, explain myself well enough to change a mind. Yet.
## It’s not about being smarter than someone else, it’s about being smarter than yourself
If you can convince yourself not to be stupid, you will protect yourself from just about everything. Outsmarting yourself is hard, though. You want to believe that you’re right. You have to remember that there is always someone smarter than you, somewhere. And no one is stupider than past you. That’s why we leave ourselves notes in documentation. To make sure future you remembers. Not being stupid means not picking fights. It means recognizing when you’re wrong.
The secret behind outplaying is you’re outplaying your own tendencies and habits. You know yourself. You know when you snap off a reply you shouldn’t, or when your humor is more biting than it should be. You have to play yourself and not do those things. Fool yourself and you’re the fool, but play to your strengths and you can keep yourself humble while preventing your inclination to be stupid.
If you outlive everyone, then you get to write the history. That takes a lot, A LOT of patience. More than most of us have. And it requires being able to tell someone you’re sorry you can’t help them, or you’re sorry they feel that way, and you walk away. And you wait. And wait. And wait. The being quiet part is the hardest, because people like to fill silence, especially you. But you must wait to survive.
## Survival is not about the Fittest
I could tell you how I survive. I could tell you to subtweet, to blog, to scream, to ride your bicycle until your lungs feel inadequate and your legs are on fire and your blood pounds so much, your Apple Watch wonders if you’re having a heart attack. I could tell you to talk to someone, a loved one or a professional, and maybe to try meditation. The Breathe app? Pretty nifty.
Remember how I said everyone at a WordCamp wants to make WordPress better? And remember how I said you’re not code? I lied a little. You ARE code in that you, me, everybody is WordPress. And while I cannot tell you the right answer for you and how YOU can survive the storm and the hate that you will face, I can tell you that you are not alone. That you are one of us. And that WE are here too.
As a team we are stronger. We can rely on each other. We can lean on each other. We can take our shared love of sports, or food, or a same birthday, and find connections with each other.
## What I Don’t Know…
The one thing I cannot tell you is why people hate. I don’t understand it myself. I suspect I never will. But what I can tell you is that we are better together. The way to make it past the hate is together. I am strong, mentally, because I turn to my community, sometimes quietly and sometimes loudly, and ask for help. There’s no shame in that.
**Categories:** How It Is
**Tags:** community, essay, wordcamp
---
### [AMP It Up](https://halfelf.org/2016/amp-it-up/)
**Published:** December 14, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Ramping up your WordPress site on mobile with Google's AMPlification project.
**Content:**
We’ve all heard about how Google wants to make mobile pages faster. The [Accelerated Mobile Pages (AMP) Project](https://www.ampproject.org/) is there to deliver and process a pared down version of a webpage, prioritizing speed. Since speed is important to your SEO, and I’m on a bit of an SEO kick, you bet it was next on my to-do list.
I admit, Joost talked about this at his WordCamp US talk this year, and among my notes was this:
> Add AMP – *not* set it and forget it
This is so, so true.
## The AMP Plugin
First its like all things WordPress, you install the plugin [AMP by Automattic](https://wordpress.org/plugins/amp/) and activate it. That does the easy work. Of course then you have to customize the hell out of it to make it look right. Still, out of the box the plugin adds a `/amp/` so if you go to [https://halfelf.org/2016/amp-it-up/amp/](https://halfelf.org/2016/wordcamp-lgbt-tribe-code/amp/) then you’ll see my AMPlified pages. If you’re using Multisite, you *may* need to re-save your permalinks for the URL to work.
There are some big warnings about this though.
1\) No analytics tracking
2\) You don’t get to design your AMP page
3\) It doesn’t work on the front page or pages or cpts
Don’t worry! We can fix all that!
## Analytics
If you’re using [Monster Insights for Analytics](https://wordpress.org/plugins/google-analytics-for-wordpress/), supposedly they added in some code to make tracking work, but I was unable to find it in the code or documentation. More than likely it’s in their Pro version. I don’t use that plugin simply because I found it easier to use a 28 line `mu-plugin` for my network and I don’t need to see my stats all the time. I used the [AMP WP recommended method](https://github.com/Automattic/amp-wp#analytics) and put it in the same `mu-plugin` as I have my regular analytics.
## Design
This is a little messy. Design is a very complicated word. If you just want to change the colors, you can do this via Appearance > AMP. Whaaaat!? That’s right, it lets you change the header color and font color right there. Super simple. If, though, you want to make your CSS tweaks directly to change that light blue header to navy, perhaps, you can follow the [AMP WP directions for CSS additions](https://github.com/Automattic/amp-wp#rule-additions) and have this:
I *strongly* recommend making few changes. Oh, color of course, but don’t go and make a 1 meg CSS file. The point of AMP is to load faster, after all!
There’s a whole second level of design that I’ll get into later. It needs its own post.
## AMP your CPTS
Right now you can only do it via code. The [AMP WP directions for CPTs](https://github.com/Automattic/amp-wp#custom-post-type-support) state they may come up with a better way, but for now you do this:
It’s pretty direct, and I added this in the bottom of my existing CPT code.
**Categories:** How To
**Tags:** design, mobile, wordpress
---
### [RankingCoach Drops the Ball](https://halfelf.org/2016/rankingcoach-drops-ball/)
**Published:** December 12, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes the target audience is missed, but assuming all businesses still match the old model is short sighted.
**Content:**
I’ve been using OnPage for SEO assistance recently and decided to check out a couple other options, one of which being [RankingCoach](https://www.rankingcoach.com).
## tl;dr – Traditional Business Only
If you want to skip the rest of this post, the summary is that they don’t meet the needs of a non-traditional business. While the interface is nice and the UX better than OnPage, the end result is that it doesn’t understand the more outré of rare businesses, and it’s not very adaptable. Oh and you have to give them your credit card.
## No Location? Nonsense!
For some reason, RankingCoach assumes that all businesses have to have a physical presence. It’s 2016, and as shitty as this year has been, they don’t. A lot of businesses don’t matter where they physically are, it’s all about the virtual presence, and that’s okay. While you can force it to understand that you’re international, the idea of being non-national is still lot on them, and oddly prioritized.
## The rarer the business, the worse the results
I’m going to put this out there as a level of stupidity and ignorance that upset me. There’s only one value for LGBT businesses and it’s a fucking *gay bar*.
I’m going to be frank here. This moment set and sealed this product for me. Gay bars. That’s it. That’s the *only* gay business? What a crock.
I tried putting in TV Entertainment but there’s nothing for that:
## Business Directories First
Instead of angling for SEO by teaching you how to make your site work better, RankingCoach tells you how to get listed in business directories first. Instead of being about SEO, it’s about how to promote your business. It also gave me 30 tasks to do for helping my site rank better in local SEO, *even though* I marked my site as international.
## Missing the Mark
Now look, I know the site says its for online marketing, but the website says this:
> State of the art software for online marketing, SEO and social media
It can’t see my Twitter account, which is linked on the page. It thinks I should get backlinks from Tumblr. I happen to have a link back to the main site from the Tumblr.
There was some weird advice that was useful, like having a static front page, but it couldn’t detect half the things I’d already done, and it was totally unable to understand non traditional businesses.
Summary? Not for me.
**Categories:** How It Is
**Tags:** seo
---
### [WordCamp LGBT Tribe is Code](https://halfelf.org/2016/wordcamp-lgbt-tribe-code/)
**Published:** December 9, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We're here, we're queer, we like beer and WordPress.
**Content:**
Last Friday we had the first ever LGBT+allies party at a WordCamp. It wasn’t really the first time we all got together, but it was the first time we stated to the world that this was what we were doing.
How did it go?
We sold out our 150 tickets. We ran out of shirts. We had an open bar and music and food (real food) and pins and stickers and a million little things. It was loud and a great many more people than I thought would show up did show up. Matt was there too.
Tracy and I kvelled about it. We never expected that. We thought maybe a dozen, or fifty at most, would show up. We thought it would be mostly the queers, filtering in and out. We thought it would be more of a flow.
What we got was a packed house. We had around 200 people who came in, queer and straight, to be there for each other and to support and hug and be there. What we got was a moment where our two tribes were there. Our nerdy WordPress people and our fabulously gay people, together, combined to remind everyone that the best part of us is the *us*.
Community is what makes WordPress so amazing. I spoke about that on Friday as well, that individually we are not our products, our code, but together we are 27% of the Internet. Individually, we are not just gay, straight, queer, trans, or ace. Together, we are the LGBT+ tribe. Together we are the queers of WordPress. We are a huge slice of WordPress and we are not alone.
I like to joke that WordPress makes queries for a reason, that WordPress is queer. And it really is. The last four years WordPress has gone from quietly supportive into publicly proud.
Thank you, everyone, who sponsored and came to the party last week. You stood up and reminded us that we are not alone. And as much as 2016 sucked, we have each other’s backs.
I don’t know how, but we will have to figure out how to do this next year at Nashville, because this was too amazing to do it as a one-off.
**Categories:** How It Is
**Tags:** community, essay, wordpress
---
### [WordCamp US - LGBT+Allies Tribe Meetup](https://halfelf.org/2016/wordcamp-us-lgbtallies-tribe-meetup/)
**Published:** November 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We're inviting everyone to come hang out with diverse WordPressers at Philly's most welcoming gay bar.
**Content:**
Thanks to the undying energy of Tracy Levesque and the dollars from many donators (including DreamHost), there will be an LGBT+Allies meetup on Friday night at WordCamp US. Yes, NEXT Friday. So if you don’t have plans, or if you just want some big gay friendly hang time, we’re inviting **everyone** to come hang out with diverse WordPressers at Philly’s most welcoming gay bar.
You don’t have to be gay to come, but you have to be gay friendly.
> WordPress is welcoming to people of all cultures, beliefs, and sexualities. In celebration of our community, we decided to have an unofficial (non WordCamp sanctioned) meetup of the LGBT WordPressers and their straight allies. The celebration will be during WordCamp US at Stir Lounge, Philly’s most welcoming gay bar.
>
> We’ll have most of the place to ourselves with delicious food from The Khyber Pass Pub and an open bar.
>
> This event is made possible by our generous sponsors!
>
> [YIKES, Inc.](https://yikesinc.com/) • [DreamHost](https://www.dreamhost.com/) • [WPEngine](https://wpengine.com/) • [rtCamp](https://rtcamp.com/) • [Cornershop Creative](https://cornershopcreative.com/) • [Automattic](https://automattic.com) • [1SEO.com](https://1SEO.com)
>
> Bring your rainbow pins and your smiles.
Personally, I think now, more than ever, it’s important to know where your tribe is and that we’ve got your back.
You can get a ticket (for a whopping $0) at [lgbtwp.ticketleap.com](https://lgbtwp.ticketleap.com/lgbtallies-meetup-during-wcus/)
[](https://lgbtwp.ticketleap.com/lgbtallies-meetup-during-wcus/)
**Categories:** How It Is
**Tags:** essay, event, freedom, wordcamp
---
### [Yoast Custom Meta with CPTs](https://halfelf.org/2016/yoast-custom-meta-cpts/)
**Published:** November 30, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making for better SEO without having to think, just by using some elbow grease.
**Content:**
Remember Monday when I was [learning about how I was ignorant of SEO from OnPage](https://halfelf.org/2016/onpage-fleek/)?
Right so here were the odd keyword notes it told me I needed to take care of and I had no idea what was going on. I mean, I looked at this and stared:
- Add the keyword `kima greggs` in the meta title
- Add the keyword `kima greggs` in the meta description
- Add the keyword `kima greggs` to the content of your page
- Add the keyword `kima greggs` in the headlines (`` to ``)
- Add images and include the keyword `kima greggs` in the image’s ALT tag
Then I did what every intelligent person does when faced with an unknown to-do. I read directions.
> The title tag defines the title and is displayed as the page name on the browser tab. The title is very important for search results. It is the heading used to display the search result and is crucial for the ranking.
Now I actually knew, from having gone through every single tab in Yoast SEO, that titles and metas are handled from the plugin (Yoast > Titles & Meta > Post Types) and, by default, they’re set to be this: `%%title%% %%page%% %%sep%% %%sitename%%`
Which translates to: “Pagetitle Number — Sitename”
Or in the case of Kima, it’s “Kima Greggs — LezWatchTV” (since I never have any numbered pages for those).
Cool, right? So it was there. Done. I also knew that the name was in the headlines. It *wasn’t* (and isn’t) in the content of the page, but I’ll accept that SEO hit since contextually it doesn’t work for what I’m writing. Similarly the image thing I handled by having the one image uploaded to the custom post type be the character photo with an alt tag and title of the character name.
You see how I’m cheating.
That left me with the meta description and a new question. You see, what I wanted the description to be would be “Kima Greggs, character on the following TV shows: \[list of shows\]” and what I *didn’t* want to do was manually type that for 1000 characters. Who would, right? Again, I knew Yoast had a way to customize that!
You can see in the above screenshot I already changed the title to remove `%%page%%` since I know the pages will never be paginated. But the “Meta description template” I needed to address. First is the easy part. I want to document that the character is on a TV show. Fine: `%%title%% is a character on a TV show` and for TV shows, I could do `%%title%% is a TV show` and that worked.
Of course, I wanted to add what stations a TV show was on, which meant I needed to use `%%ct_%%` which lists the post’s custom taxonomies, comma separated. Except it didn’t seem to pick up things for my custom post types. Turns out [this is a bug](https://github.com/Yoast/wordpress-seo/issues/3364).
When I added this: `%%title%% is a TV Show on %%ct_lez_tags%% %%sep%% %%excerpt_only%%`
It displayed this: ``
That was the easy stuff. When I got to characters, it became a lot messier because of how data was stored. To do the basics I looked at what my custom fields were and came up with this:
`%%title%% is a %%ct_lez_sexuality%% %%cf_lezchars_type%% character played by %%cf_lezchars_actor%% on %%cf_lezchars_show%% %%sep%% %%excerpt%%`
Now that *should* have turned into “Jane is a Lesbian guest character played by Anonymous on Fake Show…” but what actually happened was “Jane is a Lesbian guest character played by Array on Array…”
I knew why. Those two values are arrays. Which meant I had to come up with some new code.
What this does is creates a *new* template variable called `%%actors%%` and that lists the actors with their names separated by commas (yes, some people have multiple actors, have you even heard of US soaps?). The one for shows is more complicated since it’s a post type referencing another post type (shows *and* characters are post types), but it’s the same general concept.
In the end I went with this: `%%title%% is a %%ct_lez_gender%% %%ct_lez_sexuality%% %%cf_lezchars_type%% character played by %%actors%% on %%shows%% %%sep%% Clichés: %%ct_lez_cliches%%`
It crams a lot of information into a small place, but it’s also all the important stuff.
**Categories:** How To
**Tags:** coding, development, seo
---
### [OpenGraph Images and Taxonomies](https://halfelf.org/2016/opengraph-images-taxonomies/)
**Published:** December 7, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a custom open graph image for a taxonomy is harder than it looks.
**Content:**
As I worked my way through optimizing the SEO for my Dead Lesbians, I hit a recommendation that I found difficult to handle. It was presented simply. Add an open graph image to the page.
The problem was the page was a category page (a custom taxonomy).
## Easy: Yoast’s OG Image
The easiest solution if you’re using Yoast SEO is just to make a custom image and upload it. Go to the taxonomy page, edit it, go to the Yoast section, click on the sharing icon, and you’ll see what needs to be added.
If you want to automatically handle the open graph image with Yoast SEO, it’s filterable.
This means if you have a specific image for a category if the image doesn’t have a post thumbnail, you could do something like this:
That’s really bad code, by the way. There are smarter ways than hard coding, especially since you can do some pretty nice stuff with [primary categories](https://github.com/Yoast/wordpress-seo/issues/4038#issuecomment-242202543) in Yoast SEO. I would probably have it grab the primary category for the post, force the image, check to make sure the image exists, and have a fallback (just in case someone else added a new category).
The problem is that the filter doesn’t work on categories and taxonomies because they don’t have the filter set. Posts and pages are fine. Not categories.
## Easy: Adding via wp\_head
Adding in an open graph image via the `wp_head` action is similarly possible.
This is extendable and you can customize it to be as simple as my example or as complex as pulling a specific image per category or featured image, depending on your theme.
## Not Easy: Reality
Besides the fact that I can’t use Yoast’s filter for categories, I had a bigger problem. The way I designed my theme, most of my taxonomies had a custom image picked. The images are all SVGs. And you know what doesn’t work on OG images? Yeah, SVGs. Good news was that I had a copy of all the images as a PNG as well, so I was able to use the second method to create default images using the PNG.
More bad news? I didn’t actually know how to grab the taxonomy ID. While WordPress has a handy function [`is_tax()`](https://developer.wordpress.org/reference/functions/is_tax/), I couldn’t use a global like `$post` to grab a `$tax->ID`. Thankfully I could use `get_queried_object_id()` to set my term ID like this:
Obviously I know where I’m storing the images. You’ll want to change that for yourself. I went with a fallback image of “square” in case there wasn’t one available, just because I hate having nothing show. Also here I only wanted the custom taxonomies to have this image, not the regular categories and tags.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Custom Meta, Keywords, and Taxonomies](https://halfelf.org/2016/custom-meta-keywords-taxonomies/)
**Published:** December 5, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using focus keywords to streamline a relatively random page.
**Content:**
As I continue using OnPage, I was able to make some pretty fast gains. All the work I did with [Yoast and CPTs](https://halfelf.org/2016/yoast-custom-meta-cpts/) immediately saw me picking up higher rankings for some of my keywords. That meant I had successfully optimized the pages for shows and characters.
The hard work happened next. See one of the terms I wanted to rank for was “dead lesbians” and if you look at that right now, we’re not in sight. We own the domain `deadlesbians.com` which sends you to `https://lezwatchtv.com/cliches/dead/` but how do we amp that up?
I don’t want to have to customize every single taxonomy and, initially, I had the default titles set: `%%term_title%% Archives %%page%% %%sep%% %%sitename%%`
This translated into “Dead Archives – LezWatchTV” and that’s pretty good but it could be better. Since I’m talking about character clichés here (characters have clichés and shows have tropes you see), the title could be better as “Cliché Archive: Dead Queers” and that takes two changes. First I rename the taxonomy to “Dead Queers” and second I changed my default titles to be prettier. But that made me think of a couple things.
If you look at the above screenshot, it shows that I only have an ‘orange’ for a good title. After some fiddling, I determined that `Character Cliché Archives for %%term_title%% %%page%% %%sep%% %%sitename%%` gave me green results, though not a full bar. The reason here is that the length of what you’re using matters. Meta descriptions should be around 160 characters ([Yoast’s crew have seen 135-250](https://yoast.com/meta-descriptions/)) but meta `titles` are a little odder.
Before I get too far into that, I have to explain that there is one annoying thing about keywords when it comes to taxonomies. If you have the premium version of Yoast SEO, then you can pick multiple keywords for posts and pages. You **can’t** do it for taxonomies. That means even though my page is named “Dead Queers” I was going to have to manually give it a custom keyword and handcraft the title.
I do *not* recommend this in the long run for everything. And in fact, this is the only place I plan on doing this. I manually made the keyword ‘dead lesbians’ and worked from there. Doing that gave me a different sort of direction, since I got the following message:
> The SEO title contains the focus keyword, but it does not appear at the beginning; try and move it to the beginning.
Of course. That made perfect sense and I changed the title to start like this: `%%term_title%% Character Cliché Archives`
Once I had done all that, I went back and changed the focus keyword to “The big list of dead lesbians.” Now this is *not* a keyword. But it lets me do this: `%%focuskw%% A collection of all queer female TV show characters who have fallen prey to the cliché of %%term_title%%.`
Originally I wanted to make a custom term meta and variable (like I made for `%%actors%%` and `%%shows%%`) but I couldn’t get it to output. Since the focus keyword is there to help me optimize things, I don’t see anything wrong with this but …
> Warning: the variable `%%focuskw%%` cannot be used in this template. See the help center for more info.
That’s what happened when I tried to set that on the Taxonomies page. And I can see why. It’s frustrating though, since I really do want it just not to show if I don’t have it set.
In the end, I had to make that page the one with a super custom meta.
> The big list of dead lesbians. A collection of all queer female TV show characters who have fallen prey to the cliché of `%%term_title%%`.
We’ll just have to see how that goes. I would much rather make it as flexible as possible, and lot of this would be easier if I was using a specific page and not a custom taxonomy listing. But there are still some limitations when you’re working differently.
**Categories:** How To
**Tags:** plugins, wordpress
---
### [OnPage is On Fleek](https://halfelf.org/2016/onpage-fleek/)
**Published:** November 28, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Keywords and content are just the tip of the iceberg.
**Content:**
I’ve gotten back into using [Yoast SEO](https://wordpress.org/plugins/wordpress-seo/) (I like to say, I don’t always use SEO plugins, but when I do I use Yoast), and I noticed they’d added integration with [OnPage.org](https://onpage.org). Of course I did remember this being added to the plugin in general, having chatted about it with Yoast and his crew, but at the time it really didn’t seem like anything I needed.
Flash forward, and it’s 2016 and while I certainly *can* do all the things it takes to set up a site and make it’s SEO sing, a person can always learn more. So I set up an OnPage account and went to town.
Actually I stared at it.
You know how people say the WordPress dashboard can be overwhelming when you first look at it? Yeah, so was this. There were a lot of options. A *lot* of options. And a lot were sales things. Then there were a hundred pages of ‘metrics’ which I confess I didn’t understand what it fully meant. While I was still capable of churning out page after page of valuable content, and having context be my SEO queen, some of the nuances of what made pages ‘good’ to search engines was clearly being lost to me.
Like I said, a person can always learn more, so after feeling dejected at myself, I decided to sit and study up. How was I going to master all this and understand how to make my site better and the content more search engine friendly? I knew once I got people to the site, the content would be useful, but getting them there was the nature of advertising (something difficult to target when no one aims ads for lesbians) and word of mouth.
Thankfully OnPage has a tool Navigator, and once I started using it everything became clear. It walked me through the basics of setting up my site. It detected I used WordPress, it directed me to install an SEO plugin (Yoast of course) and then gave me step by step tasks to get those simple, basic wins.
The first 18 tasks were things I’d already done, like hooking up Google Analytics, signing up for Google and Bing Webmasters, submitting my sitemaps, etc etc.
And then I hit the section about Keyword Pages.
That confused me since I knew the page that the keyword “kima greggs” should point to is `https://lezwatchtv.com/characters/kima-greggs/` (pretty obvious when you see it, right?). I clicked on the link to complete the task and was surprised.
The bottom part of the page was a list of pages on my site, and none of them was the right URL. Oh dear. I entered it in manually and hit save. That presented me with new tasks:
- Add the keyword `kima greggs` in the meta title
- Add the keyword `kima greggs` in the meta description
- Add the keyword `kima greggs` to the content of your page
- Add the keyword `kima greggs` in the headlines (`` to ``)
And then there were a lot more which were pretty easy but those… Well those led me down a path that will be continued later.
The lesson to take here is that if you’re trying to figure out how to optimize SEO past the easy basics, OnPage can teach you about how you’re doing it wrong. It can teach you how to do it right. And eventually you can optimize things with the conscious understanding of why the code does what it does.
**Categories:** How It Works
**Tags:** seo
---
### [Managing User Permissions](https://halfelf.org/2016/managing-user-permissions/)
**Published:** November 23, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Managing users on your site can be a big mystery, but it doesn't have to be.
**Content:**
When it’s just you writing on your site, WordPress user management is incredibly basic. You have one user, you, and you do all the things. If you’re a little neurotic, you have one user who is an editor to write all your posts, and one who is an admin to do the admin things, and you religiously log in as the editor.
But when you have a site with multiple authors, how do you handle them and their permissions? And what do you do when they leave?
## Lowest Common Denominator
The most important thing to remember with any CMS or tool is to give users the *lowest* possible permissions. The people who are admins can do *anything* so they should be restricted to just the people whom you’ve discussed responsible administration, how to handle things, and who the ultimate top technical boss is. The [Roles and Capabilities](https://codex.wordpress.org/Roles_and_Capabilities) of WordPress can be very daunting, but the summary is very important:
- Super Admin – somebody with access to the site network administration features and all other features
- Administrator – somebody who has access to all the administration features within a single site.
- Editor – somebody who can publish and manage posts including the posts of other users.
- Author – somebody who can publish and manage their own posts.
- Contributor – somebody who can write and manage their own posts but *cannot* publish them.
- Subscriber – somebody who can only manage their profile.
## The Administrative
I strongly recommend limiting your Admin accounts to less than 5. *Most* people don’t need to be an admin. In fact, the only annoying thing an admin is needed for would be adding new users. Everything else that they can do is, properly, administrative and requires some technical knowhow. You don’t want your copy editor updating a plugin that breaks a site, after all.
Editors are like your moderators. They can approve posts, edit them, handle comments, and more. They *cannot* install and upgrade code, however, which is good. Admins (should) have server access, after all, not Editors. If you think of it that way, you may go less crazy.
## The Writers
Your post writers come in two flavors: Authors and Contributors.
The difference here is minimal but important. A Contributor *cannot* publish posts, and more importantly they cannot *edit* posts once published. That makes Contributor a good role for guest posters, or irregulars. If you need to review and approve every post before it’s live, this is the role for your writers. On the other hand, an Author should be someone you trust won’t go back and make naughty changes to posts after they’re approved and published.
The biggest ‘flaw’ in Contributors is that they cannot upload files. This can be annoying, I know. If you need more robust tools for your writers, services like [CoSchedule](http://coschedule.com) and plugins like [Edit Flow](https://wordpress.org/plugins/edit-flow/) may be up your alley.
## The Departed
I don’t mean dead. What happens when your writer quits? You don’t want to delete their posts (probably) but you do want to balance their access with your security. The simplest solution is to make them a Subscriber. This means they can just read and leave comments on your site and nothing more. Their posts will still be attributed to them, but they cannot be edited.
Of course, it the departure is less than amicable, another solution is to make them a Subscriber, but then change their email and password. If you use Gmail or GSuites, a super quick email fix is to create an alias like `blogadmin+username@gmail.com` for your users. For example, if the removed user’s login ID is `johnsmith` then I would create the email `blogmaster+johnsmith@example.com` and use that to own the ID. This prevents `johnsmith` from being able to log in and change his password again.
For cPanel you’ll need to use forwarders and for Plesk you need aliases. Both require setting them up on the server side. Sorry.
## Custom User Roles
I say this with a heavy heart. *Most* sites need to stay away from this. The basic five roles will suffice for most situations, and you should really try them for a while before dismissing. Adding in new users roles in WordPress can end with no one having permission to do anything. If you use custom roles, please be *very* careful and make sure you know how to restore basic user permissions in a pinch.
**Categories:** How To
**Tags:** management, permissions, wordpress
---
### [Chronic Infections: Blacklisted](https://halfelf.org/2016/chronic-infections-blacklisted/)
**Published:** November 16, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Google will be blacklisting repeatedly infected websites. This will be interesting.
**Content:**
If you use Chrome, you may be used to those warnings about how a site is dangerous (or hacked) and maybe you shouldn’t visit it. If that happened to your site, you’d get an email if you use Google Webmasters (which I recommend you do), and then after you clean it up you can ask for a rescan. Or if you don’t, Google will rescan the site after a while and if it’s clean, carry on.
That ends.
Google found out something we’ve all known for a while, and that’s people can be evil and malicious. And what they’ve done is created a ‘repeat offenders’ blacklist, for sites that clean up only to allow themselves to be reinfected. As they say, [“Sites that repeatedly switch between compliant and noncompliant behavior within a short window of time will be classified as Repeat Offenders.”](https://support.google.com/webmasters/answer/7104997).
This is dangerous for users when a hack is outside their control.
The number one cause of reinfections is not plugging the hole. In the case of things like WordPress, it’s down to upgrading everything, deleting anything with a known hack or backdoor, and locking down users. Hacks like Pharma, where the database becomes vulnerable and repeatedly re-infects a site, are thankfully rare for WordPress, but the same cannot be said of other CMS applications.
And far worse than that is this. By which I mean what happens when your *ad network* is the cause of a hack?
Recently, a friend of mine was hacked and got upset that his webhost’s scan of his site said it was clean, while Google did not. In looking at the site, I pointed out the hack was from his *ads* and not the files on the webhost. His webhost’s scanner didn’t hook into Google’s Safe Browsing service so of *course* it didn’t come up. He was pissed off about the host missing it, but once I explained why, he realized the magnitude of the issue.
By adding an ad service to your site, you’re effectively trusting their behavior. And some ads are pretty scummy. While Google Adsense (and others) are usually pretty quick to kick-ban those idiots, the damage will be pretty hardcode. It takes but a small moment for a high-traffic site to serve up enough malware to make that attacker’s plan worthwhile. And worse, if the same kind of person get in again and again (which happens) and your site is infected multiple times, you will end of on the shit-list.
Thats enough FUD on it. Let’s talk about mitigations.
We’re all going to need to get better at figuring out where the malware is from. All of us. Security companies are going to lose money if they can’t stop repeat attacks, and since even the best firewall can’t stop shitty ads, all our scanner tools are going to need to be better about detecting what the cause is and where it’s from. This is going to be hard, since the ad may be gone by the time the site scan runs.
Google will need to tell us what they know a lot better. I don’t know if they will, but they’ll need to figure something out. At the same time, I get why they may not want to. It tips the hand to tell malicious people exactly how you caught on to them, but at the same time telling people “Your ads are serving up malware” would be impactful and hopefully not too harmful. I’m on the fence there.
Finally, we *all* know ads on the internet are shit. We’re all barely making money off them. So if you get infected by an ad vendor twice, it’s time to turn those ads off and look for something new. If that ad vendor is Google, open a ticket with them and provide evidence that they’re hurting your SEO and could cause you to get on that repeat offender list.
Yes, this is making a hard decision, but it’s one you must make. If you’re being betrayed by your ads, you need to quit them.
**Categories:** How It Works
**Tags:** administration, advertising, security
---
### [Clear Communication](https://halfelf.org/2016/clear-communication/)
**Published:** November 14, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There will always be room for debate.
**Content:**
“Your guidelines should be so clear as to not permit so much wriggle room,” he said.
I started at my screen for a moment, feeling my neck heat up with the sheer arrogance of his implication. Besides the fact that I did spend quite a bit of time trying to make them as transparent and clear as possible, it’s a known impossibility.
Anyone who’s ever written anything knows that it will always be interpreted by someone in an unintended way. Have a look at the US Constitution, which we’re still arguing about to this day. It’s categorically impossible to write anything in a way that will be perfectly understood by everyone who reads it, past, present, or future.
Let’s step back though and think about what the post of such a statement might be.
Everything we write for the purposes of education should be as clear as possible, in order to minimize confusion. We can all agree on that. Guidelines, documentation, how-tos, and the like are all for education. When you write a story, a novel for example, you don’t need to write for clarity but for a different purpose. I won’t get into that today.
To that end, his statement was correct. We *should* write our guidelines not to permit wriggle room.
However when we consider what the guidelines were, and please note they are indeed guidelines and rules, we hit a different situation. Guidelines are meant to direct people into doing what is expected of them. Some can be as clear as “Don’t steal” but others have to be a little more broad like “Don’t hurt people intentionally.” That’s a very big statement, and while it’s certainly a good guideline for any group, enforcing it without specific examples is always going to be problematic.
The difference between rules and guidelines is that rules can be clear, while guidelines must allow for interpretation. And even with rules, it’s categorically impossible to write them in a way that will never ever be misconstrued.
So what do we do?
We write things as clearly as possible. We state, upfront, that the guidelines have an intended purpose and what that is. We remind people that the guidelines cannot cover each and every possible permutation of events. We admit that some of these will be up to the discretion of the people enforcing them. We write a disclaimer that we are human and we are mortal.
We do our best. And if someone says “These could be better” we ask “How? Please help.”
I can tell you from experience, less than 1% of people who complain about your guidelines will help, though.
*Comments on this post have been disabled.*
**Categories:** How It Is
**Tags:** documentation, essay, writing
---
### [Revealing Slides](https://halfelf.org/2016/revealing-slides/)
**Published:** November 7, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little bit of insight in how I customize my slides.
**Content:**
I’ve struggled with my slides for years. At first, like a lot of people, I made them showy and crammed with content. Then I had a serendipitous meeting with Laura Legendary and talked to her about the [accessibility of slides](https://halfelf.org/2014/your-slides-suck/). Which was, in short, mine sucked. Yours probably do to.
Over the next 18 months, I’ve transitioned from amusing images and gobs of data to a header with images, to a header and subheader, and maybe a bullet list when needed. The amount of text on the slides are minimal. They’re not there to teach you code, because that’s a futile attempt in the first place. Learning to code from slides was a bad idea in college, and in a 30 minute session with 15 for questions, it’s worse.
Remember college? Class was where you talked about the theory and the principle and the ideas. You got the history and the concepts and (in math class) the formulas. Sometimes you were told to look in your book because the formula was huge. Then you went to the labs and you talked about it again and did ‘experiments’ to turn the theory into reality.
Perhaps instead of contributor day we should have lab day. Day one is sitting in presentations. Day two is learning how to apply what we learned, with the presenters as the instructors. Learned about CSS and flex box? Okay, let’s all build a flex box together!
But we don’t. We try to cram everything into a session, to teach people the theory and the reasons why you’d use responsive CSS. And we try to give people examples and code and links. And we hope we inspire them enough to learn more and try it on their own.
A year ago, I stopped putting *practical* code examples in my slides. I still do code, now and then, but I limit it as much as I can. It’ll always be hard for someone to read, it’ll always be hard for someone to understand. And I’m a very haptic learner, I learn by doing and not by reading, so I need that Hello World example to read through and try myself.
Once I decided to do that, I slowly started stepping back my images in slides. If I need one for explanatory purposes, I’ll use it, but otherwise I keep it to plain text. And in keeping to plain text, it allowed me to reconsider my slide options.
[I still use Reveal.js](https://halfelf.org/2014/all-is-revealed/) and I love it. [Reveal.js](http://lab.hakim.se/reveal-js/) is clean and direct to use but sometimes it’s a little plain. It’s a little weird to add a header and a footer, and they can get cluttered and annoying and I sat down to decide what I wanted to see in my slides.
1\) The emphasis is on the content
2\) The ‘credit’ to my company isn’t distracting
3\) A handy way for people to see the link to the slides
The third one makes more sense when you remember that I use this to display my slides live. If I tell people to go to `helf.us/wcsea2016` and I want them to remember this halfway through the talk, I need a link. I also want the slides to be there for the blind to follow along. They can plug in their screen reader and hear the slides as I go through. In addition, I have the speaker notes already in my slides. Just for added fun.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/10/myslides.png)
If you look at my current slides, you’ll see I have a ribbon that looks like the GitHub fork ribbon on the upper right, and a button link to my company, DreamHost, on the lower left. This is done with CSS and an image. The image is the DH logo, but the rest… Well it gets done by this:
The ribbon is via [Fork me on GitHub CSS ribbon](https://github.com/simonwhitaker/github-fork-ribbon-css) by Simon Whitaker, and it’s a quick line of code. The powered by stuff is my own CSS:
I don’t always use it. I have a file called `/assets/css/dreamhost-powered.css` that I call for this. If I don’t want to use that and instead want to brand differently, I can use any other CSS file because it’s all just HTML.
**Categories:** How It Is
**Tags:** css, js, slides
---
### [Your Slides Suck](https://halfelf.org/2014/your-slides-suck/)
**Published:** January 13, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** And for the record, my slides suck too. They suck because they're not accessible.
**Content:**
At WordCamp Las Vegas, I had a watershed moment of privilege realization. I’ve had these before at WordCamps, like Portland where I realized how much I rely on my phone for the Internet, and what that actually means to other people (thank you [Eric Mann](http://eamann.com/) for that one, you should post those slides!). This time it was as simple as AccessibleJoe asking my new friend, Rebecca, if she could help him. I glanced over and saw that Joe was sitting with Laura Legendary.
Laura’s blind.
In that instant, the very second I saw her cane, my mind wiped out every single thought I had and focused on this. “Holy crap, my slides are worthless. Not just on the screen today, but when I give the URL out, because they’re all IMAGES.”
See, while I use SEO slides, my slides are a PDF imported from PowerPoint, which makes them a bit honking waste for her. No text. No tooltips. The deaf similarly were left out until they read the text posts I tend to make as a follow up to my slides, but since my slides are a counterpoint, or emphasis, to my speaking, I really greatly on what I say and how I say it. That means my slides are *absolutely worthless* to anyone who is differently abled.
When Rebecca needed to go away before Joe got back, I offered to take over, introduced myself, and said “I’m sorry, my presentation slides are worthless to you.” Laura was kind enough to explain to me the situation, demonstrate how she used her phone (before her own presentation where she showed everyone exactly how much running a website sucks. It blew my mind when she said there was only ONE theme she could find that was accessible on the front and back end so she, a 100% blind person, could manage her site all herself. And then she only had one plugin for an estore that worked.
 One.
Single.
Theme.
If that doesn’t slap you in the face and make you think you’re doing something wrong with your programing, allow me to do this for you.
*We suck.* We are inconsiderate. We are selfish. We are ignorant. We have no idea how hard the web is for people. Even though I do spend a lot of time working on my site to make it easier to read for the visually impaired (that is people who hate small fonts), I have no idea how crap my site is for the actual blind.
Want to know how bad it is? Close your eyes and try to use your site. Go on, make a post. If you’re on a Mac, there’s a tool built in for this. I played with it the other night and was galled at how hard it was to get around the customizations of a theme. To write code, I rather expected to be hard, but the theme settings (not the customizer built in, the settings from Genesis) were not very easy, even though I knew what I was looking for.
So my pledge to this starts here. I’ll be making **all** my slides on SEO slides from now on, with long descriptions and alt text for everything, to make my slides more accessible. I will continue to speak clearly concisely, and more over, I will print up my slides notes in advance so I have them right there without having to use PowerPoint.
I love PowerPoint’s ability to have speaker notes, but it relying on them means I made my efforts fail for some people, then it’s time to do something new and different. I’m still going to keep my slides with few words on it, but with the SEO Slides features, I’ll be able to show the ‘notes’ (I hope, right guys?) so the deaf can read and follow along. It’s not perfect, but the only other idea would be to learn sign language, or get my wife’s up to the level where she can do that for me.
Challenge accepted.
**Categories:** How It Is
**Tags:** design, essay, slides
---
### [SEO Slides Is A Pie](https://halfelf.org/2013/seo-slides-pie/)
**Published:** November 15, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** SEO Slides. Not entirely what I need, and possibly too expensive for what I'll use it for. But still a really good plugin and service.
**Content:**
*This review is of the FREE version during the beta release!*
I wanted to love you. All my friends rave about you and tease me for using PowerPoint. “Don’t you want to own your data!” they harangue me. And it’s true, I do! So the idea of having my slides on my server, embedable into posts? Hey that sounds great!
The cake, is, alas, a pie.
It’s not really a ‘lie’, but there are points that I just don’t love like they do. This is not to say I don’t like it, in fact I am happily using it, and I’m going to keep using it, and for a lot of people, this will be perfect to make slides. It’s not (quite) perfect for me, but that’s because of my current usage. I can see the future of slides and WordPress, and it really is going to be SEO Slides for many (if not all) of us.
Before I get deep into this, you have to register to import PDFs. This is perfectly fair and understandable. They’re converting a PDF into images on *their server* and importing. Okay, I’m jiggy with that. I could conceivably make the images myself, but this is fine. The problem, or rather the part I don’t like, is that they really all just images. And they’re named things like `c6ddd0b82e5a45c70fb2718869cad3e1-7`. So once I import, I have to go back and change all the titles and (if I want) copy in my notes.
So why not just write it in SEO Slides? Because of Presenter View.
Say what you want about PowerPoint, but the fact that I get a presenter view, filled with my notes, is actually very important to me. I make notes, as you may have noticed reading my post from WordCamp Portland, 2013. Sometimes they’re *exactly* what I’m going to say, sometimes they’re slightly different bullet points than my slide has. Sometimes I have NO bullet points on the slide, so they’re all in the text. I really try to *use* that aspect of Power Point. I don’t really script my talks to 100% detail, but I treat those notes as flashcards to keep me on topic and on pace. They even will have time notations.
As a presenter, keeping to my time limit and topic is important to me. Since I do give similar talks a lot (example: I used ‘A Tale of Two Servers’ to talk about Managed WP hosting in Boston, but I also have a Degrassi themed one called ‘Whatever it Takes’), the notes are often the same, but the pacing will be different. I try to cater to my audience. For now, this is the absolute number one reason I’m sad-panda about the plugin. But if that’s not your thing? You have no worries!
The important factor to me is embed-ability. I have to be able to embed my content on a page. I use that page with a custom shortlink and put it in my slidedeck. Now with SEO Slides, I can just use the page, but it doesn’t let me put text or notes around it, so I’ll still want this to be embedded. Problem? Embedding with SEO Slides is not as obvious as you’d think. I read the [Embedding FAQ](https://seoslides.com/faq/#embedding) and this just did not happen for me:
> When you “Publish” your presentation, you will be provided a link to “Use presentation in a new post.” This option will embed your presentation directly into a new blog post.
I thought I was doing something wrong, but finally I realized the ONLY way to get this “Use in presentation” link was to save the post once published. Gah. Why not a nice button? Still, this was not insurmountable, and in the end, I really did like the look of the embed way better than the Slideshare one.
Except … I’m not really thrilled with having to upload all my media. It makes me want to make a dedicated SEO Slides site on my network so I can isolate content. Part of the issue is with how I like to write my slides. I know for a WordCamp where I speak for 45 minutes, in order to leave room for questions, I should have no more than 30 slides, and that’s only if I’m doing roughly a slide a minute! I try to keep it closer to 20-25 honestly. A 45 minute talk should have at least 5 minutes for questions. I like to keep the text on my slides minimal, so I have a lot more to actually talk about.
I hate slides that are pretty much what the person reads off… thanks. And that’s really a totally personal thing, but it means my slides are really image heavy. So that adds a lot of weight to a site. It’s not a plus or minus, just something I have to consider.
The other problem with embeds is the embed CODE. You get a lot of parameters but the ones that jump out at me is this:
It looks cool, and I can change the site\_src and site\_title…. What I can’t do is change the output. I mean, I can’t remove that ‘source and title’ at all. I can’t change the default so it’s always ‘halfelf.org’ instead of my placeholder site. And worse? I can’t turn it OFF so other people can’t embed my stuff. I mean, what if I don’t want them to embed my warez? This means if someone looks at my slides, clicks the slick plus-sign, they get the code for embedding *and* they get my slides.ipstenu.org link. Now if you go there, you get redirected, but that’s not the point! Why have this customizable if I can’t… customize it? There are no settings options save entering my API key and allowing for tracking (which I turned off). Why not have an option for customizing output!
A final minor note with SEO Slides, the title is also wonky. This may be because I’m running Trunk but I get this weird `title` thing in my … well … title:
Not really super happy about that. I did report it though. Also I reported that I ‘ran out’ of uploads of PDFs. In the free version, you get three free PDF conversions. I did it once. I tried a second time and it said “Upload Error: Your subscription has exhausted the use of this service.” So I filed tickets for both of those on November 14th.
On the good side? These guys are WAY responsive to my enquiry about something (which they changed promptly), and helpful when I said “DaFUQ?” about embedding.
I’m not sure if I want to use it going on. I may end up using it for embedding, though, but it won’t be a replacement for PowerPoint for me any time soon. Now I just have to decide if I want to pony up the $200 a year just to convert my PDFs. There are enough ‘little’ things missing that frustrate me, like no quick-edit if you just want to change titles, no categories, no tags, no main ‘slides’ page (that is – the custom post type has no archive page).
Of note! Since this initial review was written, but before it was posted, SEO Slides upgraded me, so I’ll have to come back and re-review once I bang on the Premium Version: Is it worth it? Since, clearly, the brunt of why I’m ‘meh’ about this is the presenter mode, I may fall in love with Premium! The software’s only been out for two months at the time I wrote this, there’s a LOT of room for growth and I’m probably just being really really impatient.
As this moves from Beta to Live, I expect a lot of great things from SEO Slides. Do I love them? Not yet. But I like them a hell of a lot more than I like PowerPoint, with that sole exception. The presenter view. God help ’em, no idea how you’d tackle that! Can’t wait to see how they do it.
**Categories:** How It Is
**Tags:** plugins, review, slides, wordpress
---
### [Hot Hands And Playoffs](https://halfelf.org/2016/hot-hands-playoffs/)
**Published:** October 28, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** On math, probability, baseball, and the outlier Joe DiMaggio.
**Content:**
Today I’m wandering off topic into a world of baseball and statistics.
My family have been Cleveland Indians fans since they came to the United States and settled in the city. My grandmother was an accountant, my father a mathematician, and I a web developer who works on software used by 26% of the Internet. Give or take. I’m also a third (and probably final) generation Clevelander. Yes, I root for my home team.
October of 2016 marked the first time since 2007 that Cleveland was in the American League Championship Series (ALCS). In the intervening years, my family had all migrated to iPhones and iMessage, allowing us to converse in real time across two continents, two countries, four time-zones, and five cities.
My father, [the mathematician and risk analyst](https://woody.com), kept a close watch on Nate Silver’s FiveThirtyEight project, especially the [MLB Predictions](http://projects.fivethirtyeight.com/2016-mlb-predictions/), as Mr. Silver has been quite spot on for things for a while, understanding the implications of probability and chance.
On October 18th, FiveThirtyEight gave Cleveland a 53% chance of winning the ALCS game 4, a 94% chance of making the World Series, and a 38% chance of winning it all for the first time since 1948. The time Cleveland won before that? 1920. Not quite Cubs level of history, but it’s been a long enough time than my grandmother Taffy never got to see them win a third time (she was born July 7, 1920).
The game on the 17th was nothing short of incredible. The starting pitcher was yanked after 2 outs because his cut pinky was dripping blood. There are, you see, a bevy of incredible rules about what pitchers can and cannot wear. More than the normal player. And we’re talking about a sport than demands all players use a glove that has colors only within a PANTONE® color set lighter than the current 14-series. These guys are nuts. And one of the rules is no bandages on the pitchers’ hands.
> a pitcher’s person cannot include any unessential or distracting thing (including jewelry, adhesive tape, or a batting glove), especially on his arm, wrist, hand, or fingers.
Bauer’s 11 stitches in his pinky split and was incredibly nasty, so he was replaced. Cleveland used seven pitchers, pretty much their entire relief bullpen, to get through the game. My family began to argue the intelligence of the move. Instead of using the rookie Merritt to start game 4, possible win-it-all game, Manager Terry Francona decided to start his ‘ace,’ Kluber.
To understand this, you have to start with the odd fact that Cleveland is down three of their best pitchers to injuries. This is including Drone Boy Bauer. Such a situation is rare for the playoffs, if not unheard of. That means they are more reliant than ever on their bullpen, so using every single pitcher possible on Monday meant they would all be a little tired on Tuesday. And Kluber would be starting 3 days rest when a pitcher normally gets 4 or 5.
Clearly Francona was banking on the team *not* needing to use the bullpen much on Game 4, but why would he make that decision knowing that the odds of winning on Tuesday were insanely low. As my dad said:
> Winning 7 games straight is an outlier. They won 6 in a row twice, of course the 14 streak, 4 games three times. I’m betting they will lose the next two in Toronto.
Then he started emailing us all homework.
Before we get to the math, let’s look at the baseball logic. The reason you would play Bauer is that the odds are Cleveland will lose on the 18th, and a good manager would know that and bet on it, like my father. Teams winning 7 games in a row is crazy. It’s rare. It’s risky. By playing Kluber, an experienced pitcher, you solve two problems. First, Merritt is a rookie. Him losing will have a deep psychological impact on the young guy. Kluber can take a hit and keep going. Second, it means if Cleveland does win, Kluber will be well rested for the World Series. If Game 4 is lost, Merritt will pitch the safer Game 5.
The psychology of math is exactly why no one would discount the Cleveland Indians winning seven games in a row in the post season, however.
> \[…\] what Terry is seeing is momentum, the intangible. You gotta measure the odds with numbers, but making good decisions goes beyond the odds … beyond just the odds. Like CoCo’s diving catch.
This is where the homework comes into play. Nine papers about hot streaks later, I came to the conclusion I had always felt had to be true. There is no such thing as a winning streak. They are nothing more than standard deviations from the mean. Models of the math have told us that there is only one event in baseball that has happened outside of the frequency of said models. Everything, the longest runs of losses and wins, are exactly as they should be and happen as often as they ought.
Except for one: Joe DiMaggio. Joltin’ Joe’s 56–game hitting streak in 1941 doesn’t make any sense. As we read in [Streak of Streaks by Jay Gould](http://www.nybooks.com/articles/1988/08/18/the-streak-of-streaks/), in order to make it mathematically probably to have a run of 50 games with a hit, we should have had four batters with a lifetime average of .400, and 52 with .350 or higher over 1000 games. Instead, three players have achieved a batting average over .350 and not one has managed .400 lifetime.
You’re thinking “But Ty Cobb!” right now, and guess what? His lifetime is .367, followed by Hornsby at .358, and Shoeless Joe Jackson brings up the rear at .356 for his short career.
DiMaggio’s streak does not make sense.
Most MLB records we consider to be [unbreakable](https://en.wikipedia.org/wiki/List_of_Major_League_Baseball_records_considered_unbreakable) are only that way due to changes in the way the game is played. Pitchers no longer play complete games on the regular, nor do they start 60+ games a season. The weirdness of DiMaggio is that his numbers are off the charts for that year, and actually the entirety of MLB history.
[The Hot Hand: A New Approach to an Old “Fallacy”](http://www.sloansportsconference.com/content/the-hot-hand-a-new-approach-to-an-old-fallacy/). Notice the quotes? The theory behind the Sloan paper is that the Hot Hand (or streak) is a fallacy because we’ve always been working under bad assumptions. To whit:
> However, prior research hinges on the assumption that player shot selection is random, independent of player-perceived hot or coldness. Said differently, it assumes that players will take the same types of shots, with the same level of defensive coverage, regardless of whether they have just made or missed three shots in a row. We find this assumption difficult to believe – if players have been shooting well, it seems logical that they would begin to attempt more difficult shots and opposing defenses would begin to cover them more tightly. This would potentially counteract the Hot Hand effect.
To make this more obvious to the conversation at hand, basketball is not baseball and men are not potatoes. Baseball is a rarity in sports. The defense has control of the ball and, barring injury, everyone who plays will have an at-bat (designated hitter rules aside). Basketball has no promise that everyone who plays will have a chance to shoot a basket, or even touch a ball. Baseball hitting streaks come down to one person versus a hundred. The batter versus every pitcher they face. Provided they’re not walked, the batter remains in control of their destiny.
All of this is quite fanciful. There are hundreds of articles, like [Phil Birnbaum’s quest for evidence of the Hot Hand effect](http://blog.philbirnbaum.com/2013/07/is-there-evidence-for-hot-hand-effect.html) and [Tangotiger’s Sabremetric blog on the impact of the Zone on streaks](http://tangotiger.com/index.php/site/article/ensberg-and-tango-speak-on-being-locked-in). The best we can say is ‘Streaks exist, but generally they do so within the expected norm of percentages.’
None of this considers the psychological impact of a streak. The longer a streak goes on, the more stress and nerves are put on a player. At the same time, the more ease is given a player, as the expectation of winning becomes a short-term norm.
Per FiveThirtyEight, the Cleveland Indians had a 53% chance of winning Game 4 of the ALCS on October 18, 2016. The Epstein family gave it much less of a chance. We were right.
**Categories:** How It Is
**Tags:** baseball, math, stats
---
### [Torrenting Cache](https://halfelf.org/2016/torrenting-cache/)
**Published:** October 31, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Caching with torrents. It flows messily.
**Content:**
There’s a new cache in town, [CacheP2P](http://www.cachep2p.com/).
The basic concept is that you can use BitTorrent to seed your cache across the world, making it even faster for everyone. Setting it up is fairly simple. Configuring it is not. At least not in an automated fashion.
Traditional web browsing is a direct connection between user and server. Traditional caching is done by having the server (or a proxy of the server) create a static copy of the page and display that. In the case of WordPress and any other dynamic CMS, that works by taking the load off of PHP and MySQL having to generate a new page on every visit.
By using BitTorrent, this is changed so that you would instead be getting a cached copy not from a server but from someone else’s computer. If you and I were on the same network, I might get the page from you instead of the server. That sounds really weird, doesn’t it? Via two javascript files combine to signal the torrent’s API, and a third file uses the unique page hash to determine freshness. Keep your eye on that last part, it’s what makes the idea of a plugin for WordPress such a pain.
To get the content for that last file, you have to look at your page in dev tools to grab the security hash:
On Safari it looks like this:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/10/hash-exampler.png)
Now if it works, and you can see an example on the [cachep2p.com domain](http://cachep2p.com), it would show results similar to this:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/10/Screen-Shot-2016-10-20-at-10.51.35-AM.png)
This did not actually work for me on Safari. At all. It was fine on Chrome, but Safari never served up the cache which is odd.
My first concern was about cache contamination. That is, if someone downloads the page and messes with it, could they have my site show content I didn’t want it to show? By using hashes, this is minimized. I have a file that defines the valid hashes, and if the copy doesn’t match, it downloads my content, not the bad one.
However the greater concern is that of accidentally releasing content I shouldn’t. Take this example. I accidentally publish something I shouldn’t, like the plan to tear down the Berlin Wall. Without caching, I can quickly redact it and if Google didn’t scrape my page, it’s like it never happened. With caching (and Google…) the bad content (my destruction plans) remain out there unless I visit the cache provider and flush things. If you’ve ever used a 3rd party proxy like Cloudflare to cache your content, this is the situation when you update your CSS files and have to go force them to refresh.
With the BitTorrent situation this becomes worse, because the cache is in the hands of the masses. If you were a politician and I your rival, I would have someone constantly visiting your site and saving the cache. Then I could go through it and look for accidental leaks.
Now of course this could happen today. I could set up a simple content scraper and have it ping your site every so often to save the data. You could, in turn, block my IP, and I would retaliate by setting up a Tor connection to do it from obfuscated IPs. The difference here is that you’re actually *encouraging* me to cache your data with this plugin.
An additional concern is the dynamic aspect of WordPress. The only way to grab the hash right now is to view the page. That hash will change when I save a page. In fact, it might change on every page load, in some situations. I didn’t get too far into testing at this point, since I realized that in order for this to work I would have to load a page, grab a hash, edit a file, save that file up on the server, and then it would cache…
That would be terrible on WordPress. For this to work on any large site, the generation of that hash file would have to be automated. No matter if the site is dynamic or not, to make people manually do that is preposterous. A vaguely WordPress solution I dreamed up was to somehow catch the cache has as the page is saved, store it in a post-meta value, and then use WordPress to generate a ‘fake’ page with the URL and the hash for the cache tool to use.
It might be easier to do that via something like WP Super Cache of W3TC, and have it save the file as it saves the cached page (and point to the static page instead of the dynamic one) but even then, the rapid changing of WordPress content would make it difficult for a cache to seed far enough out.
Right now, I think this is something that might only be useful for a small, mostly static, site.
**Categories:** How It Works
**Tags:** cache, development, torrent
---
### [Not Spilling SEO Juice](https://halfelf.org/2016/not-spilling-seo-juice/)
**Published:** October 26, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Not spilling your juice is important to keep your SEO ranking.
**Content:**
Once in a while I still get people who ask me to do things for them. Some offer to pay, most don’t, but a common thread lately has been “How do I redirect and not screw up my SEO?”
They tend to ask it nicer, but that’s what they mean. And to be honest, the question surprises me in 2016. I’ve read email after email about people who swear “I renamed my domain/page and now my SEO crapped out!” And to each and every one I ask “Did you redirect it properly?”
I think what’s happening is that the problem is so clear cut, people are overthinking. That is, bar none, the biggest mistake I feel anyone ever makes. They overcomplicate a problem and mire themselves in the hell of debugging. I do it all the time.
Let me tell you a story. When we started LezWatchTV, we had some pretty non-SEO friendly URLs. Our taxonomy for TV stations was “show-tags” and it went on and on with worse and worse names. Finally I sat down and drew out a map of what the ‘best’ SEO names would be for what I needed, and it was very short:
- TV Stations: `stations`
- Character Traits: `cliches`
- Show Tropes: `tropes`
- Characters: `characters`
- Shows: `shows`
Five items. And to do the recdirects, I put this in the `.htacess` file:
That’s all I needed. I took all the old, bad names and I redirected them to the good names. But I had to throw in an added wrinkle. I’d originally decided shows would have cliches and characters tropes, but I realized that was wrong and flipped them a week later. That meant I had things like `/cliche/law-enforcement` which had to be redirect to `/trope/law-enforcement` and for that, there was nothing to be done save a massive section like this:
This goes on for 24 character clichés and 18 show tropes. It had to be done manually.
Now let’s ask the big question. Did I lose *any* SEO Juice by doing this?
Not a drop. Because I used a 301 redirect and I used it properly (calling it *well* above my redirect for WordPress). This is exactly what Google’s webmaster docs tell you to do:
> If you need to change the URL of a page as it is shown in search engine results, we recommend that you use a server-side 301 redirect. This is the best way to ensure that users and search engines are directed to the correct page. The 301 status code means that a page has permanently moved to a new location.
Still not sure? Here’s what Joost (of Yoast SEO) says when asked if you should use a [301 or a 302 redirect](https://yoast.com/ask-yoast-301-or-302-redirect/):
> The answer is very simple. You should never use a 301 redirect if you ever want to use that url again. So if you’re redirecting one url to another and you’re sure that the old url is never going to be used again, it’s a 301. If you’re not sure, it’s a 302. That’s it. Good luck!
This is, again, straightforward. If you’re never using the page again (which I’m not), you use the 301 redirect.
By the way, if you’re using Yoast SEO Premium, then you should still have access to their redirect tool. Personally I feel that’s a change that should be on the server level, not a plugin.
Okay, so what happens if you forget to do this? Your SEO will tank. However this can be fixed! Again, if you’re using Yoast SEO and you set up Google Analytics and webmaster tools with it, you have a handy Search Console which will let you see what the errors are. If you don’t, but you use Google (and really this is where it’s quite helpful), you’ll go to your Search Console > Crawl > Crawl Errors page and check out what’s listed.
Remember to check desktop and smart-phone pages. As long as you keep those old URLs redirecting properly to their new home, your juice will be safe and sound.
**Categories:** How To
**Tags:** seo, website
---
### [stdin: is not a tty](https://halfelf.org/2016/stdin-not-tty/)
**Published:** October 24, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making annoying errors shut up.
**Content:**
That was the error.
`stdin: is not a tty`
I use rsync to make a backup of my files via this shell script that runs every time I log in to my laptop:
It’s a nice little script. It downloads everything into a folder called `example.dev` which I then use with [DesktopServer](https://serverpress.com) to have a copy of my site. The database? That’s handled by another file which pulls down the DB backups from Amazon S3 (something built in to cPanel) which I may cover at a later point.
Today though, let’s talk about what that error is, what it means, how we fix it, and why that fix works.
The error is caused by having `mesg` at the top of a `.bashrc` file on my server. In my case, the line is not in the user’s file, but the root file. The message, on login, tells you when your last login was, where it was from, and what the IP was. It also tells you how many failed logins happened since your last login, a report that amuses me when I sudo into root now and then.
Why I get the error is because when I log in via rsync, the message is trying to show on the rsync output, which can’t parse it, and thus errors. The fix means I need to tell it *not* to show the output. And to do that we put this at the top of the `.bashrc` file:
Another option would be this:
It depends on your flavor of Linux of course.
The final question we have with this is *why* does it work?
The second fix is simple. It checks for tty, which is Teletype. If you’ve ever wondered how deaf people use the phone, it’s via a teletype machine. For the purposes of computers, it just means “This is text and we are going to talk in text interactively.” The tty setting is handled by your terminal of choice. If it doesn’t get tty, the server will just not show the message.
The first fix is a little more weird. PS1 stands for Prompt String 1 and is one of the prompts you get when logging in. Normally it just shows username and password. Using `-z` is checking if the prompt is interactive or not. If not, return (aka exit out and do nothing else).
**Categories:** How It Works
**Tags:** shell, unix
---
### [United States Patent: 8010458](https://halfelf.org/2011/united-states-patent-8010458/)
**Published:** September 2, 2011
**Author:** Ipstenu (Mika Epstein)
**Content:**
> An online social network is provided in which members of the online social network control who may view their personal information and who may communicate with them. The members control who may view their personal information by setting a visibility preference. A member may not view another member’s full personal profile if the measure of relatedness between the two is greater than the visibility preference of the other member. The members also control who may communicate with them by setting a contactability preference. A member may not communicate with another member if the measure of relatedness between the two is greater than the contactability preference of the other member.
>
> via [United States Patent: 8010458](http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-bool.html&r=1&f=G&l=50&co1=AND&d=PTXT&s1=facebook.ASNM.&OS=AN/facebook).
It’s official. The US patent office is useless.
**Categories:** How It Is
**Tags:** administration, social media, software, website
---
### [Git Subtrees](https://halfelf.org/2016/git-subtrees/)
**Published:** October 19, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Branching the modules into trees works a lot better and solves a long standing wish of mine.
**Content:**
I have a project in [Hugo](https://gohugo.io) where I wanted the content to be editable by anyone but the theme and config to remain mine. In this way, anyone could add an article to a new site, but only I could publish. Sounds smart, right? The basic concept would be this:
- A private repository, on my own server, where I maintained the source code (themes etc)
- A public repository, on GitHub or GitLab, where I maintained the content
Taking into consideration how Hugo stores data, I had to rethink how I set up the code. By default, Hugo has two main folders for your content: `content` and `data`. Those folders are at the main (root) level of a Hugo install. This is normally fine, since I deploy by having a post-deploy hook that pushes whatever I check in at Master out to a temp folder and then runs a Hugo build on it. I’m still using [this deploy method](https://halfelf.org/2015/deploying-hugo/) because it lets me push commit without having to build locally first. Obviously there are pros and cons, but what I like is being able to edit my content and push and have it work from my iPad.
Now, keeping this setup, in order to split my repository I need to solve a few problems.
## Contain Content Collectively
No matter what, I need to have *one* and only one location for my content. Two folders is fine, but it has to be within a single folder. In order to do this, it’s fairly straightforward.
In the `config.toml` file, I set two defines:
Then I moved the files in `content` to `content/posts` and moved `data` to `content/data`. I ran a quick local test to make sure it worked and, since it did, pushed that change live. Everything was fine. Perfect.
## Putting Posts Publicly
The second step was making a public repository ‘somewhere.’ The question of ‘where’ was fairly simple. You have a lot of options, but for me it boils down to GitLab or GitHub. While GitHub is the flavor du jour, GitLab lets you make a private repository for free, but both require users to log in with an account to edit or make issues. Pick whichever one you want. It doesn’t matter.
What does matter is that I set it up with two folders: `posts` and `data`
That’s right. I’m replicating the *inside* of my content folder. Why? Well that’s because of the next step.
## Serving Subs Simply
This is actually the hardest part, and led me to complain that every time I use Submodules in Git, I remember why I hate them. I really *want* to love Submodules. The idea is you check out a module of a specific version of another repository and now you have it. The problem is that updates are complicated. You have to update the Submodule separately and if you work with a team, and one person doesn’t, there’s a possibility you’ll end up pushing the old version of the Submodule because it’s not version controlled in your git repository.
It gets worse if you have to solve merge conflicts. Just run away.
On the other hand, there’s a tool called Subtree, which two of my twitter friends introduced me to after I tweeted my Submodule complaint. Subtree uses a merge trick to get the same result of a Submodule, only it actually stores the files in the main repository, and then merges your changes *back* up to it’s own. Subtrees are not a silver bullet, but in this case it was what I needed.
Checking out the subtree is easy enough. You tell it where you want to store the repository (a folder named `content`) and you give it the location of your remote, the branch name, and voila:
Since typing in the full path can get pretty annoying, it’s savvy to add the subtree as a remote:
Which means the add command would be this:
## Maintaining Merge Manuverability
Once we have all this in, we hit a new problem. The subtree is not synced by default.
When a subproject is added, it is not automatically kept in sync with the upstream changes so you have to pull it in like this:
When you have new code to add, run this:
That makes the process for a new article a little extra weird but it does work.
## Documenting Data Distribution
Here’s how I update in the real world:
1. Edit my local copy of the content folder in the hugo-library repository
2. Add and commit the changed content with a useful message
3. Push the subtree
4. Push the main repository
Done.
If someone else has a pull request, I would need to merge it (probably directly on GitHub) and then do the following:
1. Pull from the subtree
2. Push to the main repository
My weird caveat is that updating via Coda can get confused as it doesn’t always remember what repository I want to be on, but since I do all of my pushes from command line, that really doesn’t bother me much.
**Categories:** How To
**Tags:** deployment, git, hugo
---
### [Yoast SEO: Selective Stopwords](https://halfelf.org/2016/yoast-seo-selective-stopwords/)
**Published:** October 10, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Custom Post Types, stopwords, globals, weird errors, and selectively applying filters.
**Content:**
Stopwords are those small words that should be removed from URLs. You know like ‘a’ and ‘and’ or ‘or’ and so on and so forth. They make for ungainly and long URLs and really you should remove them.
If you happen to use Yoast SEO for WordPress, and you want to disable stopwords, there’s a simple way about that. Go to SEO -> Advanced and disable the feature for stopwords.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/cleanup-permalinks.png)
If you want to kill it with fire and prevent everyone on your site from being able to activate them ever, you can toss this into an MU plugin.
The first filter makes the stopwords kick back nothing, and the remove action stops the process from running. You probably only need the second one, but better safe than sorry, I always say.
But … what if you *want* stop words removed, but you don’t want them removed on certain custom post types? Welcome to my world! I wanted to remove them from two post types only.
Enter my frankencode:
There was something funny to this, by the way. Originally I didn’t have the `$pagenow` code. Didn’t need it. But when I left it out, Yoast SEO broke with a weird error. It refused to load any of the sub-screens for the admin settings!
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/cannot-load.png)
After some backpacking of “Okay, was it working before…?” I determined it was the call for `global $typenow;` – a global that isn’t used at all in the Yoast SEO source code that I could find. Still, by making my code bail early if it’s not even on a page it should be on, I made the rest of the WP Admin faster, and that’s a win for everyone.
**Categories:** How To
**Tags:** plugins, seo, wordpress
---
### [Review: Spark Love for Your Gmail](https://halfelf.org/2016/review-spark-gmail/)
**Published:** October 14, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Set fire to your email. In a good way. Spark delivers the heat.
**Content:**
[Moving my email to Google Apps](https://halfelf.org/2016/moving-cpanel-email-gmail/) has, thus far, been interesting. I don’t regret it, and consolidating multiple emails down to three was a good choice. The learning curve of adding in email aliases so I can mail from all the accounts I use, and the limits of Gmails shitty filters so everything is funneled to the right place, has been tricky.
As I mentioned before, I have a ton of aliases. Adding them in on the Google Admin back end (just renamed G Suite) is weird but easy enough. To be able to email from them, you have to also add them in via the normal Gmail web app. It’s tucked under Settings > Accounts, and under “Send mail as”, click Add another email address.
But if you don’t want to use the web app (and I don’t), Gmail can be a bit of a turd. It doesn’t work great with the desktop Mail.app, and it works terribly with iOS’s mail. Gmail and Apple are just at odds with how email works. They both want to control your experience and redefine email in different ways. Frankly I prefer the Mac way, but that’s personal preference.
What is a universal problem is that I needed a way to email from my aliases, and if you set up email as Google Mail in the iOS mail app … you can’t.
Yes, you read that right. It is flat out impossible to set up email aliases for a Google mail account. If you want to use the iOS mail app and Goggle email *and* aliases, you have to set up Gmail as an IMAP app, and that’s sort of a shit show in the making. Gmail’s IMAP implementation is non-standard, to put it simply. Among other things, you can only use 15 connections to IMAP per account. If I had the desktop app open and my iPhone and iPad, weird shit happened.
Now, there are solutions. You could use the Gmail app, but it sucks and doesn’t have an Apple Watch component. Also it’s ugly. Excuse me. It’s basic. You could also use Google’s Inbox app, but you have to use Inbox and the email filters aren’t as robust.
This leads us to our final solution. [Spark](https://sparkmailapp.com).
This app was something I’d played with before, as it had email alerts on the Apple Watch, and I wanted to get pinged for some work emails while updating all DreamPress installs over at DreamHost. Sadly, the fault of the app not meeting that need is Gmail, again, which has no way to filter properly and send an alert only when an email meets specific criteria.
What Spark *does* do is everything else. It has a Watch component, it syncs between my iPad and iPhone, it looks like an iOS app, it acts like a Google app, it pulls in the features people rave about Inbox, and it has email aliases that are simple to set up. Whew. The only thing it doesn’t do is show me a count for unread messages in my folders.
I can live with that.
**Categories:** How It Is
**Tags:** app, email, ios, review
---
### [Optimizing Images](https://halfelf.org/2016/optimizing-images/)
**Published:** October 12, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Smashing images into smaller and smaller images for faster and faster loading.
**Content:**
After running a regeneration of my images (due to changing things on my theme) my Gtmetrix score dropped from an A to a D! In looking at why, I saw it was telling me my images should be optimized.
Best to get on that, eh?
The easiest way is to install jpegoptim on the server:
And then to run a compression on my images:
Anyone fancy running that on a few thousand images? Hell no. We have a couple options here. One is to go into each folder and run this:
The other is to sit in the image root folder and run this:
I picked `--strip-all` since that removes all the image meta data. While I would never want to consider that on a photoblog, I needed to compress everything and, for some reason, unless I stripped that data I didn’t get smaller sizes. For this case, it wasn’t an issue.
What about PNGs? Use optipng (`$ yum install optipng`) and run this:
Going forward, I used Homebrew to install those locally and compress my images better, though I’m usually pretty good about remember that part. Well. I thought I was.
**Categories:** How To
**Tags:** images, website
---
### [Google Knowledge Blindspot](https://halfelf.org/2016/google-knowledge-blindspot/)
**Published:** October 5, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Google, like the US government, has a difficult time understanding what a 'person' is sometimes.
**Content:**
With the new release of Yoast SEO 3.6, I decided to test out their new walk-through setup.
As someone who’s been studying SEO to one degree or another since the 1990s, SEO in and of itself is no great mystery to me. The bare bones of how it works, how you make good content, is understandable. But what Yoast SEO does, and what I like it for, is it makes it obvious to people without my experience what is needed. It also takes the generally good SEO of WordPress (and a good theme) and optimizes it for the myriad, constant changes that Google does.
For that, the walk-through is a wonderful idea. I like it. I think new users will love it. I think it’ll lessen the barrier to those people who are told “You need a website!” but no one is willing to (or able to) sit with them and help them get started.
Initially I was super impressed. Yoast had clearly studied the aspects of walk-throughs that had worked and that didn’t, lifting pages from other complex plugins that needed to be used by, perhaps, non-technical savvy people.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/site-type.png)
Being asked what *kind* of site I was running was brilliant. For the purposes of this test, I decided to use my community/wiki/library – LezWatchTV. And right away I ran into a problem.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/company-person.png)
The tool wanted me to say if I was a company or a person.
Well … Neither. I’m a community site. Or maybe a group? Either way, the two designations didn’t really apply properly. Where was “Other”?
This couldn’t be Yoast making a boneheaded maneuver, I realized. Few people know better than Joost and his crew what WordPress is used for. They’re smart people. They’ve seen more of the Internet than most of the rest of us and they know well how it’s used. So could the screwup be Google or Schema.org?
I went to Schema.org to look up how they would classify the site, and determined that [DataCatalog](http://schema.org/DataCatalog) was the most appropriate. Alright, knowing there was a good classification, I looked back at Google’s Knowledge Graph.
Google’s Knowledge Graph is a weird thing. It’s Google’s attempt to figure out how to answer your questions. You know how you can type in “How do I do X?” into Google and you get that interesting formatted answer?
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/bakeapie.png)
That’s from their Knowledge Graph. But more importantly, so is this:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/root.png)
The more you dig into it, the more you realize that the only boxes like that are for people or companies. So the breakdown is that Google has not yet figured out how to flag non-people non-companies.
This means my ultimate question of ‘what I am?’ has become a little more existential than I’d wanted, and a little simple. It’s not a person, therefore it must be a company. And while that is entirely, totally, daftly incorrect, it’s also less incorrect that a person.
Thanks, Google.
**Categories:** How It Works
**Tags:** google, plugins, seo, wordpress
---
### [Per-Site MU Plugins](https://halfelf.org/2016/per-site-mu-plugins/)
**Published:** October 3, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A different way to per-site Multisite in MU Plugins.
**Content:**
A great many moons ago, I handled my per-site MU plugins in a [very straight forward way](https://halfelf.org/2013/adding-per-site-multisite-options/). I made a `halfelf-functions.php` file and checked for the blog ID with `if ( $blog_id == 2 ) {...}` and off I went.
Now? I do this:
I have a folder called ‘functions’ and in there I have a file for every site that needs it’s own functions. This also let me clean up some rather old code I wasn’t using anymore, but it also let me add in code to include local CSS. Since I version control my `mu-plugins` folder, this allowed me to move my custom CSS from Jetpack to a normal CSS file.
Why did I need to do that? Jetpack CSS [doesn’t allow the fill param for CSS](https://github.com/Automattic/jetpack/issues/2133). Their current justification is that it’s advanced enough that people should be editing the theme. And mine is “But … why?” SVGs are becoming more and more popular, after all, and a number of plugins are allowing them. That means to style your SVGs, you’ll want to use CSS. And you can’t with Jetpack, which means you’re back to the old hell of editing your theme’s CSS. And that was something I wanted to avoid.
You’d *think* I could do this:
But that actually didn’t work. No matter what I did, the result of `$helf_site_url['host']` was *empty*. I know, right? What’s up with that.
What’s up is me not thinking about how functions ‘know’ what they know.
Inside the function, you see, it can’t see non-globals. So it wouldn’t work. If you’re not using Multisite, you don’t need to use `$blog_id`, but I don’t know why you’d want to use this if you weren’t using Multisite. The other silly moment was remembering that `plugin_dir_path()` would give me `/home/user/public_html/wp-content/mu-plugins` which would make the URL a relative URL, and not at all what I wanted. But using `plugins_url()` would give me an absolute path.
Perfect.
**Categories:** How To
**Tags:** mu-plugins, multisite, wordpress
---
### [Adding Per Site Multisite Options](https://halfelf.org/2013/adding-per-site-multisite-options/)
**Published:** September 23, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You want options? We got options! Different ways to handle per-site functions on a Multisite network!
**Content:**
johnc- said in IRC the other day, regarding the use of get\_option API for WordPress “our standard practice is to use get\_option to enable site specific features, if the feature needs to be unavailable for other sites then it gets broken into a separate plugin for clarity”
So to explain this for those who blinked a little we need some examples, and really this depends what you’re writing.
We got to this point in the conversation while folks were watching my [“Don’t Use WordPress Multisite” presentation from WordCamp SF](https://halfelf.org/2013/wcsf-video-dont-use-wordpress-multisite/ "WCSF Video: Don’t Use WordPress Multisite"). During the presentation, I mentioned that generally, when I want to write a function for a specific site on Multisite, I wrap it around a ‘If site 1, then …’ and put it in it’s own plugin file in mu-plugins. That leaves me with files like `halfelf-functions.php` so if I ever split the site out (see? I’m always thinking ahead) I know what file to copy.
**But** that’s not the only way about it. Another way is to put all the functions in a file, and then wrap the actual filters and actions around a get\_option call. Why would I want to do this instead of a separate function file? The question of portability comes up primarily. Exporting site options is not the easiest thing in the world on a Multisite, but there are cases, like my [Capital H Dangit!](https://halfelf.org/2012/capital-h-dangit/) function, where this would make sense. In general, I always want DreamHost to have a capital H, so since 99% of my sites have that on, I could, instead, use an option, since if I ever moved the one site that *doesn’t* use it, I just won’t bring the function over!
Currently have wrapped that function around an ‘if site 2, then don’t run’ check, which works fine. But if I wanted to move that to options, it would go like this:
This is pretty basic. It adds an option called `helf_capital_H_dangit`, auto-loads, and defaults to on for everyone. That was the easy part. The hard part is determining how to control it.
One option is an interface where I can check a box on, say, General Settings > Writing > Formatting (right under the smilies check box would be perfect), but since I knew this was something I was going to want to control as the super-admin (that is, I *don’t* want the other people on my network to turn it off), I went in to the back end of my site at `/wp-admin/network/site-info.php?id=2` (since this is site #2) and searched for ‘Helf’
I edited it to ‘no’ and saved. Boom. I can use DreamHost and Dreamhost here.
Now this isn’t something I’d do for everything. In fact, my actual `halfelf-functions.php` file looks like this:
All the per-site filters are right there turned off as I want them. It’s not a lot of effort that way, and it’s still easy to pick up a site and drop it somewhere else.
Which is better? I don’t know. The real test would be to do some hardcore speed checks and see if checking for the blog ID is faster than checking for an option. I think the speed benefit gains would come from only calling this when needed, but for the limited world in which this is used, it should be fine. Also, keep in mind what both johnc- and I are saying, but in different ways: remember the 80/20 rule.
In my opinion, if you’re making a feature that will be used by 80%+ of the sites on your Network, `get_option` is probably the easiest bet. If you’re making a feature that’s going to be used by 20%- of the sites, then a separate plugin (with a site\_id check) is the way to go. Of course, you could do an option and default it to ‘no’ as well, but that brings up an interesting level of things to remember if you ever move a site.
If you’ve got a more efficient way of doing the same thing, or even just a different way, speak up! More options are always better.
Oh and no, we’re not going to sneakily install this on DreamPress, but if I did, it would also capitalize DreamPress, DreamCompute, and everything else out there. But I won’t.
**Categories:** How To
**Tags:** coding, multisite, plugins, wordpress
---
### [Sortable Custom Columns: Taxonomies](https://halfelf.org/2016/sortable-custom-columns-taxonomies/)
**Published:** September 26, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making even more things sortable!
**Content:**
You may have noticed that when I was making [Sortable Custom Columns](https://halfelf.org/2016/sortable-custom-columns/) I *didn’t* make it so I could sort some of the fields.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/sorting-coliumns.png)
That’s because unlike my lovely post meta, those other fields are custom taxonomies. And by their very nature, they’re **not** sortable. In order to do this however you need some SQL.
## Make the Columns Sortable
First we have to add our new columns (`lez_gender` and `lez_sexuality`) into our sortable function.
Last time it only had the unset and the `postmeta-roletype` columns. Now we’re adding in our taxonomies as `taxonomy-{TAXONOMYNAME}` to that.
## Actually Sort the Content
Now here’s the sneaky SQL stuff.
I repeat this with ‘gender’ changed to ‘sex’ and ‘lez\_gender’ changed to ‘lez\_sexuality’ for the other taxonomy.
I tested this on 921 posts in a custom post type and it didn’t make my server cry. Which is a bonus.
**Categories:** How To
**Tags:** coding, sql, wordpress
---
### [Sortable Custom Columns: Another Post Type's Data](https://halfelf.org/2016/sortable-custom-columns-another-post-types-data/)
**Published:** September 28, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If only we always knew how we wanted to use all our data before we actually set it all up, but sometimes that's just how it goes.
**Content:**
And we’re still on [LezWatchTV](https://lezwatchtv.com) where there are two CPTs: Characters and Shows.
Every Character has a meta key of the Show (or Shows) it relates to. Since this could be 1, 2, or 7 (you get the idea), it’s an array of Post IDs.
On every page for a Show, I do a count for how many Characters link back to it. Since they’re post IDs, I have to watch out for the LINK/IN results (which I mention in my post on [querying the characters for their deaths](https://halfelf.org/2016/combining-data-multiple-cpts/) … look it’s a weird site). And in so far as showing this on a front-end post, it’s not hard to run a query of characters, grab the shows (in their meta key) and check if that specific show is in the array. If it is, update the count by one.
But there are problems with this. It’s slow, and as it’s something I run fairly often this makes the site slow. Also it isn’t *sortable*. I ended up with a lot of ugly, repetitive, code. After screwing around with SQL and the like, I determined (around the same time my buddy Norcross opined the same) that the smart thing would be have the shows all have a meta field for character number and did this:
- Every time a show is saved, check how many characters link to it and save the count.
- Every time a character is saved, check what shows it links to and run the update for shows.
In that way, I can just grab the meta keys and call it a day. It would make everything much easier.
Would have been nice if I’d thought of that 1000 posts ago, huh? Well you live and learn and take down the elephant one bite at a time.
## Make a Function to Count Characters
Since I know I’m going to want to check the number of characters from multiple places, it seemed wise to make this a function on it’s own.
When I want to use it, I just call `lez_count_queers( POST_ID )` and I get a number of queers for that show.
## Update Shows When Saving Shows
I could have done this in one massive function, but I decided to break it apart so I didn’t have to loop through things unnecessarily. That will make more sense when you look at the next function. But for this, I’m taking advantage of the action `save_post_{post_type}` which lets me trigger my update only when that post type is updated.
The infinite loop check is very important, otherwise every time I ran the update, it would trigger the update and trigger the update and trigger the update. You get the idea.
## Update Shows When Saving Characters
Having decided to break the saves apart, I had a very similar command for the characters, only this time I *am* forcing it into an array. This allows me to compensate for the characters who were added before I updated to the new, array, system. There are only a few left, but better safe than sorry.
This time you’ll note the lack of infinite loop check. It’s not needed here, since I’m not updating the character content. I’m also doing two actions here, one for ‘do\_action’ and one that is the action. This allows me to handle some odd workarounds like… the catch.
If a character doesn’t have any shows associated with it yet, like a *new* character, then it won’t update the character until the second save. And just as bad, if a show is changed, it won’t update. And no, I don’t have a complete fix for this yet. Working on it. The best idea I have so far is to schedule a single cron command to run the show update in 5 or 10 seconds. However this won’t solve the issue with changing shows.
## Batch Update All The Things
Once I got the code in (and I checked that it worked), I had to update all the posts. Thanks to wp-cli, there’s a handy [post update](http://wp-cli.org/commands/post/update/) command. And yes, there are a lot of ways around this one but I thought this would be ‘simpler.’ If you want the super lazy way around it, you can view all the pages on the edit screen, select all, pick ‘quick edit,’ and then save them with no changes.
Since I decided to use WP-CLI, though, I wanted to get a list of all
This gave me a list of every show that was published.
And this re-saved every single show that was published with the post status of … published.
## Make it Sort
Once I had done all that leg work, I could use the super basic sort by meta key value. The only difference to [what we did before](https://halfelf.org/2016/sortable-custom-columns/) is that now we’re using `meta_value_num` .. since characters are numbers.
**Categories:** How To
**Tags:** plugins, post meta, wordpress
---
### [My Question is "You Suck"](https://halfelf.org/2013/my-question-is-you-suck/)
**Published:** July 22, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some help with handling those support questions that aren't questions, and reviews that should have been support questions.
**Content:**
If you’ve ever watched *Survivor*, they have a Tribal Council at the end of each episode, where they discuss things and decide who to vote off the island. In the grand finale, however, they instead discuss whom to give the million dollars. Every previously voted off tribe member gets a chance to ask the two (or three) finalists a question. Miss Alli, from the classic days of Television Without Pity, used to love/hate when someone would step up and use their time to shout, insult, or otherwise berate the finalists. She called that “My Question is you suck.”
Whenever you do support, you will invariably run into people who act exactly like that. If I had a dollar for every time someone left a support ticket with “This sucks!” I wouldn’t need to work anymore. And those people are really annoying, because you want to reply “Well thanks, and over here in the constructive world…” but you absolutely cannot engage them. As the Survivor yahoos quickly learned, feeding the fuel for someone who’s ranting is about as useful as keeping the rain off with those little paper umbrellas you get with fruity drinks.
### My question is … this code is crap
Something to keep in mind, Tech Support is not “Customer Service” per se. When someone needs tech support, while they totally need someone to be ‘nice’ to them, they really need someone to fix their problem. Customer Service is all about building a relationship with the customer, figuring out their needs and wants, and basically *selling* them something. On the other hand, tech support is being told “This is my problem, fix it.” While that certainly happens to people who work at hotel desks (“There’s no hot water…”) it’s the meat and milk of life for anyone who writes and/or maintains software.
To this end, you’re really not ‘servicing’ the customer, nor are you taking time to build a great rapport with them, you’re trying to fix what’s wrong. Certainly doing this provides a service to the customer, but making sure the person comes back (or stays) is often secondary. After all, if we can fix the problem, you’ll come back, right?
When someone just says ‘You suck’ or ‘Your code sucks’ there’s very little you can do about it, if they’re not willing to give you a concrete example of these things. I have, on occasion, replied “Patches welcome! I’m always happy to improve my work.” That’s pretty much the best I can do. When the reply is that I, personally, suck, then I hand it over to anyone else. There’s nothing I can do here, so it’s time to ask someone else to help me out.(If you’re the solo dev, it’s time to cut your losses, say that you’re sorry you can’t help them, and walk away.)
### My question is …. this plugin gets one star because it doesn’t work
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/5351c208ea8511e2984222000ae801ef_7.jpg)Mark Jaquith Reviews Code. Credit [Mark Jaquith](https://twitter.com/markjaquith/status/355475827477053440)Everyone hates the ‘review that **should** have been a support question.’ Invariably we’ll get it. The plugin doesn’t work, screw you. And when we go back to look at the person’s post history, we see never once did they, in a place you can find, ask you ‘How do I make this work?’ It’s frustrating. Now you should keep in mind, on the WordPress.org forums, someone can *change their star rating*, so the best thing to do here is try and win them back. Kill ’em with a little kindness, point out ‘I would have seen this faster had you…’
But in general, this one is not to terrible to win back. Much of the time, someone who is this lost that they can only find the review location and not the right support places is someone who has a pretty easy to fix issue. Solve it and you’ve got a returning user. A smaller percentage of the time, alas, the problem is someone who really, truly, didn’t read what the plugin does. “This plugin for vegan resources sucks because there’s no bacon!” Not much you can do there except point out “This is by design.”
### My question is …. you don’t reply fast enough for me
Today we expect, and often get, instant feedback. We have livechats, we have Twitter and Facebook. We reach out to the people who represent a company (or a TV Show), and we assume there will be some prompt reaction. This is no longer customer ‘service’ but ‘experience.’ The customer’s personal experience will color their feelings about both the product and the people behind it. It’s a large part of why I don’t think pure customer service exists any more, if it ever did, in software.
The problem comes in when you take a weekend off, or an afternoon, because you want to actually have, you know, some time with your family, or go to a movie. Maybe you were just asleep for eight consecutive hours. Either way, it was the worst time in the world for someone else, and they’ve left multiple requests for help. If you’ve ever worked in a ‘traditional’ office, these people are like the guy who emails you a long question, and then calls you *and* swings by your desk, after IMing you, to make sure you got the email.
In short, they hit every single ‘annoyance’ nerve in a person’s body, all at once, and they do it over and over and over. I tend to want to reach through the monitor and take away their caffeine for a couple days. But until someone invents that for me, I have a couple tactics.
For anything ‘free’ (like WordPress plugins) I tell them that this is a free product I write in my free time, and that means waiting a reasonable time for a reply means waiting 3-5 days, not 3-5 seconds. And then I answer their question as best I can. For the paid stuff, I point out that I missed their email because I had gone home for the day (or ‘had the weekend off’). Usually just that gentle reminder of “some people do work ‘normal’ hours still” gets them off their horse enough to work with. On the rare occasion it doesn’t(I’ve had people tell me that I’m too important to not be available 24/7, which is sweet, but no.) I’ve just ignored their unreasonable demands and concentrated on fixing the problem at hand.
### My question is … you don’t know what you’re talking about
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/yousuck.gif)Finally there’s the you suck hidden in a peculiar phrasing of basically “you aren’t good enough.” This is not the same as the outright “You suck.” because it’s actually a value judgement. It’s not a dismissive “You’re a meanie poopy head!” sort of claim, it’s a “Your code sucks!” And this sort of comment hurts a lot. People calling you names rarely have any basis to do so, and they’re rarely right. People calling into question your work, however, that cuts to the bone and tends to make us over react.
In defense of people who submit bug reports, much of the time this is *not* what they mean! Sometimes they say “I think you’re wrong because of XYZ” and it comes across as “You idiot, how could you not possibly know this!” I say this a lot, but text is a really lousy medium for communication of intent. Now. One thing the people who report the bugs really need to remember to do is say “Thank you” when the bug is fixed, or even “I appreciate you taking the time to explain to me why you won’t do XYZ.” Instead, most of what we get is someone saying “I told you! I was right and you were wrong!” I gotta tell you, that never really makes me want to work with you again.
But the real reason this one galls me is that it’s generally said to me after someone has specifically asked me for help on something of I’m somewhat of an expert (or talented tweaker). I’ve had people tell me I don’t know jack about WordPress (pretty sure that’s wrong), or pretty much anything else under the sun. That frustrates me, since you came over here asking me, admitedly a total stranger, for help, and when I gave it you snipped that I’m ignorant.
To these, I actually do point out “You know, you asked me for my help/opinion and I gave it. We can agree to disagree, but you don’t have to be mean about it, since that’s not a good way to get help from a free, volunteer, community.”
Unless of course you’ve hired me, at which point I refund most of your money and cancel the contract.
**Categories:** How It Is
**Tags:** administration, essay, support
---
### [Custom Columns Search: Not unique table/alias](https://halfelf.org/2016/custom-columns-unique-tablealias/)
**Published:** September 21, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** WordPress database error: [Not unique table/alias: 'wp_postmeta'] ... Well that can't be good, can it?
**Content:**
After making [Custom Sortable Columns](https://halfelf.org/2016/sortable-custom-columns/) everything was awesome, right?
Well… Mostly.
When I tried to sort a search, I got this:
Not good.
And not actually (really) related to the sortability! No no, I did this to myself by adding in [optimized post-meta search](https://halfelf.org/2016/optimizing-post-meta-search/). You see, that runs on the front **and** the back end of WordPress.
I knew it had to be the search tweaks I’d made when I saw this:
Right away I realized it had to be my custom queries both calling from `wp_postmeta` and, in doing so, stemming all over each other. Not good at all.
The fix was relatively simple. All I had to do was move the filters to run only if we’re *not* in wp-admin.
This meant that the internal post search wouldn’t query those fields, but in the grand scheme of things, that’s okay. Generally when I’m looking for a post in the search, I’m looking for it by title. If I wanted to be more particular, I could have it not use my custom joins when I’m on a post listing page, but allow it if I’m editing a post (so adding a new link would search all that content too).
For now, this is what I need.
**Categories:** How To
**Tags:** database, debug, wordpress
---
### [Sortable Custom Columns](https://halfelf.org/2016/sortable-custom-columns/)
**Published:** September 19, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making your custom columns sortable is a little annoying, but really nice once it's working.
**Content:**
I have a *lot* of custom columns going on over at LezWatch TV. And there are a million tutorials on how to make your columns sortable. So here’s another one.
## Backstory
I have a custom post type for TV characters, and the characters have extra meta data. The kind I want to show is the TV show (or shows) associated with the character and the role type.
I should note that ‘role type’ can be weird, since there are characters who will be guests on one show and regulars on the other, and really I should go back and change all of that but when you get to 1000 characters, you really don’t want to… Anyway. Let’s just do this. Keep in mind the following things.
1. The custom post type was registered as `post_type_characters`
2. The data I wish to list is ‘tv shows’ and ‘role type’
3. TV Shows is an array of IDs related to another post type (shows), stored in a meta key called `lezchars_show`
4. Role Type is a plain text value stored in `lezchars_type`
Now we’re ready to go
## New Column Headers
We want to make a new column for your custom post types. For this to work, you need to know the name of your custom post type – `post_type_characters` remember – and the format for the column code – `manage_{POSTTYPE}_posts_columns` … See how that works?
The name of the columns (`cpt-shows` and `postmeta-roletype`) are semi-arbitrary. I picked `cpt-TYPE` and `postmeta-META` because they were logical to me. I always use those formats.
## Column Content
Giving the column content is a little more difficult because I’m listing TV shows associated with a character. Plural. And some characters are on three shows. Usually people are only on one, thankfully.
This time the function name is going to be based on `manage_{POSTTYPE}_posts_custom_column`
And this results in this:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/chars-cpt-columns.png)
## Making it Sortable
But as you’ve noticed, it’s not actually *sortable*. That is, if I have one character with no ‘role’, I have to surf through 47 pages until I find her. So the magic here is to make these columns sortable.
This time the filter is named `manage_edit-{POSTTYPE}_sortable_columns` and there’s some extra mess going on.
The column names are required from the previous steps, but the sort by being ‘role’ is something I made up. It doesn’t have to match anything from before *however* it has to be remembered, as we’re going to re-use it in a moment.
You see, I have to tell it what ‘sortable’ means by filtering `pre_get_posts`. I’m grabbing the meta value for `lezchars_type` and I’m going to tell it to order by the value. This happens to be alphabetical. If I was using a number, it would have to be `meta_value_num` instead of `meta_value`.
Remember how I said to remember we called the order-by ‘role’? Well this was why. The case check is on ‘role’ but also the meta\_key is our key name.
And yes it works:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/09/sorting-coliumns.png)
**Categories:** How To
**Tags:** coding, wordpress
---
### [Review: Ninja Forms 3](https://halfelf.org/2016/review-ninja-forms-3/)
**Published:** September 16, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Three is here, and it's amazing.
**Content:**
I wanted to have this out last week, in time for their release of Ninja Forms 3, but with WordPress 4.6.1 dropping the day before and me breaking the site I use Ninja Forms on, well let’s just say my week ran away with me. See the previous post about how lesbians eat data for more.
Anyway. [Ninja Forms 3](https://ninjaforms.com/ninja-forms-three-live/). It took these guys a year to get it all right, and from where I sit, they did an amazing job. They managed to upgrade with minimal loss of data. And since we’re talking about forms, that’s a huge deal. You see, when you do a major overhaul of how forms are built, you’re changing how the data is stored. You’re also (possibly) changing the shortcakes in the posts where the forms are located.
Making matters ‘worse’ for Ninja Forms, they have add-ons. Now they have to make sure these hundreds of add ons will work with the new version of Ninja Forms, and you can bet that not every developer will be responsive. I know that one for a fact.
What they did was nothing short of phenomenal. You see, they ended up making two plugins and a migrator, wrapped it all up into one plugin, and released it. I cannot stress how incredibly hard that is. And they did it right and well.
Here’s how it worked. I had version 2.9.x and I pressed that happy upgrade button to go to version 3. Nothing changed. I had an alert telling me that “3 is coming!!” which I knew, so I clicked on the link and was taken to a page asking me if I wanted to upgrade. Hold on a second. I was *asked* to use the new version.
Right then and there I realized they’d not just included some 2.9.x stuff in the plugin as a fall back, no no. They had two plugins. That’s *twice* the work, but more to the point, they had an upgrader *and* a downgrade in there. I clicked upgrade, migrated my forms, and that was it. From the visitor’s end, nothing had changed, and that’s how we like it.
For me though, using it was a mind trip. The very first thing I noticed was that it took up my whole screen. Now I’m not a fan of that in general. I want WordPress to look like WordPress. I want access to all my things so I can right click and open a link in a new tab and multitask. And worse, *most* full screen WordPress tools don’t look like WordPress. The disparity of those kinds of changes bothers me a lot.
Shockingly, Ninja Forms felt like WordPress. It looked and felt like everything else in my dashboard. I’ve only seen this a few times, like with WooCommerce, where the ‘non’ WordPressy pages were still WordPress. This is hugely important to me. The more we make a consistent user environment for WordPress, the better we make the entire WordPress experience for our users.
I hadn’t messed much with Ninja Forms since I first set it up but now I had all sorts of fun things to play with. The drag and drop interface was as slick as it looked in the videos. This has reinvigorated my interest in things and I’ll be adding some more custom forms to the site soon.
Okay, so what *don’t* I like?
The colors don’t match my site. This is so random, I know, but I like to use different WP Admin themes for different sites. This site is purple, another is blue, and the one using Ninja Forms is 80s Kids – bright blue and pink. I wish that Ninja Forms picked up my admin colors and used that to make their interface.
I’m disappointed about tabbing as well. I can’t press tab and go between fields when I’m editing a form. I try to use my mouse as little as possible when I enter data. If I’m typing in information, like ‘term name’ and ‘value,’ then I want to press tab to jump to the next field.
Finally, and this is going to sound weird, I don’t like that the form editor makes the rest of their settings pages look plain. They did such a kick ass job, I look at the ‘regular’ settings and think they missed something. I know, it’s petty.
**Categories:** How It Is
**Tags:** plugins, review, wordpress
---
### [Lesbians Eat Data](https://halfelf.org/2016/lesbians-broke-jetpack/)
**Published:** September 14, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Debugging why the data on my site killed my server was astounding.
**Content:**
The original title was “Lesbians Broke Jetpack” but it turned out to be even *more* complicated than all that. And thankfully more rare.
This concerns three things.
1\) The website lezwatchtv.com
2\) Jetpack for WordPress
3\) ElasticSearch
On Sept 6th, Jetpack released a new version – 4.3 – and I promptly upgraded. When I did, I started getting weird emails from my server of a “Suspicious process running under user lezwatchtv” and the content looked like this:
Being a proper code-nerd, I backed out a few things and tried again. Same error. I went into my process watcher and saw *five* processes calling `wp-cron.php` for that domain, but no others on the server. I killed the processes and turned off WordPress cron. Everything was fine. Then I installed [WP Crontrol](https://wordpress.org/plugins/wp-crontrol/) and manually kicked off cron jobs until it happened again.
The culprit was a ‘runs everyone one minute’ job by Jetpack, which struck me as bewildering.
The sync job is meant to update your data on Jetpack’s servers, which makes sense, and running every minute will copy up everything that changed in each minute. It seemed a little heavy to me, and disabling it stopped my run-away cron jobs. That meant the sync was failing. I reached out to a Jetpack tech and explained the situation. He re-ran the sync manually and it stalled.
We determined the likely issue was that the job was, for some reason, hanging and unable to finish, so it would just stay active forever. And ever. And since it would see that the sync had never done, it would start up all over again until, finally, my server killed the five (yes, five) processes and sent me an angry text about it. Yes, my server texts me.
At this point I emailed support with full details and got a very insightful reply from Brandon Kraft:
> I’m interested in if there’s an issue with the server connecting with WP.com (seems unlikely given your other sites sound fine), if there’s a large amount of postmeta or something like that that is throwing a wrench into the system, or something to that effect. We’ve isolated some odd cases where when there is either a lot of postmeta or something yet undetermined in postmeta breaks things in a way similar to what you saw.
DING!
See there are 40 posts, 22 pages and then 1246 Custom Post posts on LezWatchTV.
906 posts are ‘characters’ and all characters have three separate taxonomies, two plain text post-meta values, and two serialized. 340 posts are ‘shows’ with two taxonomies, three plain text post-meta values, three integer (plain text) post-meta values, one true/false, six HTML, and one serialized data.
So if I was going to point at “a site with lot of weird post meta” I would pick this site.
I spent a few hours on the 7th (the day after the release) beta testing their 4.3.1 version. We tried [a patch for the bug where full sync wasn’t giving up on wp error](https://github.com/Automattic/jetpack/pull/5126). That helped a little, but the error kept happening, limiting itself to two or three processes. I pointed to a special API, I ran some weird `wp shell` commands, and all we came up with was that at 190 or so ‘chunks’ out of 443, my server would stop sending messages to Jetpack’s servers.
Eventually I zipped up a copy of the theme and plugins and a sanitized DB (all secret information removed) and sent it over for them to play with. And they reproduced it! That was good. It meant it wasn’t my server, but it was my setup and the way Jetpack’s sync worked.
Like everything that has to sync, Jetpack plays the game between ‘sync it all super fast’ and ‘don’t kill the server.’ The way they sync the posts, they apply filters to render the content, including embeds. Because it does that with embeds, it triggers `update_post_meta` to update the `_oembed_time_{long_base64_string}` value, so it can know when to update the embed code for best caching.
Wasn’t I *just* talking about post meta the other day? [Why yes! I was talking about optimizing post meta for search!](https://halfelf.org/2016/optimizing-post-meta-search/) The interesting thing about that is, since I’m using [ElasticPress](https://wordpress.org/plugins/elasticpress/), it scans all my post meta for updates so it knows what to save as searchable data. That means when Jetpack triggers the update, it triggers ElasticPress, and all hell breaks loose.
But why did this happen *now*? Because I turned on “Sitemaps” for Jetpack. And when you enable (or disable) a Jetpack Module, it triggers a full sync. This happened to be the first time I’d done that since installing ElasticPress.
I did what any responsible person would do, and wrote this all up and submitted a [bug report with ElasticPress](https://github.com/10up/ElasticPress/issues/572). Sadly for now I’ve disabled ElasticPress until this can be resolved. I can probably turn it back on safely, since I won’t be triggering a full sync any time soon, but since I don’t want to accidentally crash things, I’ve left it off.
And how was your week?
**Categories:** How To
**Tags:** debug, development, plugins, wordpress
---
### [Debugging cPanel's Default Webpage](https://halfelf.org/2016/debugging-cpanels-default-webpage/)
**Published:** September 12, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Automating all the things sometimes ends in disaster. Trust your tools, but remember how to debug.
**Content:**
It started with a weird email from someone complaining that a 5 year old link was broken. They were trying to go to tech.ipstenu.org. I don’t, and haven’t used that since maybe 2011 or so. That was when I bought halfelf.org you see. I knew the domain should be forwarding, I set that up a million years ago, but for some reason it wasn’t. I told him the right URL and went back to puttering around.
But it bugged me, you know?
And later that day, half my domains started spazzing. It turned out they were still pointing to the ‘temporary’ name servers, ns3 and ns4. I cleaned up my DNS zones and rebuilt them (thank you Dan E. from Liquidweb) but for some reason it was *still* derping.
Now… as you know, I set up [AutoSSL and Let’s Encrypt](https://halfelf.org/2016/lets-encrypt-cpanel/), like a good internet monkey.
In the middle of all this shit, I thought to myself ‘Self, I should fix having a subdomain as an add-on which I don’t need anymore now that we have this set up!’ I deleted store.halfelf.org as an add-on and put it back properly as a named subdomain.
Then I went and properly re-ran the AutoSSL check…
Errors:
I read down and saw I had this error for ALL the bad domains. Coincidence? I think not. And neither do you, right? Right.
I did what you do and Googled and Googled and came across people saying that it was Sucuri (nope) or some other CloudFlare type firewall (nope), and then I thought about the crux of the error. “SSL connection failed” is a pretty distinct error, I felt. And of course the SSL connection failed, there wasn’t a certificate yet! So why was it trying to get to SSL right away?
And then I remembered … I have this in my .htaccess
Which MEANS when it goes to http://store.halfelf.org, and doesn’t get the proper reply, it redirects to https which is the bad page that cPanel always does.
Oh yes.
Deleted those lines, re-ran AutoSSL, and it works.
Picard, Riker, and Worf facepalm.
Okay, smarty, what’s the real fix? Because as much as I want to leave this in place, I’ll have to remember to turn it off every time I add a new domain or subdomain to the system, and while that’s *rare*, it’s the rare cases that cause the most problems (thank you Herbert Hecht).
I looked back at the error and recognized the pattern being repeated: `.BIN_AUTOSSL_CHECK_PL__.` I saw it *all over* the place. I also knew that the folder AutoSSL puts down for LE is `.well-known/acme-challenge` (it’s in your web root). And I *also* knew this extra thing… I knew `.htaccess`
My new rule:
Ironically, once I sorted all that out and understood I needed to whitelist things for AutoSSL and LE, I was able to Google and find an answer. [cPanel knows about the issue and has a case open to fix it for everyone](https://forums.cpanel.net/threads/autossl-htaccess-whitelist.562651/).
Still, I’m leaving that code in place for the one account that tends to add subdomains often enough that I would need this, and not-often enough that I’d remember.
**Categories:** How To
**Tags:** cpanel, debug, htaccess
---
### [Optimizing Post Meta Search](https://halfelf.org/2016/optimizing-post-meta-search/)
**Published:** September 5, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Trimming down the meta key names I searching for to prioritize my results in a WordPress search.
**Content:**
While I’m currently using [ Adam Balee’s technique to add more custom meta to my search results](https://halfelf.org/2016/search-custom-post-data/), it had one flaw to me.
See, his search added *all* the post meta, and really I didn’t want that. While I’m still deep in the woods of getting ElasticSearch to prioritize for me, what I needed was for the search to only look at specific post\_meta fields. And for that, I needed to change the search query just a little bit.
The original code has a section where it updates the Where clause:
Now originally I thought I could just add on to that, but for just changing it to this didn’t work:
That’s because there’s no way to know what `$1` is. I tried this as well but it didn’t work:
So accepting I would have to keep using `preg_replace` I thought about what I was searching and what I wanted. I didn’t want the search to show every character with the tag ‘homosexual’ for example, because that was a custom taxonomy and people can look for that if they wanted to see all the homosexuals. That meant I trimmed down the list of meta fields I needed to search.
My final result was this: chars\_actor, shows\_worthit\_details, shows\_plots, shows\_episodes, shows\_realness\_details, shows\_quality\_details, and shows\_screentime\_details.
I left out the metas for ratings, because all that would do is mean if you search for a ‘5’ for example, you’d get all the things rated five without enough context. (That reminds me I need to code in a way to sort shows by rankings…).
Anyway, my code looks like this:
That change is in the OR clause, where it says “OR if the post meta key name is in my list of keys, AND has a value like my search, then add to the results.”
I feel it’s a little clunky, but it works.
**Categories:** How To
**Tags:** post meta, search, wordpress
---
### [Post Meta, Custom Post Meta, and Statistics](https://halfelf.org/2016/post-meta-custom-post-meta-statistics/)
**Published:** August 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** More fun with post meta, CMB2, statistics, and numbers.
**Content:**
I do a lot with [weird stats](https://halfelf.org/2016/chart-js-fun/). I do a lot with [CMB2 and custom meta](https://halfelf.org/2016/custom-terms-cmb2/). I do a *lot* with [CMB2 and weird post meta](https://halfelf.org/2016/cmb2-dropdown-years/).
Is it any surprise I wanted to add my new year dropdown data to my site for some interesting statistics?
Of course not. But I started small. I have a saved loop called `$all_shows_query`
This really just gets the list of all the shows and holds on to it. The meat of the code runs with this:
As mentioned, there are more if statements, like `if ( get_post_meta( $show_id, "shows_stars", true) ) {...}` which gets data for if a show has a star or not. And `if ( get_post_meta( $show_id, "shows_worthit", true) ) {...}` which checks if a show is worth it or not. I was already doing a lot of this, so slipping in one more check doesn’t hurt.
To show the data, without [Chart.js](http://www.chartjs.org), it looks like this:
With Chart.js, it looks like this:
Right now the data’s a bit off, since I’ve only updated 200 of the 325 shows, but it’s enough to get the information.
**Categories:** How To
**Tags:** charts, coding, stats, wordpress
---
### [Passing Variables in WordPress Templates](https://halfelf.org/2016/passing-variables-wordpress-templates/)
**Published:** August 26, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Passing variables and parameters and overriding when needed in your theme.
**Content:**
I don’t theme, generally speaking. I’m not *bad* at it, I just don’t have that particular aspect of ‘design’ in my head where I can create out of nothing. What I can do (and do do) is tweak the heck out of themes. This means I’m sure, if you theme, you know all this and think I’m a bit silly. That’s okay.
One thing I hate about code is duplicated effort. I don’t mind including the same library in 100 different projects, but I hate when I have to use the exact same code over and over in multiple files. Like I did in my theme.
I talked about [using Chart.js in my theme before](https://halfelf.org/2016/chart-js-category-statistics/), and in that work I made use of `get_template_part()` to show the includes. It actually doesn’t look like that any more. Here’s the original code:
And here’s the current code:
While `get_template_part( 'stats' )` calls the file `stats.php`, the call to `get_template_part( 'inc/statistics', 'shows' );` gets `/inc/statistics-shows.php` instead.
This lets me organize things a little better. My `/inc/` folder is filled with this:
As the help doc says, this makes it easy for a theme to reuse sections of code and that’s actually what I’m doing.
I have a call to `get_template_part( 'inc/archive', 'characters' );` in multiple files, including some page templates but also in my category and taxonomy lists.
That means if it’s a show, use one format, and if it’s a character use another.
But…
One of the things I do is a little weird. On the single display pages for shows, I loop through all the characters related to the show and display them. There’s custom post meta to link the two, and what I do on the single page (`single-post_type_shows.php`) is grab the value for the post-meta of ‘shows’ on every single character page, and if the show ID is the same as the post ID of the page you’re on, add the character to an array.
This is not very efficient. I know. It’s basically running an extra loop on every ‘show page’ load and collecting this query. What’s important here though is the array:
This is important because I needed to *pass* this data through to my template part. On the template page for characters, I call `get_template_part( 'inc/excerpt', 'characters' );` and it works fine because it knows exactly what page it’s on and calling `get_the_post_thumbnail()` will work because of what show it is. But when I call it from the shows page, though, it tried to use the values based on the show page, not the character.
What I needed to do was pass the parameters of the character array to the excerpt. And you can’t do that with `get_template_part` but you *can* with a different call.
This passed through my array, which let me call it with a nice for-loop :
And now my excerpt template can use `$character['title']` and everything looked great on the show pages.
They did not, however, look so great on the character page, which used `get_template_part` remember. This was simply because the array for `$character` was empty. In order to make this work for the single character page, I had to recreate the array. Only I did it a little differently.
The reason I wiped out the content (which held `get_the_content` in the original array, remember) is that on a single character page, WordPress knows to show the content, so I don’t need to double that work. I also added in new array items for `ischar` and `shows` so I could check `if ( $character['ischar'] !== true ) {...}` in some places and show slightly different content depending on what page I’m on.
Whew.
**Categories:** How To
**Tags:** coding, themes, wordpress
---
### [Chart.js Category Statistics](https://halfelf.org/2016/chart-js-category-statistics/)
**Published:** March 23, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using Chart.js for pretty charts is pretty simple once you get the hang of it.
**Content:**
One of the sites I work on is using the [Metro Theme](http://www.shareasale.com/r.cfm?b=453419&u=728549&m=28169&urllink=&afftrack=) by [StudioPress Themes for WordPress](http://www.shareasale.com/r.cfm?b=241369&u=728549&m=28169&urllink=&afftrack=). And on that site, I have a page dedicated to some odd stats based on the categories and tags and custom taxonomies.
What I have is a post type ‘shows’ and a custom taxonomy called ‘clichés’ and from that I was easily able to generate a percentage of how many shows use the cliché of queers in law enforcement (38%) or how many have the death of a queer (also 38% right now). But that wasn’t enough. We wanted ‘pretty graphs’ and for that I needed a tool like Chart.js and a little PHP magic.
## How to Chart.js?
[Chart.js](http://www.chartjs.org/) is a super cool and super responsive and super flexible way to include a chart. And using it is incredibly easy once I figured out that I could just use inline script tags. A very basic chart that would show you how many days each month has looks like this:
If you’re using WordPress, you’ll want to use wp\_enqueue\_script to call it. Here’s what I did for my theme:
But that’s the basics of it. Once I understood that, I was good to go.
## The Code
Before I can do anything, I need to make sure I have the data I needed. What I wanted was a list of all the shows that were published and a list of all the cliches, ordered in the way I need them. The order is simply comma separated values, enclosed in quotes, enclosed in brackets:
And the data is similar:
Since I’m lazy, I checked that the array worked if it ended in a , and it did! That means my PHP looks like this:
And my js looks like this:
You may notice the simple call of `` in there? That’s where it outputs the data I sorted out in the PHP section. Done. I’m could put it more inline, but I liked to separate them as much as I could.
## Putting it in the theme
This is a Genesis theme so while I am making use of the Genesis loop, the call to `get_template_part` can be used by anyone. I’ll explain in a moment. First, here’s the page template:
This works like any other page template. You make a page, you select the template, and it loads this custom design.
The magic sauce is in `get_template_part( 'stats' );` which calls the file `stats.php` and that file has all the code you saw above. This means I can edit my post with all the explanations I want, and then it always outputs the stats on the bottom. By calling the Genesis code in the bottom, I retain all of it’s magic while pulling in what I want.
## The Result
Looks nice, doesn’t it? I’m quite fond of it.
**Categories:** How To
**Tags:** coding, hosting, javascript
---
### [What They Don't Tell You](https://halfelf.org/2016/dont-tell-you/)
**Published:** September 9, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you prick us, do we not bleed? If you tickle us, do we not laugh? If you poison us, do we not die? And if you wrong us, shall we not revenge?
**Content:**
I wear a lot of hats in the Open Source World. I help teams. I represent and direct others. I herd the cats of software. I allow my name to be known. People talk about how we’re doing a good job, working hard, working together trying to make things better. They talk to you about the wonderful feeling of success that comes with releasing a product. They tell you about the joy, the friendships, and the community.
Well. Here’s what they don’t tell you.
They don’t tell you about the bad days.
They don’t tell you about the week you will spend being blamed and slandered and lied about in blog posts and on Social Media because people know half of thing.
They don’t tell you about the fact that you *can’t* speak up and defend your actions because it’ll make things worse.
They don’t tell you about the subtle misogyny that makes you wonder if it’s there at all.
They don’t tell you about the gut churning nausea you’ll feel about turning on your email and watching wave upon wave of hate-mails come in.
They don’t tell you about the dick pics and come ons.
They don’t tell you that even when you can explain yourself to your friends, you’ll have to make sure they know *not* to speak up on your behalf because it won’t help.
They don’t tell you that you can make it worse by being outspoken.
They don’t tell you that crying will make people feel they’re right.
They don’t tell you that people won’t even consider that their words cut you to your very bone.
They don’t tell you that even if a great many people respect you, it doesn’t make you feel any better.
They don’t tell you that someone will say ‘it’s all in your head.’
They don’t tell you that you will have to wait it out.
They don’t tell you that you will have to suffer.
They don’t tell you that the phrase “Just joking!” doesn’t ease the wounds.
They don’t tell you that even with all the support in the world, there are days you will feel absolutely, 100%, alone in your community.
All those good and wonderful things? They’re true. And I wouldn’t change the past if I could. Contributing to open source has enriched my life in many ways. It’s taught me more about myself that I could have imagined. It’s taught me how much I can stand and take though. It’s taught me that sometimes, somedays I will stand with my name and my work being spoken ill of, with my actions being second guessed and criticized, and I will have no succor or recourse.
I will have to stand there and take it and wait and say nothing and do nothing except the best I can do.
What’s the point of this? There isn’t one. This post isn’t a cry for help or a request for my friends to come to my defense. It’s a reminder for all of us that these things happen, and there will be days we feel worthless. Where we feel beaten down and angry and that we want to cry or do *something* and we just can’t because we know in our hearts it will make things worse.
But maybe the point is this.
I feel that way too. Everyone does.
So you’re not alone at all.
*Comments on this post have been disabled.*
**Categories:** How It Is
**Tags:** community, essay, open source
---
### [Let's Encrypt cPanel](https://halfelf.org/2016/lets-encrypt-cpanel/)
**Published:** August 19, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Are you there, server? It's me, Let's Encrypt. Making your sites more secure.
**Content:**
On August 10th, cPanel announced [provisional support for Let’s Encrypt via AutoSSL](https://blog.cpanel.com/announcing-cpanel-whms-official-lets-encrypt-with-autossl-plugin/).
For hosts like DreamHost to be able to implement Let’s Encrypt is a lot easier than a behemoth like cPanel. See, DreamHost only had to make sure it worked on their own servers. They have a homegrown panel that they have 100% full control over. Adding in how to install the code on all servers and how to integrate it requires less testing than cPanel, who has to make sure *everyone* who uses cPanel can use this.
As of version 58 of cPanel, everyone can. And it works.
## Installation
Log in via SSH and run this as root:
That installs everything you need. Keep in mind, this *only* adds LE to the AutoSSL feature. It’s AutoSSL that whips up SSL certificates for cPanel accounts. Doing this install *does not* install certs on your domains. We have to configure it for that.
## Configuration
Once you’ve installed the code, go to WHM: Home » SSL/TLS » Manage AutoSSL and set it to Let’s Encrypt:
If it’s your first time, yes, check **Create a new registration with the provider.** because you’re new. You only need to mess with that if you’re new or have to reset registration for some reason.
By default, AutoSSL is set to run based on your “Feature List Setting” (under Home » Packages » Feature Manager » Edit Feature List). Mine has it checked, which means it will automatically run.
## Adding Existing Domains
This worked great *except* I had a bunch of domains using [StartSSL](https://www.startssl.com/). First off, I adore StartSSL, and the recent changes to their website make it so much easier to use. But I was using it for external free certificates where I didn’t want to pay for them, on domains that never see money. Some of them (most of them) I wanted to convert to LE.
For that, I deleted the StartSSL certificates in WHM and cPanel for the domains/account in question. Then I went to AutoSSL, clicked on the tab “Manage Users,” and clicked “Check USERNAME.” I did *not* pick check all users (which is at the top of the page) because I don’t want to check all users.
## Adding New Domains
I love this part.
Do **nothing**.
No, really. Add the new domain, wait twelve hours, boom. New certificate. If you have to have it right now, go into WHM and click check for that user. But it’s automatic. Hence ‘Auto’ SSL you see.
## Caveats!
This is something only controlled by the server admin. Per-site cPanel doesn’t get an option, however if they delete the LE cert and add their own, that will override it.
There’s a limit to how many times you can make certificates *and* how many you can make. As the warning says:
> Certificates that Let’s Encrypt provides through AutoSSL can secure a maximum of 100 domains per virtual host.
> Let’s Encrypt will issue a maximum of 20 certificates per week that contain a domain or its subdomains. If you include subdomains of a domain on more than 20 certificates, Let’s Encrypt will issue those during the next window, up to the limit for that week.
If you’re using a wildcard subdomain (`*.ipstenu.org` for example) in order to make things easier with Multisite, this won’t work. You’ll see a ton of errors in your logs. Not to mention it won’t make SSL certs for all the virtual subdomains. That’s because they’re *too* virtual. You’ll have to make an actual add-on subdomain or use a domain alias for LE to pick that up.
You can’t revoke a certificate either, which can be a problem should there be a security issue along the lines of [Heartbleed](http://heartbleed.com/). When that happened, we all had to reset our SSL certs as well as patch our servers. Lots of fun. Should that happen again, cPanel users will have a big problem.
It’s because of that I don’t want to use Let’s Encrypt on *everything*. I’ll use it on this domain, and my other normal ones, but my WMH domain and my stores use a Comodo Certificate.
**Categories:** How To
**Tags:** let's encrypt, security, servers, ssl
---
### [Making HTTPS Everywhere](https://halfelf.org/2016/make-https-everywhere/)
**Published:** August 24, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making everything secure is easier than you may think.
**Content:**
With the advent of [Let’s Encrypt](https://letsencrypt.org/), introducing free and easy SSL certificates for everyone, and the fact that [Plesk](https://devblog.plesk.com/2015/12/lets-encrypt-plesk/), [cPanel](https://blog.cpanel.com/announcing-cpanel-whms-official-lets-encrypt-with-autossl-plugin/), and [home grown Panels like DreamHost’s](https://www.dreamhost.com/blog/2015/12/03/lets-encrypt-and-dreamhost/) all providing easy ways to install certs, renew them, and support them, we’re finally inching our way to the dream of HTTPS Everywhere.
## Why HTTPS?
The S makes it secure, and the green lock on a browser tells a person that their visit is safer, encrypted, and obscures sensitive data. It means a visit is confidential. It means the site is the real site. It cannot be easily monitored, modified, or impersonated.
While this blog has no sensitive data of yours, it does accept (require) your email when you leave a comment. You don’t want everyone knowing that, I suspect. You probably don’t want everyone grabbing your IP.
Why do we care about security in general? Because [nothing is non-sensitive anymore](https://https.cio.gov/everything/). Everything we do and say on the Internet can be used against us. Entering in your mother’s maiden name on a form over HTTP? Someone can snipe that and use it to steal your identity. Use the same password on multiple accounts, one of which is HTTP? Your code can be stolen. The list goes on and one.
## How I Turned This Site HTTPS Everywhere
Every single domain on `ipstenu.org` is now https. Everyone either has the Let’s Encrypt certificate or a Comodo one. First I [turned on Let’s Encrypt](https://halfelf.org/2016/lets-encrypt-cpanel). Then I used WP-CLI to search and replace my urls:
And so on and so forth down the line.
Next I checked my `mu-plugins` folder and my `content` folder to make sure none of my home grown code was hardcoding in http (it wasn’t), and updated my `wp-config.php` to include this:
That probably wasn’t required but why not? Finally I tossed this into my `.htaccess`:
Really. That’s all it took to swap it all to https everywhere here.
## Gotchas
Not *all* my plugins were happy about this.
Most were, actually, which was nice, but a couple did some incredibly stupid things with hardcoded `http` resources. Fixing them for myself is trivial. For others… I recommend [WordPress HTTPS](https://wordpress.org/plugins/wordpress-https/) or [Really Simple SSL](https://wordpress.org/plugins/really-simple-ssl/), both of which will let you force https for all URLs or block the http ones.
For the most part, with WordPress, you don’t need to worry about this. In recent years, the ability to force SSL from within WP itself has gotten better and better. The problem has always been our themes and plugins.
Other than that, it’s been pretty smooth going.
## Non WordPress
But… what about my non-WordPress sites? Yeah, you know I have them.
Well my [ZenPhoto20](https://github.com/ZenPhoto20/ZenPhoto20) site doesn’t run any extensions, so I just checked the box for using SSL and went on my way. I’d cleverly written all my themeing with protocol-less URLs (`\\example.com\my\path\file.css`). While that’s really an anti-pattern, and https should be used whenever possible, I had everything in one file so I search/replace’d that and it was done.
My [Hugo](http://gohugo.io) site required two changes to a config file. It looked like this:
The reason I did that was so my templates could look like this:
Once I saved the variables in my config, I could push the site (which [automatically rebuilds and deploys](https://halfelf.org/2015/deploying-hugo/)) and be done.
**Categories:** How To
**Tags:** hugo, wordpress, zenphoto
---
### [Elasicsearch as a Service](https://halfelf.org/2016/elasicsearch-service/)
**Published:** August 17, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Getting started with Elasticsearch involved me determining running it on my own was a bad idea.
**Content:**
Search is hard. Searching when you have custom meta data in post is harder. By default, WordPress *does not* search your custom meta data. And my [LezWatchTV](http://lezwatchtv.com) site is 75% custom meta data.
I’d been using Google Search, but that has a lot of issues of it’s own like privacy, ads, accuracy, and most importantly, no way to tune it. I decided to try out [ElasticSearch](https://www.elastic.co/) since I knew that was what WordPress.org’s internal search engine was going towards. After I [added custom post meta to my search content](https://halfelf.org/2016/search-custom-post-data), this post was going to be about how to install Elasticsearch on an ELK stack on DreamCompute, which turned out to be rather easy if time consuming and messy. And getting WordPress to work with it was as easy as installing the [ElasticPress plugin](https://wordpress.org/plugins/elasticpress/) (thank you 10up).
What was *complicated* was making Elasticsearch work remotely. By default, it wants to only be accessible locally for your own security. But adding in Shield and still having all the logs and pretty things to understand what was happening and how to manage it when it was all new escalated quickly. It was simply too much all at once for me. Instead I decided to look into Elasticsearch as a service.
There are a lot of options here,
## Self Managed
I know I said ‘as a service’ but you really can use [DigitalOcean](https://digitalocean.com) or [DreamCompute](http://dreamcompute.com) to do this. And there’s all sorts of documentation about how to do it available (like [DigitalOcean’s ‘How to install the ELK Stack on Ubuntu 14.04’](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) which works on DreamCompute too). And [Amazon Elasticsearch](https://aws.amazon.com/elasticsearch-service/) is also an option here.
But… they’re all very self-managed. They require you to jump into servers, run a lot of commands, and they’re not new user friendly. Look, I get that this is complicated stuff, but people aren’t going to know *if* they want to learn all this if you make it monumental to get into.
## Services
You can break these down into two main types.
Enterprise Level:
- [Elasticsearch Cloud](https://www.elastic.co/cloud)
- [ElasticPress Service](https://www.elasticpress.io)
- [Qbox](https://qbox.io/)
Free ‘Trials’:
- [Bonsai](https://bonsai.io)
- [Searchly](http://www.searchly.com/)
I wanted to use something ‘free’ to get started so I could figure out what I wanted to do and how to properly use Elasticsearch before deciding if I wanted to pay. But also I wanted to figure out exactly to do with search. Therefore I needed something ‘free’ to test with, something with logs, that would help me understand it all. I ended up trying both Bonsai and Searchly. While Bonsai gave me more room, Searchly had more information to the interface, but *neither* had a ‘Hey, here’s how you tune Elasticsearch!’ page.
Neither had Kibana 4 though, which is a little sad.
So when you don’t know how to do ‘anything’ with Elasticsearch, what can you test? The same search. I checked which was faster, which was more accurate, and which had the results I wanted. Bonsai was the winner here, so that’s what I went with.
## Integrating WordPress
Thankfully this is the easy part.
Install the [ElasticPress plugin](https://wordpress.org/plugins/elasticpress/). Go to Settings -> ElasticPress and add in the URL from your Bonsai panel as your Host. It should look like `https://username:password@yourcluster.us-west-2.bonsai.io` (with some variation based on location). Save, press the ‘Run Index’ button, and you’re done.
The nice thing about the plugin is if it breaks (like the service goes down), the plugin reverts to WordPress search! Which isn’t great, but … well.
Next? How do I tune Elasticsearch?!
**Categories:** How To
**Tags:** search, service, wordpress
---
### [Search Options for Custom Post Data](https://halfelf.org/2016/search-custom-post-data/)
**Published:** August 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Searching custom meta data in WordPress isn't default. And that is sad.
**Content:**
I use [CMB2](https://github.com/WebDevStudios/CMB2) to add in a bunch of custom meta data for my posts on a site. Seeing as I’m using it to allow layouts and formats to be consistent, it’s not surprising that I’ve chosen to split out my data like that. In another world, maybe it would be done differently, but this works.
Except that search sucks. WordPress *doesn’t* search custom post meta out of the box which just kills me. That meant all the data I stored in for names and dates was never getting searched. There are two ‘easy’ solutions for this at least.
## Google Search
Ew. I know. But ew. Since I’m using Genesis as my theme, it’s not super hard, just a little weird. Assuming you already have a [Custom Search Engine](https://cse.google.com/cse) set up, and you’re using Genesis, here’s what to do next.
First I added this into my `functions-site.php` (note: I made a `functions-site.php` file so I can easily update my `functions.php` file on the rare occasion I need to update the child theme – it’s really rare – but also so I always know what’s me and what was Genesis):
Then I made a custom page template thanks to [Rick Duncan](http://www.rickrduncan.com):
Finally I added a page called “Search Results” and assigned it this template. Done. Google, who searches the whole page content, will get everything. It just looks like Google.
## Having WordPress search your Custom Post Meta
This was surprisingly annoying, but not as hard as all that. Adam Balee wrote [Search WordPress by Custom Fields without a Plugin](https://adambalee.com/search-wordpress-by-custom-fields-without-a-plugin/) which, I know, is ‘without a plugin’ and sort of silly, but I put that in as an MU plugin and it worked perfectly!
This is not the most efficient search, I know. But it works and gets my data where it’s needed.
**Categories:** How To
**Tags:** search, wordpress
---
### [Greylist, RBLs, and Spam](https://halfelf.org/2016/greylist-rbls-spam/)
**Published:** August 10, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stopping spam a little more inventively than just saying "If there are 100 recipients, these are bad..."
**Content:**
Recently I noticed I had 13 spam emails all from the same ‘company.’ The content was incredibly similar, though subtly different. The from email was always different, but you could tell by looking at it that it was the same. And even more damming, it all had ‘junk’ content and 100+ recipients. But for some reason, [SpamAssassin](http://spamassassin.apache.org/) wasn’t catching it!
After 5 emails came in back to back, I decided to do something about it.
At first I was trying to find a way to tell Spamassassin or Exim how to auto-turf the emails with 100+ people listed in the ‘To’ field. This proved to be a little more difficult and complicated than I wanted, and I was sure that these spammers would catch on to that sooner or later.
What I really wanted was for Spamcop to pick up on this, but I’ve been sending them in to no avail for a while. That got me looking into how cPanel handles Spamcop in the first place.
## Real-Time Blackhole Lists
cPanel uses RBLs, Real-time Blackhole Lists, to determine if an email sent to you is spam or not. By default, it comes with [SpamCop](https://www.spamcop.net/) and [Spamhaus](spamhaus.org). That means it will reject mail at SMTP time if the sender host is in the bl.spamcop.net or zen.spamhaus.org RBL. Well that was well and good, but could I add more to that list?
Of course. I pulled up [cPanel’s documentation on RBLs](https://confluence2.cpanel.net/display/ALD/Exim+Configuration+Manager+-+Basic+Editor#RBLs) and determined I could add as many as I wanted. On the top of the Basic EXIM Editor is a link to **Manage Custom RBLs** which is what I wanted. All I had to do was figure out what to add.
After reading through [WikiPedia’s comparison of DNS blacklists](https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists), I picked a few and tested the latest emails that had come through, looking for ones that caught them. Then I tested known good emails and made sure they weren’t caught. I ended up adding [Barracudacentral](http://www.barracudacentral.org/rbl) and [IPRange](http://iprange.net/rbl).
## Greylisting
The next thing I did was introduce [Greylisting](https://documentation.cpanel.net/display/ALD/Greylisting) to my email. They way Greylisting works is that if it doesn’t recognize the email, it will *temporarily* reject it and tell it to resend. If the email is real, the server tries to send it again after a little while. There are some downsides to this, as it’s possible for a legit email to be trapped for a few hours (or days) if someone’s set up their server poorly. On the other hand, within half an hour, I blocked 11 emails.
I mean. I’m pretty sure `monica@getoffherpes.com` is spam. You know what I mean?
This was super easy to do, too. I turned on Greylisting, I restarted Exim, I walked away.
Okay no, I didn’t. I sat and watched it to see if anyone legit got caught (one did, it passed itself through properly).
## Result?
A little less spam. I don’t expect this to work for everything, but it had an immediate impact on many of the spam emails that were annoying me.
**Categories:** How To
**Tags:** cpanel, email, servers, spam
---
### [CMB2 And The Dropdown Years](https://halfelf.org/2016/cmb2-dropdown-years/)
**Published:** August 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a year-range in CMB2 is easy (if you befriend a developer).
**Content:**
At WordCamp Montreal, I mentioned the [database of dead lesbians](http://lezwatchtv.com) that Tracy and I maintain. The camper looked at it and said “You know it would be awesome if you showed the shows airdates.”
Good point! Except I just plain struggled with the concepts and how to do them in CMB2. I knew I could make multiple fields in one ‘metabox’ as I read up on the [snippet for an address field](https://github.com/WebDevStudios/CMB2-Snippet-Library/blob/master/custom-field-types/address-field-type.php), but try as I might, I couldn’t make it work.
I tweeted my headache and ended up talking to Justin Sternberg who asked me if I could explain my use case better.
> I have 300+ posts, all of which have a start and end date. Some may have an end date of “current” however.
>
> Examples of valid data:
>
> - 1977-1979
> - 2016-current
> - 2000-2016
>
> I also need to sort by start and end year. So I can search for all posts with a start of 2014.
>
> I could have two year-sorts, easily, but that makes for a clunky interface as it would be separate fields. I know CMB2 can have a combined field (like addresses) but while I got it to save, it wouldn’t properly display on the edit page.
>
> This only needs to be editable on the WP admin edit post.
That night, he replied and asked if [this year-range field type](https://github.com/WebDevStudios/CMB2-Snippet-Library/blob/master/custom-field-types/year-range-field-type.php) would work.
Mind? Blown. It works exactly how I need it to. I tweaked the code (and threw in a pull request) to set up a way to reverse the years (show newest first) which is more useful for my needs.
Now? Editing 319 show entries.
**Categories:** How To
**Tags:** development, plugins, wordpress
---
### [Backtrack to Clean Code](https://halfelf.org/2016/backtrack-clean-code/)
**Published:** August 3, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We walk backward through code to find the clean data and resolve our problems.
**Content:**
I was watching *The Bletchley Circle*, about four women who were part of the code breakers in World War II, and how they stumbled upon a serial killer because only they could see the patterns. In the third episode of the first season, the main character is trying to explain why understanding the killer, Crowley, from before he started killing, and she says the following:
> At Bletchley, when we came across corrupted data, we had to backtrack till we hit clean code. That’s how you find an error in the pattern. All Crowley’s giving us is corrupted data.We need to backtrack to before he was killing. We need to start from there. That’s how we’ll find him.
I’d never thought of it in those words, but that’s exactly right.
When we debug code, when we find errors, we always backtrack to clean code. Most of us aren’t trying to find psychopaths and serial killers, of course. What we’re trying to do is find the patterns and understand what went wrong. And many times, we’re trying to find patterns when the telling of the breaking doesn’t lend itself to any patterns.
Think about how you describe a situation, how you explain what’s broken. You start with your part. “I was trying to do X.” Then you explain what you expected to happen. “Normally that makes the color blue.” Next you say what did happen. “Instead, it made the color red.”
That’s all well and good, except there’s a great deal missing. Some of it will be pertinent and some won’t. Some will be overkill and useless signal to noise, and some minutiae will be just what is needed to solve a problem. The difficulty is that you may not know what happened that is important. If all you know is ‘I upgraded WordPress’ for example, then you may not be aware of all the changes that went into the WP\_Http API. You may not know about the new Multisite functions.
If you’re not a developer, reading the field guide for WordPress 4.6 RC1, and all the linked posts, and did a compare of 4.5.3 to 4.6-RC1, then maybe you’d be surprised when your plugin breaks. And while you thought well of yourself for testing on the release candidate, you’re stunned at how much changed, and not sure what on earth happened.
So you backtrack. You know that the magic sauce is in the requests sent to the server. And you know you’re using `wp_remote_request()` to do it. So you look at anything related to that. What does it call? Did that change? You step back and back until you find as much as you can, and when you’ve determined it’s ‘something,’ you reach out for help.
In WordPress, this is why we tell people to switch to default themes or disable plugins. We’re asking people to backtrack to code we know is clean. We can’t read minds and know the little things. So we ask people to backtrack in the most obvious ways. “Does it happen with all the other plugins off?”
Backtracking to clean code.
**Categories:** How It Works
**Tags:** debug, troubleshooting
---
### [Mobile Ad Detection](https://halfelf.org/2016/mobile-ad-detection/)
**Published:** August 5, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some simple mobile detection for Google Ads.
**Content:**
I screwed up not that long ago.
I got an email from Google Adsense telling me that one of my sites was in violation because it was showing two ads on the same mobile screen, which is not allowed. Until I started using some of Googles whole page on mobile ads (an experiment), this was never an issue. Now it was. Now I had to fix it.
Thankfully I knew the simpliest answer would be to detect if a page was mobile and not display the ads. Among other things, I know that *I* hate too many ads on mobile. So all I wanted was to use the Google [page level ads](https://support.google.com/adsense/answer/6245304) – one ad for the mobile page, easily dismissible. Therefore it would be best if I hide all but two other ads. One isn’t really an ad as much as an affiliate box, and one Google responsive ad.
For my mobile detector, I went with [MobileDetect](http://mobiledetect.net), which is a lightweight PHP class. I picked it because I was already using PHP to determine what ads showed based on shortcodes so it was a logical choice.
Now the way my simple code works is you can use a WordPress shortcode like `[showads name="google-responsive"]` and that calls a file, passing a parameter for name into the file to generate the ad via a mess of switches and sanitation. Really you can go to `http://example.com/myads.php?name=leaderboard` and it would show you the ad.
The bare bones of the code looks like this:
The secret sauce is that check for two things:
1. Is the ad *not* one I’ve authorized for mobile?
2. Is this mobile?
Only if both are false will the script continue to run. It’s simple but I like to have things stop as soon as possible to make loading faster. There’s no css trickery to hide things via mobile size detection. It’s as simple, and as close to a binary check as I can make it.
**Categories:** How To
**Tags:** mobile, php
---
### [Long Term Vision](https://halfelf.org/2016/long-term-vision/)
**Published:** August 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** While it may seem 'easier' to make multiple separate plugins that all do similar things, long term it makes your developers crazy and hurts your users.
**Content:**
[Say what you will about Jetpack](https://halfelf.org/2013/jetpack-koolaid/), the plugin serves a great purpose in a few major ways.
1. Once you register for the API, you never have to again.
2. Everything is easy to find to update and configure (Menu -> Jetpack).
3. New Features are added and you don’t need to install a new plugin.
Now look at something else. A company released over a dozen Facebook plugins. All the plugins required you to connect via their API (a separate connection in each). All the plugins required you to use their admin panel to set up a per-plugin configuration. All the plugins deleted those settings on deactivation. Or how about a WooCommerce related set of plugins that all required the use of their API (legitimately) but all the plugin did was connect you and send you to where that specific plugin part was configured?
Got that in your head? Good. Now what if *Jetpack* did that? What if to enable aspect of Jetpack you had to install Jetpack Stats, Jetpack Comment Form, Jetpack Subscriptions, etc etc etc.
You’d *hate* Jetpack. And worse, the Jetpack developers would too. They’d have to work extra hard to ensure all the suite of plugins conformed to style and protocol. Shared libraries? Gotta update them in *all* of the plugins. Oh and don’t forget to make sure they’re all backwards compatible in case someone updates one but not another. Figure out which one takes priority, make sure someone else’s changes on Stats doesn’t break Comment Form, and on and on and on.
There’s a reason Jetpack works as well as it does, and it’s not just because Automattic is behind it. Jetpack has one sign up, one registration, one setup for the connection. Each sub-app is toggled via Jetpack. New additions, when the main plugin is updated, are all easily checked for backcompat and everyone tests together before pushing out.
So why do I call this the long view?
Because the long view considers not just adding new users to your system, but keeping them in a way that makes them happy. The long view looks at the reality that your developers will leave. The long view thinks about the easiest way to maintain a lot of code. The long view makes sure that introducing old users to new things is easy.
And that means, the long view would look at your 15 or 20 plugins that all use the same ‘base library’ and tell you it’s a shitty plan. It’s more hours on more code with more potential conflicts. It’s less cross-code checking. It’s more testing. It’s more unit tests that have to be repeated over and over.
The biggest reason I see people argue that 18 plugins is better than 1 is ‘SEO.’ The quotes are there on purpose. Because it’s bullshit. Anyone who thinks 18 plugins will net you better SEO than one, well written, well curated document file on the master plugin has failed at SEO school and needs to meet Ted. Ted is a 12 inch lead pipe that the boss keeps in the top drawer of his desk at DreamHost. No, not really. But the point remains, they’re not an SEO Expert.
Content is king. Remember that? [Duplicate content is bad](https://support.google.com/webmasters/answer/66359?hl=en).
> However, in some cases, content is deliberately duplicated across domains in an attempt to manipulate search engine rankings or win more traffic. Deceptive practices like this can result in a poor user experience, when a visitor sees substantially the same content repeated within a set of search results.
That applies to your code too. Duplicate code, duplicate functionality, is bad.
Now there is always a time and a place for multiple separate plugins. I only want to use [Easy Digital Downloads](https://easydigitaldownloads.com/?ref=3359) extension for Stripe, not any other payment gateway. So I don’t need the extra plugins in a ‘payment gateway suite.’ But there, EDD cleverly has all the base code in their plugin and the add-ons just enable more features. [Yoast’s Video SEO](https://yoast.com/wordpress/plugins/video-seo/) is similarly an add-on. They didn’t waste time making a dupe of their main SEO plugin just to add in videos.
I hope the point is made. You can make your code simpler, easier to maintain, and easier for your users to find the new things if you keep it all in one. And that is a win.
**Categories:** How It Is
**Tags:** design, development, marketing, planning
---
### [The Need for Mobile Speed](https://halfelf.org/2016/need-mobile-speed/)
**Published:** July 27, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Contemplating how terrible the modern web is on a slow connection.
**Content:**
I took the train from NYC to Montreal, which I will never do again. It was too long, too uncomfortable, and customs actually made the TSA preferable. But while you ponder that in your back brain, I want you to consider this as well. The internet on the train sucks.
For the first time in years I was back on pre-smartphone speeds. And the problem with that is I was in a world that expected 3G or faster speeds. Here’s what would *not* load:
- Twitter
- Facebook
- Tumblr
- Most news webpages
- Anything with video
Here’s what I could do:
- Text
That was a pretty shitty smartphone experience. As I sat on the train, I wondered why it was so shitty. Didn’t we build everything to be mobile first? Wasn’t the point of the responsive systems to make it faster? Turns out we didn’t.
One of the things we do well in the modern web is device detection. If I’m on a mobile device, everything’s cool and perfect and my sites will load for that device. There are PHP libraries like [Mobile Detect](https://github.com/serbanghita/Mobile-Detect) and [Detect Mobile Browsers](http://detectmobilebrowsers.com/)\], but what they’re really doing is *device* checks, not mobile. Knowing what kind of device someone’s on lets us customize a web experience to that device, and that’s all we tend to do. We put in the hours to check “Is this a mobile device?” but not where we should be.
Of course, that’s really hard to do. Apps like [SpeedTest](http://www.speedtest.net/) and [TestMy.net](http://testmy.net/) work alright, but when you’re traveling by rail, your speed is incredibly variable and confusing. One minute I’d have 4 bars, the next 1, and then I’d drop from LTE to 3G and worse. Oh, and don’t bother asking about the WiFi. It was a joke.
Somewhat related, I travel a lot for work. I recently did a 12 day run to NYC and then Montreal, where I was in hotels most of the time. Hotel Wifi is a spotty thing. Either they charge you up to $40 a day for the privilege of their shiternet, or they give you free wifi that loads everything but images. Trying to work from hotels is a hit and miss proposition as well. I can connect, but as soon as I hop onto my VPN, everything drags.
Then we have conferences. I’ve yet to go to a tech conf where we didn’t kill the Wifi, or nearly so. While that’s kind of our faults for leaving on our various automated updaters and DropBoxes and the like, there isn’t a ‘Conference Wifi’ mode on laptops to say “Hey, I’m on a bandwidth so don’t do the automated background things please and thank you.” This is, by the way, why my presentations are always on my local box as well as online. I assume the wifi will die.
In all cases, as soon as the internet quality drops to slow, our experience online crumbles. We simply haven’t built most tools to work in a one-bar world. And much of this isn’t a solution we can easily grasp. Even the big guys, who have servers built for stress and speed, are slow in these situations. Because we assume too much. We assume minimum connectivity.
The race for faster wireless service is on, but we should step back and look at the simplification of our sites. If we can make a low-speed version that is as fully featured, we should.
**Categories:** How It Is
**Tags:** bandwidth, essay, speed
---
### [Keep A Name In Mind](https://halfelf.org/2016/keep-name-mind/)
**Published:** July 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Name your 'things' wisely for what they are and where they live.
**Content:**
When you’re making your own project for small things, it’s not a huge deal when you try to think up a name. As soon as you realize your project is going to be shared with the world, however, the game changes.
## Project Names
A project can be as massive as a new release of an operating system (Longhorn anyone?) or as small as a new plugin for WordPress. If could be a library for PHP or JS, or maybe a simple NPM add on. In all cases, the name you pick should be unique.
This gets hard when you want to name a tool something like “Foo for Bar” like “Color Coding for Quickbooks.” Wy is that hard? Well while your name is certainly descriptive, it’s not unique. Because someone else can make the same tool. “Joe’s Color Coding for Quickbooks.” Or worse… “Color Coding 4 Quickbooks.” And the problem here is that neither of you really have the right to the name, do you? You’re both leveraging ‘Quickbooks’ and their brand, so where do you have a leg to stand on when someone uses a similar name?
A unique name, though, like “Color Me Quickly,” would be so much better. Think of displaying it like this: “Color Me Quickly – A tool to colorize Quickbooks” and then having a description that talks about the idea and how to use it. “We love Quickbooks, just like you, but we hated the color schemes. We were always mixing up Receipts and Refunds. That’s why we came up with the Color Me Quickly tool. One simple install and we could see, right away, what was what. With our accessibility friendly default color schemes, and fully customizable colors, you can make your Quickbooks look how you need.”
The name is unique, the description is SEO friendly, and you will be easily able to stand out in a crowd.
## Function Names
Oh but then we have function names.
If you’re a library, please *please* **please** remember to wrap your code in “If this code is already included, do not include it again” checks. PHP has [function\_exists()](http://php.net/manual/en/function.function-exists.php) and [class\_exists()](http://php.net/manual/en/function.class-exists.php).
Using Javascript?
The point here is that if you’ve made a library, *always* make sure it’s not already running before you try to run. This is a huge issue in WordPress land. With over 45,000 plugins, the odds that two will include the same libraries are pretty high. The odds that two will have conflicting versions? Right, you got it.
But you should watch out with those checks. I’ve seen a lot of plugins use a check that if the function doesn’t exist, run their plugin. That’s a great idea, except that it’s not. If you name your function `wp_get_post()` and check for it’s existence before loading, what happens if it *does* exist? Your code won’t be called. And what happens if your code doesn’t get called? Your function won’t run. Your plugin won’t work as expected.
Function and class names have to consider their world. A WordPress plugin should never use a non-prefixed’ anything. [As Nacin says:](https://nacin.com/2010/05/11/in-wordpress-prefix-everything/)
> It’s a simple concept. Anything you create in the global namespace has the potential to conflict with a theme, another plugin (including one you wrote), and WordPress core itself. Thus, prefix everything with a unique-enough character set.
## Be Unique
Consider the environment that you code for when you name things. Always check for trademarks and possible conflicts before you name something you plan to release to the world. Remember to be unique.
Also remember it’s 2016. All the good two and three character prefixes are probably taken.
**Categories:** How It Works
**Tags:** coding, design, wordpress
---
### [Blocking Together](https://halfelf.org/2016/blocking-together/)
**Published:** July 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Blocking users on Twitter got a whole lot more interesting.
**Content:**
Out of GamerGate, the amazing Randi Harper created [Block Together](https://blog.randi.io/good-game-auto-blocker/) which allows you to block everyone associated with the nasty parts of the whole mess.
To use it, it’s two steps.
1. Sign up on [Block Together](https://blocktogether.org/)
2. Click on the link to [@randi\_ebooks’s list](https://blocktogether.org/show-blocks/5867111278318bd542293272f75147f8fc5931bea431e7ca16e9242964965d66494a6fb68f3518b82f171bcf0e419ccc) and press subscribe
That’s it. Once you do that, you’ll automatically block the masses. But this goes far further than Gamer Gate. By making a blocklist of your own, you can manage the people who regularly harass, offend, or otherwise make your life on Twitter miserable.
I’m a firm, devoted, supporter of freedom of speech. I also defend my right not to listen to someone I don’t want to hear. I don’t *have* to listen. Those blocklists can be incredibly useful to share with people, like your friends and people who face similar harassment, so you can protect yourself.
> Sharing your block list
>
> If you choose to share your block list with friends, Block Together will create an unlisted, unguessable URL to access your block list. You can share the URL by email or Direct Message if you want to keep it private among friends, or you can tweet the URL if you are okay sharing your block list publicly. You can always disable sharing from the Settings page. If you do so, the URL to access your blocks will be deleted forever. If you choose to share again in the future, you will create a new, different URL. If you choose to disable sharing, you need to separately remove any subscribers you no longer want, on the Subscriptions page.
>
> Many people find that they don’t want to share their block list because they find there are accounts on it they don’t remember blocking, or that aren’t particularly abusive. This is partly because Twitter, for a long time, did not offer Mute. So if you wanted to stop seeing a merely unfunny account that gets frequently retweeted, blocking used to be the only fix. Now Twitter offers Mute, so you can Mute those accounts instead. Block Together makes it easy to remove them from your shared block list with the ‘Unblock and Mute’ button on the My Blocks page.
I don’t public share my list. I have shared it to a few people, but since I block rather than mute people, it’s very easy for people to take offense at me putting them on the list. To me, blocking someone means “I don’t chose to have conversations with you in this manner in Twitter.” There are companies of friends I’ve blocked because they follow me to Twitter after a conversation on the Plugin Repository team.
Actually for me, most of my blocked people are either people who have violently responded to social activism tweets, people who tweet me thinking that’s a faster way to get their plugin approved/reviewed, people who are implicitly aggressive towards me without taking the time to learn the whole story, concern trolls, and passionate people who have gone overboard.
Yes, I block people who ping me about their plugins. My Twitter account is not the right way to address those things. Neither is Facebook. People who cannot respect the fact that I’m not working 24/7 don’t deserve my attention. I block them, and all the begging in the world won’t change that. I block probably faster than most people would consider ‘fair’ but it’s my Twitter account, not theirs, and I have a way I wish to control access and information. I need a reason to block people, but I’m not required to explain that to everyone.
But if I make that list public, people would probably use it as leverage to harass me more or treat me worse. They have in the past. It’s the double edged sword where I want to help my friends but I need to protect myself. For now, my list will be private to people whom I know well only, and who won’t take it as offensive.
**Categories:** How To
**Tags:** essay, freedom
---
### [Hiding Custom Taxonomy Parents](https://halfelf.org/2016/hiding-custom-taxonomy-parents/)
**Published:** July 20, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Short and simple (and effective) way to prevent people from manually making children categories.
**Content:**
I have a few custom taxonomies that I want to be shown as textboxes and in order to do that, the simplest way is in the custom taxonomy, you set them up as hierachical true. This makes them behave like categories. The problem is I really *don’t* want these things to be hierarchical. That is, I don’t want people adding in a parent/child relationship.
The simplest way around this is to cheat with CSS:
That hides the parent value. In order to have it show on the proper pages, I put it in a file called `shows.css`, in the same folder as my `shows.php` file that controls all the settings for the shows CPT (this includes the custom taxonomies used by shows) and wrapped it in this:
Now you can’t see that there are parents. Perfect. Done.
**Categories:** How To
**Tags:** categories, coding, wordpress
---
### [WordPress Multisite: Block Site](https://halfelf.org/2016/wordpress-multisite-block-site/)
**Published:** July 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's not actually very easy to protect yourself online when you can't block people who are offensive or abusive.
**Content:**
This came up when I was looking at WordPress.com, where one has the freedom to post anything [within their ToS](https://en.wordpress.com/tos/), and I saw someone’s moronic blog about how specific people were evil. Pick whatever you want, it doesn’t matter except assume it was something offensive to a minority.
The Terms of Use says this:
> In particular, make sure that none of the prohibited items (like spam, viruses, or serious threats of violence) appear on your website.
This was not a serious threat of violence, it was just ignorant, offensive, and stupid. I looked at the site and thought “What I want most in this moment is a big ass button to block this person from posting on my .com site, and to prevent them from ever being able to comment on any blog I own.”
It doesn’t exist. (I will note I found [BuddyBlock](http://www.philopress.com/products/buddyblock/) but I have no idea how well that would work, and it’s for BuddyPress only.)
Part of the cool thing about WordPress Multisite is that you can run your own social network. With that power comes responsibility though. Users should be able to protect themselves while remaining on your network, allowing them to block other users they just don’t want to talk to.
So why don’t we? Well effective blocking is hard. As I mentioned in my post about how (most) [contact forms fail at this](https://halfelf.org/2016/mailbag-contact-forms-fail/), the biggest issue is people can just fake who they are are try again. This is a little harder on a Multisite, where a legitimate email and account can be required to comment, but by default all members of a network can comment on any blog on the network. This means we’re opening ourselves up to the potential to more abuse.
How would that big block work? There are a few approaches and I think the best route would be two fold.
## Blocking Users
Everyone should have the ability to mute or block a user. As an end user, if I never want to see comments from John Smith again, I should be able to press ‘block.’ Then I would just see a note like `[comment hidden]` whenever I run into a comment from him on any blog on the network. On a non Multisite, I’d actually like to see that for any site that requires registration. Allow users to mute each other.
As an admin, if I block John Smith, then his comments are immediately discarded. If you wanted to get fancy, then you’d hide his comment from everyone who isn’t him, so he thinks he’s still talking to people and just being ignored. A silence mode. Use some JS so an admin has to click to expand and see what’s going on, so if John Smith is escalating, he can be banned.
That would be the other thing. Banning users from your sites on a Multisite should be totally possible. And on .com a way to report “User X keeps working around my blocks.” would help a lot.
Also for admins, perhaps they should be able to see “X people have blocked this user” on the Dashboard. That said, I can see a massive possibility for abuse with that. If John Smith was an admin of his own blog and saw ’10 people blocked you…’ it could cause problems. It would be trivial to hide it from the user, so you could never know how many people blocked you, but I can think of a few fast workarounds. Easiest is to add a second admin account to my own blog on the network and check.
## Blocking Blogs
This is mostly an issue on WordPress.com, since it’s one of the few places I know of that has a ‘reader’ that shows you blogs that you might be interested in. That’s how I found the offending blog, by the way. A friend runs a religious blog on .com and the one we both found appalling was a *recommended blog* to her. I’ve already talked to some people behind the scenes of .com about that and how the algorithm may need some turning. But even if she had stumbled on to it via a search, should she not be able to say “Ew! Block!”
I would write it so that if someone clicked ‘block blog’ the following things happen:
1. The owner of the blog is blocked from commenting on any blog I own
2. The URL of the blog is placed on my blacklist
3. Optionally, all admins of the blog are added to my blacklist
Now I don’t have to see anything anymore.
**Categories:** How It Is
**Tags:** coding, essay, multisite, wordpress
---
### [A Monstrous Regiment of Content](https://halfelf.org/2014/a-monstrous-regiment-of-content/)
**Published:** February 12, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Ruminations on the monstrous combination of an installation being managed in a overly complicated way.
**Content:**
Any similarities to website configurations, current or defunct, is probably somewhat intentional. But I’m not naming names here in this tale of woe.
## The situation:
You have your website: domain.com
You have a staging version where you test all your code: stage-domain.com
Your coders edit the theme code, install plugins, configure them, etc. At the same time, your editors edit content, make posts, etc. The code (plugins etc) is managed by Git because you know you should be using versioning. The posts are not because… WordPress.
## The Problem:
In order to post content, you have to push code *and* content up to the production server. This means that if you’re trying to upgrade WordPress, you have to put a hold out on content until the upgrade is done. How do you keep the two in sync, without goobering your content?
## An Answer:
Decouple content and code.
First let’s version control the php files. This means your themes and plugins will all be edited on staging, and when you’re done, you check the code in and then check it out on production.
Next we attack the DB. Have a job that, when you check out files in production, it copies up **only** following tables:
```
_options
_users
_usermeta
```
This means that all your code (plugin settings, theme settings, etc) gets pushed live, and all your content remains isolated. If you have extra tables, you may need to make allowances for them (like, say \_podpress or \_badbehavior), but you can find them quickly looking at the current DB. You’ll want to add these as necessary, or not. I’d count `_podpress` as ‘content’ and leave it out (we’ll get to what to do with it in a second), and `_badbehavior` as transient data.
On production, you have your content makers be Editors. They edit the content live (because you trust them). If you want to be extra secure, lock down the server via IP rules. At the end of every day, run a reverse sync, where the staging DB’s posts and content are replaced by the live site’s, thus ensuring everyone has the ‘live’ data. Obviously you’d want to script in a serialization safe search/replace after every sync (and have an auto-backup taken before any messing about starts).
It’s in the copy back that we decide what to do with the other files. Either make an exclude list or an include list, whichever makes you feel safer.
Includes would be:
```
_commentmeta
_comments
_postmeta
_posts
_terms
_term_relationships
_term_taxonomy
```
And then anything else you want like `_podpress` (see? I told you I’d get back to this).
Excludes would be anything I have in my push script from before, so `_options` etc. To this I’d also add `_badbehavior` or anything transient. I don’t really need it.
## Pitfalls:
Content isn’t just posts and pages. What if your ‘editors’ need to edit widgets?
What if they don’t? StudioPress’s Genesis Framework has a totally awesome widget called “Featured Page” which lets you pick a page, check options, and off you go. What if you had a page called ‘Header Widget’ and in your widget area for Header, put that widget, pointed it to that page, and checked ‘Show Page Content’? Now your editors just need to edit that page!
What if they still do? Grab a plugin like [Members](http://wordpress.org/extend/plugins/members/) and make a special role for “Super Editors” to let them make widget changes. Of course, now you have to uncouple `_options` and you’ve lost some of the magic here. This is a bad idea. You want to decouple content and code. Using Widgets for this is a cool idea, but what if you did it another way entirely. What if instead you used custom post types, and just had it show the most recent in the ‘spot’ for that header? Say you wanted an ad to show at the top of the page. Make your CPT for ‘header ads’ and write a post. Then schedule another for Wednesday at 3pm. Boom, your ad gets replaced! This also makes it easy to go a step further, make a Role for Marketing or Advertising, and now only they (and admins) can mess with ads. Downside there is you may end up with a lot of CPTs.
What about when WordPress updates? Well, that’s something to be careful over. If you update staging to (say) 3.5.1, but production is on 3.5, the tables *will* get updated. Thankfully, WordPress *rarely* messes with posts and comment tables. The ones that normally get poked with an update is \_options, and we’re syncing that anyway. Still, you should set aside some time to test in staging before you go ahead and push this. Since we’re only posting content on production, this will have no impact on your editors.
## Alternatives:
Put the content tables on another database. While WP doesn’t make it as easy as it does for [custom user and meta tables](http://codex.wordpress.org/Editing_wp-config.php#Custom_User_and_Usermeta_Tables), certainly you should be able to fiddle with that. Then just sync the rest of the tables. Code like [hyberDB](http://wordpress.org/extend/plugins/hyperdb/) already lets you split the DB for load balancing, so you could fork that.
Or … Sync the whole database. But that defeats the purpose.
**Categories:** How To
**Tags:** deployment, wordpress
---
### [Adding Post Meta Data to Quick Edit](https://halfelf.org/2016/adding-cmb2-data-quick-edit/)
**Published:** July 13, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A practical example of adding post meta data to quick edit, and wondering why we have to cry so much when we do it.
**Content:**
After Monday’s post, where I [added custom taxonomy data to Quick Edit as dropdowns](https://halfelf.org/2016/customizing-tax-quick-edit/), you know I had to tackle adding more data. While most of my data is custom taxonomies, some is post-meta and one is a weird cross-relational CPT to CPT(s). CMB2 themselves noted that [this isn’t something easy to do](https://github.com/WebDevStudios/CMB2/issues/95). But I had already tackled this in one way and felt confident.
When I showed my initial function to add the quick edit box, you may have noticed I had multiple cases:
I actually added in the values for gender when I did the sexuality. I renamed the cases from just ‘roleype’ to ‘postmeta-roletype’ and ‘shows’ to ‘cpt-shows’ in order to help remind me what was what. WordPress itself adds in `taxonomy-` as a prefix for taxonomies, so it was in-keeping with the theme.
In order to add the new code for roles, I edit my case for `postmeta-roletype` in `lezchars_quick_edit_add` and everything will be awesome. I just have to get the data, validate it, sanitize it, update it, and javascript it.
Here we go!
## Understanding the Data
In order to know *how* to save the data, and how to get it, we should understand how we’re creating it in the first place. Like I said before I’m using CMB2. I do this on a post by post basis. This means my code is going to be saved as post meta. I know that for extracting and updating that data I’ll need to know three things: post ID, post meta key, and post meta value.
I have a global variable `$lez_character_roles` which allows me to use the same data in my CMB2 array for this data and I’ll be able to reuse this all over the place. The array keys are the slugs (regular, recurring, guest) and the values are the names (Regular/Main Character, etc…).
I’m already extracting the data for displaying in the custom column. While my custom column code covers both the shows CPT stuff (which is complicated in order to handle multiple shows), I’m only going to concentrate on adding the post meta data for role type. Here’s the code:
As you can see, the line `echo ucfirst(get_post_meta( $post_id, 'lezchars_type', true ));` is super straightforward. That’s why we’re starting with this. Oh and the reason it’s set to ‘true’ is that a character should only have one role. Admittedly, this gets weird when a character is regular, then leaves and comes back as a guest, but we default to ‘highest role applicable.’
Of note, this shows the role ‘key’ (‘recurring’ vs ‘Recurring Character’) but that’s okay. If I was to show the full data here, it could make the page very content-heavy. I wanted to avoid that. If, instead, I wanted to show the display name, I’d add a global for `$lez_character_roles` (see how that array pays off?) and then change the case to do this:
For my use case, the simpler method is enough.
## Making the Dropdown
We’re going to use the same function we used last time, `lezchars_quick_edit_add`, and add in a switch for the column name `postmeta-roletype` with this (omitting other cases for brevity):
That array for my roles really makes life easier here!
I will note, in retrospect making the character roles a taxonomy would have made a lot of other things easier when I started making the pages for statistics, but that’s another post.
## Saving the Data
Again, we’re re-using what we have. Remember the function `lezchars_quick_edit_save`?
Here we’ve added our global for the character roles again, because we want to make sure the role is a legit role before we save it. Like `update_option`, the `update_post_meta` function will add the meta field for the post if it does not exist. Makes our life super easy, doesn’t that?
## Javascript Hell Again
Now the shit I hate. Again, since we can’t pass post data to quick edit natively, we have to use javascript. We use our two functions for that:
and
This works. It’s ugly as hell, but it works. Sadly it’s broken. If you quick edit twice, it shows the first values. I’m sure I’ll figure that out eventually.
**Categories:** How To
**Tags:** coding, javascript, post meta, quick edit, wordpress
---
### [Customizing Taxonomies as Dropdowns in Quick Edit](https://halfelf.org/2016/taxonomies-dropdowns-quick-edit/)
**Published:** July 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Customizing Quick Edit to show
**Content:**
When you go to quick edit for a post, you will automatically see your custom taxonomies as editable fields:
But there’s a problem … I don’t want these to be text fields nor do I want them to be checkboxes. When it’s just you running a site, there’s less to worry about with regards to these things. You know what you’re adding, and if you typo, you blame yourself. At the same time, WordPress only has two options for these sorts of things: tags (freeform text) and categories (checkboxes).
Technically they’re settings for hierarchical, where false is text and true is checkboxes, and I’ve hidden the parent field (a topic for another post). But doing that makes them all check boxes, and I want to restrict people to *one* and only one checkbox. Except I don’t. The UX of having checkboxes vanish is pretty shitty, and it isn’t logical that you would only check one box.
Let me explain. In this example, which is practical, I have a taxonomy for human sexuality. I chose taxonomies and not post-meta because that would allow me to sort much more easily on data by groups. Simply, I can grab a list of all people who are flagged as ‘pansexual’ with one function and not have to reinvent the wheel.
That means I can use radio buttons or a dropdown. I feel a dropdown is a better, cleaner, UX, so that’s what I’m going to do. You can use the same logic here, though, so don’t worry.
After reading [ShibaShake’s documentation on adding in quick edit values](http://shibashake.com/wordpress-theme/expand-the-wordpress-quick-edit-menu) I winced. Adding it with `quick_edit_custom_box` is super easy. The problem is that you have to use an incredibly weird amount of javascript to get the post ID and pass data back and forth. As weird and annoying as that was, it actually works. The example, of course, is comparing a CPT, where as I am using a custom taxonomy, so my own code was a little crazier.
## Remove the taxonomy from Quick Edit
To do this starts out sounding like the stupidest idea ever, but you want to set `show_in_quick_edit` to `false` in your taxonomy. That does what it sounds like, removing the item from the quick edit page. Obviously now I have to add it back.
It’s important to note that if you don’t have any custom columns in your post list view, the rest of this won’t work. I do, and since part two of all this will be about being able to edit those custom columns, I don’t have to worry. If you do, here’s how you add a fake column… Ready? You add *and* remove the column. I know, I know, WP can be weird:
Like I said, I know it’s weird.
## Add the Quick Edit Box
Since I know I’m going to be building out a few more of these, and one is a cross-relational CPT to CPT drama, I’ve broken mine out into a switch/case basis.
This is all pretty basic stuff. I’m simply making a form for a drop-down based on the contents of my taxonomy. If you want to make it radio buttons, do that.
## Saving The Changes
Now we’re getting a little weirder. We need to save our changes, but only if it’s *not* an auto-save, and if it’s the correct post type (`post_type_characters` for this page), *and* if the user can edit the page:
The two checks going on here are first to be sure it’s the right `POST` action to save on, and then to only update if the term already exists. If you wanted to append terms instead of replace, you could add a ‘true’ param to [wp\_set\_object\_terms](https://developer.wordpress.org/reference/functions/wp_set_object_terms/), however I want only set one sexuality per person in this case.
At this point, the code actually works!
## Changing the current selection for the dropdown
There’s one problem though. If you’re working along with me this far, you’ll have noticed that the default selection is *always* ‘(Undefined)’ and that’s not what we want. The extension of this problem is we have to use bloody javascript to edit it. Damn it.
Please don’t ask me to explain that. And yes, I know we should be using [Unobtrusive Javascript](http://en.wikipedia.org/wiki/Unobtrusive_JavaScript) and hooking into the DOM instead, but I don’t yet know how to do that.
I do know that if I wanted to add in multiple checks, one way is to duplicate the `function set_inline_lez_sexuality( widgetSet, nonce )` and rename it to `set_inline_lez_gender` and then extend the actions like this:
There are more combinations and concatenations one can do here. Knock yourself out. It’s enough javascript for me today!
**Categories:** How To
**Tags:** categories, javascript, taxonomies, wordpress
---
### [Looking Back at MovableType](https://halfelf.org/2016/looking-back-movabletype/)
**Published:** July 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** MovableType still feels very early 2000s.
**Content:**
For the first time in years, I looked at Movable Type.
I walked away, like so many people, in May of 2004 when the restrictions and pay requirements were too much. I’d played with b2 before and WordPress, but that was when I fully moved to WordPress. While I’d remembered that the Open Source version had been fully restored in version 3.3, I forgot that when they released v6 in 2016, they [‘terminated’ the Open Source licensing option](https://movabletype.org/news/2013/07/license_change_on_movable_type_6.html). Again.
In doing normal research of things, I ended up on MovableType.com, and was struck by how modern and out of date the site felt.
The site isn’t mobile friendly. Or at least not iPad friendly. It does this peculiar zoom in where the content is focused but it still has a sidebar. This means flicking down to read can causes my screen to wobble side to side as well. The zoom also didn’t work consistently, making me have to fix it over and over.
That said, it has a much nicer design and layout than I expected.
[](https://halfelf.org/wp-content/uploads/sites/2/2016/07/image.png)
I have to say, that’s a much more modern front page than WordPress.org and less cartoony than the current WordPress.com pages. The same can’t be said of navigation, which was a little confusing. If you don’t know you have to purchase to download, seeing the Software License section without clarification is weird. That should be even more obvious, I think. I shouldn’t have to click on “Release Notes” and then see [Install MT](https://movabletype.org/documentation/installation/) on the sidebar.
Once I ended up in the documentation, I poked around and had a laugh at the [software requirements](https://movabletype.org/documentation/system-requirements.html#php).
> PHP 5.0 or higher (5.3 or higher is recommended)
Sounds familiar, doesn’t it?
The rest of the [install direcrions](https://movabletype.org/documentation/installation/install-movable-type.html) are incredible weird and hands on. It has none of the simplicity I’ve come used to with WordPress. And please remember, I think that WordPress is far too complex for a new user, still, because WP’s NUX sucks. MT’s is worse.
What interested me the most is that, while you can’t get MT for less than $900, they have a [public GitHub repo](https://github.com/movabletype/movabletype) available.
Still, I didn’t install it. Instead I read the documentation to see what using it would look like, and was rather startling to read the [author page on creating entries](https://movabletype.org/documentation/author/creating-entries.html) and see an interface that looked old.
It reminded me of WP 2.5. Which I guess is understandable since the documentation on how to import from WP to MT is very old. [No, I’m serious, it has screenshots of what looks like WP 2.5 as their documentaion](https://movabletype.org/documentation/installation/moving-from-wordpress-to-movable-type.html).
While I still think that MT lost out big time when they decided to separate from the Open Source community, their product doesn’t draw me in. It doesn’t look fun or nice to use, and that’s probably a reason it’s not as popular as it could be. The GitHub page has 22 contributors. WordPress 4.5, led by my coworker and friend Mike, had [298](https://wordpress.org/news/2016/04/coleman/). Even the official, but not really used like that, WP GitHub repo has over 30 contributors.
I wonder how the web would have looked if Six Apart had never made the license changes.
I wonder would power 26% of the Internet in that world.
**Categories:** How It Is
**Tags:** essay, freedom, open source
---
### [What Are You Paying For With That License?](https://halfelf.org/2016/paying-license/)
**Published:** July 6, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** What are we selling and what are we getting when we buy software?
**Content:**
My friend Andrea recently complained about confusion between support licenses and the GNU Public License:
https://twitter.com/andmiddleton/status/747548520840728580
https://twitter.com/andmiddleton/status/747555343371141120
This lead to a WP Tavern post about how [Commercial WordPress Product Descriptions Can Mislead Customers into Purchasing More Licenses Than Necessary](https://wptavern.com/commercial-wordpress-product-descriptions-can-mislead-customers-into-purchasing-more-licenses-than-necessary).
## GPL Freedom to Use
WordPress is licensed as [GPLv2](http://www.gnu.org/licenses/old-licenses/gpl-2.0.html) and in the preamble it says, rather boldly:
> The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software–to make sure the software is free for all its users.
The GPL is intended to be about freedom in the code you acquire (be that for free or for purchase) and your ability to reuse it as you see fit.
If you really want to understand the GPL and WordPress, I highly recommend you pick up [A Practical Guide to WordPress and the GPL](http://wpandlegalstuff.com/a-practical-guide-to-wordpress-and-the-gpl-get-it/). It’s actually written by a lawyer and it’s $25 for the ebook, which seems like a lot until you realize that to hire a lawyer to go over all this would be over $400.
The point for this post is pretty simple though. The GPL gives the user of a theme or plugin in WordPress the freedom to use the code as many times as they want, on as many sites as they want, for as long as they want.
## The Restrictions of Products
I purchased a theme called [Utility Pro](http://www.shareasale.com/r.cfm?b=778546&u=728549&m=61628&urllink=&afftrack=) from Carrie Dils. I love that theme. On her site, the various licenses are restricted by support.
- Support for 1 Site
- Support for 5 Site
- Support for 25 Site
All licenses come with “1 Year Support and Upgrades” and the ‘pro’ version has these extras:
- DesktopServer Blueprint (quick setup for DesktopServer users)
- Developer’s Edition (Grunt, Sass, and more)
- WP Development Workflow course
What am I paying for here? Support for X sites for 1 year, and updates. It doesn’t say if the updates are for all my sites, but I’m going to assume that if I get support for 5 sites, I get upgrades for 5 sites. The thing here is that the GPL would allow me to install this theme on 250 sites if I wanted, and not only can Carrie do ‘nothing’ about it, but she wouldn’t care. She knows how the GPL works, after all.
This still leaves me with a couple questions:
*If I pay for support for one site, what happens when I put my license on two sites?*
The best case scenario would be I’d get a message telling me that I’ve used up the sites available to my license, and I’ll have to remove one to add another. I’d add in a link to buy more licenses personally.
*What’s to stop me from lying about the site I’m having a problem on?*
Well … Nothing. And unless I need Carrie to log in, she’ll never know! Even if I did let her log in, I could show her a demo site and explain “I’m working on a new version of my site and this is my code…” Which is a totally legit reason to be testing out her code on an ‘unlicensed’ site.
*Can she stop me from copying the updated version to an unlicensed site?*
Nope! In fact, if I’m super smart, I’ll always leave an unmodified version on a site that gets updates, and then use that as my base to update anything I’ve forked. Oh, and my version is so forked, it’s practically not her theme anymore. But that’s okay. I renamed it from `utility-pro` to `utility-jo` (it’s funnier to me).
## Change What We Pay For
I’m going to propose a different way to handle licenses.
Instead of paying for X number of sites for support, pay for X years of support + updates + features.
That’s right, I’m suggesting this price point:
- $80 for 1 year of support and updates on unlimited sites.
- $200 for 3 years of support and updates and those nifty things on unlimited sites.
The word ‘unlimited’ may sound terrifying. If you allow unlimited usage, what’s to stop me from opening a million tickets for my million sites for help? Nothing. Not a damn thing. Except there’s nothing stopping me from doing that right now anyway except my own pathological honesty when it comes to respecting the work of others.
The people who will abuse this system are, for the most part, the people who already are. All the license has to check is “Is this license valid? Yes? Push the update!” Now the theme developer will always be pushing her latest, most secure, code to everyone, which is a win all around. Oh yes, did you think about that? If everyone always gets an update, then everyone always has the ability to be secure.
Now there is one big pain point here. What if I give someone else my license key?
Well… What if you just give away updates anyway?
[Genesis](https://helf.us/genesis) does. No license check needed. I can take my Genesis core theme, install it on any site, and if it’s out of date, I get an update alert.
If you buy their Pro Plus All-Theme Package, it works like this. You shell out $499.95 at first and then $99.95 per year for access to every single theme they make, plus 3rd party themes, plus theme updates, plus support.
The thing is I never put in a license number to Genesis core or my children themes. Ever. The updates just happen, even if I don’t have an account. So what am I paying for with Genesis? I’m paying for the code base, the support, the advanced documentation, and the access to everything I may need to make my site damned awesome.
## But What About Big Changes?
The game is a *little* different with plugins. See, a theme actually rarely changes. Once you’ve made a theme, it stays roughly the same except for library updates and security issues. A plugin though, they can add new features. So instead, let’s take a page from the Apple. The Apple App Store *does not* charge you for updates. They charge you for mini-transactions which, love ’em or hate ’em, actually work. If you need to charge for an update, you make a new version.
Think about that for a second. In the App Store, version 4.1 is a *minor* release, but version 5.0 is a *major* release. This is not the same as WordPress’ semantic versions where 4.1 and 5.0 are both major releases, but 4.1.2 is not. When someone has a major release on the App Store, they retire their existing app and add a new one. The upgrade process *mostly* works. There’s always a weird period of time where things are odd.
When we look at plugins, it’s a heck of a lot easier but you would have to use a license check to restrict updates. Using your licenses and the plugin headers, you can check “If someone’s on version 4.1 and I have released 5.0 and their license is active, push the update.” That’s the easy check. The fun check would be “If someone’s on version 4.1 and I’ve released both 5.0 *and* 4.2, but the license is *not* active, update them to 4.2 only.”
Hold the phone. Why am I saying this? Because *now* you’re pushing *security* updates to your 4.x branch while not giving someone the new 5.x features. You win, because you’ve made the internet safer. The user wins, because they’re safer and possibly inclined to trust you more. Slip in a little alert to the top of the 4.x admin screens to say “There are new features in version 5.x. Upgrade now for 30% off!” and you’ll be converting sales!
While someone *could* change their plugin headers to lie and say that their 4.x version is really a 5.x version, there’s no benefit to them to do this if you’re simultaneously requiring an active license.
## So What Does This Have to Do With GPL?
Going back to what Andrea said, it makes it clear what your freedoms are.
You can take code, install it where ever you want, and no one should actually give a damn. But by making updates easier, companies have to worry less about people wrangling, leaving them free to handle the egregious issues, like reselling.
- The GPL allows me to take StudioPress themes and resell them if I want.
- StudioPress has the right to delete my account and break my ability to update if I do that.
Without touching on the hot-button topic of the ‘spirit’ of the GPL, we’re talking two separate things. The GPL allows me to do what I want with the code. The terms of use of StudioPress as a service, providing me with updates, is not bound by the GPL, nor should they be. But Andrea’s point, that our terms of use and licensing (billing) structure can confuse people with regards to our GPL freedoms, is totally valid.
The onus is on the seller, not the buyer, to explain the difference between the GPL freedoms (do what you want, basically), with the Terms of Use freedoms. GPL doesn’t give you the freedom to defraud a company, for example. If they chose to cancel your account because you resold their product, that’s their right. Your freedom to resell is not impinged by the GPL. You can go for it. But they aren’t obligated to give you free updates anymore if that’s the case, and they can probably slap you with a c&d order.
The point is the GPL and its freedoms *can* live side by side with making a profit. We just have to be honest about what we’re selling. We’re not selling the code at all, we’re selling the service.
**Categories:** How It Is
**Tags:** business, essay, license
---
### [Not Mailbag: Where Contact Forms Fail](https://halfelf.org/2016/mailbag-contact-forms-fail/)
**Published:** July 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Protecting yourself from abuse and harassment in comment forms seems to be a white whale.
**Content:**
My friend Andy, [reading last Friday’s post](https://halfelf.org/2016/mailbag-life-without-contact/), remarked no one should have to put up with crap like that. He’s right, and I mentioned that most contact forms don’t allow you to filter via your WordPress blacklists or comment moderation settings.
Surprised?
You should be.
Back in March 2014, I raised this with Jetpack, saying that the [Feedback ignores Blacklists](https://github.com/Automattic/jetpack/issues/430).
> You have a moderation list and a blacklist.
>
> You have a user you want to block from commenting forever. You add them to the blacklist. Surprise! They can still use the feedback form!
>
> This should behave just like the blacklist on comments: It blackholes them. Done and gone. After all, you didn’t want them around.
>
> Logically I can see why it doesn’t use the comment checks. If you have a check to only let users who have an approved comment, leave more comments freely, this would be a problem. There’s no ‘pending’ value for feedback.
And the first reply … Well it made me mad back then. I say this as someone who is good friends with the fellow who commented, but back in 2014, I wanted to smack the back of his head.
> This would be super easy to get around, just changed the alleged from email address. Besides, blacklist tends to be things that shouldn’t be displayed publicly automatically, allowing contacts would let them appeal the blacklist.
>
> I could see grounds for adding a filter to have grunion follow the commenting blacklist though. Less sold on an admin option.
Now go back and read last week’s post. I have not blacklisted the rather vile word used in that comment because I have a friend who is dyslexic and often says ‘cuntry’ instead of ‘country.’ It’s an honest mistake on her part. We added in an autocorrect to her phone and tablet. But blocking short words is hard. Still. The IP address? You bet that hit my blacklist.
If I still had a comment form, that moron could still harass me.
As I replied to George:
> Sure, and it’s just as easy to get around the current blacklists in WP. The point is, though, if you’ve put someone’s email on your comment blacklist, the assumption can be made that you have a good reason. You DON’T want this person commenting on your site, so why are you making it easy for them to harass you? And yeah, I used ‘harass’ intentionally.
>
> Certainly I can and do block their emails on the server, but I still have to go in and clean out the messages in feedback once and a while, and I for one get a lot of pretty vile garbage from people. So having one less place to have to read their BS would be beneficial.
>
> It’s always been relatively easy to work around if you’re a dedicated troll, but if the blacklist just blackholed their contact messages, it does a lot for your mental health.
Because he’s right that a dedicated asshole will work around the blacklists. They do it today. Still, I feel there’s no reason to make it *easier* for them. And while I can block from a server level, not everyone has my skills. And for those people, should we not introduce Akismet level scans on feedback forms?
You see, the reason I was mad at George back then is his argument felt like he was saying “since it can be worked around, this is a bad idea.”
That is *absolutely* not what he meant.
Even if I didn’t know George well, I have simple proof he didn’t think this was a stupid idea, he thought it was an idea that begat caution. What proof? He didn’t close the issue. In fact, he gave it a milestone to review.
Now, sadly, it’s been two years with no traction. Every so often someone bumps the milestone, which means it’s among the 600+ tickets that need attention. But it lingers. It’s not a priority.
Jetpack and Akismet are both owned by the same company. If you have the Akismet plugin installed and activated, and have an active subscription, every form submission will be checked for spam.
They need to take it to the next level. So do *all* forms plugins. From what I can tell, Ninja Forms has a field [simple spam prevention](http://docs.ninjaforms.com/customer/en/portal/articles/2045697-faq?b_id=9172#faq_antispam) but no blacklists. Gravity Forms has an old, not-updated, 3rd party plugin for a [Gravity Forms Email Blacklist](https://wordpress.org/plugins/gravity-forms-email-blacklist/).
In fact … the only contact form plugin I could find that actually uses WordPress’ built in blacklist would be Takayuki-san’s [Contact Form 7](http://contactform7.com/comment-blacklist/).
Let us protect ourselves from abuse.
**Categories:** How It Is
**Tags:** harassment, mailbag, spam
---
### [Mailbag: Life Without Contact](https://halfelf.org/2016/mailbag-life-without-contact/)
**Published:** July 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I don't really miss that contact form at all.
**Content:**
It’s not a secret I [deleted my contact form](https://halfelf.org/2016/mailbag-contact/) back in February. It’s been a few months since, and for the most part it’s been the greatest feeling when it comes to writing for this site.
I do miss the random cool questions people had that would lead to new posts. But that is really it.
The hate mail is a lovely thing to not get. Oh sure people still leave comments in whatever open post they can to tell me off, but those never see the light of day.
Let me just share with you the *common* sort of hate mail I get. Please note, this is word-for-word what was said. The only part I redacted was exactly what I’d done (and to whom) to deserve this.
> You are a real piece of shit. Someone came to you with respect and in good faith to ask you but a simple request \[…\] and you chose to fucking lecture them?
>
> Congrats at showing what an insipid androgynous cunt you are.
> You’ve now lost another user
Yeah. Someone thought that was okay to talk like that. Wanna know what brought it on? I was explaining to someone that we do not have the technical capability of deleting forum accounts on WordPress.org, and we’re probably not bound by any UN statutes seeing as everything you post on .org is of your own volition. The tl;dr is “If you don’t want things to be in public, don’t post them in public.”
This guy hid his email … or so he thought. I’m aware of who it is. So are the other forum mods, so if he comes back and acts up on .org, we’re prepared. Following people home and treating them like that is not welcome in any community I’d want to be a part of.
So deleting the comment form? Smartest thing I’ve done in years.
**Categories:** How It Is
**Tags:** contact, mailbag
---
### [Whose Fault Is The Hack?](https://halfelf.org/2016/whose-fault-hack/)
**Published:** June 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Who's fault is it, exactly?
**Content:**
Your site was hacked.
Welcome to the worst day of your webmastering career. This is worse than the time you accidentally rebooted the server in the middle of processing the largest orders ever. This is worse than the time you cowboy coded something stupid at 1am on your phone from the bar. This is worse than the time you typed `rm -rf ./*` in the wrong window. This is worse than the time your credit card expired and you put off fixing it in the billing system until your site was down.
Why? It’s worse because you have *no* idea what the hell just happened, why, or who to blame.
Let me tell you who to blame.
## Your Web Software
Oh yes. They are to blame. They left you vulnerable. They made it all sound so super easy and simple that you installed a site and walked away, assuming all was well. They didn’t push those security updates like they promised and they left you ready to be hacked!
Except… Did you update everything promptly? Did you use the code only in the ways it was intended? Did you add on extensions that weren’t vetted by security experts. Did you limit the administrative access to your site to only people who knew how to do things and what was, and was not, safe?
## Your Web Host
Can’t forget these idiots, right? They’re supposed to be locking your server down for your own protection and making sure no one can see anything. They take care of everything, like server updates and network upgrades and those zero-day SSL alerts. Clearly they dropped the ball.
Except … Did the OS they’re using actually push the update needed for security? Did they not and now your host had to decide if they fork and support more or they wait and only support the legit things? One is getting you fixed faster, but it’s also making it harder to make sure *all* security patches are applied. Oh and hey, there are 40 other people on your slice of the network, and one of them has a down-time requirement. And did you remember to only use the secure access to your server? Did you maybe, the one time, turn on FTP (even though they told you not to) and use a clear-texted password?
## Yours
Hey you. If you can’t tell… The answer is it’s everyone’s fault.
Of course everyone can do better to make the world more secure, but we have to accept the fact that it’s not ever any one person’s fault. Very few bits of code are written by one person and never looked at. Very few situations are clearcut. We forget to lock the door, we leave a window cracked, we assume and don’t check.
But at the end of the day, the fault for our hacks lies on the person who cares the most when the hacks happen. If your website is your life, if it’s the way you make business and survive, you cannot just take it all on a hope and prayer that you got it right. And if the effort of upkeep and maintenance is too much, you’ll have to compensate with paying for experts who do that.
The fault is ours.
**Categories:** How It Is
**Tags:** essay, security
---
### [Multisite Emails and Redirects](https://halfelf.org/2016/multisite-redirect-registrtation-per-site/)
**Published:** June 27, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Handling the mess that is Multisite registration and emails when you're on a per-site basis.
**Content:**
I wrote a plugin that allows people to [Join A Multisite on a Per-Site Basis](https://wordpress.org/plugins/join-my-multisite/).
There are some things it doesn’t do that I have no intention of adding into the plugin, but people often ask me how to do them. Personally, I think people should always know they’re on a network, and hiding this will only lead to complaints later one, but my way is not the only way.
That said. I am aware of things people try to do that my plugin won’t. All of these snippets should go in a file in `mu-plugins`. I’d name it `multisite-registration.php` personally. That way I know what it is right away.
## Emails By Site
When you register for a network site, you always get emailed from the network. This means even if I go to `halfelf.org` to reset my password, the email always comes from `ipstenu.org`. To change the password reset emails to be from the one where you’ve actually pressed the reset link is pretty easy:
But when we talk about the activation it’s a little messier. If you’re using my plugin, you can have users sign up on a specific site. You probably want to have new user activations come from that site and if you do, you need to do this:
That subject can, obviously, be changed.
## Redirect Lost Password Pages
So you may have noticed that the lost password page on a network always points to the network and never the site you’re on.
That can actually be fixed by doing this:
This simply filters the URL and if you’re on a site’s login page, use that site for the URL.
## Redirect Logins to Their Site
This one is messier. If you always want a user to be redirected to ‘their’ site, you have to know what their primary blog is on the network. You can do this, and for the most part, this works:
If they don’t have a primary\_blog, they’ll be punted to the main for the network, as it should be.
**Categories:** How To
**Tags:** email, multisite, registration, wordpress
---
### [Apple Watch UX: Too Small](https://halfelf.org/2016/apple-watch-ux/)
**Published:** June 24, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We're making steps forward, but the UX could use some work.
**Content:**
The biggest issue I have with my watch is the UX to perform an action.
I use the WebMD app to remind me to take my pills every morning. At 7:15 it pings my watch and says to take them. I have to scroll down and tap ‘take’ but it gives me three options: Skip, Take, Dismiss.
This is *not* the same as the alert they show on their Apple page:
That shows up when you miss the alert and go check what you need to take.
This strikes me as a bit off. The information is too small and the buttons are not as clear as they should be, and I have to scroll down.
So let’s think what does someone want when they get that alert? They either take the pill or not. Or they dismiss the alert. We want them to take the pills, so we should make that button bigger and green. We don’t want them to not, so make that normal and red. As for dismissing, we can swipe the alert down, so you can leave that button off completely and use the built in UX.
When we consider the [Human Interface Guidelines](https://developer.apple.com/watch/human-interface-guidelines/) of the Watch, I think they’ve aimed too small. While they say to have buttons be “large enough to be tapped easily” and “Create buttons that are easy for the user to tap.” the minimum sizes they provide are shockingly small.
[](https://developer.apple.com/watch/human-interface-guidelines/ui-elements/)
A 42mm Watch has 390px of usable vertical height. 52px (which is the minimum size for the 42mm) is 13.3% of the height. That’s 13mm. Hold on to that number.
There was a study by the MIT Touch Lab which investigated Human Fingertips in the [Mechanics of Tactile Sense](http://touchlab.mit.edu/publications/2003_009.pdf) and they determined the average width of an adult human index finger is 1.6 to 2 cm (16 – 20 mm).
Now Apple’s saying the *minimum* height is 13mm when the smaller end of average is 16mm. That means if your button is the minimum, most of us will have trouble tapping your button.
I’m not a graphic designer. I call myself a monkey with a crayon. I’m not a UX expert. But I am is a very experienced user and I’m someone who *understands* how users think. That’s distressingly more rare than you’d think. I understand how a user goes from A to B and gets lost on C.
When I first got my Apple Watch, I struggled. I had a lot of confusion over force touch (something I still find a little difficult to get correct). But I’ve learned the one thing. Those buttons need to be bigger.
These are the buttons for alarms. The one I don’t have is the nightstand mode button but I use my Watch for an alarm and I don’t have a snooze. Sometimes I have trouble tapping the button in the morning, but I don’t think that’s a function of button size. That said… Those buttons could be larger.
The Watch tries to separate functions on the Watch, alerts, by ones you look at and ones you interact with. I think the interactions need to have bigger buttons in order for more meaningful, easier, usability.
Some of this will be addressed in WatchOS 3, which will have us swiping less. But the majority of apps are still trying too hard to cram more information onto small screens. WebMD included. We need to get better about separating information from alerts on our notifications and devices. We need to have everything be easily dismissible with one gesture.
Thankfully we’ll keep iterating and getting better.
**Categories:** How It Is
**Tags:** apple, ux, watch
---
### [Multisite And Theme Activation Checks](https://halfelf.org/2016/multisite-theme-activation-checks/)
**Published:** June 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Network activating a plugin gets weird on Multisite when you need to check if the theme is also active.
**Content:**
Earlier this week I talked about how you can’t actually network activate all plugins. As it happens, I have a plugin for a specific theme, and it doesn’t like being Network Activated.
The plugin is [Genesis Simple Hooks](https://wordpress.org/plugins/genesis-simple-hooks/) and, logically, it only works if you have a Genesis theme installed and active.
## How It Works
When the plugin is activated it properly runs the following activation hook:
First this looks to see if there’s no parent theme or if the parent theme version is less than 2.1.0, and if either of those are the case (that is if there’s no parent theme, and the version is less than…) it calls `simplehooks_deactivate`.
And you know what? That sucks. It never checks for *Genesis* as the parent theme name, based on the assumption that only Genesis themes use the define of `PARENT_THEME_VERSION` which probably made sense a few years ago, but doesn’t anymore. And more importantly for this explanation, you can’t network activate it because unless you’re lucky enough to be running a Genesis child theme on the main site of your network, it won’t activate.
Worse, it will throw errors on sites that aren’t.
## How I’d Fix It
First I made a list of the action/function calls that require a Genesis Child Theme to be active in order to run properly: `simplehooks_load_textdomain`, `simplehooks_init`, `simplehooks_execute_hooks`
Then I moved them all to their own section and wrapped them in a check:
What’s `simplehooks_can_run`? That’s a *new* function I’ve created to check for the requirements:
What this checks is if the parent theme is 2.1.0 or higher and, if it is, if the theme *or* it’s parent is named Genesis. By having it use `return` I don’t have to check if it’s true or false, the if-check is smart enough for me not to do it explicitly.
Finally I changed the if check in `simplehooks_activation` to look like this:
What this isn’t doing is checking for WordPress 3.9.x anymore, as it’s 2016 and that was 2014 and I’m not worried about it. If I was, I’d toss `&& version_compare( $wp_version, '3.9.2', '>=' )` to the if-check in `simplehooks_can_use` to CYA.
This *also* isn’t giving you an error on Multisite. That means if you network activate the plugin and, on Multisite, go to a site that *does not* have Genesis running, you don’t get an error. This is by design. There’s no point in telling a site-admin “Hey there’s this Genesis thing you can’t have because you’re not using it! NEENER!”
I’m actually using this here on this site. If you’re interested at testing it out, grab it from [my Github repo](https://github.com/Ipstenu/genesis-simple-hooks/tree/multisite).
Pull requests welcome.
**Categories:** How To
**Tags:** multisite, plugins, themes, wordpress
---
### [Debugging Unexpected Output](https://halfelf.org/2016/debugging-unexpected-output/)
**Published:** June 13, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Helping debug unexpected errors is not as obvious as it might be.
**Content:**
It’s going to happen one day. You’re going to get that weird error when you activate your plugin to test it and you will have no idea what it means.
What error?
Unexpected output.
The problem is WordPress doesn’t tell you what did it, where, or why, not even if you have debug turned on. You *do* have debug turned on, right? Well I was stumped on this one. I checked all my PHP calls to make sure I didn’t have whitespace, I looked for any files that were accidentally saved UTF-8, and I checked and double checked my diffs between the good and bad versions.
What I ended up doing was writing a function that saved the error and output it.
That results in a pretty kind of output:
I like to use the pretty display so I can easily read what, exactly I messed up and how.
**Categories:** How To
**Tags:** coding, debug, wordpress
---
### [Google Advertising Experiments](https://halfelf.org/2016/google-advertising-experiments/)
**Published:** June 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** See who's clicking on your Google Ads. Or not.
**Content:**
In the time since I’ve gone back to Google Adsense, I’ve had issues with some of their ads. Mostly religion and politics. Big shocker, right? Every once in a while, Google suggest I allow those ads:
> Consider allowing ads from sensitive categories to increase auction pressure and improve performance.
I usually discard the suggestion, but this time they tried something new to me.
> … you can allow these ads now, or run an experiment to help you decide.
[Experiment](https://support.google.com/adsense/answer/6321879?hl=en)?
There are only two types of experiments right now. One is ad units, where you can adjust templates and ad sizes. The other is what I’m doing, allowing and blocking ads. I clicked on the experiment button, and it set up an A/B test for me, tracking the clicks of each version of my site, to see if anyone actually clicks on those ads.
Initially there was an option to automatically pick the best one, but I don’t know if I want to. I do know that I want to actually see if anyone who reads my sites wants to see political ads.
The reason I’d blocked them is they were showing right-wing crazy people on my sites, and I’m not that person. They were showing ads I would deem offensive (and you have to work hard to offend me) so instead of reading every single ad, I decided to block all of them, assuming I wasn’t hurting my income too much.
After this experiment, I’ll circle back and make a more informed decision. I wish there were more things I could experiment on, like specific ads in specific locations, but this ability to just see if the ads are clicked at all is a nice start for a free product.
**Categories:** How To
**Tags:** advertising, google, testing
---
### [Boundaries](https://halfelf.org/2016/boundaries/)
**Published:** June 17, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Not being an asshole starts with recognizing that you're not special at all.
**Content:**
My friend and coworker tipped me on to this post about [The Asshole Filter](http://siderea.livejournal.com/1230660.html) which begs the question: “Why is everyone I deal with an asshole?”
The post goes on to talk about how the issue is that if we draw a line in the sand but then *allow* people to cross that line, or worse reward them for doing that, we’re hurting ourself. In the example, a fellow named Fred used to accept personal emails about a project but now asks them to be sent to a group email.
> \[…\] some people use fredsstaff@fredsconvention.tld and some people use Fred’s personal email.
>
> Who uses the officially designated email address?
>
> • People who feel strongly about following rules.
> • People who feel following the rules is generally a good idea.
> • People who respect Fred’s request because they’re generally respectful.
> • People who respect Fred’s request because they like Fred personally.
> • People who don’t want to antagonize Fred.
> • People who realize the problem Fred is trying to solve and want to be cooperative to reduce the burden on Fred.
> • People who feel it important to respect role boundaries.
> • People who are concerned that overwhelming Fred will cause their request to get lost.
>
> Who uses Fred’s personal email address?
>
> • People who can’t be bothered to learn and follow procedures.
> • People who feel rules are for other people.
> • People who feel they should get to cut in line.
> • People who don’t feel keeping track of what other people prefer is all that important.
> • People who aren’t troubled by the thought of pissing off Fred, either because they don’t care whom they piss off or because they think Fred is of no account.
> • People who feel entitled to get their way.
> • People who feel satisfaction when they find an illicit “shortcut” to getting what they want, that “suckers” are too “chicken” to use.
>
> In short, the decent, cooperative, law-abiding people all use the departmental email address, even though it doesn’t work a well as they might like, while the assholes continue emailing Fred directly.
Did that just sound familiar to a lot of you who are thinking “I can just email Mika about plugins…”
People often ask me why I sound angry when I tell you “Please email plugins@wordpress.org, don’t tweet/DM/Slack me asking for status. Just use the email and sit on your hands a bit.” I’m actually not angry. I’m annoyed. There’s a huge difference.
Angry me logs off and calls it a day.
Annoyed me rants a bit to someone who understands, or maybe says something passive/aggressive on Twitter about “Please use the plugins@ email…”
In both cases, though, I probably waste at least an hour of my time *not* getting to the things everyone wants be to get to. In both cases, I feel incredibly disrespected and used. Yes, used. Because even when my *friends* say “Hey I have a quick plugin question…” the answer has *once* been a quick one. That question? Someone asked if he could adopt the plugin of a friend of ours who had died.
First of all, that’s just an unexpected question by anyone’s standards (and it’s why we came up with a policy about handling death among developers). Second of all, it’s a touchy subject on it’s best day, so asking how to handle it was respectful. Third… He actually asked if he should just email the group.
This was someone who clearly understood the reality, the situation, and the fact that there will always be exceptions.
The sidebar of this issue is that, even if I ask someone to email a group, nine times of out ten it’s me who replied.
I can give you a really long explanation, including how I plan to use those emails to train up new reviewers so you *don’t* have to wait on me, but let me ask you this instead.
- Are you more or less important than everyone else who is waiting for their plugin to be reviewed?
In general, if you get the ‘snippy’ reply of “Dude stop fucking things up and use the right channel” then I’ve *already* asked you, at least once, to “please” use the email. I’m very careful to ask nicely since I know there’s no possible way for everyone to know things. Mistakes are totally okay in my book. Intentionally trying to jump a queue just makes you an asshole, no matter your intentions. You’re disrespecting everyone, me and every other plugin developer out there, by demanding you get attended to first.
Okay.
So what would be a good reason to ping directly? Well about the only reason people do it that I consider thoughtful and respectful is this:
> Hey it’s been a week and I didn’t hear back about X. Did the email get lost or are you guys super backlogged?
And maybe…
> I think \[plugin reviewer\] is treating me unfairly. Can you help or do you know who can?
Both of those are totally perfect reasons to step off book. One is you not being sure if the email was received. The other is an issue with someone who might read the email.
But do you see how they’re both asking, briefly, without a lot of drama or accusations, a simple question? Well. Not a simple question. But they’re asking in a way that shows they understand the situation of the world in general, they understand they’re asking for an exception, and they will respectfully accept the answers.
By the way. The answer to the first one is 90% ‘backlogged’ and 10% ‘goddamn email!’
**Categories:** How It Is
**Tags:** essay, rant
---
### [So Take an Upgrade, Maria!](https://halfelf.org/2016/take-upgrade-maria/)
**Published:** June 10, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A message to my sites. Say we won't use Oracle. Gonna start a new life.
**Content:**
A year ago I asked [how do we solve a DB like Maria](https://halfelf.org/2015/solve-db-like-maria/), and my friend James and I had a good laugh at the long list of issues.
It’s been a year.
I’ve upgraded to PHP 7.
It’s time.
## What about Oracle vs Google?
Oh you heard about that? [Google won a case against Oracle about GPL code in Android](https://www.eff.org/cases/oracle-v-google) which I want to be really happy about, but it illustrates a major flaw in the judicial system. To whit: The player with the deepest pockets wins.
That case about Java though, not MySQL, which has been a long standing issue with the Open Source Community. The summary? Well it’s kind of like Prohibition. They can try to outlaw it, but we’re going to do our own thing. Which is where MariaDB comes in. It was a fork of MySQL, made in order to stay free and open. I strongly support open source software and so I change to MariaDB.
## What Are The Issues?
There aren’t as many for [MySQL 5.6 vs MariaDB 10.x](https://mariadb.com/kb/en/mariadb/mariadb-vs-mysql-compatibility/#incompatibilities-between-mariadb-100-and-mysql-56) as I’d thought. In looking at that, I determined it wouldn’t really impact my sites or setup. In fact, I was certain none of it would be an issue.
## How to Upgrade?
I’m on WHM, so first I made a backup: `/usr/local/cpanel/bin/backup --force`
Then I went into WHM and said “Upgrade Maria!”
I picked the interactive upgrade since I wanted to see what it was doing. Step one went rather quickly and updated everything. It asked me to check my compiled software (which meant two non-WordPress sites that historically act odd when I upgrade). Once that was done, I clicked ‘next’ and was told I didn’t need to do anything else…
## Now what?
I ran off to [GTmetrix](https://gtmetrix.com) and checked my sites. I had two that were PHP 7 and they had no real change. I then changed another one to PHP 7 and Maria and checked it, and got bigger gains. Speed was up and everything, code wise, appeared to work as needed.
It was entirely a non-event.
**Categories:** How It Is
**Tags:** database, upgrading
---
### [How Do You Solve a DB Like Maria?](https://halfelf.org/2015/solve-db-like-maria/)
**Published:** April 8, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How do you push to the cloud and pin it down? How do you find the query that means Maria?
**Content:**
I was talking to my friend James about upgrading SQL. If you didn’t know, upgrading SQL is a horrifyingly monumental thing, because there’s no way back except restore from a backup. Minor upgrades are generally painless, but the CentOS warning is as follows:
> Upgrades to new major releases (the first two digits in the version string) are more involved because there is a substantial risk of data loss.
Data. Loss.
It’s scary when you consider doing it for yourself. It’s horrifying when you consider doing it for a few thousand users.
On top of that is the issue that MySQL is owned by Oracle and they’re not exactly known for being good stewards of OpenSource. Unlike many other Open Source projects, Oracle owns the entire copyright to MySQL. All contributions are done if the developer has signed a “contributor agreement” that assigns ownership to Oracle. This isn’t all that weird, to be fair. When I worked for The Man, that was basically how things worked and it made sense. The work I did for the company belonged to the company.
Where this is weird is that Oracle has said that about a GPL product, even to parts of it the company has not written. Why is that? It’s because all contributors to the code have to sign a “contributor agreement” assigning ownership of the copyright to Oracle, which is not alone in this. Sun before them used contributor agreements to get full source ownership, and many other projects do the same.
Now, James and I looked at the [MariaDB vs MySQL compatibility doc](https://mariadb.com/kb/en/mariadb/mariadb-vs-mysql-compatibility/) and had a laugh.
> tl;dr “For all practical purposes, MariaDB is a binary drop in replacement of the same MySQL version,” except for this long list detailing where you’re screwed.
Now when you get down to MySQL 5.5 and MariaDB 10, the issues become very minor and unlikely to cause you migraines, which is a relief, but that list sure is long and daunting.
I’m not yet running MariaDB because it’s an all-or-nothing move. I can’t keep on MySQL, and I have a few old (ancient) bits of non-WordPress code on this server. I always stress that [WordPress is not the limiting factors in server upgrades](https://halfelf.org/2015/road-php-5-x/ "The Road to PHP 5.x"), and it’s still the truth.
I’ve started doing the recon work to make sure MariaDB will work for all situations on my server, for all apps, and I’m currently pretty sure that I’ll be fine, but I do have one way-out-there app to check into. They’re also one of the few people who pay me for hosting, so we may have to have a sit-down anyway to discuss their future.
> [@Ipstenu](https://twitter.com/Ipstenu?ref_src=twsrc%5Etfw) Yep!
>
> — Gary (@GaryPendergast) [March 24, 2015](https://twitter.com/GaryPendergast/status/580473177140236289?ref_src=twsrc%5Etfw)
The most important question has been answered.
**Categories:** How It Is
**Tags:** essay, open source, servers
---
### [Is This A Good Name For Your Project?](https://halfelf.org/2016/good-name-project/)
**Published:** June 6, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Names should be unique. They should be distinct. The should be yours.
**Content:**
If the answer to *any* of the following is not a ‘yes’ then no, you should not use the name for your project.
Again, every answer here should be yes.
1. Did you Google the name?
2. Did you check if the domain name was available?
3. Did you make sure no one else is using it for a similar project?
4. Did you check for trademarks and copyright conflicts?
5. Did you check it against a five year old and made sure they don’t giggle?
## Congratulations! You Have a Good Name!
Maybe.
I do a lot of arguing with people over the idea of ‘how’ to name a project, because people want to make add-ons
For example, if you have written an add-on plugin for Microsoft Word, you can’t name your project “Microsoft Word Super Snazzy Map Add-On” but you *can* name it “Super Snazzy Map Add-On for Microsoft Word.”
Using a name like “My Product for Other Product” is something I consider common sense. Consider the example of Keurig. If you made an eco-friendly brew cup, you could market it “EcoBrew Pod for Keurig” but you could NOT attempt to market it as “Keurig EcoBrew Pod.” The latter implies a direct relationship to Keurig and may be against the law in some countries.
## Being Original Is Hard
I don’t mean to dismiss this. It’s hard to come up with a name that is original, descriptive, and unique. It gets harder and harder every day. Consider that a number of [today’s companies seem to have ripped their logo out of a 1989 design book](http://nextshark.com/airbnb-beats-hootsuite-copied-logos-from-same-book/)
The Beats logo on the right compared to one found in the 1989 design book Tweeted by Spencer Chen.Now we have long accepted in logos the limitation of language, letters, and combinations. It’s probably not theft, but it’s something you have to be aware of when a new project is named. Similarly, we accept the fact that naming something that is at once unique while still displaying your own flare is problematic.
I can’t offer you an answer that will fit everything, but I can offer you this. When you pick a name for your project, regardless of if you’re the big fish or the little one, it’s your responsibility to check if something even possibly related is *already* there. If you happen to name things at the same time, that’s an honest mistake, but if you know better going in, don’t be the bad guy.
## What About The Bad Guy?
What happens, though, if a year or three down the line, you get an email telling you that your product is infringing on trademarks?
You have two choices:
1. Fight
2. Flight
There are weird issues in the US with Generic Trademarks. Like did you know heroin, thermos, and aspirin are genericized? That means we use the words ubiquitously to mean the general concept of ‘a thermos bottle’ or ‘that horrible drug’ without reference to the trademark holders.
That said, there are terms that are *not* generic, and yet we use them similarly. Band-Aid, Kleenex, Post-It, and Google. Yes. Google. Google actually has gone to the point of downranking you for terms like ‘googling it’ because they want to protect their brands.
So what happens when you get that email from Johnson & Johnson, telling you that your product “Mika’s Band-Aid for WordPress” is a trademark violation?
Fight or flight.
You can argue that no one would logically think that ‘band-aid’ in this case would ever be confused for their product. Or you can say “Oops, my bad. I was totally trying to leverage the term band-aid.” You can also ask them “Are there circumstances in which I can rebrand this so as to make it clear I’m not intending to violate your trademark while not losing the ground I’ve made with my product?”
I will suggest, if you chose to fight, to get a lawyer who specializes in trademark law.
**Categories:** How It Is
**Tags:** essay
---
### [How To Pick Your Webhost](https://halfelf.org/2016/pick-webhost/)
**Published:** May 30, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to pick a webhost comes down to understanding yourself, what you need, and how you work.
**Content:**
This is not a real conversation, except it totally is.
User: I want hosting.
Me: What kind of site do you want to host?
User: A WordPress site!
Me: What kind of content do you plan on writing?
User: Oh you know, blog stuff.
Me: Okay… A food blog, a photo blog, a tech blog…?
User: *Why are you asking me all this!?!?!*
I’ve had so many conversations like this, I’m of the opinion that recommending hosting is a mugs game that simply cannot be ‘won’ so I generally don’t play.
Then why am I presuming I can tell you how to pick a webhost? Because I’m telling you *how* to pick a webhost, not who the best webhost is.
## Preface
Someone will hate every single webhost on the planet. I use [Liquidweb](https://www.liquidweb.com/?RID=JFO123) and [DreamHost](https://dreamhost.com). People hate both of those. There’s the bevy of EIG companies whom people will detest and lambast and accuse of shady actions to be listed somewhere. There are the millions of small companies. There are good and bad companies, and there are reasons to use them. Whenever someone asks what host to use, I remind them that *someone* will hate their choice. That’s okay, just don’t take it personally and I recommend you ignore people who simply jump on bandwagons to tell you “X SUCKS!” They’re not being helpful.
## Needs vs Wants
I repeat this a lot in myriad situations. Your needs are what your website *needs*, which should be obvious. If you’re running WordPress you need a webserver than runs a modern version of PHP and a MySQL (or MariaDB) database. That’s it. But that isn’t all of what you *need* for a website, and to understand your needs you need to be very clear about your own abilities, your capabilities, and the time you’re willing to commit to your project. Running a website is very time consuming and stressful. You can’t just set it and forget it.
## Who Are You?
We should all know who we are, what our skills are, and what we *enjoy* doing. I’m like playing with servers and code. My wife prefers practical experimentation (she makes cheese and mead). My father is a mathematician. We’re all writers of a sort, but of the three of us I’m the one who runs the website and puts of articles on the regular. This is not because the others can’t, but because they know who they are. My father sends me his articles to post, my wife posts her own, and I both write my own for me but for my company, and I maintain the servers (and email). If you’re not me, and don’t have a me, you need a me. That *may* be your host, and it may not.
## How Do You Communicate Best?
Do you get anxiety with phone calls? Look for a company with live chat and email support. Do you hate live chat? Are you dyslexic? Look for phone support. You know how you like to communicate with strangers, so pick a host that has what you need. I personally prefer ticket based systems, unless my server is actually on fire. That hasn’t happened much.
## How Do You Add People?
Let’s say you decide to hire someone to work on your website. Do they need access to the server? Do they need access to your billing? How do you do that without giving them your passwords? Find out how the host handles this. Can you simply add a technical contact or will there be more complicated steps?
## What Is Your Site About?
Why does this matter? Well, think of it this way. “I want to make a community site where people from my city can come and post news, events, crimes, etc.” Did you just think about [BuddyPress](https://buddypress.org/)? You will likely need a bigger server than Shared. “I want a photoblog!” Okay you will need to seriously look at diskspace, which means SSDs may be a little tricky for you since most limit space. Check if the host allows easy upgrades. “I’m going to run a multisite network for my school!” You need a private server. Knowing what your site is about will help you predict upcoming hurdles.
## Do You Know Any Metrics?
Most people, especially people with a brand new site, are going to say “No!” here and that’s okay. But if you do know things like how much traffic you get or how often you post or how much disk space you use, talk to the host about it. Pre-sales questions like “What’s the best hosting plan for a site that gets 2000 visits a day, and then 12k on one day a week?” are the bread and butter of a host. If they can’t answer it, move on.
## Does The Host Make You Feel Good?
If you get a bad feeling from the host at any step along the way, you feel like they’re dismissive or maybe not a good fit, *walk away*. Look, you need to be comfortable with your host, and if the advertising practices of a host upset you, don’t use them. It’s that simple. Even if they’re the best for your needs, if they make you uncomfortable, you will be miserable. And remember, for every single host there will be people who hate them. That’s okay too. If it works for you, and you feel good about doing business with them, then that is really all that matters.
**Categories:** How To
**Tags:** essay, hosting
---
### [My Super Secret .htaccess File](https://halfelf.org/2013/my-super-secret-htaccess-file/)
**Published:** October 30, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** An inside look into my wild and wooly and actually pretty simple .htaccess settings.
**Content:**
This came up back in April in the comments of [WordPress Login Protection With .htaccess](https://halfelf.org/2013/wp-login-protection-htaccess/ "WordPress Login Protection With .htaccess"), where I remarked my .htaccess was pretty long and weird. It came up again when I was doing a [MeetWP presentation](https://halfelf.org/2013/meetwp-troubleshooting-and-hacked-sites/ "MeetWP: Troubleshooting and Hacked Sites") about hacked sites and some security.
So what is it? Actually less long and weird these days. I’ve been trimming stuff out. But since people ask, here it is, broken out into ‘chunks.’
## Security
Everything in this section is for security purposes. That is, I feel it helps my site be safer.
This is basic .htaccess stuff, says to allow includes and symlinks, but stop indexes. This means if you go to `halfelf.org/wp-content/uploads/` you don’t see anything, *even if* I don’t have an index file.
Now we’re into a little odder bits. This stops anyone from surfing to my wp-config.php file. It shouldn’t matter, PHP won’t let it load the content, but if my PHP is off, it protects me just in case!
This is because of the next section. It gives a nice error for 401s, which WP normally gets gitty over. And not the fun way.
Ahhh, yes. Here I say “If you’re coming to wp-comments-post OR wp-login and you are NOT refereed by one of my domains, sod off.” And then it says “Oh and if you’re looking for .svn or .git files? Go away.” This isn’t perfect, but it works for some of the botnets. The fun part is that the rewrite sends them back to themselves, which should cause annoying things to happen. Don’t want that? Redirect them to fbi.gov. Actually, if some tool had a page “Redirect botnets here…” I would use that, but generally I send them to `http://lmgtfy.com/?q=wordpress+botnet` because I’m that sort of kid.
## Speed and Bandwidth
Now that I’m safer, lets speed this stuff up!
First up, stop the hotlinks! I got the idea from [Perishable Press](http://perishablepress.com/creating-the-ultimate-htaccess-anti-hotlinking-strategy/), and it stops you from embedding my images. This means my site is faster, as you’re not sucking up my bandwidth. I get 5G so it’s not too much of a concern right now, but it’s the principle of the thing. [Don’t hotlink images!](https://halfelf.org/2013/hotlinking-google/ "Hotlinking is Evil (And So Is Google)")
I use Pagespeed on my server, so here I’ve added in my extra rules. Not everything is active for all sites. This is my default WP rule-set though, and it works well. I have it skipping a couple non WP folders, who have their own rules inside on their own .htaccess files anyway. If you don’t have pagespeed? Skip this section.
Oy. There are a couple ways you can control all these things. One is the way I did (filesmatch) and the other is `ExpiresByType image/jpg "access plus 1 year"`. Is one better than they other? I don’t know. Not that I’ve managed to see, but I find the filesmatch to be easier to read and add things too. It’s shorter. Does that make it better? Only in so far as my management goes.
Finally we have gzip, which compresses and makes things smaller and thus faster. Using gzip saves me about 80% in filesize, so it makes things faster to download and, thus, display. If you’re using this in your .htaccess, do not also try to use it in plugins/extensions for other web apps, that way likes double compression and garbage on your pages.
## Add support!
This is a really short bit to add in support for filetypes I use that aren’t always standard:
## Rewrites
In general, this is useless to everyone else, save as an example.
I cut out a couple of sections, where what I did with the ‘Only redirect ipstenu.org’ stuff is repeated for each site. I built much of that after reading my 404 logs and determining what needed to be redirected. Everything is commented and in logical sections, so I can easily find and remember what the heck I was doing.
This is the longest section, the stuff under `# Ipstenu Moves` and such, because they’re accounting for files that moved a million years ago. But the moves section is pretty straightforward too, as you can see where things went. I try to keep it as compact as I can. Sometimes I go through and make them more and more efficient, as I learn new tricks.
## What used to be here?
I used to include the [5G Blacklist 2013](http://perishablepress.com/5g-blacklist-2013/) and/or the [2013 User Agent Blacklist](http://perishablepress.com/2013-user-agent-blacklist/) (or whatever the current versions are), but now I don’t have it on all my sites because of the work I’ve been putting in on my firewall and ModSecurity instead. Every once in a while, someone tells me I’m putting too much work on Apache to handle the hackers and spammers, and I generally reply “Better Apache than WordPress.”
Regularly, I go through my .htaccess and see what I can push over to ModSec. I also trim down my PageSpeed rules into things that work on most sites, things that only work on this site, and things that work for everything. This is why there’s no blacklisting here, it’s all handled by my firewall and mod\_security and that’s that. I like to take the load off of apache and .htaccess and PHP and make the server do the work.
## Why not nginx?
Per site configuration is still a pill. No, really that’s it. It’s a hassle to re-do everything I have in htaccess, I can’t just toss a .nginx file in there on the fly without restarting nginx, which means for shared hosts it’s just not gonna happen. Sucks. For managed hosting, where you don’t allow users to make those changes, sure, it’s great. But that’s not *my* use case. I may use it for a Varnish in front server one day, after I rebuild everything from scratch.
**Categories:** How It Works, How To
**Tags:** coding, htaccess, security
---
### [SSD: An Anecdotal Journey](https://halfelf.org/2016/ssd-anecdotal-journey/)
**Published:** June 3, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Anecdotally SSD is an incredible improvement of the old bog hard drives.
**Content:**
After I upgraded to [Ogra](https://halfelf.org/2016/farewell-mothra-hello-ogra/), I noticed that my server’s load stats were a little janky. They were pretty high, actually, bouncing between .5 and 2 all the time. Now this isn’t really all that bad, but as I looked at my server, I realized I was paying a little more than I needed, since I’d cut down on space by offloading backups better.
This matters because I needed only 50G of diskspace (I only use about 30 right now for all the sites), and while I did want 2G of RAM, I could easily switch to an SSD on my hosting plan. It was cheaper, and it was as easy as pressing a button. I’ve never really gotten to play with SSD for this site, so I thought “what the hell” and pressed the button.
A weekend later…
The five minute load average shows a *massive* drop. It’s incredible. The red and blank spots are where I was running the actual migration process and disabled monitoring for a bit. Literally all I did was reboot the server and the move it to SSD. That’s it. It’s insane when you think about it.
By the way, I saved disk space by offloading the backups to Amazon S3. Amazon costs me about $3 a month, and while I detest their interface, the integration is built into WHM. I have an open feature requests to [allow arbitrary CEPH destinations as backup](https://features.cpanel.net/topic/ceph-backups) so please vote for that if you like the idea.
SSDs had the bonus of changing my backup from taking 2 or 3 hours to taking 15 minutes.
Anecdotally SSD is an incredible improvement of the old bog hard drives.
**Categories:** How It Is
**Tags:** essay, servers
---
### [A Simplier Hugo Deploy](https://halfelf.org/2016/simplier-hugo-deploy/)
**Published:** May 27, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** An even simplier, no-go required, deployment for Hugo.
**Content:**
I have a [Hugo](http://gohugo.io) site that I’ve been deploying by [running Hugo on the server](https://halfelf.org/2015/deploying-hugo/). But this isn’t the only way about it.
If you use Git and it’s on the same server as your site, and owned by the same user, it’s remarkably easy to do this.
First make sure the `public` folder in your Hugo repository is being tracked. Yes, this can make your repository a little large but that’s not something to worry about too much. Space is cheap, or it should be. Next make a folder in `tmp` – I called mine `library` – to store the Git output in.
The new `post-update` code then looks like this:
What this does is checkout the Git repository and then copy it over. The format of the sync will delete anything not found. Done.
The benefit of this method is that you don’t need to install GoLang or Hugo on your server, and everything is pure and simple Git and copy. Rsync is a delightful way to copy everything over as well. You can delete the temp folder when you’re done, but the checkout process handles things for you. Another nice trick is you can specify what branch to checkout, so if you have a special one for publishing, just use that.
But could this be *even* easier? Yes and no. You see, what I’m going is checking out the whole thing and then copying over folders. What if I could tell Git to just checkout the code in that one folder?
There’s a think called a ‘sparse checkout’ where in I can tell Git “Only checkout this folder.” Then all I have to do is go into that folder and checkout the content I wanted. The problem there is it literally checked out the folder ‘public’ and what I wanted was the content of the public folder. Which means while it’s ‘easier’ in that I’ve only checked out the code I need, I can’t just checkout it out into where I want. I will always have to have a little extra move.
To set up my folder, I did this:
And then my script remains the same. But! This is going to be a faster checkout since it’s only ever going to be exporting and seeing the folders it needs.
**Categories:** How To
**Tags:** deployment, git, hugo
---
### [Encrypting Source Code Doesn't Make It Safer](https://halfelf.org/2016/encrypting-source-isnt-safer/)
**Published:** May 23, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** All the work you're doing to hiding your code is about as useful as preventing right-click on images.
**Content:**
I’d love to think that’s all I have to say on the matter, that you all will read the subject, go “Yup!” and we’re done.
The reality is that I have to argue this, regularly, with people.
Here’s the code from a plugin out there:
The whole file is like that. The developer explained it was done that way for ‘security’ — it would make things harder to hack. I pointed out that’s simply not true.
Here’s what having encrypted, hashed, packed code does:
1. It makes your build process take longer.
2. It adds another failure point into your code.
3. It makes it harder for the end users, other developers (who write plugins), web hosts to debug, and *you* to debug.
4. It makes you look like a developer with evil intents.
5. It sets an expectation with users that this kind of code is ‘normal’ in WordPress.
Recently Sucuri posted about [a redirect hack](https://blog.sucuri.net/2016/05/wordpress-redirect-hack-test0-default7.html) that works by putting junk code in your `header.php` file which looks rather similar:
The issue here is that an end user, your normal WordPress user, cannot tell the difference between the somewhat safe code I quoted before and this code. They see ‘gibberish’ where as I know they can use [a hex decoder](http://ddecode.com/hexdecoder/) to translate `["w\x73\x78\x6e\x69\x66\x69\x6f\x71\x6c"]` into `["wsxnifioql"]` … which is still pretty terrible.
Well written code, well named functions, are self-explanatory. You see a function called `redirect_404_pages()` and you have a pretty good idea of what it’s for. You see a function named `wsxnifioql()` and good luck knowing what the heck that’s for. This goes back to the claim that the code is more secure. It’s not. It’s needlessly complicated, and as I shoed with the hex decoder tool, it can *trivially* be decrypted and read.
So what is the *real* point of hiding your code? Who are you trying to protect? What’s ‘safer’ about any of this?
The answer is that it’s about about you, you, you. You don’t want someone to take your great idea.
That’s it. And that’s foolish.
WordPress is GPLv2 (or later). Furthermore, to be hosted on WordPress.org, your code *cannot* be encrypted or hidden or otherwise non-human-readable. The basic reason is that WordPress’ success is due to it’s understandability and extendability. Anyone can read WordPress’ core code, parse it, learn from it, and enhance it. When you take that away from users, you isolate your code and prevent people from extending it.
This person, this developer, charges upwards of $1000 for the add ons to their code. Yes, a plugin that costs over a grand. It sounds economically sound to try and lock things down so people don’t steal their intellectual property. We can all understand that impetus. I support it. I also feel that part of being in an open source community is being aware of how your actions impact the world at large.
Because WordPress is open and because there is a standard expectation of non-encrypted code (except by evil-doers), the burden moves to developers to *not* hide their code that is installed on users’ servers. The code that is deployed to an end-user is expected to be human readable. This comes at a risk. I have a copy of a theme I bought, and I could give it away to anyone I wanted. They may not get updates, which means I have to be aware of the risk I’m introducing to my friends when I give them something like a premium theme or plugin.
Similarly, what are the risks of telling people it’s okay to install plugin code in `uploads` instead of the `plugins` folder? What are the risks of allowing people to think that encrypted code is generally okay? In and of themselves, neither action seems particularly dangerous. PHP code is PHP code, right? If it runs, you’re good. But the reality is not so. By installing code in `uploads` I’ve made it so it’s no longer fully protected by WordPress and ‘standard’ security practices. I’ve also made it riskier that my code would even run, since many hosts prevent executable code from running out of that folder for security.
So how do I meet the (assumed) criteria of not having someone rip off my code?
You don’t. Your machinations aren’t preventing it now, and they won’t prevent it tomorrow. Hexcode is easily parsed. Even the Zend framework has to be able to be reversed to be run, so a dedicated person will always find a way around it. And the majority of your users aren’t going to be the problem. It’s those extremes. So what you’ve done is wasted time, effort, and money to annoy the majority to stop the minority. Let people inspect your code. If someone steals it, there are laws to help you handle them. Use them. Theft is theft. The GPL may allow them to take your code, copy and expand on it, but it doesn’t let them violate your copyright.
All the work you’re doing to hiding your code is about as useful as preventing right-click on images. It doesn’t protect the end users, and it doesn’t protect your intellectual property.
**Categories:** How It Is
**Tags:** coding, development, essay, wordpress
---
### [Why I Don't Use Git Flow Anymore](https://halfelf.org/2016/no-more-git-flow/)
**Published:** May 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I don't regret Git Flow. It taught me a lot and made me comfortable. But now it's time to spread my wings.
**Content:**
Please don’t get me wrong. I love git-flow. I think it’s great. But it was great to teach me *how* to use git. It taught me not to use `master` for my development, and how to make branches and all that. Git Flow got be in the habit of doing good things and testing and showed me how to work with multiple projects. It was a great crutch to get comfortable with the ideas of Git that (for a long time) confounded me.
But I don’t need it anymore. Instead, I do things very, very simply and my flow is as follows.
`$ git checkout master ; git pull`
I always start by assuming I’ve forgotten something and need to sync up. This works for me, since I run on two computers.
`$ git checkout NewProject`
Once I’m in the new project, I start making all my edits, add my code, etc. Now here’s where I get a little silly. If I’m working on my own stuff, it’s Coda, always, so I’ll constantly ‘commit all changes’ and fill in my commit messages and then *cancel out*. I do this over and over until I’ve reached a point where I think “This code is ready to be tested.” Then I commit for real.
This means my commit logs look like this:
There are other ways to do this, of course. I’m a huge proponent of keeping [change logs](http://keepachangelog.com/) but a commit message should be useful too.
It’s too easy to put in this: `git commit -m "Adding new icons"`
While it’s more time consuming, just use `git commit` and put in a good message like I did up at the top. Now, this is not new. A hundred people have all said this before, but it bears repeating.
- The first line is your subject, keep it to 50 characters.
- Capitalize the subject line but don’t use a period
- Use the imperative mode – “Add new icons” and not “Adding new icons”
- Leave an empty line between subject and body
- Explain what you did in the body, keeping lines to 72 characters
- Bullet points are okay – use a space before a hyphen for best compatibility
- Reference any issues at the bottom – “Fixes: #123” or “See Also: #456 #789”
If, like me, you commit and then, before merge, realize you have changes, use `git commit --amend` to add your new changes to the existing commit.
**Categories:** How It Is
**Tags:** development, git, workflow
---
### [Aiding Symbol Selection](https://halfelf.org/2016/aiding-symbol-selection/)
**Published:** May 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Managing the icons in a more visual way sometimes means offering more education.
**Content:**
Last week I was talking about the difficulties I was having with [Symbol Selection](https://halfelf.org/2016/perils-symbol-selection/). At it’s crux, the issue is explaining something visual that’s clear to me but may not be to others.
What I ended up doing was making in-line documentation. When you edit a category, you see the option to change the icon, but now it has some exposition:
This is pretty simple, I now, but the point is that if you get that far and go “Wait, what?” your eyes will hit that link and you’ll probably click on it and get the new Appearance page:
The page is generated by an mu-plugin, and quite simply it scans the folder for all the symboicons and shows you each one. Since it’s in an mu-plugin and the images are a part of the theme, I put in an extra check to see if the folder is there and, if so, show an error.
It’s not perfect, but it helps.
**Categories:** How To
**Tags:** design, essay
---
### [PSA: DreamObjects URL Changes](https://halfelf.org/2016/psa-dreamobjects-url-changes/)
**Published:** May 20, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There's a possible breaking change to DreamObjects coming up in September. Be prepared.
**Content:**
If you use my DreamObjects plugins, don’t worry, I’ll have them updated before September.
## What Changed?
As part of ongoing service improvements, DreamHost made a subtle, but critical, change to how everyone accesses DreamObjects. Specifically, they changed the DreamObjects hostname to prepare for upcoming enhancements.
Old hostname: `objects.dreamhost.com`
New hostname: `objects-us-east-1.dream.io`
## I’m a developer who uses DreamObjects. What do I need to do?
If you were ever using the URL `objects.dreamhost.com` in your site, you need to change it to `objects-us-east-1.dream.io` and everything will be awesome.
## Is it really that simple?
Not always. For *some* plugins and code, it is that simple. For my backup plugin, I added in a new option:
`if ( !get_option('dh-do-hostname')) {update_option( 'dh-do-hostname', 'objects-us-east-1.dream.io' );}`
This way I can later make it a dropdown for people to select as they want.
But for my CDN plugin there’s a major issue. You see, the way it works is that it updates the URLs of images within your posts. It, literally, edits your post content. And that means a change has to go back and fix all the URLs. I had to write some fairly weird code to do this. I’m still testing it fully, and I think it’ll do everything I need, except it’s not going to perfect.
Right now it does it’s utmost best to fix any URLs on a site, however it will *only* fix the ones for images it can **detect** are on DreamSpeed. I am aware that some people with a phenomenal number of images manually copied their uploads folder to DreamObjects and ran a command like this:
`wp search-replace 'example.com/wp-content/uploads' 'objects.dreamhost.com/bucketname/wp-content/uploads'`
Or maybe they used the [InterconnectDB script](https://github.com/interconnectit/Search-Replace-DB) or another plugin. Those people you’re going to have to watch out for and inform in a useful way as to how to fix it.
## I’m an end user. Do I need to care?
Yes. You do. *Do not* try to fix it on your own just yet. Not until the plugins you use have updated and said they’ve corrected the issue. Then read the FAQ or any alerts to make sure you don’t need to do anything else. If you’re not using DreamObjects as a CDN, this should be pretty painless.
If you did, or if you moved it all manually, you will have to do it again before September 5th, 2016 or all images will break.
Thankfully, if you’re on DreamHost, you can run the following command:
`wp search-replace objects.dreamhost.com objects-us-east-1.dream.io`
That will upgrade everything for you. If you’re not, you’ll need to use the search/replace tool of your choice.
Again: *WAIT* until any plugin you use for this has been updated. I personally contacted everyone in the WordPress.org repository and informed them about it, but since I know that’s not perfect, I’m doing this too.
## This sucks!
I know. It does. But I don’t see a better way around it.
## When will your plugins be updated?
Before the end of May. I just want to test it on as many large sites as I can find.
**Categories:** How It Is
**Tags:** dreamobjects, plugins
---
### [De-fontification](https://halfelf.org/2016/de-fontification/)
**Published:** May 16, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
I love fonts. They’re a great way to make your site unique. Back in the early 2010s, we were all using them all over the place.
It’s time to retire them.
This month, [WordPress core pulled it’s dependency on Google Fonts](https://core.trac.wordpress.org/ticket/36753) and I couldn’t be happier. The concept behind the [Font Natively](https://make.wordpress.org/core/features/font-natively/) project is incredibly simple. Remove Google Fonts, everyone wins.
Back when we added Google Fonts for core, it was not without it’s naysayers, and I was one. Am one. There are days when I cannot access Google for reasons. When my father’s in China, he can’t get Google Fonts. The web looks very different fro him.
> Instead of relying on an external resource, Font Natively moves the WordPress admin back to system fonts. This leads to faster load times, especially when working offline, a removal of a third-party dependency, and a more native-feeling experience as the lines between web experiences and apps continue to blur.
With this in mind, as much as I love Fonts and especially Fonticons like [Font Awesome](https://fortawesome.github.io/Font-Awesome/), I’m stepping away from them. And really this is me moving on and giving up the control over my website having to look a specific way.
This is a philosophy. The site will never be pixel perfect for everyone. People look at my sites on tablets, phones, Macs, Windows, etc etc and so on and so forth. The concept that you can absolutely control the specific layout, every single molecule, is long gone. The best we can do is make it look as good as possible on all those things.
Part of making the site look better is making it load better, and better here means faster, which is yet another reason. I don’t need all the icons in Font Awesome, for example. I needed four on one site, five on another, and one on a third. Do the math.
As for Google Fonts? Well. They had their day. But even Google tells you that using blog and italics and all that would slow your site down. Guess what? I use bold and italics *a lot*. I *like* emphasis. So for me, I was always going to need them, and it was always going to slow things down.
And finally, finally, it’s 2016. We didn’t have good system fonts in 2008. Now we do. Let’s embrace and drop the fonts we don’t *need* and only include the ones we *require*.
**Categories:** How It Is
**Tags:** design, essay, google
---
### [Farewell Mothra, Hello Ogra](https://halfelf.org/2016/farewell-mothra-hello-ogra/)
**Published:** May 9, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Moving cPanel to CentOS7 wasn't hard at all!
**Content:**
For some reason I name my servers after Godzilla monsters. I currently have two – ogra and gamera. [Gamera](http://godzilla.wikia.com/wiki/Gamera) is a new DreamCompute box I’m using to test things on, but [ogra](http://godzilla.wikia.com/wiki/Ogra) is this server.
## Gamera
There used to be a server called Gamera before Gamera. Original Gamera was my very very first VPS. At the time, I had four websites, all with separate hosting plans, and I mathed out that it would be cheaper to combine them to one VPS and learn that.
Boy what a jump that was! This was my first experience with a VPS at all, but I think that, in retrospect, it gave me comprehension of the web in a new way. Before, I was just a user of the internet. After, I understood why so many sites behaved differently. Gamera was actually how I got to know Mike Schroder! We’d added ImageMagick to WordPress and he was an aficionado. I was trying to test some things and he pointed out I didn’t actually have it installed. Off to the races!
## Mothra
As Gamera got long in the tooth, I needed to upgrade some software and realized that doing so wasn’t going to be possible anymore without an OS upgrade. Instead of that, however, I looked into a whole new server on a new system: the cloud.
This really just meant I had a more dynamically upgradable server. It was easy to add more memory or diskspace. I could spin up new clusters as needed (though I haven’t needed to yet), and it was bigger and faster and better.
I learned a lot on Mothra. Everything from memcached and nginx to varnish and SSL was done there. I’ll miss it.
## Ogra
Of course time went by and I installed all sorts of shit on my server. And, eventually, I wanted to upgrade to the newest operating system and test it without downtime. This *can* be done, but I decided to build a new server on the latest and greatest OS and migrate my sites. Building out the server was easy, as I have a document called “How I Installed Shit On My Server” and I was able to use that to rebuild everything I needed. Some things had changed and got updated, but in general it was pretty much the same thing.
Since everything was on cPanel and WHM, transferring sites was incredibly painless. Where, five years ago, I had to ask for help, this time I was able to press the pretty buttons and do it myself. The most terrifying part was the DNS. What I did was move accounts over one at a time, starting with the smallest site and building up. Then I’d change my `/etc/hosts` file to point to the new IP and verify everything worked. As soon as the site was good, I changed it to the new nameservers (ns3 and ns4) and moved on to the next one.
This was only a problem when I ran into my Aunt’s website, which has the DNS over on Microsoft. A few emails later, I logged in as her and changed the setting (and saved her account information for the next time). Sadly, Microsoft doesn’t let you point a domain to a CNAME, you have to use an A record, which means IP and doing my migration this way required a new IP.
## What Now?
Now I’m waiting on EasyApache4 and full support for [Let’s Encrypt in cPanel](https://forums.cpanel.net/threads/lets-encrypt-support.538621/).
**Categories:** How It Is
**Tags:** servers
---
### [The Beta Tester's Paradox](https://halfelf.org/2016/beta-testers-paradox/)
**Published:** May 6, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The more likely a person is to test Beta and RC, the less likely they are to have bad code.
**Content:**
In a nutshell, the paradox is this:
> The more likely a person is to test Beta and RC, the less likely they are to have bad code.
When people wonder why problems like the recent jQuery flub manage to make it all the way into the wild, they tend to assume the issue is not testing enough. They’re incorrect. The issue is not testing enough.
Put the lead pipe down.
What do you think ‘enough’ is? I promise you, the majority of people who have a broken site will say “It needed more time being tested.” And in return, the majority of developers will say “It needed more people with more diverse setups testing.”
So which one is right? They both are. We need more of the *right* people testing. We need people who are on the edges of ‘normal’ for WordPress. The problem is that the ‘right’ people are the people who have the worst code.
Take a look at WordPress 4.5. Not a *single* beta tester was using a plugin or a theme that used jQuery improperly. Look at Jetpack 4.0. Not a single beta tester had a server config that broke, but within 12 hours they had over 300 tickets about an error 500 on many sites. In both cases, a significant amount of testing was performed. People banged on the code and outright tried to break it. Just not the *right* people. And the worst thing is we cannot know who is the right person until after something breaks.
This leads to the other part of the paradox.
> Someone whose site breaks after an upgrade is less likely to want to beta test.
This is because we’ve broken the trust. They cannot accept that their site went down, or their computer crashed. Or maybe they can’t afford to be Janie on the Spot and jump every time their site needs a bit of an extra hand when an upgrade goes bibbeldy.
Of course, this is why the people who *are* testing are *less* likely to have a problem. They don’t want to waste time debugging stupid code problems, so they put the time in front to make sure they don’t introduce bad code to their environment.
We create a vicious circle, because the only way to get better results from beta is to get more people beta testing. But few people are willing to fully beta test on a live site, and say what you will, there’s nothing quite like live testing on a real, production site. You can’t stress test reality until you get your setup on your server on your design on your everything.
**Categories:** How It Is
**Tags:** essay
---
### [The Perils of Symbol Selection](https://halfelf.org/2016/perils-symbol-selection/)
**Published:** May 13, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Understanding symbols and their meanings in the real world application isn't always as easy as we'd wish.
**Content:**
When I started my little experiment with [showing icons on custom taxonomies](https://halfelf.org/2016/custom-terms-cmb2/), I began with a text field. This was because it was the easiest to edit and change right away. Next I changed it to a selection dropdown, based on the content of the folder where the I’d stored my images.
And for the most part, that’s pretty cool. Except for the part where drop-down select boxes can’t show images. This meant I had to show the image name. Generally that’s okay. I know the name of the image I wanted to use. The problem is that I know that because I know the images I uploaded. For someone else, that’s 800 images or so they have to guess at, based on names.
After playing around with selections and forms for a while, I determined there really *isn’t* a great way to show a list of images natively. No matter what I was going to have to mess with this the un-fun way because the easy way, CSS, failed. You can use `background-image` in Firefox but not Chrome or anything else that people use.
Good news! As of jQuery UI 1.11, the [selectmenu widget](http://jqueryui.com/selectmenu/#custom_render) exists. Bad news! It’s not actually simple to implement. In fact, I absolutely failed at implementation. Let’s talk about why I failed, because it’s not *just* a matter of how convoluted the code is.
A large part of my failure in this is due to the scale. If you only have one or two images, it’s less stupid. But when you get around to sets of 800 images, you start to understand why WordPress has a media uploader the way it does.
The biggest factor, though, is that searching ‘visually’ is a difficult system to maintain. Symbology, the art of getting a ‘thing’ to represent another ‘thing’ is incredibly hard to pin down. Look at your WordPress dashboard. Why does a pushpin represent posts when they’re not all that different than the ‘two sheet’ icon of pages in functionality? Why is users a single person icon and not multiple people?
Ask yourself this: if you’re adding in a new menu item, what do you make your icon? Do you make it your brand logo (a G in a circle for StudioPress’ Genesis theme)? Maybe you make it a cloud with a down arrow to indicate downloads (as does Easy Digital Downloads). We wanted to add in a new Custom Post Type for ‘Characters’ and ‘Shows’ for my database site and Tracy, who is amazing at this sort of thing, cheekily picked a video camera for ‘shows’ and a name tag for ‘characters.’
I had a related but slightly different issue when I wanted to use Mark Jaquith’s meta [I Make Plugins](https://wordpress.org/plugins/i-make-plugins/) plugin. I wanted to see my plugins on the sidebar with a more unique icon. I couldn’t use the most logical one, a plug, since we’re already using that for Plugins. I went with a little ‘awards’ icon.
In both cases, we studied the list of [Dashicons](https://developer.wordpress.org/resource/dashicons/) and picked the ones that made the most sense, but it required a visual study of what we really needed and an understanding of how they all worked. Scrolling down a massive list of all of those is annoying, but necessary. You need to look at your options, think about them, and feel what they mean contextually.
I haven’t yet figured out a perfect solution, but I’ll let you know when I do.
**Categories:** How It Is
**Tags:** essay
---
### [Switching The Main Blog on Multisite](https://halfelf.org/2014/switching-main-blog-multisite/)
**Published:** December 3, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Here's how you swap out two sites on a Multisite.
**Content:**
Previously I’d only ever posted this in my ebook, [WordPress Multisite 110](https://store.halfelf.org/ebooks/wordpress-multisite-110/).
What people mean by this is the site they originally set to be seen at domain.com is no longer the one they want to use, but the one at (say) domain.com/temp or temp.domain.com. If this is what you’re wanting to due, it’s not impossible, but it is annoying and a little tricky. If you’re using the trick to give WP it’s own directory, these are not the directions you’re looking for. I haven’t written those out yet.
First you have to go to Network Dashboard > Sites and edit the site you **want** to be the main site.
This you want to to look like this:
Make certain you leave ‘Update siteurl and home as well’ checked! If you forget that, you’ll be sad. You no longer need to check the box (it’s gone in newer versions of WP), but if you *DO* have it, check it.
Now you’d think you go to edit the main site and change it, but you can’t.
By default, the main site is not editable. This makes sense when you think about how messy this might be, so in order to edit it you have to go to your wp-config.php file and look for this line:
`define('BLOG_ID_CURRENT_SITE', 1);`
Change it to the site ID you want to use as your main site. In this example, I want site #2, aka, two, to become my main site.
`define('BLOG_ID_CURRENT_SITE', 2);`
Save the file and then you have to go *back* to your Sites and edit the old main site.
Give its path a new name and press save, making sure you keep that checkbox checked if it’s there.
In this example, I’ve picked a new URL for my formerly main site becuase I don’t want any conflicts, but there’s nothing stopping me from picking ‘two’ again and just totally swapping things.
The last step is to change your post content. Using a plugin like [Velvet Blues Update URLs](https://wordpress.org/plugins/velvet-blues-update-urls/), you will need to search each site separately and replace the URLs. If you have wp-cli, you can do that too like this:
If those look good, rerun without dry run and call it a day!
An interesting quirk is that you may need to edit the Fileupload URL if you’re using blogs.dir for your images. I noticed that on one site it was set to `http://example/two/files` which clearly is wrong. To fix that, go to Network Admin, click on Sites, and click on edit for the site. From there, click on the dangerous “Settings” tab and look for “Fileupload URL” and edit as needed to match things.
Cool tricks like this can be found in [WordPress Multisite 110](https://store.halfelf.org/ebooks/wordpress-multisite-110/).
**Categories:** How To
**Tags:** administration, multisite, wordpress
---
### [Open Source Doesn't Mean Public](https://halfelf.org/2016/open-source-doesnt-mean-public/)
**Published:** May 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Open, closed, and in between, we can't always discuss everything we work on.
**Content:**
Someone made a vague implication that my post about licenses were shots fired from someone who doesn’t ‘do’ but is only an ‘observer.’
This is quite inaccurate, though I don’t blog about it here and I don’t talk about it anywhere for one simple reason. I can’t. I signed a paper, years ago, that agreed the work I did for them would be private. I would neither reuse the code (which I can’t anyway) nor would I discuss it. In fact, I had to make a phone call to ask if I could blog about it in general. I understand why someone might assume I’m not speaking from experience, but that just makes an ass of you and me.
This isn’t about me refuting or dismissing allegations from someone who, for whatever reason, dislikes me and likes to make their hate public. No, this is about the interesting predicament about what happens when you *can’t* release information about your code.
## Half Open
Here’s your scenario. The front end is an open system, a plugin say, that one installs on WordPress. It’s GPLv2 (or later) compatible because it’s distributed code I want to put on WordPress.org. That right there is a requirement. Alright, so I have one half of a product that is GPL and Open Source. The other half lives on a server somewhere in the world and does all the backend work. The plugin? It just passes API data too and fro as needed.
I just described Akismet.
You and I know very little about how Akismet works on the backend. And here’s the thing, *that’s how it should be*. We have a lot of information on how to interact with the [Akismet API](https://akismet.com/development/api/) but none about how it actually calculates what is and isn’t spam on the back end. I repeat – this is the way it should be.
Look at what Akismet does. It magically identifies spam. While it’s all well and good to be open source, the very first thing that would happen if they opened up all their code is we would see spammers read it and subvert it.
But then again, we have things like [SpamAssassin](http://spamassassin.apache.org/), an open source product I use on my email servers. Does this mean SpamAssassin is too dangerous to use? Does it mean it should be avoided? No, absolutely not! While it’s far from perfect, SpamAssassin does a phenomenal job at catching and stopping spam. But at the same time, it’s imperfect and being public, it’s more likely to be subverted by clever spammers. Thankfully the things it checks for are parts of email that a clever server admin can protect from and, all in all, it’s useful.
## Half Closed
If we accept the fact that having a code base open or closed actually has very little impact on it’s usability, then why do we lock down our systems? That’s easy. Security and profit.
Profit is the easy answer. If a system is closed then you can’t download it and install it for yourself. This means if you want to use it, you have to pay. Again, we can look at Akismet and VaultPress, which I would wager actually are built on open source code, as examples. They don’t have to be free, after all. There’s nothing wrong with being closed, either.
By making a system a closed system that no one sees the backend code for, we create a product where only people who have access to the source code can easily infiltrate. This, of course, offers no assurance that it will never be hacked, only it raises the bar and makes it harder to deal with when it does get hacked. But at the same time, it is harder to hack an unknown than a known, and it does make things somewhat safer.
Of course, if I told you all the ATM code in the world was not only open source but freely distributable *and* it was out there right now, how would you feel? That probably filled you with a little dread, thinking about how much trouble we already have with card skimmers and ATMs. If we have people who already know how to jack in, how much worse could it be if they knew how to encode software into the fake cards they make, and use them to backdoor your accounts?
## Have Your Cake And Eat It Too
Just because the code you work on is open source doesn’t mean you can talk about it in public. Just because the code is closed doesn’t mean you can’t.
I’m not talking about licenses here, though, I’m talking about contracts. I signed a paper about certain code I’ve written that prevents me from discussing it. So while I’d love to tell you everything about everything I’ve worked on, I can’t. But that’s not a bad thing. I’ve been privileged to work on the open and the closed, and it’s given me a greater appreciation and understanding of when we should and shouldn’t open our work. And this comes down to understanding the nature of the risks involved.
Things like ATMs, financial trading, and mortgages should be secured and private. Why? Because the risk is much too high. A license? Well a worst case scenario is that someone figures out how to backdoor a free license for themselves. Another is they figure out how to use someone else’s license to gain access to their information. Those are pretty bad. So if you want to make your license API open but the code behind it not, I support that call.
But. I do think you should have a way to manage your licenses and updates. That’s just business sense.
**Categories:** How It Is
**Tags:** development, essay, freedom, open source
---
### [Referrer Spam In Adsense](https://halfelf.org/2016/referrer-spam-adsense/)
**Published:** May 2, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Oh joy, oh rapture, Semalt is at it again.
**Content:**
You may have heard of Semalt.com. I’ve heard them argue that they’re not spammers, they’re not evil, they’re not bad people.
You know what? They are. They are spamming, they are doing evil, and they’re bad people.
The other day I was checking my top-sites in Google Adsense, trying to think of how to increase revenue on my passive income, when I saw this random domain showing up on my list of sites. A site that wasn’t mine. A site that looked like a spammer:
## Why is this happening?
[According to Google](https://support.google.com/adsense/answer/179827), this happens when a site loads cached content of your domain (Google does this). It can also happen when someone copies your whole webpage into an HTML email, or if someone uses a bad iframe.
There’s also the obvious, but rare, case where someone uses your code without your knowledge.
## Do I need to block them?
No. Except for the part where they screw up your analytics metrics and cause load on your server. Keep reading, I’ll explain.
## Will I Be Penalized by Google?
My first thought was “Oh shit, Google’s going to yell at me!” I quickly checked that I had [site authorization](https://support.google.com/adsense/answer/65062?hl=en) on, which means only domains I’ve approved and added can show my ads. Whew.
This is a big deal by the way. While it would be nice to earn more views, if a site that isn’t mine uses my ads without knowing, I *can* get in trouble. More than once I’ve told off plugin developers about using Adsense in their plugins. This is for a couple reasons, first is that you can use it to track who uses your plugin (bad), but also because *Google* doesn’t want you to. They outright say that you cannot put ads “on any non-content-based page.” An admin dashboard is not a content page. Done and done. No ads in your plugins, thank you.
But that’s *exactly* why I was worried!
Where is Semalt showing my ads?
## What is this URL for anyway?
The URL was `http://keywords-monitoring-your-success.com/try.php?u=http%3A%2F%2Fexample.com` (not my real URL). The only reason I could find it was I dug into my Google stats and found it as a referrer. If you happen to pop that into a browser, you will be redirected to `http://semalt.com/` — Real nice.
That is, by the way, how I knew it was Semalt.
## What is Semalt?
Semalt is a professional SEO and marketing service. They literally make their money ‘crawling’ websites. When their site started, it was really the scamiest looking thing I’d seen in a long time. A year and a half later, they’ve cleaned up their act a bit but back in 2014 we all looked at them with a massive Spock eye.
As it turned out, they were using [infected computers to scan the web](http://blog.nabble.nl/post/93306955157/semalt-infecting-computers-to-spam-the-web). My personal guess was that they are leveraging hacked computers and using them to scan for vulnerable websites. Once they find a site, they hack it and use it to push malware.
That’s a guess. I have no proof. But based on their search patters and behavior, it’s looking pretty likely to me.
## Can I block them?
Yes! But there’s a catch.
You see, everyone says you can do this:
And while that works, it’s obvious that Semalt is on to us because now they use `keywords-monitoring-your-success.com` and other URLs as passthroughs.
## How do I get them out of my analytics?
Do you use WordPress.com? Or Jetpack? Great! [Report the referrer as spam](https://en.support.wordpress.com/stats/#marking-spam-referrers)! WordPress.com blocked Semalt back in 2014, but obviously they’re on the rise again.
If you’re using Google Analytics, [Referrer Spam Blocker](https://referrerspamblocker.com/) is probably your best bet.
**Categories:** How It Is
**Tags:** analytics, spam
---
### [Too Many SVGs](https://halfelf.org/2016/many-svgs/)
**Published:** May 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Slow down, your blog's gotta last. You've got to make that download fast! Just zipping through the kilobytes. Viewing your site should be so groovy.
**Content:**
I was looking into moving a site from Font Icons to SVGs for a few reasons. The primary is that, with an SVG, images will look crisp on all monitors, including the non-retina displays. They literally look better on my crappy old MacBook, instead of just on my iPad.
Once I had the one site done, I went to look at another. It was a smaller site, running a Hugo as a static site generator, and I thought it would be perfect.
I was wrong.
## Using SVGs is Easy
Replacing my font icon with an SVG was as easy as making my Facebook call this:
Done. It’s tiny (2kb) and there are six similarly sized images which makes for 18kb which is incredibly smaller than the 200kb or more that Font Awesome can be. Simply, I realized I was only using five of the icons (on every page) and how stupid was that? I don’t *need* the whole library!
I will note that ‘styling’ SVGs can be an exercise in patience, since you cannot apply CSS styles when you embed as an object. Thankfully, I wanted to make the icon match my style so I edited the style directly (which is the topic of another post). If you use PHP, I recommend using `file_get_contents()` to get the contents of the svg, and then use normal CSS to style. I was using plain HTML. There are tradeoffs.
## Using too many SVGs sucks
My initial tests, using the footer first, and my page loaded much faster. Elated, I jumped over to all uses of the fonts, and remembered I had a page that listed a series of items with star rankings (none through five). I changed the generator code behind that to be object icons and reloaded.
The page was slow.
It was like dialup modem slow. Absolutely painful.
After some research, I ran into [this post](http://frozeman.de/blog/2013/08/why-is-svg-so-slow/) about why SVG was so slow, and found a graphic that explained it clearly.
What the graph demonstrates is simply that the more objects you have on a page, the slower it is. That part is obvious. The more *anything* on a page, the slower it is. So why are SVGs slower than PNGs? Why was I only seeing this on an HTML page with 50 images, and not on a WordPress generated PHP page with the same amount.
The answer was because the SVGs have to be *rendered* on the HTML page. I was using `` tags on the HTML and `file_get_contents` on the PHP. The way the PHP code works, it pulls the file into content and dumps it out, not processing. Since the files are so small, and since the there’s no object rendering involved, the rendered PHP was faster than a static HTML. In this case.
## Can It Be Faster?
After I was done face-palming, I asked myself if it was possible to speed this up? Fixing this comes with understanding the cause. Once I determined that the issue was rendering the object and *not* the SVG itself, the solution unfurled before me.
Instead of using object tags, I could include SVGs like this:
The downside is that this looks uglier. The upside? This is hella fast and it’s *still* lighter weight than including a font icon, and I don’t have to upload images.
## SVGs or Font Icons?
This is a question for the ages. They can both be made accessibility friendly, they can both be optimized. Arguably, font icons are compatible with more browsers, but it’s also 2016 and if people are still on IE 8 (sorry banks), the Internet looks pretty shitty anyway. I can’t tell you which is better, and I find use for both in different situations. I love font icons a great deal, but just as I love WordPress, there’s a time and a place for them. And a time and a place for something else.
**Categories:** How It Works
**Tags:** design, development, font
---
### [Making More With Less Work](https://halfelf.org/2016/making-less-work/)
**Published:** April 27, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making my code do more work for me, with custom meta content and repetition. And repetition. And repetition.
**Content:**
The other day, I added [meta data of an icon to a custom taxonomy](https://halfelf.org/2016/custom-terms-cmb2/). When you need to add one or two filters to one or two items, it’s simple.
Replace `{my_taxonomy}` with your taxonomies, call it a day. But when you add in two, or three, or four, you don’t want to make four, or six, or eight lines of code. And when you’re calling the same array over and over, it’s time to get smart.
## Make An Array
I originally only want to do this custom work in one taxonomy, so it was no sweat to repeat a little code. But then I realized I wanted to see it in four. Maybe more. So I picked out my array:
I made this outside the two functions, because I knew I was going to need it in multiple places. It would necessitate me tossing `global $icon_taxonomies;` into every function that needed it, but that was okay. Better that then trying to make sure every time I updated an array, I did it in all the places. Once is better.
## Make Your Loop
The easiest thing was to trigger this on admit\_init. Grabbing my global, I ran a simple for-loop from that array and added a filter based on the taxonomy named stored in the array:
## Is It Really Less?
A clever person will count the lines in this code (10 when you add in the variable) and think “Mika, you wrote two extra lines!”
A more clever person will count the lines and think “At 5 taxonomies begins the break even point.”
I know. From the outset it looks like I’m taking more time to over-engineer the solution to a very simple problem. And while I am, I’m also making it easier not to make typos and not to forget a step. I can make one change, one word, and update multiple places becuase that array is *also* used back in the `my_register_taxonomy_metabox()` function.
I removed the array and tossed in the new code.
Yes, that’s adding two lines, but it removes my need to think “Where does this all go?” down to one place. And yes, I documented this in-line. The code header has a nice docblock explaining the whole section, what each variable is, and what each function does.
**Categories:** How To
**Tags:** coding, design, wordpress
---
### [Custom Terms and CMB2](https://halfelf.org/2016/custom-terms-cmb2/)
**Published:** April 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Let's say you have some custom taxonomies in WordPress. And let's say you want to add a special field to them for an icon. How would you do it?
**Content:**
Let’s say you have some custom taxonomies in WordPress. And let’s say you want to add a special field to them for an icon. How would you do it?
There’s a cool plugin by someone I know that can do this, called [WP SVG Icons](https://wordpress.org/plugins/svg-vector-icon-plugin/) and it works great. But it wasn’t quite what I needed.
You see, I had 832 really awesome SVG icons I wanted to use. In order to use Evan’s plugin I’d have to convert them into a font using Icomoon. I already had about 300 in a font, which is cool, but I was in the thought to move these from fonts to pure SVG anyway since they’ll show up in better detail if you don’t have retina screens. Also they’re smaller and loaded on demand and … well it is what it is.
I decided the simplest solution was as follows:
1. Upload all the SVG to the server
2. Add a custom term meta field to the taxonomies for ‘icon’
3. Show the icon on the Terms List Page
4. Show the icon on the Term Edit page
And yes, it works.
## Where Do The Icons Go?
I put them in my theme. They’re pretty specific to the theme itself, but usually things that are related to custom data ends up in `mu-plugins` since I want them to exist outside of the theme. For the record, I also have CMB2 outside the theme, so the code is all there, but the images are in the theme. You can decide how you want.
## Adding Custom Term Meta
There are a lot of ways of doing this, but as I’m using CMB2, well, I’m using CMB2 so it looks like this:
You’ll notice `before_field` there. That’s what will let me do the 4th item on my list. The description tells you how to use the field. Don’t worry, I do sanity checks later on.
## Show The Icon On The Terms List
I wanted the icon to show after save so that people would be able to know what they’d added and change it if needed.
You can see where I’m checking if the icon has been set *and* if the file exists. What this does is first generate a column for the icon and then populate the content based on the term information.
There you can see the icon, looking rather nice.
## See The Icon When You Edit
This is a little different. I had to check the output the of the field value, which is set by CMB2, and then base the rest of the code off that.
Again I double check the file actually exists, just in case you typo.
I put it before the field because that looked better to me, but there are other places this could go.
## Results?
I started this because, originally, it was all done with CSS. That meant if people added in new terms, someone with admin ability had to go in and edit things. This way, people can not only see what they’ve added, but you can get a quick view of what doesn’t have icons set. It’s instructive and has visual feedback.
The ‘next level up’ would be to only allow selection from a dropdown.
For the least amount of hustle, add this to your `my_register_taxonomy_metabox` function:
And then replace `'type' => 'text_medium',` with this:
And voila. Done. Now you’re even harder to get wrong.
It even looks good.
**Categories:** How To
**Tags:** coding, terms, wordpress
---
### [A Blog Thought On Documentation](https://halfelf.org/2016/blog-thought-documentation/)
**Published:** April 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
Everyone, everyone, hates doing it. We all do.
But there’s something that blogging regularly has brought me that is specifically related to documentation. And it’s this.
I am more likely to write down exactly how I solved a problem if I think about it as a new blog post.
I know, that sounds so simply it’s stupid, but I’ve realized that the whole reason I’ve figured all these things out is that I want to have something to blog about, and I want the blog posts to be interesting, so I started writing down how I solved problems.
Of course, the joy of a problem is in the solving, so most of the time I’m talking about happy things. I do also blog about my failures, my missteps, and my totally-wrongs. Nothing wrong with being wrong. You learn a lot more from it, I feel.
## Start Without Code
When I start ‘figuring out’ a thing, I write it down without any code. I write down “I want to do X.” And then I start brain storming.
Take Monday’s post about term icons. “I want to assign an icon to a term.”
That’s how it started. Then I talked through my vague concepts:
- Show the icon on the back end
- No uploading icons
- Show the icon on the term edit and terms list page
- Make sure it can show on the front end
It’s really just the broad ideas. I’m not digging in deep.
## Pick Something Easy
When I start coding, I pick the thing I already know how to do the most of. In this case, it was showing the icon on the *front* end. That let me start in comfort. I uploaded the images to the development server ([VVV](https://github.com/Varying-Vagrant-Vagrants/VVV) in this case) and started messing around with showing the images on the front end.
I hardcoded in everything at first, using a default icon of ‘bacon’, and went about figuring out how I wanted it to display. I didn’t document this as much since it really was just about the look first. I knew when I got down to brass tacks, I’d be doing this:
All of that code, except the icon part, was already written. That’s why it was easy.
## Pick Something Obvious
Once I’ve done something easy and boosted my confidence, I start with the actual work. How do I set a term meta for a custom taxonomy?
I knew how to make custom meta boxes, but taxonomies were different. I quickly remembered all the work Boone did for WordPress 4.4 and read his post on the [Taxonomy Roundup](https://make.wordpress.org/core/2015/10/23/4-4-taxonomy-roundup/). That way I learned that, as I had assumed, `get_term_meta` was a thing.
Then I check to see if CMB2 knew how to use term meta, and happily found that it will work with term meta out of the box. No extra work. Thus the obvious became simple and I made a custom meta box for my term to put in a plain text field which was (originally) the path to my media file.
I used that process to start the blog post. That was the new thing, so I wrote up the answer, not the process, and explained how to do the thing.
## Write About the Tweaks
At that point, all that was left was busy work. I added in how to show the images on the back end, but then… then I did something extra. As I wrote the end of the post, I asked myself what the next logical step was? Well that would be not letting someone typo or put in names of images that didn’t exist. Instead of having to document all the images, I could just show a list.
And that’s what I did.
## Share It
This is actually universal.
If you just documented something, you either did it so you can repeat the process over and over, or so you could have someone else do your dirty work for a change.
If it’s personal, change ‘share it’ to ‘store it in an accessible place.’ Something in the cloud will do in a pinch. I often have my little things in a DropBox folder called “How Do I…” That’s because I usually ask “How do I edit all the images for …”
But if it’s not personal, if I know a group will have to do it again later, I document it and share it. It may go in the company internal knowledge base or maybe it’ll be on a GoogleDoc shared with the people who need to know. Maybe I’ve put it on this blog.
Either way, I documented. I released it.
Now it’s your turn.
**Categories:** How To
**Tags:** coding, documentation
---
### [Prettier DreamObjects Listing](https://halfelf.org/2016/prettier-dreamobjects-listing/)
**Published:** April 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making my DreamObjects image lists look prettier.
**Content:**
A long time ago, I wrote about how to [list your objects on DreamObjects](https://halfelf.org/2015/listing-everything-dreamobjects/). This code still works. I’m using it today, and as long as my bucket is public, it’s perfect.
It’s also kind of ugly and a hassle to get the link. I have to right-click every time, and really I just want to grab the link, paste it somewhere else, and go.
Thankfully it’s 2016 and there’s a library called [clipboard.js](https://zenorocha.github.io/clipboard.js/) that does this.
Before I did that, I decided how I wanted the layout to be. Two buttons, one for a link copy and one for a link to open in a new window.
Looks pretty basic, I know, but it’s better than that list.
Next I took my foreach loop and made it this:
This gave me the output and set me up for the script code at the bottom of the page:
Obviously `clipboard.min.js` is what you think it is, but the tooltips is so you can have that nice `showTooltip` popup so you know what you just did.
When you combine that with the work I did the other day for a droplet, all I have to do is keep that page up and handy to throw links at people.
You can see it at .
Before you ask, since not everything there is an image (‘Wrong’ is Dom Deluise shouting that), and since the images are all varying sizes, I went with not showing the image at all.
**Categories:** How To
**Tags:** coding, dreamobjects
---
### [DreamObjects Droplet](https://halfelf.org/2016/dreamobjects-droplet/)
**Published:** April 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Giving the world a nope-ta-pus!
**Content:**
I have DreamObjects, I have Transmit, and I have gifs I like to throw at people. I’d been using a tool called CloudUp, which is cool, but it had been broken for a while and was bothering me, so what I really wanted was a way to save my images to DreamObjects. It’s dogfooding, right?
## Add To Transmit
I like [Transmit](https://panic.com/transmit/). I have the desktop app and I’ve used it for years. They do it right. Early on they added S3 to their app, so adding DreamObjects to it is so simple it’s painless. We have cool[ directions on the DreamHost KB](https://help.dreamhost.com/hc/en-us/articles/215322248-How-to-Use-Transmit-with-DreamObjects) about how to do it.
## Make a Droplet
Once you’re connected, you need to make a droplet. I happen to have a bucket called `ipstenu-images` which I use for all my images. I know, it’s totally imaginative. Next I hit right-click and selected ‘Save Droplet For Folder’. It looks like this:
I chose to save mine in the ‘favorites’ folder, which I sync on Dropbox. I did choose to save the password information as well, which if you’re doing this on your own computer is relatively safe.
When it saved, it opened up a Finder window with my new Droplet, named “DreamObjects droplet.” I dragged that to my taskbar and tested it by dropping an image.
[](https://ipstenu-images.objects.dreamhost.com/nope.gif)
That’s my default test image.
## Set Permissions Properly
Except it didn’t work!
The permissions error was because the upload defaulted to only letting the owner see the image. Thankfully this is an easy preference setting in Transmit. Go into Preferences, then Rules, and at the bottom you have permissions. Click on the S3 tab and change “Read” from “Owner” to “World.”
Now anyone can go to and see a nope-ta-pus!
**Categories:** How To
**Tags:** dreamobjects, s3, transmit
---
### [On The Fly Checklists](https://halfelf.org/2016/fly-checklists/)
**Published:** April 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making your checklists fly.
**Content:**
When you do the same thing over and over, the best thing to do is automate it. We all know that.
However there are simply some things you cannot automate. As horrible as that is to say in today’s world, you cannot automate things like “Proofread content for errors.” Why? Well a computer only knows to look for what you tell it to look for. And if you habitually typo homophones, you’re in for a long day.
That’s why we have things like checklists. Do X, check Y, etc etc. They’re there to ensure when we run the automated steps, we do everything properly.
I spent the first half of April generating Pre-Flight Checklists for a lot of things. How to upgrade things at DreamHost, how to update things at WordPress.org, how to migrate from X to Y, and so on and so forth. The sad thing is that I’ve had to do all these for long standing processes which exist mostly in someone’s head.
Here are some tips to how I do it.
## Write Your Checklist As You Do It
If it’s a process you know, have a document open (or a piece of paper) and write as you go, enumerating every single step. Be pedantic.
> On Your Computer:
>
> 1. Generate list of X
> 1. Go to Y and click BUTTON
> 2. Copy list to DOC
> 3. Run TOOL to output new file
> 4. Add new file to repository
> 1. $ git commit -a FILENAME
> 2. $ git push
>
> On Remote Server:
>
> 1. SSH to 123.45.67.89 as your ID
> 2. Go to folder BAR
> 1. cd /home/blah/foo/bar
> 3. Dryrun sync command
> 1. sync bar baz –dry-run
You get the idea. Like I said, be specific and get every single thing you do. Don’t worry about getting everything perfect. This is about getting all the information.
## Walk Through Your Checklist
Once you have it up, walk through it and do everything (except the actual code push parts). This will show you how you can clean it up and what needs to be explained better. I find it helpful to ask myself “If I was new, would I know what ‘the remote server’ is?” If the answer is no (which it often is), I become more pedantic and specify what server to connect to and exactly how.
For example instead of “Connect to Servername” I’ll put in this:
> - Connect to production server
> - `ssh servername` — use your ID and password
Using the different font helps me to know it’s a command and not directions. Any time you feel something is vague, explain it. Put in examples of output. Don’t be afraid to break the ‘flow’ of a checklist to ensure clarity.
## Ask Someone Who Knows to Proof
If this is a process someone else has done, grab them and have them skim it for anything obviously wrong. Often I’m writing and refining a checklist for something I don’t actually do, but I watch regularly. With that mindset, I’m able to write from a place where I know enough to know what has to be clear to someone new. A place of no assumptions.
That person should question your claims. if you say “Check X” and they come back and ask you “Why are you doing X in step 15? You do the work in step 4. Why not do them together?” That’s a good thing! You want to be clear, but if there’s work that’s duplicated, you can save yourself and the future-you time. Also that person is going to be the one who says “We should explain *why* we do this…” They’re going to teach you more about the process.
## Ask Someone Who Doesn’t Know to Proof
This is harder. You need someone who knows ‘enough’ that you’re not explaining what SSH is, but doesn’t automatically make assumption. This may be why I end up on checklists a lot. I pestered the hell out of my coworker, Mike, and asked him to explain things in broad terms and then nitty gritty. I asked him to walk me through the steps, then I wrote them down and turned around to someone else and asked “Does this make sense?”
Why? Because Mike was too close to it to see the forest for the trees, which is a good thing! He knows it all! I was fairly close to it, enough to possibly get in over my head. By grabbing a total novice, we had the trifecta of brilliance. That third person asked “What is this?” and noted multiple things that might be wrong.
## Release and Iterate
You’re going to miss things, so every time you do the process, have the red pen ready.
**Categories:** How To
**Tags:** development, essay
---
### [Null and Zero](https://halfelf.org/2016/null-zero/)
**Published:** April 13, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** To a human, they're similar. To a computer, they're not.
**Content:**
This is an amusing anecdote.
When I was working on my [cross-check of shows and characters](https://halfelf.org/2016/combining-data-multiple-cpts/), I got everything working right except one thing. I noticed my count of ‘shows with death’ made a weird pie chart. You see, the number of shows was off by one compared to the total number of shows. I went back and forth, trying to figure out why it was doing that, and in the end I decided that I’d output the list and manually count to see what I was missing.
I counted, by hand, the shows that I got with the list of ‘all characters are dead’ and that number matched what the code output. Then I subtracted that from the number of ‘shows with any death’ to get the ‘some characters are dead’ count, and that too was okay. This meant that, for some reason, the list of shows where no one died was wrong. But it was subtraction! How could it be wrong!
Well as it turns out, I forgot that null and zero aren’t the same to a computer, but they tend to be to a human’s brain.
Now I *know* this! I know that zero is a number, it’s a value of the known quantity of zero. And I know that ‘null’ is a *non value*, meaning that it’s a data point that cannot yet be known.
You can’t math on null. And I knew this. Earlier in my code I’d written `$foo = 0` outside of my loop where I check and, as needed, increment it with `$foo++` specifically because you can’t add to null.
> Nothing from nothing, carry the nothing…
But. In my calculations, I checked the following:
1. If a show has been flagged with ‘death,’ count all the characters.
2. For each character, if they’re dead, add 1 to the death count.
3. If the number of characters is the same as the death count, add this show to the list of ‘kill ’em all.’
4. If the number of characters is greater than the number of dead, and the value of either isn’t 0, add the show to the list of ‘kill some.’
Then, separately, I checked “If the show has *not* been flagged with death, add the show to the ‘kill none’ list, because that’s a 1/0 check. And when you don’t think too deeply about that, it sounds fine, right? If they aren’t marked with death they must kill none. And if they don’t kill them all, and they don’t kill some, then the number should be the same as the ‘kill none’ list.
The problem was that I had one show, just one, where all the characters were alive but it had been flagged with death. This was not an error. The show *did* kill off a character, but I’d not added the dead character yet. Which meant it ran through the checks like this:
1. Flagged with death, we count all the characters (8).
2. If the character is dead, add one to death count (death count is 0).
3. If the number of characters (8) is the same as the dead (0), add to ‘kill them all’ (false).
4. If the number of characters (8) is more than the dead (0) (true), add the value of either isn’t 0 (false), add them to ‘kill some.’ (false).
Which isn’t wrong at all. It just meant that the show didn’t get listed on ‘kill none’ because it was flagged with dead, and it didn’t get listed on ‘kill them all’ because 8 is more than 0, *and* it didn’t get listed on ‘kill some’ because while 8 is more than 0, dead was 0.
Oh silly me. The value of death characters was ‘null.’ They simply didn’t exist in a place where they should have.
The fix? I added the dead character to the site and everything was fixed. But code wise, could I prevent this? I certainly should, since I know better than many that you can’t predict what users are going to do. So it begs the question of *why* was I checking if character count and dead count were not 0 to begin with? It was, originally, because my ‘no deaths’ list was screwed up and I threw that check in to omit cases where a show was flagged as death but didn’t have death.
The accuracy of these things depends entirely on your data. Garbage in, garbage out. The best fix would be to check ‘if a show has death and it has no dead characters, adjust the dead count down by one’ but also ‘if a show has no death, but it has dead characters, adjust the live show count down by one.’ I haven’t done that yet. I will soon.
**Categories:** How It Works
**Tags:** coding, development, wordpress
---
### [Combining Data from Multiple CPTs](https://halfelf.org/2016/combining-data-multiple-cpts/)
**Published:** April 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Bring out your dead! Sometimes you just need to track random things.
**Content:**
I wanted to get a list of all TV shows where 100% of the listed characters were dead.
> @Ipstenu … Did I just read that you’re using WordPress to compose a list of dead lesbians in media? I have to say, that’s kind of unique.
> — [Otto42](https://twitter.com/Otto42/status/716082891839504385)
Yes, yes I am. Television media, excluding reality TV.
The problem is I store the information in two [Custom Post Types](https://codex.wordpress.org/Post_Types) (shows and characters). And while both shows *and* characters have a way to track if there are dead, getting that list was frustratingly complicated.
We wanted, originally, a way to mark a show as having death *and* a separate way to track each dead character. Since they were separate CPTs, we made two custom taxonomies: dead-character and death. Logically then, I could use WP Query to get a list of all shows with the cliche taxonomy field of ‘death’ checked:
I know I could use a different way to get terms, but I don’t want to since I need to count these shows:
But I also need to continue processing. Once I have a list of shows with death, I need to get a list of all characters who are on the show. That data is stored as [Custom Meta Data](https://codex.wordpress.org/Custom_Fields) and those don’t have a quick and easy sort method. Worse, the shows are listed as an array.
Originally it was just a number representing the post ID for the show, and that was pretty easy to check. While we have posts in the dead show query, get a list of all characters with this ‘show ID’ which looks like this:
The problem is that compare line. Once you stop looking for “Does 123 == 123” you have to use ‘IN’ or ‘LIKE’ and, since this is an array of show IDs, we need `'compare' => 'LIKE'` for this check. That sounds simple, but there’s one more *small* problem. If the show ID is 1, then *every single show* with a 1 in it shows up. In addition, I actually wanted to get a list of all the shows where *some* characters died, so I couldn’t just check for characters with the meta\_query of the show and the tax\_query of death.
My first step in all this was to convert the shows to an array:
Now I can process everything as an array and check if the show ID is really in the array. If it is, we’re going to record that there is a character in a show with death.
Next we’re going to check if the character has the tag ‘dead-character’ (listed as a custom taxonomy for ‘show cliches’) or not *and* is in the show:
Once we have that data, I need two arrays. The first is for shows where the count of all characters on the show is the same as the ones who are dead. The second is for shows where *some* characters are dead:
The full code for that magical snippage looks like this:
And yes, it works just fine.
**Categories:** How To
**Tags:** coding, development, wordpress
---
### [Fauxgo and Rickroll](https://halfelf.org/2016/fauxgo-rickroll/)
**Published:** April 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Learning by humor.
**Content:**
April Fools is today. I hate April Fools ‘jokes’ as pretty much all of them are cruel.
Now that we have that out of the way, I’d like to tell you about two plugins I created that are pretty much useless but educational.
## Rickroll
Released in the WordPress.org plugin directory, this plugin changes all your videos to the official Rickroll video. All. Your. Videos. The point it was made for is that you really can run a filter to do some pretty impressive things with videos. Including replace them. You can take the logic of this plugin and apply it by filtering (say) all videos embedded in comments made by a specific person. That would really mess with them. Or you could possibly call YouTube’s api, check the rating of the video, and if it’s over a certain amount, show a default instead.
Download: [WordPress.org – Rickroll](https://wordpress.org/plugins/rickroll/)
## Fauxgo
This plugin replaces the WordPress logo with a Fauxgo. Why? Someone complained to me that you couldn’t rebrand WordPress entirely. So I did. The thing about this plugin was that it was deucedly complicated to make work right. Most of the trouble was the CSS is ‘weird.’ But once you have it installed, everything looks different ‘ish’ and suddenly you’re not sure what the logo is anymore.
I plan to edit this and write it as using an SVG icon instead of the icon font.
Download: [Github – Fauxgo](http://github.com/ipstenu/fauxgo)
**Categories:** How To
**Tags:** plugins, wordpress
---
### [Obviously Oblivious](https://halfelf.org/2016/obviously-oblivious/)
**Published:** April 6, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Obvious plugins are the best plugins.
**Content:**
So I was asked this…
> @binarygary: .@Ipstenu I know you aren’t the patent office…but have you ever declined a plugin for “obviousness”?
I replied, not in jest, that I had declined some for ob*li*viousness.
Gary’s plugin was obvious in that it did exactly what it was purported to do, and it did it well. And it had a puny name. I quite liked it and approved it pretty quickly. But the crux of the question is interesting. Have I ever rejected plugins for being too obvious?
Not that I can remember. In fact, I kind of love the plugins that do exact what they claim to do. Like [Rickroll](https://wordpress.org/plugins/rickroll/) which turns your videos into Rickroll or [Logout Roulette](https://wordpress.org/plugins/logout-roulette/) which gives you a one in ten chance of being logged out. Those are simple and obvious and a little stupid, but they’re perfectly obvious and only the oblivious would be confused.
An obvious plugin is possibly the best kind of plugin. My buddy Otto once remarked that well named functions don’t *need* documentation. If you have a function named `reset_the_loop` it’s pretty obvious what it does. Now you might need to add some docblox to explain how to use it and what parameters you can pass through to it, but in and of itself, it resets the loop!
On the flip side, here’s `rts_reset` which is actually a function I saw recently in a plugin. Okay, what does that do? It was in a class named `RTSCode` which didn’t help at all. And there was no inline documentation. After a while, I traced everything back and sorted out what the heck the code was doing (it was reseting a query, but only if you passed specific params back).
In general, a WordPress theme and plugin should be painfully obvious. It’s open source, it’s code anyone can look at, and yes, it should be stupid easy to understand what it does and why. That’s the meaning behind ‘open’ in so many ways. Open for everyone. Open to be forked and learned from and studied and made more perfect. Or at least more fun.
I like obvious things. Obvious is good.
**Categories:** How It Is
**Tags:** essay
---
### [Migrating from CMB to CMB2](https://halfelf.org/2016/migrating-cmb-cmb2/)
**Published:** March 30, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Moving some inherited code from CMB to CMB2 is pretty simple.
**Content:**
I didn’t plan to, the first time. I’d inherited a site that I offered to help someone clean up and they had [CMB2](https://github.com/WebDevStudios/CMB2). They didn’t actually. They had CMB, the original. This was a while ago. Looking at their site, I realized they had one (yes, one) custom meta box, so I removed CMB and coded in that one meta box and called it a day.
Flash forward a while. A long while. I have a site that was mostly built out by someone else, and it worked great except on mobile. After trying to update content on the site on my iPad and getting frustrated to the point of angor, I re-did the theme as Metro Pro (yes, it’s that site), and folded in a lot of the meta boxes into mu-plugins, so we could keep them no matter what the theme.
But again, she’d used CMB. Not CMB2. And since I know CMB2 has a lot more features, I decided to upgrade. Three hours later, I had it done and had it done rather nicely.
## Decide how to install CMB2
I did it as an `mu-plugin` – Look. It’s a library. I have my font library (aaah!) in there as well. This is how I organize things. I don’t want people disabling it on accident, so by having it in my Must Use folder, only people with SSH or Git access can screw with it. This is a protection thing.
I tossed the `cmb2` folder in there and whipped up a fast `cmb2.php` bootstrap file:
You’ll notice that’s more than just bootstrapping. This is the other reason I wanted it as an MU plugin. The first part with the `require_once` is the call for CMB2. I could simplify it since the folder is lowercase, but it’s fine as is. The second part with `function cmb2_get_post_options` is so that I can use the names of all my posts as options in a dropdown. I didn’t invent this code, it’s from [the CMB2 documentation](https://github.com/WebDevStudios/CMB2/wiki/Adding-your-own-field-types#example-2-posts-or-other-post_type-dropdown-store-post_id). The last bit of `function cmb2_site_scripts` is just to make sure my custom CSS gets loaded on the right pages (I wanted to change the layout of some things).
## Convert the Calls
This was the weird part. I’d never really used CMB before. CMB2, through various things including reviews, I’m pretty familiar with the general aspects of it, though not all the specific calls. From CMB to CMB2, the major change was that instead of multiple nested arrays with a return, the code was wrapped in a function that had an array, but then it had callbacks.
This:
became this:
You can totally see how one transmuted into the other, right?
The biggest change is the `'fields' => array( ... )` section, which is totally missing from the new version. Remaking the fields was trickier since some changed a great deal. And some changed in fantastic ways.
Here’s the original actor name field:
And here is the new one:
I’ve added in two things. First is the desc (description), which was needed because I was adding in the repeatable field! Sometimes actors are replaced, and with that in mind we’d been using ‘Foo (2013), Bar (2014-2015)’ and so on. But now with repeatable fields we could easily add in a new line for every actor. Problem solved!
## Why not hand code?
Because the Fields API is a sack of wet, smelly, rotting, hair. It’s actually worse than the Settings API. I can’t wait for the [Fields API plugin](https://github.com/sc0ttkclark/wordpress-fields-api) to hit release candidate and have a UI built in. Until then, hand coding more than one meta box is a headache. Making three groups with three to eight fields in each with cross dependencies? A nightmare.
Simply put, CMB2 does it well, obviously, and simply. The code is easy to understand and implement. I wish it was in core. It’s around 3 megs, but 2 of them are from translations, so it’s really not as horrible as all that.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Because Developers Never Typo](https://halfelf.org/2016/developers-never-typo/)
**Published:** April 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Never trust input.
**Content:**
> It’s not a problem. Only admins can use this.
I’d pushed back on a plugin that wasn’t validating their post input wisely. Instead they just slapped `sanitize_text_field()` around everything and called it a day.
One of the myriad reasons I’ll push back on a plugin is improper sanitization. When I say that, I mean they need to sanitize, validate, and escape the input. If I see things like `update_option('my_cool_options', $_POST['my_cool_input']);` I’ll push back and tell them to please sanitize. But really I tell them this:
> SANITIZE: All instances where generated content is inserted into the database, or into a file, or being otherwise processed by WordPress, the data MUST be properly sanitized for security. By sanitizing your POST data when used to make action calls or URL redirects, you will lessen the possibility of XSS vulnerabilities. You should never have a raw data inserted into the database, even by a update function, and even with a prepare() call.
>
> VALIDATE: In addition to sanitization, you should validate all your calls. If a $\_POST call should only be a number, ensure it’s an int() before you pass it through anything. Even if you’re sanitizing or using WordPress functions to ensure things are safe, we ask you please validate for sanity’s sake. Any time you are adding data to the database, it should be the right data.
>
> ESCAPE: Similarly, when you’re outputting data, make sure to escape it properly, so it can’t hijack admin screens. There are many esc\_\*() functions you can use to make sure you don’t show people the wrong data.
I say it often. Sanitize everything (but especially what you save or process), validate input, escape output.
I understand though, why someone might naively assume that since only admins can do a thing, it’s ‘safer.’ The truth is admins screw up as much as anyone else. Worse, probably, since admins have more power and often think they know better.
But the point I was trying to make to this guy was that it doesn’t matter *who* is inputting the data.
I’ve told this story before. I used to have a job testing software packages for software I didn’t use. We replied on ‘scripts’ from people to know what to test. One day, John C and I were trying to test some new software and every time we hit a certain screen, we’d crash the box. We tried over and over and it failed. So John called the vendor and explained what we were doing. They walked us through it and it crashed. Since we were a VIP, they said they’d send over a couple developers. When the two guys showed up, one watched us very carefully and was shocked.
The young dev exclaimed, “Why would you ever input wrong data there?!”
I eyeballed him. “Why would putting in wrong data *crash* the computer?”
The older dev chuckled. “We’ll put in an error check there.”
The lesson I learned is simple. Never trust input.
**Categories:** How It Is
**Tags:** coding, development, essay
---
### [More Chart.js Fun](https://halfelf.org/2016/chart-js-fun/)
**Published:** April 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making more beautiful charts is fun.
**Content:**
The [statistics page](http://lezwatchtv.com/stats/) on my TV database site is pretty fun. It’s the one I learned how to use [Chart.js](https://halfelf.org/2016/chart-js-category-statistics/) for in the first place.
I wanted to add in some pie charts, but first I upgraded the code to the 2.0-beta and refined the PHP on my stats. Originally I just had some pretty basic bar charts for category statistics. Now I have some pie charts to show characters by role (by which I mean are they a main character, a guest, or a recurring character).
## Better Category Stats
Let’s talk about some better PHP first. The stuff I had before worked, but it could have been better. Here’s the better PHP:
What I did here was take the data and make a single array for it which gives me the data structured as follows:
```
Array
(
[addict] => Array
(
[count] => 2
[name] => Addict
[url] => http://example.com/tropes/addict/
)
[athlete] => Array
(
[count] => 3
[name] => Athlete
[url] => http://example.com/tropes/athlete/
)
)
```
This makes my array much smaller and simpler to run through. Next I changed how I call the data in my javascript:
The unsetting at the top is a quick run to remove the tropes I don’t need for this chart because I’m displaying them in the pie chart. See? It all comes together!
## Pie No. 1 – Sexuality
There are two pie charts. One is checking how many characters are gay, straight, or bisexual. I’m sure eventually I’ll be add asexual, but that isn’t today. Anyway, that chart is surprisingly simple. Since I’d already improved the PHP call for category stats, and sexuality is saved as a character taxonomy, I was able to do this simply as follows:
The default assumption is that any character being added is a homosexual. The reason ‘straight’ is there is for a character who was presented as gay, but that turned out to be a fantasy sequence. Thanks, Roseanne. With that in mind, calculating the number of gay characters was a matter of subtracting the straight and bisexual. And yes, I named the chart pieSexdata on purpose.
## Pie No. 2 – Character Role
The second pie chart was a lot harder. You see, I’d chosen to save the ‘role’ as a custom meta field in the post. There’s a dropdown for ‘Main’ or ‘Recurring’ or ‘Guest’ and it defaults to ‘None’ if you don’t fill it out. Right now everyone has a role but I coded in a failsafe.
This code took me a while to sort out, but as soon as I realized how simple it was, I made a loop so I didn’t have to repeat code:
This produces a nice array:
```
Array
(
[regular] => 147
[recurring] => 37
[guest] => 23
)
```
I wanted it to be an array since I can see this expanding sooner or later. The pie chart code looks very much the same as the one for sexuality, and all that’s really different is how I’m calling the data and doing the math for how many characters have no listed role.
## What’s Next?
Things are shaping up nicely, but I want to add in better labels. I’d like if they show the percentage when you hover over them on pie charts, and if they could link to the taxonomy pages for the bar charts. But I haven’t quite sorted out how to do that yet.
I also have to blame Tracy for this, because she’s the one who wanted stats like that in the first place.
**Categories:** How To
**Tags:** coding, wordpress
---
### [Dependency Disaster](https://halfelf.org/2016/dependency-disaster/)
**Published:** March 28, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The circle of hell of dependencies is one we may never climb out of.
**Content:**
Over the last few weeks and months, the nightmare that is WordPress plugin dependency hell has waxed and waned with the ire of a thousand burning suns. It flared up when I, perhaps naively, posted a reminder of a rarely called upon guideline to not submit Frameworks for hosting on WordPress’s official plugin repository.
This brought up the perfectly valid arguments that these repositories are useful as they allow for deployment and updates that were hitherto unavailable when rolled up into one package. And at its heart, I understand their point and agree with them as to the benefits. But since WordPress core doesn’t have true plugin dependencies at this time, it’s exceptionally complicated and a hassle to include them.
Personally, I feel that the NPM or Composer style *development* of plugin is the way to go. Development. Not deployment. With few exceptions, I feel the best way to release a plugin is all in one, rolled up together. The exceptions are, of course, plugins that are add-ons to others, like a plugin that adds a new email integration hook to MailChimp, or a new payment gateway for WooCommerce.
The rest of our plugins should be self contained, reliant on naught but ourselves. I have two plugins which contain the same AWS SDK libraries, written in a way to check if the library is already loaded and to make sure it only loads what’s needed. Why did I do that? Because then someone can have one or the other or both without conflicts.
The user doesn’t have to care about dependancies. They are invisible. That is as it should be. Users don’t have to care.
But there’s also a danger with dependancies, as recently came to light in the JS world. Azer Koçulu [liberated his modules from NPM](https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c#.yvlx3a383) after the threat of a trademark based lawsuit had NPM remove one of his projects.
Sidebar: Open Source has no right to impinge on trademark law. Period. However some lawsuits are frivolous and daft and should be contested. Sadly most communities (NPM, WordPress.org, etc) do not have the money or resources to fight that battle for a developer. If you chose to fight, please contact the EFF.
As is his right, Azer pulled *all* his packages from NPM. The fall out from this package removal is that a lot of automated builds failed. This has to do with the way Composer is often bundled. Instead of a wrapped up package like an exe or a dmg, it’s a stub that reaches out and downloads all its requirements on the fly. Just like the TGM Plugin Installer. Right? And what happens when those requirements are missing? The build fails.
Perhaps worse, by unpublishing the name slugs used can be taken over by anyone else, and used to push more nefarious code. This did not happen. NPM checked everyone and verified they were as decent as one can before handing over the old names to new owners.
My first thought was “Could this happen to WordPress?”
Yes and no. First up, we don’t reuse names. If you have the plugin ‘foobar’ and ask to have it closed, the name is still reserved. In extremely rare cases we’ve turned over names to trademarked owners (like how Facebook owns the facebook slug) but always with communication of both parties and always with awareness to how many users might be impacted.
But could we pull a plugin for trademark infringement and screw up package dependancies? You bet your ass.
We’ve been *lucky* that all legal parties involved in similar arguments have been accepting of the ‘grandfathered’ ruling. That’s why we still have plugins with slugs like ‘google-analytics-by-joe’ out there. But it’s also why we don’t allow any more. And yes, when a plugin with a unique name is submitted, we do take the time to check if it’s already trademarked. To spare people this drama.
But yes. It could totally happen. And since we have to name our dependancies and rely on those slugs, there’s no easy way out.
I suggest reading the [Hacker News thread](https://news.ycombinator.com/item?id=11340510) on the matter. They weigh both sides of the issue, and show you how the pros and cons make this even more complex.
**Categories:** How It Is
**Tags:** development, essay, open source
---
### [The Pressure to Succeed as a Woman Who Codes](https://halfelf.org/2016/pressure-succeed-woman-codes/)
**Published:** March 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** What men in dresses, fake geek girls, and coders all have in common.
**Content:**
I feel a disproportionate amount of pressure to succeed in coding.
I call it disproportionate because it’s only about 1/3rd of my career. The other two are support/training and public speaking. And while I used to have a fear of public speaking, I’ve somehow managed to discard that and I’ve got no concerns at all about screwing up on stage. I might. My talk might flop. My training might not be understood or adopted. My support may be wrong.
But what scares me to the point of tears is coding.
It’s not that I’m *bad* at it. Intellectually I think that I’m pretty good. I’m not the greatest in the universe, but that’s a realistic stance as opposed to anything else. And I enjoy playing with it, inventing new things, seeing how they work, helping people solve problems with code. It’s honestly fun.
Looking at the [Stack Overflow Developer Survey](https://stackoverflow.com/research/developer-survey-2016) I noticed that only 5.8% of the participants identified as female. Taken a different way, 92.8% of people had no problem saying they were men. Now, SO is aware of the disparity, and mentioned this:
> Our survey results demonstrate a dramatic disparity in tech among men and women. In fact, we know women make up a more significant proportion of the developer workforce than this suggests. According to Quantcast, about 12% of Stack Overflow’s readers are women. (We don’t actively track gender internally.)
I have a personal theory that gamification appeals more to men than women. This stems from reading about Richard Bartle’s player types way back in the 90s. It was a big thing in MUDs and MUSHes, and the [Bartle Test](https://en.wikipedia.org/wiki/Bartle_Test) is essentially a series of questions that can be used to identify the classification of a player into one of four types: Killers, Achievers, Socializers, or Explorers.
Now it helps if you’ve read a little of [Hearts, Clubs, Diamonds, Spades: Players who Suit MUDs](http://mud.co.uk/richard/hcds.htm), but you can get by with the Wikipedia article. The main point is that we can classify people into player ‘types’ based on what they enjoy doing and how they like doing it.
In general, winning and hacking are associated with Killers and Achievers, while helping and curating fall under Socializers and Explorers. And when I say it like that and you look at things like programming vs support forums (of which I do consider Stake Overflow), lines start to be drawn. These lines are carved in stone when you consider some of the research gamerDNA did into what kinds of player played what kinds of World of Warcraft characters, and what their genders were.
What does all this have to do with the unrealistic expectations on women who code?
If one buys in to the hype and typecasting, then one would say that women (nurturers) are more likely to be socializers and explores. Regardless of if this is accurate, there certainly is an expectation on women that they are ‘mothers’ and, from that, they are often unconsciously perceived of being a specific player type. And when someone steps out of what people feel their norm is, they’re often set upon.
This is not solely endemic to women, of course. Men who express emotions publicly, like crying for example, are also set upon by others for not being manly enough. And that is precisely my point. People who don’t fit the stereotypes of what gender is get pushed back. People who act ‘out of character’ are looked upon as odd.
Okay, so why do women keep feeling pressured? Because shit like this happens:
> In the line to see Deadpool, a film where they mention me by name, a guy started explaining who Deadpool was to me.
>
> — Gail Simone 💙💛 (@GailSimone) [March 16, 2016](https://twitter.com/GailSimone/status/710176567012540416?ref_src=twsrc%5Etfw)
You can look up the ‘fake geek girl’ phenomenon on your own. The fact is that it applies to anything not stereotypically female that a woman does. And it means that, in order to be taken seriously as a coder, we have to achieve great things or all we’ve done is prove we’re only good for the ‘fluff’ of support.
Eddie Izzard makes a joke in his “Dress to Kill” routine about men who wear dresses and heels:
> You know, if a woman falls over wearing heels, that’s embarrassing, but if a bloke falls over wearing heels, then you have to kill yourself. It’s the end of your life. Its quite difficult.
And while we laugh at it, the truth is that ‘abnormal’ behavior is treated with incredibly high expectations. Unrealistic ones. Unfair ones.
I don’t have an answer to this, and for now women shoulder the burden of being expected to be greater than men of identical backgrounds, simply because of how we were born.
**Categories:** How It Is
**Tags:** essay
---
### [Composer and WordPress' Plugin Preflight Check](https://halfelf.org/2016/composer-wporg-preflight-check/)
**Published:** March 18, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** More control over Composer means fewer conflicts with SVN's preflight checks on WordPress.org
**Content:**
When you upload a plugin to WordPress.org’s repository, it does some pre-flight checks to make sure the code is okay. More than once it’s caught a missing `;` for me. But one day it caught this:
I stared for a moment, Googled to be sure, and sighed when I figured out that what was happening was my library was a PHP 5.6+ version and that didn’t pass the 5.4 checks.
Regardless of how annoying this is, it’s not too hard to fix. No, I’m not going to tell you how to avoid the scan, nor am I going to talk about the stupidity of the scan. Instead I’d like to tell you how to *get around* this problem.
It’s so easy, too.
You see, my issue is that I use [Composer](https://getcomposer.org) to [build my resource libraries](https://halfelf.org/2016/resource-folders/) and in my `composer.json` file, I have this:
And for what it’s worth, this is great. I have it download all my libraries. Then I have it run a script to copy over just what I need to my `aws` folder and I have Git and SVN ignore the `vendor` folder. Everyone wins! The problem is that Composer sees that my laptop is running PHP 5.6 and so it installed version
## Fix PHP on Your Computer
Since I use [Homebrew](http://brew.sh/) on my Mac, this is super easy for me.
Then when I re-run `composer update` it will install what I need.
The problem here, though, is that this is tied to a specific computer, and if a coworker downloads my stuff and plans to fork it, they’re SOL and merges fail and it’s sad times all around. So with that in mind, uninstall 5.4 and go back to 5.6.
If you have a problem with installing 5.6, run it this way:
## Fix PHP in Composer
I like this fix better. Put this above your require statement and you’ll force Composer to build based on PHP 5.4:
Now we’re cooking with fire. This works for everyone, it forces Composer to download 5.4 compatible libraries, and my very long transmission worked.
## Is This Perfect?
Obviously not. There are going to be cases where your code absolutely has to be the code for PHP 5.5 and up. The latest version of the AWS SDK is v3, for example. But it’s for 5.5 only. I personally don’t feel there’s enough of a buy-in for PHP 5.5 and up *yet* to make an issue of it. And having no check at all won’t fly.
**Categories:** How To
**Tags:** composer, libraries, plugins, svn, wordpress
---
### [Project Bloat](https://halfelf.org/2016/project-bloat/)
**Published:** March 21, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
Can we have a serious talk about project bloat?
During the framework kerfluffle, I remarked that I hated seeing a 10 line plugin needlessly include a framework like CMB2 because of the size of plugin it created. Someone remarked that if the library helped them write something in ten lines instead of 100, wasn’t that better?
And the answer to this is *maybe*.
My issue is not using a library when the library is the best solution. My issue is people defaulting to use a library before they think about if it is the *best* solution.
And my point is really quite simple and obvious to a large number of developers. I’ve touched on it [time](https://halfelf.org/2015/hate-framework/) and [again](https://halfelf.org/2016/trouble-libraries/). I’ve told you how I handle [packaging my vendor folders](https://halfelf.org/2016/resource-folders/). Simply put, I think that before you include *anything* in your project, you should evaluate it’s merits and flaws.
Look. There are always, and will always be, good reasons to use a library. There’s never a reason to use a library thoughtlessly, and that’s what I see every day. By ‘thoughtlessly’ I meant someone who has a plugin that adds one setting, a custom meta field let’s say, into all posts. And in order to do that, they wrap ACF into their plugin.
For *one* field.
One.
Literally one.
And I get it, I really do. The settings API is a bag of wet hair, and the fields API needs love (so much props to [Scott Clark for his work there](https://github.com/sc0ttkclark/wordpress-fields-api)), and figuring out how to do things can be a comprehensive battle of trial and error vs ‘How much hair do I have left?’ And yes, I *do* use some of those libraries, like CMB2 and ACF, when the need calls for it. When I’m making a massive custom tool or theme and I need to do a million things. But …
What I don’t do is use it for one field. Sure I could, but that would make my plugin very large and to no real benefit except it’s ‘easier’ for me. And even that is questionable. When I *do* use them, and yes I do, I do so thinking about the weight I add to my project.
A pause here. I say this a lot, the weight of a project.
Everyone seem to assume I only mean the size (in MB) of a project. I don’t. When I say the ‘weight’ of a project I mean the file sizes, of course. Making your 10kb plugin over 500kb just to add one field (I’m being literal here, folks) is sketchy at best. Making it over a meg is borderline ignorant. But I also mean the weight of how it impacts the speed of the site. Will having the library called make a site slower? It might. And I also mean the weight of technical debt. Am I going to update the plugin and the library every single time? This is my responsibility now, and I have to test and test and ensure I don’t break anything.
The weight isn’t just the size, it’s the time sink. It’s everything that has to go into keeping a library included in a way that doesn’t conflict with anything else. It’s managing my time so I can test and evaluate changes. It’s making sure I push code that won’t break on new versions of my main project (i.e. WordPress). It’s making sure my changes don’t break other co-projects (like WordPress plugins and themes), by assuming they’ll always work on the newer versions. Backwards compatibility isn’t a requirement for all projects, but when it is, you bear that weight too.
And the weight is also the fact that I’m robbing myself of a greater understanding of WordPress core. Using a library isn’t ‘cheating’ but it does mean I might be *less* capable of debugging a conflict, if it’s due to the library.
That’s the real weight of a library included in your project. If you’re not considering it when you add a library, you’re doing yourself a massive disservice.
**Categories:** How It Is
**Tags:** coding, design, essay
---
### [Making Plugins Filterable](https://halfelf.org/2016/making-plugins-filterable/)
**Published:** March 14, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
I’m really bad at thsi since, generally, I don’t know why people would want to with the plugins I make. Which means I don’t do it. Which means I didn’t know how.
I have a plugin that records the IP address of users as they register and outputs it on the ‘show users’ page. It’s simple and it works.
Someone asked me if I could make it link to a place where he could see where the IP was from. Now my *intent* with the plugin was to list the IPs so I could spot serial sock puppets. But this use-case, I agreed, was valid. I just didn’t want to tie my plugin into one service or another. So I made it filterable.
As it happens, it was incredibly simple. This is filed under “Stuff I should have known years ago…”
## Make The Output Filterable
Originally I had the code outputting `$theip` and, in order to make it filterable, I wrapped that with this:
The whole function looks like this:
You’ll notice the `has_filter()` check is only on one possible output? That’s because I’m translating the output on the other one, which says “None Recorded” I could filter that, so people could change it to anything they want, but right now I think that’s a bit odd.
## Filter The Output
To test this, I made a file `/mu-plugins/register-ip-multisite.php` and put the following inside:
That made it a link. Simple.
## Does It Work?
Of course!
[](https://halfelf.org/wp-content/uploads/sites/2/2016/03/ip-link.png)
I did not apply the filter to the output on the edit-users page, but if that turns out to be needed, I can.
**Categories:** How To
**Tags:** development, filter, plugins
---
### [Apple Watch Faces](https://halfelf.org/2016/apple-watch-faces/)
**Published:** March 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** After close to a year with a watch, I've sorted out what kind of watch faces I like.
**Content:**
I’ve had my Apple Watch for getting near a year now.
Time flies I guess.
I started out using the basic Utility face, with the round clock and simple notifications along the edges. The more I used it, the more I realized I needed different faces for different days. That’s something the Watch lets me do with surprising ease.
## The Workday
[](https://halfelf.org/wp-content/uploads/sites/2/2016/03/IMG_0344.jpg)
What I need to know the most is ‘what do I have scheduled next?’ Meetings of course, but I also put appointments and I schedule ‘to do’ slots in there. I need a half day to fix some code? I’ll do block that out.
The complications are the date in the upper left, the calendar in the center, and the bottom row are the weather, my activity, and [MacID](http://macid.co/). The last one is a premium app which lets me lock and unlock my laptop from my watch. Since I leave my laptop open on my desk all the time, I find this helpful for security. Pop off the bathroom, lock the laptop. Come back, tap the watch, unlock.
If you don’t have a watch, they have an iOS app that works too. In fact, the Watch uses the phone app.
## The Weekend
[](https://halfelf.org/wp-content/uploads/sites/2/2016/03/IMG_0342.jpg)
I like an analog watch face. It’s my default. This one shows me the time and date with the day, the corners are battery and activity. The bottom is weather in detail. If I tap on the date, I go to my calendar, but most weekends I don’t need to worry about it.
## The Traveller
[](https://halfelf.org/wp-content/uploads/sites/2/2016/03/IMG_0343.jpg)
When I travel, I don’t actually need my calendar so much. It’s weird, but since I mostly go to WordCamps or similar conventions, I don’t tend to schedule things past ‘event – 8am to 5pm’ followed by ‘After Party – 6pm to 9pm’ and so on.
That means what I need for my watch is the weather (I’m often in places for the first time). The bottom row is the time at home (so I don’t call my wife at one in the morning), activity, and my flight status. I almost always fly American these days, so I put that complication in.
## The Apps
I mentioned [MacID](http://macid.co/) already. It’s $3.99 and worth it. I also use [Wunderground](http://www.wunderground.com) for my weather, since it has the right kind of alerts. I can see the clouds and the rain and that’s all I want. I use the free version. [American Airlines](http://www.aa.com/apps) has a free app, and it’s surprisingly good about alerts for gate changes and rescheduled flights. I’m constantly getting updates before gate agents. I also use [TripCase](http://travel.tripcase.com/) since I can track my hotel and event information in it. The bonus there is my wife can check and know where I’m supposed to be, in case she needs to get a hold of me.
## What Else
I actually have other faces I use. I have a photo I took in Japan that I like to use with the time, and nothing more, when I have a non-stress, non-fuss day. I have a red-text time only face for when I’m in theaters (red light is less ‘glaring’ than others if I should happen to check the time). But the three I listed above are my regular watch faces. All on one watch.
**Categories:** How It Is
**Tags:** apple, hardware, watch
---
### [The Awareness of Method](https://halfelf.org/2016/awareness-intent/)
**Published:** March 16, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Being aware of how we speak (or type) to others is imperative in communication when you're pretty much all remote.
**Content:**
February and March were weird for me. A lot of personal drama, and none of it really mattered to the masses so I kept it to myself and my close friends. I don’t feel the need to publicly broadcast my personal pain on everyone, and I do my best to step back and let it (hopefully) not impact my reactions to everyone else.
This was very hard because a goodly portion of my drama was from the public sector, and it boiled down to people *unintentionally* hurting me. And as I grumbled on Twitter, I feel like I need to explain how having hurt feelings doesn’t mean I’m over reacting. Which is preposterous.
I understand that, for the most part, the people who hurt me certainly did not intend to attack me or sound combative. And I’m well aware that tone is a terribly difficult thing to read in the written word. That’s why good authors take the time to explain things in detail. Things like italics and bold and capital letters are important for reading into the meaning of a sentence.
At the same time, any time a comment aimed towards me starts with a remark about how they don’t care for drama, I walk away. You should never say that. If you don’t want to talk about the drama, don’t invite the drama. It’s really that simple. And if you’re worried that how you’re saying something, it’s a sign that you should rethink what you’re saying and how you’re saying. This is where the method comes in to play.
The intent of what you’re saying is subject to the **manner** in which you say it. If you ask a sincere question and people react strongly and negatively to it, then your intent was lost in the method. Communication in text-only is complicated. You can’t see people’s faces, you can’t hear their tone, and most of us don’t know each other to the degree that we can reliably read intent. Simply put, your intent is subject to how it’s read.
For a long time, I’ve advocated people remember that when someone misinterprets what they’ve said, the fault lies in both parties. If I say something and it’s read as aggressive, this is in part my fault for not tempering my tendency to be direct with the need people have for humanity in a conversation. At the same time, no matter how nicely I say “Your plugin has been closed…” someone is rightly going to read it and be angry and interpret that I am being mean or offensive.
It’s a no-win situation. Or at least it’s one I’ve never figured out how to win. I’ve been told the default ‘your plugin has been rejected…’ email is too angry because it uses all caps for one line, even though it apologizes and explains it’s trying to get the reader’s attention and encourage them to … well … read. That email was developed over *years* of communications with thousands of developers. It’s the one we determined to have the highest success rate of people actually reading and processing what was said.
Still, at least once a day someone replies to an email asking ‘How do I resubmit my plugin?’ This invariably comes in reply to an email that says “When you’ve corrected your code, reply to this email with the updated code attached as a zip, or provide a link to the new code for us to review.” And at that point, I honestly don’t know how to make it more clear.
When people say the email is too aggressive, I explain that we’ve cultivated them over years, but we’re always willing and welcome to make it less so. And we *ask* if they have suggestions? Not a single person has ever replied with advice, *except* the person who said “Don’t use emoticons, they’re unprofessional.”
Seriously, you just can’t win.
Which brings me to the point and it’s that winning isn’t the point. Losing is the point. We lose when we don’t take into consideration the reaction to what we say. We lose when we dismiss someone else’s reaction. We lose when we over-react to what we perceive as an over-reaction.
We will never be able to always speak clearly and without accidental misunderstandings. We will never be able to ask every question in a way that makes everyone feel welcome to join a dialogue.
We can be aware that our words have weight and meaning, *especially* because an increasing number of us communicate in text first (if not text *only*). We can try to learn from our mistakes. We can apologize sincerely for those mistakes.
What you say can and will be taken out of context. It can and will be read the wrong way. When it happens, it hurts and it tends to make you react poorly. But being hurt by someone’s words doesn’t mean you’re over-reacting. And it would do us all good to remember to respect other people’s feelings and reactions.
Yes. Even me.
**Categories:** How It Is
**Tags:** communication, essay
---
### [On Saying No](https://halfelf.org/2016/saying-no/)
**Published:** March 9, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Saying no and hearing no is never simple.
**Content:**
We are, for the most part, accustomed to getting our way. We have a problem, we contact support, they fix it.
Once in a while, however, support says ‘No.’
## I’m sorry, I can’t do that, Dave.
There are technical limits to all products. Due to our own failures of imagination, we cannot foresee every possible iteration of usage for the things we build. These failures are, of course, not the fault of anything but our own lack of omniciense. We cannot know all things. We cannot predict all things.
In this way, we have learned to expect limitations over time. We know that there is a line drawn in what the computer can do. If we have not programmed the computer to do a thing, it cannot know to do the thing. The reason for the limitation is just that the code’s author didn’t wish to write a thing. Why? Many reasons, none of which matter.
We can, however, accept that systems and software are written by humans. Humans are fettered with limited vision. Computers are shackled by the humans who create them.
When a program says it cannot do a thing, it cannot do the thing.
## I’m sorry, the system’s a bit limited.
The problem with our shackles is that the one who has to tell a customer that the computer cannot do a thing is a person, not a computer.
We cannot delete user accounts on WordPress.org for a number of reasons. If the site was just a blog, or a BuddyPress network, it would be a simple matter. Instead we integrated a wiki, multiple bbPress 1.x instances, a BuddyPress network, a multisite, theme SVN, plugin SVN, and core SVN.
So no. We no longer have the technical ability to remove a user ID. Not even in the case where you accidentally used your gmail address as your username and are now `ipstenugmailcom` … It says username, but people do what they do. And no, we can’t rename users either. Same reason.
We coded ourselves into a situation where we are technically limited. We cannot do the thing because we didn’t develop a way to do the thing.
## I’m sorry, but it’s against policy
Then there’s a different kind of reason that someone tells you no. Like when someone asks for an embarrassing post or comment be deleted. Obviously this can be done. Comments and forum replies can always be deleted. That’s how they work. You may have your own site and you’ve deleted spam.
But every site has a comment policy. They have the right to moderate their site however they want. Some delete things right away. Some moderate and manually approve all comments. Others let things run until the shit hits the fan and then spend hours and weeks and months cleaning up. However they choose to moderate and maintain their site is their business and their choice. You don’t have to stick around if you don’t like it.
A large issue occurs when you don’t realize until after the fact that one of the policies is, perhaps, not removing posts. That’s when things get really messy, because now you’re being told no and not only is it by a human, but it’s a human who makes the choice.
## Your rights are subjective
The rights you have on *someone else’s* website are subjective.
The rights you have when you use a product are as well.
If you download Microsoft Office, you agree to a lot of [terms and conditions](https://www.microsoft.com/en-us/Useterms/Retail/Office/2016HomeAndStudent/Useterms_Retail_Office_2016HomeAndStudent_ENG.htm). Whether or not you read them, you agreed to them. Same with Apple’s [iCloud terms and conditions](http://www.apple.com/legal/internet-services/icloud/ww/).
You give up some of your freedoms in exchange for their convenience. Your rights are subject to the agreements you make when you chose to use software, comment on a site, join a community, sign a contract, etc. etc.
## Be gracious in victory and defeat
Once in a great while, someone will make an exception for you. Most of the time you really *don’t* want it.
Perhaps you think it proves that all policies are mutable, but the reality is not. You see, that exception means it’s worth more to them to shut you up than it is to abide by policy.
Of course a post can be deleted. Of course someone can lock your account for you. Of course you can be granted an extended warranty. But, for the most part, in order to get that far and get that level of ‘reward,’ you will have had to become the person no one wants to talk with.
An example. A user asked for his account to be deleted and was informed of the technical impossibility of the request. He then asked for his posts to be removed and was informed of the policy prohibiting such a request. He finally asked for his account to be made inactive and to ban him from the site. He was told (after confirming that these requests were all to calm his paranoia and not that he was being harassed or stalked by someone) that the site was not his parents, and if he wanted to leave, the answer was to log off and walk away.
Instead he began to post nothing but vulgarities.
His account was locked and he was banned.
He will likely never be welcome again.
He might think he ‘won’ the argument, but all that happened was he showed his deplorable behavior, in public, in a way that Google captured. He tainted his reputation. He tarred and feathered himself. He burned his bridges. And he bragged about it.
## Support are people too
When you are told ‘no,’ try to understand why. Accept the fact that you cannot get what you want all the time. Sometimes it’s just impossible. It’s understandable to be upset and angry. But the people tasks with enforcing policy or educating you to as to limitations, they are people just like you.
**Categories:** How It Is
**Tags:** community, essay, support
---
### [Unique vs Common](https://halfelf.org/2016/unique-vs-common/)
**Published:** March 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little on the topic of naming libraries and functions.
**Content:**
Someone asked me if I could explain why sometimes I tell people to name their functions uniquely and sometimes I don’t.
I get how this is confusing, even though it makes perfect sense to me. Here’s how to remember:
- What’s *yours* is unique to your plugin
- What’s *common* is unique to what’s common
Okay, maybe that didn’t help. Let’s try a practical example!
I have a plugin called ‘Genericon’d’ which includes the [Genericons](http://genericons.com/) library inside. In that plugin, I have the following enqueues:
The first one is for Genericons, the library. There I use the common name of `genericons` which means if *anyone* else also enqueues Genericons with this name, one of ours will win depending on load order. For my personal plugin CSS, I use the name `genericond` (notice that D?) as it matches the name of my plugin and, therefore, is less likely to conflict with someone else’s plugin.
Conflict is the name of the game here. I actually *want* `genericons` to conflict. Well, not conflict. I want it to be recognized as a shared library, so WordPress only loads it once. If I had named it `genericond-genericons` then, in the event someone has Jetpack or a theme like TwentyFifteen which both include Genericons, they would load the entire library twice! And I would suck. On the other hand, if we all share the library name, WordPress will check, see it’s loaded, and carry on.
Name what’s *yours* in a way unique to your plugin or theme.
Name what’s *shared* in a way that’s unique, but also stupid obvious and easy to share.
Font-Awesome? Use `font-awesome` for your enqueues.
As for functions and class names, even if you put in a check for ‘if this doesn’t exist…’ the logic works the same. If it’s yours and yours alone and only exists in this code, name it unique to your plugin/theme. If it’s a shared library, like the aws-sdk, name the class in the standard way and wrap it in an ‘if this doesn’t already exist…’ so that if it does exist, it only gets called once.
Standard names for shared libraries.
Unique names for your personal codes.
And bonus! If you keep your names to a standard, while being unique, someone may call your functions too.
By the way, anything global like `DEFINE( 'FOO', true );` should always be unique. Those are globals. Everyone uses them. I’ve made that mistake too.
**Categories:** How To
**Tags:** function, wordpress
---
### [The Big Picture](https://halfelf.org/2016/big-picture/)
**Published:** March 2, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The big picture of putting users first.
**Content:**
## Decisions, Not Options
WordPress’s core philosophies are what has allowed it to be extendable, supportable, extensible, and surpass 25% market share.
One of WordPress’ hallmarks is a massive plugin repository and the ability to extend WP to do pretty much anything. Instead of making the core software huge and bloated, filled with aspects the majority don’t use, WordPress decided to follow a path of ‘decisions, not options.’ With that, the onus is on the developers to deeply learn and understand the implications of any and all changes and additions to the core software. We’re encouraged to separate our personal feelings from what is best for the project and the users.
We need to think about the big picture.
## I Fight for the Users
I often say this when I’m in core meetings about ideas for changes that will impact users. Generally these are visual changes, like moving a menu or adding in a more obvious button. When we, as developers, make a decision, we need to have the big picture in mind. Do *most* users need to decide what quality of image compression to use for WordPress? No. Not because they don’t care, but because the information to explain it is overwhelming to many.
Recently [WordPress increased the default image compression](https://make.wordpress.org/core/2016/02/22/proposal-increase-the-default-image-compression-in-wordpress/) (you’ll see it in WP 4.5). In the proposal, an incredible amount of research went in to figuring out what settings would be best for the majority of users.
Will the minority, the photography site runners, be possibly upset? Yes. But when we look at the big picture (ironic, I know) we remember that *most* people will only notice that their sites are loading images faster.
## It’s Okay To Be A Minority
Most of us started using WordPress and were the majority. We were the target audience and the people it aimed at. Over time, the ways we use WordPress become more and more specific, and suddenly we have at least one way where we are unique and special. We no longer ‘just blog’ on WordPress. We sell our wares, we write novels, we build communities.
We are, suddenly, a minority in how we use WordPress. This makes it harder and harder to keep the big picture in mind. We are, as humans, inclined to see ourselves first and put our own needs first. Our websites need these things, therefor they are the most important aspect of the upcoming changes in WordPress.
This isn’t true, of course. But we lose sight of the big picture very easily when the changes impact us, and it tends to make us concentrate on the wrong things.
## I Prioritize the Users
I speak up for the users in developer meetings when they’re not there.
I think of them first.
When I make a change, when I design a change, it’s for the users first. Even when it inconveniences me, even when I feel it’s not the perfect solution for my plans, I consider that what I’m making only is what it is *because* of the users.
The big picture is that users make the software what it is. Putting them first in as many things as possible makes it so that they can trust me when I make a decision. When I say “No, this would be better for you as a user but not for your safety.” I know I can say it from a place where I’ve earned the respect and trust of the users.
You cannot get to that place of trust without putting the users first in all possible things.
The big picture is bigger than just you, who wrote the software, and you, who used the software. The big picture is all of us.
**Categories:** How It Is
**Tags:** development, essay
---
### [Cooking as a Dev Skill](https://halfelf.org/2016/cooking-dev-skill/)
**Published:** February 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Learning to cook is exactly like learning to code. Only it tastes better.
**Content:**
My friend Dan asked if I’d be talking about cooking as a dev skill for WordCamp Minneapolis.
> .[@Ipstenu](https://twitter.com/Ipstenu?ref_src=twsrc%5Etfw) I'm assuming cooking as a dev will be your [@WordCampMpls](https://twitter.com/WordCampMpls?ref_src=twsrc%5Etfw) talk submission
>
> — Dan Beil (@add\_action\_dan) [February 17, 2016](https://twitter.com/add_action_dan/status/700107259972603905?ref_src=twsrc%5Etfw)
While I won’t be making that camp this year (sorry folks), I thought I’d take a moment to talk about cooking as a dev skill. Or rather, what cooking teaches you about developing a website.
## Know What You Want to Cook
You can’t just decide to throw things together until you’ve been cooking for so long, and you’re an expert at winging it. Most of the time, we pick a recipe we know, or feel we can follow, and decide what we want to make. We have to temper this with what we need to make. If I’m making dinner, I need protein and vegetables. If I’m making a pie, do I need the pie or do I just want something sweet?
Websites are the same way. We pick the site we want to make before we start building. When you go into making your site, you have to know what you *want* the site to be. You also have to know what you need. I need a web presence (it’s 2016, yes you do), but I don’t need a video and an interactive game and all the bells and whistles.
## Check Your Ingredients
Open the door to your refrigerator and make a list of what you have. Look at the recipe. Do you have what you require to make this dish? If you’re ordering out, you get the meal pre-made. When you’re making it yourself, you need to make sure you have salt and butter and tofu and eggs.
When we talk about webpages, we talk about the code behind it. Can you design something out of nothing? Do you have the tools with which to do so? Can you write javascript and PHP and HTML? These are things you need, these are your ingredients. They’re also going to be your libraries like Backbone and React.
## Mise En Place
In cooking, setting up everything beforehand makes the entire cooking experience better. I’m terrible at it, but I’m doing my best to get better, because once I’m prepared, everything flows and I’m less of a whirling dervish. The setup doesn’t just keep you organized, it keeps you real. It lays everything out and sometimes, when you look at 10 pats of butter, you may think about maybe cutting down a little.
Speaking of those libraries, make sure you have only what you need. The whole Backbone repository is over 5 megs. The one file you need is 69kb. Use only what you need. The more individual pieces you need, the more you should scrutinize them. Did you really need all that in the first place? Do you really need eleven css files for options of display, or should you make a basic one and let people build what they want?
## The Cake Will Collapse
You’re going to mess things up. You’ll burn the caramel, overcook the pasta, underboil the egg, and so on and so forth. These mistakes are okay. As Julia Child said it, “No on will ever know!”
Do I even need to say it? Your code will fail. A lot. In weird ways. You may spend an hour wondering why `WP-CLI` fails, only to remember it’s `WP_CLI` instead.
**Categories:** How It Is
**Tags:** coding, essay
---
### [Baby Steps Security](https://halfelf.org/2016/baby-steps-security/)
**Published:** February 24, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The move to enforcing better security is fraught with misinformation and caution. Two Factor is not the holy grail.
**Content:**
It’s a simple question. How do I make my site login secure?
My answer is simple. Use https for your admin dashboard and use a strong password.
## Your username is not a secret
My gmail user ID is ipstenu@gmail.com
My WordPress.org username is Ipstenu. So is my Twitter handle. Facebook? Yep. GooglePlus even.
And my username here on this site is Ipstenu.
I hear a lot of people telling folks that their username on their WordPress blog should be a secret and, for the life of me, I can’t understand the logic. [Your username is not a secret](https://halfelf.org/2014/username-secret/). It never really has been. It never will be. We used to log in everywhere with our emails, then it became our commonly used nicknames, and based on Twitter and Peach and whatever social network comes next, that’s where it’s going to remain.
## But… Admin?
But why do people tell you not to use ‘admin’ as your username, then? Well it’s the same reason you have a top lock and a knob lock on your door. The knob lock is your username. Everyone has one, and they have roughly the same level of protection. If you only use a knob lock and don’t have a good top lock, the brute force of someone kicking your door in is pretty easy.
The top lock, the bolt and chain, that’s your complex password. Not everyone uses them. You should, but some of us are lazy. When we do use them, we make our lives more secure and safe.
Back to admin as a username. Using admin is like using the same key for all the doors in an entire apartment building. If you’re the apartment owner, that sounds great. But if you’re the resident, you’re probably not super happy about that idea, right?
Changing your username to something unique to you makes your lock safer. Reusing it means you have the same master lock for all your accounts. It’s better for you, you can remember it, and it’s sneakily helpful for your branding. Yeah, I slipped SEO in there.
But your passwords are a different matter. You don’t want to reuse your passwords for a simple reason: If you *do* reuse your passwords, then once someone gets one password, they can get access to all your accounts.
All. Your. Accounts.
Your bank account.
## Two Factors
A lot of this is mitigated by something called [Two Factor Authentication](https://halfelf.org/2013/two-factor-authentication/), which gives you the ability to have a username (publicly known), a password (private and secret), and a one-time-use password (generated by an app and only good for 60 seconds or so). Now you have three locks! One of which you don’t even know how to open until you’re actually opening it.
The current issue with Two Factor Authentication is its usability. It can be confusing to people to set up. You need a smart phone, which are not universal quite yet, and you need to be able to take a picture of your screen for most of them. Even once you have it set up, you need to read and enter a code.
I’ve found mixed information regarding how well this works, or doesn’t, for people who are visually impaired. For the most part, I suspect these tools are only barely accessible. They’re probably a nightmare for the blind to use. If you have to rely on getting a text message to log in, then you’re absolutely fucked if you’re overseas or out of range or have no bars.
And then there’s the issue I see faced by everyone, and that would be what happens when you lock yourself out. If you \[get locked out of Apple\](George’s link), it’s a headache but survivable. But if you get locked out of your *own* site, what do you do? Who do you call? Your webhost? Why? It’s not their responsibility to unlock you. And don’t ask WordPress.org to unlock you.
No, you have to know how to do ‘something’ to fix this. Be it disable a plugin without being logged in, or be it editing a file, you will need access to your system and some technical chops to pull this off. And no, folks, the majority of WordPress users don’t have it.
## Security in Steps
We cannot all become secure tomorrow without possibly alienating the user base. WordPress has a 26% market share these days, and that’s a non-insignificant number of people. For them, we absolutely must consider the cradle to grave usability of our products. How useful are they? How safe are they? How easily can someone untangle their site?
Two Factor is one of the ways to go, but it’s only one possible future. It has a higher hurdle than many people understand. Even Google has a [less than 10% adoption rate for 2FA](https://duo.com/blog/estimating-googles-two-factor-2sv-adoption). Facebook probably has less, and if I was asked which user base most matches the skill level of the *average* Wordpress user, it would be Facebook.
WordPress faces a hurdle of its own creation. It’s too popular with too many people of questionable technical ability to just switch on two factor authentication and force it for everyone. Much like multisite, it requires an understanding of some technical aspects of the web, not WordPress, to use safely.
Or as my friend Jan puts it: You must be this tall to ride.
**Categories:** How It Is
**Tags:** security, wordpress
---
### [Chickens, Eggs, and MVP](https://halfelf.org/2016/chickens-eggs-mvp/)
**Published:** February 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I do have thoughts on the REST API. I want it. I want it now. But I want it done right.
**Content:**
There’s a lot of weight to shoulder for the [WordPress REST API](http://v2.wp-api.org) project. It has a lot of hurdles to overcome and a lot of doubters to win over.
I’ve been silent about it, thoughtful about it, and questioning about it. I personally want the REST API if, for no other reason, than once it’s in-core, we can set the XMLRPC on fire. Which means…
## My MVP – Parity with XMLRPC
That’s right. If the REST API can do **everything** that XMLRPC can do today, I think that part of its code needs to be in Core today. Get it in. Get people using it. I don’t think the measurements of how many plugins are using the REST API are a valid argument, since you get these numbers (roughly):
- 115 plugins use XMLRPC
- 25 plugins use V1 of the REST API
- 21 plugins use V2 of the REST API
Now, this is not the right measurement because looking at both XMLRPC and the REST API, we are not clocking the number of plugins but the number of *sites* – non WordPress sites even – that are calling these features. And that is a number that cannot be measured. There’s no way on the planet to really know for sure how many people use those features because, for the most part, they’re not doing it within WordPress. All the plugin scans will tell you is people who are *extending* it, for the most part. WooCommerce, Advanced Custom Fields, those are plugins adding their own endpoints and hooks.
And those, yes, are important. But more so is the real-world.
Can we detect how many WordPress sites are using the JSON API? Not really. Sure we could probably violate trust and get a list of every site that’s asked for an upload or install of the plugin, that wouldn’t tell us who has it active and who is using it.
## We’re Not Ready (Until We Leave Beta)
We’re not wrong to be cautious about this. There’s a freedom a plugin has that a core feature does not. Once the REST API is in core, it’s done. I don’t mean development or innovation stops, I mean we can no longer make breaking changes.
> While we believe the API is now stable enough for public testing, we may continue to break the API in the future as we improve it further. Only use the API in development, and do not use version 2 in production environments.
That’s what the documentation for Beta 1 says. And when I look at the changelog for 2.0 Beta 12.0 (released February 9, 2016) I count **six** changes labeled ‘breaking change.’ That’s bad. I hesitate at saying it’s deplorable, as I understand why it’s happening. They’re iterating fast and hard and trying to get to a place where they’re ready.
That said, this is a real world problem, as [Eric Mann](https://twitter.com/EricMann/status/697111525979328512) expressed in a series of Tweets:
> My client installed the REST API before it included post meta. We had to build a bunch of custom work to support meta.
> Then the REST API updated to include meta and broke our integration. I spent a chunk of hours refactoring to compensate so we could update.
> Now, apparently, the REST API is pulling that meta support out and putting it in a separate plugin …
> Yet people still criticize me for saying I’m wary of placing too much dependency on the stability of the API …
Eric’s point is a good and valid one, and it actually supports both ends of the argument.
The REST API is too much right now. It’s too much of all the things, and pulling meta out and letting it iterate quickly is a good choice. That said, the rest of the API needs to consider the same things. What’s done? What’s ready and locked and will not be ‘breaking’ changes? That should be ‘stable release #1’ and *that* goes into core.
From that moment on *what’s in core **cannot** not receive any breaking changes*. Lock down: These are done and will not be broken. Give the developers your promise in blood that this is what it is.
WordPress is backwards compatible for a million miles and frankly the REST API has not been. So make it. Put it in stone. But the REST API plugin itself is really too big to continue developing as it has been, and that’s to it’s detriment. It’s simply not sustainable the way it has been because it’s trying to serve two masters.
On the one hand, it wants to grow rapidly. On the other, it wants to be secure and safe and solid and ready for code.
But right now we’re stuck in Beta, and that hurts the perception. Also we’re still breaking things, and that hurts adoption. No one wants to start using a beta product that changes things in a way that breaks their sites. No one wants to use this for clients yet.
## I Propose a “Release Candidate”
Go back to my first point.
Parity with XMLRPC. That’s all the REST API core plugin should be right now. Pull out everything else and slap the designation “Release Candidate” on there. *You do not break things in Release Candidates*. This candidate is your candidate for core inclusion. When it’s good, that goes into core and we *close* the existing plugin. Of course we do one final update to notify people ‘Hey, this is included in core now! Woohoo!’ It’s called ‘disabling’ the plugin, and anyone who has a feature plugin thats been moved into core, if you want it disabled, contact the plugins team. We will be *happy* to retire you plugin.
What about everything else? They get punted out into their own mini plugins. Like meta, they can be iterated and they can break all they want *until* they hit Release Candidate.
You see, that Release Candidate is your promise that you believe you are ready to go. Everything works the way you want it to, everything is ready for real-world testing. No more breaking changes.
## In Hindsight
Looking back, I think the REST API is a perfect example of why the Featured Plugin system is both perfect and problematic. We are trying to simultaneously treat development like a plugin (fast, light, and iterative) and like core (adaptive, backwards compatible, and reliable). The whole reasons we started breaking out things like MP6 into Feature Plugins has come home to roost and shown that the idea is solid, but the methodology needs to be more set in stone as to what they should and should not do.
For a Featured Plugin, Beta is the time for breaking. RC is the time for testing in the real world. We need to be more firm about what we will include in our Featured Plugins and what we will not. We need to be harder on adding new features. We need to say ‘No’ a little more, and let things be developed outside of the plugin.
We need a plan that includes the retirement of the plugin when it’s job is done.
**Categories:** How It Is
**Tags:** development, plugins, wordpress
---
### [Apple Does the Right Thing](https://halfelf.org/2016/apple-right-thing/)
**Published:** February 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I am glad it's hard to hack into my iPhone. Now make it that hard to hack into my laptop.
**Content:**
People died. While we can easily get lost in the implications of preventing deaths and understanding why a mass killing happened, there is one fact we’re left with.
The FBI have asked Apple to write a backdoor into the iPhone code to allow the FBI to brute-force entry into an iPhone.
## What is Brute Force?
Quite simply, it means trying passwords over and over again, until the right one is determined. At its heart, it’s trial and error, and you can program it into another computer. We call it brute force because rather than trying to intellectually deduce a password, it’s done via direct effort.
## Why does this involve Apple?
You can set your iPhone to, after 10 incorrect passwords, wipe itself out. After three (3) wrong passwords, the iPhone makes you wait a little. I’ve set my phone to wipe on 10 incorrect passwords since if someone has my phone and can get in, they can also get access to my banking information.
With a 4-digit passcode, there are 10,000 possible permutations. With 6, this increases to 1,000,000.
The [Ten most common passcodes](http://danielamitay.com/blog/2011/6/13/most-common-iphone-passcodes) have probably been already tried. And if you want a fun read, check out [Why repeating a digit may improve security on your iPhone’s 4-digit lockscreen PIN](http://mindyourdecisions.com/blog/2011/01/27/game-theory-and-probability-of-iphone-passwords/).
## What did the FBI actually ask?
I have read a [copy of the summary](https://assets.documentcloud.org/documents/2714001/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf) (this is not the full 40 page ruling) and many of the news articles. The best I can summarize is this:
Tuesday February 16th, 2016, a magistrate judge in Riverside, California ruled that apple had to provide “reasonable technical assistance” to the government to recover data from an iPhone 5c. This includes bypassing the auto-erase function (the one that happens after 10 bad passwords) and allowing them to submit an unlimited number of passwords. In order to do this, the FBI wants a special version of iOS that only works on the one iPhone.
Apple has five days to respond if they believe that compliance would be “unreasonably burdensome.”
Yes, it says that the FBI is asking to break into one iPhone, but the only way to do that is to write a system that could be used to backdoor any iPhone. This is because Apple intentionally wrote their code so that they couldn’t get at your data. Apple has no way to dismantle or override the 10-tries-and-wipe feature. Only someone with the passcode can do it.
## Is that technically possible?
Of course. There’s no real question about that. It won’t be easy (so ‘unreasonably burdensome’ may or may not apply here). And to be honest, the technical possibility of this is not the issue either.
Does this mean ‘anyone’ could do this? Yes, but it’s unlikely. This sort of hack is an OS-level one, which means the software needs to be signed by a key only Apple knows, unless there’s some other vulnerability in the phone. You can introduce a vulnerability by jailbreaking the phone, of course, but for the most part we don’t know if you can hack it from the outside like that. Signs point to this not being probable. But if it was going to happen, Apple would be the best company to try. They’re the ones who would know best.
I want to stress: I believe anything is technologically possible. Human cloning? You bet! Hacking my iPhone? Sure thing. I do not believe these things are easy, or even probable, but they are in the realm of possibility.
## Why did Apple Say No?
Apple did say no. They said it publicly in a [Customer Letter](http://www.apple.com/customer-letter/) on their website. And they said no, not because these things are hard, but because they are dangerous.
> Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.
>
> \[…\]
>
> Rather than asking for legislative action through Congress, the FBI is proposing an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority.
>
> The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer.
>
> The implications of the government’s demands are chilling. If the government can use the All Writs Act to make it easier to unlock your iPhone, it would have the power to reach into anyone’s device to capture their data. The government could extend this breach of privacy and demand that Apple build surveillance software to intercept your messages, access your health records or financial data, track your location, or even access your phone’s microphone or camera without your knowledge.
You can read the whole thing for yourself, but in essence Apple is saying that by allowing the FBI to insist on this, they can use it as leverage to demand anyone’s phone be unlocked similarly. Keep in mind, while this case is certainly above board, do we really trust our government to always have our best interests in their hearts? Where can we draw a line between a known criminal act and a suspected one? Do you think they will never apply this to a case with tenuous links to an actual crime? We’ve already had wiretapping issues (Watergate, need I say more), and frankly the US government hasn’t gotten much better. And once the US has managed to allow this, many other countries will use this as their reasons to do so.
Also you can’t uncork the lamp. Once the genie is out and this is possible, it will be given out to other agencies and someone will reverse engineer how this works. Other countries *will* get their hands on this. They will use it against innocents. We know this is truth because it already happens now.
## Privacy and Freedom
I’m going to give you the quote you’re expecting. The Ben Franklin one:
> Those who surrender freedom for security will not have, nor do they deserve, either one.
From a technical aspect, the hurdles faced to hack into a cell phone make me feel safer as a user. It makes me feel better to know that the FBI are failing to break into my little iPhone.
**Categories:** How It Is
**Tags:** essay, rant, security
---
### [Poor Support Experience](https://halfelf.org/2016/poor-support-experience/)
**Published:** February 26, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** An experience in no-communication from the unlikeliest source. Apple.
**Content:**
I broke my watch. I have an Apple Watch with the Sapphire glass screen, and I broke the glass.
For reasons that are frustrating, I don’t have AppleCare+. The short version is that I didn’t realize I didn’t have AppleCare until September. The Watch was a present in May (June). I was deemed ineligible, which is annoying, but I appealed and pointed out I couldn’t know I didn’t have it until it was way too late. But I was declined. I didn’t have a receipt, I didn’t have proof, they couldn’t believe me. Fine. I acutally understand that and, were it me, I’d probably reject the claim as well. That meant I knew I was going to have to shell out if I ever needed a repair for a crack. And February 2016 was that time. I took it to the Apple Store and had one of the shittier repair experience of my life.
I *did not* schedule an appointment since they had nothing until Monday anyway, and I knew this would be a “We can’t fix it, we’ll send it in.” sort of thing. I got there and was told that they don’t have a walk-in repair for the Apple Watch like that. They do for the iPhone, and the iPad, but not the Watch. Okay. Stupid. Fine. I set a Walk In appointment for an hour away, and went to run an errand. When I got back, the appointed time came and went. So I asked a nice person in an Apple Shirt how that worked.
This was the first *rude* person I’ve ever dealt with an an Apple store. I wish I’d gotten his name. He was condescending, brusque, and unsympathetic. He said I should have known that the time was an estimate (sure, I did) and that it could be up to another 90 minutes. I stared at him. How the hell should I have known that? I asked if there was a different line for repairs, he said not and then chided me for not making an appointment. Sorry, make an appointment for four days out when I broke something today that will need to be mailed to a repair center? I did not say that, I looked at him and said “I see. So when you said ‘Around 1:55’ what you meant was ‘Between 1:55 and 3:30’? The guy who checked me in didn’t say that.” He shrugged and I walked off.
It took another 45 minutes to get to check in. Once I did, they just said ‘Sit at any open stool.’ This is poorly planned, but okay. I sat and after a few minutes, a fellow asked for my name. He tapped on his iPad, found my appointment, looked at the words on it, looked at my watch, and promptly apologized.
“I’m sorry you had to wait so long for what’s about to be a really fast case.”
I’d already taken the watchband off and nodded. I knew it had to be mailed in. They can’t replace a screen at the store. He filled in a form, the AppleCare+ conversation was had, and we left being told a link would be sent to me.
No. Actually I got a receipt for the work order (fine) and no link. I logged into my Apple ID account at https://supportprofile.apple.com/ and was surprised to see my Apple Watch not listed. I added it and went to the ‘repairs’ link (which said I had 1 repair) only to have this:
> Apple could not locate any repairs for the Apple ID: \[Me\]. Please try again with a different Apple ID or look up a single repair on this page.
Since the work order had the Repair ID, I put that in and the serial and got a pretty useless status page:
[](https://halfelf.org/wp-content/uploads/sites/2/2016/02/apple-store-service.png)
Step 1 | Request – February 10, 2016 : Service requested
That’s it. Step 2 is Service and Step 3 is Return, but there’s no information like an estimated date or even verification it was sent out. At the store I was quoted 3 to 5 days. Now here’s the thing. I *know* what’s going to happen. They will get my watch, go “Oh, it’s broken, look at that!” and send me a refurb. I will not get my watch back, I’ll get a new one (a new used one) and it sucks, but there it is. I accept this. It’s a watch. Then they will send that watch back to the store and I will pick it up. And I was told 3-5 days (I asked ‘business?’ since it was about to be a long weekend, and the fellow said they were working Monday), and that I would get notified of status changes.
But after a few days of nothing, I called Apple and asked two things:
1. Why doesn’t it show up on my open cases for my Apple ID?
2. What actually is the status?
The guy on the phone and the woman at the store were helpful, if disappointing. The Watch had not been shipped out right away. The Dispatch Center did not have it. The store claimed to have sent it and received a sign off, though the shipping folks said that was not the case and status on that repair page still said ‘Service requested.’
The phone tech said to call back in two business days days if I didn’t get any emails or any information, and he added the case to my account. No not the repair, the case. And the direct link to the repair works, but it’s still not associated with my account. I did what any neurotic would do, and I left the page open, hitting refresh once in a while.
Three hours later the status zoomed to step 3: Returned.
> February 13, 2016 : Product replacement pending
So why do I call this a bad service experience?
It should have been much shorter. Apple could have a simple hardware check. Is it really broken? Yes it is, we’ll send it to repair. And this would be for things that are sent in only. If you want to try and trade it in for a fixed one then and there, it’s separate. But if you just want to express mail in your broken whatsit, why not make this easier? The front gate person can ask two questions: Is it really broken? Do you want to send it in for repair/replacement or trade it in today?
I also never once got a single email from Apple about this.
Well that’s not true. I got the first email but that was it. I never got a single status report, like they swore I would. I have root access to my server, I run my own email server, and I checked for every single email with ‘apple.com’ in it for the last 7 days. I found one from `bounces@email.apple.com` and none from `GR_R###@APPLE.COM` (I’ve removed the identifying numbers). I checked and yes, they were sending to the right email. The one email I did get was from `donotreply@apple.com`.
But. Why were none of these emails recorded in my profile or my repair ticket? Why did I never get the promised texts? Why was there no communication? Why, when I contacted Apple, did they actually say their ticket system *still said* the device was ‘submitted’ and nothing more? They had to contact other teams to find the information which I was never able to see in my profile.
As much as I deride my ticket system at the office, the fact that every email is logged twice (once as email and once in the ticket) means I can always go back and see exactly what was sent, by whom, and when. Clearly they have multiple systems, and none talk to each other.
I did get my Watch back. On day 5. I could have had it back on day 2 if they’d learned how to properly communicate.
And guess what? The new watch was broken. It wouldn’t vibrate.
**Categories:** How It Is
**Tags:** rant, support
---
### [Very Voluminous Vagrants](https://halfelf.org/2014/very-voluminous-vagrants/)
**Published:** April 4, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Various methods of testing WordPress. Because there is no one perfect way to get it all done.
**Content:**
I finally sat down and installed Vagrant.
Specifically I installed [Varying Vagrant Vagrants](https://github.com/Varying-Vagrant-Vagrants/VVV). I read, like I do, and the directions were thankfully pretty clear for a change about what the prerequisites were, and I found myself with an install of Vagrant up and running within an hour. At this point I joked “Now what?”
Vagrant is yet another tool you can use to create test websites. It’s a super-powerful command line tool one might use instead of [DesktopServer](https://halfelf.org/2013/review-desktopserver/ "Review: DesktopServer") or MAMP. Now, I love MAMP. While I find DesktopServer more ‘flexible’ in that I can spin up a client’s site really fast to check it, MAMP is even faster to boot when I just want to see one site and test a plugin on it, in part because I use [MAMP No Password](https://www.46palermo.com/blog/run-mamp-without-password-easy-way/) and run it on port 80 (which lets me use Multisite).
But… Sometimes when I want to test, I want to test different configurations at once. Like I want to test on current (3.8.1) and trunk, and I probably want a Multisite Network as well. But Vagrant is way more than *just* a lot of different environments in one go. I mean, if that was all it was, I could edit my hosts file and make a couple extra sites in MAMP or DesktopServer and be done.
## What do you get?
[You get a lot with VVV](https://github.com/Varying-Vagrant-Vagrants/VVV#what-do-you-get), and if all that seems weird to you, it’s okay. The more I work on servers, the more I see a varity of weird setups and the more I want to mess with them for testing. This isn’t to say VVV is perfect. You can’t switch (easily) between PHP 5.2 and 5.3 and 5.4. There’s a whole [discussion ticket](https://github.com/Varying-Vagrant-Vagrants/VVV/issues/98) on the matter.
Vagrant makes multiple servers. Not PHP/Apache instances. *Servers*. They’re virtual, but let’s be honest, so is the server this site is running on. That means I can mess with the server, install extra features if I need to test a clash with PHP version or add ons or whatever, I can do so without blowing up my laptop (or a real server) pretty quickly. That means my plugins test site (on a live server) may not be needed anymore, which led me to the first actual thing I had to do with Vagrant: Make my own sites.
## My own sites!
You get five ‘default’ sites when you use VVV:
- [http://local.wordpress.dev](http://local.wordpress.dev/) for WordPress stable (/www/wordpress-default)
- [http://local.wordpress-trunk.dev](http://local.wordpress-trunk.dev/) for WordPress trunk (/www/wordpress-trunk)
- [http://src.wordpress-develop.dev](http://src.wordpress-develop.dev/) for trunk WordPress development files (/www/wordpress-developer/src)
- [http://build.wordpress-develop.dev](http://build.wordpress-develop.dev/) for a Grunt build of those development files (/www/wordpress-developer/build)
That’s four, I know. The fifth is “vvv.dev” which lists the other four sites. That’s pretty much what most of us need when testing. A local site, one on trunk, one using src, and one with grunt for those CSS/JS things.
I needed more:
- [http://multisite.dev](http://multisite.dev/) Subdomain Multisite (/wordpress-musubdomain)
- [http://local.multisite.dev](http://foo.multisite.dev/) Multisite subsite foo (/wordpress-musubdomain)
- [http://bar.multisite.dev](http://bar.multisite.dev/) Multisite subsite bar (/wordpress-musubdomain)
- [http://baz.multisite.dev](http://baz.multisite.dev/) Multisite subsite baz (/wordpress-musubdomain)
- [http://folder.multisite.dev](http://folder.multisite.dev/) Subfolder Multisite (/wordpress-mufolder)
- [http://local.plugins.dev](http://local.plugins.dev/) Plugins tests (/wordpress-plugins)
Those all run stable. I though about naming them wordpress-something, but I needed the subdomains and it was easier to just make multisite.dev for that. I know what it is, and this is for me first. The way you do this is with [Auto Site Setups](https://github.com/varying-vagrant-vagrants/vvv/wiki/Auto-site-Setup), where Vagrant looks in your www folder and if it finds more folders with the right files, will build sites! Natually that means I made a little Github repo for this called [VVV ASS](https://github.com/Ipstenu/vagrant). Because you’ve met me before, right?
## What do you do with it?
Test all the things, really. Bang on plugins and code that isn’t right, make patches, and have a generally clean environment to play with. It’s also good for building on (core or plugins or themes).
I’ve been struggling with PHP Unit Tests, as well. I understand them, but I don’t really grok them yet. While I dig the idea of unit tests, creating them is a little complicated to me. Suffice to say, I know WordPress on push day wants to unit test all the things, so I should get used to this.
1. In terminal, navigate to your clone of the VVV repo.
2. Run `vagrant ssh` to connect to the virtual machine.
3. Run `cd /srv/www/wordpress-develop` and go into the folder.
4. Run `phpunit`
And there you go. What did all that do? A lot. Check out the Core Handbook on [Automated Testing](http://make.wordpress.org/core/handbook/automated-testing/). Beyond that, I cannot tell you. Yet. Expect more on that later when I’ve gotten someone to explain it better.
## Do I have to use VVV?
Nope! There’s [VIP Quickstart](https://github.com/Automattic/vip-quickstart/), by Automattic (yes, that Automattic) which lets you bring up a WordPress.com-esque site. And there’s [WP Vagrant](https://github.com/tierra/wp-vagrant) which gives you more testing environments, so when you want to blow up core on PHP 5.2, you can do it easy as another vagrant up.
## Am I sold?
Developer Ipstenu is sold. User Ipstenu still likes MAMP best. “Yes, I’ll fix your site” Ipstenu likes DesktopServer. Each has their own place. I’m so comfortable in CLI now, it’s more natural to use MAMP and VVV. DesktopServer comes in to play for me when I need to spin up a site specifically to test an existing site someone else broke.
**Categories:** How It Works
**Tags:** development, open source, wordpress
---
### [What's In a Plugin Name](https://halfelf.org/2016/whats-plugin-name/)
**Published:** February 17, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A name that is both concise and descriptive is still possible.
**Content:**
Not terribly long ago, we stopped letting people use someone else’s trademark or company/plugin name as the first term in their submitted plugin.
Example:
“Girl Scout Cookie Tracker by Mika” would no longer be accepted.
However “Mika’s Girl Scout Cookie Tracker” would be just fine.
The point we try to make here is that your name, your product name, should be first.
Of course, that second name is pretty poor, and I’d be more inclined to name it “Cookie Order Hunter” with the description of “Hunting down Girl Scouts to buy your next hit of Thin Mints has never been easier!” Yes, I know you can buy them online, not the issue here.
This new name is sort of neat. It’s got a kick to it and it has a distinct name. Suddenly I have a sort of branding all my own and this is good! I am now unique and I will stand apart from the other similar plugins.
Of course there are times when you don’t want to do this. I wrote a plugin called “EDD – Prevent EU Checkout” and I submitted it as “EDD Prevent EU Checkout” because it was a “Prevent EU Checkout” plugin *only* for Easy Digital Downloads. If I was doing my normal thing, where I pick a fun name, then I would have used the dev name: “EDD – Sucks to be EU.”
Here, though, I started the plugin with EDD – a search term often used – and ended with a description of what the plugin was. The fact that I keep the name as I do just means I haven’t finished the new version. I will soon be rebranding it to “Prevent EU Checkout with Easy Digital Downloads” because that’s a better SEO friendly name.
But here I’ve pointed out two things. The display name and the submission name are two different things for a reason. The display name is what people see, and the submission name is what sets your URL in the repository. Had I used “Prevent EU Checkout with Easy Digital Downloads” then my URL would be `https://wordpress.org/plugins/prevent-eu-checkout-with-easy-digital-downloads` and that’s not a friendly URL to anyone.
Submit a plugin with the ‘name’ you want for your URL.
Let’s take an example just for fun. Commoji – A plugin that lets you reply to comments with emoji reactions. No it’s not real. Yet. I would submit this as ‘commoji’ (all lowercase) and in the description I would put only the short description, leaving the readme to be read on it’s own. Remember: The readme is vital, so every pertinent piece of information that a user should have *must* be in that readme.
Within my plugin code, and that readme, the plugin’s display name would be “Commoji – Reply to comments with Emoji” (and if I’m feeling puckish, I’d add ? at the end).
Now I have my cake and Edith too! A short plugin slug, a descriptive plugin name, and a unique name that people will remember. I’m not stomping on Emoji’s trademark, such as it is, and I’m demonstrating my own individuality.
**Categories:** How It Is
**Tags:** plugins, wordpress
---
### [Mailbag: No More Contact](https://halfelf.org/2016/mailbag-contact/)
**Published:** February 19, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The mailbox is now closed.
**Content:**
On Monday the 8th I deleted my contact form from this site and my personal one.
That means this may be the end of the mailbag.
Why did it happen? Well, looking back on the last 7 months of messages I got, I can group them as follows:
- Requests that were meant for plugins@wordpress.org
- Password reset requests for the forums
- Requests to delete forum posts (we don’t do that by the way)
- Requests to be hired (even though the page said no)
- Solicitations to write for people for ‘exposure’
- Questions people should have asked in the forums
- A ‘quick’ question that’s an essay
- Complains that I suck
- Complaints that I blocked someone on Twitter/Facebook
- Spam
The legitimate messages that were interesting and thought provoking were few and far between. If I got 4 a month, then it was less than 10% of what my inbox was seeing. And worse, blocking someone via the comment blacklist didn’t stop them from submitting a contact.
After someone informed me, via the contact form, that a post I commented on in the WordPress forums *over a year ago* was out of date, I said enough was enough, and removed it.
How do you contact me?
Why do you need to?
Look, my family and close friends already have my email. Anyone from WordPress who absolutely has to get a hold of me knows how to (they can view my email in my forum profile after all). And the random masses of humanity who just want to ask me something for a quick fix?
You really don’t need to contact me. At all. You just want to because you think it’s faster and cheaper. I value my time more than that these days. I simply cannot spend my time helping everyone. Not with everything else on my plate for WordPress and for work and for life.
Of course if you post in the plugin forums for my plugins I’ll help (maybe not as fast as people might like, but hey, you’re getting free help). Of course if it’s work related I’ll be there.
But I’m not for hire. I’m not here for a ‘quick’ email (which by the way, most of you send me essays). And I’m definitely not here for your abuse.
**Categories:** How It Is
**Tags:** contact, mailbag
---
### [Mailbag: Assumptions are the Mother of All Screw Ups](https://halfelf.org/2016/mailbag-assumptions-mother-screw-ups/)
**Published:** February 12, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Assume good faith.
**Content:**
I get a lot of plugin related emails like this:
> Did the rules change?
Or this:
> You’re not being fair, you let X get away with it.
Or this:
> They’re liars and you should be ashamed.
The problem all these people have is they only see one small portion of the world they’re dipping their toe in.
First of all, if you have a problem with WordPress.org hosted plugins or the repository in general or you think rules are being enforced unfairly or your plugin was closed, you email `plugins@wordpress.org` and not me directly.
The plugin team is a *team* — a group of people who work on the plugins. While you may only be talking to one ‘face’ of the team, when you take conversations offline, you rob us of the ability to track the status of your plugin. Also you prevent us from being able to use the experience to train up new team members.
So yeah, I get pretty firm about this one. Use the right channel for the right complaint. If someone comes by and tells you “Actually you want to talk about that here with the right people” and you decide not to, well you’re a fool.
Back to the case at hand. Those three emails had to do with pretty mundane situations.
The first two were about being busted for a guideline violation. The last was about a review.
> Did the rules change?
This developer was using a trademark in his domain, which is not permitted, and he was told to fix it. The rules have always been that this is disallowed, but sometimes people (hi) miss things.
> You’re not being fair, you let X get away with it.
This happened when the developer was closed for using powered-by links. He complained that six other developers were doing it. I replied thanking him, closed the other six, and told him he still needed to fix his plugin.
> They’re liars and you should be ashamed.
A contentious review-that-should-have-been-a-support-post happened. Then the user came back, apologized, and said he was wrong. *After* that, the developer replied complaining that the user should have opened a ticket. This began a little snippy argument between user and developer, ending with the user repeating that he already had apologized and would delete his post if he could. The developer became irate when I wouldn’t delete the post (the user *can* change his review after all) and deleted his plugin.
## Assumptions Should be Checked
Each person came to the table knowing their small world. I come knowing that there are 42,700 active plugins and over 56k total. I close and open tens of plugins a day. I review more. I see code that makes me sigh and some that makes me celebrate. I also am human and make mistakes. Things slip by reviews, we miss a trademark here and there, and we may not catch everyone doing it wrong.
But the one thing we never are is malicious.
We never hunt down one user and punish them because we hate them. Ever. If we have an argument that seems impolite, we hand off the conversation to someone else. We assume good faith from the developers, but we know communication is hard. We know two people may not speak on the same page sometimes. We know that miscommunication happens. The problems all stem from our assumptions. They assumed we were picking on them, singling them out, and punishing them. We assumed they’d understand we’re just enforcing guidelines.
About the only time we allow ourselves to be mad at people is when we’ve told them “Don’t do this” and they do it anyway. And really this only actually happens if we say “Don’t resubmit, please email us” and they just ignore that message and resubmit. It’s a following directions thing. Trust me, everyone hates you when you don’t follow directions, *even if* it all works out okay, you’re still acting entitled. If you don’t understand the directions, just ask for clarification.
English is imperfect. It’s confusing. It’s downright weird. It’s contradictory. On top of that, humans are weird and imperfect and contradictory.
Assume good faith.
**Categories:** How It Is
**Tags:** mailbag, rant
---
### [Impostercide](https://halfelf.org/2016/impostercide/)
**Published:** February 10, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** On defeating yourself.
**Content:**
This is not about my plugin of the same name.
For my first ‘real’ adult job, I was asked if I knew what WinINSTALL was. “Its like WinImage,” they said.
I had **no** idea what they were talking about. I thought I was applying for a software testing and deployment gig, and that sounded like images. I’d like to say I told them the truth, that I wasn’t sure what that specific software was for. I didn’t. I bluffed. “WinImage? Sure. I know that one.” And then I rattled off what the job description had said. “It takes snapshots of operating systems in order to collect all the changes to know exactly what software did when it was installed. Right?”
Could they see I knew nothing? I guess not, because they hired me. And I had no idea what that actually meant. Sure, I understood the concept, but had no idea what I was really getting into, so I bluffed. I talked around the subject, hitting the technical points I **did** know and, in doing so, got hired. And I was scared for *years* that one day someone would realize I didn’t know jack.
We all start out not knowing, and when we get to the point that we do know, we feel that those early bluffs mean one day, someone will find out, we’re liars. That we know nothing. Learning to deal with the fallout from that one interview has been a years long process. It set the tone for my tech life, my life in general, because I’d built everything on a lie. The lie eventually became truth, but trust me that doesn’t make you feel any better.
When I started speaking at WordCamps, I was terrified because of that lie a decade before. Why would people want to hear from me? I had nothing to say that other people hadn’t said. The second and third times got much easier, but I still get scared. I’m scared now! When I wrote my first eBook, someone said something hurtful. He said “Why would anyone buy your book? They can just google and find that out themselves!” But I wrote it, sold it, and even made a sequel. That was really hard to do because I was facing people telling me things were worthless.
Imposter Syndrome stems from our self doubts. It comes from the place where, like me at twenty, we bluff a little bit in order to get our foot in the door. It’s worse when, like a lot of people these days, we don’t have college degrees. We feel every day that someone will realize we know nothing. Let’s take a deep breath. There’s no magic cure to say “Do this and you will never again have these fears” — I have them all the time. Every time I take on a new role or task, I worry I won’t be able to succeed, and I can trace it back to that niggling fear from that day I bluffed. So I fake the confidence I need to stand up here. But I also remember these facts.
## Fact One: Everyone’s bluffing about something.
We all do it. **We all do it.** If someone says they never exaggerate or bluff about their abilities, they’re liars. Hold on to that thought, because we *all* want to be seen as better than we are. It makes us feel good.
## Fact Two: Some people ARE smarter and/or better than you are.
There’s at least one person out there who is smarter than you are or better than you are at a thing. That’s just a statistical reality. The different between them and you, however, is that you are here. You showed up. You’re *here*. It’s okay. The only way to get better and smarter is to keep doing things. So step one is show up. Accepting the fact that you’re not the best is hard, but as soon as you do, the constant fear to be best starts to fade a little.
## Fact Three: Sometimes it’s just in your head.
Anyone who has a mental illness, be it depression, SAD, anxiety, can tell you this. Sometimes you get hit by a feeling of nothing and you don’t want to leave the house. You may stop answering your parents’ phone calls. You may just get really quiet. Or maybe you have a manic phase, or maybe just being around people hurts. This is all complicated and messy. But when that sort of thing happens, it can take a lot of time to remember to understand your brain and what you’re doing and when it’s *you* and not the world. You have to constantly judge things and ask yourself if your looking at things reasonably.
Sounds like I’m speaking from the heart, huh? When this happens to me, I rely on my friends. I ask them if I’m being irrational, if I’m just feeling self-doubt, or if there’s a real reason.
## Fact Four: Just because it’s all in your head doesn’t mean it’s all in your head
You all saw or read Harry Potter, right? So in the last movie, when Harry’s in the weird limbo place and meets Dumbledore again, he asks if their conversation was real or if it was all in his head. Dumbledore points out that just because it’s all in his head doesn’t mean it’s not real. Just because you know you have a mental illness doesn’t mean that your feelings aren’t real. Separating the two isn’t easy. It helps to have friends who can spot-check you. Of course, most of my friends work in WP, and I don’t want to embarrass myself in front of them. Welcome back, Imposter syndrome!
## Fact Five: It’s okay to say you don’t know
That’s hard. That one always makes me think “Oh god, they’ll fire me because I don’t know this basic thing.” It’s not the case. If it is, well you would have hated working there anyway. You have to be able to able to learn. You need that freedom. You need the freedom to fail and experiment and say “I don’t know this.” But. You have to hold up your end of the bargain.
## Fact Six: It’s not about what you know but how you know
If I’d been honest in the beginning, I might have started in a better place. If I’d just said “Nope, never used WinInstall but I’m willing to learn!” I could have set myself up different. Today, I don’t know much javascript. I’m still a bit touchy on sql. But I know how to know. I know how to google. I know how to research. I know how to learn. I’m okay with looking foolish for not knowing because I know I can’t know everything! I take notes, I document, and I learn. And the more I learn, the less I fear my own self.
**Categories:** How It Is
**Tags:** essay
---
### [Working with Webhosts](https://halfelf.org/2016/working-webhosts/)
**Published:** February 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Working with webhosts is a lot like working with your doctor. Telling them important things without overwhelming them is complicated.
**Content:**
Working with a host isn’t just sending in tickets into the abyss and hoping they answer them. Whether you’re communicating on behalf of a client or for your own benefit, it’s not the same as working with fellow developers. You need to approach a host with different expectations and explain situations in different ways in order to get the best results.
## What Is A WebHost? Why Are They Different?
You’ve had this problem where what works on Host A doesn’t work on Host B, right? All webhosts are different for a really obvious reasons. There’s more than one way to solve the problem of webhosting. Every host has decided, on their own, what works well for THEM. Which means no two of them are the same, nor will they really ever be. This is okay, if it’s a little annoying, because not only are YOU a special snowflake with your customized website, but so is your webhost with their customized server and environments.
## Setting Expectations
Hosts Are Not Developers
Your host is not going to generally debug themes and plugins. They’re just not. They don’t have the manpower for it. The host cares first about your servers, THEN about your code. And if they find your code is the problem, that discovery is often the limit. They’re not always going to help you debug exactly why plugin X is causing a specific feature on their servers to grumble. This doesn’t mean they can’t do it. Many hosts, especially ones with WordPress hosting plans, can and do debug code all the time. To be more precise, you shouldn’t expect the host to reverse engineer your code to understand why it does what it does. They are problem identifiers.
Hosts Will Fix What’s Theirs
This doesn’t mean that a host will leave you high and dry. A host will fix whatever they can. If their code broke your stuff, you bet they should fix that. Did they run a WordPress upgrade that left your site with bad permissions? Yes. But… If they ran an upgrade and you have a theme incompatible with WordPress 4.2, who’s problem is that? Should they be on the hook for fixing it or should the person who owns the site? This is why I say hosts will fix what’s theirs. It’s a lot of grey areas sometimes. It feels like people are always making exceptions or telling you that you’re an edge case. But at the end of the day, a host is NOT on the hook for upgrading your custom theme to work with the new version of WP.
All Hosts Are Different
Telling a host “But it works locally” or on another host doesn’t do them ANY good, nor do they really care. Everyone sets up servers differently, and sometimes the issue will be with PHP or the Linux OS or maybe, help me, Windows. It’s apples and oranges, like trying to compare two similar themes. Now this puts developers in a bad spot. WordPress is incredibly flexible and works, out of the box, in the majority of situations. The same cannot be said of all code. Most people don’t have the resources core does to test in so many iterations. And even WordPress misses things. Not all code will work in all configurations in all circumstances on all hosts. Sometimes you are a special snowflake. You are the edge case.
Don’t Assume
So what can we do to make things better? Telling the host the important things, especially if you’re a dev, will help everyone. If you’re not a dev, then start with the basics. The important thing here is, even though you having a bad day, not to freak out. You need to be calm, you need to be clear, but you need to provide a GOOD bug report. Don’t assume the host magically knows everything, since the error MIGHT be their servers, certainly, but it may also be a combination of what the user is doing, how they’re doing it, and the server that causes the problem. Hosts are not psychic. They only know what you’ve told them.
## Give the Right Information
Who Are We Talking About?
The most obvious question? “What’s the domain?” Many people will have multiple domains with a host, and if the issue only happens on one, you can speed up their searches just by being up front! Many, many, many times I see people complain that their ‘site’ is down. One user had 107 domains. I stared at it for a moment, tested a couple, and finally emailed back. “I looked at these five domains and they seem alright. Your email didn’t specify which domain was broken or how. Can you please be a little more precise? It’ll help us find out what’s wrong faster.” Start out with exactly what’s wrong and where.
Are You The Owner?
The next important thing to tell a host is “Who are YOU?” This is secretly “Who owns the site” because if it’s not you, you may not be able to get all the answers due to security. The host will know who you are, based on the email, so this also means “What kind of person are you?” Are you a user who can’t code? A high end dev? A middle-of-the-road guy caught in the problem? Let the host know what you can do and they can help tailor answers better. It’s okay to say that you’re the new dev taking over and you don’t know everything yet. Just let the host know where you stand. This lets them know what to expect and what they are permitted to tell you.
Where Does It Hurt?
With WordPress, sometimes a host has to ask “Can WE log in?” I hate this. I hate asking someone for access to log into their site. It makes me nervous. But sometimes if the error only happens when you do specific things, a host has to log in to reproduce it with debug on in order to track it down faster. If it requires logging in to reproduce the problem, remember to provide them access. I strongly suggest making a second account for the host and deleting it when they’re done.
## Explaining The Problem
Even If It’s Tricky
All the information before should have gotten you here already, but it needs repeated. Explain the problem! “This site is broken” is a terrible email and yet I see it daily. A better one is “This site is broken after we upgraded to WordPress 4.2. This is the error, this is what I’ve already tried. I THINK the issue is this other thing. Can you help?” Give the right information. Tell the host what’s wrong. Give them an error. Don’t assume they’re familiar with every single possible error. You’re not, after all, unless you’re Nacin.
Details Are Important
I know I said to tell them what you think the problem is. It’s okay not to know, but it’s not okay not to give the details on what you DO know. You know some things. Is the problem happening for logged in or logged out users? How do you reproduce it? Start by assuming the host knows NOTHING about your site and how it works. Even if you’re sure they know how a blog works, take the time to step back. This is really hard. You have to give them enough information without spewing your whole history.
Walk Them Through It
Walk them through exactly how to reproduce it. Use screenshots when possible. Videos? Not really as helpful as you might think. If you get an error message, make sure that you give them the WHOLE message as well as the context. I mentioned not assuming before, this goes double here. Don’t assume a host knows how you upload an image. There are multiple ways to do that, so tell them how YOU did it.
## You’re Not The Customer? They May Have To Talk Tech
When you’re not the one who pays the bills, you may need to play intermediary and have the owner contact the host. Some hosts let you add specific email addresses as secondary contacts. You should always make sure of that early on. If you hate the social engineering that comes with people cracking into other people’s accounts, that’s WHY many hosts won’t just tell you everything. Playing the middle sucks, and when this happens, try to be patient. Everything will take longer. That said, have the customer ask the host if there’s a way to add you on as someone the host is allowed to talk to. Most have a way around it.
## Pick The Host You Like … And It’s Subjective
Speaking of that … You should find a host you like. Figure out what you can work with, and here’s a big secret. Hosts won’t mind if you tell them that they can’t meet your needs. Okay that’s a lie, they do mind. But if the reason is “You don’t have 24/7 phone support!” well they understand. If the reason is “I need a type of server you don’t provide” that’s also okay. And sometimes, sometimes, no matter how much you love a specific person (or people) at a host, they just don’t meet all your support needs. And that too is okay. Hosts understand that. One brilliant person doesn’t make up for the masses, after all. Hosts aren’t the same. It’s okay.
## Everyone Wants Everyone To Be Happy
In the end, the host wants the same things a customer does. A good, fast, website that does what they want and makes them happy. If you’re clear about what’s wrong, what you need, and you’re willing to work with a host to experiment a little, you may be surprised at how well you can work with them to succeed.
**Categories:** How It Is
**Tags:** hosting
---
### [Representation of Code](https://halfelf.org/2016/representation-code/)
**Published:** January 27, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** We are (not) Spock.
**Content:**
There’s a great many things to be learned from the drama of the recent Code of Conduct proposal. A great many people have demonstrated why one is needed, why ‘Just act professional’ is not a tenable long term solution, and why some people are exactly the sort of person who will fall afoul of the new guidelines.
After all, who would really argue that these guidelines are ‘bad’:
> Examples of unacceptable behaviour by participants include:
>
> - The use of sexualized language or imagery
> - Personal attacks
> - Trolling or insulting/derogatory comments
> - Public or private harassment
> - Publishing other’s private information, such as physical or electronic addresses, without explicit permission
> - Other unethical or unprofessional conduct
But that isn’t what it brought to my mind. The needs of a Code of Conduct are myriad, and the phrasing is complicated. It should be, at once, easy to understand and abide by, while being comprehensive and difficult to abuse. It should prevent rules-lawyers from gaming the system and min-maxing the hell out of their abhorrent behavior, while still permitting people to speak their mind. Anyone who’s played a table-top game with ‘that guy’ knows that pain.
As I tweeted:
> Today PHP is learning that individuals bear the weight of representation of their groups.
This is something everyone in a minority group has known for a long time. Not to throw politics into the mix, but compare the different reactions to the Baltimore protests of 2015 and the Malheur National Wildlife Refuge occupation of 2016. Consider the way some people are painted as ‘he should have known better’ and others are just ‘misunderstood.’
One of the things I hate about WordPress is that I am now and forever representing it. Yes, forever. If WordPress is still around in 30 or 40 years, I will be representing it. If I leave it or say “Well I hate X” about it, I will reflect back on WordPress and my words will likely be taken and twisted around and contorted to mean something.
Now and forever, I represent things that I am and things that I do. If I act like an ass online, it reflects on my company. A coworker of mine told a joke on Twitter and was subjected to attacks from someone who found it offensive. Whether or not the joke was tasteless, it reflected on him and our company. It doesn’t matter if the company endorsed it or not, nor does it really matter what our CEO may or may not have said regarding the situation. It matters that we represent myriad aspects of our life *all the time*.
To give you a short list, I represent women, lesbians, LGBT as a whole, married people, childless families, Jews, Californians, Chicagoans, Canadians, Americans, caucasians, and please double the list and add ‘in tech’ to that. We haven’t even touched on things I work on and participate in the community like WordPress, Wikipedia, MediaWiki, Ada Camp, Hugo, Jekyll, PHP, ZenPhoto, etc etc and so on and so forth. Oh and DreamHost, the bank I *used* to work for, and possibly the guys I worked for before that. Then there are the games I play (D&D, Pern, WoD, etc).
I don’t get to ‘stop’ being those things. Even though I’ve not played a MUSH in almost a decade, to some people I will forever be known as a MUSHer. And some people may change their opinions on me just hearing that. But also some people will say “Oh, she acts like that because she grew up on a MUSH.” And worse, “If she acts like that, then all MUSHers are assholes.”
Look. We know it’s stupid. We all know that a person isn’t the sole representation of a thing, and yet we spend our lives looking over our shoulders because we will now and forever be what we are identified as being.
It was hard for [Leonard Nimoy to be Spock](https://www.washingtonpost.com/news/the-switch/wp/2015/02/27/leonard-nimoy-is-dead-but-spock-will-live-on-forever/).
> Nimoy is so synonymous with his half-Vulcan alter ego that fans revolted upon seeing the title of his first memoir, “I Am Not Spock,” despite Nimoy’s insistence that behind the name was merely a nuanced explanation of the distinctions between himself and his character.
When we think of him, we think of Spock, the role that made him famous. And it took him years to come to grips with understanding that he was now and always will be Spock to many of us. It’s a hard thing to accept, that you will forever represent yourself, a job you had for three years and a handful of movies, and that no matter what, whatever you say will reflect back on that.
WordPress, PHP, those are our Star Treks and we are Spock.
Live long and prosper.
**Categories:** How It Is
**Tags:** community, essay, rant
---
### [Mailbag: The Trouble of Rollbacks](https://halfelf.org/2016/mailbag-trouble-rollbacks/)
**Published:** February 5, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Why we don't downgrade plugins? We can't reliably pick the right pervious version.
**Content:**
Anonymous asks:
> Why doesn’t WordPress let me rollback a plugin?
Answer: Because the education of developers as to how to properly tag and number releases hasn’t hit critical mass.
Other answer: Because no one’s paid me enough yet to sit and manage every single WordPress plugin release to ensure the developers are properly using tags.
Other answer: No one’s written the code to enforce proper tagging for plugins.
Look. Let’s step back. Why does rolling back WordPress work? I’m going to assume you disabled auto-updates for a moment. They work becuase WordPress understands semantic versioning.
- 4.4 is a major release.
- 4.4.1 is a minor release (bug and security fixes)
Now go look at your plugins. Look at their versions. Let me show you what I, a plugin reviewer, sees:
- 20151205-295323 is a major release
- 3.2.3.1 is a minor release
- 4.2.1 is a major release
- 14.4 is a critical bug fix
- 738741 is a minor release
It goes on and on.
But even if we fix that, we have to trust that people will remember to actually *use* the SVN tags folder. They don’t. Trust me, about half the time I contact a plugin developer about a problem, I have to ask them to please use SVN properly.
The trunk folder is for the ‘latest’ version of your plugin. This may be a beta, and it may be the same as your stable release. Either way, trunk should be a working version.
The tags folders are for your releases. Finished up version 1.3.4? Great! Update the plugin readme and the main file to have the new stable version and run `svn cp trunk tags/1.3.4` to copy it over. Done. But no, they don’t do that.
This is the ‘fault’ of open source and freedom, of course. We let plugin developers do what they want, a lot more than themes, and with that freedom comes risks and responsibilities. Different people rise to those responsibilities differently. Most of us stumble along, make mistakes, figure out what best practice works for us, and move on.
Should WordPress enforce proper behavior? I gotta tell you, I don’t think it would be sustainable. Not without a *much* smaller repository and not without some sort of signed contract with developers to agree to the guidelines. And I don’t think developers would like it.
I don’t think we’re (yet) at the point where auto-updating plugins is wise. Themes, yes, but I don’t think plugins are quite there yet. Maybe we’ll get there, but there are so many hurdles before us it’ll be a while yet.
**Categories:** How It Is
**Tags:** mailbag, plugins, wordpress
---
### [Packaging and Shipping Resource Folders](https://halfelf.org/2016/resource-folders/)
**Published:** February 3, 2016
**Author:** Ipstenu (Mika Epstein)
**Content:**
No, I don’t mean resources to get help.
Have you ever opened a plugin or theme and seen a folder that says `bower_components` or `node_modules`? Yeah, I hate those. I don’t hate Bower or Node, I use them quite a lot. I hate how people use them in their plugins.
## What Are Those Folders?
In order to make life easier, [Bower](http://bower.io/) is a package manager that lets you install libraries that your plugin needs. Making a plugin that needs AWS SDK?
`bower install aws-sdk-js`
Boom. And you can easily upgrade it too with `bower update` – which I love. This is a great idea.
But notice that last line? `bower_components/aws-sdk` is where it saved my files. And if I go in there, the JS file I need is `bower_components/aws-sdk/dist/aws-sdk.min.js` and that is surrounded by other files:
Now as a developer you have a couple choices here. You can leave the file where it is and just call it from there or you can move it. If you move it, you want to make a simple way of updating it. After all, the whole point of using Bower here is to make life easier. Personally I use Grunt for these things. I talked about it [last year](https://halfelf.org/2015/ebb-flow-automation/) but my basic idea is to use Bower to download the latest and greatest versions, and then Grunt takes care of (a) updating the Bower packages and (b) copying the files to where I need them.
Okay, but what if I have something a little more complex?
## What Resources Do I Need?
This seemingly innocuous question is surprisingly deep. It’s not just ‘what package/library am I trying to manage’, but how do I manage it and with what? What if, instead of the javascript, I wanted to use the PHP AWS SDK instead? Well, the AWS SDK for PHP is not available in Bower! Instead it uses [Composer](getcomposer.org).
Here’s where things get weird. Composer is a package manger. [Grunt](http://gruntjs.com/) is a package manager. Node and Bower are too. This means I have to stop and think hard. Which one do I need? Why do I need it? What am I going to be managing?
It’s time to ask this:
## What Are My Packages For?
Within Node there are two kinds of packages:
- “dependencies”: these packages are required by your application in production
- “devDependencies”: these packages are only needed for development and testing
Take a moment to think what you need to dev and what you need to run. Your test code doesn’t need to be in your release, does it? No, of course not. It would make perfect sense to have in your Git or personal repository, but the WordPress SVN repository is not actually for your own code management. It’s a release management tool. That’s another post for another time. Just keep in mind that you should really only be pushing your code to SVN when it’s a version ready for use (be that beta testing or releases).
Back to what things are for. When talking about the AWS SDK javascript, I’m talking about *front end* packages. So that’s a dependancy. But Bower? It’s a devDependency. The users don’t need to know (or care) that I’m using Grunt and Bower to package things up. That means they shouldn’t be installed in my plugin!
In the case of my AWS SDK a ‘devDependency’ is Composer. I only need it to build my packages.
My dependencies are as follows:
Adding that to my `composer.json` file is a simple thing and now I can just run `composer update` to get everything I need!
## Where Should My Packages Live?
This is generally pre-destined. If you use Node they go in `node_modules` and Bower likes `bower_components` and Composer uses `vendor` and so on and so forth. You can, of course, customize these. I often make a folder called ‘assets’ or ‘assets-dev’ so I can easily ignore it in my version control. Frankly I don’t need them and neither do my users and it’ll help save space.
There’s a cool thing about composer. If you use `composer init` then it asks, at the end “`Would you like the vendor directory added to your .gitignore [yes]?`” This is great, because if you looked at the folder `vendor` you would see a *lot* of folders and files you don’t really want. I actually only want one folder `vendor/aws/aws-sdk-php/src/Aws/` and I want that folder to be located in `aws/Aws` please and thank you. Composer adds this into `.gitignore` for you.
You’ll still have to add that into your SVN ignore file, which is a little more annoying. To ignore all `composer.*` files it’s this:
And if you want to ignore multiple files or folders use the following command to bring up the text editor:
For SVN I would ignore `composer.json`, `composer.lock`, and the `vendor` folder.
## How Do I Move Folders?
Remember I want to move things to another folder? I use Composer’s scripts to do this. I admit this is ugly code. I have this in my `composer.json`:
This runs whenever I run `composer update` in this folder and it copies everything where I need it to be. I did tell you it was ugly, right? But it does work.
## The Result?
The result is my `vendor` code is never uploaded to WordPress.org’s SVN, my users never see the stuff they don’t care about, and I have a faster way to update my plugins when I need to make sure all the packages are right.
**Categories:** How To
**Tags:** development, plugins, wordpress
---
### [WP JSON API Challenges](https://halfelf.org/2016/wp-json-api-challenges/)
**Published:** February 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** My experience with the JSON API has been a failure to launch, mostly because my preconceived notions were wrong. All wrong.
**Content:**
In my frustration of my static process, I ripped everything out by it’s roots and decided to take things in a strict order.
## Decision: All-In-One or Separate?
The first question was do I want to download everything as one big JSON file and split it out later, or do I want to, from the start, download each post as it’s own file? The time to download shouldn’t change, and if I do it right, I could script it to check if the date stamp on my downloaded file was older than the post date in WP. That means I could have this logic:
That made it an easy win. Let’s split away from the original plan. Now my goal is to extract all the posts from my WP site in JSON format.
Remember the goal here is to run a *static* website with WP. There are plugins that convert WP to static HTML, which you can then use to power a site, and this isn’t a bad idea.
## How To: Get all the posts from a WP site via the JSON API?
This sounded easy. `http://local.wordpress.dev//wp-json/wp/v2/posts` listed posts, and the v1 [comparison chart](http://wp-api.org/misc/comparison.html) says that you can list *all* posts, it stands to reason that I can easily get all my posts.
In a way, this is a WordPress problem. WP doesn’t want you to show all posts. It would make your site very slow if you had, say, 10,000 posts. Which means that the claim that the JSON API can lists all posts is true, it just doesn’t do them all at once.
I happen to have 40 published posts on my test site, so when I GET with this URL, it loads all of them: `http://local.wordpress.dev//wp-json/wp/v2/posts?per_page=100`
But that isn’t sustainable. And the old trick of making `per_page` equal to `-1` didn’t work.
I did determine that the JSON API actually knows what the amount of posts is!
The header “X-WP-Total: 40” is what I needed. Of course, that is rather weird to get. It means to get all the files, I have to write ‘something’ that does this:
1. Get `http://local.wordpress.dev//wp-json/wp/v2/posts` and parse it to get the value of X-WP-Total
2. Get `http://local.wordpress.dev//wp-json/wp/v2/posts?per_page=X-WP-Total`
Okay. So how?
Well remember how I mentioned a plugin that made a static site already? I was talking about things like [Really Static](https://wordpress.org/plugins/really-static/). Save a post, it saves the JSON file! Why not write this plugin?
Why not use “Really Static”? Well I don’t want to have WP doing more than be my content generator. I want to separate content (the blog) from WP. And that means I will end up writing a plugin…
## Am I In Too Deep? Or Am I Over My Head?
So far, this has been an incredible amount of work. It’s been a lot of two steps forward and three steps back, over and over and over. And yes, it’s been very frustrating. I’ve given up many times and, if my posts about multiple approaches are any indication, I’ve deleted and restarted many, many times.
And I have to be honest here… I’m giving up on this overly ambitious plan right now.
This marks two major failures (three if I could how insane the entire ‘use Jekyll/Hugo to run a gallery’ was). First, I’ve failed to sensibly convert JSON files to MD in a scriptable and reproducible way. Second, I’ve failed to export JSON from WordPress in a simple way. Both those failures can be worked around. I can build a plugin that exports the JSON. It’s not trivial, but having done similar things I’m sure I can do it. The issue is ‘is it worth it’? And right now I think the answer is no.
I’m back to the drawing board right now, sketching up new plans and ideas. I want to eliminate as many steps as possible. I’d like to leave WordPress alone, let it be WordPress, and similarly let my static generator be static. These failures have taught me more about the interdependencies than I expected, and I’ve learned more from them than I may have if I’d had outright success from the start.
While I’m starting over, again, I feel hopeful and less ‘I hate you, JSON’ than I thought I would. I now understand things more clearly and I see how I made things far, far more complicated for myself.
The future of this project is, weirdly, bright.
**Categories:** How To
**Tags:** api, failure, hugo, json
---
### [GPL Isn't Protecting You](https://halfelf.org/2016/gpl-isnt-protecting/)
**Published:** January 25, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The GPL is about freedom to take your code and make it mine. That doesn't mean you're unprotected, it just means you need to protect yourself.
**Content:**
Some days I know my plugin reviews are going to wreck me. January has had a lot of complaints from people about aspects of the GPL. Specifically they wanted to know how to protect themselves with the GPL.
The truth is the GPL is not protecting anything except the right of the next guy to take your code and do stuff with it. And that terrifies people.
I’m not entertaining a discourse on the merits or legality of the GPL here. Those comments will be deleted. Simply put, a requirement of *the WordPress.org repositories* is that to be hosted there you must be GPLv2 (or later). At that point, every other argument is moot. Your code has to be GPLv2 to be in the repositories. End of story.
Okay. So what’s there left to discuss about protecting yourself and your code? Three things: Trademarks, copyright, and theft. Here we go.
## Trademarks
GPLv2 doesn’t protect your trademark, but that doesn’t mean your trademark isn’t protected. While any image you put in your WordPress theme or plugin has to be given as GPLv2 compatible, that doesn’t void your trademark. A freely offered image that is trademarked (say, the WordPress logo) can be used in your plugin, but it comes with [restrictions](http://wordpressfoundation.org/trademark-policy/) after all. The inclusion of the SVG of the logo in GPL code doesn’t change that.
One of the things that changed in GPLv2 and GPLv3 was related to this. Remember, GPLv2 allows all code that does *not* include any restrictions that were not already in GPLv2. As long as license was as free (or freer) than GPLv2, it was deemed to be GPL-compatible (see the WTFPL). The issue with that is some licenses were very easy to comply with but had clauses like you couldn’t use certain trademarks. This caused confusion, as it was read as a restriction. The thing was that it *wasn’t*! Regardless of what the license said, you never had permission to use the trademark.
This is good for companies. You can trademark your logo and, if someone takes it redistributes a fork with the logos still in it, they’ve violated trademark law. And you can protect yourself there. I suggest you read [Joomla’s post on the matter of Trademark protection](http://opensourcematters.org/legal/trademark/trademark-faq.html) to get a better idea of how it all works.
## Copyright
Copyrights are another thing that the GPL doesn’t protect. Except it does.
GPLv2 and GPLv3 are both [copyleft](http://www.gnu.org/licenses/copyleft.en.html):
> To copyleft a program, we first state that it is copyrighted; then we add distribution terms, which are a legal instrument that gives everyone the rights to use, modify, and redistribute the program’s code or any program derived from it but only if the distribution terms are unchanged. Thus, the code and the freedoms become legally inseparable.
What does that mean? Your copyright is yours. By the act of writing code, you own the copyright (with some exceptions, like if you’re hired to write the code). When you contribute code to an open source project like WordPress, you *STILL* retain the copyright unless you give it away, but the license is whatever the project’s license is. Most of the time this is fine, but as I recently saw with [Hugo](https://gohugo.io), this can be problematic when a project wants to [change their license](https://github.com/spf13/hugo/issues/201). Hugo had to get permission from every single person who had contributed.
This is, by the way, why WordPress will probably always be GPLv2.
One way around this is to require everyone to waive their copyrights in order to contribute. I believe DotNuke did this. Whomever owns the copyright, if the code is still licensed in a way that allows for free distribution then nothing’s really changed. The code is still open.
Of course, then there’s the [jQuery Foundation does with their Individual Contributor License Agreement](http://contribute.jquery.org/CLA/) – In order to contribute to jQuery’s code or website, you have to sign that and provide a valid email. This gives them a way to contact everyone and also makes sure you understand what you signed up for. WordPress just has a checkbox when you submit your code to remind you that you’ve given it up.
If you’ve ever looked at the [jQuery Foundation License](https://jquery.org/license/), you may have noticed this line:
> You are free to use any jQuery Foundation project in any other project (even commercial projects) as long as the copyright header is left intact.
This is not imposing a restriction more than GPLv2. See the bit in trademarks. Legally you had to do that anyway, they’re just reminding you not to be a tool and leave this simple line in:
> - Copyright jQuery Foundation and other contributors
I bark at developers a lot for removing the license headers from javascript files. Don’t do it. You’re violating copyright and, if the original devs complain, you’ll lose your code until you fix it. Which is the point here. Copyright exists beyond GPL, so the fact that it doesn’t actively protect it doesn’t make it not enforceable.
## Theft
I don’t mean legal here.
A lot (a lot) of people argue that their plugin should be able to be encrypted or obfuscated to make it ‘harder to steal.’ I hear that about once a week, if not more. And my answer to all of them is “Not if you want to be hosted on WordPress.org.” WordPress.org has an ‘above and beyond’ understanding of the idea of distribution and allowing people to edit. It’s felt that the spirit of GPL means your code should be easy for someone to read and fork.
I said a dirty thing there, I know. The ‘spirit’ of the GPL is probably causing some of my friends to roll their eyes so hard they’ve got migraines. Sorry about that. But it really is the one time I use it. When I say the ‘spirit’ I mean the intention of the license and it’s application to WordPress.org’s repositories only. Right or wrong, agree or disagree, it’s straightforward. If you want to have your code in the .org repos, it’s gotta be human readable.
There’s a simple reason for this. The GPL Copyleft is all about *freedom* and keeping that freedom alive. The Copyleft says that anyone who redistributes the software, **with or without changes**, must pass along the same freedom to further copy and change it. In order to allow people to change the code, we want it to be human-readable. We want people to be able to look at your code and say “Oh I understand how this works. I will improve it!” When you take away, or overly complicate their ability to do that, we feel you’re intentionally impinging on that freedom. You’re trying to find a way around it, basically.
About the only time I’ve heard someone not claim they were smushing the code up to protect it from being stolen is when someone has smashed their javascript into a `p,a,c,k,e,d()` type compression file. I actually hate those files. Javascript is hard enough as is! Stop making it harder. Plus I need to tell you something really important.
While minifying your javascript *will* improve a website’s performing by decreasing the load time, it doesn’t make it *run* any faster for the majority of code out there. Of course there are situations (large libraries or limited devices) where this is not the case, but trust me here. Your 7 line javascript is not going to be significantly faster just because you compressed it. I advocate using the `.min` version of common libraries, but unless your code is huge, leave it alone and let other people see how to edit it.
## Bonus: Distribution
GPL comes into play when your code is distributed. If I put my code on my server and never give it to anyone, it’s not been distributed so licenses don’t really matter. As the [GPL FAQ explains](http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.en.html#GPLRequireSourcePostedPublic):
> But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program’s users, under the GPL.
It’s the big *if* there. What constitutes distribution? Is your browser downloading a javascript file in order to run my site distribution? Is handing you a zip file distribution?
I always recommend people play it safe.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, license, wordpress
---
### [Mailbag: Can I Track Issues with Github Like WP Support?](https://halfelf.org/2016/mailbag-can-track-issues-github-like-wp-support/)
**Published:** January 29, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Tracking all your issues on all your Github repos? Not all that hard.
**Content:**
> How do I see all my Github issues for all my projects?
I was asked this at a WordCamp by someone who had seen my ‘how to get into Github’ series with Carrie Dils.
If you’re tracking the WordPress forums, `https://wordpress.org/support/view/plugin-committer/YOURID` will list all of the support requests and reviews for any plugin you have commit access.
Not a comitter, just someone listed as an author? Use `https://wordpress.org/support/view/plugin-contributor/YOURID`
But Github? Turns out it’s super easy!
`https://github.com/search?q=is%3Aissue+is%3Aopen+user%3AYOURNAME&type=Issues`
Basically you can go to the [Github Search Page](https://github.com/search) and put in`is:issue is:open user:ott42` and you’ll see them all! There’s no RSS feed mind you but you do get emails for all those so you should be okay.
**Categories:** How To
**Tags:** github, mailbag
---
### [Mailbag: Why Do Cannonical URLs Mess Me Up?](https://halfelf.org/2016/mailbag-cannonical-urls-mess/)
**Published:** January 22, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Don't panic! Here's a towel and an answer to why your urls are 301 redirecting.
**Content:**
This came from a DreamHoster who said it was okay to blog it if I didn’t mention them by name. They were embarrassed about the mistake.
> Why was my site having a redirect loop, and why did changing the domain to force www in panel fix it?
The ‘panel’ being mentioned here is DreamHost’s Panel. We don’t have cPanel, we have PANEL, and it’s our special, 100%, tool. In there, you can edit your domain settings. One of the settings has to do with your domain settings. Simply it asks “Do you want the *www* in your URL?”
In general I check “no” because I’m a [no-www kind of person](https://halfelf.org/2012/dont-use-www/). I don’t like it.
The issue this person was faceing was that you’d go to `http://www.wordpress.dev` and everything was fine, but his site went all over the place weird when you went to
In order to fix that person’s website, I changed “Leave it alone” to “Add WWW” (their preference, not mine).
Why did that work? Let’s understand the issue first. What was happening was that your server generally doesn’t care if you visit `http://www.wordpress.dev` or `http://wordpress.dev` because it knows that they both mean `/home/user/wordpress/public_html/` (or whatever). But! Some servers (like DreamHost) let you prioritize and redirect. If they don’t, you can use nginx/htaccess to force www or not. As far as the server cares, none of this matters. If you force no-www and someone goes to www, they get redirected and everyone’s happy.
Except WordPress. WordPress is picky. WordPress has special settings:
Recognize that? If you have WordPress set to use www and you go to the non-www URL, it won’t redirect you. It will, however, force all internal links and generated paths to have the www. The same thing happens if you don’t force https for your site. WordPress will still serve `http://wordpress.dev` but all the links on that page would be to `https://wordpress.dev` and so will your stylesheets and javascript.
This may make you think that WordPress doesn’t care. You’d be wrong. WordPress cares deeply, and it shows up when you go a URL like `http://wordpress.dev/i-am-fake/` – assuming you don’t have a page named that. If you’ve forced www, WordPress will look for that page and do a 404 redirect. Suddenly you’ll have www!
Except in some cases, what happens is WordPress accepts the URL you gave it and shows without the www. Then it remembers it should have the www and redirects to that. Only it knows you told it non-www and redirects to that. And you get an endless 301 redirect loop. And you cry.
If you force www in DreamHost’s Panel *and* you force it in htaccess *and* you set it your settings, this still may not be enough! You may have to do a search and replace to change all the non-www urls to www!
Amusingly, when WordPress 4.4.1 dropped, we found a rare race condition with http and https and WooCommerce, born from a simple mistake.
Everyone I know who looked at that went “Oh, right, if my site has https in the home and site URLs, maybe I shouldn’t try to force http here!” But Woo lets you shoot yourself in the foot. Or at least they did. There’s a ticket open where I suggested perhaps they prevent that.
And for what it’s worth, I totally get how these things happen. You set up your domain and your WordPress site and your http/https settings at different times. It’s understandable that in 2013 you didn’t have SSL, but you added it in 2014. And at that time, you only put SSL on your checkout pages (right?) and since you wanted your cache to work better, you said “no https for checkout’ed!” That’s perfectly sane and logical. But since LetsEncrypt and HTTPS Everywhere became big in 2015, you changed the whole site over and simply forgot about that one, teensy, toggle…
At least, until someone got that horrible 301 redirect on checkout.
Like I told the people I fixed, don’t kick yourself over this. You have a lot of moving parts and the secret is understanding how each bit works. If you know that you set Panel properly, and `.htaccess` properly, and site/home URLs properly, *and* it only happens on checkout, you can zero in on what’s left and debug that.
**Categories:** How It Works
**Tags:** debug, mailbag, wordpress
---
### [Why CDN Media Needs a Plugin](https://halfelf.org/2016/cdn-media-needs-plugin/)
**Published:** January 20, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There's one simple reason, but understanding that reason comes with understanding how media is saved in general.
**Content:**
I wanted to write a blog post for work (something I try to do once a month) so I thought “I should write about using a CDN for images. I wonder if you can do this without a plugin…”
One hour later, and 1200 words, the answer is no. You cannot.
My initial goal was to move media files (and *only* the media) from `http://example.com/wp-content/uploads/` to `http://static.example.com/wordpress/` on DreamObjects. I’ve written a plugin that does that, but to my frustration, I found you cannot do this *without* a plugin for one incredibly simple reason.
But before the big reveal, let’s break down, in simple terms, what I would actually need to do in order to move the uploads. My two assumptions are that I already have a WordPress powered site (check) and I already have DreamObjects (check)
1. Setup a bucket on DreamObjects (or AWS whatever) to house my images, and give it a CDN alias.
2. Copy all the images to the bucket.
3. Change the Upload URL to `http://static.example.com/wordpress/` (my CDN alias for the bucket).
4. Edit all posts and GUIDs to the new URL.
The thing is, I can actually do all of that!
## Setup a Bucket on DreamObjects
Log in to your Panel, click on Cloud, go to DreamObjects, and create a new bucket in DreamObjects. I called my domain-static because that’s easy for me to remember. Static content lives here. Once you have your bucket, click on the “Change Settings” link and add an alias of “static” to the domain you’re hosting all this on (example.com in this example).
You can name your alias anything you want. I just picked static because I knew I wanted my URLs for images to be `http://static.example.com/wordpress/2016/01/happynew.jpg` and this makes it simple. I like to leave my CDN available for more than just WordPress, and doing this will let me have more folders like `wiki` or `gallery`.
Next, scroll down to “DreamSpeed CDN” and turn on CDN Support. You’ll notice that tells you a special URL for CDN:
> Connect to the accelerated DreamSpeed CDN version of this bucket at: examplecom-uploads.objects-us-east-1.dream.io
Don’t worry! You can use your custom URL too. You don’t have to, but most of us want to, to feel special. In order to use your custom alias that we just made, scroll up a little and check the box for ‘CDN’ on your alias. Press save and you’re good to go!
## Copy all the Images
*Set the bucket public first!*
Just trust me, here. Okay? Good. Set the bucket public and then upload all the images. I used Transmit. Cyberduck also works.
## Change the Upload URL
This part was scary.
We need a moment of history first. Up until WordPress 3.5 this was actually pretty easy to do. You went to your media page and you changed things. As of 3.5, WordPress decided that this was more trouble than it was worth. Too many people were accidentally doing silly things, breaking their sites, and it was too dangerous. So they *removed* the part of the screen that let you change this.
I have issues with this, since for what I want to do, it makes it a hassle. But given the flaw in my great plan, I recognize the change as one that protects people who know less than I do.
Using a plugin to restore this missing setting would be the easiest on many levels. And there are a few plugins that do this but I like [Upload Url and Path Enabler](https://wordpress.org/plugins/upload-url-path-enabler/). It’s simple and to the point.
Of course, I love wp-cli and we have it on all our servers at DreamHost, so this command is similarly awesome:
```
wp option set upload_url_path http://static.example.com/wordpress
```
The last option for this is the secret WordPress page called “All Settings” — This is hands down the most powerful and dangerous page in all of WordPress. It lists all your options and settings that you have in the database. And yes, you can edit many of them in your browser at `http://example.com/wp-admin/options.php`
Go ahead. Take a look. It lists a *lot* of things, most of which you should never, ever, ever, touch. If you were going to use this, search for `upload_url_path`, change the value from empty to `http://static.example.com/wordpress`, and press save.
## Edit All Your Posts
This is a sucky part. You have to edit all your posts now to move the existing images. This is because those changes you made are *only* for images going forward. Which is really cool and means you didn’t break anything so far. But WordPress hardcodes the paths to images in your posts (for many reasons) so you need to change all of them.
If you know how to use the command line, this is actually really easy:
`wp search-replace http://example.com/wp-content/uploads/ http://static.example.com/wordpress/`
Run that command and WP-CLI will magically fix all your posts.
If you don’t want to use the command line, I recommend [Velvet Blues Update URLs](https://wordpress.org/plugins/velvet-blues-update-urls/).
## Done!
And to be clear on things, *this worked perfectly*. My media library showed properly, all my images showed, and everything looked perfect. So I decided to run some basic tests and upload new images…. and that’s where my house of cards fell apart.
**You cannot *save* files to another server.**
## Actually You Can… if you sudo
Now I have to tell you something. I lied. You totally can do this. The problem is that it’s hard and requires mounting your bucket as a local filesystem so that it would be available via the file-path of the server. You see, you could save files to `/folder/location/wordpress/` anywhere on the server. I save mine to `/home/user/public_html/static/` on one set up, and I have a static domain (`domain-static.com`) that runs from that folder.
What that means if I had a location I could access, I could tell WordPress to save there, making it ‘local’ enough to trick it. You can do this with tools like [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse), however they’re incredibly complicated and weird for the layman. And that right there was my problem.
If you’re trying to present something as ‘Without a plugin’ then you don’t want to make the tradeoff be ‘..but with sudo access to a VPS.’ That’s unreasonable.
And it’s why, right now, if you want to use a CDN for your media in WordPress, use a plugin.
**Categories:** How It Works
**Tags:** coding, plugins, wordpress
---
### [The Fiscal Responsibility of 25%](https://halfelf.org/2016/fiscal-responsibility/)
**Published:** January 1, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Do we have a fiscal responsibility to not update or must we update, regardless of the big picture?
**Content:**
“We’re going to deploy on December 20th.”
I winced.
I’m not Christian and December 25th is just another day when I binge watch Netflix. The 24th? Movie night! But I picked up a habit at the Bank and that was not deploying code for the last two weeks and first two weeks of the year unless the company was going to be fined if we didn’t.
I was brutal about that to people. I was harsh and mean and demanded lengthy justifications. I made them speak to senior management, who were hard to find around that time of year because every one was on vacation.
The reason for this was that the bank had a clear cut *fiscal* responsibility not to go down between Thanksgiving and a bit after New Years. That was when year end processing happened, and that was when many companies who used us were processing the most orders. For a lot of people, business booms right when everyone wants to take a break to be with their family.
WordPress runs 25% of the Internet.
We use it for blogging, for building Facebook-eqsue sites, for running ecommerce stores.
That means and we the developers of WordPress now have a responsibility not to break when we upgrade people. A *huge* responsibility. And it’s one we can never give with 100% assurance because of one simple fact.
We made WordPress open.
Anyone can make a theme or plugin. And while we do our best to test with core WordPress, we cannot test all of the 45k plugins in the repository yet. The best is *maybe* we could write a script to check for fatal errors on activation. But even then, can we test all 45,000 against all possible permutations of combinations?
That’s an incredibly massive number. All my factorial calculators, even Google, just said ‘Infinity.’ And we add about 9000 plugins a year. This is staggeringly huge and it gets bigger every year
But with this increase in share and use comes an incredible *responsibility* to 25% of the web. We *cannot* break their sites.
Of course I know that’s impossible. There will always be outliers. And even with the large user base that companies like Yoast have, the dearth of willing and capable Beta Testers for a free product is going to bite us. It’s part of what I asked [what I did at the Town Hall at WCUS](https://halfelf.org/?p=8307) — Are we going too fast?
Speed cannot exclude us from a responsibility to our users. And with the increasing provenance of online stories and websites for everyone, pushing a change when we know that the majority of the world is celebrating *something* between Nov 15th and January 15th is reckless. Look at how many people want time off in those months to be with family. Look at how many businesses are running sales. Look at the amount of data transfer that spikes.
And then picture what happens when an update has a small bug that takes down one site in a thousand. 1/1000 of 1/4th of the entire Internet. If that didn’t make you shiver, do the math again. Imagine if Apple went down because they pushed an update right around Christmas?
The answers change sometimes, though. What if it was a security fix? Would that change your mind? It would change mine. A major upgrade around Christmas worries me. A minor one, not so much.
It may be time to call a year end moratorium on updates to our systems and apps. If they’re business and mission critical, test them as best you can, but consider if you *have* to update before that Christmas rush. Make people jump through hoops to prove they need the new shiny right now. If you know you’re understaffed or under heavy load, consider that as much as anything else.
**Categories:** How It Is
**Tags:** rant, responsibility, wordpress
---
### [Mailbag: How do plugins update?](https://halfelf.org/2016/mailbag-plugins-update/)
**Published:** January 15, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How plugins (and themes) upgrade and (possibly) why we sometimes break WordFence.
**Content:**
From Ken the Web Mechanic comes this:
> Hi! I wonder if you’d have any insight on this… I’ll mention Wordfence, though I imagine that it applies to any security plugin that compares plugin files with those in the WordPress repository… One of the most common things that Wordfence reports as a file “inconsistency” is the readme.txt of many plugins. Frequently, when using Wordfence’s compare feature, the readme of an installed and up-to-date plugin is shown as not the most current version and the repository shows the latest version – which is for the version that is installed!! If you delete the plugin and then download and install it anew from the repository, the readme is for the current, Wordfence has no complaint and all is right with the world… So I guess my question is… When a plugin is updated through WordPress, does the readme.txt file always get updated? It’s always been my understanding that during an update all of the old filed are deleted and then the new version is installed from the repository… It’s seeming like this may not be 100% of the case. It’s certainly only a minor irritation to me… but it makes me curious… Inquiring minds and all of that! 😉 Thanks!
I put the whole question in because while the crux is “How are these buggers updating?” the whole picture is interesting. I’ve talked about this once before, but it was a very long time ago. [How the WordPress Upgrade Works](https://halfelf.org/2011/how-the-wordpress-upgrade-works/) was posted in 2011, and [Why does the WordPress background auto-upgrade work?](https://halfelf.org/2013/why-does-the-wordpress-background-auto-upgrade-work/) was back in 2013. So it’s about time for a revisit.
The short answer is “Actually, the readme.txt **is** deleted on plugin (and theme) upgrades.”
The longer answer means first we should understand what’s going on with upgrades! How plugins (and themes) update is pretty basic and you can check out `/wp-admin/includes/class-wp-upgrader.php` to see all this code:
1. Connect to the filesystem.
2. Download a package.
3. Unpack a compressed package file.
4. Clears the directory where this item is going to be installed into.
5. Install a package.
These are all great failsafes, making sure multiple times that we’re not about to leave a user in a bad state. We check to make sure we can download and use the file before deleting and replacing. We check to make sure WordPress can find all the folders it needs, like `plugins` and `wp-content` and so on. If it can’t connect to any of the ones it needs, it will fail. We make sure we can download and unzip the file. Even when we look at the complex fourth step, we’re all checking over and over to make sure that when we really do delete these files, we have something to replace them with.
The goal is that WordPress should never be able to leave you with a plugin deleted and not installed again, nor should it leave you with a half-deleted plugin. Obviously critical failures, like a server reboot mid-stream, will have some catastrophic effects. This is why WordPress tosses a `.maintenance` file down, mind you. Stops your site from looking like total poop while all this is going on.
When we look at the class `Plugin_Upgrader` itself (line 766 or so), we get into some nitty gritty things. The public function `upgrade` does some interesting things:
Here we are clearly deactivating and deleting safely before we upgrade. And at this point, I’m very confident that we’re deleting that readme.txt before we upgrade.
Okay! So why is WordFence being a dillweed?
I have a theory it’s related to the updates we do when WordPress core has a new version. You see, instead of updating the whole plugin, we update the readmes only to edit the “tested up to…” value. If there’s no code change, after all, why would we bother? No need to push an update! This means you no longer have a plugin that 100% matches what’s on Wordpress.org, you have a plugin where the code files match, but not the `readme.txt` files.
And then poor WordFence notices that the readme you have and the readme on .org’s servers is out of whack, and tosses an error.
I don’t know how WordFence would fix that, but I’m pretty sure this would hang ’em up.
WordFence folks, got any ideas?
**Categories:** How It Works
**Tags:** updates, upgrading, wordpress
---
### [Not Ditching ZenPhoto After All](https://halfelf.org/2016/not-ditching-zenphoto/)
**Published:** January 13, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Walking through the problems that made me stick with ZenPhoto after all.
**Content:**
When we last left our heros… We had taken a SQL database, converted it to JSON, split it into 885 separate JSON files, renamed and moved them based on the folder path previously assigned.
That took a while, but now we’re ready for the fun!
## Convert them to MD
I already know how to do this one. Run [grunt-mustache-render](https://www.npmjs.com/package/grunt-mustache-render)!
One problem. It didn’t like recursive folders. Pause for laughter. Thankfully I had done a `cp` and not an `mv` on my files with Mike’s script, so I just changed that to handle moving `.md` files instead of `.json` and it all went fine.
## Turn on Hugo
I had a theme already so I copied it over and then started making my changes. I needed the layout to be a little different.
First I needed a list of all the sections and files and I needed to grab all the items that were an ‘Index’ file and format them specially:
I felt very pleased with myself at this point. Obviously I would need to replace “IMAGE HERE” with an image, but I had the basic idea down.
Inside each post, there was a shortcode mentioned before, `{{< gallery >}}`, and this is where my drama started. What I wanted I thought would be (fairly) easy. Get a list of all the folders where this `index.md` file was and list them similar to what I had done before. They were sub-sections (in Hugo Terms), but as it happens, Hugo doesn’t have a way to handle those! [There are no templates for subsections](https://github.com/spf13/hugo/issues/455). Now this in and of itself wasn’t a deal breaker. I could made do with that shortcode except…
## Limitations
The thing I really do like about ZenPhoto is that I can drop my new media in a folder and magically knows what’s up. Add a new folder? It knows it’s there. With Hugo (or Jekyll) I found it was incredible hard to do something as ‘simple’ as getting a list of all the items in a folder. With Jekyll I’d [need a plugin](http://stackoverflow.com/questions/17446472/how-to-list-files-in-a-directory-with-liquid) (which I am certainly not adverse to). Hugo has a readDir call, but [it’s limited to the working directory](https://github.com/spf13/hugo/pull/1204) and I wanted to read the images in a CDN folder (on the same server, but still).
Perhaps ironically, it’s easier to run a gallery with Hugo and Jekyll if you host the images off your own domain. It goes against my goal of having a self-hosted site, though. But for now, it’s not possibly to do what I wanted.
## Do I feel like I wasted time?
No! In fact, I’ve learned a lot of things that tell me where the foibles are in my plans.
[ustwo actually did make a React powered site](https://ustwo.com/blog/open-sourcing-our-website) and in looking at [their source code](https://github.com/ustwo/ustwo.com-frontend) I see they did it by making the site ‘all one page.’ This is something I can understand today and wrap my head around. Because the alternative would be something like this:
1. Write a post
2. Run a script to grab all the pages via the JSON API as individual .json files
3. Run a script to convert them into .md
4. Build static site (test and then deploy)
It’s not actually that horrible when I put it that way. It means everyone could write on WordPress and, when they’re ready to deploy, I just run my script, push to my dev site, validate, and push to live.
But. That loses a lot of what makes WordPress cool. Editing posts on the fly, pushing live updates, and scheduling posts all becomes a nightmare. For my Gallery idea, it means that WordPress remains a viable option except for the fact that I can’t easily move from ZenPhoto to WordPress *and* WordPress behaves like a blog when I don’t want it to be one.
I’m all about using WordPress for things other than blogging but the sad truth is it’s still structured like a blog. Custom Post Types are doing a great job, and a lot of what I do on my estore site is similar to how I’d want to handle a gallery. I could do posts as posts and organize them as categories, for example, and structure the whole theme to handle that…
Or I could just stay on ZenPhoto, which does all that out of the box.
And yes. That’s what I’m doing.
**Categories:** How To
**Tags:** hugo, wordpress, zenphoto
---
### [Ditching ZenPhoto for Hugo?](https://halfelf.org/2016/ditch-zenphoto-hugo/)
**Published:** January 11, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** My adventure of moving from ZenPhoto to Hugo did not go as expected.
**Content:**
This started out as a 230 word bullet point list of how to do things. It’s now two entire posts!
## (Almost) Leaving ZenPhoto
I have to preface this by telling you that I *didn’t* in the end. Yeah. I know. I planned to. And here’s why:
I like ZenPhoto a lot. It’s a great Gallery tool, and after Gallery2 went to Gallery3 and I hated it, I was quite in love with them. But. They’ve started to inch towards being a general CMS and the whole ZenPhoto/ZenPhoto20 split left a weird taste in my mouth.
Plus the DB I have is already 65 megs, which has started to behave a little oddly. Now I have 38,534 images in 885 albums, and to a degree that makes sense. If you think about it in WordPress terms, I have 885 taxonomies (tags and categories), and 38,534 posts. Given that each post in this example would be a sentence at most (describing the image), the WordPress DB would be around 15megs based on some napkin math I did. Validating this, there’s a [WordPress Joke DB with 40k Jokes](http://wordpressgalaxy.blogspot.com/2013/01/40000-jokes-wordpress-database-download.html) and it’s only 14 megs.
Oh and did I mention that ZenPhoto has no export feature? I guess there’s a reason the first PHP script I wrote was a simple Gallery. All I really want is to display images in a structured format.
But. As I said before, I *did not* leave ZenPhoto! Why not? Because I was unable to do what I wanted to in pure Hugo, and because porting everything over to WordPress is incredibly hard and complex.
## Why Not WordPress?
WordPress has a lot of awesome advantages. It auto generates thumbnails for one, which [Hugo does not](https://github.com/spf13/hugo/issues/1014), so porting the gallery over would save me one level of complication. But I have 38,534 images to import. No matter how you slice that, I’d have to import them and associate them with the right post. Probably manually.
With a static generator, I can very easily assign a variable for each album to say ‘get images from this folder and display them.’ And if there are folders, list each folder as a link to another page. By contrast, I would have to use a plugin like NextGen gallery to do this in WordPress, and while I do like the plugin, it’s got the same issue that ZenPhoto has for me. It’s doing too much. And, to be honest, part of this process is to limit my potential security issues. Adding in really big, really complex plugins is the opposite of that, no matter how rigorously reviewed they are.
Besides, if I hated it, I knew I could import MD files into WordPress. [Someone already did it with Jekyll](http://tyler.io/importing-jekyll-posts-into-wordpress/) after all.
## Get and Grep the Data
No matter what I needed the data. Thankfully I knew how to do this with phpMyAdmin already. I dropped the `_albums` table in JSON format. Why JSON? Well as I’d already learned, I could generate a Markdown file from a JSON pretty easily. Of course, I got stumped on having it loop through the JSON file, but I have a plan for this.
On export, `albums.json` was 643 KB while `images.json` was 61.4 MB. And they were all one line. I’m not using `images.json` just yet.
I tossed it into BBedit and scrubbed the data, removing everything I didn’t need. This did not change the file size at first, since I also made the JSON human readable. There was a lot of gripping here, but I took each entry from 16-22 items down to six: tags, categories, folder path, title, description, date. And the file went down to 143 KB. One-sixth, more or less.
Finally I had to split each entry because, as I’d learned, trying to loop through a nested JSON array in grunt is complicated. So fine, I’ll do it manually. But how? Answer: By loving linux. You can [split files](http://www.computerhope.com/unix/usplit.htm)!
There’s also [csplit](http://www.computerhope.com/unix/ucsplit.htm), which is contextual split. Either way, I now have 885 `album-xxx.json` files. Whew.
## Rename and Move the Files
I messed around with linux commands to move files based on their folder paths and rename them based on the last variable. I dreaded having to just move them and then going to mess with the renames. So after two days, I asked Twitter and was saved by Mike Little and Kailey Lampert. Between them I learned that there was a jq tool for messing with JSON (homebrew install it) and that a shell script is a godsend.
I ended up changing it to reduce future broken URLs. But basically everything except the `mkdir` comes from Mike. He’s my hero.
## To Be Continued
Once I had all the files, it was time to change them all to Markdown files and whip out my templates!
But you’ll need to wait for that because this post got really long.
**Categories:** How To
**Tags:** gallery, hugo, wordpress, zenphoto
---
### [Mailbag: Access and Security](https://halfelf.org/2016/mailbag-access-security/)
**Published:** January 8, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Not everyone needs to be an admin. The path of least resistance is often the wiser one.
**Content:**
In the midst of a longer set of forum posts about how to not have a plugin updated because you’ve made edits to the plugin, someone said that their issue was that the people on the site updated.
> Now please don’t say that we should give them minimum privileges …
Actually. That’s precisely what I’m going to say.
1\) Do not make anyone an admin whom you do not explicitly trust.
2\) As the admin, test all plugins before updating.
3\) If a plugin is constantly releasing unstable updates, stop using the plugin and look for alternatives.
3a) But make sure it’s not your theme or a conflict with another plugin first. It may be something else’s fault.
4\) Stop editing plugins directly.
5\) Treat every upgrade as a serious thing.
Now. I know why the guy doesn’t want to hear “You’re doing it wrong.” But the truth is this. If you give people who are irresponsible enough to update things the ability to update things, they’re gonna update things!
True story? On one of our company sites, one of the guys has access to update all the things. He did and broke the site. I jumped in, told him “Don’t do that, please, ask me next time.” and I fixed it. And then I went through everyone who had admin access and locked their accounts down to Editors. The exceptions were the people who legitimently *needed* that access.
And yes, WordPress needs more granular user roles/controls. I want that user to have access to administer all posts *and* add new users. I don’t want him anywhere near the plugins and themes. But I evaluated the risk vs reward of his access, and since he’s educatable, I felt it was safe to leave him there. Plus he knows right away to call me if he breaks things.
That goes back to the trust aspect, though. I trust him.
Trusting people to have access to aspects of your site reflect your understanding of what that access means. Making everyone and their brother an admin is reckless, not to sugar coat the situation. Only people who *must* be admins should have admin access. It’s really that simple. And if you insist there’s no other way around it, then you’re not paying attention closely enough.
Make a list of what your users *need* to do. Not what they want, what they *need*. And be serious here. Do they need to update plugins or do you do it for them in a reasonable timeframe? Do they really need to be able to add users? Remember though, we’re asking what *they* need, not you. Go to [WordPress’ list of Roles and Capabilities](https://codex.wordpress.org/Roles_and_Capabilities) and take note of what they actually can do.
Now I said before, the roles and controls and capabilities of WordPress leave a lot to be desired. But thankfully WordPress has `add_cap` and you can adjust roles.
Here’s how [Isabel Castillo](http://isabelcastillo.com/editor-role-manage-users-wordpress) did it:
You only need to do that once since the roles and caps are locked into the database (see above, the controls need to be better). Still. Now your *editors* can edit users. Brilliant.
So yes. I will tell you you’re doing it wrong, especially when you’re doing it in a way that is dangerous and risky in the long run.
Don’t let the toddlers try to drive the car.
**Categories:** How It Is
**Tags:** mailbag, security
---
### [Mailbag: Hugo from iPads](https://halfelf.org/2015/mailbag-hugo-ipads/)
**Published:** December 25, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Yes, you can totally post to a Hugo managed site via your iPad. You just need to git a little help.
**Content:**
So I’ve done the whole Hugo thing and it’s great and it totally works for me. That 1% itch left from Jekyll is gone. So queue the inevitable…
> But what about mobile posting?!
Why on earth the planet is obsessed with posting everything from their phone, I don’t know. Things like Instagram and Twitter make it easy for us to ‘communicate’ (and I use that loosely) and post photos of our lunch. And yes, the iOS app for the iPhone means I can ‘live blog’ but, to be honest, I hate it on my iPhone.
My iPad though… I love posting from that.
And yes, yes I can post to my Hugo run site from my iPhone or iPad. Remember, I can push my new content by running a git push command. The server will build, sync, and clean up on its own. All I need to do it is a Git app on my iPad that doesn’t suck
[Working Copy](http://workingcopyapp.com) does not suck.
It’s an iOS app that pulls my git repository to my iPad (the whole thing, so make sure you have room). Then I can edit files, commit them, and push. Hugo on the server does the rest, just like it would from my desktop.
Working Copy is different from many other Git related apps because can hook into *any* git repository. I’m not using GitHub for this project. I want to do 100% self hosting, and that means no GitHub. Also no BitBucket. These tools are fine for what they are, and in fact I pay GitHub for some private repos. But I wanted my repo on my server, in part so I could do exactly what I’m doing.
The tool is incredibly simple. It’s a familiar file navigator, tap through the folders. Tap edit to edit, make changes to the post, hit done. There’s even a preview feature that mostly works. Some of my Markdown files are very weird.
If I wanted to edit in Byword, which is what I do most of my writing in for non-novel related things, I can share and go back and forth. I’d love it if the WordPress iOS app (or Calypso) did that. Write in Byword, send to other app. But even a copy/paste is simple enough. In this case, I can write in Byword and share to Working Copy. The interface takes the title of my document and let’s me pick the folder.
Once I’m done with my edits, I commit my changes. Then I can push, or not. There’s an option to commit+push, but it crashed my app. A skim of reviews showed this happened to others. The iOS interface can be a bit tetchy so having this be two steps doesn’t bother me.
I did find it odd that there was no button to push. I had to go back to the main folder, swipe-left, and press the orange push button. But that, and the weird crash, were it for annoyances.
While free to download, it’s $9.99 for unlimited deployments. It was free for 3 weeks, which I tried out over WordCamp US and found simple and perfect for my workflow.
**Categories:** How It Works
**Tags:** ios, mailbag
---
### [JSON to Markdown](https://halfelf.org/2016/json-markdown/)
**Published:** January 6, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Struggling on my mastering of the JSON API. How can you turn JSON into Markdown?
**Content:**
Now that I understand how Hugo and JSON work separately and together, it’s time to figure out the next question.
Can I generate Markdown files based on the contents of a JSON?
## My JSON File
I started with an SQL DB where my photos have lived for a long time. I exported the albums table to a JSON file (yes, phpMyAdmin can do that), cleaned it up by removing the cruft I didn’t need, and ended up with something like this:
By the way, I’m not going to address how to actually make the gallery with images here. Yet. The eventual idea I have here is to run this with WordPress doing that, but since I was messing around with this anyway, I figured I’d reuse what I had.
The end goal here, remember, is to export the JSON file from WordPress (list all top level categories, let’s say) and have Hugo generate a page for each one. That’s all. But WordPress has so much data, I decided to start with the smaller, simpler stuff.
Let’s move on.
## Create a Markdown Page from JSON
Thankfully someone else has already tossed this idea around. I started with reading [Dynamic Pages with Hugo](http://cyrillschumacher.com/2014/12/21/dynamic-pages-with-gohugo.io/)
> My idea is: Import any JSON or CSV from any local file or URL and make the JSON or CSV content available in a shortcode or directly in the layout files.
That was very close to what I wanted, but it would result in me having to make a page for each item. I don’t want that. I want a script to make the `.md` file for me.
So I stepped back and stopped asking “How do I make a Hugo page from JSON?” and I asked “How do I make a separate file for each entry in a .json file?”
Sidebar: My wife was trying to convert the Hebrew year (3595) into all the possible other calendars and asked me to help her with the math. I asked her “What Julian year is that?” She said it BCE so it didn’t work like that, but that was 167. I Googled “What is 167 BCE in the Chinese calendar?” Boom. [WikiPedia’s page for 167 BC](https://en.wikipedia.org/wiki/167_BC) lists them all. As I pointed out, the trick to these things is not converting it all yourself, but getting from ‘weird’ to ‘Base 10.’ Once you’re at the default (the lowest common denominator), it’s allot easier to figure out other people’s weird.
This is related to my task at hand. Weird is being specific. Weird is *caring* what system I’m using. The root of my issue is this: I want to make a Markdown file for every entry in JSON.
I use [Mustache](http://mustache.github.io/). And, yes, [someone already had this idea](http://evilmousestudios.com/using-mustache-and-grunt-for-documentation/). He was using [mustache-render](https://www.npmjs.com/package/grunt-mustache-render) in Grunt, which I’m already familiar with, but I made a few changes.
1. I changed the templates folder to my Hugo [Archetypes](https://gohugo.io/content/archetypes/) folder. This is my source, my style.
2. I changed the data folder to my Hugo [Data](https://gohugo.io/extras/datafiles/) folder.
3. The output went to (you got this one, right?) the Hugo Content folder.
This should work, right?
## Mustache Render
My Gruntfile has this:
And my `gallery.md` file is like this:
Except that doesn’t work. If I changed `{{title}}` to `{{0.title}}` then it showed Foo and Bar’s adventure information. Obviously the render was only going to show each entry individually. Now. This could work in a variety of situations, just not mine. Alternatively, I can wrap the output in this: `{{#0}} ... {{/0}}`
But what I want is ‘for each key in json, make a file…’ and since I can put the JSON output right into the gruntfile (`data: { greeting: "Hello", target: "world" }`) then in theory I want to generate this:
Okay so how do I tell Grunt to read from a JSON and for each key, do a thing? First I use `grunt.file.readJSON`:
And this will output item #2 (Bob’s vacations). So stage one is complete. Now I want the 1 in `pkg.1` to be iterative *or* I want to pass a variable to the mustache file and change `{{#0}} ... {{/0}}` based on its value. Obviously if I had one JSON file for each ‘post’ I wanted to make, this would be easy.
## Multiple Markdown Files from One JSON
I have no idea.
Seriously. I spent a few hours on this, lying in bed trying to feel less cold-and-flu-ish. At this point, I don’t really care what I use to do it, but the bones is this: Take one JSON file and split each object into it’s own file.
Can’t figure that out yet. But hey, there’s my 2016 project!
FYI: If you reply with ‘try project X!’ without a code example of how to do it, I’ll probably delete your comment. I’ve seen ‘Try handlebars!’ or ‘Try Assemble’ but my issue here is no one has an *example* of how to do it, and I work best by example. I need that Hello World.
I am looking at Handlebars and Assemble, by the way, but at 900+ words, it’s time to call a pause on the adventure.
**Categories:** How To
**Tags:** grunt, json, markdown
---
### [Using JSON with Hugo](https://halfelf.org/2016/using-json-hugo/)
**Published:** January 4, 2016
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I may still be in over my head, but I'm learning to swim!
**Content:**
I know I’ve been talking about Hugo a lot, but the whole reason I say and wrapped my head around it was that I wanted to make a website using JSON.
Making something out of the [JSON API](http://v2.wp-api.org/) in WordPress isn’t easy, and I decided to start with something hard. I thought I would make a Multisite network to be the back end of my site, and then call the JSON API to generate the content.
## Why?
It doesn’t make my site (much) faster, though it makes it more cacheable. Mostly what it does is lets me separate church and state. I can use WordPress to write content, and then call it however I want. That would be Hugo. If I build the site via Hugo locally, then every time I generate the files it can pull in the data on the fly.
## Enable the API
This is easy. Install WordPress 4.4 and install v2 of the [Rest API plugin](https://wordpress.org/plugins/rest-api/). I also installed Jetpack for reasons of using Calypso.
You absolutely have to use the Rest API plugin. WordPress 4.4 adds in some of the bits, but the API plugin gives you the actual endpoints. You’ll need these later.
## Call the API
This was also easy. Kind of. Making a jquery file that called the content was fairly straightforward but… Making it responsive and reactive was hard.
What I really wanted to do was have some web app, js powered without node, that just called the data and kept the url structure. And for that what I need is a JSON client.
It was incredibly hard to find how to make a static HTML website powered by JSON. I’d see Rachel Baker’s presentation on [making a WordPress theme with the JSON API](https://speakerdeck.com/rachelbaker/build-a-theme-with-the-wp-rest-api) but that wasn’t what I wanted to do. I mean, in a way it was. The [theme itself](https://github.com/rachelbaker/wcus-demo) was what I wanted, but I didn’t want to run it with WordPress.
I did a lot of research and finally stumbled onto [restful.js](https://github.com/marmelab/restful.js) by marmelab. I read their [blog post](http://marmelab.com/blog/2015/03/10/deal-easily-with-your-rest-api-using-restful-js.html) on the product and it looked like what I wanted. I needed something that would run without Node.js since I wanted to do this on Apache.
## Consuming a RESTful Web Service Dynamically
And this is when I starting banging my head against a table. None of the solutions I’d found were working for me. Nothing. Rachel was right. I was in a bit over my head. Oh she was nice enough not to say it that way, but they way she looked at me was very Jewish Mom of her.
In order to stop feeling useless, I decided to learn Hugo. It had come up a few times on my search for a dynamic static site. Hugo has [LiveReload](https://gohugo.io/extras/livereload/) which, if you’re familiar with most static generators, is pretty cool. The idea is the pages rebuild as you edit the content (or theme) files.
If you run `hugo server` locally on your laptop, you can see this today. Hugo upped the ante by tossing in the ability to run it on the server *and* the ability to watch the data files. It also has the ability to [call JSON remotely](https://gohugo.io/extras/datadrivencontent/).
I feel it’s important to note that you *cannot* trigger that LiveReload when you’re using external URLs. But anytime you edit a file and LiveReload is triggered, Hugo will read the URL content from your cache. If you’ve disabled cache, it will download it fresh. Don’t disable cache unless you have an unlimited API. And no, I don’t know how long the cache is good for.
Sadly, OAuth or other authentication methods are not working yet, but for now that’s okay because I’d been in over my head for so long, I stepped back.
## Understanding JSON First
Okay fine. Once I realized I’d tried to do too much at first, I went back to that static filmography I had.
This is basic stuff. A simple chunk by chunk. And to call the file in a shortcode, I did this:
Actually I did a lot more but you get the idea. And if you’re wondering about the if statement at the top, it’s so I can pass a parameter to my shortcode:
It took me longer than I’d like to figure that out. At first I had multiple filmography files (actor, writer, producer) and I was trying to look through them all. In the end, I realized this simple JSON and a simple call was better.
## A Little More JSON
There was another case, though. I had lists of episodes compiled into separate JSON files, one per show. This is logical and maintainable after all, but it meant I couldn’t use the same logic loop in the same way.
What I really needed was to loop through `$.Page.Site.Data.episodes.SHOWNAME` in order to get the data from that show. And I couldn’t add on a variable to my `range` call.
But as it happens, Hugo is clever and if I say `{{ range $.Page.Site.Data.episodes }}` it will give me the file `episodes.json` if that exists. But if there happens to be a *folder* called `episodes` then it will give me all the JSON files in there.
I read through the [data documentation on Hugo](https://gohugo.io/extras/datafiles/) a few times to understand the hierarchy but it breaks down really logically:
Data {dot} episodes {dot} continum
And if I ran this:
Then I got this:
- continum
- fringe
- sense8
I already knew I could do a range within a range, and finally I came up with this:
The shortcode checks the post it’s on and, if the Front Matter has ‘show’ defined, it will give me a list of all titles (episode titles) for that show.
I added in an extra check for the season parameter. This one is passed through the shortcode:
And that, in turn is called in the shortcode above the output for title:
So nothing will display unless the show in the JSON file matches the show on the page with the shortcode, *and* the season matches the one defined in the shortcode.
Now I actually have a more robust check. If no season is defined, it shows all episodes (useful for one-season shows, right?). But you get the idea.
## How Did This Help?
Remember my JSON example before? Here’s what it looks like for *Fringe*:
Instead of just started with those naked chunks, I have a definition of the show name (fringe – lowercase because I want to compare it to other lowercase things and I’m lazy) and the definition of a section for episodes. That’s the whole reason why that call for seasons works the way I want it to.
This helped me to understand and visualize JSON. By taking a simple JSON list (the filmography) I learned the basics of connecting code and content. Then by taking the more complex scenario, where I needed nested data, I understood that relationship.
The next step will be making a *simple* WordPress site and calling the JSON remotely. Obviously I have to figure out how to trick it into making fake permalinks, but baby steps. Baby steps.
**Categories:** How To
**Tags:** cache, hugo, json, rest api
---
### [Porting Jekyll to Hugo](https://halfelf.org/2015/porting-jekyll-hugo/)
**Published:** December 28, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Moving from Jekyll to Hugo is more about trading Liquid for GoLang than anything else.
**Content:**
Importing content is always the bane of moving systems.
Now one of the things Hugo has is a cool command called `$ hugo import jekyll` – and yes, it does exactly what you think it does. This was interesting to me since I wondered if I could switch my library from Jekyll to Hugo and yes, yes I can.
The site I have on Jekyll has a few more posts than the first one I built on Hugo. This one has around 1500 pages. Excited, I ran the command:
That’s not right. I spent a few hours trying to run it in various permutations, but I was never able to get it to run right. Thankfully, I didn’t need to since I could just copy my content over. There was no translation needed, as I was already using yaml headers in my .md files so that actually was a pretty painless transition.
The theme on the other hand… Well. I had a complex site with data files and weird junk being thrown around. That was just learning how to translate for-loops for ranges, with some where clauses tossed in.
Was it hard? Yes. But that’s not what you’re *really* asking.
## Was it worth it?
Excuse me while I whip this out:
Yes. The site builds faster, which is a win. It also creates tags and categories that can automatically cross link. I can make ‘sections’ without having to define them in my config file, just by making folders. I can spin up templates quickly. I have a little more redundancy than I’d like, but as I master GoLang, this becomes less and less.
Build time ranges from 11737 ms to 2116 ms. Milliseconds. They were into the minutes with Jekyll, even though Jekyll 3 was notably faster than version 2. It was still taking me about 2 minutes to rebuild the Jekyll site, even with incremental builds working. Plus I had to build and rsync every time, in addition to Git pushing. Now I just Git and done.
Oh and JSON works remotely out of the box. I just have to get better at my range calls now.
## What’s Different?
Making a ‘static front page’ with Hugo is harder. In fact there’s still an [open trac ticket on it](https://github.com/spf13/hugo/issues/330). I was able to use an idea I already had, a custom post param called “type” for tagging ‘index’ posts in the news pages so I didn’t get a list of my indexes when I wanted to list all news from 2002. I leveraged that and tagged my primary index ‘mainindex’ and put a quick check in my `index.html` in my theme:
Instead of doing a normal loop where, like a blog it shows me posts in reverse order, it just showed that specific content.
But…
If there’s a file in that Section with the type of ‘Index’ then it shows that. Of course… While `index.md` doesn’t get used in the main content folder, it **does** in Sections. If I have a file named `index.md` in a section, that makes `index.html` like I expected. Since I still wanted lists in the majority of cases, I tweaked the content of my default list file (`list.html`) so that I could always show a ‘main’ file:
Then I renamed all the `index.md` files in the Sections to `main.md` but this created another issue. Now I had two URLs that worked. I could have put this into the template for the section to avoid this, but I want to separate content and theme as much as humanly possible. WordPress habits. For now, I’ve left this alone. If someone is clever enough to go to a non-linked, non-sitemaped page *instead* of the index, I think my SEO will live. It’s more than I wanted to play around with loops.
Speaking of the loops and lists, getting a list of a ‘sub section’ is not currently possible either. Rather, they do work, but [there’s no default templates for sub-sections](https://github.com/spf13/hugo/issues/455). This was a small problem since I structured my site like this:
Now, I don’t need a custom template for each sub-section, but I *did* want to use my custom *list* template for each sub-section. To work around this, I made a template in `/layout/section/news.html` that had this:
I know this is weird. The **Type** of index means “I am the main index file of the section” while the **topic** index means “I am an indexing file and not a normal news article. This gives me my main index of `/news/` giving me a custom content page with information like I wanted, using the `main.md` format I use in all sections.
Then in each sub-section, I use a very simple `index.md` file:
That weird bit in the content is a shortcode ala Hugo, which calls the file `/layouts/shortcode/news.html` that has this:
That spits out a table of all the pages in that section by date.
## What’s Next?
It took a lot to get here, or so it may seem. This took me two nights to work out. That’s it. So now I have to figure out the next steps that have vexed me:
1. How do I properly mimic a for-loop with range?
2. Can I make a responsive gallery out of Hugo?
3. Can I power a Hugo site with WordPress JSON?
And that’s a whole ‘nother story.
**Categories:** How To
**Tags:** golang, jekyll, moving
---
### [Looping Hugo](https://halfelf.org/2015/looping-hugo/)
**Published:** December 30, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Looping through Hugo became a day of insanity when a variable couldn't decide if it was an integer or a string.
**Content:**
I’m ending the year with something non-WordPress. But it has a weird JSON related journey.
I asked three questions at the end of my [last post](https://halfelf.org/2015/porting-jekyll-hugo):
1. How do I properly mimic a for-loop with range?
2. Can I make a responsive gallery out of Hugo?
3. Can I power a Hugo site with WordPress JSON?
This is the answer to the first one. However in the solving, I made a breakthrough in my head about how one calls data from JSON and structures it.
But I’m getting ahead of myself, becuase changing a for loop from Jekyll to Hugo was harder than I expected. Way harder.
One of the things I check in some posts is what the rating is. I set a parameter called ‘rating’ and if it’s there, I ran a quick check to determine how many stars to show:
I was pretty damn proud of that loop. Check the rating, output a gold star for each number over 0 and a grey star for every number between the rating and 5. It’s simple but it’s quick.
Transposing from Liquid to GoLang was not as hard as all that. `{% %}` became `{{ }}` and `{% endfor %}` became `{{ end }}` and, at first, that was the easy stuff. The majority of my logic was a one-to-one translation. Change `page.rating` to `.Params.rating` and so on and so forth.
The order of the if’s was strange to me, in that it became `{{ if eq A B }}` (except when it wasn’t) and I was used to thinking `{% if A == B %}` — it was fairly easy to overcome. In short order, all my simple if-checks were done.
But those damn loops! I had the ugliest “if A == 1, show 1 gold and 4 grey” configuration. And worse, I had cases where I was checking “If there’s an entry in the Filmography for this show, get the rating from that and not the page itself.” The Filmography file was a straight-forward JSON file, you see (told you JSON was involved).
Back to the first problem. I knew if I wanted a shortcode to say “Get me a list of all pages, by date, where section is news” I did this:
`{{ range where $.Page.Site.Pages.ByDate "Section" "news" }}`
And that `$.Page.Site.Pages.ByDate` call changed depending on what template I was on and what I was calling. For a shortcode I had to pass though page to site to pages. On a template I could do `.Data.Pages.ByTitle` (no `$` needed either). I’m still at the trial and error stage of figuring out which call and where, but I know I’ll get there. It’s just mastering new syntax and understanding where I’m calling from and what [variables](https://gohugo.io/templates/variables/) are available to me.
That’s really okay. It took me years to visualize the interrelations with WordPress themes and functions and plugins, and even then sometimes I’ll output an array in ugly, unformatted ways just to read through and make sure I understand what I’ve got at my disposal. This is normal for most of us.
And it was fairly clear that if I wanted a shortcode to call the data file and not a list of Section pages, there was code for that: `$.Page.Site.Data.filmography` (back to Filmography again). And that worked fine. Right up until I wanted to say “For all values where X equals Foo…” and I was back to my loop-headache.
Now. GoLang *does* have a for loop!
And I though that I could just use that. Nope! So I asked myself why did `{{ for i in (1..Params.rating) }}` fail?
First of all, that ‘in’ should be `:=` instead. But even so, when I ran it I got “ERROR: function “for” not defined.” That means there is no `for` function. And no loop. After looking at how I was iterating in other places, I did this:
> ERROR: 2015/12/12 template: theme/partials/rating.html:3:26: executing “theme/partials/rating.html” at <.Params.rating>: range can’t iterate over 3 in theme/partials/rating.html
The 3, in that case, had to do with a rating of 3. This makes a little sense, since you’re *supposed* to use range to iterate over a map, array or slice. A number is none of those.
Thankfully I found a ticket talking about [adding a loop function to Hugo](https://github.com/spf13/hugo/issues/552) that was addressing what I was trying to do and finally I had an answer:
The idea there is that `seq` makes a sequence of the value of `.Params.rating` for me. If the value is 3, I get an array of `[1,2,3]` to work with. And that’s something `range` can itterate over!
Except…
> at ``: error calling sub: Can’t apply the operator to the values in theme/partials/rating.html
Now the amusing thing here is that the code worked! Even if it wasn’t seeing `.Params.rating` as an integer, it did the math. I suspect it’s related to [this old bug](https://github.com/spf13/hugo/issues/551), where variables from front matter are strings and not integers. Except that he said it worked in YAML and that’s what I’m using.
This was the most perplexing issue. How is a number not a number if it’s being numbered? And then I noticed that I was able to make a sequence, so clearly at that point it knew it was a number. And then I did this:
And yes it works.
I’m basically saying “Hey, how many ones are in the number X?” and saving that as a number. There’s no real reason I can comprehend why it failed to work, but there it is. I’ll file a bug as soon as I can figure out how to explain that in a way that doesn’t make me sound crazy.
How did all this teach me about JSON? You’ll have to wait a few days.
**Categories:** How To
**Tags:** coding, hugo, shortcode
---
### [Mailbag: Wasting Time](https://halfelf.org/2015/mailbag-wasting-time/)
**Published:** December 18, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Everything comes back to WordPress.
**Content:**
Today’s question comes from a Slack DM tossed my way about learning and possibly discarding Jekyll.
> Don’t you think you’re wasting your time learning all these nonWordPress things?
Nope! Every single thing I’ve learned and discarded has improved my skill set.
Let’s take MediaWiki. Learning that taught me templating in a way that I never would have understood in WordPress. It also taught me about the perils of your ‘own’ language instead of HTML. While I’ve come to like Markdown, you still have to know HTML to make Markdown really work, because you need to understand what it is you’re writing.
And Jekyll? I learned a lot about importing and exporting data between ‘languages’ that don’t like each other. I also learned a lot about deployment of static content. Anything but FTP, right? Jekyll had me writing my own deployment scripts.
Now that I’m looking at Hugo, really not much has changed. I’ve learned [GoLang](https://golang.org/), which is not all that different from things I already knew. But it’s expanding how I think about the logic structures. Hugo’s got an up on Jekyll in a lot of ways, like how easy it is to make loops for traditional blogs. Also it can handle remote JSON a little better, which sets me up for what’s next.
You see, *all* of this work, all this learning, is going to come back to WordPress.
What I want to do is manage my site in WordPress and have that output the JSON (via that [awesome new JSON API I’ve been learning](https://halfelf.org/2015/beginning-understand-json/)), which will in turn be *dynamically* called when I want to build my static HTML site.
For sites you’re not updating daily, or even weekly, this might be the magic you need. Everyone writes on WordPress. Someone has a command (or even a script) to run that collects everything from JSON and dumps it to Hugo, which generates the site for you to proof and then push.
Version controlling the content.
Let the users write in Wordpress while you bask in the glory of your static site that is, pretty much, unhackable as a CMS. I mean… what are you going to do to my HTML?
See?
It’s all WordPress.
**Categories:** How It Is
**Tags:** hugo, learning, mailbag, wordpress
---
### [Deploying with Hugo](https://halfelf.org/2015/deploying-hugo/)
**Published:** December 16, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Deploying on Hugo is a lot easier since it runs on my server too.
**Content:**
One of my headaches with Jeykll was the deployment. It wasn’t until I found Octopress that I had any success. Hugo wants you to use Wrecker for automated deployment. I don’t want to since I don’t host on GitHub.
## Deploying (v1)
The first method I could use is a script like I have with Octopress, which runs an rsync, but instead I went with a git post-update hook:
```
GIT_REPO=$HOME/repositories/my-repo.git
TMP_GIT_CLONE=$HOME/tmp/my-repo
PUBLIC_WWW=$HOME/public_html/
git clone $GIT_REPO $TMP_GIT_CLONE
rm -rf $PUBLIC_WWW/*
cp -r $TMP_GIT_CLONE/public/* $PUBLIC_WWW
rm -Rf $TMP_GIT_CLONE
exit
```
And that copies things over nice and fast. I could do this for Jekyll as well, since now I’m version controlling my site content (in public) as well as my source code. There are downsides to this. I don’t want to sync my site folder. It’s going to get very large and messy and annoying.
The workaround for Jekyll people is to install on the server and that didn’t work for me.
## Install on the Server
But Wait! There’s More!
I actually like Hugo better than Jekyll,. It feels slicker and faster and more … app like. Also since it’s not Ruby, I was able to install it properly on my server. Yes, unlike Ruby which was a crime, GoLang was incredibly easy to install on CentOS 6.
First install Go and it’s dependancies:
```
$ yum install golang
$ yum install hg
```
Now install Hugo. No you can’t yum it up:
```
$ export GOPATH=/usr/local/go
$ go get -v github.com/spf13/hugo
```
This puts it in /usr/local/go/bin/hugo and I can run Hugo commands natively.
Which brings me to …
## Deployment (v2)
Change the aforementioned script to this:
```
GIT_REPO=$HOME/repositories/my-repo.git
TMP_GIT_CLONE=$HOME/tmp/my-repo
PUBLIC_WWW=$HOME/public_html/
git clone $GIT_REPO $TMP_GIT_CLONE
/usr/local/go/bin/hugo -s $TMP_GIT_CLONE -d $PUBLIC_WWW
rm -Rf $TMP_GIT_CLONE
exit
```
Works perfectly. Unlike Ruby which is just a brat.
## Now the Magic
When I’m ready to write a new post, I can locally spin up my hugo site with `hugo server`, write my post, make sure it looks nice, and then commit my changes to git and push.
```
cd ~/Development/my-repos/hugo-site/
hugo new content/some-file.md
vi content/some-file.md
git add content/some-file.md
git commit -m "revised some-file"
git push deploy master
```
And it all works.
Massive hattip to [Andrew Codispiti](http://www.andrewcodispoti.com/deploy-process/) for detailing his work which made mine easier.
**Categories:** How To
**Tags:** deployment, hugo
---
### [Consenting to Collection](https://halfelf.org/2015/consenting-collection/)
**Published:** December 23, 2015
**Author:** Ipstenu (Mika Epstein)
**Content:**
Collecting information on users is something every program wants to do. Doing it is easier said than done.
When you build a product, you want people to use it. Obviously. But more than that, you want to know *how* they’re using it so you can know how to make it better for everyone. In order to get that information, you need to monitor and track your users.
I hate that.
So do most users, actually.
In the world of social media, with photos flying left, right, and center about what we’re doing and where we’re going and what we’re eating, controlling that data can make someone a king. At least, if they know how to use it.
The issue with data collection is consent.
If you have a WordPress plugin, you’re not allowed to track users without their consent. You must let them opt in. But that’s the easy part. The hard part is getting the users to *understand* what they just agreed to.
No one reads EULAs. We all see that license agreement when we upgrade our phones, we scroll down, and we click okay. We don’t read. While, arguably, we should, the issue is not just that we don’t read but that we’re getting too much information, and none of it really is what we needed to know.
With WordPress plugins (and you can easily reach to Drupal extensions with this), we have a unique opportunity to educate our users.
“Allow tracking. By checking this box, data will be sent to the service X in order for me to learn about usage and develop improvements.”
Simple and direct. I would even add in a link to Service X, or better yet to a page that explains exactly what is tracked. When you do this, you will be educating the user as to exactly what ‘tracking’ means.
Past the consent is the world of *how* to do the collection.
## Size Bloat
I have a big beef with plugins that use frameworks because a high number of developers do this and make their plugins hundreds of times larger. I see, regularly, a one-page plugin where someone uses a framework instead of learning the settings API. And that’s the first issue. These frameworks for tracking are big. They can be megs of files that add more bloat to a plugin.
There’s a new tool out there to help developers track the usage of plugins. If you add that to your plugin, it’s *your job* to make sure it doesn’t violate any terms of use. If you add it in later, consider what this will do to people upgrading. Will people who use small, shared, hosts run out of memory upgrading your plugin because it’s now 10 megs?
## Sinking Speeds
There’s another massive issue, which is the speed of the site. The more trackers you add into a site, the slower it gets. This is pretty basic logic and you’ve probably seen it from Google Sitespeed. “Your site is connecting to too many other servers.” The more sites a domain has to hit to load, the slower it is. Period.
Services have to hold up, too. If someone crashes the service because they get featured on Post Status or Reddit, then that is a part of your responsibility as a plugin developer. You’ve added in a feature. It now is broken. What happens to your users? Did you break their sites? What if they can’t reach the host because it’s blocked in China?
## Full Disclosure
We’re back to this for a reason. I had a whole post about it, from the developer perspective in being upfront of who is doing the tracking in a service. But that was really about informing the person who installed the plugin. Now I want to address the visitors. When you’re tracking the usage of your plugin, you have to be clear as to what you’re tracking and specificlly who you’re tracking.
If you’re tracking visitors to the site, you have to make sure the person running the site knows, so *they* can make sure their visitors know. That’s their job. Yours is to educate in a clear and direct way.
## Be Honest
This is really your golden rule. Be honest and up front with what you’re tracking, why you’re tracking it, what you do with the data, and protect yourself. You’ll need the legalese yes, but you should make those things human readable too.
People want to know who has their data.
Make it easy to know.
**Categories:** How It Is
**Tags:** development, essay
---
### [Disclosure](https://halfelf.org/2015/disclosure/)
**Published:** December 21, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Fully explaining what it is your product does is an absolute must.
**Content:**
One of the myriad reasons I push back on WordPress plugins is because someone didn’t disclose enough information about ‘phoning home.’ Phoning Home is simple concept that comes down to this “Don’t send data from the plugin users back to yourself (or anyone else), *unless* you’re a service. And if you are a service, make this clear in the readme.”
Simple, right? It’s totally easy to understand that we want you to tell people “Hey, if you use this plugin, it will report back to my servers…” Much of the time, this is obvious. A Facebook connection plugin, logically, contacts Facebook. Embedding YouTube playlists contacts YouTube. Those sorts of things we don’t worry about, though if you have your plugin say “This will pull data from YouTube” then it’s better. Sometimes this is less obvious, like if you use geoplugin.net to determine locations. Your plugin probably has nothing to do with that domain, but you still have to tell people about it so they know.
But why do they need to know?
First of all, this is the basic email I’ll send you if I see you’re not explaining the phone-home in your plugin:
> Plugins that send data to other servers, call js from other servers, and/or require passwords and APIs to function are required to have a full and complete Readme so we can make sure you’re providing the users with all the information they need before they install your plugin. Our goal with this is to make sure everyone knows what they’re installing and what they need to do before they install it. No surprises.
>
> This is especially important if your plugin is making calls back to your own servers. For the most part, we do not permit offloading of images or code, however in the case where you are providing a service (like Disqus or Akismet or Twitter), we permit it. The catch is you have to actually explain this to the layman in your read me, so they know where data is going.
Clearly there are some basic reasons, like we should know where our data is going for our own safety. There are also some surprising reasons to people who don’t think about these things, like legal ones. You’re calling out to other servers? What if my company legally can’t do business with them? Then we have the tin-foil hat reasons, like I don’t want to do business with Google so I don’t want to have Google JS in my plugin.
All that sounds pretty basic. And some of it is super obvious. If you’re making an app to communicate with Facebook, then it’s logically going to send data to Facebook. None of that surprises anyone, nor should it. With a service, one simply has to be up front about what the product does, what services it connects to, and why.
“This plugin pushes your comments from your Facebook page to your blog, matching users by email addresses with their Facebook accounts (if found).”
I just made that up. But it’s upfront, it’s honest, it’s direct, and it’s clear what’s being sent and where and why.
There’s another aspect to this, however, something that is far trickier and more complex. What happens when your existing tool adds a service?
The obvious answer is that you need to disclose this change to our users. As long as the users know what they’re getting into, then you are golden. The complex answer, the one I can’t really tell you a one perfect answer for, is *how* you might do this.
Why is this hard? It’s hard because there is no one right way to tell users about the change. There is no one perfect way to make sure users read the information. There is no one way to get all the data to all the people who need to know about the information.
And there sure as hell isn’t one way to make sure no one will complain about any of that.
When you make a change to the paradigm of what your tool does, taking a stand alone tool and adding in a service, you have to consider that a percentage of your users will rebel. This is simply because all those wonderful things you do about disclosing the service for *new* users have to be transitioned in a meaningful and logical way to *existing* users. And there is just no way to do that perfectly.
This doesn’t mean you shouldn’t try. This means you have to be creative and innovation and a little ‘in your face’ about the change. You have to give users an option, before the service kicks in, to say if they want their data shared.
**Categories:** How It Is
**Tags:** development, documentation, wordpress
---
### [Hugo](https://halfelf.org/2015/hugo/)
**Published:** December 14, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There's no app quite like Hugo. Where ever you go, I go. So Bye, bye, birdie!
**Content:**
I’ve been playing with Jekyll a lot. After WordCamp US, I started toying with the idea of a JSON powered Jekyll site, where WordPress output its posts as JSON and Jekyll pulled in the posts and converted them. This ran into many snags. It wouldn’t be ‘dynamic’ for one, but the biggest issue is that Jekyll’s JSON reading ability was terrible. It didn’t like the complex JSON that WordPress put out.
That sent me hunting down other things like [Hugo](http://gohugo.io/). Unlike Jekyll and it’s use of Liquid, Hugo uses Go (hence the Go in the name you see).
Installation (on a Mac) is easy.
`brew install hugo`
Done. It’s harder on my server, but still easier than Jekyll, which started to become a ‘thing’ as I worked through all this.
Using Hugo is remarkably similar to Jekyll except that it works faster and a little more smoothly. The site builds incredibly fast and it dynamically refreshes. So if I edit a post, the page refreshes itself. This let me tweak my theme and posts and sort out the new language incredibly fast. Edit a file, boom, I see what’s wrong.
It’s about as logical as Jekyll too, so it took me one DayQuil addled afternoon to sort out how to make things work.
## The Basics
The basic are simple. You have a basic structure like this:
```
▸ archetypes/
▸ content/
▸ data/
▸ layouts/
▸ static/
▸ themes/
config.toml
```
The config file is what you think it is. Your posts go in content and the html-ized version shows up a public folder that gets created on the fly. The data folder is for your static data like a .json file or a .yaml.
Independant to your theme, you can put css and js in the static folder, and layouts in the layout folder. Ditto archetypes, which are post-types. So if you know you’re always going to have a post type of ‘musician’ and you want it to have special headers, then you can have an archetype called musician.md with all that pre-filled in. Then when you want to make a new entry for Clifford:
$ hugo new musician/clifford.md
You can also have those in your theme if you wanted, but generally I use the same theme and separate projects. At this point, I was impressed enough to be swayed from Jekyll. I’m not going to explain how to write a post, since it’s just markdown and a header, just like Jekyll or GitHub Pages.
## Building Your Site
The commands are basic. Running `$ hugo server` will build your demo server. Of course, you’ll want to post your drafts, so you need to add the param `--buildDrafts` … Oh and you want a theme …
`$ hugo server --theme=utility-pro --buildDrafts`
That’s silly, right? Why do I have to define all that? Thankfully I can edit my config.toml file:
```
baseurl = "http://example.com/videos"
languageCode = "en-us"
title = "My Super cool Video Library"
theme = "utility-pro"
buildDrafts = "true"
[params]
Subtitle = "Videos about cats, collected from the internet."
```
Now every time I run the command ‘hugo’ it will build my drafts with my theme!
```
$ hugo
45 of 45 drafts rendered
0 future content
45 pages created
42 paginator pages created
14 tags created
3 categories created
in 254 ms
```
That’s incredible fast seeing as it built everything. Of course the other site I have is a great many more pages.
## Theming
Since I’d already mastered Jekyll theming, this was trivial. Go and Liquid are weirdly similar and most of it was transposing. There’s not much to say here except that there’s a [Twenty Fourteen Theme](http://themes.gohugo.io/twentyfourteen/) for Hugo and it’s pretty much what you expect. For WordPressers, it’s a good place to start.
## Shortcodes
The neat thing is that Hugo has shortcodes! They’re not like WordPress ones, but you can see the similarity between WordPress and Hugo.
```
[video mp4="video.mp4" flv="video.flv"]
```
vs.
```
{{< video mp4="video.mp4" flv="video.flv" >}}
```
Sadly there’s no oEmbed. And I had to write the shortcode on my own, but again, if you know the basics of logic all this stuff is easy. Here’s the magic behind the shortcode:
Once you look at it, it’s remarkably like WordPress. Only I don’t need a plugin. Everything in `/layouts/shortcodes/` are like `mu-plugins`.
## And So?
And so Hugo won enough of my attention that I’m going to keep playing with it and see what’s next.
**Categories:** How It Works
**Tags:** golang, hugo, jekyll, static site
---
### [Mailbag: Why did you ask that at the Town Hall?](https://halfelf.org/2015/mailbag-ask-town-hall/)
**Published:** December 11, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I ask the tough questions sometimes, and I accept answers I don't fully agree with.
**Content:**
Last weekend, at WordCamp US, I asked a question at the town hall.
At its heart, the question was that did Matt feel the rapid release cycle of WordPress major revisions was too fast? I asked this based on the concerns I hear voiced by plugin developers, generally the smaller shops (single person or under ten teams), who not only have to test their plugins with the new versions of WordPress, but also learn these new, rapidly evolving and changing, libraries like ReactJS and the REST API.
Matt’s answer was essentially no, and that he felt that things would only get faster. Also he said he didn’t think plugins should be one-person shops.
> What did you think of the answer?
I was asked variants of this by many people that night and the next day.
I disagree with Matt somewhat.
This isn’t a shock. I’m sure he’ll read this and nod. But he and I both know that a health disagreement can be good for an ecosystem. I understand his point, and in many ways agree with it. A team project for plugins and really any development is what makes things improve faster. Two heads are better than one.
But at the same time, we look back on things like Yoast SEO, and to think that those can only exist while supported by a team is to forget the way that all of this, even WordPress, started.
One person has an idea. One person shares the idea. A second person makes a suggestion.
One person.
Of the 45,000 plugins in the repository, the majority happened because of one person. One person had an idea and a dream and built a plugin. One person learned a thing and shared it. One. And the harder we make it for that one person to grow, the harder it will be for them to become the next Yoast, or Woo, or Jetpack.
As of this post, we released four major releases of WordPress within 355 days. I think that speed for the sake of speed is as bad as dragging out feet and having one release a year. Yes, we have *improved* our stability by having more frequent releases, because we don’t rush to have an unready feature added to a release. There’s going to be another soon. And that’s a good thing.
At the same time, it’s pushed us to release faster and faster, and that causes the bar to be set too high to new people. It causes burnt out. It causes update fatigue.
I don’t think we should revert to ‘release when it’s ready’ again. That has as many problems (if not more) as ‘release X times per year.’ I do feel we need to consider the emotional health and the supportability of what we are releasing.
Do it well, do it fast, do it cheap. Pick two. And know that the price is from our blood and bone.
I think we should turn it down a notch. Just one notch. And we should stop releasing just to be sure we release a number of times a year.
**Categories:** How It Is
**Tags:** mailbag, town hall, wordpress
---
### [Beginning to Understand JSON](https://halfelf.org/2015/beginning-understand-json/)
**Published:** December 9, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Starting to understand all the fuss about the JSON API.
**Content:**
Themes without php …
Dynamic content without page requests …
What about Multisite without Multisite?
These are all things I’ve heard when people talk about the JSON REST API and how it’s the next greatest thing in WordPress. Well great, but what *is* it?
REST stands for representational state transfer. It’s actually the juice that’s been powering the web since forever. RESTful systems generally run over HTTP (hypertext transfer protocol) and use the agreed upon language to get and put data. REST gives you a way to read and write data programmatically. You’ve been using it for years without even realizing it.
This means our question isn’t what is it, but why do we want it or care about it?
The WordPress REST API is a nice way to get at the data from WordPress without having to load all the heavy parts of WordPress. It’s useful for things like mobile apps, which don’t need to load everything, just the data, and it’s faster.
Now, yes, WordPress has an API, called XML-RPC, and it sucks. You’ve used it already if you use the iOS app. We also have APIs like RSS, but that’s pretty much read only. The reasons that the current implementation of XML-RPC sucks are myriad, but basically it’s due to security, abuse, sanitization, and weight. It’s powerful but expensive and risky.
The JSON API being added to WordPress aims to simplify and secure all that.
> Want to get your site’s posts? Simply send a GET request to url.com/wp-json/posts. Update user with ID 4? Send a POST request to url.com/wp-json/users/4. Get all posts with the search term “awesome”? GET url.com/wp-json/posts?filter\[s\]=awesome. It’s that easy.
The [WP API](http://v2.wp-api.org) is very simply the interface to make it easier to get at your data. That’s it. How it does it is incredibly complicated. What it does is simple.
Make it easier to get at my data without loading WordPress itself.
What I dig the most about it is this idea.
Take a website running [backbone js](http://backbonejs.org) that calls the JSON API from your WordPress site. Say frontend.com and backend.com are your URLs. You blog on backend.com and use WordPress normally. Your readers will visit a non WordPress site on frontend.com….
Go on then. Hack the front end.
It’s not WordPress, so unless you introduce an endpoint that puts you at risk, you have a way to protect your content. Plus now you can upgrade your blog all you want without having to worry really about taking your blog down.
Obviously this isn’t perfect. By not using WordPress on the front end you won’t have access to a lot of features from plugins. Like related posts. [And then again, maybe you can use related posts](https://wordpress.org/plugins/wp-simple-related-posts/). [Maybe you can even us Jetpack’s related posts](https://developer.wordpress.com/docs/api/1.1/post/sites/$site/posts/$post/related/).
Mind? Blown.
If everything WordPress can do the JSON API can do, then there’s nothing I can’t do. I can make any site where I run WordPress on the backend and anything I want on the front end. And now I can separate my site data, run by WordPress, and my theme and it’s options. I can dry run theme changes and layouts using my live data. I can tell the JSON API frontend.com site to ignore all posts with a special status, tell testend.com to use them, and draft posts.
Migrations become easier. Who cares where the backend is, as long as the API frontend.com page can call what it calls.
WordPress is becoming more and more of an application, and that is why we can all be excite about being at REST.
**Categories:** How It Works
**Tags:** development, json, rest api, wordpress
---
### [Calypso](https://halfelf.org/2015/calypso/)
**Published:** December 7, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's just an app to the left, and then a blog to the right as we get used to the new world order of WordPress on the desktop.
**Content:**
You’ve heard about it. Calypso, the WordPress desktop editor for Macs. I’ve been using it and I’m going to give you a quick rundown on what I like and what I don’t.
## Like
First of all, it’s Open Source, which is great to look at. Anyone can poke at it and play with it. It’s also a nice GUI to use. Markdown works out of the box if you have it set up in Jetpack. That’s awesome since I’ve gotten very used to using it thanks to Jekyll.
It’s very fast as well, which is great. Fast is good. It also saves rather quickly, even when I’m on some shitty wifi. It’s much faster than using the native WordPress editor.
There have been some bumps in the road, but the development is open to comments and suggestions and steering. Some of the decsions made make sense from every angle except the end users. Users use things in weird ways and, once explained, development seems willing and able to adjust.
## Dislike
There’s no spell check. This makes me very sad (I’ve been told it’s a feature request). Clicking back and forth between my sites is a little annoying, and I can’t easily hide sites (or reorder them). There aren’t tabs either, which means I can’t write on three or four posts at once. Yes, I totally do that.
You can’t do Custom Post Types. Yet. This is a deal breaker for one of my sites. Basically I can’t manage my WordPress eCommerce store with this. You also can’t change color schemes. I somewhat wish that it would pick up my user settings and use the profile color from MP6 that I selected there. That way I’d have purple for some posts, green for others, and I’d always easily know where I was.
## On the Fence
I don’t really like that it forces me to use Jetpack, but at the same time, the REST API isn’t in core yet, so this makes sense. Similarly, I don’t like that it’s Mac only, but I understand why. Unlike ‘traditional’ software development, the people on the WordPress.com project are primarily Mac users. Of course they went to Mac first. Since it’s open source, I’m hoping someone figures out how to Windows it up soon. Making it Unixy shouldn’t be too hard, since Mac is running Unix.
Back to Jetpack, I would love to see this forked and decoupled from Jetpack, using the REST API instead. Not because I hate Jetpack (quite the opposite) but because I’d like to set my father up with this, and he travels to China where WordPress.com (and Jetpack) are problematic thanks to the Great Firewall.
## All in All, I Like It
So far, so good. I like Calpyso and it’s no great effort to remember to use it, unlike pretty much every other desktop app for WordPress. And yes, I’ve tried those.
**Categories:** How It Is
**Tags:** app, desktop, essay, wordpress
---
### [It's Okay To Overwhelm](https://halfelf.org/2015/overwhelming/)
**Published:** December 2, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When we're overwhelmed we may make mistakes, but we'll learn a lot too.
**Content:**
“Your email overwhelmed me! I can’t do this!”
That’s what the email reply I got was. It had started innocently enough. Someone asked how to set up Multisite. I linked them to the article and sent them a free copy of my ebook [WordPress Multisite 101](http://store.halfelf.org/ebooks/wordpress-multisite-101/).
He emailed back asking again how to to it and I replied that he needed to read the link and the ebook and, if he had a specific question, to ask, but otherwise, those two items were what I could do for him at the time. He wasn’t a customer, a client, or even a friend. He was barely a friend of a friend of a friend. There was no social contract or legal one. He was basically someone who asked a question.
Seven emails later and a very angry chain, he finally explained that he had **already** activated Multisite, before the initial emails, and it was broken. He could no longer log in and, damn it, he didn’t actually WANT multisite. So I explained he needed to un-do Multisite, showed him where (in the ebook, and via a link) he could get directions on that.
And that overwhelmed him.
Now at this point, my friend who introduced him to me apologized and said he’d explain to the guy what ‘taking advantage of someone’s kindness’ meant.
While I do feel sad that I overwhelmed someone and that he was in over his head, I don’t feel any guilt for not providing hands on help like that. There’s a limit to how much ‘freebie’ you can throw out into the world, and this fellow was not being very clear about what his actual situation was. If it had started with “I accidentally set up Multisite. How do I undo it?” I would have given him a quick set of directions with a note of “If editing the DB is too complicated for you, you’ll need to hire someone.”
*There is no shame in hiring someone when you’re overwhelmed.*
When you’re in over your head, you will make bad assumptions, get lost, and make expensive mistakes. If you think someone is expensive before you start your own demolition and plumbing, imagine how much the cost will be when they have to fix what you did to yourself? Websites are pretty much the same way. It’s the nature of the service industry really. You’re trying to perform a service on your own instead of paying an expert. If you get it right, awesome, you’ve learned new things and have a new skill! If not, you pay more.
But that’s actually why I think it’s okay to overwhelm someone sometimes. When you give them a large amount of data, if they’re willing to learn and concentrate, then they can learn not only about a process but about themselves. The issue isn’t the data dump but how we react to it.
When you’re overwhelmed, and believe me I’ve been there too, you have to take the elephant one bite at a time. You didn’t know how to drive a car perfectly the first time you sat in one. You couldn’t ride a bike from day one. You won’t be able to do *anything* 100% correctly out of the gate unless you’re a savant. Most of us aren’t.
Perfection is the enemy of progress, though. If we all wait until we’re perfect, we’ll never get anywhere.
It’s alright to be overwhelmed. It’s not alright (though certainly understandable) to let that prevent you from making progress.
Be overwhelmed. At if, in that moment, you learn one thing, then you’ve made progress.
**Categories:** How It Is
**Tags:** essay, learning
---
### [I Am The 20%, And So Are You](https://halfelf.org/2015/i-am-20/)
**Published:** November 23, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I have always and will always fight for the users. Even when they outnumber me. I am the 20%.
**Content:**
We speak of innovation in WordPress. We present new features like post embeds and emojii, things not everyone wants to use on their sites, things that slow down sites, and we tout how we are making things better.
But do we consider all the users when we do this?
One of the tenets of WordPress, one of the core philosophies, is that we make decisions, not options. And we base these decisions on the 80% rule. We say if a feature will not be used by 80% of the user base of WordPress, we won’t add it.
In early November, WordPress reached the 25% saturation threshold. We have, generally, taken that to mean that WordPress powers 25% of the Internet. A more accurate statement [by W3Techs](http://w3techs.com/technologies/details/cm-wordpress/all/all) is this:
> WordPress is used by 58.7% of all the websites whose content management system we know. This is 25.0% of all websites.
That means sites like my library (which is using Jekyll) or a site built by hand because it’s 5 pages are still considered. Jekyll and Github pages might skew the spectrum, but I’m going to give them the benefit of the doubt, that they know how to adjust for that. [The statistics are really quite impressive](http://w3techs.com/blog/entry/wordpress-powers-25-percent-of-all-websites).
But with that volume of users comes a great responsibility.
952,795,650 websites and counting. If we take away the 75% that are parked domains and redirects, we have 238,198,912 websites. Let’s call it 240,000,000. Of those, 25% are WordPress. 60,000,000 websites on WordPress. 48,000,000 users is 80% of that. Realistically, since we all have multiple websites, I’ll say 45,000,000 individuals.
We are now trying to build websites and predict the behavior of 45,000,000 users.
And you know what? I’m *not* excited about it. I was a little excited when we hit 16% but when we hit 18% and then 20%, I started to be filled with dread. The numbers of who uses WordPress are skyrocketing, and while I should fear the edge of the cliff, the day the inevitable WordPress killer steps out of the shadow and destroys us (by the way… that totally happened to Windows and Mac, didn’t it? They’ve been top dogs for even longer…), I worry that we’re now crossing a different line.
When we start to propose things like embedding posts, or speeding up WordPress by shunting legacy code to a plugin, or dropping support for shortcodes, I fear we’re about to walk off the cliff ourselves.
Let me paint you a picture of our world.
We have spent a decade (close to 11 years) teaching people to use plugins. We explain that the exhaustive feature set of WordPress is best served by plugins. We have created a moderated, but not curated, repository of themes and plugins. We allow multiple plugins for innovation, for solving problems in new ways, and for demonstrating the myriad ways which one can use WordPress. Similarly we have taught them that themes are the right way to design and style a site, and themes can also be at the forefront of these innovations.
That said, we have not yet managed to teach people *how* to pick a plugin or theme. They think it’s on WordPress.org, it must be safe. In general, the majority of themes and plugins on the WordPress.org repository are better written than their premium counterpart. Please note: majority – the minority of stunningly well written themes and plugins are not to be discounted, but let’s be real folks, they’re the minority. At the same time, the majority of plugins on the repository are crap.
So let’s recap. If you take all the plugins in the world and round them up, more of the best ones will be on the WordPress.org free repository, but so will more of the bad ones. Following me still? Okay.
Now end users, the majority of our 45,000,000 users, do not know how to pick a good plugin from a bad one. They don’t know how to read, or even skim the code to find out if it’s secure or not. They rely on maybe a quick search for reported issues, if that. They look, they find, they use. Of course they do. We told them to. We linked them to these plugins and said proudly we had found their solutions.
On top of that, we’ve failed to teach them the importance of upgrades. WordPress core handles security updates, but since plugin and theme developers aren’t all as tenacious and consistent about their updates as WordPress core, we cannot always push updates of themes and plugins. WordPress is reliable. Not everyone else is. Not every one of the 50,000 plugins in the repository can possibly be.
This means we don’t have the ability to just update everyone’s site with themes and plugins right away. We just don’t. There are some plugins and themes that will break when we do, or cause each other to break. Worse, there are some plugins and themes that don’t offer updates. Which means we have created a world where people don’t know they need to upgrade to be safe, or that they have to upgrade if they plan on using WordPress 4.6.
And oh yes, we’ve taught them the importance of upgrading WordPress core very well. We’ve cajoled webhosts into upgrading WordPress core for them. We certainly upgrade WordPress core. That’s why over 80% of sites on WordPress are on the 4.x branch. We did our job well, but not fully.
So when you talk about removing features from shortcodes, or dropping support for PHP 5.2, I think that the people who would be hurt by this would be the people least able to understand why.
These people use plugins and themes and don’t know that Johnny Dev used old code. And if Johnny doesn’t update his code in time to meet the changes to the shortcode API, or there’s a bug that makes it not work in PHP 5.4, the user gets hurt.
And when the user is hurt, they don’t blame Johnny Dev. They blame WordPress.
They blame WordPress because we told them to install plugins and use themes. And they trust us. And in that one move, we have betrayed the trust.
That’s the cliff I see us rapidly approaching. And that is the cliff I fear more than anything else. Our idealism and hope may drive us off the edge before we realize it.
We developers, we builders of WordPress, are the 20%.
**Categories:** How It Is
**Tags:** essay, wordpress
---
### [Rant: Lightboxes and Scrolling](https://halfelf.org/2015/lightboxes-scrolling/)
**Published:** November 27, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Size matters when your box is too big for my screen.
**Content:**
Lately I’ve run into a problem where a tool I’m using has a lightbox that’s cut off at the bottom of the screen.
This generally happens because I have my browser at half-height, or because I’ve pressed the ‘increase font’ keys to make a site 110% text for readability (WordPress P2, I’m looking at you). Here’s what life can look like for me:
This image shows a lightbox cut off midway. The bottom of the picture shows the bottom edge of my browser. Obviously I could make my browser window larger, and most of the time this is what I do. But should I have to? There are situations where I can’t do that, like on mobile. Whomever decided that overlays on mobile was a good idea needs to have their favorite sweaters eaten by moths.
Make your screen scrollable. Make sure your lightbox doesn’t get totally jacked up when a screen is ‘too small.’ A major part of responsive design is not just making sure your site works on mobile devices and ‘full blown’ computers, but that it works on all sizes of monitors when a browser isn’t maxed out.
Here’s another example:
In that image I have what I can only presume is an advertisment that wants me to click something. It’s not until I change my zoom to 75% that I can see this is an ad for Dropbox Business:
Oh and Dropbox was totally unhelpful when I reported these things, which is why they’re getting shamed. They said to fix my screensize.
When a similar issue happened with Slack, I got an apology and a promise to address it. Which they did within a week.
**Categories:** How It Is
**Tags:** design, dropbox, rant
---
### [Mailbag: Why Won't You Help Me From Myself?](https://halfelf.org/2015/mailbag-help-me-from-myself/)
**Published:** November 20, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes when you build a better mousetrap, you only catch yourself.
**Content:**
I won’t name names here but I suspect people know who I’m talking about it. Please note, any comments naming names will be deleted. They deserve a chance to redeem their name and exactly *who* they are is not the issue.
> We never received any advice when we asked. Only warnings.
A company made a new plugin, released it on WordPress.org, and then emailed a lot of people about it.
It was brought to my attention first as a potential plugin violation. Was someone culling emails of the plugin install and using that to send email? A quick check of the code showed that was not the case and I informed the reporters as such.
But then people said “I don’t even use this plugin and I got emailed.”
At this point, I dropped them a note and explained that sending out spam email like that was going to piss people off. Lo and behold, their plugin was filled with one-star reviews.
In the end, the asked the plugin to be deleted because they felt they could never recover. And I had not helped them, only warned them. This was true. I had not offered to help them make peace. I’d told them what was about to happen. And it did.
Why didn’t I help them? Simply, I’m not their marketing department.
As I said. Who they are doesn’t matter. They aren’t the first person to have this problem and they won’t be the last. And the question they’re really asking is two fold.
First, why won’t I delete bad reviews based on people not liking getting spam. Second, why won’t I fix the problem.
For the first, it’s because the experience of your plugin begins with how someone is introduced to it. If the first experience I have with a product is a racist or sexist ad, I will not use it. If it’s a product I was considering using, I might leave a comment or review saying “I would have used this but…” That was my experience. It doesn’t matter than I never used the product if my experience with it beforehand was strong enough to inspire me to leave a review.
For the second, I can’t fix your problem. You did this to yourself. You had a poorly conceived of ad campaign and it shot you in the foot. You aren’t the first person to have this problem and you won’t be the last. You’re just someone else who screwed up and was hit by the social monster.
And you know what? It sucks, and it’s not fair, but it’s something you did to yourself. Yes, you did it by accident, but covering it up doesn’t make it go away.
We all screw up. We all have to apologize. If it was me? I’d reply to every single one star review and tell them I was sorry, it was a bad idea, I won’t do it again. And then I’d donate money in WordPress’ name to the EFF, explaining that while I can’t compensate them for the plugin without it approaching bribery, I can endorse the protection of our online privacy, which I flagrantly disrespected.
It won’t be perfect, but it gets you started.
**Categories:** How It Is
**Tags:** mailbag, wordpress
---
### [Say Thank You Publicly and Be a Better Coder](https://halfelf.org/2015/thank-you-better-code/)
**Published:** November 30, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When I was at WordCamp Tokyo, I was reminded of the power of a thank you and how it makes Open Source better.
**Content:**
Takayuki Miyoshi is one of the best developers for WordPress you probably don’t know about. Miyoshi-san is quiet, thoughtful, and had written a handful of plugins you probably do know. Like [Contact Form 7](https://wordpress.org/plugins/contact-form-7/). He’s also written a wonderful multilanguage plugin called [Bogo](https://wordpress.org/plugins/bogo/).
He gave his very first presentation in English about [why he uses free plugins](https://ideasilo.wordpress.com/2015/11/02/why-we-should-choose-free-plugins/). Miyoshi-san’s reasoning is plain and simple. By giving back to WordPress and open-sourcing the code, you have a greater chance of people helping you make your code better. More people will find bugs, more people will help you fix, more people will use it, and things will be made better for everyone.
This is much the same idea as Pippin Williamson has about his open source philosophy. Now Pippin is pretty upfront that he thinks [you should open source your plugins](https://pippinsplugins.com/should-you-open-source-your-plugins/). And he’s got some strong views on [supporting your site projects](https://pippinsplugins.com/an-open-letter-on-side-projects/) (and the responsibility there in). But he also mentioned once that he supports putting premium (i.e. paywall’d) products on Github.
For free.
That’s right. He said you can totally put your code up on Github for anyone to download or edit or fork.
I thought about it for a moment, and how open and honest Pippin has always been with his code, and how some of his early WordPress code was not the greatest. Yes, I have been around WordPress long enough that some of the people I think of as being ‘The Real Shit’ about coding for WP were pretty bad. Maybe not as bad as I was when I started, maybe they were. My point is that Pippin, like everyone else, started out as a beginner. And some of his beginner code was bad, like everyone else’s.
Would Pippin be as good a programmer as he is today without open source and without people giving him code corrections and suggestions?
I think not.
Furthermore, I don’t think that you’re going to lose any money here. The intersection of people who would both buy your plugin and are technically capable of using Github to install plugins is pretty small. I say this as someone who understands well the desire of people to get things ‘free’ from the internet and the seriousness of customers. If you make it easy for someone to buy your products (and in the case of WordPress, get updates for it), people *will* pay you. Because they like convenience. Remember the tale of [Oatmeal vs HBO](http://theoatmeal.com/comics/game_of_thrones). If you stop people from being able to get your product easily, they just won’t.
Most people are afraid of monetary loss, which I get. But you have to rethink things. First of all, *most* people won’t use Github. They won’t like not getting security updates, for one. And if you present Github as a technical place, they won’t use it. Done. Secondly, I happily bought the *Person of Interest* DVDs once Netflix got punched by (I presume) WGN on re-broadcast rights and couldn’t show me Season 4 before Season 5 airs. I get the added bonus of watching it on my Blu-Ray player, in super ultra HD. This behavior is **NORMAL**. Amazon made it *easy* for me to get what I wanted, and now I own it and if the Internet is out, well I’ll watch Root and Shaw and the Machine all day.
And there’s something else to consider. The people who would use Github to get something for free are the folks who wouldn’t have paid in the first place. You’re losing money that you’d never have. To help explain this, I’ve made a little Venn Diagram for you, to show you how small this intersection is:
I’m serious here. This is non-mathematical but based on my allegorical experiences of years in support be it free or paid. This is coming from someone who lives and breathes WordPress plugins. If you make it easy for them to pay, you will not lose money by putting the code up in a way for other developers to submit pull requests. That small sliver of green, the people who can use Git and would still pay you, those are your contributors. Those are the people you want. Because Open Source Code means more eyes, and more eyes means more reviews, and more reviews means better code.
Everyone wins.
And like Pippin and Miyoshi-san, I think that having your code available for others means I may learn new things and become a better developer. When I say ‘pull requests welcome’ what I mean is ‘teach me what you know, I love to learn!’ Even if I say “No, I don’t want to add that feature” trust me that your lesson was welcome and absorbed.
When I went to WordCamp Tokyo, I had the intention of seeking Miyoshi-san out to tell him how much I like Bogo. That it solved a problem for me. That it just worked. That the code was good. Miyoshi-san also wanted to tell me thank you for the things I’ve done for him.
It’s possible we both got a little teary eyed.
And he and I agree on the big things. Make your code available for others to review and comment on and get pull requests. It will make you better.
**Categories:** How It Is
**Tags:** coding, development, essay, plugins
---
### [Mapping the Apple Watch](https://halfelf.org/2015/mapping-apple-watch/)
**Published:** November 18, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using the Apple Watch to get lost and un-lost is always interesting. Unless you use Google Maps. Then it sucks.
**Content:**
While in Japan, I had the chance to use my Apple Watch to get around and I figured out something.
For walking or driving, the Apple Map app is the best to use with the Apple Watch. Not only do you get turn by turn directions with the haptic taps, but you can quickly see what’s next if you’re not sure what side of the street to be on. The haptics I love:
> A steady series of 12 taps means turn right at the intersection you’re approaching; three pairs of two taps means turn left…
I use this feature constantly. It’s brilliant to be able to walk around and enjoy the area I’m in without worrying that I’ll get too terribly lost. As I walked through Kanda, my wrist tapped “tap-tap, tap-tap, tap-tap” and I turned left like a boss. The only time I used my phone was when I was at a five-way intersection. I can even use it to walk from my father’s apartment to his mother-in-law’s house a few blocks away. Or the 7-Eleven (which are awesome in Japan).
For public transportation, the Google Maps app is brilliant. No. It’s phenomenal. Ueno station, in Tokyo, is one of the more complicated and confusing stations I’ve ever seen. It’s crowded, it has a damn shopping mall on top of it, and it’s where seventeen major train lines meet. The Google Map can, most of the time, tell me what track to be on and when for what train.
Ueno makes Penn Station look tiny.
But Google Maps can’t do ‘both.’ In fact, I’ve learned the Google Maps app is getting worse at things. You see, you go through Ueno to the Keisei Skyliner (the train to the airport) when you take the train from my dad’s apartment to Narita. It’s very simple. Takasaki line from Ageo to Ueno, exit Ueno via the South (not the Park) exit. Turn right. Pass the duck. Done.
Instead of showing you a walking route, when I asked Google Maps to get me to Narita, it drew a straight-as-the-crow-flies line from Ueno Station to Keisei Skyliner. Yeah. Not so much there, Google-San.
It only got worse when I wanted to take the train from Ageo to Kanda for WordCamp. You’d think that Google would be able to alert me, since they have an Apple Watch App, with taps “Hey, get off the train at the next stop.” But they don’t. In fact, the Apple Watch app just lists the directions, not very well, and doesn’t give me alerts. Even worse, you can’t easily track from the iPhone to the Watch. When I put in a direction on my Apple Maps, it automatically triggers the map on my Watch. Google Maps only shows ‘recent searches’ and Work and Home.
It’s an absolute fail to use the technology properly.
To make Google Maps ‘right’ for the Watch is pretty simple.
1. Direction alerts. Tell me when to turn left or right. Steal it from Apple or make your own.
2. Change train alerts. Tell me when I should get up. This will prevent people from sleeping through their stops.
3. Give me easy directions to anywhere. Let me set up a path on my phone and immediately transfer it to my Watch.
4. Use Siri. “Hey Siri, use Google Maps to get me home.”
Four things. I’d settle for the first two, though I think the first three should be a priority for user experience.
Until then, I’ll have to use my iPhone for transportation in a strange land, and my Watch for walking around the planet.
**Categories:** How It Works
**Tags:** app, apple, essay, review, watch
---
### [The Security of a Lifetime License](https://halfelf.org/2015/security-lifetime-license/)
**Published:** November 13, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** StudioPress ups and downs the value in their pro-plan, making me think about the hidden value of a lifetime license.
**Content:**
A few years ago, before I started working for DreamHost but after I decided I wanted to do WordPress all the time, I bought the [StudioPress All Themes Package](http://www.shareasale.com/r.cfm?b=242693&u=728549&m=28169&urllink=&afftrack=). For $500, it gave me a lifetime access to all their themes, all their future themes, support, and more. So I tucked away all my ad and ebook income for a while and bought it the day before a 50% deal hit. Of course, right? Brian being a wonderful guy, saw my amused tweet and credited me the difference.
Since then, I’ve pretty much been a nothing but StudioPress shop. Almost every site I run on WordPress is using StudioPress themes. I’ve gotten free upgrades for all their themes, free versions of the ‘pro’ themes (all the HTML5 friendly ones), and it’s very much been worth it to me.
But licensing is a strange subject. [Chris Lema recommends charging annually](http://chrislema.com/subscription-fees/) (instead of monthly). And while I have a lifetime subscription, the unlimited free support will be leaving this world soon. From what I’ve heard, this only impacts support. To be honest, I’ve filed less than ten support tickets in five years. And it’s not because I’m savvy. There’s very little that I need help with to use Genesis themes. They have pretty darn good directions on how to reproduce their demo sites, they have code snippets, and they have a friendly self-help forum.
Basically, this code is tight. Right now I’m using the [Generate Pro Theme](http://www.shareasale.com/r.cfm?b=353079&u=728549&m=28169&urllink=&afftrack=) on this site, but I also bought [Utility Pro theme](http://www.shareasale.com/r.cfm?b=778546&u=728549&m=61628&urllink=&afftrack=) from Carrie Dils (worth it). The child themes rarely need updating, and all I ever have to worry about is the parent Genesis theme being updated, which is easy as pie. They have their own updater.
My friend [Amanda Rush](http://www.customerservant.com/studiopress-now-includes-third-party-themes-in-its-proplus-package/) (also a StudioPress fan) wonders if this heralds the end of days of unlimited forever support and licenses. I suspect so. Will I be annoyed if I have to start paying for updates? Maybe, but mostly because I have a serious concern about security.
Let me paint a picture for you. I get a free parent theme or plugin, it could be Genesis (the StudioPress parent theme) or WooCommerce (a popular ecommerce plugin), and I purchase an ‘add on’ of a child theme or an extension plugin. I pay for a year, and I’m happy. The add-on does what I wanted, I get my updates, and everything’s cool. Then one day, 370 days later, there’s a major issue. A massive security hole and suddenly my site is vulnerable!
My license has run out.
Do I get the update or not?
Do I get notified of the update or not?
I’ve seen this play out over and over again with sites like CodeCanyon and ThemeForest. How do people who have purchased a product get alerted properly and given the ability to update? We’re spoiled because if Jetpack or WooCommerce itself has a critical hole, those plugins are *free* in the WordPress.org repository. And I know, from working on that team, that if there’s a big enough issue, then the free plugins get updated and the update is pushed out to everyone. It’s rare, but when it happens, it’s for the benefit of everyone involved.
The sad truth is most one-off shops can’t do that. WordPress.org can update *all* [branches of your plugin](https://halfelf.org/2015/update-fatigue/). If you’re properly using versions for your plugins and themes, then you can release version 2.3.1 to fix a bug, but also fix that bug on 2.2.4 and 2.1.9 and so on. And yes, WordPress can push those branches (2.3 and 2.2 and 2.1) so even people on older versions can get fixed.
To the best of my knowledge, no one else does that yet.
And, perhaps worse, some won’t even consider letting you have the security update because your license isn’t up to date.
All that said… Should you buy it, knowing you may not get support and updates forever? Yes. Right now, the [StudioPress Pro Plus All-Theme Package](http://www.shareasale.com/r.cfm?b=242693&u=728549&m=28169&urllink=&afftrack=) is on sale. $262.46 for every theme *plus* third party themes. The sale goes on until the 16th, so grab it this weekend.
It’s an investment I’ve never regretted.
**Categories:** How It Is
**Tags:** essay, security, wordpress
---
### [Octopress](https://halfelf.org/2015/octopress/)
**Published:** November 16, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding new tools to my Jekyll bag.
**Content:**
A brief history lesson. In the beginning there was Jekyll, a website generator that created static sites for you to deploy to your server. And then there was [Octopress](http://octopress.org/), a ‘framework’ for Jekyll that actually was a fork of one guy’s Jekyll site.
> Octopress is basically some guy’s Jekyll blog you can fork and modify.
That’s a direct quote from Brandon Mathis, the creator and curator of Octopress. But it wasn’t a framework like WordPress people think of Frameworks. It wasn’t like [Underscores](http://underscores.me/), which is just a theme framework. It really was more like a one-click install for Jekyll, that had someone’s theme on it.
Wisely, Mathis is working on changing this. Starting with Octopress 3 (currently 3.0.11) it’s a Jekyll add-on. While there is no ‘migration’ explanation yet, if you’ve never used Octopress, it’s a great time to start.
## How to Install
Add this line to your application’s Gemfile:
And then execute:
You can also install with bundler if you want, but it works out about the same in the end.
## How to Use
I was stuck using bundler on my personal computer. That meant to use Octopress I had to do this:
Sucks, doesn’t it? After reading [Ben Hamill’s post about ‘never typing bundle exec again’](http://garbled.benhamill.com/2013/09/03/never-type-bundle-exec-again/), it was fixed! I used the Ruby fix since it’s just me on the project.
Now I can use `octopress` as my command prefix.
## What I Dig
The deploy is [way better than my own](https://halfelf.org/2015/deploy-jekyll-without-ruby). Just put that out there.
Also there’s a [draft command](https://github.com/octopress/octopress#new-draft)!
That will make the file `/_legal/terms/index.html` and I’m happy. If I want to use custom templates, I can do that too:
Sadly I can’t move the template folder. I wanted to store it in `_jekyll/templates/` but that’s not an option. Also moving things to the `_drafts` folder is a little techy at best, since they assume you want to make posts and I’m making collection pages.
Most of the time I do exactly what I was doing with MediaWiki, and that is to copy the content of an existing file into a new one. Most of the time I just copy the file, rename, and edit it. It’s not perfect, but it works and I know I get the right layout that way. I plan to look into why drafts is so touchy about where things are, and how to make it behave better with collections, but Octopress 3 is still in the early stages.
**Categories:** How It Is
**Tags:** jekyll, octopress
---
### [One Direction: Sanely](https://halfelf.org/2015/one-direction-sanely/)
**Published:** November 11, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The way you flip your URLs has me overwhelmed.
**Content:**
In my ongoing saga of moving from MediaWiki to Jekyll, I decided to be smart and rename all my URLs.
Stop.
I know that’s the *worst* thing you can do. Please put down the pitchforks. I didn’t do this without redirections and I didn’t do it without deep thought. You see, the issue with MediaWiki is that it was a pretty flat file representation of the site. This doesn’t *have* to be the case. You can choose to put pages as sub-pages on MediaWiki very easily, but few people do. I didn’t. That means I had around 1000 pages that, in Jekyll land, would all be in one folder. And that sucked. Like I mentioned before, [I made Collections](https://halfelf.org/2015/jekyll-collections).
This meant I was moving from `example.com/PAGE` to `example.com/folder/PAGE/` (and yes, the backslash matters, MediaWiki doesn’t do that). Now, from a structural standpoint, this makes a lot more sense. You want to have a collection of interviews, you have `example.com/interviews/year/interviewname/` and that’s ridiculously easy to understand. But. When you’re moving from no structure to some structure, you have to accept a bit of a loss.
So here’s how to redirect sanely:
1. Make a list of what has a direct relation to a new page
2. Look at your page visits to see what’s hit the most and make sure that’s redirected
3. Have a catch-all at the end
That’s it! Three simple steps to do it. But how did I do it?
On the Wiki, I had a whole subsection called “Encyclopedia” which had all my internal documents like the about page, the policy pages, and so on and so forth. Those were all moved to the WordPress blog. Most had a new page, but the category itself did not so I added this the .htaccess in root:
That’s all incredibly straightforward for .htaccess rules. The first three are one-to-one direct links and the last three are with variables to handle URL strings like “Terms\_Of\_Use” and “Terms\_of\_use”, both of which were Wiki-forwarded to the correct “Terms of Use.” Similarly, I wanted to redirect “General\_Disclaimer” and “Disclaimer” to one page, simplifying things.
This pattern of one-to-ones continued on through my .htaccess. Pages that I could link like that I did. But then I hit on a couple big sections, the Interviews and News Articles. Those I had, for years, broken apart into pages by year. So I cleverly used tricks remembered from changing my WordPress date permalinks to do this:
The main URLs were directed to the new main locations, but the per-year ones were sent, logically, to their new year locations. But that was the easy part. When I moved things over, I got rid of ‘character’ pages (which I had only sporadically updated anyway) and I wanted to combine a lot of the redundant pages:
That’s starting to look a lot better. I did a lot of those. I tried to make them as dynamic as possible, but there were limits. In the end, I had about a dozen popular links I had to do manually. I don’t like that, but that’s the world I got myself into. I wanted to be able to redirect news and interviews to at the very least their year page, but as it turned out, I used the same naming conventions.
See the problem? There’s no way to really point those around. I played with a lot of options before I ran a search my recent traffic to see what pages were popular that people were going to in the `/wiki/` folder and redirected them as best I could.
Finally I had my fall back:
This is the last rule. If anything gets through the others and down to this one, it sends them to a new page that explains where the wiki went and links to the popular pages.
The most important thing to remember in all this is to put things in order. Your `.htaccess` is a top-down file. It starts at the top, it processes rules in order, until it’s done.
**Categories:** How To
**Tags:** htaccess
---
### [App Review: iStat Menus](https://halfelf.org/2015/app-review-istat-menus/)
**Published:** October 30, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A quick review of a desktop app I love for keeping tabs on my stats. My computer stats.
**Content:**
It’s a simple question. If the meeting is held at noon Pacific time, what time is it UTC? The answer is 1900 hours.
The reason for the question is complicated. I work with people around the world. My family lives in a multitude of timezones, some across the date line. I travel a lot. I need to know when ‘now’ is, and I need to know when ‘now’ is for someone else all the time.
Enter [iStat Menus](https://bjango.com/mac/istatmenus/) for Mac.
It’s not actually meant for what I use it for. iStat Menus is to help you make a menu item on your Mac that shows you some interesting stats. I can see, at a glance, how strong my wifi really is, or my computer’s temperature (I’m on a MacBook Air, so this is important). I can look at how much memory I’m using to quickly see why things are slow. It gives me quick links to deep dive into things. It’s wonderful when I’m testing new apps and I can see that, yes that one is slow slow slow.
But the side benefit for me is how it replaces the Time and Date Menu in my Apple menu bar. When I click on the time, I get this:
I get my month at a glance, a list of everything for today (including birthdays which I blocked out for you) and then it lists what time it is now in various place. If I hover over each time, I get more details including a Mercator map showing where daylight is right now and relative other places people care about. For $18 I’m able to keep track and know “Oh, maybe I shouldn’t ping someone on social media when it’s 2am for them…” For that alone it would be worth it, but the rest have become invaluable to debugging why my laptop was rebooting randomly.
If you just need the basic stats, [iStat Mini](https://bjango.com/mac/istatmini/) is pretty brilliant. And it’s free.
**Categories:** How To
**Tags:** app, apple, macintosh, review
---
### [Quick Notes on Ruby and Jekyll](https://halfelf.org/2015/ruby-jekyll/)
**Published:** November 9, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A very quick, brief, overview on the relationship of Jekyll, Ruby, and Gems.
**Content:**
I feel like I should be writing about *Once Upon A Time* at this point…
Let’s take a moment to talk about our stack here.
- Ruby is a dynamic, reflective, object-oriented, general-purpose programming language.
- Ruby libraries are bundled into gems.
- Jekyll is a gem that can publish static websites.
- [Bundler](http://bundler.io/) lets you list all your dependencies required for the project you’re working on.
- A `Gemfile` is a file in which we can list gems for the aforementioned dependencies.
Still with me?
This matters because you can use a `Gemfile` to define your standard libraries for a Jekyll site. The general idea is that you install Bundler:
Then you make a Gemfile in your Jekyll folder:
What this does is it defines what version of Jekyll I want to use and some of the gems I want to use. For example, if I wanted to add [Jekyll Compose](https://github.com/jekyll/jekyll-compose) to all the users of my Git repository, I would add this:
Now all they have to do is run `bundle` after their git pull, and they get the new requirement.
**Categories:** How It Is
**Tags:** coding, jekyll, ruby
---
### [Mailbag: But You Can't Post Mobile!](https://halfelf.org/2015/mailbag-cant-post-mobile/)
**Published:** November 6, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Mobile posting from Jekyll really isn't a thing. But it's not like it was much better with MediaWiki anyway.
**Content:**
This has been marked as the biggest downside to using Jekyll. Once I started telling people I was moving the Wiki to Jekyll, a great many of them were cautionary about this issue.
> How do you post from your phone or iPad?
The answer is that I don’t.
I won’t lie. Mobile posting is a pain. Since I don’t have Jekyll running on my server, I can’t edit a file there and regenerate. If I had that it would all be a lot easy. In my case, since I’m using it as a non-blog it’s never the place I need to post mission critical things. Besides, if you’ve ever tried to keep your pretty formatted WordPress site updated when you want a custom crafted excerpt and a featured image, from your iPad, I gotta tell you … it sucks.
And that’s WordPress, something that has a dedicated, usable, app for iOS. WordPress is also pretty okay in mobile. People like [Ryan Boren](http://ryan.boren.me/) spends a great deal of time caring about mobile usage. WordPress has gotten slower on the admin side in the last decade, but it’s gotten more responsive and agile at the same time.
MediaWiki not so much. Editing should be a lot easier, seeing as there’s no ‘admin’ back end to mess with things, but for whatever reason MediaWiki was always terrible on my iPad. It was next to unusable on my iPhone. Even with their default themes (remember, with MediaWiki you see the front end theme on page edits) it was dodgy.
Furthermore, what did I need to post? This is a wiki-type documentation site. It is rarely, if ever, updated on the fly. It houses long form news articles. There are recaps of TV episodes, explanations of humanitarian events, and reports of events. There is no live blogging. There is no quick off the cuff journaling. It’s storytelling.
So here’s my ‘mobile’ workflow.
1. Write the content in something, probably Byword
2. Email it to myself
3. Probably rewrite the whole thing in longer form, with design and fancy things
4. Post
I could probably streamline that better if I saved from Byword to Dropbox and had that automatically copy over (suggestions welcome), but I don’t really write from my iPad that much. I usually send myself an email with six or seven links and a note to ‘Import these things…’
**Categories:** How It Is
**Tags:** jekyll, mailbag, mediawiki
---
### [Jekyll Table of Contents](https://halfelf.org/2015/jekyll-table-contents/)
**Published:** November 4, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding a 'simple' table of contents to Jekyll makes you consider the weight of your site. Is a heavy overhead worth it?
**Content:**
One of the cool things about MediaWiki, about the only thing I missed, was the built in table of contents display. With Jekyll, since this was a static sort of site, you would have to tell it ‘When you build this page, include a table of contents.’
And I found a brilliant Jekyll plugin, [Jekyll ToC Generator](https://github.com/dafi/jekyll-toc-generator), that added in a beautiful jquery based table of contents with a click back to top feature. But there was a problem. When I installed it and ran a build to test it, my Jekyll site took *nine times* as long to build.
In order to generate a Jekyll site, you run the command `jekyll build` and, on Jekyll 3.0, that gives you the output “done in 8.493 seconds” or so on. Now, if I do a full build on a site I’ve cleaned (there’s a `clean` command you can run to scrub the site and ensure you get a clean rebuild), it generally takes about a minute. That’s to build a thousand files with a lot of weird trickery. If I’m just rebuilding the changed files, it takes about 10 seconds. Much more reasonable.
With the ToC Plugin, it took 98 to 100 seconds, *every single time*. Right away, I knew why. I had included a plugin that had to check every single page on the site on that rebuild, see if it needed a table of contents, and then build the page. Of course that took a long time!
I’m always talking about needs and wants when I work on websites. It’s a basic principle my high school drilled into me. Understand what you *need* and how it’s different from your wants. Don’t compromise on needs. Well, I knew that I didn’t need a table of contents, not on every page, so it clearly had to be a ‘mostly want.’
By contrast, having my site build quickly was a need. A fast build ensured less overhead, less weight, and less time spent. Time is a massive factor in websites. The rendered site has to be fast for users, this much is obvious to everyone. But having your build be fast means you, the site maintainer, spends less time on the parts that don’t make the site better, freeing you to develop and write.
Also speed is something Jekyll wants to work on. The build different between the 2.3 version of Jeykll and the 3.0-pre beta, is incredible. In 2013, a site with “362 articles with 660 words in average” took around 10 minutes for a full build. I have double the articles, about the same amount of words, and it’s a minute for a full build. It’s faster on my faster laptop (duh).
The decision tree for Jekyll is more obvious on build than the same one is for WordPress (or MediaWiki) on render. The basic concept is simple. The more complex your site, the longer it takes to generate pages. For WordPress (or MediaWiki, or Drupal, or Joomla, etc etc), the render happens when someone visits your site. For Jekyll and other static site generators, the render occurs when you build the site. That means with Jekyll I can see right away, before I get close to deployment, which means I make the decisions well before the ‘stage’ step of my deployment process.
What’s more important? The complexities that make your site personal or a fast build?
Here’s an example from a Jekyll discussion on the matter. Someone had the following code in the templates, which made the date output rather pretty:
But that had to run on page builds, which naturally was going to make a site slower. One of the ways Jekyll has improve this was to introduce incremental updates. Only update the pages that need updating. That is a big “baboom!” moment and it let me run the plugin jekyll-last-modified-at (which spits out a last modified date on pages) without any performance hit except on the clean build. Since that only gets called when a page is built, and a page is only built when it changes, it’s a massive improvement for me.
What does all this have to do with the table of contents?
Once I pushed it into a ‘want’ and not a ‘need’ I opened my mind to other possibilities. I stopped looking for a Jekyll or Ruby or Liquid based table of contents, and I asked myself “Can Markdown make a table of contents?”
Markdown is a ‘language’ like HTML that is actually faster to write in than raw HTML but can be read, rendered, and output as HTML. I’m a big fan of HTML and part of why I picked WordPress back in the beginning was that I stumbled on a post where Matt Mullenweg talked about how he didn’t like bbCode and didn’t want it in WordPress. HTML was something we knew. Why make people learn something new?
It wasn’t until I started [blogging more on my iPad and phone](https://halfelf.org/2015/markdown-isnt-bad/) that Markdown made sense. Now I’m quite the fan. But I knew that I didn’t know a whole lot about Markdown. I did know that Jekyll used a flavor called [‘kramdown’](http://kramdown.gettalong.org/) (all lowercase) so I read up on that and found that kramdown has a built in [built in table of contents generator](http://kramdown.gettalong.org/converter/html.html#toc) that was incredibly easy to implement.
It’s not something I want (or need) on every page, so I just put that on a few pages. No real overhead added and it’s easy enough to style with CSS. Suddenly I have my cake and I can eat it too.
**Categories:** How To
**Tags:** coding, design, jekyll, markdown
---
### [Deploy Jekyll Without Ruby](https://halfelf.org/2015/deploy-jekyll-without-ruby/)
**Published:** November 2, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Deploying your Jekyll site with a command.
**Content:**
This is a bit of a lie. I do have Ruby, it’s just on my laptop.
I don’t have it on my server, though. I have my git repo there, though. I could, but there are a couple reasons I don’t, and because I don’t, I can’t just run a `jekyll build` on my server. I’m not the only one with this particular issue. A lot of people on shared hosts can’t do it, for example. And people on cloud based tools can’t really either.
Option one, which is very common, is what I have been doing. I added `_site` (the Jekyll output folder) to Git and I copy that over on a post commit hook. For what it was, that worked just fine. It only ran when I did a git commit, and if I wanted to work on a version I could totally do that in a branch, edit it, and bring it back in without accidentally deploying things.
But option two would be rsync and that appealed to me more.
I found the gem I was looking for eventually. It’s called (simply) [Jekyll deploy](https://github.com/choffmeister/jekyll_deploy) and you add it to your `Gemfile` with this:
Then run the bundle command:
Now you have a new command called `deploy` which runs first a build and then it deploys based on the configuration options you put in. In my case it’s an rsync deploy, but you can do Git too. There was just one problem with it. The build every time made it such that my site would rebuild every time, which meant the rysnc would always be 100% new and that was more traffic than I really wanted.
So I did what you always do here and I [made a fork of Jekyll Deploy](https://github.com/Ipstenu/jekyll_deploy) and changed my `Gemfile` to this:
Now my deploy *only* runs a deploy.
A better solution would have been to put in some options and create `jekyll deploy --build` to allow me to run a build first, but I actually kind of like having them separate.
The only question left was if I should keep `_site` under version control. I decided that I should, since the git repository would keep the file dates under control, assuring me that only the files I changed would be pushed with a deploy.
I will note that the only reason it’s so simple for me is that I have [passwordless SSH set up](https://halfelf.org/2012/passwordless-ssh/), where I don’t have to put in my passwords when I connect from a trusted computer. And since I only have this installed on a trusted server, *and* if I didn’t, I’d have to have a password to get access to the git repo anyway, I felt it was safe.
**Categories:** How To
**Tags:** deployment, jekyll
---
### [Jekyll Collections](https://halfelf.org/2015/jekyll-collections/)
**Published:** October 21, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Figuring out collections with Jekyll is kind of like Custom Post Types.
**Content:**
Early on, Jekyll’s developers said that if someone was using posts for non-blog content, they were doing something wrong. That left one other avenue open, the first time I looked at Jekyll, which was pages. They’re nice, but they’re not what I wanted.
[Enter Jekyll collections](http://jekyllrb.com/docs/collections/). These are ‘arbitrary’ groups of related content which you put in their own folder. I had 15 years of interviews collected, so for me this seemed like a perfect idea. I read up on [Ben Balter’s – Explain Jekyll Collections like I’m 5](http://ben.balter.com/2015/02/20/jekyll-collections/) and it helped me sort out what I wanted.
## Configure
This is easy. You just add the collection code to `_config.yaml`
Having the output set to true means that when I run `jekyll build` the pages are generated. That’s pretty simple. They don’t get auto-generated when you run a `jekyll serve` and you’re testing locally, however. Which sucks. I upgraded to Jekyll 3.0 beta and it started working, though, and I’m okay with running a beta.
## Create A Folder
Also easy. Make a folder called `_interviews` in the main Jekyll folder. I will note, this gave me a fit. I wish I could put all my collections in a subfolder, because now I have this:
It’s messy, and if I didn’t know that some of those folders are special (like `_includes`) I could easily be confused. The `_site` folder makes some sense, that’s where my site is output. But even if I use the source setting to move all my source pages into a folder (called `_source` in my case), I still can’t separate the code from the content. What I would like is this:
`_assets` – Store all of my ‘code’ like layouts, plugins, css, etc here.
`_content` – Store all my post content, collections, pages, etc here.
Still this is a little better for me. Less insane. I will note, I was able to move my folders by defining the directories in my configuration file like this:
So now my main folder has two folders `_site` and `_content` which is a lot easier for me to work with. I feel less muddled. Inside the content folder is a `_jekyll` folder which is my ‘wp-content’ folder, and a `_data` folder, which has some data files. More on that later.
*NB: This only works on Jekyll 3.0 and up!*
## Create Files
All I had to do was make my files in my `_interviews` folder and I was done. Well. Not really. I needed a way for Jekyll to link through everything, and I really didn’t think making manual pages was smart. I tossed in this code to my interviews post file and it cleverly looped through everything it found, generating the page on the fly:
If you’re familiar with WordPress loops, this is the same thing as saying “For all posts in a category…”
## Customize the Hell Out of It
Of course you know that’s what I did next. I went and made it super-complex by putting my interviews in year subfolders and then making the main interview page a list of all the years, with links to those pages, and loops back and … well. That’s another post.
**Categories:** How It Is
**Tags:** coding, design, development, jekyll
---
### [Bye Wiki, Hello Jekyll](https://halfelf.org/2015/bye-wiki-hello-jekyll/)
**Published:** October 19, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Mastering Jekyll at last.
**Content:**
I’m trying to make life less messy by learning an entirely new system.
I have a Wiki with 1000 or so pages and it’s running MediaWiki. And it’s overkill. I don’t update it often enough to need all the bells and whistles. I need it to be fast, I need it to be simple. I need it to work for one editor (hi). Oh and I need it to be secure.
## Create a Git Repository
There’s a reason for this. My plan is to commit my changes for Jekyll to a git repo and then have it auto-copy the proper files up to the folder on my webserver. My git repository is private and on the same server owned by the same account, so I can do this. Once I had my bare git repo, I ran this in my local repository folder on my laptop:
And I got a warning: *warning: You appear to have cloned an empty repository.*
Which I knew. But that’s fine. I wanted it empty.
## Install Jekyll On Your Computer
Full stop. This is where I got confused before.
That’s it. That’s how to get it started.
## Create Your Site
I was still in that other folder, so I ran an install:
The reason for the force was that I did have some git files in there and a readme. Then I spent a few hours trying to figure out how to write posts and pages in Jekyll. Posts are ‘easy’ in that you create a file named `yyyy-mm-dd-PostName.md` and it will generate a post with that name. You can read up on [Writing Posts](http://jekyllrb.com/docs/posts/) for more.
But. I’m converting a Wiki and pretty much the whole thing is going to be ‘pages’. To be honest, Jekyll’s idea of pages are ugly. The [Writing Pages](http://jekyllrb.com/docs/pages/) directions want me to put it all in the same folder and I didn’t like that. I thought I’d rather write a mess of posts in the `_posts` folder and then let Jekyll generate on the fly.
To do that was relatively easy. I set up permalinks:
After I did that, I realized I would *still* have to name things that ugly way, so I added this to my `_config.yaml` file:
Then I made a folder called `_pages` and put my files in there, named `CSI_Crime_Scene_Investigation_(season_1).html` and so on, with headers like this:
Yeah. It’s starting to make sense. I could change the permalink to `":/title/"` and get the same result, where it would match the filename. But for now, the basic idea is enough.
## Themeing
It was harder than expected. I had to convert a lot of random PHP includes into Jekyll includes (pity I can’t just say ‘include this file, yes, I know it’s PHP…). Then I wanted to add some features like a table of contents, like I had from MediaWiki, which was a little tricky. But. Once I sorted out the way you do includes and how I could do them, it was all a bit easier.
## Importing MediaWiki
This proved to be incredibly hard. Like table flipping, teeth gnashing, up at night, wondering why the universe was created this way hard. It was so hard, I exported the wiki to XML (easy), converted that to [WordPress xml via Perl](http://www.analogrithems.com/rant/portfolio/mediawiki2wordpress/) (hard because of dependancies), edit all instances of `wiki` to be a post, import into a WordPress site (easy), and then …
Then I spent a long time going through the import, fixing the pages, formatting things, uploading images properly, etc. The wiki I was importing was old. It happens to be the oldest part of the website it’s on, and I was using a lot of templates. In a way that was great. But in another way it was really a terrible idea because it locked me in.
So a lot of things had to happen. First, I had to rebuild all my templates. The wonderful thing with this is that I was using a lot of templates to list things like episodes and I could convert those to yml (or csv) and then have Jekyll run a loop to display them. Once I realized that, it meant I had a lot more freedom with content.
I ended up not importing everything. A lot of what was on that Wiki was never looked at by anyone but me, and fifteen plus years of cruft leads to a lot of messy things. Between Jekyll collections and data, I was able to break things out into sanity again. But that’s a whole post on it’s own.
## Pushing To My Server
I’m using Git, and it’s set to auto-push when I push. But this time I did it a little different. Normally I’d run jekyll on the server, but in this case I don’t have the option so I went with adding my `_site` folder to the git repo (which meant editing `.gitignore`) and then writing this:
This is not what I would consider a great idea. I’d rather run git on the box, but Ruby has been misbehaving there, and this actually lets me use the code on a shared box too.
**Categories:** How To
**Tags:** jekyll, mediawiki
---
### [Fetch As Google Failed](https://halfelf.org/2015/fetch-google-failed/)
**Published:** October 7, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A short tale of debugging and WordPress.
**Content:**
Once upon a time, I got an email from Google recently saying that Fetch as Google was failing for ipstenu.org.
I eyed them like they had a fifth eye. I was on ipstenu.org. I was on halfelf.org. They were clearly wrong. So I went to [Google Webmasters Tools](https://www.google.com/webmasters/tools/) and checked out what was going on. I had a whole page that said “Temporarily unreachable.” I gave it a day. Sometimes that’s just Google being weird. But no.
[](https://halfelf.org/wp-content/uploads/sites/2/2015/09/not-accessible.png)
After cursing a little while, I turned off all the plugins on the site and switched to the default theme. And the fetch worked. So I turned them on one at a time until it stopped.
And the moral, ladies and gentlemen, is that even though it’s been ten years of WordPress, when someone asks you to make sure you go through the normal debugging steps, you do it.
- flushing any caching plugins you might be running, as well as server and/or browser caches.
- deactivating all plugins (yes, all) to see if this resolves the problem. If this works, re-activate the plugins one by one until you find the problematic plugin(s). If you can’t get into your admin dashboard, try resetting the plugins folder by FTP or PhpMyAdmin (read [“How to deactivate all plugins when you can’t log in to wp-admin”](http://codex.wordpress.org/FAQ_Troubleshooting#How_to_deactivate_all_plugins_when_not_able_to_access_the_administrative_menus.3F) if you need help). Sometimes, an apparently inactive plugin can still cause problems. Also remember to deactivate any plugins in the mu-plugins folder. The easiest way is to rename that folder to mu-plugins-old
- switching to the Twenty Fourteen theme to rule out any theme-specific problems. If you can’t log in to change themes, you can remove the theme folders via FTP so the only one is `twentyfifteen`. That will force your site to use it.
- manually upgrading. When all else fails, download a fresh copy of the latest.zip file of WP (top right on this page) to your computer, and use that to copy up. You may need to delete the wp-admin and wp-includes folders on your server. Read the [Manual Update directions first](http://codex.wordpress.org/Updating_WordPress#Manual_Update).
So yes. Do try it.
**Categories:** How To
**Tags:** debug, essay, wordpress
---
### [Jekyll Layouts vs Wiki Templates](https://halfelf.org/2015/layouts-templates/)
**Published:** October 26, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Replacing a variety of templates with cleverly built layout files.
**Content:**
One of the things I was doing in Mediawiki was using a lot of templates. A lot. The way a template works in Mediawiki, you have a special page called `Template:NAME` and you can embed it with `{{NAME}}` in any post. You can even embed a template in a template. They’re basically static ‘blurbs.’ You can make them dynamic, but I have found that even after ten years of using Mediawiki, it’s still a bit of a mystery.
With Jekyll, that gets thrown out the window.
Let’s take, for example, my list of interviews. I have 14 or so years of interviews, broken up into a separate page by year and internally sorted by date. Manually. I also have a template `{{Interviews}}` which outputs a pretty formatted link to each year. Also made manually. For every new interview, I edited at least two pages (the interview itself and the year). And for every year I had to update the main interviews page and the template.
My end goal was to do the following:
1. Each year index would dynamically list the posts for that year
2. The interview main page would list links to all the available years
3. The interview ‘template’ would be output on every page
4. The interview year page would list everything from that year
5. All those things would dynamically update when I added a new item
Oh and I also wanted a layout to be intelligent enough to show a special header with specific information on the individual interview pages.
## Love Collections
To convert this, I first made use of [collections](https://halfelf.org/2015/jekyll-collections/), making one for `_interviews` and within that I have a folder for each year with the interview as a flat file and an `index.md` to make the main index. I don’t have to do this. I could have the index anywhere I wanted, but this was easier for me.
There is a big gotcha here, though. Subfolders and collections and sorting by date doesn’t work the way you’d think it would. I could make it easily sort by title, and I could reverse it, but sorting by date proved to be a killer. Eventually I figured this out:
1. All the pages have to have a date, even if you’re not going to sort that page (see my index)
2. You can’t sort in a for loop
The final code looks like this:
## Front Matters
This is funnier if you know that the ‘header’ of a Jekyll file is called the [Font matter](http://jekyllrb.com/docs/frontmatter/). Here’s an example of mine:
Everything except `topic: index` is a default variable. I made the topic, and what that does is tell me “This page is an index page” and what year things are. There are reasons for this down the line. Now I also want to sort by year, but I can parse the date for that.
## Design the Layout
I designated my layout as ‘interview’ in the first example, so I made a file called `interview.html` in layouts and made it a child of my default layout. In there, I have this code:
That says “if a page is an index, list it.” Now when I want a new year, I just add in a new folder with an index file.
I’ve gone even further, taking the logic from some WordPress themes I’ve see, and the layout file has all the code for both the index view and the per-item view, allowing me to format my interviews with custom headers and footers around the content.
## Does it Work?
Yes it does! Mostly.
The problem with this, and yes there’s a problem, is that the interview layout page doesn’t regenerate itself. I have to go and re-save the layout for interviews in order to regenerate any lists I have on that page.
I can get away with typing this in shell: `touch _content/_jekyll/layouts/interview.html && jekyll build` but it is a little annoying. Even running a manual `jekyll build` won’t do it because the layout doesn’t realize it has a change yet. I do understand why, though. It may be worth moving that somewhere else, though I have a feeling even if I make it a template it would have the same problem, since that template file wouldn’t know to update until it was edited.
It took me a while to find the magic sauce is a bit of code called `regenerate: true` – This is not something you should use everywhere! I use it on my interviews index pages because those pages get updated when a new item is added to their folder. It actually lets my index pages be totally blank except the yaml headers which is nice and simple.
**Categories:** How It Is
**Tags:** coding, development, jekyll, mediawiki
---
### [Bad Habits, Bad Dates](https://halfelf.org/2015/bad-habits-bad-dates/)
**Published:** October 28, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** In my move from MediaWiki to Jekyll, I learned I'd been doing some things in a pretty terrible way.
**Content:**
First of all, the migration of MediaWiki to Jekyll went fine. I binge watched “Person of Interest” and converted things with the clever use of grep and regex. Once I got to the point where I was converting templated files from Wiki to Jekyll, it got a lot easier. The hardest part was date conversion, and it started with some bad filenames.
MediaWiki let me use whatever I wanted in (almost) whatever way I wanted, which is a problem. Also a problem is MediaWiki’s flat-level structure. Everything was the same level for the URLs, so you had `http://example.com/wiki/NAME` and, for the most part, that worked out okay. The problem I ran into was how I chose to name files.
You see, I used the logical names “Interview Source (dd M yyyy)” for the interviews. That converted to the URL of `http://example.com/wiki/Interview_Source_(dd_M_yyyy)` which is nice and descriptive, if long. And it worked great right up until my subject had seven interviews on one day, two with the same source.
Take this example. If you have an interview with the CBS morning news and the CBS evening news, on the same CBS local station, do you name the files “CBS Morning News (28 October 2015)” or “CBS News (28 October 2015)”? Obviously you have to go by the unique name (or the more unique one) to avoid name collisions. And for a time that worked out just fine. Except. I also had news articles. So if the CBS Morning News put out a news article on the same date as the interview, I was screwed. I ended up with multiple stupid filenames like “CBS Morning News (28 October 2015 b)” and so on. It was annoying.
This could have been ‘avoided’ or at least mitigated more if I’d had used the subpage hierarchy for articles, making things `http://example.com/wiki/Interview/Interview_Source_(dd_M_yyyy)` and `http://example.com/wiki/News/Interview_Source_(dd_M_yyyy)` instead. And certainly I could have moved everything.
But for whatever reason, subpages aren’t really super popular with MediaWiki. At least not the self-managed ones I’ve seen. They take a level of awareness that not everyone has. You can’t ‘see’ the subpages easily, not like categories with WordPress, or collections with Jekyll. And that means people just don’t use them. How do you train everyone to know how to do everything?
Conversely, this naming issue isn’t a problem with WordPress because there has always been a clear delineation between URL and page name. This is made more-so when you use plugins like Yoast SEO, which allows you to remove ‘stopwords’ like ‘a’ and ‘the’ from your URL strings. This looks ‘wrong’ on MediaWiki, sadly, which is used to making pretty URLs that are descriptive.
In the move to Jekyll, I renamed everything. First I made folders for each year and then I moved all files with that year in the name into the right folder. Since that muddled a few ‘extra’ files in there, I checked each file for the content `{{InterviewTemplate` or `{{NewsTemplate` and sorted them into `/interviews/year/` or `/news/year/` as appropriate. That was easy.
To rename the files, I used my favorite tool [Name Mangler](https://manytricks.com/namemangler/) to convert the filenames from `Interview_Source_(dd_M_yyyy)` to `interview-source` – nice and short. The ‘gotcha’ with that was, of course, multiple posts from the same source in a given year. And that was a problem because of that stupid naming convention. I would have to sort out some kind of script to rename things in bulk to convert the names into something I could then re-rename in order.
And then I remembered something…
[](https://xkcd.com/1319/)
Not that. I remembered that the post-slug didn’t matter. It could represent the date of the post, but also possibly the order in which the posts were created. Which meant they didn’t matter in the slightest and I could batch rename.
Furthermore, my date convention lead to a massive annoyance *inside* the content. Jekyll wanted my name convention to be `yyyy-mm-dd` and there was no really easy way to take `yyyy-M-dd` and convert it. There is no regex that does that. In the end, I converted `dd M yyyy` into `yyyy-M-dd` (which regex can do nicely) and then a search on all files for `date: /d{2}-January-/d{4}` to replace with `date: /1-01-/2` and repeated for every year.
Annoying, but it worked.
**Categories:** How To
**Tags:** coding, jekyll, mediawiki, regex
---
### [Mailbag: Why Jekyll?](https://halfelf.org/2015/mailbag-jekyll/)
**Published:** October 23, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Why would I go to Jekyll when I could have WordPress?
**Content:**
> Why didn’t you convert your site to WordPress? You said you had to import it from Mediawiki to WordPress already.
I had this conversation with my wife, too.
WordPress is *awesome* at being a dynamic website. To be a static ‘wiki’ style website, it sucks. It’s not meant to be static like that. It’s not intended to be static. Even if you turn off comments on your site, you mean for WordPress to generate index pages and categories and the like.
With WordPress, all that work is done on the server. When you visit a page, it’s generated for the first time. I may have a cache that lets reader number 2 see that page, but always the page, the HTML, is being dynamically built on-demand. MediaWiki works the same way. In contrast, Jekyll is dynamically built on my laptop and deployed as an in-situ static site. Each HTML page is a real HTML page on the server. No extra work has to happen. It’s small, it’s light, and it’s fast, because all that processing was done by me on my laptop before putting it on the server.
And that actually illustrates the problem with WordPress, and why we struggle with things like Varnish and nginx and caching. We want our sites to do more and be faster. We need flexibility and posting to Twitter and dynamic page generation when we make an edit, because we’re constantly making changes.
Except I didn’t. I don’t. Not the particular site I was working on, anyway. The site has about 1000 pages (probably closer to 600 once I decided not to import some of the things) and they’re pretty static. At most I updated them once a week for half the year. WordPress would be overkill. Hell, the Wiki was overkill and the only reason I kept using it was technological debt. I didn’t want to add to the debt. I didn’t want to make things even weirder and harder to use. I didn’t want to put a site more at risk with software I didn’t want to upkeep (MediaWiki, not WordPress).
So it was clearly time to dig myself out with a little sweat equity and decide what I really wanted. I made a list of what I needed, what I wanted, and what I could live without. When I did that, Jekyll started looking more and more like a viable option. I would have spent as much time removing the aspects of WordPress I don’t need as I would have learning a new theme system and language.
Also in the end I didn’t use the WordPress import. I manually copy/pasted content. The content was what I wanted, and I needed it text only, and MediaWiki made that damn hard to get at. Of course the Jekyll exporter for WordPress was pretty freaking cool. If I was pure WordPress to Jekyll, I’d be fine. I guess there just aren’t a lot of people doing MediaWiki exports.
**Categories:** How It Is
**Tags:** essay, jekyll, mailbag, mediawiki, wordpress
---
### [Apple News: Only Our News Fits](https://halfelf.org/2015/apple-news-fits/)
**Published:** October 2, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Rant: Apple News is all the news that fits, except the news you can't have.
**Content:**
iOS 9 has a new tool, [Apple News](https://www.apple.com/news/). This is the replacement for the Newsstand app everyone shoved in that ‘Apple Shit’ folder on their iPhones and muttered about how it took up space on their 16G iPhone they didn’t care about, and damn it, I don’t have an iWatch so why do I care about that app either?
You know you have that folder.
News, though, is actually pretty damn cool! It’s actually a news reader app I like and want to use. Except for two big issues.
You see, I have an Apple Watch and I like how it alerts me to things. I get a wrist buzz, I look down, I know things. A text message, a direct message from Twitter (since few people can do that), an email in a certain box (not yet, but as soon as I figure that out…). What I want with News is for my watch to buzz when there’s a new article about a specific thing.
The first thing I did was set up News to search for topics I wanted. Like you do. And I put in ‘Jorja Fox’ because I’m still running that website.
[](https://halfelf.org/wp-content/uploads/sites/2/2015/09/IMG_0003.jpg)
Interesting, right? No Jorja. I clicked on ‘Show more topics’ but even after scrolling and scrolling, I couldn’t find her. The same thing happened with ‘George Eads’ and ‘Rachel Ray’ but not ‘Bobby Flay.’ Looking for ‘Jennifer Tilly’ brought up ‘Jennifer Lopez’ (close!) but weirdly enough I was able to find ‘Sara Sidle’ (the character Jorja played on CSI).
[](https://halfelf.org/wp-content/uploads/sites/2/2015/09/IMG_0009.jpg)
I ended up managing to make my favorites (Animal Defenders Intl, CSI, and Sara Sidle), but I couldn’t find the movie ‘Lion Ark’ or ‘Extinction Soup.’ Actually, finding the ADI was incredibly hard.
The search function doesn’t seem to trigger for exact matches as much as it should.
If you want to add a website, it’s not at all logical. You have to add an RSS feed if the news site isn’t located there and even *that* isn’t logical. Go to Safari, find the RSS feed, click it, and your iOS device will ask you if you want to open in News. Say yes! There you go.
Except… How do I add an arbitrary search? You don’t. You can’t. If you want to have a ‘Cat Cora’ channel, or a ‘Jorja Fox’ channel, you’re out of luck. If the name doesn’t show up it doesn’t show up, and yes, I scrolled and scrolled. Then I got a little smarter and got the Google RSS link:
`https://news.google.com/news?pz=1&cf=all&q=Jorja+Fox&output=rss`
I opened that on iOS and added it. And it didn’t work. Oh it added something, but it wouldn’t open within News.
Then I tried Bing:
`https://www.bing.com/news/search?q=jorja+fox&go=Submit&qs=n&form=NWBQBN&pq=jorja+fox&sc=8-9&sp=-1&sk=&format=RSS`
And Apple News said it couldn’t add Bing to News. Bias much? After iOS 9.0.2 dropped (literally that night), I was able to add Bing, but only if I went to that URL and viewed as desktop (if you didn’t know, there’s “Request Desktop Site” button in Mobile Safari).
[](https://halfelf.org/wp-content/uploads/sites/2/2015/10/IMG_0011.jpg)
Now *sometimes* there’s a [button in the ‘Share’ setting in Safari that lets me add to News](https://halfelf.org/wp-content/uploads/sites/2/2015/10/image-768x1024.png). And sometimes there is not. Way to go, Apple. In all cases, I get the spinning circle of doom after I add something to News.
Naturally I went to look for help on Apple News and found none.
In the midst of all this, I realized a horrible thing. You don’t get alerts on your Watch from News. You do from a variety of other news apps. You can’t from News. So they’ve made a great new tool that doesn’t let you add arbitrary searches, doesn’t alert you to new news about the searches you can make on your Apple Watch. And while I do have notifications on, it doesn’t seem to notify me about anything.
In contrast, I added Google News & Weather to my iPhone and, once I logged in with my Google account, it remembered I had a saved search and showed that. Except it also showed me general news and weather. I can’t dismiss those. I *have* to show them, above my custom news, all the time. Plus the alerts I get are for world news, not my personal searches, which is funny since Google can email me when my custom search has new articles, so I know it *can* do this.
Here’s what I want: A ‘News Reader’ that lets me get alerts on what I want to get alerts on. If a site it scans publishes something with my keywords, it pings me. When I read the app, it would sort by date (hiding duplicates by default), and let me thumbs-up or thumbs-down the article to help train it as to what was relevant.
One of the apps I tried, while looking for that, was [Nuzzel](https://itunes.apple.com/us/app/nuzzel-daily-news-from-your/id692285770?mt=8). Cute hedgehog aside, the idea that I can get the news from people I follow (and one presumes I trust) is nice. But that only shows me what people know about. [News360](https://itunes.apple.com/us/app/news360-your-personalized/id420397564?mt=8) suffered the same problem as Apple News, that adding certain arbitrary topics proved impossible. It could find some of my terms but not all. At least they had a way for me to file a bug report, though.
**Categories:** How It Is
**Tags:** apple, ios, rant
---
### [Mailbag: Delete My Account, Please](https://halfelf.org/2015/mailbag-delete-account-please/)
**Published:** October 16, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sorry, Charlie, I can't help you there.
**Content:**
Becuase I’m active in the support forums, people find me and ask all sorts of questions. Like Charlie.
> I want to totally delete my word press account. I will PAY you to do this. Why? Because I worked for 15 minutes on the original word press website but found it too difficult for me and chose to go with a super easy Wix.com website, which is now published and works well. In searches I come up under wordpress only and my deleted wordpress website is still there. I want people to be able to find my wix site. I hope there is a way to TOTALLY delete my word press account. I will PAY you to do it.
Sorry, Charlie, no can do. I checked his email and his domain that he put in his email and it was on WordPress.com so I sent him the link on .com for [How to delete your site](https://en.support.wordpress.com/delete-site/).
I will note, I am sorry he wants to use Wix.com, but on some levels it is far simpler than WordPress (yes, I said it). It’s drag, drop, and done, and looks great on desktops. Mobile? That’s another story. But I had a paint-by-numbers GeoCities account back in the day, so I really don’t have room to talk about ugly first websites.
The story doesn’t end here. Charlie asked me to do it for him.
Even if he was a customer at *my* company, I would tell him no. I would send him directions on how to do it but I would not delete it for him. I don’t delete customer’s sites or data (unless the data is a Terms violation). Hell, even with hacked content, I back it up elsewhere first. Deleting someone’s data is an absolute, 100%, last resort. You should never ever do it. There’s no going back.
Then Charlie asked me again.
I suspect his issue was that he was really frustrated and wanted everything to die in a fire. Which I totally understand, but amidst all your anger, you need to take a deep breath and follow the directions. And, when someone tells you “I don’t work for that company, but I found out how to do it. Here you go!” perhaps you can say “Thank you.”
Just a thought.
**Categories:** How It Is
**Tags:** essay, mailbag, wordpress
---
### [New Plugin: @Reply Two](https://halfelf.org/2015/new-plugin-reply-two/)
**Published:** October 9, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making managing and leaving comments a little easier.
**Content:**
This blog has a cool trick in the comments section. The ‘reply’ link in comments will auto-generate your reply starting with “@person: ” and it does that with my plugin [@Reply Two](https://wordpress.org/plugins/at-reply-two/).
The name is a pun because it’s a fork of the plugin [@Reply](https://wordpress.org/plugins/reply-to) (which has the slug `reply-to`), but it also has a ‘reply to’ feature (two … to … right?). I strip-mined the original and made sure it worked on the modern versions of WordPress. I made sure it looked good. And then I added in a feature I wanted, which was to allow for a way to see parent comments on the admin dashboard.
That is, if you go look at a comment on the dashboard, you’ll see a little arrow that says “Show Parent Comment (15 words):” (or however many words). It strips out all HTML, so it’s a pretty accurate count. I wouldn’t want to use it on a site with a lot of really, really long comments where everyone was always replying to each other. It would make the comments page really slow to load.
Stephen Cronin’s [Show Parent Comment](https://wordpress.org/plugins/show-parent-comment/) does the same thing there. His uses JS, and mine uses html5 with [details-shim](https://github.com/tyleruebele/details-shim) for fallback. Except for IE8. I hate IE8.
I forked the plugin almost two years ago but I had it irregularly updated until Jeff posted about his [experiences moderating comments on WP Tavern](http://wptavern.com/lessons-i-learned-moderating-comments-in-wordpress).
The sad truth is that you can’t automate ‘enough’ of what makes moderating a pain in the ass. You can’t make it faster because it requires a human to read and pay attention to what they’ve read and process what it means. The part of the work that takes all the time is the part of the work that won’t be possible to teach a machine to do until we invent an AI.
There’s a reason why spam-trapping isn’t perfect. While we have gotten pretty good about it, things will always get caught incorrectly, or let through when it should have been blocked. Why? Well we don’t yet have a way to scan someone for the intent in their heart. Metaphysics aside, we can’t find the answer in the soul of the person beside us.
What we can do is make it easier for humans to look at a thing and go “Wait a second, that isn’t right!” Humans are generally good at that. We know what we’re ‘used’ to seeing and what we’re not. Hopefully that’s what @Reply Two does. Pun and all.
**Categories:** How It Works
**Tags:** plugins, wordpress
---
### [Turning It Off And On Again](https://halfelf.org/2015/turning-on-off/)
**Published:** October 14, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Spending a day debugging when you can't see anything that resembles an error message is entertaining. In the "not at all" way.
**Content:**
Apple’s watchOS 2.0 came out on Monday Sept 21, and I was one of the unlucky ones who had a problem. All of the new ‘native’ apps crashed.
If you’re unfamiliar with the concept, the original Apple Watch didn’t allow apps to really run *on* the watch. They ran on the phone and you had to use Bluetooth to connect for data. Now, with watchOS 2, the apps can load locally and use wifi on the Watch itself, making them faster. Exciting times for all. As I explained to my wife, all the Apple default native apps worked fine. The 3rd party ones did not. They all crashed.
Also my battery life went to shit. So I did what one logically does. I rebooted my Watch. That didn’t help. So I went to Google and Reddit (yes, Reddit) and I dug around and found what everyone else had done to fix it:
- Unpair and re-pair
- restore from backup of 2.0
- Setup as new
- Let it sit overnight
- Uninstall apps from phone, reboot phone and watch, reinstall apps on phone, reinstall apps on watch
- Reinstall from my 1.0.1 backup
None of that worked for me, so I filed a ticket with Apple support at about 7:15am. They called me back at 7:30 (which was nifty) and we discussed what I’d tried. They walked me through things, I confirmed I’d tried all of that, and detailed what I’d seen happen. Finally the woman apologized, said she didn’t know why it couldn’t work, and asked if I wanted to mail it in to Apple for a replacement.
I didn’t. I was sure this wasn’t a hardware bug. I asked if I could take it to an Apple Store, and she said yes, making me an appointment at the store for the weekend (the earliest time) but I work .5 miles from a store so I planned to head down after lunch to have a go.
I ended up not doing that.
I work in tech. I’m used to troubleshooting. I went over everything I’d done. I checked and double checked that I was sure I did it right. I went back to the Reddit thread and looked to see if anything new had been posted. Sure enough, there was something. [A Zen man in the MacRumors forum had an answer](http://forums.macrumors.com/threads/native-apps-do-not-load.1919307/page-6):
> - Doing a iphone backup with encryption of data on itunes.
> - Delete content of iphone.
> - Restore from a backup.
> - All native apps are working fine!
While I couldn’t say that was a ‘great’ idea, I figured I had nothing left to lose. Since I always keep a spare cable for my phone and my watch in my bag, I connected them both and tried.
And yes. It worked. Immediately I canceled the appointment with the Apple Help Gurus and started a live chat with them to explain how I fixed it. I also contacted the two app companies I’d been chatting with about it *and* made sure to confirm on Reddit that it worked for me. Because [I will never be DenverCoder9](https://xkcd.com/979/).
The debugging process with the Apple Watch is convoluted. I had a similar headache when I couldn’t get the WiFi working properly. I ended up having to disconnect WiFi from my phone and then re-add it for the Watch to pick it up. It’s not really the best experience, and there’s not a lot of ways to debug things.
While I do like the Apple Watch, the black-box technology aspect of the iPhone is increased since it’s, literally, impossible to use the watch without a phone. You have to both attempt to fix things on the watch and the phone, without having a way to determine which is the broken one. And a ‘reinstall’ is not really the friendliest thing. Had I not had a handy laptop, I would have had to do an iCloud restore, which would kill my activity history (something I’d already accidentally wiped out).
The problem comes back to meaningful error messages. All I could say was “The app crashes and kicks me back to the home screen.” Apple faces the same issues we all do with errors. How do we explain things in an informative way that allows people to react to the errors and know what to do next, when there is *no way* to gauge their skill set? Sadly, Apple’s route is “Take it to a professional.”
We can’t all do that with our products, and more often than not it leads to frustration and things like ‘Bendgate,’ where people just rant and make a product seem worse when it’s really only a very small percentage of those who are impacted.
Is there an answer? No. But it’s just one more thing to consider when we discuss elegant failures.
**Categories:** How To
**Tags:** essay, troubleshooting
---
### [An Ad Network You Can't Use](https://halfelf.org/2015/ads-you-cant-use/)
**Published:** October 12, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's really the best ad network I've heard of. But I've barely heard of it.
**Content:**
Amidst the kerfluffle of Peace being pulled from the App Store after a couple days, there was a mention of how it also blocked [the Deck Network](http://decknetwork.net/) ads.
Most people in tech have seen Deck ads, but few outside the ‘hard core’ geeks know of it, and it’s for good reason. It’s an invite only ad system that makes ads that don’t slow your site down.
Manually curating ads, they restrict users to show one and only one ad on the site, perhaps not on all pages of a site, but just the one ad.
> In essence, buying a month on The Deck gives you an exclusive showing on three percent of all the pages viewed for that month across all fifty-two sites and services. And there won’t be Google or other third-party ads diluting your exposure. The Deck ad is the only ad on the page.
It’s a phenomenal amount of work. And that would be why only fifty-odd sites are in. Peace happens to be on that network. But let’s put aside the whole [ethics and morality of ad-blocking](https://halfelf.org/?p=8043) for a day.
The *idea* behind the Deck Network is everything I want an ad network to be. They pride themselves of relevancy to their network and only show ads relevant to the network. They only show ads they’re okay with seeing. As mentioned before, it’s an incredible amount of work, but it’s exactly what you’d want to see in an ad network. Ads that people would rather be relevant than, nessecarily, make money.
That’s really kind of the same reason as my I like [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/) so much. With Project Wonderful, though, the quality of the ads is a little crowd sourced. If enough of us report an ad, it will likely get pulled but it will always be reviewed. With The Deck, it’s the other way. Nothing gets in that isn’t vetted first.
The amount of work that goes into that is exactly why, every time anyone says “I’ll pay you to put my ad on your site” I say “No thanks.” The whole mess of running my own ads, having them expire and rotate and change, is a hassle I don’t want to mess with. I don’t want to spend my time running ads, and I’m a one-woman-show here, folks.
The balance between making money and having relevant ads is tricky. I think, for the tech world, The Deck gets it right. But I doubt any of us will ever be on it.
**Categories:** How It Is
**Tags:** advertising, essay
---
### [Stop Using Copy Protection](https://halfelf.org/2015/stop-using-copy-protection/)
**Published:** February 23, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Give up. The only full protection is not to post your image in the first place.
**Content:**
I’ve seen a million features out there to ‘prevent people from stealing your content.’ The idea is that by preventing people from (easily) copying your work, you stop them from stealing it and profiting off your efforts. You may even think that you’re saving your images from being stolen. In general, they use javascript to prevent things like right-click, view source, copying text, and disabling keyboard short cuts. In general, they suck and here’s why.
## User Experience
Anyone who uses a screenreader or an alternative mouse tool now, officially, hates you. You’ve made your site look like absolute crap. Some screen readers can no longer read your content at all. Also not everything handles javascript very well (which is by far the ‘most popular’ way to block out content) and that makes for a pretty lousy experience for your visitors.
## Support
If you have a problem with your website and ask the world at large for help, they will take one look and hate you. No one can easily help you with your CSS or your layouts or your design now, because you’re protecting content. When customers ask for help, the first thing I do is turn those plugins off so I can use my normal debugging methods and not worry about cruft interference.
## It Doesn’t Work
If you disable right-click, you make it harder for me to bring up Chrome’s dev tools, but not impossible. You can’t make it impossible. This is, in part, because there are so many different browsers to account for, but also because developers really don’t want you to be able to kill dev tools. We need them to fix the web, and if I were to leave the dev tools open and then visit your site I would be able to have it open on your site.
Once I have dev tools open, I can view the resources loaded by your page. Take Instagram, who doesn’t let you right-click on an image to download. I can instead right-click, chose ‘Inspect Element’ and I get this:
Guess what I can do now? Load that URL in another window, download, done. If that’s not available, I’ll go over to the Resources tab, open up the Instagram folder, then Images, and find the image I want. Again, done.
## There’s Only One Way
There is but one foolproof way to prevent your content from being stolen: Don’t publish it.
But of course no one wants to hear that. So what’s the other way? Well give up on not having your words stolen. Even if you make it difficult, people will get at it. People type up books and scripts today, they’ll do it for your website if they’re properly motivated. Images, on the other hand, are a different issue. If you’re a photographer, don’t put your full-sized images online unless you’re selling them. And if you *are* selling photographs, put them on a cloud host like Amazon. Large files and PHP aren’t the best of friends anyway. Your website, unless it’s a store, doesn’t need the 10meg image file.
As much as it pains me to say it, DRM is also a solution. So is watermarking your images. The way people like Getty protect their images is to lock it down to purchased users only. You can (fairly easily) download the smaller, sample images, but the awesome big ones are locked down.
But that’s how you protect your content. Not with those plugins.
**Categories:** How It Works
**Tags:** coding, plugins, security, wordpress
---
### [To Block or Not To Block](https://halfelf.org/2015/block-block/)
**Published:** October 5, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Thoughts on the issues of ads and their blockers.
**Content:**
Ad blockers. Okay.
I have ads in this site. I have donation buttons. I make more via the ads, naturally, and I use the money to offset the absolute frivolity it is to run a web server. I also use ad blockers.
And I also understand the worry of ad blockers on iOS because I see the possible loss of income.
But.
My ads are not obtrusive. I hope. I test them a lot on browsers. I don’t display them on smaller ones. I am picky about the ads. I don’t have pop-up/lightbox ads or alerts that congenially prompt people to sign up for a mailing list or try a service. I hate those things. They get between me and the content I’m trying to read. They prevent me from visiting sites. And if you’ve tried to click away an ad like that on your iPhone, you know my pain. Let’s not even get into the accessibility problems.
No, ethically I chose not to host the ads I hate.
And I lose money because of that.
A lot of money. Probably a hundred a month, easy. And I’m personally okay with that, because I *can* afford this website. I have the money to keep it up, and for what it costs me, it’s cheaper than other hobbies. It’s helped turn a hobby into a career.
But the same cannot be said of all websites. Many need those ads to survive and flourish.
So in the balance between content and money, with accessibility and speed on the line, what is the right answer? Who is more important? Where is the right path to earn money while showing ads and not pissing off readers?
And I’m not the only person who has trouble with this balance. The developers of Peace, an iOS ad blocker, pulled his product after two days, saying [it didn’t feel good](http://www.marco.org/2015/09/18/just-doesnt-feel-good). He doesn’t like being the person who gets to decide what ads are right and wrong. That said, Marco is still a proponent of blocking [for the ethical reasons of knowing who’s tracking you](http://www.marco.org/2015/08/11/ad-blocking-ethics).
Disclosure time! I use an blocker on my computer. It’s µBlock, which Taylor Swift also uses:
> I have moved from using Adblock Plus to µBlock
> Github/about:
> Extension:
>
> — SwiftOnSecurity (@SwiftOnSecurity) [January 25, 2015](https://twitter.com/SwiftOnSecurity/status/559155450583990272?ref_src=twsrc%5Etfw)
But the truth is I actually block few things. It’s not that I want a blocker but I want an unobstructor tool. Just like we despised pop-ups, I hate the following things:
1. Ads that redirect my iPhone to the App Store to buy your stupid game
2. Ads that cover my entire browser window, forcing me to click away
3. Ads that autoplay, making me scroll the hell around and figure out what I have to turn off
4. Ads that popup in the background, making me address them before I can read
If you can’t see a trend, let me explain it for you. I hate all things that pull me away from your *content*.
The New York Times has reported on this: [Enabling of Ad Blocking in Apple’s iOS 9 Prompts Backlash](http://www.nytimes.com/2015/09/19/technology/apple-ios-9s-enabling-of-ad-blocking-prompts-backlash.html)
> “When ad blockers became the most downloaded apps in the App Store, it forced publishers and advertisers to rethink the role that advertising plays on the web,” said David Carroll, an associate professor of media design at the Parsons School of Design.
That illustrates the issue. It’s not that we hate ads. Most of us understand them as a necessary evil. We pay for Netflix to get fewer ads. We pay for cable to get higher quality shows… in theory. We get ads with free TV because it’s free and has to make money. We get ads on newspapers and in magazines because they are surprisingly low cost for what they are. Ditto comic books.
We *know* and we understand why ads are there. We rebel because the ads make it impossible to get at the content. The thing we came for.
I don’t have an answer. I know that, sometimes, I actually do click on ads that interest me. I also know that most of the time people don’t click on ads. I know that many sites need ads to keep going and to keep delivering content. But I know what we’re doing, making ads more and more in your face, is not the right way to win.
Right now I have no iOS ad blocker. I haven’t found one I like yet. I’m sure that will change.
**Categories:** How It Is
**Tags:** advertising, essay, website
---
### [Changing Git History](https://halfelf.org/2015/changing-git-history/)
**Published:** September 30, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It's back to the future when you make too many commits in git!
**Content:**
Working on a group project in Git, I did the smart thing with my code. I made a branch and proceeded to edit my files. I also did a dumb thing. I made four commits.
The first was for the first, ugly, functional version of the code. The second was a less ugly, kind of broken version. The third was the rewrite and the fourth was the working version. When I wanted to submit my changes for a review, it was going to be ugly. I did not need or want people looking at four commits They only wanted the one.
Now I’m a weird person for how I do commits. I add a new feature like a new function to parse things, and I commit that. Then I change my CSS and commit that. And so on and so on. This means I can look through my commit history and see exactly when I made a change. When I’m ready to do my release, I document all the changes based on that commit log and have it as my message.
But when you’re working with a team, and all they want is one clean commit? Well I’m their worst nightmare. There is a cure for this, though! You can squash your commits, merging them all into one.
## Squash
Actually it’s rebase. It can be squash too, though. I ran the following command which says to rebase my last 4 commits:
That opens up another editor
Now here’s where it’s weird. The first one, `b17617p` is the one I have to merge everything into. And it has the worst commit message, doesn’t it? Oh and I was totally not using the right formatting for how the company wants me to format my commits. They want the comment to be “Feature: Change” so I would have “Humans: Added new feature to autogenerate humans.txt”
Since I knew I wanted to merge it all and totally rewrite the commit, I just did this:
Which, once saved and exited, gave me this:
Since everything with a `#` is ignored, I deleted it and made it this:
Yeah, that’s it. Admittedly, these should be two separate changes, but they’re all a part of the same project in this case so it’s okay.
Of course, at the end of this, I looked at my code on our web tool and swore, because I’d left a debug line in. My hero Mike said “Don’t worry! ammend!”
I made my change, instead of a normal `git commit -a -m "These are my changes"` I ran a `git add FILENAME` and `git commit --ammend` to [fix up your most recent commit](https://www.atlassian.com/git/tutorials/rewriting-history/git-commit--amend/).
> It lets you combine staged changes with the previous commit instead of committing it as an entirely new snapshot. It can also be used to simply edit the previous commit message without changing its snapshot.
And yes, it’s pretty awesome. Use it wisely.
**Categories:** How To
**Tags:** coding, command line, development, git
---
### [Custom Excerpts Read More for Genesis](https://halfelf.org/2015/custom-excerpts-read/)
**Published:** September 28, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding in 'read more' for a custom excerpt on Genesis.
**Content:**
I nearly always make a custom excerpt for every post I write. This has the benefit of letting my lede be extended into a great sub-headline. It has the downside of killing my ‘Read More’ links.
The objective is simple. Have a custom excerpt *and* a read more link. The problem is that there are multiple excerpts and WordPress handles them all in different ways.
1. The teaser – This is what you write in a post and end with a `` tag.
2. The automatic excerpt – This is the first 55 words of a post.
3. The custom excerpt – This is what you put in the ‘excerpt’ box on a post.
Those are parsed in reverse order, so the custom excerpt is given the highest priority. That means in order to show my read-more links, I need to put this in my theme’s `function.php` file:
But. I’m using StudioPress’ Genesis theme. This means I’d like to take advantage of some of the awesome accessibility friendly features so that my read more link looks like this:
Okay, cool. How do I do that? Back in the old days, this was how you’d edit the link for Genesis:
As of Genesis 2.2, we’re into a world of properly accessibility friendly code, and the function `get_the_content_limit()` has a major change where it calls `genesis_a11y_more_link` and that is the function that added in the span for the screen-reader, which requires me to add in the `genesis-accessibility` theme support for my theme.
And as far as it goes, that’s perfect. It makes sure everything matches nicely and is accessibility friendly. But it doesn’t take care of my custom excerpts. For that I need a force command:
If there was an `genesis_after_entry_excerpt` sort of function to hook into, I’d be happier, but this works. It puts a *\[Continue Reading\]* paragraph at the end of each of my excerpts for my front page, my archives, and *not* my individual pages. This helps my readers who are, perhaps, not always as aware as they might be about where to click.
**Categories:** How To
**Tags:** coding, themes, wordpress
---
### [Mailbag: An Appropriate Solution](https://halfelf.org/2015/mailbag-appropriate-solution/)
**Published:** September 25, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Be prepared for what you're getting into.
**Content:**
Y’all know I don’t really like to answer these questions. I mean. Presumably you’ve noticed I don’t answer this a lot anymore?
[I don’t care if you use Multisite](https://halfelf.org/2014/dont-care-about-multisite/). And I hate this question because you’re (innocently) asking me one of the most incredibly complicated questions possible.
> I’m working with a college who wishes to create a portfolio system for their students. Basically, a student can create their own website – or multiple – to share with employers and others. I’m thinking WP Multisite may be a good option. I could have super admin access, the college’s admin can have super admin access, and each student will have admin access to their individual sites. Would you agree that WP Multisite would be an appropriate solution?
I agree it *can* be *an* appropriate solution.
I will never agree it’s *the* solution.
Read the post I linked to above, will you? The one that explains exactly why this is such a damned hard thing to answer.
Now. Ask yourself this:
1. Are those students the people who will be happy where they can’t install a plugin or a theme, or will they badger you endlessly to install them?
2. Will those students ever want to easily export/move their sites?
3. Will they ever need ‘more’ than WordPress and, thus, need shell or DB access?
4. What do you want them to be able to do when they’re done?
5. How much time do you have to fix their sites?
6. Are you able to review and ensure security for all plugins and themes they may want?
7. Do they already have webhosting? (Most universities give you some.)
Figure that out and you’ll know if it’s the most appropriate solution for them and you.
**Categories:** How It Is
**Tags:** mailbag, multisite, wordpress
---
### [Stupid Easy](https://halfelf.org/2015/stupid-easy/)
**Published:** September 23, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Who are you writing your code for? How will they use it? Do they need simple or complex?
**Content:**
> You have made yet-another stupidly easy plugin. I love it!
My buddy James said that after testing a plugin I wrote for WordPress that has no settings.
Frankly those are my favorite plugins, the ones where you install them and walk away because they do one thing, they do it well, and you’re done.
A plugin without options means it does the one thing, I don’t have to decide how I want it to work, and it just goes. Now, at the same time, a black box plugin with no information can be complicated and tricky, which means you have to sit and make the decisions thoughtfully at the beginning.
The first question I ask is “Who is it for?”
I love W3TC, but dear god is it complicated. It’s doing a lot of things and while it does them all very well, it’s hard to understand what all the settings mean and how they all need to work together. When I set about adopting a Varnish plugin, it was picked by my coworkers specifically because it was simple and it worked the majority of the time. Can you break it with other plugins and themes? Sure. That’s the nature of WordPress interoperability. But at the same time, it works without user interaction.
That was the key, we felt. A plugin that just runs, no user interface needed, just let it go. This was simple, this was easy, and this was direct.
Since then, I’ve added in two ‘options.’ One is the ability to define your true IP address. This is for people who are behind proxy services like CloudFlare. The way a Varnish purge works, is it sends a command to the domain name. If your domain is handled by CloudFlare’s servers, then it gets messy. The second was a ‘purge all’ button on the toolbar, which let you manually flush the entire site.
Those two settings are hard and easy to access. The defining the IP can only be done via editing your `wp-config.php` or via command line. Why? The majority of people don’t need it. It’s actually often a latency issue when you cache a cache with a proxy, so it’s not really the best idea in the first place. The purge button is limited only to the admins of a site, because they’re the only ones who should be flushing the cache for an entire site anyway.
Does this work for ‘everyone’? No. No it doesn’t. Of the 6000 people who like it just fine, there are about a dozen who want things differently. They want a settings page, where they can allow more people to flush cache and define the IP. They want a per-page flush button. They want better error reporting.
I’m with them on the last one but the others… well it’s interesting. Adding more complications will certainly expand the usability of the plugin, but is that the goal of *this* plugin? No. In many ways, it would be much better to make a second, different, plugin. Maybe an add-on. Call it “Varnish Advanced” for those people who need more power.
But the majority need the simple because I knew my target audience were the people who didn’t know or want to know the technical stuff. I handed them a plugin that works in the majority of use cases. I made sure it handled the majority of situations. And I made it so they could just install and walk away.
I do agree that it needs a little better error reporting, but even that has to be handled carefully. You can’t just hand an end-user an error without simultaneously giving them a direct way to correct it. And no ‘Talk to your host.’ is not a fix. A fix means the user can do something (hopefully simple) to correct a problem. Now, my ‘edit the `wp-config` file’ fix is not super simple for everyone, but at the same time it serves an important purpose. It makes someone think about how big a change is and what it means.
Knowing my users means I know they need that stop to think, and it means I know they *will* think.
**Categories:** How It Is
**Tags:** design, development, essay, wordpress
---
### [HTTPS and WordPress](https://halfelf.org/2015/https-wordpress/)
**Published:** September 9, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You can set up HTTPS on WordPress smartly or less smartly. Let's be smart.
**Content:**
Really there’s a right way and a not-quite-as-right way to handle HTTPS on WordPress. It’s not that hard to do, and if your whole site is going to be HTTPS, then the easiest way is to change your home and site URLs to be `https://example.com/` and put `define( 'FORCE_SSL_ADMIN', true );` in your `wp-config.php` file. Then you should (if this is an existing site) search your database for the old HTTP url and change that to HTTPS.
Seriously, that’s it. That tells WordPress to be HTTPS all the way and you’re done. Of course, that doesn’t actually work 100% for everyone, because there are some silly plugins and themes that do things like this:
The problem there is they’ve defined the script as HTTP and if your site is HTTPS then you’re going to get mixed content messages. And the real issue here is that means your connection is only *partially* encrypted! That non-encrypted content is accessible to sniffers and can be modified by man-in-the-middle attackers. This, clearly, is not safe anymore. The right way to do your enqueues is with protocol relative URLs:
Alternately you can just use the HTTPS url, because that won’t break HTTP visits and it won’t make anything *less* secure.
But. Since you really can’t go in and edit all your themes and plugins, the plugin [WordPress HTTPS](https://wordpress.org/plugins/wordpress-https/) is the way to go. That can force everything around. I know it’s not updated in a long time, but it still works. I keep thinking I’ll fork and clean it up… Well in my free time. The point of that plugin is that it lets you force everything to HTTPS, and will rewrite things on the fly. It’s a good idea.
Instead of using the plugin, I’ve seen a lot of people do this in their `.htaccess`:
In and of itself, this isn’t wrong. This forces everything HTTP to redirect to HTTPS. The problem is you’re still actually sending data from WordPress over HTTP *first*, and you’re right back to opening up to man-in-the-middle attacks because the data from WordPress goes from HTTP first and that’s, say it with me kids, insecure!
Now that said. This should be okay for most things. The POST calls should be sent securely, and all you should see on the return end is everything after that 301 redirect, but we can’t be absolutely sure about this. My buddy Jan [used mod\_substitute to force HTTPS](https://blog.dembowski.net/2014/better-ssl-with-mod_substitute/) (back before he moved to nginx). His code looks like this:
In doing this, he doesn’t need to worry about the HTTPS plugin I mentioned, because it forces everything with a `src` attribute to be protocol relative. He also doesn’t have to search/replace his content if he doesn’t want to, which makes switching *back* easier. If you wanted to do that. But as Jan pointed out to me, he switched to nginx because it’s easier and supports variable substitutions.
Should you use .htaccess or nginx to force https instead of a plugin? That’s totally up to you. I use the plugin since I trust it to only mess with WordPress and not anything else I may have lying around. Also since my domains are often more than just WordPress, it’s a little easier for me to segregate their control. The flip side to this is that WordPress doesn’t redirect http traffic.
By this I mean if you turn your whole site to HTTPS properly, you can still go to `http://example.com/this-is-a-page/` and WordPress will load it *as* HTTP. This is and is not a bug. WordPress is (properly) trusting your server to tell it what it should be. Your server is saying “Be HTTP or HTTPS! Whatever!” Now there *is* a trac ticket to have [`FORCE_SSL` really force SSL](https://core.trac.wordpress.org/ticket/28521) but that’ll be a while because there are a lot of complications in that change.
So yes, for now, I would use `.htaccess` to add an extra later of SSL forcing, but with a bit of caution. If you’re proxying HTTPS (like you’re on a Varnish cache behind something like Pound or nginx) then you may need to use this code for your .htaccess redirect.
The reason for this is Apache can’t always see SSL if it’s not in charge of it (because it’s proxied or handled by a load balancer), and to teach it where it really lives. The trick there is the code I just showed you may not be right because every server’s a little different. There’s a great [StackOverflow post on the problems of redirect loops while forcing https](http://stackoverflow.com/questions/18328601/redirect-loop-while-redirecting-all-http-requests-to-https-using-htaccess/) that you should read.
Good luck, and safe HTTPSing!
**Categories:** How To
**Tags:** domain, security, wordpress
---
### [On Site Advertising: Affiliates](https://halfelf.org/2015/site-advertising-affiliates/)
**Published:** September 7, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Basically I'm really bad about these.
**Content:**
*This is related to a series of reviewing on-site advertising I have used: [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/), [Google Adsense](https://halfelf.org/2015/site-advertising-google-adsense/), [WordAds](https://halfelf.org/2015/site-advertising-wordads/).*
So what about those affiliates?
Affiliates are simply links to other sites that earn you money because, after clicking on your link, they buy something. And in my experience, they are never going to be the big money earners.
I’ve used the following, in no particular order:
- Amazon
- [StudioPress.com](http://www.shareasale.com/r.cfm?b=346200&u=728549&m=28169&urllink=&afftrack=) (themes)
- [Easy Digital Downloads](https://easydigitaldownloads.com/?ref=3359) (ecommerce solution)
- [Sucuri](http://affl.sucuri.net/?affl=80318fc21285587a2b6888eaabdb28fb) (site security)
- [Liquidweb](http://www.liquidweb.com/?RID=JFO123) (web hosting)
- [Namecheap](http://www.namecheap.com/?aff=32035) (domains)
- [Utility Pro](https://store.carriedils.com/downloads/utility-pro/ref/8) (theme)
All those links are affiliate links, by the way.
Unless I’m making a post that has a direct link to them, like I’m discussing them specifically, they don’t get a lot of traffic. The problem is, like ads, where do you put affiliate links for the best traction?
In a weird way, links like those are why spammers spam links. They trust people will click on the random links and buy a product. If you turn your affiliate links into banner ads, then you can be more successful, but now you just have more and more cluttering up your site.
This is pretty much why I suck at them, though. I don’t enjoy marketing. I hate the push of sales. The way I buy things is I look around, I ask around, and I test. I know what features I want and, if I don’t, I actually do ask people for help understanding them.
I’ve read multiple essays on how to effectively be an affiliate, and the advice boils down to what [CopyBlogger says](http://www.copyblogger.com/smart-people-affiliate-marketing/) about being honest and authentic.
But I do reviews rarely, which means affiliate links are just these links that sit around and look link ‘powered by’ links, which they really are. I will say that I don’t have an affiliate link for anything I don’t use.
**Categories:** How It Is
**Tags:** advertising, review, website
---
### [CDN vs Local](https://halfelf.org/2015/cdn-vs-local/)
**Published:** September 21, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The ultimate answer is "I do not know."
**Content:**
Which is better?
I have no idea.
Sorry. That’s not the end of the post, obviously, but really after the time it took to write this, my answer is that I really don’t know. So let’s talk about why I don’t know.
The claim is this: “A CDN is faster!” The idea here is that a CDN will be faster because it lessens the load on your server. Anything that’s being process by another server means less work yours has to do. And that is totally true. Also, many CDNs have worldwide locations, which means someone in India can download your cat video from a nearer server than yours in Michigan. Also, more people have downloaded shared resources (like Google fonts) so it won’t be downloaded again, making their experience faster.
And all that sounds great. But the actual functionality and performance gains are not going to be exactly tit for tat. At first, I thought that since I get a lot of traffic in Brazil, having a CDN that has local servers would be great for them. It was. A little. But it was a *lot* worse for me. Using my site in the US slowed down measurably. This was because of the latency of the CDN being worse than my own server.
In addition, many site speed tests measure how many URLs you call in your page. Using a CDN ups that by one. It’s minor, but it’s something to consider. There’s also the idea of branding, which a CDN can hurt if you use it wrong (most CDNs will allow you to use cdn.yourdomain.com of course). Using too many servers for a CDN (think of it like `cdn1.example.com`, `cdn2`, and so on) can slow down the user experience too and cause overhead with all the DNS lookups.
What’s the alternative? Good caching. And I do think that proper, server side caching is hugely important. But at the same time, the right network for your static files can provide significant improvements. Which is why we always end up back at CDNs.
The real thing to consider is what your content is on that CDN. WordPress is dynamic content and shouldn’t be on a CDN. Images and stylesheets, though, those are perfect for a CDN. You take the traffic and, thus, the load off your server and it becomes faster. Streaming video too.
Which brings us around to the idea of the cloud as a CDN.
But is it *faster*? Is it better? Is it safer?
Maybe. It certainly can be, but there is no blanket perfect answer for all of us.
Currently I build local but prepare for the possibility of a CDN later on.
**Categories:** How It Works
**Tags:** design, essay, hosting
---
### [Mailbag: Curbing Comments By Count](https://halfelf.org/2015/curbing-comments-count/)
**Published:** September 18, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I do moderate. And I use tools for it. So can you!
**Content:**
Someone had a rant in my mailbox about my strong stance on comment moderation, which can be distilled to this question:
> I noticed you really have strong opinions on comment moderation. Do you use anything other than bad words to flag for moderation or outright block?
Sure do!
I’m very careful about ‘bad words’ since ‘anal’ will also pick up ‘canal’ and I only moderate for for things that are generally only used as a pejorative. Example? Okay, I have ‘dyke’ and ‘kike’ in my mod list. The first one I get called a lot. Still. The second has fallen out of favor. But because people have a remarkable talent to say words with the sole intent to be hurtful, even under the veneer of “I was just being funny, stop being so sensitive!” I have cherry-picked the popular ones on my sites and tossed them into moderation.
The only thing I blacklist are people. People’s emails (and user names sometimes) go into the blacklist. That’s why I wrote [Sitewide Comment Control](https://wordpress.org/plugins/sitewide-comment-control/), I’m able to blacklist people from the whole network easily. But I only use this for people. People should be blacklisted when they prove themselves to be untrainable.
That leaves one thing up in the air and that’s moderation. You have three choices with default WordPress: Moderate all, moderate un-approved, moderate none.
I have “moderate un-approved” which means I have to manually approve all first time comments. To add on to that, I use [Comment Probation](https://wordpress.org/plugins/comment-probation/) in order to restrict people I’m not entirely sure about.
And finally, I moderate by length.
I month ago, I mentioned on Twitter that I was playing with an idea to have my comments moderated by length. If a comment was over X words long, it should be flagged as needing approval before showing.
Caspar Hübinger, in the time it took me to get a cup of coffee, wrote [Comment Moderation by Word Count](https://github.com/glueckpress/comment-moderation-by-word-count/). I made one, small, patch to it, and I’m using it now.
> This simple WordPress plugin will send any comment that would otherwise be approved automatically by WordPress to the moderation queue if it contains more than a given number of words.
The theory I have is this: If your comment is over a certain length, you really may want to consider making it a rebuttal blog post of your own. My limit is currently set to 250 words here, which is half a page of content.
[](https://halfelf.org/wp-content/uploads/sites/2/2015/09/moderation.png)
My one change was this:
> If `current_user_can( 'edit_posts' )` then they should be able to leave a comment of any length without moderation.
My theory here was that admins and editors are trusted users.
And now you know!
**Categories:** How It Is
**Tags:** administration, mailbag, plugins, wordpress
---
### [On Site Advertising: WordAds](https://halfelf.org/2015/site-advertising-wordads/)
**Published:** September 2, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** WordAds, while a beta product, was just not usable enough.
**Content:**
*This is part of a series of reviewing on-site advertising I have used: [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/), [Google Adsense](https://halfelf.org/2015/site-advertising-google-adsense/), [WordAds](https://halfelf.org/2015/site-advertising-wordads/).*
My experience with [WordAds](https://wordads.co/) has been a little spotty. In terms of revenue, it’s far superior to ProjectWonderful. That said ProjectWonderful (and Google Adsense) have some aspects that make WordAds less than attractive.
I used WordAds for about 13 months, and while I loved the plugin they made, and I loved the support, the problems I have are with the system and the quality of ads. I want to stress that this is a ‘review’ of their beta product. I knew what I was getting into with a beta, but there were issues with the system that went beyond what I’d normally accept for a beta.
A beta is expected to be functional and usable if buggy. WordAds was functional, but I had no control and no information, which made it unusable.
I had no control over ad placement, which normally I would say is the ‘fault’ of the plugin, but in reality it’s clearly the decision of the service. It provides two ads: one below the first post on an archive page and one below the post content itself on a single post. The ads are exactly the same shape. Most of the time this is fine. On some of my sites, which use ‘non traditional’ layouts, it made them very, very janky.
Additionally I have no control over what ads show. The default ads tended to lean towards ClickBait. I don’t like that, but it’s pretty minor since default ads always kinda suck no matter what system you use. Still, I couldn’t pick and close ads I found offensive. The winner for this service is Project Wonderful. For WordAds I had to right click, get the information of what had loaded, and send that in to get it blocked. Given that most users just say “Did you know you had a Rand Paul ad on your site?” this was impossible to manage for me.
When I combine this with the lack of information … Here’s the ultimate reason I called it quits. There’s no dashboard. There is no way for a user to see analytics. I had no way see what ads are doing well and where which means I could never evaluate the impact of them on my layout. Like many professionals, I review SEO impact and ad displays. I couldn’t do that at all on WordAds to the point that they had to email me a report of my earnings.
I was told the manual emailing of revenue was a temporary stop-gap while the new system was put in place. Six months later, not only was I still getting emails, but I actually didn’t get one for a month and had to politely ask someone on staff. They were, as always, totally awesome about it, but I felt the underlying current was they too were feeling the strain of a lack of automation. It felt like there was no managerial and resource investment in what should be a killer product.
Having earnings be a black box is a crappy user experience. Having analytics be a ‘just trust us…’ world is useless if I want to improve my site quality and revenue. I’m all for set-it-and-forget-it (which is ironically why I love the plugin), but the user experience for the service itself was disheartening.
## Review
- Ease of Registration: 4/5
- Ease of use (on WordPress): 5/5
- Ease of use (non WordPress): 0/5
- Customizable: 0/5
- Control: 1/5
- Analytics: 0/5
- Revenue: 3/5
When they get out of beta, I may check them out again, but right now I don’t feel comfortable having my eggs in an invisible basket.
**Categories:** How It Is
**Tags:** advertising, review, website
---
### [On Site Advertising: Google Adsense](https://halfelf.org/2015/site-advertising-google-adsense/)
**Published:** August 31, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The grand pappy of all ad networks still holds up.
**Content:**
*This is part of a series of reviewing on-site advertising I have used: [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/), [Google Adsense](https://halfelf.org/2015/site-advertising-google-adsense/), [WordAds](https://halfelf.org/2015/site-advertising-wordads/).*
[Google Adsense](http://google.com/adsense/) is the grand daddy of ad systems, and if you can use it, it’s got the highest rewards. In the last 3 years, they’ve streamlined and upgraded and made the system incredibly nice to work with.
I stopped using Adsense for the 3 years prior to this experience because I was frustrated with the lack of control. That’s far less the case today. You can now allow and block ads far more granularly than before. You can blacklist specific domains or specific types of ads. While it’s a little derpy to get the URLs, I was able to blacklist some anti-gay sites right away.
Even though I still wish they’d just blacklist those people from making money in the first place (not Rand Paul, the hate sites), Google’s doing a much better job than they used to, and I feel morally better about it.
Of course, while there are a bajillion WordPress plugins for it, there’s no official Google Plugin and because of that, I don’t use any plugin. The same code I wrote up for [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/) is easily applied to how I want to use Google Adsense.
Also Adsense remains the highest earner of any revenue stream I’ve used. Their current system even includes a scorecard, updating regularly, that explains how your site is doing:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/08/google-scorecard.png)
That ‘Site Health’ score being a 4 is due to WordPress putting ‘[render blocking javascript](https://developers.google.com/speed/docs/insights/BlockingJS)‘ in the header. I’ll live. Everything else is fine.
The interesting thing about Adsense is that Google’s rolling out something new. [Google Contributor](https://www.google.com/contributor/welcome/). And if you have adsense then it’s already on:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/08/google-conributor.png)
I’m not entirely sure how it works, and I kind of want to see it be such that people can pick a site to sponsor, but the idea is a game changer I’m excited for. This alone was why I went *back* to Adsense.
## Review:
- Ease of Registration: 4/5
- Ease of use (on WordPress): 3/5
- Ease of use (non WordPress): 3/5
- Customizable: 5/5
- Control: 3/5
- Analytics: 5/5
- Revenue: 4/5
Adsense is old, but it’s aged well and Google’s treating it with love. It makes money, they appreciate that, and it shows.
**Categories:** How It Is
**Tags:** advertising, review, website
---
### [On Site Advertising: Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/)
**Published:** August 26, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Project Wonderful is really pretty awesome and has a lot of features. Now if only their revenue and style were the tops.
**Content:**
*This is part of a series of reviewing on-site advertising I have used: [Project Wonderful](https://halfelf.org/2015/site-advertising-project-wonderful/), [Google Adsense](https://halfelf.org/2015/site-advertising-google-adsense/), [WordAds](https://halfelf.org/2015/site-advertising-wordads/).*
I found [Project Wonderful](https://www.projectwonderful.com) by accident. It was linked to on some comic book and fan sites I visit. For the most part, Project Wonderful is Project Pretty Good. It’s goofy, it’s silly, and most of the ads you get are for webcomics or ebooks.
Revenue from it is also chancy at best. I average pennies a day, but I have a lot of control and I like that which is part of why my revenue was so low. I set it up so I have to approve every single ad and ad change, which is exceptionally time consuming. This also causes lower revenue, but the primary reason I like it is that control.
I can block users, I can report them for scams or bait-and-switch, and I have a very wonderful rapport with the staff there. They’ve told me before that they appreciate my reports. If I change my mind about an ad, it’s a little tricky but I can go and find it and reject it after the fact.
There’s no plugin for this ad network. You have two bits of code to put on your site, the basic Project Wonderful JS that loads their commands and then the code for each ad-block. It’s pretty trivial to make a plugin for it, and in fact I made a shortcode that allows me to run `[pwads id=name]`, where name is the name of the adbox. It’s a very basic switch check and sanitize and it works fine for me.
This code is also accessible outside of WordPress because the shortcode is calling a separate file (like `/secret/ads/projectwonderful.php` ) which I can then use with sneaky includes. But that’s another post. What must be known here is that I have it working in and out of WordPress with the same code base.
The biggest problem with Project Wonderful is that it feels like 1999. The site is old and dated. The interface is clunky and has a crappy UX if you’re on a tablet. Don’t bother with a phone.
The welcome page is pretty nice:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/08/pw-02.png)
You have links to all your ads, you can click on them for more ads:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/08/projectwonderful.png)
It’s not *bad*, it’s just dated. Also they have downtime a little more than I’d like to see. It used to be bad but now it’s once in a while. The real problem with the downtime is it makes my site slow.
## Review
- Ease of Registration: 4/5
- Ease of use (on WordPress): 3/5
- Ease of use (non WordPress): 3/5
- Customizable: 5/5
- Control: 5/5
- Analytics: 3/5
- Modernity: 2/5
- Revenue: 1/5
I’m still using Project Wonderful, but the revenue certainly is something hard to accept. I stick with it, mostly, because it’s ethically pleasing.
**Categories:** How It Is
**Tags:** advertising, essay, website
---
### [Mailbag: Chocolate Cake is a Need](https://halfelf.org/2015/mailbag-need-cake/)
**Published:** September 11, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Multisite, revenue sharing, categories as subdomains, and more in this week's mailbag!
**Content:**
Adrian in Florida has a long one! I’m going to break it up.
> I watched your presentation about “don’t use WP MU” have decided I shouldn’t use it but wanted to ask your advice on some other things. First I want to start by pointing out re the presentation:
>
> • I noticed that for the Wordpress.com network sites I noticed the WP toolbar does show on the sites giving them away as network sites except for one, Gigaom (perhaps there is a way to remove it?)
>
> • For some of us chocolate cake is a need, not a want.
No, the cake is a want. And I use that example for a reason. We can joke all we want about how we *need* the cake, but fact is this: We *need* food. We *want* treats. If we can be clear in our hearts about needs versus wants, webdev is much simpler. I don’t need coffee. I like it. I can live without it. I don’t want to and choose not to. I can blog without WordPress. I don’t want to. I choose not to. It’s very important to be clear on needs and wants and choices in life in general.
As for turning off the .com toolbar on Gigaom, I noticed when I visit there’s a blip where it shows the space for the toolbar and then it’s gone. So that suggests it’s CSS fixing itself. But the answer is “They’re a VIP customer and probably paid out the nose for that.”
> 1\. I just want to learn one theme/framework to make websites with and not change. I had already paid for Elegant Themes to get Divi which is supposed to be customizable and seems to have good video tutorials, before I saw your recommendation for Studiopress. I don’t know how to tell if I should scrap Divi and pay up again for Studiopress. Would you?
I like Studiopress a great deal. It’s secure, it’s stable, it’s updated responsibly and reasonable, and Andrea Rennick is one of my BFFs. Divi I dislike because of how they handle sessions. But whichever you use is up to you. If you want a free theme to start with, I’d pick up Theme Hybrid. Justin’s code is second to none.
> 2\. I want to be able to make each page in my Wordpress site show up under its own subdomain. I’ve tried a few plugs like “page links to” which doesn’t work. I saw that there are some plugins that do this for categories. Do you know a plugin that enable each page resolve to a subdomain otherwise do you recommend one of the category plugins over another?
This stems from his URL design which is `page.example.com` and … I just wouldn’t. It’s a waste of time and effort and locks you into a categorization that will be insane to unroll later.
Now as a category that’s less weird and you can try one of these plugins:
- https://wordpress.org/plugins/subdomains/
- https://wordpress.org/plugins/main-category-as-subdomain/
- https://wordpress.org/plugins/wp-subdomains-revisited/
I still wouldn’t use Multisite unless you really enjoy logging into a separate site for each post and not having an easy way to cross reference.
> 3\. Is there a plugin out there that allows different people to receive ad revenue for their posts? We have two different writers for one website, each should get ad revenue related to each’s own posts on the same website.
This is actually why I bothered to answer. This is a cool question and I had no idea at all when I first read it.
Turns out, *yes* you totally can have separate ads per author. If you’re using Google AdSense (you didn’t say), then try [Multi Author Adense](https://wordpress.org/plugins/multi-author-adsense/), which looks like you could set the code per author. There’s also [Revenue Share](https://wordpress.org/plugins/revenue-share-plugin-for-authorsrsp/) which may be a little simpler.
Good luck!
**Categories:** How To
**Tags:** advertising, mailbag, plugins, wordpress
---
### [Cookie Free Domains and CDNs](https://halfelf.org/2015/cookie-free-domains/)
**Published:** September 16, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Messing with static locations for static things on a website.
**Content:**
After I [dropped Cloudflare](https://halfelf.org/2015/cloudflare-ends-weirdly) I went back looking at other ways to speed up my site and what could I optimize things. As I mentioned in [Static Content Subdomain](https://halfelf.org/2015/static-content-subdomain/), one of the benefits of that mess was to allow me to have a cookie free domain and, in having a cookie free domain, I basically made a domain that could be used as a CDN for my (mostly) static files.
It was noted then that, if you’re a [non-www person](https://halfelf.org/2012/dont-use-www/), you have to actually use a separate domain. I do. I hate www in URLs. So I picked up a free domain for the site where I’m doing all this: `ex-static.com`. I probably could have gotten it even shorter if I’d tried `sitecdn.net` but that was short enough for me.
Since I already had everything over at `/home/user/public_html/static` I created an add-on domain in cPanel and told it to use that as its home.
Then I ran a search/replace on WordPress:
`wp search-replace static.example.com/wordpress ex-static.com/wp-content/uploadswp option set upload_path /home/example/public_html/static/wp-content/uploads`
Since I’d already changed my media settings, that was all I needed to really run a replace. It changed my media settings too! Since I was planning to move my static content, not just images, I changed the path too, so I had to go back and change `upload_path` as well, but wp-cli is my friend.
Next up, because of the static content move, I copied my `wp-content` folder over and added this to my `wp-config.php`:
Boom. Everything’s where I want it.
Sadly, it got messy for MediaWiki and ZenPhoto. The later doesn’t allow you to move your themes folder at all so I made a symlink to `/home/example/public_html/static/themes/themename/` and called that a day. MediaWiki was a damn dirty lie.
Supposedly you can set this:
As soon as I did that, I got errors all over the place and had to change the directory path back:
Weirdly named, `$IP` is set as follows:
I did the same thing as with ZenPhoto and made a symlink then I could change the style directory.
Lastly (and this was last for a reason) I changed my `.htaccess` rule:
This was last so that I could not break things mid-flight. And I added in this:
Everything works as expected. And? I have cookie free domains and I’m ready to move all my data off to a CDN whenever I’m ready for that step. The CDN would only have to cover the `ex-static.com` domain, to boot!
**Categories:** How To
**Tags:** cdn, development, essay, hosting
---
### [CloudFlare Experiment Ends Weirdly](https://halfelf.org/2015/cloudflare-ends-weirdly/)
**Published:** September 14, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** After five months of CloudFlare, I've turned it off. Unsatisfied.
**Content:**
I ended up turning it all off for one reason only.
I keep getting a 522 error on cloudflare.com.
Now. I have a working theory that it happens when I’m hitting my own site a lot (be it for development or as recently, a lot of traffic I need to reply to), but what would happen is I got an error 522 on my sites. So I’d go to cloudflare.com to whitelist my IP, since their explanation of “This means your site is down” was wrong (site was up, I was ssh’d in at the time), and I’d get a 522 on cloudflare.com.
Let me roll back to August 1st.
That night I went to make some changes on my site to the CSS and, instead of turning on Dev Mode in CloudFlare, I did my thing with Git, pushed my changes, dumped the cache of that CSS file, and was prepared to smile at my glory. Nope! I got a 522. This was odd, since I was currently on the server via SSH and the load on the box was 0.3. Naturally I went to `support.cloudflare.com` to try and see if I’d missed some directions only to get a 522 there as well.
Track that for a second. I got a 522 on CloudFlare’s domain.
The possible answers I could come up with, since I couldn’t read any of their documentation, as either my IP was blocked or the cache server I was proxying through was down. Since I could log into the dashboard for my accounts, I went in and tried to guess how to whitelist my IP. I couldn’t find that, so I opened a support request:
> I can’t access support.cloudflare.com because of 522s. My IP is 172.249.156.169 – Is there any way I can get whitelisted?
I got reply that it was the wrong place to ask, which I don’t think was correct. One of the solutions (per a Google cache of the support page I couldn’t access, hello) said that you could whitelist your IP to see if that helped. Cool. Except I couldn’t get the part of the page to load that told me where and how that was set.
So I asked for support with the dashboard via the dashboard support panel. Instead I got someone telling me I had to open a new ticket. And he was incapable of transferring my ticket or saying “Hey, you can’t access the right support place, let me make a ticket for you! Sorry about that.” It was akin to telling me to email them to tell them my email was down.
I fumed. And then I kept clicking until I found the place to enter my IP. I did and magically CloudFlare started working for me! I quickly went and opened a ticket to complain that I couldn’t have a ticket transferred (or made for me), and suggested this:
> If someone’s logged in via the dashboard and they’re getting a 522 on ALL Cloudflare sites, it’s a logical assumption that something blocked them. But if I can log in, the odds are I’m really me, so that should get an auto-whitelist. If that isn’t possible, can it be detected and alerted? “Hey, we noticed your IP is blocked. Would you like to white list it, since you’ve logged in we can be reasonably sure you’re not an asshat?”
They replied with a standard ‘A 522 means…’ and told me to whitelist their servers on my server firewall. For some reason the email didn’t get to me, so I made a new ticket.
In this ticket, I had to wait until I got another 522 (end of August) and when I sent in my error ID and a screenshot, I was told this:
> This was a timeout between our cache server and the origin server that hosts support.cloudflare.com.
I think he actually meant “Our cache server was down.” because at that time I couldn’t get to *any* CF hosted site until I rebooted my router and got a new IP.
I don’t *really* buy this, though, and I think their IP block is too aggressive. I would run into it all the time when I was at a hotel. I’d be reading comments on my own sites and get blocked. And every single time I got blocked, it was from all of my domains and `cloudflare.com.` Sketchy as hell to me.
When I added in the problem that ‘always up’ actually meant if your site was down they’d put up a CloudFlare page to apologize for the site being down, I decided to turn it off. It clearly wasn’t helping me as much as I’d hoped.
This isn’t to say CloudFlare is terrible and you should never use it, just that it proved to be too frustrating for me to want to use.
**Categories:** How It Is
**Tags:** cdn, development, servers
---
### [It's Not Beer It's Homebrew](https://halfelf.org/2014/its-not-beer-its-homebrew/)
**Published:** May 21, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Homebrew installs the stuff you need that Apple didn’t.
**Content:**
If you’re a rookie getting your hands around all this webdev stuff, and you’re on a Mac, you may have already come to a rude awakening when you find out that, for reasons unknown to man, Mac decided we didn’t need wget.
That’s how I was introduced to Homebrew.
I love wget, because it’s a super simple and fast way to download something. `wget http://wordpress.org/latest.zip` is the fastest way for me to download a zip, and I use it regularly. So one day, when deving code, I realized I needed a plugin. I went to wget it and got a horrible message.
`-bash: wget: command not found`
After searching around, I was about to download, compile, and install wget when a comment on StackExchange said “Try Homebrew.”
Everyone’s dersive comments aside about how ‘real’ programers don’t install packages (seriously people), I said to myself “Ipstenovich,” I said. Yes, I call myself that sometimes. “You use yum to install packages on your server because it’s easier and safer. Why wouldn’t you use the same thing here?” Over to I went and stared at the installer command like a fish.
The call ‘ruby -e’ means “run Ruby and tell it to call this URL externally…” And then it clearly was calling github for an installer. It’s tough to decide to trust a new program but after some serious banging around, I trust the Homebrew.
Once installed, which doesn’t take long at all, I ran the check `brew doctor` which told me a couple things:
1. I’d installed SVN and Git on my own (truth) so I needed to change my .profile (with directions how)
2. I had a half-baked attempt at installing ImageMagick that needed cleaning (with suggestions how)
3. I had MacPorts still in my /opt/ folder, that needed removing (with directions how)
4. I needed to install xcode command line tools (with directions how)
5. xQuartz was out of date
6. I hadn’t updated my brew list in a bajillion years
Most people won’t have that last one. I did once have an older install of Homebrew that I’d never really cleaned up. However the other ones took me about an hour to clean up properly, because I was watching Fargo (the movie) at the time. Once installed and set up, I was able to install wget and upgrade it. Ditto OpenSSL (because Heartbleed, you know). It’s great.
Homebrew is pre-1.0 which means there can and will be issues. Don’t panic, for most of what anyone needs, this is perfect. It’s also good at upgrading when you need to:
The little beer mug is awesome.
One of the nice things about Homebrew is that it doesn’t use (nor advocate the use of) sudo. This is really good for security and makes me feel much safer.
Go forth, rookies, and install Homebrew! It will make your development much happier!
**Categories:** How To
**Tags:** macintosh, open source, software
---
### [Mailbag: Finding A Rogue WordPress Setting](https://halfelf.org/2015/finding-rogue-wordpress-setting/)
**Published:** September 4, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Don't make settings changes without reading what they do!
**Content:**
After helping someone track down a weird WordPress setting, he asked the logical question:
> How did you even find that!?
The issue was that a person was missing the menu option to edit their themes. I asked if they were *also* missing the menu option for editing plugins. As soon as he said yes, I knew it had to be the define to [disable the plugin and theme editor](https://codex.wordpress.org/Editing_wp-config.php#Disable_the_Plugin_and_Theme_Editor):
`define( 'DISALLOW_FILE_EDIT', true );`
That literally says “No editing files!” So we looked first in the `wp-config.php` file for it and came up empty. Now as much as we yell at people for editing `functions.php` or at themes for creating a mess of settings that aren’t needed, I knew the fastest way to find it was this:
And as expected, that gave me a file: `./wp-content/plugins/ninjafirewall/lib/firewall.php`
Since we had wp-cli, I opened that file and looked for the term:
Then I ran this: `wp option get nfw_options`
If you don’t have wp-cli, just pop into the database and look at the option value for `nfw_options` — either way you’ll see this:
I’ve snipped out a lot of the data, but you can see that `disallow_edit` is set to `1`.
We had the user change that setting. Imagine that. It worked!
The moral of the story? Don’t make settings changes without reading what they do!
**Categories:** How To
**Tags:** debug, plugins, wordpress
---
### [Mailbag: Headers Already Sent](https://halfelf.org/2015/mailbag-headers-already-sent/)
**Published:** August 28, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** In which I digress when talking about headers already sent errors.
**Content:**
Yasha from Russia asks for guidance!
> Hi I was searching on ways to resolve get header error in WP and saw your posts, which helped a chap with his website. I am a total beginner and having a nightmare with a divi template I am trying to upload. I have tried a ton of solutions on line and nothing worked. I would be grateful if you could provide me with some guidance. Unfortunately I am not in a position to pay you, but should our path cross I would be happy to offer you a few fine Belgian beers. Thank you in advance
I don’t drink beer (I can’t stand fizzy drinks, I know, it’s tragic).
I have to preface this with the honest truth. I hate Divi Templates. I’ve reached out to them under my company hat a couple times, never heard back, but I cannot stand their theme because of the first line in `header.php` for every single theme I’ve ever seen from them.
Pardon me while I rage flip a table.
Why do I hate this? Sessions aren’t friends with caching. A session is used to store information for a user and have it accessible across all the pages of your website. Cool, right? The problem is a session is also saying “*This* user gets unique content and should have a unique experience.”
Which kinda tells caching, and specifically Varnish caching, to take a long walk. [WPEngine doesn’t allow you to use them because of that](http://wpengine.com/support/cookies-and-php-sessions/).
But all that aside, how *do* you debug that Headers Already Sent?
1. Turn on `wp_debug`
2. Read the error
3. Kill the plugin (or theme) causing it
I hate to say it’s that simple, but it usually is.
That error means the problem is in the theme *applesororanges* and you check by swapping themes.
When you get around to these, it’s a bit messier:
The bit in ‘output started at…’ is a wp-includes folder! It’s unlikely core has bad code, so here you have to turn off *all* the plugins and switch to a default theme. There’s a reason that’s the way we debug, by the way. It’s hands down the fastest way to see if it’s you or not.
If turning off all the plugins fixed it, great. Now turn them back on, one at a time, until you break it again.
Remember! Sometimes it’s the combination of the plugins and theme that caused the problem, so be ready to pick a second best theme or plugin.
**Categories:** How To
**Tags:** debug, mailbag, wordpress
---
### [Don't Use WordPress MultiSite](https://halfelf.org/2011/dont-use-wordpress-multisite/)
**Published:** September 22, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** There's a time and a place for everything and that's WordPress. But there isn't just one perfect answer to all things! If you use MultiSite, you should be doing it for the right reasons.
**Content:**
*Edit: It’s May 2015 and this post is **still** relevant.*
*I talked about this at WordCamp SF 2013. Check out my [slides](https://helf.us/wcsf2013/ "WordCamp San Francisco – Don’t Use WordPress Multisite") or watch the [video](http://wordpress.tv/2013/08/01/mika-epstein-dont-use-wordpress-multisite/ "WCSF Video: Don’t Use WordPress Multisite").*
I love MultiSite. I think it’s awesome and very helpful when you want to make a network of sites. But more and more I see people doing things where I just tilt my head and wonder *why* they’re using MultiSite for that particular use-case. People seem to think that simply **because** they can use MultiSite that they **should** use it, and this simply is not the case!
MultiSite, either by intention or effect, works best when you think of it as running your very own version of WordPress.com. You have a network of sites that are *disconnected* from each other, data wise, but share the same available user base. That means the only ‘information’ that is shared between two sites is your user ID, and even then, unless you’re explicitly granted access to the site, you’re nothing more than a subscriber. Which is to say you can read the site, and comment.(You could get nitpicky here and point out that there are a lot more things one can do as a subscriber on a site, but you understand the gist.) That means that while there are many perfectly valid reasons for having a MultiSite, it will never be a perfect solution for all people.
One of the best alternatives to MultiSite is Custom Post Types. They let you make ‘subfolder’ additions to your site and format them as you want. There is a drawback, though, in that you cannot use YYYY/MM/DD in your permalinks for them ([Otto on Custom Post Types – wp-testers email list](http://lists.automattic.com/pipermail/wp-testers/2010-May/013010.html)) however I would wonder why people use that anyway these days? The only reason I use YYYY in my URLs is that I believe there’s a date on the usefulness of these posts, and if you come back in five years, you should know how old the information is.
Another alternative is good planning. If you sit down and define your needs for your site **before** you build it out, and plan for the growth you desire, a lot of things become clear. Think about how many different places you’d want to go to maintain your site.
Here are some examples of sites that *should not* be built out as MultiSites:
**To Categorize Posts**
This one comes from my girl, [Andrea](http://ronandandrea.com "New Plugin – WP Grins SSL"), who reminded me of a fellow we ran into who wanted to have one site to post from, and each post would go to a special site based on the category. WordPress *already* has that built in! It’s called, get this, ‘categories.’ Now the user in question said he didn’t want categories because your URL shows up as /category/pemalink, and that wasn’t his desire. So I suggested Custom Post Types. /posttype/name was much better, and he could add in tags as he wanted.
**When Your Site is Homogenous**
Do you want your whole network to look and feel 100% the same? Don’t use MultiSite. If every single subsite is going to be exactly the same, except for content, but the content is all written the same way, you don’t need MultiSite. Replicating the theme and settings on every subsite is a pain, and you can achieve the same result with categories, tags and CPTs. You can even use a membership plugin to control who sees, and has access to, each CPT!([Role Scoper](http://wordpress.org/extend/plugins/role-scoper/) claims to do this, in fact.)
Now someone will point out that this site fails that check! If you notice, three (four, kind of) of the sites look very similar. Same general layout, same links and sidebars, but different headers. This site could have all been done as categories and CPTs, and not needed the multisite until I hit on the children sites like the one for my grandmother. But. When I built it out, I decided to put my tech posts on their own page to separate the writing. They **are** separate sites. What I write here is vastly different from my blog, and that’s important to me. The site has the same ‘feel’ in look alone: the context is what separates us.(And I have a plan for the photo blog.)
**For One Special ‘Thing’**
I’m guilty of this one. I had a site that was a blog, and I wanted to make a ‘video’ section. So I made a MultiSite! Boy was that dumb. Two admin areas, two sections for layout, and I wanted the site to still look like ‘itself.’ I caught a clue later on and converted the whole thing to Custom Post Types! Much easier to maintain! Now I have a smaller, faster, site.
**Users Shouldn’t Know About Each Other (AKA Separate User Databases)**
[Andrew Norcross](http://andrewnorcross.com) pointed this out. If you need users to be on different sites, but not aware that they’re on a network, don’t use MultiSite! Now, yes, there *are* ways around this, however it’s an auditing nightmare for any large company, and a security risk that you should be aware of before you start.
[Curtiss Grymala](http://www.ten-321.com/) points out that if you need totally separate user databases, this is a strong case against MultiSite. Be it for security or just obscurity, if the users need to be separated don’t do it. There are workarounds, but you’ll spend more time on that then updating your sites.
**Hosting Small Client Sites**
I don’t host my Dad’s site, [Woody.com](http://woody.com), even though I maintain it. Why? Because, as
Cristian Antohe said, he just needs a standalone WP install. Would it be easier for me to have one place to go to upgrade him? Yes and no. He’s small, he doesn’t need a lot, and he now owns his domain, his site and his email, all in one place. It costs him $7 a month, plus the number of meals he buys me when we’re in town together, and he’s master of his own domain. This is great for him, because if he fires me, he still has everything. Also, if he does something weird that spikes his traffic 500% (like last month), it doesn’t affect the rest of my sites. Factor that into your budget. Make your client own their own data.
**Users Need To Embed JS Into Posts**
This is *not* a bug, people. Only the Super Admin on a MultiSite install has the access to include iframes, javascript, and other non-oEmbed’d data into posts! You don’t want them to! If you’re running a MultiSite, you’re the big dog, and you’re responsible for limiting their actions to things that won’t take down everyone because they don’t understand what an insecure iframe hack is. Yes, there’s a plugin that will let you allow this. No, I won’t tell you what it us, because unless you’re using a 100% locked down, you approve users you know and trust with your car, site, you do not want to open this door.
If you can’t give them they access they need via shortcodes, then they need to host themselves, or you host them separately. Protect everyone on your network, and don’t give them unregulated access.
**Users Need To Install Themes/Plugins**
Curtiss again reminded me that MultiSite doesn’t let you let your users install themes and plugins as they want. You can, via the use of clever themes that save settings per site (like TwentyEleven) and plugins that allow you to tweak CSS (like [WordPress.com Custom CSS](http://wordpress.org/extend/plugins/safecss/)) give them more customization, but you cannot give them access to install plugins and themes. Why? Because those things will be available to *everyone* on the whole Network.(There are plugins to manage plugins more granularly, and only permit some sites to use certain plugins, but again, this isn’t something everyone on your network should have access to do.) Remember, we’re sharing here!
**Same Post, Every Site**
I keep running into this one. “I want to have the same post pushed to every single site on my network!” I understand why people do this, I just think they’re doing it wrong. It’s not *just* that MultiSite is meant to be separate (aka individual) sites, it’s that you’re diluting your content. The more different places someone can go to in order to get the information you’re providing, they less impact you have because you’ve given them too many options. Decisions. Make one. Also, as Andrea reminded me, identical content in multiple places is something *spammers* do. Google will downgrade your site ranking if you do this.(This doesn’t impact categories, tags and archives because of the use of canonical links.)
Now, one user said he needed to do this as a business decision, because each of his (mapped) domains was a separate brand. But the separate brands had shared data. So … they’re not actually separate, but children. Me? I’d have everything link the **shared** data back to the **master** brand. McDonalds may sub-brand out happymeal.com (they did!) and make a whole separate site, but if you click on their ‘Privacy’ link, you go **back** to macdonalds.com! Why? Because the **parent** brand is where that stuff belongs.
**BuddyPress Separation**
This comes from Andrea again. If you need to have totally separate BuddyPress installs, use separate installs entirely. Just … y’know, you can do it other ways, but it’s not worth it.
**What else?**
This list could go on and on, so jump in and tell me your reasons why you’d never use MultiSite!
**Categories:** How It Is, How It Works
**Tags:** administration, multisite, wordpress
---
### [Folder Permissions on Windows](https://halfelf.org/2010/folder-permissions-on-windows/)
**Published:** October 14, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** This solution won't help everyone, but it helped me today. I had to add permissions on a few hundred folders, and I didn't want to do it manually.
**Content:**
 For what it’s worth, they fixed the copy problem and didn’t need my fix, but because it does work, here’s what the drama was.
We’re moving 300 odd folders, all named for the group that uses them, from one server to another. For security, each folder has a windows domain group named ‘IPS-GROUP’ (not really, but you get the idea). Only that domain group has access to the folder. I got a call asking me to reset the permissions on them. Manually. I flipped out for about a minute and bitched on Twitter. Then I sat down to code.
I used DOS because, due to another ongoing project, I’m probably the youngest person this familiar with it in my company. I knew I could do it in \*nix pretty fast with a for loop, and I remembered a snippet of code I had out there for CACLs and I came up with this:
So assuming that all your folders are in `C:\Temp\TEST`, what this does is make a list of all the folders, by name, and spits it into a file. Then you move to the directory and run the for loop, which says that for every line in the doc you made (each line is a folder name, remember), add the group `IPS-foldername` to the permissions with full rights.(You can chose whatever permissions you want. I suggest http://www.computerhope.com/cacls.htm as a resource.)
Now, this ONLY worked because on my server, the folder name and the group names are mostly the same. A couple are not, but the script kicked this out:
```
C:\temp\TEST>CACLS FOO /E /G IPS-FOO:F
No mapping between account names and security IDs was done.
```
That let me go back and manually fix the ten or so that failed.
I hope this helps someone else down the line!
**Categories:** How To
**Tags:** command line, security
---
### [Genericon'd Menus](https://halfelf.org/2013/genericond-menus/)
**Published:** March 31, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding Genericons to your menus is easy as it gets.
**Content:**
Quick and dirty, I wanted a menu to have Genericons. Menus are crazy extendible and I use them in sidebars all the time to make a list of links formatted in a nice way. So why not a Genericon? After all, I know menus are really glorified Custom Post Types.
Don’t they look pretty? It’s stupid easy.
**URL:** http://facebook.com/you
**Navigation Label:** ``
**Title Attribute:** Facebook
**CSS Classes (optional):** `social-buttons`
Then all I had to do is fiddle with CSS. `li.social-buttons .genericons` is applicable here, and that’s why I gave it the CSS class. If I wanted to have it be a genericon plus text, then the Navigation Label would have been ` Facebook` instead. If you don’t want the genericon to be part of the link, make the label just the link name, and add `genericon genericon-facebook` to the CSS classes.
**Categories:** How To
**Tags:** css, design, genericons, wordpress
---
### [Extending Chrome](https://halfelf.org/2013/extending-chrome/)
**Published:** November 27, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** For fun, profit, and perhaps a little tweaking of terrible websites, I'm using Chrome Extensions to make the web suit me a little more.
**Content:**
I had a problem.
If you know me at all, you know this is how 99% of my code lessons start. I have a problem I can’t solve easily, so I dig into it and write about it. In this case, my problem was one of those really stupid, messy things where I needed to force some code to run on certain pages and I didn’t have any access to those pages. Why? Well … let’s just say I wanted to make something like [the Hey Girl chrome extension](http://heygirl.io/) okay? Yes, I need an [extension for Google Chrome](http://developer.chrome.com/extensions/index.html).
It doesn’t really matter what you’re making, what matters is how *easy* it is to make a Chrome Extension. It really only needs two files, a `manifest.json` and then your content files. Let me explain by making Google Red.
### Manifest
The [manifest](https://developer.chrome.com/extensions/manifest.html) is where you list what’s in the Extension. It’s going to have the name, summary, what files to call, when and where. A really simple example would be like this:
This is pretty straight forward. Name, description, etc. The value for `manifest_version` has to be the number 2, no quotes, no matter what. This is [mandated by Google](https://developer.chrome.com/extensions/manifest/manifest_version.html). They don’t use it yet, but they will. Then we get to the fun stuff, `content_scripts`, which is also pretty obvious. Using “matches” says “Only run this when the URL matches…” This is an inclusive match. For a different example, here’s an extension I want to run on every website, but *not* when I’m in wp-admin:
You can take this even further and only have it take action at specific actions (like when you make a tab active). The [content\_scripts documentation](https://developer.chrome.com/extensions/content_scripts.html) is pretty overwhelming, but it has all sorts of options. Today, though, saying we want to match just Google’s pages is okay.
In order to do this, I made a blank file called manifest.json and saved it in my ‘Development’ folder called`~/Development/Chrome/extensions/GoogleRed` but this doesn’t actually matter. Save it anywhere on your computer. Just know where it is. I also put blank files for `mystyle.css` and `mystyle.js` in there because they’re my content files! They’re blank, we’ll get to the real code soon.
### Content Files
This is the fun part. The content files are what makes the magic happen and the super cool thing? It’s all basic JS or CSS or HTML. Seriously. Anything you can do in those languages, you can do in an Extesion and call it a day. For example, here’s one I used to strip referrers from URLs on Facebook (I was experimenting):
I set this to only run on Facebook.com and it was exactly what I needed. I admit, there are better JS ways to do this, but I suck at JS still, so this was as far as I got.
### The Example
Google actually already made the files, so you can download them from [Chromium “Make Page Red”](http://src.chromium.org/viewvc/chrome/trunk/src/chrome/common/extensions/docs/examples/api/browserAction/make_page_red/) and toss them in your folder. My files are as follows:
**mainfest.json**
**myscript.js**
That’s it. Two files. But how do I get it installed?
### Adding it to Google Chrome
Go to `chrome://extensions/` in Chrome and you get this kind of view:
[](https://halfelf.org/2013/extending-chrome/chrome-extensions/)
See the box on the upper right? **Developer Mode**? Check it. Now you get extra information!
[](https://halfelf.org/2013/extending-chrome/chrome-extensions-developer/)
What interests us the most here is “Load unpacked extension…” but also that ID code ` jcpmmhaffdebnmkjelaohgjmndeongip` is really important. This tells me where the extension lives on my computer, because I can go to `~/Library/Application Support/Google/Chrome/Profile/Extensions/jcpmmhaffdebnmkjelaohgjmndeongip` and see *all the code* for the other extensions. This makes it super easy for me to fork them. Since this is all just for me, and I have no plans to release them, I’m less worried about licenses than I might be, but I still am in the habit of checking what they are and so should you. Your folder locations will vary depending on your OS, and how many Google Profiles you have (I actually have 3 – me, work, fansite).
Click that “Load unpacked extension…” and select the folder:
[](https://halfelf.org/2013/extending-chrome/upload-2/)
Once you upload it, you get this:
[](https://halfelf.org/2013/extending-chrome/sample-ext/)
Now you know where the file is, but also you get a special link for **Reload (⌘R)** which is a life saver. Click that and any changes you made to your source files are re-installed into Chrome! This is great because Google’s example of making pages redder? Doesn’t work.
Okay, that’s not fair, it does work, just not on every page. It didn’t work on https pages for me until I edited the manifest and changed permissions from `"activeTab"` to `"activeTab", "tabs", "http://*/*", "https://*/*"` and then clicking on the magic button worked:
[](https://halfelf.org/2013/extending-chrome/click-icon/)
It’s kind of nice to be able to bully things around that way.
I’m just dabbling my toes into the Extensions water, and I find it highly powerful to push Chrome into my paths right now. Have you written any extensions?
**Categories:** How To
**Tags:** browser, javascript, plugins
---
### [InBox Insanity](https://halfelf.org/2014/inbox-insanity/)
**Published:** February 21, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I just don't like that unread message count, hanging over me, staring at me, looking at me... demanding my attention.
**Content:**
I get a lot of emails. I’m usually receiving and sending every hour or so. Most of the time they’re email alerts, sometimes conversations. While I’m a massive unsubsciber of email lists, I filter a lot of my emails into folders, where I’ll leave them unread until I have time, and then I delete them. Oh yes, I’m a member of [Inbox Zero](http://inboxzero.com/).
I started doing the Zero because I wanted to cut down on the stress in my digital life. An unread notification sits there, like a malignant ‘Deal with me!’ eye. And the thing is I do, I will, I always at least read the email. I don’t always reply, but I will read it. But what I don’t need is a five year old kicking my seat asking if we’re there yet.
I’m not patient. I eat my bagels undercooked because if the dang thing isn’t done in the time it takes me to start the toaster, get my cream cheese, make a coffee, and go to the bathroom, then it’s getting eaten as is. I would never be a good chef because I don’t care if every slice and dice is the same, I care about eating. If it’s time to go and you’re dawdling, I hate you. I get annoyed when people can’t budget their time well and thus are always late. It’s a thing, it’s mine, and it’s what it is.
Conversely, when it’s not food, or when its not a specific time event (like “I’ll meet you there between 4 and 5”) then I don’t stress about it. And when it’s email or Twitter, I’m seemingly negligent about serious replies because I may take a long time, and reply to other people frivilously, but in reality I’m thinking about the right reply. I have a couple emails in my drafts at any one point in time because I’m thinking.
It’s funny, I know, that I get upset when people nag me about replying. But I understand that people need processing time, and while I’m terribly impatient when I wait for an email reply from someone (seriously, ask my wife, I’m *really* annoying), I try as hard as I can *NOT* to bother them about it! I may send them a little “Hi” note after a week or so, depending on the issue, but I’m usually asking someone for a special favor in the first place, and I try to respect their boundaries.
Whew. Lots of me me me here!
**Also** I like using desktop applications. I like email apps, and Twitter apps, over in their own thing that I can totally close out and ignore if I need to write or whatever. I’m not tempted to open twitter.com in my browser because I never do it. It’s good for me and my sanity, because I don’t get those ‘gotta clicks.’ The only ones I have in my browser are my RSS reader, Facebook, and Google Plus, none of which annoy me with alerts in my browser (well, not once I forcibly turned off all alerts).
But email and Twitter, being a desktop tool on my Mac, need some settings changes too. Twitter has two places:
[](https://halfelf.org/2014/inbox-insanity/twitter/)
On the first settings page, General, I set my menu bar icon to disabled, so nothing to pester me up there. On the Notifications page, I turn of *nearly* everything. The exceptions are mentions (which I keep as menu, just in case I change my mind… it’s been a month, I suspect not) and messages. Messages are important. Very few people DM me on Twitter, and when they do, it’s probably important or private, so it needs serious attention.
*Nothing else does.*
Email is weirder. How do you turn off the dock? Surprisingly easy. Go into your System Preferences and click on Notifications (first row, last column). In there, I always turn on “Do Not Disturb” settings from 9pm to 7am. If I’m up and coding at that hour, I’m in a zone and leave me alone. Otherwise I’ve left the laptop open, and either way I’m probably not in a mood to talk to people. The last thing I want is more alerts.
Next scroll down to your email app (mine is Postbox) and turn off everything. Uncheck the boxes and set the style to ‘None’ and walk away:
[](https://halfelf.org/2014/inbox-insanity/notifications/)
Boom. No more red number.
Don’t worry, I’m still checking mail.
**Categories:** How To
**Tags:** email, macintosh
---
### [WCSF Video: Don't Use WordPress Multisite](https://halfelf.org/2013/wcsf-video-dont-use-wordpress-multisite/)
**Published:** August 1, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Guess who is up on WPTV now?
**Content:**
\[wpvideo LYqducp0 width=”800″\]
Too many people see Multisite as a silver bullet that can do everything they need, only to find out they’ve bitten off more than they can chew, and now they have a site that is too big, too complicated, and too much of a hassle. Understanding what Multisite does out of the box, what it’s best at, and where it’s easily extendable will help you build the right site.
**Categories:** Video
**Tags:** multisite, wordpress
---
### [Torrenting](https://halfelf.org/2013/torrenting/)
**Published:** November 9, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Torrenting is really easy. It's also legal, depending on what you torrent.
**Content:**
I torrent.
Look. There are hundreds of legit reasons to do this. I’m not going to argue if it’s right or wrong, because we all know that taking something that people charge for, without paying, is called stealing. Let’s put that aside. I’ve got a torrent I want to download, because downloading this way will be faster than a normal FTP of a 1G file.
The first thing you need is a Torrent client. I like [uTorrent](http://www.utorrent.com/) personally, as it’s small and easy for me to use.
The next thing you need is a torrent file. Let’s say I want to get the DRM free music from SXSW. I could download them all one at a time, or I could use a torrent from
[](https://halfelf.org/wp-content/uploads/sites/2/2013/11/2005-sxsw.png)
That’s 2.6 gigs of music. And you’d think this would take a long time to download. You’d be wrong. What you download is “SXSW\_2005\_Showcasing\_Artists-Release\_1.torrent” and open that tiny file in your client.
uTorrent lets me select what files I want to download (all of them today):
[](https://halfelf.org/wp-content/uploads/sites/2/2013/11/uTorrent.png)
I click okay, and it starts to download. This is where it gets fun. The more people who are sharing this file, the faster my download goes.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/11/utorrent-dowloading.png)
Here it is, trucking along at 1M a second and it’ll download in about 45 minutes. Just enough time for me to take a shower.
The magic in the torrent sauce is that instead of FTP where it’s one person asking one server for one file, this is a million people asking a million people for a file, as bits, not a file. So I can get one snippet of a file from Bob in Minnesota, and another from Arman in Atlanta. The more of us who download, the more of us who are sharing *what* we just downloaded!
But torrenting is really my favorite way to share large files to the masses. And yes, when I’m done downloading, I leave it up to ‘seed.’
I am aware, by the way, that as of 2010, SXSW was a little iffy about distribution via torrent, but it’s been three years and no one’s shut the site down. They’re all well aware of it so if no one’s been slapped with a C&D by now, they’re all okay. Anyway, all these songs are available to download off SXSW’s official site. The issue was with the distribution, which I can understand. I try really hard to only download legal files from legit sources, because I appreciate the value of the work that went into what I’m enjoying.
Now if you’ll excuse me, I have some new music to listen to!
**Categories:** How To
**Tags:** software
---
### [Dr. Jekyll and Ms. Hyde](https://halfelf.org/2014/dr-jekyll-and-ms-hyde/)
**Published:** February 19, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** "Helen and her damn thongs" is a line that remains stuck in my head forever. In this case, it's Jekyll and it's damn forks.
**Content:**
I like WordPress. I like the community and I like the way I can invite other people in on it. But. I wanted to run a site, a small site, with static content for the most part, no comments, and just the basics. So why not Jekyll? After all, I’m big on self-hosting, and while most people I know seem to be running Jekyll on GitHub, you know me. I want to do it myself, I want to have it all here.
Six drinks later…
My major issue with Jekyll is that the ‘Simple’ directions aren’t obvious the way everyone seems to think they are. I mean, yes, they’re simple, but they lead you to some pretty crazy misconceptions based on how websites and CMSs work, and have worked, for a long time. And given all the posts I’ve read about how terrible WordPress is, my remark on that is: No, Jekyll is not terrible, but it has an audience.
Look, of course WordPress can be terrible. So can your car. It’s all in how you use it, what you add on to it, and what you fuel it with. I have a lot of reasons to use WordPress, and I really like it for many reasons (least of which is if you asked me to explain Jekyll to someone who emails me a PDF of a Word Doc to post on WordPress… Well, yeah, no, it’s *not* simple.)
## Misconception: Where Do I Install Jekyll?
DaFUQ?
Okay… you think “Hey, Jekyll’s running my site so it’s all on Jekyll, right?” Nope! Jekyll is installed on my laptop. It’ll be used to create content that I will deploy *to* my website. Jekyll generates the webpages. Just bear with me. Yes, it also runs the site, but it doesn’t have to. In fact, it generates all of my pages into a subfolder called `_site`, which you can actually load as a webpage. If I copied all of that over to a folder, it’d work as is. So option one here is that I could just do that. But that’s not what I’d call ‘friendly’ and it means all my code has to be on the server where a sneaky person could go get it. Part of why Jekyll interested me is that it’s more secure by being a flat site.
Option two is to use a Jekyll ‘front end’ deployer, like [Octopress](http://octopress.org/) or [Prose](http://prose.io/). Option three was to stop and think “Maybe I just don’t get this and I should start simpler.” It’s very odd to me to have my ‘content’ on a server, but the ‘source’ not there. While if it’s just me running a site, that’s great. But as soon as I have to tell my dad to check code out… Maybe this is a bad idea. I don’t want end-users to have to learn all this. I want to tell them “Write your content. Save it here. Magic.”
## Revise: Needs vs Wants
When I get really bogged down in thoughts like this, I step back and ask my self “What are my needs?” That’s similar to asking “What problem am I trying to solve?” but it’s a little broader, as I may not have an actual problem, I may just need a small change.
I’m looking for a product with a small footprint, no comments, a way to subscribe to updates (RSS or email), separate content and design (so my writers don’t mess with the layout), and it needs to have a workflow that *does not* involve me having to teach svn or git commands to a music major. Oh and it has to be easy for me to upgrade (one click or git pull will do).
Say what you will that git is easy (it is for me, albeit sometimes confusing). It’s *not* necessary for everyone to learn. I really feel a journalist shouldn’t have to learn to use it in order to write content! Still, after banging my head on this, I finally decided I was making my life too complicated by trying to self host before I understood the actual workflow of the process. So I went one step further back and decided *not* to self host right now.
## KISS: GitPages
[Everyone uses GitHub Pages.](http://pages.github.com/) So fine, so will I. They walk you through the setup, so that’s nice. It was pretty painless to make a repo. But what did that have to do with Jekyll? I can edit everything within GitHub which is nice but I don’t want that. I wanted to learn Jekyll… Scroll to the bottom and there’s a nice graphic saying I can use Jekyll!
And they link to [the Jekyll quickstart](http://jekyllrb.com/docs/quickstart/). Okay, thank you, I can install Jekyll. How do I hook them up? I had to actually Google to find the link to [Using Jekyll with Pages](https://help.github.com/articles/using-jekyll-with-pages) and frankly, after reading it… I don’t want to. Oh I did it, but it’s not “simple.” It’s a total pain in the ass. It reminds me of the old MoveableType when you had to fuss with cgi-bin. It’s all manual. And this is fine for a dev, but I don’t want to have to install this on my Dad’s laptop. Did I mention he was on Windows?
So using this for a version controllable, static website, is actually far less tolerable than I wanted it to be. I can use it, I kind of understand it (the whole source folder is confusing me a little…) but it’s not something I could easily roll out to a medium-technical person without some serious training. In fact, I need some serious training to get good at just pushing my content, and when I compare that to WordPress…
I get why people like it, though. The static files alone are pretty cool, but it’s going to be a learning curve.
**Categories:** How To
**Tags:** cms, open source, website
---
### [Mailman Newsletter Widget](https://halfelf.org/2012/mailman-newsletter-widget/)
**Published:** April 18, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Adding in a mailman signup widget is so easy, I wonder why I never did it before!
**Content:**
I read [How to Add a Newsletter Signup Box After Your Posts](http://www.briangardner.com/newsletter-signup-box/) by Brian Gardner and thought to myself “Self,” I said, “I really would love to be able to add a signup widget for my mailman newsletter.”
And so I did. The following code is plain HTML. Just drop it into a text widget wherever you want it to show up, and magically it will. If you’re using a Genesis theme, this is your replacement for **Step 3**.
One important thing to note here, I wanted everyone to get the emails as they happened, no digest, so I set this: ``. If you want to make it an option, the down and dirty way is to use this:
The rest is pretty much Brian’s CSS, tweaked a little since my size requirements were different. Don’t change the ‘name’ values, as it makes Mailman cry. And how does it look?
Looks nice, don’t it?
**Categories:** How To
**Tags:** email, widget, wordpress
---
### [Smart Servers](https://halfelf.org/2011/smart-servers/)
**Published:** October 24, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Smart Servers are the new buzzword. A server that is semi-cloud-like, but still it's own master. What does it mean? Is this just another flash in the pan? I've decided to buy into it.
**Content:**
I upgraded the server that runs this site. Well, I should say I transferred from a traditional VPS on CentOS 4 32 bit server I’ve been on since 2009 to a CentOS 5, 64 bit, fully managed Smart Server.
What’s a Smart Server?
You know this whole [cloud hosting](https://halfelf.org/2010/what-is-cloud-hosting/) thing? It’s like that, but not. I had serious concerns about the cloud. Certainly I was worried when I heard people running WordPress MultiSite had weird issues with caching and things not syncing up when new server slices were made. Reason enough to hold off for me. But then my host says “We have these in-between servers.”
[LiquidWeb Smart Servers](http://www.liquidweb.com/SmartServers/?RID=JFO123) are kind of like Cloud Servers. First, I’m the only person on my server (which is a step up from VPS), and I have a set amount of bandwidth. I’m charged per-day, too, so if I need more CPU/Memory for a couple days, I only get charged for *those* days. That’s really nice. There’s a lot of normal ‘cloud’ features too, like I can spin up new images on the fly and use them (maybe 30 minutes total to do all that).
Yeah, 30 minutes. Thinking about how long it took to just *migrate* from host2 to gamera(Gamera (ガメラ?) is a giant, flying turtle from a popular series of kaiju (Japanese giant monster) films produced by Daiei Motion Picture Company in Japan. Created in 1965 to rival the success of Toho Studios’ Godzilla during the daikaiju boom of the mid-to-late 1960s, Gamera has gained fame and notoriety as a Japanese icon in his own right.), being able to move things around on the fly with only an hour of outage is nothing. When I moved my three WordPress sites, they took about an hour or so each (give or take). When I moved my forum with a 4gig database, it took about eight hours. We made jokes about how it was the size of Liechtenstein.(The problem with a 4gig database is when 400megs is in one table. Takes a long time, no matter what you do. The file copied over fast, but the exploding of it took long enough for me to nap.)
None of that was why I upgraded/moved though. The real reason for the upgrade was that my server’s been having weird issues, and most of my research said it was because I was on CentOS 4. I couldn’t upgrade SVN, I couldn’t upgrade PHP for much longer, and I was sure that come February 2012 (when CentOS 4 is EOLd) I was going to be increasingly in the cold. So I made a list of everything I’d ‘done’ to my server, all the upgrades and tweaks, and I went for broke.
For the most part, I can’t tell the difference between my old VPS and my new smart server other than the speed (much faster). What I did notice, and didn’t like, was that the memory tends to run ‘hot.’ With nothing going on at all, it was hitting 90% usage. With nothing going on for my old site, it’s at 50% (and normally hovered around 60-70%). Gamera definitely runs heavier, though I’m still using the old caching. I did have to up PHP memory to 64megs, from 32, after I ran into weird issues on one site, but for the most part, I’m in a ‘It Just Works’ state of mine. Oh and I will very much need to sort out external SSL, since everything’s on one IP now, and you can’t use multiple SSL like that.
Yet I’ve still not answered the question. What *is* a Smart Server anyway? Thankfully LiquidWeb isn’t the only site using this designation.
We know what Cloud Server is, and we know why it’s good. It’s flexible, it can add on memory and diskspace as I need it, and take it away if (when) I don’t. I’m charged for what I’m using, not a blanket ‘This is what I need on my worst day’ sort of deal. But the problem there is a lot of people actually need that flexibility but don’t have the brainpower to handle running their own server. Two years ago, I didn’t, that’s for sure. In fact, two years ago, Cloud scared me. But, just like VPS.net came up with Cloud Shared Hosting (which I jokingly called Cloud for Dummies), LiquidWeb and some other said that some of us really need a VPS, but we’d like some of those cloud features too.
This is the middle ground. Too many places were looking at Cloud Dedicated hosting, which is expensive, and not something we all need, and then was also that race to the cheap hosting. I pay $60 a month for my hosting, and it’s worth it. I know, it’s a lot of money to some people, but think on this: If I pick up the phone right now and call Tom, my sales guy, or Benny, the tech I know pretty well, they’ll take the time to help me. And if I call the 1-800 number at 1am? Someone is there who speaks English and knows what I’m talking about.(Not that I don’t love OffShore support, I know I love the ones at my office! Many of them are fantastic in their fields and well worth the price of admission. But too many companies force these intelligent people to stick to a script, and don’t teach them the hows and whys of the code, the company, and how to work with American customers. If you’re going to support Americans, you must learn how to deal with them, for better or for worse, you learn to deal with your customers. And yes, that means being fluent in their native language, and their technologies. This holds true for India, Mexico and that moron from Nebraska who wanted me to go into the registry on my Macintosh. AT&T.) So while I’m willing to pay more for someone who will bail me out, I’m *not* willing to pay more for something I don’t use. Like extra minutes on my cell phone, I don’t like to pay for hypothetical ‘in case I get the Digg effect or Matt links to me again’ CPU and memory.
While a Cloud Server would handle all that, it also requires consistent and constant management. You have to know what to expect, and be ready to go. Those of us who do all this as hobbies or as a side-gig don’t have the time. Also, sharing resources in the cloud makes some of us sketchy. The whole reason we self-host anyway is that we want to be in control. Cloud sharing started to sound a lot like Shared Hosting, which has issues of it’s own. Resource contention is s concern, as are bad neighbors. The cloud is great for hosts because it shares everything, and complicated for users because we don’t want to share.
It sounds a little repetitive to call this Cloud Light. In fact, it feels really repetitive to say “This is like a VPS, but with Cloud Add-ons.” Part of this is because understanding what the Cloud is, after decades of the old way, is hard for our brains to wrap around. For most of us, the cloud doesn’t matter. In fact, it barely matters for me. The cloud is really what the internet has always been to most of us: ephemeral and mystical. Don’t let the smoke out of the cloud, or your website will crash! See? You don’t know anything more than you did before, now do you?
The Cloud is synonymous with the Internet for many people, and I think the future of it is aimed that way. For me, having the ability not to be tied to hardware and to add on more space, memory and CPU as I need it is invaluable. Being priced reasonably for those things also makes me pleased. The Cloud gave me freedom, but a Smart Server gives me even more: the freedom to control my destiny on my server. And that’s just cool.
So what’s the downside? There are some.
Understanding memory usage has been the big issue. I mentioned before that Gamera uses 90% of the memory, *normally*, and after my database crash I came to understand why. See not being tied to hardware means I’m not tied to hardware memory either. So linux, being linux, uses up all the memory it can. I watched, and when I start doing more intensive stuff, like importing a 4G database, the memory *dropped* to about 75%, and then bounced back up to 80-90. This is what it’s supposed to do! When it starts running out of memory, it goes to swap. Now on the traditional VPS, this was bad. Swap meant you were ‘out’ of memory and about to crash. On a Smart VPS, this is okay. My swap sits around 10% right now until I clean it out.
Cleaning it out is where things get weird. Smart VPS memory doesn’t clean out. If I hot-swapped my memory, some genius at MIT sorted out I could actually read data off the memory. Of course, if you have the physical access to my server I have other problems. But swapping memory, well that means the computer *swaps* data to the hard disk and back to your RAM as needed. I’m not entirely sure how this all works, and I’m doing some research now (and asking the tech from last night for info he said he had about all this). As for the crash… My database crashed on Saturday because the table was 600mb, and the space I’d allocated for swapping like that was 400mb. Liquidweb’s support moved the SQL temp drive to a place with more space to allow for that and everything started working again.
SSL was pretty straightforward. I bought an extra IP, since it’s cheaper and easier than sorting out [multiple domains on 1-IP for SSL](https://halfelf.org/2011/request-multidomain-1ip-sslcert/) for only two domains. The other domains don’t *need* SSL yet, so they can wait until WHM catches up with SNI and other weird acronyms you don’t care about.
Basically, I’m very happy. I’ve even started to forget it’s something novel.
**Categories:** How It Works
**Tags:** cloud, essay, management, servers
---
### [Diving Into Varnish](https://halfelf.org/2014/caching-varnish/)
**Published:** July 14, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little dive into Varnish for Apache on the same server ends with being all wet.
**Content:**
We use it at DreamPress a lot, and I’m still learning its ways, but with me, the best way to learn a thing is to do a thing. So when I had a random server crash with nginxcp, I decided to play around and see about using Varnish on my server instead.
Varnish is an HTTP accelerator designed for content-heavy dynamic web sites (like WordPress). [Unlike nginx](https://halfelf.org/2014/nginx-proxy/ "Nginx Proxy"), there’s no support for SPDY or SSL, which I can’t use anyway unless I spring for another server in front of my Apache box to be a true nginx box. Since I wasn’t getting any benefits out of nginx for those, I’m not too worried about it here yet. Should the world go to SSL, then my POV will change. The Varnish gurus [aren’t fans of SPDY](https://www.varnish-cache.org/docs/trunk/phk/http20.html#spdy) as it happens, which I find fascinating.
Back on point. I’m going to use Varnish as a proxy, which means when someone comes to my server to ask for a file, Varnish will first check itself for a cache and then if it’s found, serve it without touching Apache. Apache is slow. This is good! While nginx can handle static files rather well, I found that where I ht slowness people told me to use a CDN. That’s nice, but I don’t want to right now, so it makes nginx less of a draw. On the other hand, Varnish will fill in the gap where Apache + mod\_php == poor static-file performance. And yes, I’m using mod\_php.
## Installing Varnish
First change Apache non-SSL port to 8080. I’m on WHM for this particular box, so I go to WHM -> Server Configurarion -> Tweak Settings and set value of field Apache non-SSL IP/port to 8080
Next I install the [Varnish RPM for RedHat REL6](https://www.varnish-cache.org/installation/redhat). This can be either Varnish 3x or 4x, but I picked the latest version.
Edit the config file – `/etc/sysconfig/varnish` – and set the `VARNISH_LISTEN_PORT` to 80.
Now we edit `/etc/varnish/default.vcl` with what we want.
Deep breath. A [whole heckuvalot changed](https://www.varnish-cache.org/docs/trunk/whats-new/upgrading.html) from 3.x to 4.x and it took me a couple hours to bang out, since my examples were all from Varnish 3.x. In the end, I made my own fork of DreamHost’s Varnish VCL. Grab my [Varnish VCL Collection](https://github.com/Ipstenu/varnish-vcl-collection) and I use the wordpress-example.vcl as my default. It’s a whole ‘nother post on how I did that one. A lot of trial and error.
The default VCL is skewed to WordPress in a specific way: If you’re logged in or have a cookie that isn’t the default WP cookie, or are on SSL, you *do not get cached pages*. This means my site will be slower for me.
## Configuring Your CMS
Speaking of WordPress… Here’s the major difference between it an nginx: I need a plugin for WordPress. I took over [Varnish HTTP Purge](https://wordpress.org/plugins/varnish-http-purge/) last year in order to fix it (instead of fork it) for DreamPress, and in doing so I’ve added a lot of little tweaks, like a ‘purge all’ feature and a button on the toolbar.
Oddly, this is the reason I *didn’t* want to use Varnish. Where nginx just works, needing a plugin means I have to either install and activate for everyone using WordPress or any other CMS on my system, or I have to figure out a way to not need a plugin? Oh, and I don’t *just* used WordPress. Ugh.
This is moderately trivial to do with [Mediawiki](https://www.mediawiki.org/wiki/Manual:Varnish_caching#Configuring_MediaWiki) but I came up full short when I looked at [Zenphoto](http://www.zenphoto.org/support/search.php?q=varnish). While I don’t post often to it (once a week generally), I do post a lot of data and I need the purge to be done. Certainly I could code in a system for it, like I did with WordPress, using a CURL call.
But it’s the *need* to do that for Varnish that made me make faces.
## Not using Varnish
At the end of the day, while I did get Varnish up and running, I chose not to use it. Yet. I have to overcome some hurdles with other apps not knowing how to play well with purging, and figure out how to command purges like I do with WordPress. You can see I have my work cut out for me porting a WordPress plugin to Zenphoto.
In addition, I’m not really sure I like the fact that I have to do that. Certainly I can just let the cache expire on it’s own, but that seems to somewhat defeat the purpose of having it be able to handle dynamism as well as it does if it can’t magically detect when my content changes, and the cache needs a bump.
**Categories:** How To
**Tags:** administration, cache, management, plugins
---
### [Woopra Gravatars](https://halfelf.org/2010/woopra-gravatars/)
**Published:** July 13, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to make Gravatars show up on Woopra for Theme Hybrid.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2/2010/07/woopra.png) At one point, I used [Woopra](http://www.woopra.com/) to monitor my traffic. At the time, I also used [Gravatar](http://gravatar.org/) for avatars. Woopra has this awesome ability to show the gravatars of the person visiting, based on their email. Except it wasn’t working with my theme.
Normally I’d just slap this in my footer.php theme file to make gravatars show up in my Woopra console, but I happen to be using a Theme Parent (ThemeHybrid – which I’m also using here) and I don’t want to have to hack my theme any more than I have. The glorious thing is that Justin, in his wisdom, made a function I could plug into. So I made a new function (my\_woopra\_footer) which lets me extract the user’s email and ID name, parse it through, and spit back the right data. It’s weird, and I don’t suggest you use it unless you’re using Hybrid’s theme.
```
/* Woopra */
function my_woopra_footer() {
global $user_ID, $user_email, $user_identity;
echo "\n";
?>?
**Categories:** How To
**Tags:** analytics, gravatars, themes
---
### [bbPress 1.x Functions](https://halfelf.org/2010/bbpress-function/)
**Published:** July 13, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Some quick and dirty functions I came up with for the bbPress 1.x days.
**Content:**
*Since I don’t actively develop for bbPress 1.x at this time, you’re on your own with these ones.*
bbPress is a forum platform by the same people who do WordPress. It’s very much a barebones bulletin board system (which makes layers on layers of bb jokes). bbPress is not for the non-techy at this point. It’s still in alpha mode, with a lot of rough edges, and is comparable to WordPress 1. Maybe. Most of the features are done as plugins, rather than defaults, so you don’t get things like PMing and Quick Tags and inline images. You have to add in plugins for that. While I was using it, I wrote a few of my own plugins and hacks to make things work like I wanted.
All of these hacks can be directly applied to the functions.php file of your theme.
## Change ‘Sticky’ to an image
[](https://halfelf.org/wp-content/uploads/sites/2/2010/07/knotes.png) If you make a topic sticky it gets ‘pinned’ to the top of the forum. This great for things like announcements etc. It’s really annoying that it’s hard to change. I wanted a post-it image to show that it was pinned, so I made a function to delete the default function and replace it with my own.
This goes in your functions.php for your theme, just like it would for WordPress
## Change the text of a ‘Closed’ topic
[](https://halfelf.org/wp-content/uploads/sites/2/2010/07/books.png) By default when you close a topic it renames the topic to **Closed: Topic Name**. I wanted to change that to **Read Only: Topic Name**, so what I did was delete the old closed filter and replaced it with my own.
## Woopra
If you use Woopra to monitor traffic and Gravatar for icons, you may notice that just slapping Woopra’s tracker in the bottom of your site doesn’t show the Gravars. Since bbPress themeing is what it is, I put this in my theme’s footer.php file to make gravatars show up in my Woopra console. The trick was getting it to extract the logged in user’s email. So here it is. Put this in your footer file and Woopra will show gravatars.
**Categories:** How To
**Tags:** analytics, function, unsupported
---
### [Dig Yourself Out of a Hole - Multisite Edition](https://halfelf.org/2010/dig-yourself-out-of-a-hole-multisite-edition/)
**Published:** September 20, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes, when you're smart and savvy, you make changes that later on shoot yourself in the foot. Here's what I did, how I solved it, and how to use this as an example of why you just keep trying!
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/200px-Ocean_surface_wave_icon.svg_.png) When I started my first MultiSite install, I didn’t want Blog #1 to be the main ‘dashboard’ site. The reasons why don’t matter. What does is that when you make seemingly simple changes, you have to be aware of how things work, as a whole, and be willing to take risks to fix them.
Site #1 was my test site and has since been deleted
Site #2 was a vlog which still exists
Site #3 is my ‘main’ site, the front page of it all
Site #6 is my saved Tweets
Site #7 is a documentation site
Site #8 is to save my Formspring posts
I know it’s weird. Bear with me. At first I was going to use Site #1 as an ‘all posts!’ site, like Andrea suggests you do with sitewide tags plugin, but then I realized that I wanted a splash page and then some fancy ‘Hi! Welcome!’ stuff with links to the vlog, blog, etc. Once I decided I wanted site #3 to be the ‘main’ site, I made that switch by editing two things.
First I went into *Super Admin >> Options* and changed my main site to #3:
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/mainsite.png)
Then I edited my `wp-config.php` file to say:
```
define('SITE_ID_CURRENT_SITE', 3);
define('BLOGID_CURRENT_SITE', '3' );
```
Now to be honest, I think that I only need one of those, but I’m totally stumped about that now. At the time, I just saw they were both set to 1 and I changed them to 3. Everything worked! Great! This was done.
Then I went to create site #4. And it didn’t show up. So I made site #5, ditto. Decided that was weird as hell, I went into phpMyAdmin and after some poking around, deleting sites and re-adding, I found the wp\_blogs table and saw this:
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/wp_blogs-broken.png)
Rationalizing that since I could see Blogs 2 and 3, and their site\_id was 1, I changed it to this:
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/wp_blogs_before.png)
And again, things seemed to work just fine. Until I started trying to use the new iPad WordPress app. Or add anything to post to my blog. Like Formspring. Nothing worked. The blogs couldn’t be found, and third-party apps sometimes crashed. Again, I thought ‘Maybe the site\_id *should* be 3!’ So I changed it to this:
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/wp_blogs-after.png)
Not only did that not work, it broke things. Quickly, I changed it back and frowned. I was obviously missing something, but what!? I started looking around for all instances of site\_id and found the wp\_sitemeta table! Most of the entries had site\_id of 1, but some had 3.
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/wp_sitemeta-broke.png)
I changed the wp\_blogs table again, knowing it would break things, exported the whole wp\_sitemeta table as a backup, and then ran a quick SQL search and replace, changing 1 to 3 and got this:
[](https://halfelf.org/wp-content/uploads/sites/2/2010/09/wp_sitemeta-fixed.png)
Now the whole site worked from front and back end, so I went to Formspring and tried to add my site. And guess what? It worked! It also magically fixed my iPad/WordPress testing woes.
So the lessons learned are “Never give up!” and “Never make changes when you don’t know what you’re doing!” Actually, no, not that second one. The lesson is to be bold with your solutions. Don’t panic and be willing to take a risk. I took backups before I started playing around, and I knew at worst, I could restore my site in 30 minutes. Because I had an escape plan that took me back to where I was, I had no fears about my changes. When you have nothing to lose, that’s when you should jump forward and try something silly!
I doubt the actual details of all this will help you, since I don’t think anyone but me was boneheaded enough to screw around like this in the first place. But seeing that someone else has seriously screwed themselves up, shot themselves in the foot, and come out feeling super smart should, I hope, encourage you to stay calm, think it through, and make a stab at something that seems right. When the wave rocks your boat, hang on and don’t be afraid to swim a bit.
**Categories:** How To
**Tags:** database, multisite, wordpress
---
### [WordPress: Open Comments More Selectively](https://halfelf.org/2011/wordpress-open-comments-more-selectively/)
**Published:** April 18, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you want to enable comments on 'all' of your posts selectively, we can do that for ya!
**Content:**
There are a whole lot of tricks you can do with SQL to enable/disable comments.
If you want to turn them on for every single page, there’s this:
```
UPDATE wp_posts SET comment_status = 'open';
```
But me? I don’t like to blanket turn things on! I don’t like to have my pages allow comments, you see, so I use this instead:
```
UPDATE wp_posts SET comment_status = 'open' WHERE post_type = 'post';
```
I find this preferable than just opening it for everything (most people will tell you to omit the WHERE clause) since if you do that, you open comments for attachments, pages, CPTs and everything. Which I never want.
But what if you *did* open comments for everything and now you realized, oh snap!, you want to turn them off on attachment pages? That’s pretty easy:
```
UPDATE wp_posts SET comment_status = 'closed' WHERE post_type = 'attachment';
```
For more awesome SQL queries, check out [Digging into WordPress – Easy Comment Management via SQL](http://digwp.com/2010/08/wordpress-sql-comments/) or the incredible Andrea’s [How to Close Comments Across a MultiSite Network](http://wpmututorials.com/how-to/close-comments-across-the-network/).
**Categories:** How To
**Tags:** coding, database, wordpress
---
### [Making a Stand Alone SQL Account](https://halfelf.org/2012/stand-alone-sql-account/)
**Published:** May 3, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A very simple thing you can do to make your sites more secure is to use a separate SQL user for your web apps.
**Content:**
One of the ways to secure your web apps is to limit the damage they can cause. When you create a database for a webapp, you have to provide a user ID and password to connect to the database, logically enough. Illogically, most people just use the same username and password they use to SSH into their server. After all, it works.
The obvious problem with this is that if someone gets access to your files (via a security hole in your webapp or your webhost), they now know your server password and ID, and can get in and cause serious damage.
But what if instead of using that normal ID and password, you made a special one that only was used for SQL. You couldn’t log in with it, you couldn’t FTP or anything except play with SQL. Then, even if they got in, they couldn’t delete your files! That’s really simple.
### cPanel
If you’re using cPanel, just go in to the **MySQL Databases** screen and add a new user. I like to use something totally obvious, so I can remember it, like `ipstenu_sql`.
For those passwords, I tend to use the generator to make something like `m}+akwQN=&)!`, not because I feel they’re more secure (I prefer pass-phrases, like ‘donkeyvanillatapdance’), but as a reminder for me not to use it for anything but SQL. Hang on to the password right now, though, you’ll want it in a minute.
Then you add the user to the databases. Back on the main MySQL page, there’s a little selection to **Add User to Database** which is really obvious to use. Pick your user and your database.
Clicking **Add** will take you to the privileges screen:
Give the user ALL privileges, as you may need this later on.
### Plesk
It’s just as easy in Plesk. Once your new database was created you, were automatically brought to the area to create the New Database User. If you didn’t do that, it’s okay, just go back the main database page and find the datase you want to add the user to (in this case, it’s LovePlesk\_NewDatabase). Click on the **Add New Database User** icon, fill in the information (remember to save your password!), and click okay.
Plesk should automatically grant the user ALL privileges.
### Updating Your WebApp
Once you have the new user made, all you have to do is edit your config file (i.e. `wp-config.php` for WordPress) to use the user and password, and hit save.
Now you’ve made your install a little more secure.
**Categories:** How To
**Tags:** administration, database, essay, security
---
### [WordPress Multisite Subdomains Without Wildcards](https://halfelf.org/2012/multisite-subdomains-wildcards/)
**Published:** September 19, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
The easiest way to run a Multisite network with subdomains is to use wildcard subdomains, because they’ll automagically map anything.yourdomain.com to yourdomain.com and WordPress will in turn translate that for you.
When you’re on shared hosting, you can’t do that. But don’t worry! If you’re willing to do it manually, every time you have a new subdomain, you can still have subdomains! This is really easy, if weird.
Go to [manage domains on your Panel](https://panel.dreamhost.com/index.cgi?tree=domain.manage&) and click on ‘Add New Domain / Sub-Domain’
[](https://halfelf.org/wp-content/uploads/sites/2/2012/09/addnew.png)
Add your subdomain as ‘mysub.yourdomain.com’ and check the box to remove www (it’s a subdomain, you don’t need it, and it causes weird issues with some plugins).
Set the Web Directory to where you have your main domain installed (normally this will be `/home/username/yourdomain.com` ) – yes, I really mean exactly the same. This is what wildcards do for you, but since you don’t have it, you need to do this. It should look like this:
[](https://halfelf.org/wp-content/uploads/sites/2/2012/09/settings.png)
That’s it! Now you just scroll down and press **Fully Host This Domain** and wait till it’s provisioned. Once that’s done, you can go to mysub.yourdomain.com and it will take you to yourdomain.com! Add in a subdomain within WordPress called ‘mysub’ and everything will work exactly like it should.
**Categories:** How To
**Tags:** domain, multisite, wordpress
---
### [phpMyAdmin vs CMS](https://halfelf.org/2012/phpmyadmin-vs-cms/)
**Published:** October 3, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
By ‘CMS’ I mean WordPress, Drupal, whatever.
So here’s a funny. I moved my DreamHost site to a VPS, so I could learn nginx (I’m still a newb) and suddenly I couldn’t get to my phpMyAdmin anymore! Before someone says it’s DreamHost’s fault, this is actually due to how I installed subdomains (which I don’t recommend) and configured nginx (still optomizing). That said, not every CMS is flexible enough for this, so if you have this problem too, here’s a work-around.
As you know, you’re supposed to go to `http://mysql.elftest.net` which then sends you to `http://elftest.net/dh_phpmyadmin/mysql.elftest.net/` to get to your phpMyAdmin page. Except it gives you a 404 styled like your site instead.
Solution? Make a fake subdomain.
I made db.elftest.net (which has nothing), but now I can go to `http://db.elftest.net/dh_phpmyadmin/mysql.elftest.net/` and log in!
How I buggered my subdomains, and how I fixed it, is another post.
**Categories:** How It Is
**Tags:** database, domain
---
### [Subdomains Back Where They Belong](https://halfelf.org/2012/moving-subdomains/)
**Published:** October 11, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
In my last post, I talked about how I did something dumb with my subdomains.
How *did* I install subdomains?
Stupidly. Or rather, stupid for DreamHost. See, many other hosts, when you make a subdomain, come up with this structure for your files:
So when I made my subs, I made them similar to that. What DreamHost does is this:
I suggest you do the default! If you didn’t, however, there is a way to fix it. It’s a two step process.
1\) **Move the files.**
I found it easier to do this in Unix `$ mv elftest.net/trunk trunk.elftest.net` (this moves and renames all in one). If you wanted to do it via FTP, just drag and drop, then rename.
2\) **Change the location in Panel.**
Go into your panel, edit the domain, and change `elftest.net/trunk`:
[](https://halfelf.org/wp-content/uploads/sites/2/2012/10/before.png)
To `trunk.elftest.net`:
[](https://halfelf.org/wp-content/uploads/sites/2/2012/10/after.png)
Give it 5 to 10 minutes, and you’re done!
tl;dr to the whole thing is this: Trust the tool! (Sharon, that was for you!)
**Categories:** How It Works
**Tags:** domain, servers
---
### [CentOS and PHP 5.4](https://halfelf.org/2013/centos-and-php-5-4/)
**Published:** January 20, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sundays are for Coding for Me. This weekend I upgraded to PHP 5.4, which meant I had to reinstall my two favorite extensions and added a new one.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/6172568431_67d4bdf44a_b1-300x200.jpeg)I finally got around to PHP 5.4
Alas this meant reinstalling certain things, like ImageMagick and APC.
This also brought up the question of pagespeed, which I keep toying with. I use it at work, but since this server’s on CentOS with EasyApache, there’s no ‘easy’ way to install PageSpeed yet (not even a yum install will work), so it’s all manual work plus fiddling. I don’t mind installing ImageMagick and APC, but Google’s own ‘install from source’ aren’t really optimized for CentOS, even though they say they are, and I’m nervous about the matter. Well… I did it anyway. It’s at the bottom.
The only reason I had to do this all over is that I moved to a new *major* version of PHP. If I’d stayed on 5.3 and up’d to 5.3.21, that wouldn’t have mattered. But this changed a lot of things, and thus, a reinstall.
## ImageMagick
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/200px-Imagemagick-logo.png) I started using ImageMagick shortly after starting with DreamHost, since my co-worker Shredder was working on the ‘Have WP support ImageMagick’ project. It was weird, since I remembered using it before, and then everyone moved to GD. I used to run a photo gallery with Gallery2, and it had a way to point your install to ImageMagick. Naturally I assumed I still had it on my server, since I used to (in 2008). Well since 2008, I’ve moved servers. Twice. And now it’s no longer default.
Well. Let’s do one of the weirder installs.
First you install these to get your dependancies:
```
yum install ImageMagick
yum install ImageMagick-devel
```
Then you *remove* them, because nine times out of ten, the yum packages are old:
```
yum remove ImageMagick
yum remove ImageMagick-devel
```
This also cleans out any old copies you may have, so it’s okay.
Now we install ImageMagick latest and greatest from [ImageMagick](http://www.imagemagick.org/script/download.php):
```
cd ~/tmp/
wget http://imagemagick.mirrorcatalogs.com/ImageMagick-6.8.1-10.tar.gz
tar zxf ImageMagick-6.8.1-10.tar.gz
cd ImageMagick-6.8.1-10
./configure --with-perl=/usr/bin/perl
make
make install
```
Next we install the -devel again, but this time we tell it where from:
```
rpm -i --nodeps http://www.imagemagick.org/download/linux/CentOS/x86_64/ImageMagick-devel-6.8.1-10.x86_64.rpm
```
Finally we can install the PHP stuff. Since I’m on PHP 5.4, I have to use imagick-3.1.0RC2 – Normally I’m not up for RCs on my live server, but this is a case where if I want PHP 5.4, I have to. By the way, next time you complain that your webhost is behind on PHP, this is probably why. If they told you ‘To get PHP 5.4, I have to install Release Candidate products, so your website will run on stuff that’s still being tested,’ a lot of you would rethink the prospect.
```
cd ~/tmp/
wget http://pecl.php.net/get/imagick-3.1.0RC2.tgz
tar zxf imagick-3.1.0RC2.tgz
cd imagick-3.1.0RC2
phpize
./configure
make
make install
```
Next, edit your php.ini to add this:
Restart httpd (`service httpd restart`) and make sure PHP is okay (`php -v`), and you should be done! I had to totally uninstall and start over to make it work, since I wasn’t starting from clean.
Speaking of clean, cleanup is:
```
yum remove ImageMagick-devel
rm -rf ~/tmp/ImageMagick-6.8.1-10*
rm -rf ~/tmp/imagick-3.1.0RC2*
```
## APC
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/apc.png)I love APC. I can use it for so many things, and I’m just more comfortable with it than xcache. Part of it stems from a feeling that if PHP built it, it’s more likely to work. Also it’s friendly with my brand of PHP, and after 15 years, I’m uninclined to change. I like DSO, [even if it makes WP a bit odd](https://halfelf.org/2011/wordpress-dso-and-permissions/ "WordPress, DSO and Permissions").
Get the latest version and install:
Add this to your php.ini:
Restart httpd again, clean up that folder, and then one more…
## mod\_pagespeed
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/Google-s-mod-pagespeed-Apache-Module-Is-Out-of-Beta-Ready-to-Turbocharge-the-Web-Video-2.png)I hate Google. Well, no I don’t, but I don’t trust them any more than I do Microsoft, and it’s really nothing personal, but I have issues with them. Now, I use PageSpeed at work, so I’m more comfortable than I was, and first I tried Google’s installer. The RPM won’t work, so I tried to [install from source](https://developers.google.com/speed/docs/mod_pagespeed/build_from_source), but it got shirty with me, fast, and I thought “Why isn’t this as easy as the other two were!?” I mean, APC was stupid easy, and even easier than that would be `yum install pagespeed` right?
Thankfully for my sanity, someone else did already figure this out for me, Jordan Cooks, and I’m reproducing his [Installing mod\_pagespeed on a cPanel/WHM server](http://hasaninter.net/2012/04/13/installing-mod_pagespeed-on-a-cpanelwhm-server/) notes for myself.(By the way, I keep a copy of this article saved to DropBox since invariably I will half-ass this and break my site.) Prerequisite was to have mod\_deflate, which I do.
The commands are crazy simple:
Once you do this, you have to edit the file, and this is where I differ from Jordan’s direction. He just copied this over `/usr/local/apache/conf/pagespeed.conf` but I had an older version from a ‘Let’s try Google’s way….’ attempt and someone else’s directions, so I made a backup and then took out the `ModPagespeedGeneratedFilePrefix` line since I know that’s deprecated. I also added in a line to tell it to ignore `wp-admin`.
Here’s my pagespeed.conf (edited):
To tell Apache to run this, edit `/usr/local/apache/conf/includes/pre_main_global.conf` and add:
Note: We put this code here because EasyApache and httpd.conf will eat your changes.
Finally you rebuild Apache config and restart apache and test your headers to see goodness! My test was a success.
```
HTTP/1.1 200 OK
Date: Mon, 21 Jan 2013 03:12:13 GMT
Server: Apache
X-Powered-By: PHP/5.4.10
Set-Cookie: PHPSESSID=f4bcdae48a1e5d5c5e8868cfef35593a; path=/
Cache-Control: max-age=0, no-cache
Pragma: no-cache
X-Pingback: https://ipstenu.org/xmlrpc.php
X-Mod-Pagespeed: Powered By mod_pagespeed
Vary: Accept-Encoding
Content-Length: 30864
Content-Type: text/html; charset=UTF-8
```
For those wondering why I’m ignoring wp-admin, well … sometimes, on some servers, in some setups, if you don’t do this, you can’t use the new media uploader. It appears that PageSpeed is compressing the already compressed JS files, and changing their names, which makes things go stupid. By adding in the following, I can avoid that:
Besides, why do I need to cache admin things anyway, I ask you?
So there you are! Welcome to PHP 5.4!
**Categories:** How To
**Tags:** administration, cache, google, images, speed
---
### [Review: Sitespeed.io](https://halfelf.org/2014/review-sitespeed-io/)
**Published:** May 19, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Analyze your website while getting a beer.
**Content:**
Let’s get this part out of the way first…
Like most people, I have a suite of websites I check when I’m trying to figure out how well a site does with regards to speed. [Google PageSpeed Insights](https://developers.google.com/speed/pagespeed/insights/), [ySlow](http://yslow.org/), [GTMetrix](http://gtmetrix.com/) (which does both), [Pingdom Website Speed Test](http://tools.pingdom.com/fpt/), [Bytecheck](http://www.bytecheck.com/)… The list goes on and on. We want as many checks as possible in understanding what’s causing sites to be slow and what is not.
When I added in nginx I wanted to test everything again, and as I made my way down my list I thought “Isn’t there a way to do this and go make a coffee?”
[Sitespeed.io](http://www.sitespeed.io/) analyzes my site while I make coffee. It’s Open Source. It’s forkable. It’s easy to install. Since I’m on a Mac, I used [Homebrew](http://brew.sh/) (which I’ll post more about in two days) but you can git clone, or download the zip, however you like.
Once installed, you run a sitespeed.io call:
This takes a little but creates a folder off your home directory: `~sitespeed-result/halfelf.org/2014-05-14-14-59/` and in there will (eventually) be a lot of files including an index.html. That one you open up in the browser. The scan *definitely* takes longer than a sitespeed check, but it’s also more in-depth in the ways I always wanted from sitespeed. Also since it’s HTML, I can toss it online and share with people.
What I noted first was a ton of errors. Sad panda.
```
phantomjs[88651:507] CoreText performance note: Client called CTFontCreateWithName() using name "Open Sans" and got font with PostScript name "OpenSans". For best performance, only use PostScript names when calling this API.
```
It also had a lot of crashes, which was when I wondered if everything was on the right version. Again, checked in with Homebrew, upgraded phantom,js, and tried it again. This time no errors (yay!)
But then the process finished and I looked at my score. 81.
So I dug into the results and looked at first my home page.
> You have 2 javascripts in the critical path and 8 stylesheets using 0 extra domains
>
> \[…\]
>
> This page has 8 external stylesheets. Try combining them into fewer requests.
And it showed me what those were. Weirdly, I saw WP was calling jquery on it’s own, as well as the JS I minified and compressed with mod\_pagespeed. Interested, I checked three other sites on my server, and they all have the same issue. It blows my mind that no other tool had pointed that out before. The stylesheets I knew were from my fonts. While I minified them all, I did not combine them because it made my font-icons break. I upgraded mod\_pagespeed for Apache 2.4 and haven’t looked at that since, so I tried it again indeed, it worked now.
I slowly worked my way down the list, noting things that I could easily fix. One thing that would ding me hard was my use of webfonts. Also not using a CDN still dinged me. Still, by using Sitespeed.io, I was able to see more exactly what was slowing my site down and why, and what I could sacrifice. Some things are going to be unavoidable (like “You are using an old version of JQuery: 1.11.0 …” ) and the multiple domains (google.com, wordpress.com, etc), but really the fact that I can narrow in with specific issues is perfect.
There are a whole mess of options, like I can take screenshots with each page, restrict the scan to specific pages (or exclude others), check in mobile, test in specific browsers (note: this is more complicated!), and much more.
So welcome, Sitespeed.io, you’re in my toolkit now!
**Categories:** How To
**Tags:** development, speed
---
### [Is It My Server or My Theme?](https://halfelf.org/2012/server-or-theme/)
**Published:** October 5, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Site slowness shouldn't start with pointing fingers at your host, but at yourself.
**Content:**
This could go on any of my sites, but since the conversation started on the DreamHost forums, I thought I’d tackle it here.
When your site is running slow, it’s easy to pick on the webhost or the server you’re on, saying that’s the problem, and demanding someone else fix it. The truth is that speed involves a lot more variables than just the webhost. Sure, if your host is slow (or down), you’re stuck waiting on us, but there are a couple really easy ways to determine where the slowness is, and you might be surprised.
If you’re using a CMS like WordPress or Drupal, take a look at how long a page takes to load the first time, and then again on a refresh. When you look at these pages, they’re in PHP and take a little time to process. The more complex your code, the longer it can take to display. This won’t really impact a refresh, but it’s a good idea to see if your browser is caching anything. If the site is really slow, go look at a static HTML or TXT page. On WordPress, look at http://yourdomain.com/readme.html and see how fast that loads. If that’s slow, hey! It *is* your server! Open up a ticket with us and tell us that the site is slow to load static pages. It’s really important that you tell us what you’ve done, so we don’t have to waste time re-doing it all for you.
But most of the time you’ll see the html loads really fast. Why is that? It’s that pesky PHP taking a while to render. Now I know this brings up the obvious question of why would we use PHP if it takes longer to load, and the answer is complicated. There are a lot of benefits to using PHP (like being able to use those cool CMS’s to make publishing your site easier), and I’m not going to go into them. Just know that if you choose to use a modern CMS, then you’re likely going to be using PHP to render your site.
That means we have to consider how to make our PHP run faster. If you’re on shared hosting, the server side work should have been done for you, and if things are *still* slow then you have to consider the painful option that you did this to yourself. Don’t worry! That’s not a terrible thing, you probably just picked a theme, or a plugin, that is totally perfect for you, but a little slow. This is why people say ‘too many plugins/extensions slow your site.’ It’s not true, but the idea is that the wrong one will slow you down. And that is certainly true.
Go to [Google PageSpeed Insights](https://developers.google.com/speed/pagespeed/insights#) and check your site out. It should give you a hint as to what’s lacking. Don’t take this as the holy grail, though. Sometimes Google has really dumb advice, like ‘You should compress the code you’re using from google.com!’ Really? So why don’t you compress it, or tell me ‘Use this code instead from us! It’s already compressed!’ In theory, all of Google’s jquery code has a compressed version, but that’s not what most people see, so telling us to use it but not how is pretty idiotic, in my opinion.
I always tell people to look into minifying their output. That means you use a tool to make your HTML all mashed up together when someone looks at your source code. This simple step has amazing results for most sites. It took my Google Speed score from 71 to 81. Any score above 75 is a ‘good’ score from my experience (Microsoft gets a 77, after all, and while Google gets a 99, their main page is pretty minimalistic).
The point to all this is that your pagespeed is dependent on more than just how fast DreamHost is running. If you tell me that your site is slow, the first thing I do is look at a static page (I may even make one for you if I can’t find one). From there, maybe I’ll poke at the server, but most of the time it’s been your site’s configuration. I say this from a place of over 15 years of self-hosting: I’m nearly always the cause of my own problems.
Of course, if it’s your WordPress site being a slug, start with caching plugins and feel free to ask us for advice. If you have a wild and wooly, never been seen before, WP problem, don’t be surprised to see me showing up in your ticket.
**Categories:** How To
**Tags:** servers, speed
---
### [Kick PageSpeed Up A Notch](https://halfelf.org/2013/kick-pagespeed-up-a-notch/)
**Published:** January 22, 2013
**Author:** Ipstenu (Mika Epstein)
**Content:**
If you’re using Apache and PHP 5.3 on your DreamHost domain, you have the magical power to enable Google PageSpeed. Just go and edit your domain and make sure you check the box for “Page Speed Optimization”:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/01/Screen-Shot-2013-01-22-at-12.37.44-PM.png)
But what does that even mean, I hear you ask?
[](https://halfelf.org/wp-content/uploads/sites/2/2013/01/partners.png)PageSpeed is Google’s way to speed up the web (yeah, that was redundant), and it serves as a way for your server to do the work of caching and compressing, taking the load off your webapps. Like WordPress. Anyone can install this on their apache server, and it’s free from [Google Developers: PageSpeed Mod](https://developers.google.com/speed/pagespeed/mod). Since you’re on DreamHost, you lucky ducky you, we did it for you. Now you can sit back and relax.
The first thing to notice when you turn on PageSpeed is that it minifies your webpage. That means it takes your pretty formatted source code and gets rid of the extra spaces you don’t use. This is called by using the PageSpeed filter “collapse\_whitespace.” Another filter we use is “insert\_ga” which is how we’re magically able to insert your Google Analytics for you from your panel. That filter automatically inserts your GA code on every page on your domain. That’s right! *No more plugins*!
If you’re like me, you may start to wonder what other filters you should use, and that entirely depend on what you want to remove. I knew I wanted to remove code comments like the following:
That’s easy! There’s a filter for “remove\_comments” so I can just use that. They have a whole mess of filters listed in the [Filter Documentation](https://developers.google.com/speed/docs/mod_pagespeed/filters) and reading through it took a while. If you read each one, at the bottom they talk about how risky a certain filter is. Taking that into account, I went ahead and added some low and some high risk filters, since I know what I’m using.
The magic sauce to add all this is just to edit your .htaccess and put in the following near the top:
Really, that’s it.
The ones I picked are:
- [remove\_comment](https://developers.google.com/speed/docs/mod_pagespeed/filter-comment-remove)s – Remove HTML comments (low risk)
- [rewrite\_javascript](https://developers.google.com/speed/docs/mod_pagespeed/filter-js-minify) – minifies JS (med. to high risk, depending on your site)
- [rewrite\_css](https://developers.google.com/speed/docs/mod_pagespeed/filter-css-rewrite) – parses linked and inline CSS, rewrites the images found and minifies the CSS (med. risk)
- [rewrite\_images](https://developers.google.com/speed/docs/mod_pagespeed/filter-image-optimize) – compresses and optomizes images (med. risk)
- [elide\_attributes](https://developers.google.com/speed/docs/mod_pagespeed/filter-attribute-elide) – removing attributes from tags (med. risk)
- [defer\_javascript](https://developers.google.com/speed/docs/mod_pagespeed/filter-js-defer) – combines JS and puts it at the end of your file (high risk AND experimental!)
- [move\_css\_to\_head](https://developers.google.com/speed/docs/mod_pagespeed/filter-css-to-head) – combines CSS and moves it to the head of your file (low risk)
Now keep in mind, not all of the features will work. While DreamHost is on a pretty cutting edge version of PageSpeed, they’re constantly innovating over there and improving. The best thing about these changes is, if you do it right, you can speed your site up faster than any plugin could do for you. And that? Is pretty cool right there.
**Categories:** How To
**Tags:** dreamhost, htaccess, php, speed
---
### [Take my SPDY, Please](https://halfelf.org/2014/google-apache-take-spdy-please/)
**Published:** December 31, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** So Google gave mod_spdy to Apache. Now what?
**Content:**
When I upgraded my server to Apache 2.4, I lamented that the choice had [killed any ability I had to run SPDY](https://halfelf.org/2014/apache-kiboshed-spdy/ "Apache 2.4 Kiboshed SPDY"). This led to me installing an [Nginx proxy](https://halfelf.org/2014/nginx-proxy/ "Nginx Proxy") on my box and being pretty happy with it.
I wanted to like the idea of SPDY on Apache, but there were serious issues with mod\_spdy. First of all, it’s incompatible with Apache version 2.4. That sucks. While someone had forked it, issue number two made me worry. You see, mod\_spdy requires OpenSSL version 1.0.1c and modifies mod\_ssl. If it was Google’s suggestions for it, I might be okay, but now we’re talking about trusting some random person out there. No. Finally the dippy thing hadn’t been updated in *years*.
Someone finally shamed Google enough, because earlier this year [Google gave mod\_spdy to Apache](http://googledevelopers.blogspot.com/2014/06/modspdy-is-now-apache-project.html). The plan is for it to be a part of Apache 2.4, as well as the future 2.6/3.0 world:
> Being a part of Apache core will make SPDY support even more widely available for Apache httpd users, and pave the way for HTTP/2.0. It will also further improve that support over the original version of mod\_spdy by better integrating SPDY and HTTP/2.0’s multiplexing features with the core part of the server.
Finally!
Except not. Sadly, there’s been very little activity since this summer. You can look at the code on Apache SVN and [mod\_spdy hasn’t been touched in 3 months](https://svn.apache.org/viewvc/httpd/mod_spdy/trunk/). It’s sad to see this linger. I had high hopes that Apache would jump and run, but they haven’t even made it work with Apache 2.4 yet.
I’m not going to hold my breath for parity on this one just yet.
**Categories:** How It Is
**Tags:** servers, speed
---
### [Image Compression](https://halfelf.org/2015/image-compression/)
**Published:** August 17, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Compressing images to make your site load faster is all fun and games, until someone loses an eye.
**Content:**
If you’ve ever tested your site on Google PageSpeed Insights, GTMetix, Yahoo! YSlow, or any of those tools, you may have been told about the value found in compressing images.
[](https://halfelf.org/wp-content/uploads/sites/2/2015/08/pagespeed-optimizeimages.png)
There are some images you can fix, like the first one on that screenshot is for an image from Twitter I downloaded. There are some you can’t fix, like the last three are all telling me the default smilies for WordPress need some shrinking.
Either way, the short and skinny of it is that if you make your images smaller then your webpage loads faster. I know, it’s shocking. Many long-term webheads know that you can compress images best on your own computer, using ‘Save For Web’ and other command line tools for compression. That’s great, but that doesn’t work for everyone. Sometimes I’m blogging from my phone or my iPad and I don’t have access to my tools. What then?
## Before You Upload
I know I just said but what about when you can’t resize before you upload. There are things you can do for this. [Photo Compress for iOS](https://itunes.apple.com/us/app/photo-compress-reduce-image/id966242098?mt=8) will let you make your images smaller. So can [Simple Resize](https://itunes.apple.com/us/app/simple-resize/id327776379?mt=8). There are a lot of similar apps for Android as well.
For the desktop, I use [Homebrew](https://halfelf.org/2014/its-not-beer-its-homebrew/) so I installed ImageMagik (which is also on my server for WP to use) and toss in a command line call for it. Sometimes I’ll use grunt (yes, [Grunt](https://halfelf.org/2015/updating-bower-grunt/), the same thing I use for Bower and coding) and [ImageOptim](https://github.com/JamieMason/grunt-imageoptim) to compress things en masse.
Of course, if I only have one or two images, I just use Preview which does the same thing more or less. Photoshop, which is still stupid expensive, also lets you do this, but for the layman, I suggest Preview for the Mac. I haven’t the foggiest what you can use on Windows.
If you’re not uploading images via WordPress (and very often I’m not), you pretty much have to do it old-school.
## While You Upload
Okay great, but what about WordPress?
The best way about it is to have WordPress magically compress images while you upload them. And actually it does this out of the box. My cohort in crime at DreamHost, Mike Schroder, was part of the brain trust behind making ImageMagick a part of core WordPress. This was a massive undertaking, but it allowed WordPress to compress images better, faster, and more reliably than GD. I hesitate to say it’s ‘safer’ since the image loss (that is that weird fuzzing you get some times) is less.
If you want to make it even better, you need to use plugins. I used to tell people to use smush.it which was a Yahoo! run service. But then they deleted it and we were all very sad. WPMU Dev, who owns a SmushIt plugin, installed Smushing on their servers and you can now use [WP Smush](https://wordpress.org/plugins/wp-smushit/). I’m a bit of a fan of [TinyPNG](https://wordpress.org/plugins/tiny-compress-images/), which gives you 500 free compressions a month, and that’s enough for me. I like TinyPNG because there are no options. I install it, it runs when I upload images, and done. That doesn’t mean I don’t see value in things like [ShortPixel](https://wordpress.org/plugins/shortpixel-image-optimiser/), just that it’s not really what I want. Finally there’s [Kraken IO](https://wordpress.org/plugins/kraken-image-optimizer/) which I love just for the name, but it makes people balk because it’s not free.
If you don’t want to use an external service, and I totally get why you wouldn’t, there’s [EWWW Image Optimizer](https://wordpress.org/plugins/ewww-image-optimizer/).
I personally use either EWWW or TinyPNG, depending on the site.
## Can a CDN Help?
Maybe. I know a lot of people love offloading their images to CDNs. I currently don’t for no reason other than I’m a bit lazy and I hate trusting someone else to host my images. But that said, you actually can (rather easily) use a CDN if you have Jetpack installed. Their service, Photon, does exactly that. Now, I don’t use Photon because my users in Turkey and China like to visit my site, but there’s nothing at all wrong with those services.
**Categories:** How To
**Tags:** images, speed, wordpress
---
### [WordPress Media Library: Show ID](https://halfelf.org/2013/media-library-show-id/)
**Published:** August 26, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How to add a new column on the WordPress Media Library to show the ID.
**Content:**
While this is considerably less of an issue with the new Media Uploader, and how it inserts your gallery code, this used to be a hassle. The old `[gallery]` code would just be that, a short tag, and if included all images attached to a post. So if you wanted it to exclude some images, you had to figure out their IDs, or remove them from the post.
I used to have to show people how to do this all the time. Hover over the image, note the URL, bleh bleah bleaaaaaaaaah.
So what if the images showed the IDs? Hey! You can do that with this function!
And there you go. I don’t actually use this anymore, but it was sitting in my scrapbook of functions.
If you’re wondering about the *right* way to handle galleries today, the gallery editor lets you configure what images are and aren’t in it through a GUI, so you don’t need to mess with this. Just click on the gallery to edit it, remove the images you don’t want, add the new ones, and off you go. About the only thing it doesn’t do is let me select how I want the images to like (URL, file, or none), and I still don’t have the option to link to an external URL. Ah well.
**Categories:** How To
**Tags:** coding, images, wordpress
---
### [Passwordless SSH](https://halfelf.org/2012/passwordless-ssh/)
**Published:** September 19, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Everyone talks about it, this is how I setup passwordless SSH.
**Content:**
I’m incurably lazy, and as we all know, lazy techs like to automate (ltla?).
I ssh a lot into my personal servers, and I get tired of having to type `ssh account@server.com`, and *then* enter my password. So I got smart.
Since I’m on a Mac, the first thing I did was grab [iTerm2](http://www.iterm2.com/#/section/home). This lets me create simple profiles so with a click, I can log in to any of my servers. When I was using Windows, I used [PuTTY](http://www.putty.org/) and the add-on for [Connection Manager](http://www.binarysludge.com/2011/11/30/putty-connection-manager-website-down/).(The real PuTTY CM site is gone, and binarysludge just keeps a copy on hand for the same reasons I do. You never know when you need it. Mine’s in my [Dropbox storage](https://www.dropbox.com/s/t8qowplijmjeu3x/puttycm0.7.1.136beta.exe).)
What I really loved about PuTTY CM was that I could fill the pref file with my accounts and passwords, and then one-click connect to any of my servers. This was as The Bank Job, where I had a couple hundred servers to do this with, and when I had to change my password, I could search/replace that file. I know, it’s not secure. At DreamHost, I had the same, but they scripted it so I can sudo in with a handy call that I’m in love with. As long as I remember my password, I’m fine. But see, I told you, I’m horribly lazy and I hate having to log in with my password, then sudo again with my password.
The first step for this is to make an rsa key pair. This is a fancy way of telling both computers to trust each other, so on your personal computer (we’re assuming linux here), go to your home folder and type this:
```
[Laptop] $ ssh-keygen -t rsa
```
You’ll be presented with a series of informative notes and questions. Accept *all* the defaults, and keep your passphrase empty.
```
Generating public/private rsa key pair.
Enter file in which to save the key (/home/ipstenu/.ssh/id_rsa):
Created directory '/home/ipstenu/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ipstenu/.ssh/id_rsa.
Your public key has been saved in /home/ipstenu/.ssh/id_rsa.pub.
The key fingerprint is:
3e:4f:05:79:3a:9f:96:7c:3b:ad:e9:58:37:bc:37:e4 ipstenu@[Laptop]
```
This saves your public ‘key’ in the `.ssh` folder (yes, it’s a folder)
Now we have to setup the server (halfelf.org for example):
```
[Laptop] $ ssh myaccount@halfelf.org mkdir -p .ssh
myaccount@halfelf.org's password:
```
This will SSH into halfelf as ‘myaccount’ and create a folder called `.ssh`. You only need to do this once, so after you set up the key for one computer, you can skip this the next time.
Finally we’re going to append the public key from my laptop over to HalfElf, so it trusts me:
```
[Laptop] $ cat .ssh/id_rsa.pub | ssh myaccount@halfelf.org 'cat >> .ssh/authorized_keys'
myaccount@halfelf.org's password:
```
The reason we’re appending is so that if I decide I want to add my Work Laptop, I can just make the key, and then repeat that last command and it will *add* it to the bottom, trusting both.
There’s a caveat here, which caught me last week. I set everything up for my new server, [ElfTest](http://elftest.net), and then moved the server to a VPS. The IP changed, so the trusted key was invalid. You see, every time you connect to a server for the first time, it asks you to trust it. If anything in that fingerprint changes, you have to re-trust. This is annoying:
```
The authenticity of host 'elftest.net (111.222.333.444)' can't be established.
RSA key fingerprint is f3:cf:58:ae:71:0b:c8:04:6f:34:a3:b2:e4:1e:0c:8b.
Are you sure you want to continue connecting (yes/no)?
```
After you respond “yes” the host gets stored in `~/.ssh/known_hosts` and you won’t get prompted the next time you connect. When it became invalid, I had to go edit that file and delete the entry for elftest (it’s partly human readable, so it wasn’t too bad).
If you hate this as much as I do, and you feel you’re immune to man-in-the-middle attacks, there’s a nifty command:
```
ssh -o "StrictHostKeyChecking no" user@host
```
This turns off the key check. Generally speaking? Don’t do this. I’ve actually only done it once. (This was at the bank, where I was behind so many firewalls, if you’d gotten to my computer, I was in trouble anyway.)
**Categories:** How To
**Tags:** command line, unix
---
### [Collecting Conflicting Stats](https://halfelf.org/2013/collecting-conflicting-stats/)
**Published:** March 25, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Measuring success via traffic isn't as simple as opening one program and reading a number.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2//2013/02/url1.jpeg)While, like many people, I use Google Analytics, I don’t really trust it’s parsing. I do use mod\_pagespeed which lets me auto-embed my GA code in every page without plugins or extra work on my part, which is great, but the results are questionable and often wildly disparate and conflicting.
Let me demonstrate:
GoogleAWStatsWebalizer**Page views**2,60710,3548,502**Hits**49,830 59,542 **Visits**8881,2742,255First of all, I can’t find ‘hits’ anywhere on Google. Their layout is different and changes regularly. Secondly, and I’m sure this jumps out at you, according to AWStats and Webalizer, I’m getting 4 to 5 times the pageviews compared to Google. I previously configured AWStats and Webalizer to exclude wp-admin and other ‘back end’ pages by editing the configuration files. I did the same in my .htaccess for PageSpeed, so I know no one is tracking admin pages.
I already know that AWStats errs on the site of users, so if it can’t tell something is a bot, it assumes it’s a user. I also know it tends to overcount, since it bases its counts on traffic in a way that is a little generous (a 60 minute count for a visit). Not a huge deal, but enough to say that yes, the 10k pageview is probably closer to the 9 or 8 of Webalizer. Speaking of Webalizer, it uses a 30 minute count, so there it skews higher. Fine, let’s be harsh and halve them.
That gives me 4000-ish pageviews. Google gave it 2600-ish.
Interestingly, Google gives a 30 minute visit count too, but it also uses cookies and javascript, which while fairly safe, doesn’t run on everyone’s browser. As an amusing side-bar, when I switched from using a plugin or manually injecting Google Analytics into my sites and started using mod\_pagespeed’s insertion, my results *went up*. Noticeably. In part this is attributed to the fact that my site is having higher traffic than normal, but when I compared it to WordPress Stats, it was a bigger than expected jump.(I’m not using WordPress’s Stats ala Jetpack in this experiment because it only counts WordPress pages, and the site I’m using is not just WP. However on a pure WP site, WP’s stats tend to skew higher than GA.)
Which one is right? Most people will say Google is ‘closer to the truth’ but I don’t know how much I can rely on that. Certainly it’s more true for how many actual people are visiting my site, and when I’m judging metrics for marketing, I’m a little more inclined to use Google. That said, if I’m trying to understand why my page speed is slow, or where I’m getting hammered with traffic, AWStats and Webalizer are *far* more accurate, since they’re counting everything.
[](https://halfelf.org/wp-content/uploads/sites/2//2013/02/url.png)From “Manga Guide to Statistics,” Shin Takahashi, 2008Right now, I’m keeping Google Analytics on my sites. I don’t really need the measurements for marketing (that would involve *doing* marketing), but there are better social engagement stats provided that make it helpful. Like of all the social media sites, Facebook and Twitter are tied for traffic, and Google Plus is only high scored on my tech blog. I think that if Google let us [auto publish to Google+](http://wpdaily.co/jetpack-google-plus/), those stats would change, but for now, it’s all manual.
This is not to say that I think auto-posting is great for social engagement, but I find I actual pay attention more to the social aspect of the media if I don’t have to remember to post all over the place. This is a massive shift since October 2011, [when I’d stopped auto-posting for SEO reasons](https://halfelf.org/2011/seo-doesnt-auto-post-anymore/). Why did I change my stance? Well it because easier to autopost *and* keep that personal touch with Jetpack’s Publicize feature. Now I can easily insert a custom message, and I know it’s going to (mostly) use my excerpt.(For some reason Tumblr is a moron about this) That saves me effort and allows me to spend more time actually interacting!
Auto-generating my stats with little effort, and being able to easily read them without needing a degree in SEO (no they don’t exist) is also hugely important. Google Analytics is easy to read, but curiously I find it overly complicated to understand. The different pages and layouts make it surprisingly hard to find ‘What were my stats for yesterday?’ Sometimes I have a boom in traffic on one day (like the day I had a 600% increase) and I want to see what went on and why. Where was this traffic coming from? WordPress’s stats do this amazingly well, just as an example.
No one tool provides all the data I need to measure all aspects of my site, nor does anyone one tool collect all the data. Google tells me more about browser size, screen resolution, and everything it can grab about the user, where AWStats and Webalizer give me more information about traffic by showing me everything, bots and humans. Basically server tools are great for collecting server stats, and webpage tools are great for user stats. But you need both.
So in the end, I have at least four different statistic programs I check on, regularly, to try and understand my traffic and measure success.
**Categories:** How It Is
**Tags:** administration, analytics, seo, social media, website
---
### [Gensis: Post Title on Featured Image](https://halfelf.org/2014/gensis-post-title-on-featured-image/)
**Published:** October 31, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little more featured image magic for your day.
**Content:**
This is something that’s done already on my personal blog, and I wanted to repurpose it for another. This was actually very easy, once I reverse engineering a few things.
### Add the Featured Image
First you have to make sure you have a featured image to add:
I’ve probably made this more complicated than necessary, but I needed the extra div for pages without featured images, I wanted to and I wanted to show the image on post pages without a link, so this was what I made.
### Move the header with CSS
I actually use some sass to generate this (thank you [Taupecat](http://www.taupecat.com/) and [my sass plugin](http://elbongurk.com/2013/11/how-to-use-sass-in-coda/)) but I’ve put it in plain PX for you. Adjust as needed. The `.featured-image.no-image` height is to match the height of that site’s featured image, [which I always know](https://halfelf.org/2014/featured-image-size-redux/ "Featured Image Size Redux").
### Style as desired
I threw in this so the whole image changes color when you hover, as a good indicator to what’s going on.
Surprisingly simple.
**Categories:** How To
**Tags:** images, themes, wordpress
---
### [Mailbag: Multiple Download Buttons](https://halfelf.org/2015/mailbag-download-buttons/)
**Published:** January 16, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How I make fake download 'buttons' for my EDD store.
**Content:**
Less a mailbag and more a forum question that grew from a logical question.
How *do* you link ‘external’ stores from your product pages?
Well, for me I do it by having a custom page I designed for my products, and listing three shortcodes. One for EDD (the default `[purchase_link]`) and then two for my own links. In non-shortcode, its like this:
`[Buy from Me][Buy from Amazon][Buy from Apple]`
The actual code is below. I try to keep things as simple as I can when I do this, and I did nick a bit of code from EDD core (you’re supposed to) to make it match. All this does is the most basic of links and it all fits in a nice little box like this:
I like that layout. Reminds you a bit of Amazon, and there’s a reason. If you keep the space open and clear, it’s easy for a visitor to grasp their options. Also I can put below a link to my EU/VAT page and say this “Purchase disabled? Here’s why…” I don’t right now, though I probably should. I couldn’t think of how to elegantly handle making the button a link like that.
## The code
Like I said. Pretty basic.
**Categories:** How To
**Tags:** coding, ecommerce, wordpress
---
### [MP6uccess - Tips and Tricks](https://halfelf.org/2013/mp6uccess-tips-and-tricks/)
**Published:** September 3, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** MP6 has moved from 'This is really nice' and into 'I gotta use this' territory with one simple addition: color themes.
**Content:**
*Notice: Since WordPress 3.8 came out, you **DO NOT** need to install MP6 for anything to work. Promise. If you want the extra color schemes, use [Admin Color Schemes](http://wordpress.org/plugins/admin-color-schemes/), but everything else works in core WP.*
I like [MP6](http://wordpress.org/plugins/mp6/). It’s far, far, far easier for me to read the back end of WordPress with it. It has legible fonts, larger fonts, and best of all, it’s mobile friendly.
The biggest complaint has been that it’s too dark. And I get that, I really do. I personally have trouble seeing white on black (computers only), and white on green (yes, road signs). So for me, the black sidebar was a little heavy, but something I could live with. Then version 2.0 came out and behold, *color schemes*!
I immediately ran this update, zipped to my profile page (where I knew it had to be), and saw this:
The other options right now are Blue (looks like the old blue), Seaweed, Pixel, and Ectoplasm. Seaweed is my favorite, but I decided to make each site a little different and distinct, so I have Ectoplasm running right now on one site and Seaweed on the other. I can tell right away which is which. My only wish is the toolbar was colorized on both ends.
## Tips & Tricks
Okay, okay, I’ll stop selling the plugin, and instead tell you what’s cool to do with it.
**Styling Menu Items**
The items on your menu sidebar default to some pretty boring icons. Bleah. For years we’ve always uploaded our own images to change things in our plugin and custom post types. Here’s an example for my own code for an old Custom Post Type, because I wanted a custom video icon to show up on my sidebar:
Now that I’m using MP6, I have access to [Dashicons](http://melchoyce.github.io/dashicons/), which already has a video icon included, so I can use this:
No need for a hover image, because this is a font and not an image, so the hover is automagically taken care of. The result is exactly what I wanted. It looked just like it was built into WordPress from day one, and my co-authors know right where they’re supposed to go to make a new video post.
There are a lot of options to nab from, and there’s a double edged sword to having some ‘standards’ built in. While it’s super easy for me to make a plugin or CPT use what I want, the same goes for other people. I imagine a lot of shopping cart plugins will want to use `'\f174'` (the shopping cart) if they don’t have their own. Also it means that to ‘match’ you’ll have to use Font Icons yourself, and they’re not super easy to make. Not that everyone worries about matching.
**Force a Choice**
Okay, what if you want to force a choice for everyone?
This is the same as it’s always been, actually. But now everyone gets to use purple and green, yay! Keep in mind, this is a hard force. Everyone uses this. There’s no changing. I have this on one site, since the ecotplasm color actually matched the theme. I set it, went away for the weekend, and found the users laughing and loving the perfect match.
**Also check out…**
I’m sure I’m not the first person do dig out these tricks for MP6. At WordCamp Chicago I remarked that a cool plugin would be “MP6SS” – it would let you pick four colors (similar to the blocks the current MP6 plugin offers), and you could make your own colors on the fly. A little dangerous, but the next option up from that would be a fork of the CSS plugin in Jetpack, which lets you totally customize your MP6 CSS 100%.
Here’s some links I’ve found to more MP6 fun:
- [Till Krüss’ MP6 Icon Examples](https://github.com/tillkruess/MP6-Icon-Examples)
- [Ben Dunkle’s SVG icons](https://github.com/field2/mp6-style-icons)
- [Jon Masterson’s Font-Awesome MP6](https://github.com/JonMasterson/Font-Awesome-for-MP6)
- [MP6 Light Plugin](http://wordpress.org/plugins/mp6-light/)
Do you have any tricks? Post links to your code!
**Categories:** How To
**Tags:** administration, css, design, plugins, wordpress
---
### [wp-cron it up](https://halfelf.org/2013/wp-cron-it-up/)
**Published:** February 5, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** It schedules more than posts, and it can be totally worked around, if you're into that sort of thing.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/browser.jpeg)If you’ve spent much time mastering \*nix servers, you’ve run into cron. I love cron. Cron is a special command that lets you schedule jobs. I use it all the time for various commands I want to run regularly, like the hourly check for new posts in RSS on TinyRSS or RSS2Email, or the nightly backups, or any other thing I want to happen repeatedly. Cron is perfect for this, it runs in the background and it’s *always* running.
My first thought, when I heard about wp-cron, was that it clearly tapped into cron! If I scheduled a post, it must write a one-time cron job for that. I was wrong. Among other reasons, not everyone has cron on their servers (Windows, I’m looking at you), but more to the point, cron is a bit overkill here. Instead WordPress has a file called wp-cron.php which it calls under special circumstances. Every time you load a page, WordPress checks if there’s anything for WP-Cron to run and, if so, calls wp-cron.php.
Some hosts get a little snippy about that, claiming it overuses resources and ask that you disable cron. One might argue that checking on every pageload is overkill, but realistically, with all the other checks WordPress puts in for comments and changes, that seems a bit off. In the old WordPress days, this actually was a little true. If you have a server getting a lot of traffic, it was possible to accidentally loop multiple calls at the same time. This was fixed quite a bit in WordPress 3.3 with better locking (so things only run once). Multisite was a hassle for a lot of people, but seems to have been sorted out.
[](https://halfelf.org/wp-content/uploads/sites/2//2013/01/1260389736939208247klaasvangend_Stopwatch.svg_.hi_.png)We already know that WordPress only calls wp-cron if it needs to, so if you disable it, you have to run that manually (which ironically you could do via a cron job (Read [How to Disable WordPress WP-Cron](http://dansgalaxy.co.uk/2010/10/03/how-to-disable-wordpress-wp-cron/) for directions on how to disable and then use real cron.)). To disable wp-cron, just toss this in your wp-config.php:
Now, remember, you still want to run a ‘cron’ job to fire off anything scheduled, so you have to add in your own cron-job for this, which I actually do! I have cron turned off, and a ‘real’ cron job runs at 5 and 35 past the hour to call wp-cron with a simple command:
```
curl http://example.com/wp-cron.php
```
Now since I have multiple domains on this install, I actually have that for every site on my Multisite. After all, wp-cron.php on Ipstenu.org doesn’t run for photos.ipstenu.org and so on. Doing this sped up my site, and put the strain back where I felt it should be. The server.
By the way, wp-cron does more than schedule posts. That’s what checks for plugin, theme and core updates, and you can write code to hook into it to schedule things like backups. Remember before how I said that WP checks to see if there’s anything scheduled? This is a good thing, since if you have your server run a long job (like backing up a 100meg site), you don’t want to wait for that to be done before you page loaded, right?
For most people, on most sites, this is all fine to leave alone and let it run as is. For the rest, if you chose to use cron instead, keep in mind how things are scheduled. Like I set my cron to run and 5 and 35, so I tend to schedule posts for 30 and the hour. That means my posts will go up no later that 5 minutes after. That’s good, but if I use my DreamObjects plugin, the ‘Backup ASAP’ button schedules a backup to run in 60 seconds (so as not to stop you from doing anything else, eh?), which means I’d have to manually go to example.com/wp-cron.php in order to kick it off. Clearly there are issues doing this for a client.
**Categories:** How To
**Tags:** cron, servers, wordpress
---
### [Review: DesktopServer](https://halfelf.org/2013/review-desktopserver/)
**Published:** July 15, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Finally installed DesktopServer. It's a pretty neat thing, but depending on your workflow, maybe isn't quite what you want. It works for me, so here's my unsolicited review.
**Content:**
I’ve been a MAMP user for years, but at WordCamp Chicago, [Suzette Franck](http://suzettefranck.com/) handed me a thumbdrive with free version of [DesktopServer](http://serverpress.com) on it. Interested (and not just because a thumbdrive with an app on it is the way I expect to be handed software today), I installed it once I got back to my office.
## Installation and Setup
You can’t run the zip from the the thumbdrive. It’s a 250meg drive with only 50 megs to spare, so because a Mac is silly, I had to copy the files locally and then unzip. It would be ‘better’ (and this is subjective) if the drive had the installer apps instead of the zips. That said, I know they were copying the zips to the thumbdrives manually so I totally give them a pass.
Once I did unzip it, it said it would have to restart. So I shut down everything, installed, and … no restart. I think it was a poor choice of words:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/ds-restart.png)
Right, clearly I wasn’t paying attention. Still, it’s a strange thing to warn when it didn’t actually happen! Now, I know what they meant is this:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/ds-start-admin.png)
I hate that MAMP does this too, and have long used the [MAMP No Password app](http://www.46palermo.com/blog/run-mamp-without-password-easy-way/) to work around this. I’d love to see that added to Desktop Server.
There were a lot of click-throughs, but that it let me add and create a dev website, complete with the hosts file, was nice. I liked that I was able to easily tell it to install in Sites (where I like my sites!), but I didn’t like that it’s bundled with WordPress 3.5.1:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/installnewsite.png)
Actually I don’t like that it’s **bundled** with WordPress. Blasphemy! But really, it would be killer if it could just have a dropdown of options: WordPress, Drupal, etc. Then when it runs, it grabs from the latest build. WordPress does this with latest.zip. Drupal doesn’t. Didn’t know that. You should, Drupal! For now, people have come up with an interesting [wget based solution](http://drupal.stackexchange.com/questions/23700/how-to-find-download-latest-drupal-version-via-bash), so that would be an awesome thing to add. But I clicked WP (vs nothing), which is the default. I was directed to my site, where all I had to fill in was username and such. All the DB work was done!
## Using DesktopServer
At this point, I was done so I closed DesktopServer.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/done.png)
My site, elftest.dev, was up and running and it was easy to use. Perfect! Seriously, at this point it just worked. If I wanted to spin up another site, that was easy too.
Sadly, it’s not easy to make a subdomain site ala Multisite. I wanted to add ‘foo.elftest.dev’ and I tried to select this be installed in elftest.dev, but got this instead:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/subdomain.png)
That’s okay for me, I know how to use my hosts file, but it would be nice to have this more accessible. After all, the draw of DesktopServer is that it’s *easy* right?
## Shutting down DesktopServer
Here it’s weird. I had shut down the app, because it was done. But doing this only closes the app, not the Apache instance, so I had to reopen (and ‘reboot’ it with Admin rights again) to be presented with this:
[](https://halfelf.org/wp-content/uploads/sites/2/2013/07/shutdown.png)
Now I could shut down.
## Conclusions
It’s a split decision. When I’m using the “MAMP no password” app, it’s certainly easier to activate and deactivate MAMP. However, DesktopServer wins with ease to spin up new sites. For someone like me, who needs to quickly test sites for customers and likes to use foo.dev or foo.loc to test, this is great. I don’t need to hassle with anything, just turn it on, add a site, done. DesktopServer is a little in the middle between easy for newbies and awesome for devs. It’s got a lot of room where I could see it growing, and that’s enough to keep me using it
The downsides are:
- Have to ‘restart’ the app with my admin password.
- Can’t fully customize the website location
- Can’t customize the TLD (no example.co.dv to test an example.co.uk site, and yes I do that)
- No menu-bar tool to activate/deactivate
I’m going to keep using it, of course. The benefit of a fast spin-up of new sites, for what I do with testing people’s sites and fixing them at work, wins hands down.
**Categories:** How It Is, How It Works
**Tags:** review, servers
---
### [Subdomains, WordPress and nginx](https://halfelf.org/2012/subdomains-wp-nginx/)
**Published:** September 15, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
This should be obvious, but I’m not familiar with nginx, so it wasn’t.
I added trunk.elftest.net as a separate subdomain (rather than Multisite) because I wanted it to run trunk and not impact anyone else.
The way that DreamHost works, is you have a separate folder for your `nginx` configurations, called nginx, and it lives off your home directory. This is commonly referenced as `~/nginx/` and yes, if you type in c`d ~/nginx/` you’ll jump right there.
To make WordPress work, I had to create `~/nginx/trunk.elftest.net` and add a `wordpress.conf` file there, with the [standard DreamHost nginx config for WP](http://wiki.dreamhost.com/Nginx#WordPress).
```
######################
# Permalinks
if (!-e $request_filename) {
rewrite ^.*$ /index.php last;
}
```
Magic.
**Categories:** How It Is
**Tags:** essay, servers, wordpress
---
### [Separate Users Are Good](https://halfelf.org/2013/separate-users-are-good/)
**Published:** September 24, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Separating your domains by userID is not only smart, it's so easy a caveman could do it!
**Content:**
When you create a new domain on DreamHost, you can chose to make a ‘new’ user to ‘own’ the site, or use an existing one. There are pros and cons to both, but for anyone who comes from the cPanel world (where separate accounts are de rigueur), it’s pretty normal to expect your separate site to have a separate login name and password.
Explaining how all this works on DreamHost is a little different, because we have users and then we have users and … well let me explain.
## There’s more than one kind of user
The first type of ‘user’ you have at DreamHost is your panel user. This user is the one you make when you sign up, and it’s usually your email. Don’t share this password with anyone, okay?
Next we have your ‘users’ which you can find in [your panel](https://panel.dreamhost.com/index.cgi?tree=users.users&). Those users are the ones who have access to things like ‘shell’ and ‘sftp’ and so on.
Then there are also those ‘other’ users you think of, like the login accounts on your blog, or your email, or maybe even the billing account for DreamHost.
When I talk about separate users, I’m *only* talking about the ones who have access to shell and stuff.
## Users own sites
Those user accounts own sites. That means I have a specific user who ‘owns’ the folder on the server where all my web code lives. And you can see it’s that user because there it is, in the path: `/home/USERID/domain.com/`
Only **one** user can own, and access, a domain. However a user can own **multiple** domains.
So here’s what this looks likes. One user owning multiple domains:
And only one user can access the domain, user two cannot:
This is cool because if there’s a domain under User 2, and it gets hacked, there’s no way for User 1 to get hacked, even if both users are you!(Unless there’s a server wide security flaw, which yes, can happen, but we spend a lot of time trying to prevent that.)
## Logical User/Domain Groups
If you own 50 domains (and I’ve seen users with 200!), having them all owned by one user sure seems easier, but it means if that user gets hacked, they’re all vulnerable, and you’ll probably end up having to de-hack 50 domains at the same time. Instead, it’s wiser to group your domains ‘logically.’ For example, my elftest.net domains have subdomains, all of which are owned by the same user. However my other top-level domains are each owned by their own user. But that doesn’t work for everyone.
Recently I was helping a customer with a hacked site, and he complained that the sites he hosted for his clients were being hacked, and his clients were pissed off. I took a look and saw that all his client sites were under one user ID. I asked him if the clients had more than one domain, or if they all had their own, and he replied that each client had 4 or 5 of the domains. After cleaning up the hack, together we made new user accounts, one for each client, and moved the domains to those accounts. If possible, I always clean before moving, but in one case the customer had 75+ hacked sites, so we moved and *then* cleaned each one, prioritizing the accounts on the way. It took a *very long time*.
 The extra benefit to this is the clients can now have FTP access to their domains and do wild and crazy stuff! But we don’t want them to have FTP.
## Moving The Domain
Obviously first you need to setup users. When I set up a new user, the first thing I do is make it secure. That means I turn off FTP, forcing SFTP only, and if needed, give them Shell access. Personally? I love shell access, so I always leave it available. If you’re using DreamPress, we have Shell turned off by default, but you can activate it.
There *is* a downside, which is that the WebFTP app won’t work. Personally? I find 99.999% of WebFTP apps to be total drek. They’re messy, kludgy, and there are some great free apps like [Cyberduck](http://cyberduck.ch/) which even let you connect with DreamObjects!
Now that you have the user, we want to move the domain. This is so easy, anyone can do it. Go into Panel, click on domains, click on edit for the domain. Go to “Users, Files, and Paths” and change the user in “Run this domain under the user:”
Really, it is that simple.
**Categories:** How It Is
**Tags:** dreamhost, security, servers, wordpress
---
### [Why We Don't Auto-Update Plugins](https://halfelf.org/2013/we-dont-update-plugins/)
**Published:** September 12, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Understanding a little more about why we upgrade what we do, and why we don't what we don't.
**Content:**
Since the push of [DreamPress](http://dreamhost.com/dreampress) (which I’m totally digging), the ‘One Click Install’ feature of [DreamHost](http://dreamhost.com) has become a little more obvious to people, and it’s benefits and disadvantages.
## What’s this auto-upgrade thing?
To make this simple, if you use DreamPress or our One-Click installer, we *automatically* upgrade WordPress for you! It doesn’t happen the very second WP has a new version, mind you, we spread it out to not destroy our servers, but you will get upgraded unless the upgrade feature was disabled (of course, you would never disable them, right?). Any time you want to see if you have automatic upgrades enabled, or want to run your own, head over to the [DreamHost Panel](https://panel.dreamhost.com/index.cgi?tree=goodies.installer&).
## Why not plugins and themes?
So why do we only do this for core WordPress? Because plugins and themes are messy.
The safest upgrade in the world is the minor upgrade (like WP 3.6 to 3.6.1), as it’s exceptionally rare that it breaks anything. It’s not perfect, of course, sometimes we find out that a plugin or theme was doing something in a very non-optimal way before (if you hear ‘doing\_it\_wrong()’ please keep in mind that is *not* a value judgement, just a code comment, we all do it wrong in the beginning). But rarely will this kind of upgrade break your site.
Similarly, the major releases (3.5 to 3.6) are perhaps surprisingly stable. They’re tested, a lot. At DreamHost there are two people (me and [Shredder](http://getsource.com)) on the core contributor list, and we’re heavily involved in WordPress development every single day, at work and at home. We keep up with WP changes, test them on DreamHost, and work with the core team to resolve issues before they even release a beta! We’re on the job!
“But hang on!” I hear you say. “I upgraded to 3.6 and it broke my theme!”
And *THAT* is why we don’t upgrade themes.
I know, I know, it sounded counter-intuitive. You have to look at it a different way. Your theme stopped working with WordPress 3.6. That means something in the theme is not compatible with the best practices in WordPress core. Translation: WP didn’t break, your theme had a bug.
It sounds like semantics, or hair-splitting, and I totally get that. It also sounds like we’re passing the buck. We’re not! And we’re not trying to imply the theme (or plugin) developer who now has a broken product is a bad coder, or doesn’t pay attention to WordPress. What we mean is that themes and plugins, as they are used by much smaller segments of the WordPress community (*everyone* uses core, but maybe only 1000 use that theme), it just can’t be tested as robustly. This is especially true of the solo-developers. Speaking as one, I used to develop WP only in my free time, so any time WP had a new release coming up, I had to take days to test all my plugins, and pray I got everything. Invariably I missed stuff. It happens. We’re humans.
Breaking isn’t the only reason, though. Sometimes an upgrade is messy and complicated. Take, for example, NextGEN Gallery. When version 2.0 came out, it inadvertently broke a lot of installs. [There was chaos, drama, and finally an open letter.](http://www.wptavern.com/nextgen-gallery-creator-publishes-open-letter) How did this happen? It happened because NextGEN is hella complex, and it’s used in myriad different ways. It happened because plugins and themes can do *anything* with WordPress.
Blindly updating core is safe. It’s tested and easy to roll back. Blindly updating themes and plugins are not always easy to roll back, they’re not always easy to upgrade (some require a massive upgrade script to run), and they may require you to make other changes in your theme. For that, we just don’t.
## If DreamPress is MANAGED Hosting, like WordPress.com, how come THEY do it?
You mean why do the plugins on WordPress.com get auto-updated? Because *you* can’t install any plugins on Wordpress.com! That’s all. They control everything, and simply activate various plugins depending on what package you buy. It’s not really the same thing at all, but I get why people think it is.
## I don’t care! Can I auto-upgrade anyway?
Are you sure? Okay, then! Install the plugin [Automatic Updater](http://wordpress.org/plugins/automatic-updater/) (by Gary P.) and set it to upgrade your themes and plugins. I personally use it on all my sites, but I’ve also personally vetted each and every plugin on my sites.
**Categories:** How It Works
**Tags:** dreampress, servers, wordpress
---
### [SSL Intermediary Certificates](https://halfelf.org/2014/ssl-intermediary-certificates/)
**Published:** December 24, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** SSL failures in weird places with cPanel, WHM, Comodo, and a phone I don't have.
**Content:**
Every now and then, my Andriod friends tell me my store won’t work on their phones.
Now my store works on Chrome, Firefox, Safari, and IE. I get a green lock, which is what you’re looking for on Chrome, and [SSL Labs](https://www.ssllabs.com/ssltest/analyze.html) comes back … with varying results of stupidity. I tend to get this:
> Unexpected failure – our tests are designed to fail when unusual results are observed. This usually happens when there are multiple TLS servers behind the same IP address. In such cases we can’t provide accurate results, which is why we fail.
Now this is a ‘valid’ failure. I have one IP and a multi-domain certificate (ipstenu.org, mothra.ipstenu.org, store.halfelf.org). It’s stupid, mind you, since sometimes it works and sometimes it doesn’t and it gives me a headache. If you look on [Digicert](https://www.digicert.com/help/) or [SSLShopper](https://www.sslshopper.com/ssl-checker.html#hostname=store.halfelf.org), they both come back just fine. I’ve started to think that the ssllabbs cache is drunk. I’m going to assume I’m okay based on [sslcheck](https://sslcheck.globalsign.com/en_US/sslcheck?host=store.halfelf.org#50.28.51.159), who gives me a B because it can’t tell if I patched for BEAST (I did).
That said, I did some research and determined I was not the only person having this issue *specifically* with a Comodo cert! As it happens, the issue was in part due to missing an intermediate certificate in my file. If someone’s already visited another website which has the same certificate seller, the intermediate certificate is remembered in the browser. Sounds great, right? The site loads faster! But if the visitor hasn’t hit my store, then they don’t have the intermediary certificate and it would fail.
But why does this only happen on an Android phone? Your browser on your big computer has a whole mess of certificates it saves for you, to make things faster for everyone. Your phones don’t.
To solve a missing intermediate certificate in the SSL connection, you have to add the intermediate certificate to your own certificate file. This is a little annoying with cPanel/WHM, because I can only do it as root. I’d previously added everything via cPanel as my ipstenu.org log in because it was per domain, right? The trick here is that I have to not just add the certificate by pasting that in, but I have to grab the other two certs that came with:
Notice how there are four? The first one is my certificate, the one I pasted in. The second is my Root certificate, leave it alone. The bottom two I had to add at the bottom of the cert page, where it said “Certificate Authority Bundle (optional):” Those I pasted the content of, one after the other, and saved it. In my case, I was so annoyed I deleted them all and re-added everyone, pasting in the main cert and using auto-fill, and then manually adding in the bundle.
I do find it interesting to note that this *only* failed on Android phones, though.
**Categories:** How To
**Tags:** security, servers, ssl
---
### [WordPress Upgrade Script](https://halfelf.org/2010/wordpress-upgrade-script/)
**Published:** December 30, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** How I update WordPress really fast without the automated installer.
**Content:**
 I don’t like the automated updater. I don’t know why, I just don’t. I have this stupid simple script I use instead. I cleaned it up before posting here. But this is what I use when I want to upgrade my various installs to the latest version, or the nightly build. I didn’t bother to put the `svn` stuff in here, since the script I use for that is fairly weird and particular to me.
The fix to ‘Oh shit, I installed WordPress 2.1 instead of 3.1!’ is to re-run it correctly, by the way. So long as you haven’t logged in to your site, you won’t update the database, so a backout is always a re-run, even in the real world.
**Categories:** How To
**Tags:** command line, unsupported, wordpress
---
### [WordPress Plugin Script](https://halfelf.org/2010/wordpress-plugin-script/)
**Published:** December 30, 2010
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Handy little script to upload new versions of WordPress plugins. It's stupid. It works.
**Content:**
 I don’t like the automated plugin installer. I don’t know why, I just don’t. I have this stupid simple script I use instead. I cleaned it up before posting here. It’s a lot more complicated than my [WordPress Upgrade Script](https://halfelf.org/scripts/wordpress-upgrade-script/) because it has to check for the latest release of the plugin via the subversion repository and clean up weird characters (because people write code on Windows, Linux and Mac and everything else!). This is one of the few times I assume that if you *don’t* specify a version, you probably want the latest and greatest.
**Categories:** How To
**Tags:** command line, wordpress
---
### [Google’s Blog Search is Irrelevant](https://halfelf.org/2009/googles-blog-search-is-irrelevant/)
**Published:** March 9, 2009
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Google's blog search screws up SEO for everyone.
**Content:**
Google is a great search tool to find a website or general information about a topic, but quite frankly I’ve come to despise their blog search engine and I’m seeing serious flaws in their ranking app. In specific, they now search blog links (aka the blogroll) and when you search blogs about a topic, you get unrelated posts.
If you search for [Laurence Fishburne](http://www.google.com/search?hl=en&q=laurence+fishburne) because you saw him on an episode of M*A*S\*H recently as a soldier with a racist CO, Google gives you two hits for IMDb, one for Wikipedia, one about news (GoogleNews that is), and then, finally, his official website. While Google claims they don’t adjust ratings (that is, they don’t give more or less weight to a website on their own) and allow their PageRank algorithm to sort all this out, it seems to me that any **official** website should be ranked first. Also, IMDb shouldn’t be listed twice. But that depends on what people are looking for and what Google offers.
> We stand alone in our focus on developing the “perfect search engine,” defined by co-founder Larry Page as something that, “understands exactly what you mean and gives you back exactly what you want.”
With that in mind, as I look at their [tech overview for people who aren’t super geeky](http://www.google.com/corporate/tech.html), I think that they come to the process a little flawed. PageRank is a great idea, don’t get me wrong. The more pages that link to a site, the higher the site is ranked (in essence). Okay, that’s great! Until you have those damn splogs. You know the ones. Spam blogs that promise you information about a person/place/thing, but is nothing more than a ton of links and 100 popups.
Why would I search blogs? Easy, a lot of news sites are using blogs these days, and I want to read those too. It’s not rocket surgery, it’s how news is disseminated in 2009, folks. And I, personally, like to search by ‘date’ because I want to know what’s newest.
> Our search engine also analyzes page content. However, instead of simply scanning for page-based text (which can be manipulated by site publishers through meta-tags), our technology analyzes the full content of a page and factors in fonts, subdivisions and the precise location of each word. We also analyze the content of neighboring web pages to ensure the results returned are the most relevant to a user’s query.
This looks like it should take care of spam blogs, but if you’ve ever done a search on blogs about someone (let’s use Mr. Fishburne again), you know it’s a crap-shoot.
[A news search](http://news.google.com/news?ned=us&hl=en&q=laurence+fishburne) is actually pretty helpful. I get some articles of interest right up front. If I flip the bit and [sort by date](http://news.google.com/news?ned=us&hl=en&q=laurence+fishburne&scoring=n) it’s still pretty useful. When I go to [blog search](http://blogsearch.google.com/blogsearch?hl=en&q=laurence+fishburne) (which is a sidebar link off news), it’s still mostly beneficial.
But I dare you, I dare you, to make sense of the articles when you click [sort by date](http://blogsearch.google.com/blogsearch?hl=en&q=laurence+fishburne&ie=UTF-8&scoring=d). Three posts on that first page might actually be something worth reading. Good luck finding them, and I hope they actually are what you want. But at the end of the day, those spam blogs aren’t the problem that makes me hate the blog-search.
No, the problem, as I see it, are the posts like this:
That bit I circled for you means that the ‘label’ (tag, category, whatever) for ‘Laurence Fishburne’ has been used 4 times. Go to that post and you will not find a single thing on the page of use. 99.999% of these blogs are blogspot and, while I don’t begrudge them their posts, they’re getting false promotion! And your post that you lovingly crafted about how totally amazing Fishburne is, and how he acted the hell out of that scene last night is now 10th on the list, and bound for page 2 any second now.
The only official Google respons I can find on the matter is a post by Jeremy Hylton in their [google forums](http://groups.google.com/group/google-blog-search/browse_thread/thread/8244fc8731f47970) (dated November 2008).
> We expected some problems from blogroll matches, but may have
> underestimated the impact on searches using the link: operator or
> where the query matches a blog or blogger’s name. We do expect to fix
> the problem you’re seeing. We’ll use the full page content, but
> exclude the content that isn’t really part of the post. I’m not sure
> if we’ll be able to make the change before the end of the year, but we
> are working on it and are pretty confident that it can be solved.
> We’ll post an update here when we’ve got a solution.
And no, there is no update to that post.
The hoopla from other blog sites has died down, but as this is still a prevalent problem on the blog search, I would really like to see it heat up again. Google’s blog search is pretty much dead useless to me if I can’t find information I want. As finding what I want is the whole point of Google (they said it first), they’ve made themselves irrelevant.
**Categories:** How It Is
**Tags:** search engines, seo
---
### [The Self-Perpetuating Myths](https://halfelf.org/2012/self-perpetuating-myths/)
**Published:** September 12, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** G.R.O.S.S. didn't work for Calvin, and it won't work for us either. Are we discriminatory because we're actually racists, or do we only look that way from the outside?
**Content:**
*This is your only warning: I’m going to talk about racism and sexism in tech, and there will be some swearing. I don’t mind if you disagree with me, just try to be constructive.*
 I blame a lot of things on society.
We’ve all heard that minorities aren’t fairly represented in certain aspects of society. There aren’t enough women/brown/gay/whatever on boards, or working in a specific group. We all know that girl gamers get grief. How many of you have gotten asked ‘Are you a girl IRL?’ when you play a female MMO character?
When you look at groups like the [Apple execs](http://www.apple.com/pr/bios/), it’s white guys across the board. Google? [2/3rd’s white guy](http://www.google.com/about/company/facts/management/). Yahoo!’s surprisingly the same with [three out of twelve](http://pressroom.yahoo.net/pr/ycorp/management.aspx).
But that name at the top, [Marissa Mayer](http://pressroom.yahoo.net/pr/ycorp/marissa-mayer.aspx), is the weird one in all this.
Pretty recently she left Google for Yahoo! which was a surprise to a lot of people. Right away, the old snark showed up. She used to blog about cupcakes, and was obsessed to the point of making a spreadsheet about frostings. Seriously? What does that have to do with her ability to helm a company? If anything I’d argue that sort of obsessive attention to detail is what you want. But no, people pointed out it was a ‘chick’ thing. Because a man making a spreadsheet to understand the various pros and cons for armor on an MMO is manly, but food’s a chick thing.
That sounds pretty stupid when you put it that way, doesn’t it?
Look, we all know that when it comes to brain-work, there’s no difference between what a woman can come up with and what a man comes up with. If you can’t accept that, you may as well just stop reading this blog now. What makes the difference is how we were raised and where our natural talents lie. Just because I’m not a super psycho coder, and prefer to spend my time helping people with their code, doesn’t mean I’m less intelligent than the people who wrote an eCommerce plugin. And yet, people persist in saying I’m in a ‘soft’ technology role.
I think I look at more varied code than the majority of WordPress users. I review plugins and I’m pretty capable of understanding what is and isn’t a safe and secure plugin. I can look at themes and tell you where your code is inefficient. Where I lack is not in my technical chops but in my *desire*. How I create isn’t with code, or visual arts, but with words. The fact that I happen to be a woman means nothing. Still, you can’t escape things like the [Women in Refrigerators syndrome](http://www.unheardtaunts.com/wir/), or how few women write comics (even ones with female leads, like Batwoman and Wonder Woman). So what’s really going on here? What’s being under-represented?
From talking to a lot of group ‘leads’ of software projects, things are still skewed to the white guy, and it shows. If you look at a community dinner I attended, the men were the majority. Then you look at *what* the women/brown were the leads for, and you come up with the disturbing comment I heard that UI and Support are ‘soft’ tech topics, and that sure made me feel pretty crappy. But I know support isn’t ‘soft’ anything. In support you see more code than just what you and someone else write. At the same time, I’ve been told many times that there’s no coding involved with support.
*Edit: Note, the other woman actually was a core-team rep, not UI, which made the comment I heard even stupider.*
A lot of this is a self-perpetuating perception issue: If a group isn’t equally represented, then there’s an issue. If women aren’t 50% of the presenters at WordCamp, you’re `doing_it_wrong()`, people will say. And yet we know that forcing equality does not actually make things equal. The basic idea of affirmative action makes a little sense “If you have a white man and a black woman equally qualified, pick the person who will bring more diversity to give diversity a chance.” Then again, that sounds really fucking stupid when you say it outloud, doesn’t it?
Why do people feel ‘minorities’ aren’t represented? Why do people feel equal numbers means equal representation? What makes equality?
I’ve been involved in technology since I was a kid. My grandmother loves telling the story about how, when I was under-six, I set up her Novation CAT modem, dialed into her IBM server, and entered in all her data so that she could make me french toast. Never once, until I was in my 20s and working for a company, did anyone ever make noise about how I was a woman. My family made no point of it, and neither did my schools, my friends, or the people I talked to online back then. To them, this was not a ‘boy’ thing or a ‘girl’ thing, but simply something that I liked to do. Meanwhile, I was chastised by my peers for being a tomboy, for being the ‘masculine’ one in my relationships (I feel bad, in retrospect, for my ex-boyfriends), and for all those other things where I didn’t fit in with normal. But computers, technology, and everything along those lines were *never* something where gender-lines were drawn.
All of that changed when I joined corporate America. Within a week, I knew, yet again, I was ‘different.’ I was one of five women in my area, and one of two technical women (the others were managers, though one was a working manager). I was weird, because I liked technology, I liked to play with things, and I’d research when I didn’t know. The more I moved away from Microsoft, the less overt my social oddity became, but it was still there.
*This behavior does not replicate within the WordPress Community in the same way.*
Oh, it’s still there, don’t get me wrong. If you want to go search through the forums, there are some awesome posts where a guy goes from totally respecting me to insulting me, and the trigger is when someone mentions in passing that I am of the female persuasion. But in the WP ‘core’ team, I’ve never met anything but respect and friendship. Now these guys are, predominately, white men, and just by their nature, lack the ability to know what it’s like to be a woman. That’s not a bad thing, it’s just a fact. I can’t know what it’s like to be brown, they can’t know what it’s like to be a woman. But like attracts like, and it’s not surprising that the leads end up being white males.
Most groups work this way. You want to work with people you can get along with, so you pick people similar to you that add value to the party. Again, nothing’s wrong with that! Does that mean minorities get under-represented? Yes. And there is something wrong with how we’re skewed, in that way. It’s not really their fault. Like I said, I blame society. I can’t help but see the world as a woman who’s been treated like crap for being a woman, and white amles can’t help seeing the world as anything but who they are either. And I don’t think ‘forcing’ people to be diverse helps at all. It just sets up a whole mess of problems.
What can Open Source do?
So far, I think they’re doing it right, and much of that has to do with the need-based drive of technology. We need solutions, we don’t care who comes up with them, so long as they work and are secure. Also, because a lot of these developers are distributed, we lack the inherit problems of sight-prejudice, that is, if you can’t see I’m a minority, you rarely assume I am one. I become judged on the character and quality of my communication. This has drawbacks, of course. The lack of visual cues makes many of us seem like assholes (text is a terrible communication medium, as it leaves the reader to interpret what they will from what they read), when all we are is being direct.
It could be better, of course, but I don’t feel that forcing integration is going to do that in a way that won’t leave us with lingering animosity. The problem I face is that I *don’t* know the answer. I see the problem, and I feel, on a visceral level, the solutions we’ve made aren’t working. I rage against ‘Political Correctness’ because as we take away more and more ‘bad’ things to say, we’re left with a neutered society that lacks the ability to express their thoughts. You can’t say retard, lame, gay, or a hundred other words to express how stupid you feel something is, and with understandable reason. But saying ‘drat’ just doesn’t feel strong enough sometimes, and you want to shout ‘mother fucker!’ We lose freedom of expression in our quest to be fair.
This brings us back to my three questions:
- Why do people feel ‘minorities’ aren’t represented?
- Why do people feel equal numbers means equal representation?
- What makes equality?
The fact is, I don’t know. I think the answer is numbers, but that feels less right when I say it. It’s both in value of work and volume, certainly, but neither one is more important than the other, when we get around to it. Like I said at WordCamp San Francisco: WordPress would be nothing without the devs, but it would also be nothing without the users, and without the people who offer support. We all work together. And thankfully, for the most part, Open Source gets this.
My suggestion to minorities, of whom I am two, is that sometimes when we feel we’re being persecuted, or picked on, it’s actually not that at all. We may be reading a personal attack into something that wasn’t meant that way. Take a moment to reason it out.
My suggestion to the majority, of whom I am one, be careful when you make assumptions. When you look at the world from a place of privilege, it’s incredibly hard to see things from that other perspective. Also take a trip to where you’re the minority. It’s enlightening.
I call these self-perpetuating myths because they make themselves more important. The more white-guy-only groups, the more white-guy-only they remain, and the more minorities feel/appear undervalued and underrepresented. Like begets like, and so on, until finally all we have is a steaming pile of angry. I leave this open ended, as the development of humanity is ongoing, and I hope in a decade, I can come back and look at this in a new way.
**Categories:** How It Is
**Tags:** essay, open source
---
### [Listen to the Aftertaste](https://halfelf.org/2012/halfelf-chats/)
**Published:** June 29, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** So yeah, you heard me Wednesday night. Or now if you want to download it and listen. I dialed in to the WP Late Night Aftertaste.
**Content:**
On Wednesday, the guys at [WPCandy](http://wpcandy.com/) have a podcast, WP Late Night, where they talk about WordPress. After the show they have the Aftertaste. And this week I ended up on the Aftertaste.
Basically Dre noticed I was on IRC (a rarity for me) and asked if I wanted to join them. I thought about it, hauled my laptop into my office and chatted away for an hourish. I’m rarely home and un-busy on a Wednesday, so it’s a treat for me to listen live (instead of at work or on my iPad after the fact).
**[Aftertaste #25: After WP Late Night 15 (with Ipstenu!)](http://wpcandy.com/broadcasts/aftertaste/025-after-wp-late-night-15)**
I’m at the 52 minute mark or so, but the whole after show is 2 hours and change.
Mostly I talked about support, WordPress, a bit about me, and … Honestly I haven’t listened in great detail. My wife says I started quiet and got louder, and others have said I don’t sound like a twelve year old girl, so that’s something.
At the very least, you’ll hear me pronounce my own name.
Amusing things you will learn:
1. Why I can’t rent a car
2. Where I work (but not by name)
3. What WordCamps I’ll be at
4. My citizenship
5. My sense of humor is exactly the same as it is online
I admit to be tickled pink that people think I must be calm and patient with all the repetitive questions you get in the forums. I’m not, they just can see my rolling eyes. I have a sardonic sense of humor, though, so I put up with it. I just vent elsewhere.
Oh and the ‘book I wrote’ mention was, indeed, about [WordPress Multisite 101](https://halfelf.org/ebooks/wordpress-multisite-101/ "WordPress Multisite 101") (and it’s followup, [WordPress Multisite 110](https://halfelf.org/ebooks/wordpress-multisite-110/ "WordPress Multisite 110")) so feel free to link people to them.
Fun thing that didn’t get mentioned, yes, I’ll be at WordCamp Chicago. I have a ticket to WC San Francisco, and the vacation days, I just have to sort out the travel stuff and hotels, because I can’t rent cars, and stuff is expensive.
As an added bonus, [here’s the last time I did anything audio-esque](https://ipstenu.org/2010/shirley-maclaine/).
**Categories:** How It Is
**Tags:** interview, wordpress
---
### [WordCamp Elevator Pitches](https://halfelf.org/2015/wordpress-elevator-pitch/)
**Published:** April 13, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You've got my attention. Now sell it right.
**Content:**
When I go to a WordCamp, I bring a little notebook. We had a DreamCon and there are about a vigintillion little Scout Books branded for it and no one at the company wants them, so I have 20 at my desk and a couple boxes more at home, and every month I burn through one. But I also bring a fresh one to each WordCamp:
[](https://halfelf.org/2015/wordpress-elevator-pitch/img_0103/)
WordCamp
[](https://halfelf.org/2015/wordpress-elevator-pitch/img_0105/)
March
Both of those notebooks are 90% full right now. At the end of a month, I copy over everything that wasn’t done in the previous book and put it on the first page. After that everything gets a new page and I X out the page when it’s done.
But this isn’t about how I take notes, or not, it’s about how I learn something new at every WordCamp I go to. Often I learn about new products from people I know, but other times I learn about new methods to coding, tricks I can use to improve my development processes, or just understanding a feature a little better.
I stress everyone should unplug at a WordCamp, turn off the laptop (unless you can just take notes without checking Twitter and Facebook compulsively), and listen. I take notes by hand because it forces me to focus. I have to listen and write and pay attention. By hand I can doodle as well, so I give myself visual clues to what I was thinking later on.
One thing I also do is that I take notes on sessions from the front to the back, but from the back to front I write down all the new-to-me products and features. Sometimes it’s just ones I know about and need to look into a little more. Sometimes they really are brand new. This is why I don’t take your business cards. I write down what I need to know, what I think about it, and your URL. If you can’t give me a URL (or your URL is too long) maybe I’m not going to look at your site.
After a camp, in my ‘downtime,’ I go back through the notes I’ve made, look them up, and decide if I like them or not. From that I’ve sorted out some tips for vendors and people trying to give me their elevator pitch on why I (or my company) need to pay attention to them.
## Make It Short
If it takes you longer than 5 minutes, I’m tuning out. You’re at a WordCamp, people are generally checking you out in between sessions, so we want the tweet version of what you’ve got.
> Our product compresses images better than SmushIt.
That was perfect. That got my attention and immediately had their name in my notebook.
## Make It Easy To Find
If I go to your URL, the one you gave me, and cannot find the ‘WordPress’ product in one click, you’ve failed and I’m not looking at you anymore. The aforementioned image compression tool failed on that one. I went to their company site, the one they gave me a URL to, there was no information on that specific product. In fact, it’s been a few days, and I googled for it, and I *still* can’t find it! I know it started with a V, but I assumed that they’d have a link to their WordPress related products on their webpage.
If the main URL of your site is not the one with this product, make that clear.
> Check out example.com/product-name/
Oh and that’s a great URL.
## Have a Demo
I want to see how good this is. Period. With the exception of ‘I’m a new webhost’ if you have a product, let me see if and if possible play with it. This is incredibly true of people who have proprietary code, like a service. No demo? Not going to look further.
## Be Ready for Tech Questions
You’re at a technical conference. I’m going to ask things like “Have you benchmarked against TinyPNG? What’s the improvement over the similar functions in Photoshop like XYZ? Does the plugin hook into an API on your end? How do you handle network latency and speed? What happens if it times out? What’s the failback?”
75% of the vendors I talk to at WordCamps tell me “I’m not the technical person…” That’s disheartening. If your sales people can’t answer the basic questions, or you don’t even have a white paper with some tech dirt, you’re not thinking about your audience. Selling to WordPress people means you shouldn’t forget the devs. You can sing and dance your cool factor all you want, but if someone asks a technical question, you should have a technical person around.
## Show Me The Code
This annoys me a lot. When people are selling a plugin, I have to buy it to see the code. So when someone asks me to eval, the first thing I ask is “Is this a service?” If it’s not, I’m annoyed I can’t see your code. Moreso when I ask you “Well I’d eval but it’s pay for. Can I look at the plugin source code?” and you say *no*.
If you’re at a tech conf and they want to see your code before committing, you may want to consider who you just asked to evaluate the code. I do explain that I’m a plugin reviewer for WordPress.org and I work for a webhost. Now if you’re interesting enough, I’ll buy your plugin and check it out. Still. A lot of us want to see the code.
## Your Product Beat Your Swag
There were two vendors at a recent WordCamp where the swag they gave out was more memorable than what they were selling. That’s just sad. I don’t care that you were giving away notebooks or watches or cups or shiny balls. I care what you’re selling.
**Categories:** How It Is
**Tags:** business, wordcamp
---
### [Whatevergram: The Honeymoon is over](https://halfelf.org/2014/whatevergram-the-honeymoon-is-over/)
**Published:** April 9, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Collecting my hipster media isn't as easy as I want it to be.
**Content:**
I’m not a photographer. I’m not artistic in that particular way and I don’t want to learn to have to be. The joy of Instagram is I can take a photo, slap a filter on it, put a border, and boom. Done. Share it with friends. The sad part about Instagram is putting that photo on my blog. It’s all machinations and annoyances.
What I wanted:
1. An easy way to take ‘styled’ pictures.
2. An easy way to push those pictures to my blog.
3. An easy way to determine how I want the pictures to post.
That’s all, three things. Now, Instagram wins at #1, and Pressgram wins at #2, and the both suck at #3.
That third one is the hardest, I guess, but what I want is that when I upload a file, it *either* makes an individual post or makes a gallery post of the whole day. And in both cases, I get the option of making a post publish right away or save it as a draft. I kind of love the idea of ‘This week in \[Insta|Press\]gram’ as a post for a photo blog. In looking at my options, I determined there’s one Pressgram plugin and a million Instagram, but none really do all of that.
But really … Pressgram 2.0 fixed most of my issues with UI, and for that I’m very happy about the new version. It’s easier to read and use, the layouts make sense. I’m even okay with the in-app purchases for things (though charging for some of the things Instagram offers for free strikes me as a poor call). Lacking the nice, snazzy filter names (imagine naming them after WP Themes) and borders/patterns means that if I want those in a quick way, I use Instagram and the *maybe* Pressgram to upload.
Except that isn’t what happens. I take a bunch of photos. At the end of the day I manually upload them all to my blog. Manually. What an annoying thing. I can’t do the one thing I want, which is make a gallery post. By default Pressgram 2 publishes my posts, so I have to use a plugin to not do that. Or I can use a plugin to import from Instagram (though again, it’s a single post per image). Of note, people recommended Instagrate to me, but it’s not Multisite compatible (says so on the plugin page) and that means it’s either poorly written or it’s doing something really wrong, since Multisite shouldn’t matter at all for that. Also it’s manual.
The best plugin I found was one that daily pulls in my Instagram pictures and saves them as draft, leaving me to manually merge and make a “This week in Instagram” gallery. There was another that can make a weekly post, but it’s old, out of date, and doesn’t actually save as draft anymore. There’s not really a perfect way to do that, though, as even the ‘import on demand’ plugins seem to have gaffs and time delays. Obviously Pressgram’s ‘Post direct’ method is going to be more precise, but even then it doesn’t have a ‘collect everything from a week’ if it’s going that.
I know I said the Honeymoon is over, but to be honest, I don’t know that it was ever here to begin with.
**Categories:** How It Is
**Tags:** essay, plugins, wordpress
---
### [Multisite Stands Alone](https://halfelf.org/2012/multisite-stands-alone/)
**Published:** December 31, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Multisite is the WP baby, and it can't do everything you want because we haven't written it all yet. That's all there is to it.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2//2012/12/nkotb.jpeg)While I wrote up a lot of reasons why you [shouldn’t use Multisite](https://halfelf.org/2011/dont-use-wordpress-multisite/), the truth is I really like it and find it well suited to my needs. But one of the big problems with it is that everyone’s network setup is different. Many times, when people ask for help in the forums, I have to sketch out the bare ideas of what to do and why. This brings people to their biggest complaint in Multisite: Why isn’t there a plugin for this already?
First and formost, Multisite is still ‘new’ for the mainstream. [Thelonius, the 3.0 release, is only two and a half years old](http://wordpress.org/news/2010/06/thelonious/)! WordPress 1.0 came out in 2004, just as a reminder. 3.0 is when Multisite was folded into full WordPress, and it’s not been there very long, but it’s changed a lot since the start. In 2010, when 3.0 came out, there were [10,000 plugins](http://wordpress.org/news/2010/07/100-million/) in the repository. Today we’re at 22,000 and growing every day. When it comes to single site WordPress, the plugin world is mature and populated. Of those 22,000, about 300 are specific for Multisite. That’s a pretty small number when you look at the over 1000 plugins that do something with Twitter. Of course, most plugins work with Multisite anyway, but the ones that are Multisite *specific* are the ones to look at here.
A plugin is developed to fit a need. A good developer tries to keep the plugin simple and adaptable, so as many people as possible can use it for as many situations as suit their needs. Doing that has a lot of weird scope creep, of course, and if you consider that we do have 1000 twitter related plugins, you may understand why. Plugins fit a need, and when they don’t we extend/fork/hack the plugin to fit *our* specific need. Multisite, in and of itself, is fitting a need, and while that need is very specific, it’s also very broad. There are myriad reasons to use Multisite, and because of that, those 300 plugins that are built specifically for Multisite have to meet all of our needs. Of course, that’s not how it works.
While the majority of themes and plugins work *just fine* on Multisite, the ones people get in arms about are the ones that are supposed to be ‘for’ Multisite. These plugins should do more, but not too much. They should meet my specific needs, as well as all of yours and hers and his too. There should be a plugin for everything. Why am I the only person who wants this? I walk away from those arguments a lot, or I point out “You’re not the only person who wants it, but you’re possibly the only person who wants it *in that way*.”
Plugins are not the silver bullet for everyone. Your site may be a werewolf, mine a zombie, and his a vampire. Each one has their own needs and because of that, their own requirements. So let’s be direct. The whole reason you can’t find the perfect plugin is because no one’s a mind reader. The reason you can’t find everything you want in one plugin is because you didn’t write it (or have it written).
What does that mean? Multisite is still young, and those 300 Multisite specific plugins aren’t all Multisite *specific* first of all. At least a third are listed as Multisite because they work on Multisite. For example, [bbPress](http://wordpress.org/extend/plugins/bbpress/) is tagged ‘multisite’ but it wasn’t built ‘for’ Multisite. On the other hand, [Networks for WordPress](http://wordpress.org/extend/plugins/networks-for-wordpress/) is built for Multisite, and nothing else.
The best way to tell if a plugin is built just for Multisite is to see if it set ‘Network:true’ in the code. If you open up the code of the plugin, you can see this in the header:
[](https://halfelf.org/wp-content/uploads/sites/2/2012/11/network-true.png)
Now, not all Multisite plugins are meant to be Network enabled, but only plugins that are for Multisite will be Network only like that, so it’s one way to make sure that plugin is intended for Multisite. The downside to that is expressed via something like BuddyPress, which *if* you use on a Multisite must be network activated, but you don’t have to use it on Multisite. This means the check isn’t perfect.
[](https://halfelf.org/wp-content/uploads/sites/2//2012/12/nkotb-new-kids-on-the-block-2314664-1280-960.jpeg)The point to all this is that Multisite’s still the new kid in town. It isn’t perfect, and it is still evolving and changing in pretty dramatic ways. Also, I find it pretty cool to watch it grow. But the reason you can’t find all the plugins you want with it is really simple: They haven’t been written. You may actually be the first person who wants something done in that specific way, and with the myriad new methods Multisite gives us to do amazing things, there’s a lot of room for different options.
What should you do if you’re not a coder and want something that’s never been done? Well, learn to code. Or hire a coder. I wish there was another way, but when you want that special one-off toy that really isn’t suitable for everyone, you’re going to need to meet the challenge head out. None of this is meant as an excuse, by the way, but an explanation. It’s just not done. Yet.
**Categories:** How It Is
**Tags:** coding, multisite, plugins, wordpress
---
### [No More PHP Code (In Widgets)](https://halfelf.org/2013/no-more-php/)
**Published:** November 5, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Breaking up with PHP Code in Widgets is making friends with Otto.
**Content:**
I consider Otto one of my friends. He’s a guy I don’t mind hanging out with in a bar for hours. His code advice (and debugging advice) has furthered my career. He’s also one of the more realistic folks out there when it comes to work/life balance. Enjoy your beers, bro. So you can guess my surprise when, a couple years ago, he lamented to me about his plugin, [PHP Code Widget](http://wordpress.org/plugins/php-code-widget/), and how he wished everyone would quit using it. “I use it.” I replied, and earned an Otto-Grumpy Cat glare. “Don’t.”
Further conversations illuminated the situation. The code works, but it’s not great since people can use it to insert anything PHPish. Sure, in the wrong hands that is hella dangerous. I was *about* to broadly declare “I’m not the wrong hands!” when I thought back on everything I do, and where I do it, and I sheepishly replied, “I guess I’m just lazy.”
And that’s the crux. I am lazy, and I looked for the easier way to include a PHP file in my widget areas. I was using it to show ads (the ones you see all over this site) via `include("/home/foo/public_html/blah.php");`. Why? Because I use the same ads on multiple places. But that’s *it* for my PHP usage. Which means for me, replacing it with anything else is super easy!
### Shortcodes
They work in widgets, so hey! I knew I just needed to include a specific PHP file from a specific location, so for me, this was pretty simple. Also it meant I could call a `do_shortcode` in other places in my theme functions to add it in.
I put in the little fail check to be hidden, so I would know where to look. This obviously works well for me since I’m pretty limited in how I was using Otto’s code. Before this, though, I was also using it for some [BuddyPress sidebar trickery](https://halfelf.org/2011/customizing-sidebar-profile-bp/) which could not be done (easily) with shortcodes, and really nor should it be, so that brings us to number two…
### Make Your Own Widget
Widget code is … weird. It’s not as easy as a function, and it’s way the heck larger than shortcode code, for many things. But you should remember that better or worse is subjective, I know, but for me it wasn’t worth the time to do it. It takes me way longer to master widget code, which I can’t use everywhere (in post content, in footers etc). But Otto’s general advice has been to make a widget.
It’s also probably way safer than doing an include like I am, but when I started needing the shortcode all over the place, that’s what it was.
**Categories:** How To
**Tags:** coding, plugins, widget, wordpress
---
### [Is SEO Best Handled by a Plugin or Theme?](https://halfelf.org/2013/seo-plugin-vs-theme/)
**Published:** December 2, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** While WordPress is great at SEO, it can be improved upon by good themes and good plugins. But which is best and won't leave me hanging out to dry if I change themes?
**Content:**
I’m not an SEO expert, but I know a heck of a lot more than many people who claim they are. For the record, I’ve been messing with SEO since it was ‘correct’ to put hidden text in the source code of your site. I used to spend time getting sites to rank well on Lycos and Altavista, back when I was but a wee intern for my friends. It’s fair to say I’ve been around the block with SEO.
I don’t consider myself an expert because of skill, though in the last couple years, I’ve decided not to keep up as closely with things like [schema](http://schema.org/), mostly because I don’t have to. I still retain a solid grounding in what does and does not make for good SEO (content!), and I understand that part of good SEO isn’t just content, it’s how the content is displayed for the reader, but also how the information is sorted for the computers at search engine companies.
[](http://www.flickr.com/photos/wavyday/4431348645/in/photostream/)Credit: [Plymouth UK](http://www.flickr.com/photos/wavyday/4431348645/in/photostream/)About every couple months, someone asks me if I prefer using a theme or a plugin to manage my SEO, and I have been giving the same answer for a couple years now. I don’t use either.
This does not mean that the themes I use aren’t ‘SEO’ optimized, of course. It means that I don’t use their ‘extra’ features. I use, primarily, [StudioPress’ Genesis Framework](http://www.shareasale.com/r.cfm?b=346200&u=728549&m=28169&urllink=&afftrack=) right now, and that comes with an SEO settings page which I never use. Ever. In fact, I turn it off in any child theme I make. This is not because I don’t think that it’s useful, but that what I do ‘use’ for SEO is already included.
My SEO consists of making my content fantastic, using a theme that includes schema headers (or adding them myself if not), and following the guidelines Yoast outlines in his article [WordPress SEO Tutorial](http://yoast.com/articles/wordpress-seo/). I don’t do *everything* he says (he likes ‘category/postname’ for permalinks, I like ‘year/postname’ but if date doesn’t really matter, I use category instead), but I do read and *think* about what it means.
That’s the crux isn’t it? I don’t blindly follow advice, or use a plugin or theme because people say I have to. I read, I think, and I come to logical conclusions, and I apply them after I write my post.
For example, Yoast says not to use ‘stopwords’ in titles and make them SEO friendly. I take this to mean your human readable title should be gripping, but the title slug should be short, to the point, and descriptive. So I customize every single title. I come up with four or five before I post, and then when I have one with a good grab, I tweak the title slug to be as short as possible, while still being descriptive. Sometimes I’m better at this than others, but I keep working it.
Next I customize my ‘publicize’ lede. This has to be good and it has to be short. I know I’m using my helf.us yourls, so the URL itself will be tiny, but that doesn’t mean I should use just my title for Twitter. I customize it, trying to make it a little more witty and pithy, to reflect me and my readers. Finally I customize my excerpt. Oh yes, my excerpts are all custom written, and they are intended to grab you hard. Like Yoast, I feel the only well written description is a hand written one, and I do it. For everything.
This puts me at a funny disadvantage. Most plugins and themes I’ve seen tend to want you to make a custom meta description. There are plugins (like the one I *do* use, listed further down in this post) that allow you to use your excerpt as descriptions, but I’ve never quite understood why themes make this so hard. In Genesis, I have a field for “Custom Post/Page Meta Description” in every post, which if I use it, will change the meta value for description.
When I dug into the code, I saw that it was pulling this:
Clearly all I need to do is make that default to what I want. And when I figure that out, I’ll let you know. Right now, all I could do was remove Genesis’ function and replace it with my own. Not elegant at all.
Now all that said, there are times when I see to ‘improve’ upon the SEO I’ve been given, because someone else is handling the content will far less care than I give. When that happens, I grab [Yoast’s WordPress SEO Plugin](http://yoast.com/wordpress/seo/). But for the most part, I don’t do anything on a regular basis that involves having to ‘customize’ my SEO, so it’s infinitely portable to any theme I want.
**Categories:** How It Is, How It Works
**Tags:** plugins, seo, themes, wordpress
---
### [Ministry of Silly Plugins](https://halfelf.org/2013/silly-plugins/)
**Published:** December 30, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Sometimes you have to look at what's weird to understand how great a thing can be. Study and learn from the silly!
**Content:**
It’s been too serious lately, and this is the last (planned) post for the year, so what are your favorite, totally useless, plugins?
I wrote one. [Rickroll](http://wordpress.org/plugins/rickroll/) – Changes ever video to RickRoll. It’s useless, pointless, and funny. I don’t actually know anyone who uses it.
For IE6 users, there’s [Graceless Degradation](http://wordpress.org/plugins/graceless-degradation/) which just punishes IE6 users with Comic Sans. Speaking of, there’s also [Comic Sans](http://wordpress.org/plugins/comic-sans/) which does it for everyone and [Comic Sans FTW](http://wordpress.org/plugins/comic-sans-ftw/) which is when you need it on your admin dashboard.
Not enough color? Suzette likes [Nyan Cat](http://wordpress.org/plugins/nyan-cat/). Just a great big NYAN on the screen. Otto wrote [Unicornify](http://wordpress.org/plugins/unicornify/) which makes your gravatars Unicorns (and would Gravatar please buy/absorb them and make them real? Please? More gravatar options needed!). Similarly he wrote [Rainbowify](http://wordpress.org/plugins/rainbowify/), for the gaudiest toolbar ever.
Need more snark? My snarky friend Andrew likes [Get Snarky](http://wordpress.org/plugins/get-snarky/) – one of the goofiest “Hello Dolly” replacements out there.
Want to live dangerously? [Logout Roulette](http://wordpress.org/plugins/logout-roulette/) will randomly log you out! One chance in ten is way better than traditional Russian Roulette of course.
Finally, how about a good old fart joke? [Farticles](http://wordpress.org/plugins/farticles/) farts while you scroll.
Someone might ask “What is the point of these plugins?” To them I say “The same as for Hello Dolly.”
The point of a plugin isn’t *always* to do awesome things and make your site have every feature it needs. It’s also to demonstrate the exponential extendability of WordPress. To show you the myriad ways you can take a site and make it wonderful. If learning by being silly is what it takes, then by all means, make a silly plugin! A silly plugin, much like the [intentionally evil plugins](http://breakfix.elftest.net/) I like to make, serve the same sort of purpose. Teaching people how to do things in a better way.
A silly plugin is way less terrifying than an evil one, though I tried to keep my evil down to a low level of annoying rather than truly evil. You can take the bones of either kind of plugin and legitimately do things that really are not in anyone’s best interests, but you can also take them to see how everything is put together in WordPress.
How have you learned from weird, silly, code?
**Categories:** How It Is
**Tags:** coding, plugins, wordpress
---
### [Giving Back Anew](https://halfelf.org/2014/giving-back-anew/)
**Published:** January 31, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Giving back to something new in WordPress is just a part of WordPress.
**Content:**
One of the things that makes WordPress special is that people give back. Even people who make their living off WordPress via their plugins or themes give back in some way, be it testing new versions, submitting patches, or even making suggestions and asking questions. I got my start by giving back and answering low-tech questions in the forums.
Thus it’s natural that, while testing Easy Digital Download’s new version, I reported problems upstream:
And perhaps more natural that I made my first attempt at a patch on Github for it as well:
My code patch is a total of three lines. Four if you count the one I deleted. That’s all it takes to help contribute. You could even fix a typo.
What does this have to do with ebooks? The patch I submitted was for the display of the `[downloads]` shortcode, which will allow you to more easily display a flexible column list of your downloads. If you’ve seen my [Catalog](http://store.halfelf.org/catalog/) page, the books are listed with multiple items per line. But I’m not using any columns. With my code patch, you’ll be able to do this:
`[downloads columns="0" thumbnails="true" orderby="title" order="ASC" buy_button="no" category="wp" price="no"]`
Which outputs no columns and no breakpoints at all. Then you just need some CSS.
Voila! Flexible columns!
**Categories:** How To
**Tags:** plugins, wordpress
---
### [Why Not Multisite?](https://halfelf.org/2014/why-not-multisite/)
**Published:** February 3, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Anything you want to do on a Multisite you can do on a single install of WordPress, with the right plugins. But... Maybe there is a good reason for Multisite.
**Content:**
My most popular post ever has been [Don’t Use WordPress Multisite](https://halfelf.org/2011/dont-use-wordpress-multisite/), which I wrote in 2011. It’s 2014 so it was time for a revisit of this concept.
The point I made in 2011, and again at WordCamp San Francisco in 2013, was that while Multisite is amazing and awesome and wonderful, it’s got limitations. I love it, I think it’s perfect for me, but I always keep those limitations in mind and try to educate people as to what they are. I think I have a pretty good grasp on them by now, and so does Nacin:
> [@jbenton](https://twitter.com/jbenton?ref_src=twsrc%5Etfw) [@Krogsgard](https://twitter.com/Krogsgard?ref_src=twsrc%5Etfw) Basically read everything [@Ipstenu](https://twitter.com/Ipstenu?ref_src=twsrc%5Etfw) has written (including when she suggests to not use it).
>
> — Andrew Nacin (@nacin) [December 20, 2013](https://twitter.com/nacin/status/413910740756869120?ref_src=twsrc%5Etfw)
[](https://halfelf.org/wp-content/uploads/sites/2/2014/01/de1d1489912369ae0e186a31257bc9eb871c60ea7681d0a67d20e314687cd2c2.jpg)This may make you wonder what I could possibly say that hasn’t been said before? The questions remain the same, but the answers change a little as time goes by. I want to stress that for every single reason I’m going to list as a case for *not* using Multisite, I probably have broken. Rules aren’t meant to never be broken, their meant to make sure we understand what and why we’re doing what we’re doing.
The absolute number one aspect about Multisite that you cannot forget is this: Multisite is for running multiple WordPress blogs (aka sites) on one install (aka a network), with *separate* content but a shared base for code and users.
If I was to make it a rule it would be this: Don’t use Multisite unless you want to run multiple WordPress sites, each with their own admin section.
But …
You know how I made that list of reasons? Like you don’t need it to categorize posts and make a site that’s all the same (or even all different), and I still firmly think that no one has any reason in the world to have a site that [duplicates content 100%](https://halfelf.org/2013/how-to-duplicate-content/). Sometimes you do need Multisite for this stuff. Or rather, sometimes you *can* use Multisite, and it’s not the wrong choice!
### You don’t need Multisite
WordPress comes with categories so just use that. Want to remove the word ‘/category/’ from your permalinks? [WordPress SEO (by Yoast)](http://wordpress.org/plugins/wordpress-seo/) can do that, as can [No Category Base](http://wordpress.org/plugins/no-category-base-wpml/). Need to limit an author to a category? Use [Author Category](http://wordpress.org/plugins/author-category/)! In addition, there are Custom Post Types, which you can create for each ‘category’ and then limit authors using [Custom Post Type Privacy](http://wordpress.org/plugins/custom-post-type-privacy/).
WordPress comes with categories and Custom Post Types which let you keep your site looking exactly the same from page to page to page, which is awesome. This is, in an essence, what WordPress was made for. If you don’t want your ‘sections’ to look the same, hey theme templates will let you customize the look and feel of each category (or CPT) as you want. WordPress is crazy flexible, and plugins are phenomenally wonderful to let you customize WordPress to the nth degree. Like [categories as subdomains](http://wordpress.org/plugins/subdomains/), which means it’s theoretically possible to do the same for a CPT. I know you can [map CPTs to domains](http://wordpress.org/plugins/domain-mapping-system/) already.
Before someone gets all snippy about how too many plugins make your site slow, I have to point out that too many *poorly written* plugins do this. It’s not the number, it’s the quality. A bad theme can slow your site down too, and I see that every single day.
### You could use Multisite
So why would I use Multisite for those situations?
[](https://halfelf.org/wp-content/uploads/sites/2/2014/01/2c694ffe7037d81fb1270e3b8c695684b6ed62be4473345bd23b927c5d52ef0a.jpg)What if your ‘sections’ aren’t just meant to segregate content? Like you’re selling eBooks and you want to run a whole special ecommerce tool for tracking and payment. Or maybe you’ve got a membership tool and want to set up a news site where people can register and write, but keep them off the ‘main’ site where you’ll be linking featured content back. What about a site that will exist for a year to represent an event like a WordCamp, and then be ‘retired?’ Suddenly we’re talking categories in a different light, and maybe, just maybe, Multisite would work for this.
It’s *easier* in Multisite to totally re-skin a section because it’s using its own theme. You can quickly spin up a child theme just for one site, or use a plugin like the CSS Editor that comes with Jetpack to allow each site it’s own custom CSS.
Because each site is separate, I can limit plugins and prevent load creep per site. Not every ‘section’ needs the same plugins, after all. And at the same time, the ones that *do* can be network activated. Also a growing number of plugins are taking Multisite into consideration, like [W3 Total Cache](http://wordpress.org/plugins/w3-total-cache/) now lets the network admin configure a large amount of caching settings for the network as a whole! This number grows every day.
### Which Should I Use
There isn’t one perfect answer here, but that’s true of all things WordPress. I think my cardinal rules of Multisite are mutable and all colored with a great deal of “It depends.” For every single reason I wouldn’t use Multisite, I also *would* (and probably have) used it. You have to take into consideration supportability most of all, though. Multisite’s worst flaw is that it leads to cases where your eyes are bigger than your stomach, and your network becomes huge and unwieldily before you’re ready to cope.
The one rule I’ve yet to break, and one I strongly feel no one should, is this: *Never use Multisite if your users cannot know about other sites.*
Other than that? Hey, the world is your oyster!
Multisite is big. It’s daunting. It’s complicated. It’s still, and probably will always be, *harder* than running a single blog, which makes sense. You’re no longer running a site, you’re running a *network*.
**Categories:** How It Works
**Tags:** multisite, plugins, themes, wordpress
---
### [SSL for One Domain on Multisite](https://halfelf.org/2014/ssl-for-one-domain-on-multisite/)
**Published:** February 5, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Quickly setting up SSL for one domain on my multisite.
**Content:**
To start with, I made a mistake and assumed, bad me, that the Terms of Service that let me collect donations for my ebooks would similarly be okay with collecting *payments* for said ebooks. Alas, no. “Digital goods including digital currency” are not permitted, and that was my bad. It resulted in me losing my entire account and having to fight to get my customers their money back.
Meanwhile I decided to get started on making an easy way for people to pay and stay on my site (like Stripe), and this, no matter what, means I need to have SSL.
Normally that’s not too much of a problem, but my store happens to be a subdomain of a mapped domain on a multisite. My WordPress install is at ipstenu.org. This site is actually tech.ipstenu.org, and my store (store.halfelf.org) is actually hshop.ipstenu.org (stands for HalfElf Shop…). I used domain mapping to point halfelf.org to tech.ipstenu.org, and store.halfelf.org to hshop.ipstenu.org. While I *could* just edit the site and home URL in the ‘Edit Site’ page, domain mapping is needed for in order to tell WordPress that the domain is really a thing.
Setting all that up was the easy stuff, though. The SSL part was something I’ve poked at before and given up, since [multiple domains and one SSL cert is a pain in the ass](https://halfelf.org/2011/request-multidomain-1ip-sslcert/ "Request: Multiple Domains, One IP SSL Certificates"). But today, if you go to [the Half-Elf Warehouse](https://store.halfelf.org/), you’ll see it’s all SSL! (NB: It was. It’s now only SSL on pages that need SSL, to allow for better caching.)
### You will need….
- An SSL Certificate
- An add-on domain
- wp-config.php edits
- .htaccess edits
- [WordPress HTTPS Plugin](http://wordpress.org/plugins/wordpress-https/)
**SSL Certs**
This is the easy part. You need an SSL certificate for the domain you need to protect. If this is the *only* domain you want to add this on to, it’s relatively easy. If you need to add SSL on to multiple domains, check with your webhost.
I actually have multiple SSL certs. The problem with multiple SSL certs is that a wildcard one for subdomains costs around $300 (this is on [Comodo](http://ssl.comodo.com/wildcard-ssl-certificates.php)), and I have three domains I need to protect on one server… Oh. Wait, wasn’t this a problem before? As it happens, I’ve got [SNI](http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI) on my Apache instance now, so that was fixed. I picked up a cert for store.halfelf.org and set it up, done. Except…
**Add-on Domain**
Why this? Well it’s funny. I used to always tell people ‘Use Parked Domains, it’s way easier’ and this is still true, it just has a caveat of ‘unless you’re trying to use SSL.’ Now that I am, I hit a sticking point where a parked domain cannot have it’s own SSL cert, but an add-on domain can. This was a simple fix. I deleted the parked domain and flipped it to an add-on domain. Then I added the certificate in for my site and now I have https on ipstenu.org *and* store.halfelf.org but *not* halfelf.org. Why? Because halfelf.org and store.halfelf.org are separate add-on domains. Had I bought a wildcard cert for halfelf.org, I could have made halfelf an addon, and store.halfelf a parked domain on top of halfelf, but this works too.
The other option, of course, is a multi-domain cert, which is too much money for my tastes, and I don’t need it all the time. I have SNI, which makes this so super easy for me, it’s silly. Just add the cert for the domain and have a party.
**WP-Config**
But today I only want to force one of my mapped domains to be SSL:
No that was it. If it’s two domains, it’s this:
and so on and so forth. Why not using an OR check? Because it failed miserably when I did that. I suspect it’s due to ipstenu.org being my main domain, but I was tired and stopped here.
**.htaccess**
Okay, now I want my domain to default to SSL when people visit too!
That was easy.
**WordPress SSL**
What about making everything on my page load SSLish? Install and activate? That was it? Oh. Okay.
### Verify!
Hey! Looks good! Actually I’d had a problem when I first ran this.
Yeah, that little yellow triangle. What the heck did it mean? I trotted off to [Why No Padlock?](http://www.whynopadlock.com/) and got an error:
> **SSL verification issue** (Possibly mis-matched URL or bad intermediate cert.). Details:
> ERROR: no certificate subject alternative name matches
That didn’t help me at all, so I viewed page source and looked for `http://store` and didn’t find anything. Then I looked at the console and saw that it had an error on some JS:
That happens to be my background image. So I went and removed the background image readded it, and the error went away!
### Moral?
Always read the ToS.
**Categories:** How It Is
**Tags:** multisite, plugins, ssl, wordpress
---
### [Contact Form 7 and Anti-Spam](https://halfelf.org/2012/contact-form-7-and-anti-spam/)
**Published:** September 14, 2012
**Author:** Ipstenu (Mika Epstein)
**Content:**
DreamHost has a fairly simple anti-spam policy, which can be summed up as this: [You cannot send email from an address that isn’t your domain.](http://dreamhost.com/anti-spam-policy/)
If that was greek to you, don’t worry. What that means is that my WordPress blog here can only send emails as elftest.net. That poses a small problem if you’re not using your domain-name to send email (a rare occurrence in WordPress), and a large one if you happen to be using the popular Contact Form 7 plugin.
[Contact Form 7](http://wordpress.org/extend/plugins/contact-form-7/) lets you create robust contact forms for your site, however it has one minor ‘flaw’ (and I hesitate to use that word). When it sends email, it sends it from the user who submits the form. DreamHost, naturally, doesn’t like this. joe@gmail.com isn’t an elftest user!
Thankfully there’s a work-around for you, and it’s really easy. For most people, the plugin [SMTP Configure](http://wordpress.org/extend/plugins/configure-smtp/), once installed and activated, will automatically fix this for you! It’s written by a reliable and trusted programmer, and I highly recommend it. Remember! Once you install the plugin, just activate it. For the vast majority of people, this was it. Everything magically worked.
Then there were some people who came and said “No, this does not work.” I’ve yet to reproduce it, but one person told me that after putting in his SMTP credentials, just like you would [setting up email clients](http://wiki.dreamhost.com/E-mail_Client_Configuration), it worked perfectly.
Additional: If you’re using **Jetpack’s** contact form, and you’ve changed the ‘to’ email address, you will *also* need this plugin. You’ll know you’re using that option because you’ll see this in your contact form shortcode:
```
to="me@myotherdomain.com"
```
**Categories:** How It Works
**Tags:** dreamhost, email, plugins, spam, wordpress
---
### [Self-Update Your Plugins](https://halfelf.org/2014/self-update-your-plugins/)
**Published:** September 17, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Keeping up with your own Joneses isn't always easy, but it can be,
**Content:**
When your plugin is hosted on WordPress.org, this isn’t a problem at all. But if you’re selling your own work, or hosting it on a non WPORG resource, there are other concerns. You see, if you host a plugin on WordPress.org, your plugin can’t have it’s own updater script. You have to use the default .org updater. This is just fine, except when you have an add on that you want to be pay-only. Then what?
Take a look at [Easy Digital Downloads](https://easydigitaldownloads.com/?ref=3359). You can get the main plugin from WordPress.org, and if you buy add ons from their site, they get magical updates too! How did they do that? They put an updater script in the main plugin which is then called by the paid extensions. You can even use their Software Licensing add ons to [run your own updates on your server](https://easydigitaldownloads.com/docs/automatic-upgrades-for-wordpress-plugins/?ref=3359)! If you want to sell on their site, they’ll help you take care of that too.
Todd Lahman also has an [WooCommerce API manager](http://www.woothemes.com/products/woocommerce-api-manager/), so if you’re using WooThemes, you’ve got that covered too.
Speaking of self hosting, if you’re hosting your own code on Github, then you want to use Andy’s **[Github Updater](https://github.com/afragen/github-updater)**. While it’s not allowed on .org (sorry Andy), this will let you push updates from your GitHub or Bitbucket hosted WordPress plugins and themes.
My buddy Norcross has [his own free updater](http://a.norc.co/1dt0MZK) for you as well.
You can also look at services like [Auto Hosted](http://autohosted.com/) or [WP Updates](http://wp-updates.com/), both of which promise to make it even easier and faster for you.
Jeremy Clarke has a [automatic theme/plugin updater](https://github.com/jeremyclark13/automatic-theme-plugin-update) as well if you still want to be self hosted.
If you’re using ThemeForest, there’s the **[Envato WordPress Toolkit](https://github.com/envato/envato-wordpress-toolkit)**, which your *users* (not you) will need to install on their sites to get updates. I don’t know if there’s a way to include an updater in your packaged theme or plugin, but that toolkit needs to be all over the place for users. That it’s not brings all the issues you see with their products being out of date.
There are hundreds of other ways around this. And really, there’s no excuse to not keep your plugins and themes up to date, no matter where they live. Keep those users updated and make it *easy* for them to do it! What resources do you use when self-hosting a plugin or theme, to keep it on the up and up, and keep everyone updates?
**Categories:** How To
**Tags:** plugins, themes, updates, wordpress
---
### [Why I Pushed Back On Your Plugin](https://halfelf.org/2014/pushed-back-plugin/)
**Published:** November 19, 2014
**Author:** Ipstenu (Mika Epstein)
**Content:**
The talk at WordCamp Ventura was actually called “Top 11 Reasons Your Plugin Was Rejected.” It was supposed to be ten, but Konstantine said “You should make it 11!” and I did but forgot to update the info for him. Bonus reason! You can see all the slides at [helf.us/wcventura2014](https://helf.us/wcventura2014) right now. Video will be up on WordPress.tv soon.
The truth is, there were only two reasons I actually would ever reject your plugin. If you never replied to our emails about any of the other reasons, we’ve probably rejected you. And if you’re claiming to be someone you’re not in a way we can’t prove, we’ve also rejected you. Let me cover the reasons here, for posterity. My slides are fully accessible, but people learn in different ways.
And to understand how I made this list, I use [aText](http://www.trankynam.com/atext/) to auto-reply to things. I just made a note of which ones I used to most, flipped ’em in reserve order, and thus I had a list.
### Trademarks
This is the funny story one where I rejected [Facebook](http://wordpress.org/plugins/facebook) because they used a gmail address and a DropBox URL for their plugin. I looked at it, thought they couldn’t possibly be Facebook, rejected, and got egg on my face. I’d do it again, though, because the point here is that if you’re making a plugin for a company and you’re using the company name, you need to make it clear and easily provable that you are them.
If you’re doing contract work for, let’s say Pandora, to make an official plugin, you should make a new account on WordPress.org for that. Pandora-Dev or even just Pandora, using a pandora.com email address of course, and then making the plugin downloadable from pandora.com does a lot to make us think you’re real. If you don’t? I may reject you right away.
### Missing readme
Otto used to let me pend a plugin because there was no readme. The number got so high, he made me stop. Now we only do this if you’re acting as a service or calling files remotely. Akismet and Disqus would require a readme, as would Twitter, but “Hello Dalai” would not. Of course you always *should* make a readme, but we don’t force you to do so.
### Phoning Home
Akismet ‘phones home’ to it’s own servers to process your comments as spam or ham. That’s not what I mean here. We don’t permit plugins to phone home to your own server unless they’re acting as a service.
A plugin that simply validates a license and ‘unlocks’ functionality that’s already in the plugin is not a service. A plugin that sends an email or message to your own servers when the plugin is installed and/or uininstalled is also not a service. A plugin that calls out to maxcdn or Amazon S3 for your JS and CSS files is also not a service.
When you call out to another server you’re generally doing one of the following:
1. Intentionally tracking the use of your plugin
2. Creating an unnedded dependancy on another server being accessible in the interest of ‘controlling’ your css/js/images or keeping your plugin smaller
3. Trying to control who uses your plugin
None of those are okay. Think about it as a user. If you’re behind a firewall and can’t access Google (which is not an unrealistic situation), and your plugin requires Google’s version of the html5 shiv script, you just broke your plugin for probably the people who needed it most. Well done.
Don’t do this. Make everything local to your plugin. It will actually run faster.
### Updates
Related to phoning home is a plugin who calls back to it’s own servers for updates. Would you be surprised to learn that WordPress.org hosted plugins can already serve updates from WordPress.org? Of course not. You’ve seen that helpful alert on a site before. This is usually a hold over from self-hosting a plugin, or hosting it on Github, but it still needs to be removed.
One of our guidelines is that you actually use the WordPress.org hosting to, you know, host your plugin. It’s not a directory for spamming, it’s for using to deploy too.
### Encryption
Using encryption methods like `base64()` or `p,a,c,k,e,r` to hide your code or otherwise make it human-unreadable breaks our rule of “No obfuscated code.” It’s fine to compress your code and minify, but it’s not okay to hide it. All code must be human readable for inclusion in this repository.
This is because we feel the spirit of GPL means that anyone can easily look at your code to reverse engineering what it does and expand on it. Easy being subjective of course, but you get the idea. Hiding your code is useless. It doesn’t help the community at all.
### GPL
Speaking of… I don’t care your thoughts on GPL. I really don’t. What I care about is this: In order to be hosted on the WordPress.org repository for plugins, every single bit of code in your plugin must be compatible with the GPLv2 (or later) license. This isn’t negotiable, it’s not up for debate. It’s above and beyond what the GPL requires, and we know that. Which is why I just don’t care how you think we’re ‘interpreting the GPL wrong.’ That isn’t my point at all.
You want to be hosted on WordPress.org? Your code must be 100% compatible with GPL. Deal with it.
### Calling wp-load or wp-blog-header or wp-config
Including wp-config.php, wp-blog-header.php, wp-load.php, or pretty much any other WordPress core file that you have to call directly via an include is not a good idea and we cannot approve a plugin that does so unless it has a very good reason to load the file(s). It is prone to failure since not all WordPress installs have the exact same file structure.
Usually plugins will include wp-config.php or wp-load.php in order to gain access to core WordPress functions, but there are much better ways to do this. It’s best if you tie your processing functions (the ones that need but don’t have access to core functions) into an action hook, such as “init” or “admin\_init”.
If you’re trying to use it because you need to access WordPress functions outside of WordPress, we’d actually much rather you didn’t do that at all. Your plugin should be inside WordPress, only accessible to people who are logged in and authorized, if it needs that kind of access. Your plugin’s pages should be called via the dashboard like all the other settings panels, and in that way, they’ll always have access to WordPress functions.
### Security
Sanitize your post calls, sanitize your SQL queries, use the right code, and be smart. Don’t reinvent the wheel. This is the hardest one to get right and we miss a lot of things, but we want all instances where $\_POST data is inserted into the database, or into a file, to be properly sanitized for security. And when you’re making database calls, it’s highly important to protect your code from SQL injection vulnerabilities via prepare() or other functions.
This is just *hard* but we do try very hard to catch them all.
### Including your own copy of jQuery
Please stop this.
WordPress includes its own version of jQuery and many other similar JS files. If your code ‘requires’ an older version, fix your code to work with the one that comes with WordPress. Having ‘your own version’ means you run the risk of breaking everyone else’s plugins and themes, which makes you a bad person. Stop it. Use the ones with WordPress. It keeps your code smaller and your plugin smaller. Also if everyone uses the built in ones, then the first time one of you enqueues it, the faster everyone else’s code will run. Really. It’s magic.
### Calling wp-content directly
When you hardcode in paths, or assume that everyone has WordPress in the root of their domain, you cause anyone using ‘Giving WordPress it’s own directory’ (a VERY common setup) to break and you make me cry. In addition, WordPress allows users to change the name of wp-content, so you would break anyone who choses to do so.
Oh, and don’t worry about supporting WordPress 2.x or lower. We don’t encourage it nor expect you to do so, so save yourself some time and energy. Remember! If we stop supporting WP 3.8 and older, then people have to upgrade to use our plugins! Everyone wins!
### Not answering an email
If you never reply to an email we sent you about why we pending your plugin, yes you got rejected. In order to keep the queue low and manageable, we reject plugins after seven days from our first reply (not your submission). This can also happen if you’re working with one of us on your plugin code and it takes a long time. This happens when a plugin is complicated, or if there’s a language barrier, or if we just can’t understand why you’re not making the changes we asked for.
---
Did I reject your plugin and you still don’t understand why? Have a weird question about plugins? Ask away in the comments!
**Categories:** How It Works
**Tags:** administration, plugins, wordpress
---
### [Mailbag: What Plugins Do I Use?](https://halfelf.org/2014/mailbag-plugins-use/)
**Published:** December 26, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Let's close out 2014 with some plugin suggestions... Or not. What plugins do I use?
**Content:**
This was actually a bit of a shill from someone I didn’t know, asking to help him with his own ’roundup’ of various experts. I didn’t reply, mostly because I was super busy and favors like this from random people are low on my list of things I’ll ever reply to. But the question is interesting.
> Which WordPress plugins do you use most in the following categories: Seo, Social Media, Commenting, Performance, Captcha and Payments.
Answer to all: None.
Seriously, though. The only ‘Social Media’ plugin I use is [Jetpack](https://wordpress.org/plugins/jetpack/), and that’s just to push my content to Twitter and Facebook reliably. I don’t use any SEO plugins though when I do, I use [WordPress SEO](https://wordpress.org/plugins/wordpress-seo/) because I trust Yoast. Most of the time, my themes handle SEO for me just fine.
Captcha I *never use*. I won’t. I hate captcha. [Captcha isn’t accessible](https://halfelf.org/2010/captcha-isnt-accessible/ "CAPTCHA Isn’t Accessible"), as I’ve been saying for four years. Similarly I don’t use commenting plugins because I don’t need them, and I like owning my content. When you put up barriers to comments, you get fewer comments.
Performance plugins are a weird area. Yes, I use plugins for that, but it’s got to do with what I installed on my server. I have memcached and ZendOptimizer, so I use a couple things for that. [Zach Tollman’s memcached object-cache.php plugin](https://github.com/tollmanz/wordpress-pecl-memcached-object-cache) and [Batcache](https://wordpress.org/plugins/batcache/). But really most of the work is on the server already having the backend required for those. That’s the same reason I have Google Pagespeed on the server.
Payments… I don’t know how I could answer this. I use [Easy Digital Downloads](https://easydigitaldownloads.com/?ref=3359) for sales, and I handle payments through Paypal and Stripe right now. But that isn’t so much a plugin question as a who do I trust with my money question. I’d be using them regardless of if I used EDD or not.
Asking me what I use ‘most’ is a very weird question since I use what’s right for the job I’m facing. If that answer is ‘Not WordPress’ then I don’t use WordPress. So with that in mind, I rarely blanket recommend *any* plugin out there. I listen to people, what they’re asking, what they mean, and how they sound, and I try to recommend based on all to those aspects. There’s rarely one perfect answer for everyone.
If you think I’m joking, read [Chris Lema on the perfect WP shopping cart plugin](http://chrislema.com/wordpress-shopping-cart-plugin/). There are a lot of choices and decisions and options out there, but you’ve got to know what you really need before you make a choice.
Of course for me, when the choice is between two equally well written plugins, I pick the one where I’ve worked with the developers before hand.
**Categories:** How It Is
**Tags:** mailbag, plugins, wordpress
---
### [Mailbag: Tools To Keep Consistent](https://halfelf.org/2015/mailbag-keep-consistent/)
**Published:** February 6, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The trick behind posting three days a week, regularly, for over two years, is to use the right tools. And to have a lot of questions!
**Content:**
Meg from Ohio (go Ohio!) asks the following:
> You blog three times a week about tech. How do you keep doing that?
I schedule posts.
[Chris Lema](http://chrislema.com) doesn’t, bless him. I started with about 10 posts I had in mind, sat down one day and made myself a buffer, and thought that it would be better to space them out to every other day. It actually started as twice a week, but then I bumped it to M-W-F, and since I’m kind of wordy, I’ve been able to keep up with it. Sometimes I write a post because I solved a problem, which happens pretty much every day, and sometimes I toss out a remark on twitter that people want to hear more about.
Much of it comes from listening and reading a lot. But I don’t *just* schedule posts. I use the plugin [Editorial Calendar](https://wordpress.org/plugins/editorial-calendar/) to keep tabs on what my schedule is, when things are being posts, and at what time, because I actually really hate the posts lists.
Here’s your default posts list:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/02/post-list.png)
It’s pretty bare bones and functional, but one of the things that’s always bothered me about the whole post list is how useless it is. Don’t get me wrong, it’s a list of posts, and it does that really well. But with the moving target that is what we use WordPress for, it’s become rather frustratingly bare bones for me and it really does impact my ability to get work done when I have to bounce back and forth between multiple screens just to see what the status is, verify I updated everything, and by the way, where are all my posts.
So, in the grand WordPress Tradition, I enhance it with plugins.
[Admin Featured Image](https://wordpress.org/plugins/admin-featured-image/) shows the featured image in the posts list, which is really good for one site to make sure I did too set an image and what it is.
[](https://halfelf.org/wp-content/uploads/sites/2/2015/02/admin-featured.png)
[UI Labs](https://wordpress.org/plugins/ui-labs/) I’ve actually forked. I need to remember to ping John about this, because I took his (great) plugin and modernized it. If you’re interested, that code is up on [my github UI-Labs repo](https://github.com/Ipstenu/ui-labs). It’s slowly being improved to make things a little easier for me and to work on WP 4.0 and up.
[Editorial Calendar](https://wordpress.org/plugins/editorial-calendar/), as mentioned before, gives me a great view for what’s scheduled and when:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/02/editorial-calendar.png)
The drag and drop interface lets me reschedule on a whim.
Speaking of… [Schedule Posts Calendar](https://wordpress.org/plugins/schedule-posts-calendar/) fills a void that has pissed me off for years. Just look at the comparison:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/02/schedule-date.png)
First, there’s the calendar by the month, then there’s the date, and finally the epic button ‘today’ to let me fast fix posts messed up by the WP iOS app.
So how do I keep posting so often? You ask questions, I answer them, and I have some tools to make it simpler for me.
**Categories:** How It Is, How To
**Tags:** essay, mailbag, plugins, wordpress
---
### [MailBag: Why Do You Do It?](https://halfelf.org/2015/mailbag/)
**Published:** January 9, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Why I WordPress, more thoughts on security, and also responsibility.
**Content:**
Zaman dropped me a year end note. He’s been asking people, interviewing them, for a site, and had three questions about why I do what I do (and a little bit of how). It deserved a public reply.
> 1.You have been actively volunteering at WordPress support forum and with your solutions individuals and companies save big chunk of money. Your family and Job at DreamHost are your top priorities. Then your priority becomes the website you run (halfelf.org). You still manage to take out couple of hours to hit WordPress forum. You mention in one of your blog that some people volunteer because they enjoy it and some do it to master skills. What drives you to volunteer at WordPress?
What drives me to volunteer at WordPress is little more than a bit of technical socialism. I give back because I get back, and it seems only logical and fair and just to make the time to do these things. Admittedly, having my job actually be know WordPress’ ecosystem and keep a good relationship between WP and DreamHost makes this far easier for me than most. But at the same time, I was doing this before it was my job. And I did it because I could.
I have a hard time explaining the need to give back to people, because it’s something you either understand in your heart or you don’t. Call it a random act of kindness to the universe, I help with WordPress because I can, because I enjoy it, and because it makes me feel good to do it. I won’t deny I get awesome emotional props from doing it, a feeling of absolute satisfaction and pleasure knowing I can help people, but it’s really just that. I like doing it. I make the time for it.
> 2.Your insights on halfelf.org are remarkable and the blog “[whose responsibility is it](https://halfelf.org/2014/whose-responsibility/ "Whose Responsibility Is It?")” in particular draws my attention. You convey it is the business owner responsibility and not the WordPress core or Webhosting Company to perform due diligence before they install plugin’s. You also call out there is a need for more security experts. Is there a shortage of wordpress security experts in general or in wordpress public support forum?
Do I think there’s a shortage of WP security experts? No, I think there’s a shortage of security experts in general. I think the masses of people would rather do awesome and create awesome than study security and delve into things. The fact that I can think of a hundred ways to socially engineer going to see a movie for free without breaking a sweat, the fact that someone like Frank Abagnale was able to pull off what he did underscores the issue.
At our heart, humans want to trust. We want to believe people won’t screw with us. And when you factor in just how complex computers and code can be, of course we have faith that the people who write code are writing the best code to their ability and know what they’re doing. And we have faith that, when a bug or a security flaw is reported, people will fix it as fast as they can.
WordPress complicates this, since there are so many plugins and themes out there that there isn’t a centralized place to reply a problem. Even if there was, there’s no way to enforce the bug is fixed, and there’s no way to be certain everyone will upgrade. Just look at the nightmare from the RevSlider situation. Once you add in the world of non wordpress.org hosted code, it’s impossible to maintain any control.
If more developers were security conscious this might be less of the case, but it’s a problem in Open Source. The Heartbleed vulnerability is a prime example of that. One change, missed by many. It’s not just WordPress, it’s how we develop in Open Source. The speed of our work makes issues like this sadly more common and possible. So we need more people who love hacking into things and breaking them and then *responsibly* passing on fixes to make things more secure. I do feel that Github and sites like it are actually a great step forward. I can file a pull request with a fix and pass on the help in that way.
This does require hobbyists to step up and be a bit more of a true developer, but they have the most to gain from it in the end.
> 3\. Examining and reviewing the plugin software may not be possible for small businesses. Do you have a list of plugins that should be avoided or a checklist that should be considered before installing the plugins? I am not asking if you to list here. May be an article in halfelf.org will be very useful for WordPress community.
I don’t have a list. I can’t have a list. It’s impossible, given the rapidity with which plugins are updated, fixed, released, and closed. It’s just not feasible. I tried, at DreamHost, to keep tabs on plugins like that for about a week. Then I gave up. It would be a full time job.
And I disagree it may not be possible for a small business to have an audit done on their plugins and themes. They can hire someone. It would be expensive, certainly, but frankly I find the alternative untenable. If you had a physical store, you’d pay to have a security audit once in a while, if only by your security company. This too is a part of running a business. Period. You just can’t dismiss it as ‘not possible’ when it’s your career on the line. Complicated, expensive, and annoying I will grant you. But you have to do it. Even if it’s just once a year, you’re a step or ten ahead from where you were before.
I’ll say this, however. I would expect someone like Pippin over on [Easy Digital Downloads](https://easydigitaldownloads.com/?ref=3359) to be reviewing *all* add-ons he lists on his site. Anything he sells, certainly, but also this [big list of free add-ons](https://easydigitaldownloads.com/blog/extensions/categories/free/) should be checked for basic security before being listed. In this way, a small company can know they’re reasonably secure with that suite of plugins.
Are there plugins that should be avoided? Sure. I suggest you avoid anyone you can’t figure out how to contact in case of a security issue, anyone who encrypts their code so you can’t read it, and anyone whom, when you *do* contact them, blow you off.
**Categories:** How It Is
**Tags:** essay, mailbag, plugins, security, wordpress
---
### [Mailbag: Multisite or Not?](https://halfelf.org/2015/mailbag-multisite/)
**Published:** August 14, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Nope, still wouldn't use Multisite for this one.
**Content:**
From Ian:
> Hi, I wanted to comment on one of your articles and see if any one would provide feedback, but the comments are closed. https://halfelf.org/2011/dont-use-wordpress-multisite/ I have been avoiding using Multisite as you recommend. Several have tried to get me to go that way, but it didn’t seem right. So in the cases of when a business wants to have independent sites that share the main sites content, what would you recommend?
There was more to the email but it boils down to this. They want a site that has all the local content *and* all the main brand’s content.
When you get to the point of ‘sharing’ content, Multisite is less and less of a winner. While we’re still in a pre JSON API world, which would make this a bit easier, I lean towards the basic simplicity of categories.
I’d have a main category for ‘news’ and another for each independent site (say ‘locale1’). Then I’d craft my theme to pull in posts from ‘news’ and ‘locale1’ *and* style it per the brand designation of each locale.
The plugin [Groups](https://wordpress.org/plugins/groups/) may be what you want to control access for things.
One site. Easy to cross-relate content. Done.
No multisite.
**Categories:** How To
**Tags:** mailbag, multisite, plugins
---
### [I Hate Your Framework](https://halfelf.org/2015/hate-framework/)
**Published:** March 18, 2015
**Author:** Ipstenu (Mika Epstein)
**Content:**
The plugin itself was one PHP file and three JS files.
The framework was over two megs.
The plugin added in a new setting to select which one of the three javascript files should be called.
The framework ‘made it pretty.’
I’m right up there telling people that the [WordPress Settings API](http://codex.wordpress.org/Settings_API) is a giant bag of wet hair. It’s confusing, it’s cryptic, it doesn’t always play well with everything, and sometimes it makes you feel like the point is to make us have decisions, not options, for our plugins. But I don’t think plugin frameworks are the answer. At least not the way most people seem to be going about them.
When I say frameworks, I don’t mean the libraries like the AWSSDK for PHP framework that you package up into your plugin and do a proper check for a function, calling yours if the the library isn’t there. No, I mean the plugins that are totally separate plugins but are meant to be called by yours in order to make development easier and more consistent.
That’s what I hate.
I love the idea of these frameworks, actually. I think that a boilerplate plugin, similar to [\_underscores](http://underscores.me/), where I can put in my plugin name, my information, and press a button to have the basic plugin files generated for me is brilliant! But I think most of the libraries out there are doing it in a way that will annoy and upset most people.
The problem is less the framework and more the people using them as a ‘quick fix’ without properly thinking about what they want to do.
## They’re Too Large
In the case of this plugin, one file with three settings could just be done with two functions (maybe three) and instead he’s made a download half the size of WordPress core. The zip is large, it makes things take just a little bit longer for people on slow servers to download and upgrade, and the larger you get, the worse you are for the really small shared hosts. I know a lot of people argue with me about this, but remember than a high number of hosts still default you to allow 7M in PHP upload size. That means when your plugin becomes the 30 meg behemoth with all your dev files, you’ve made things pretty bad for some users. But even when you’ve only made your plugin 2 or 3 megs, why would you do that when you have one file of actual code?
The logic escapes me.
## They’ve Got Too Many Files
Not the same thing as too large! There are hundreds of files in a framework, and if you’re using only 4, that means you have 96+ files to review for security. You just increased your workload for not enough value. Which is really a major part of my next issue. The point here is you, the developer, are responsible for every single file in that framework. You are expected to know everything about it, where it installs, what it uses, why it uses it, and when to upgrade. This is a pain. It’s a chore. And it’s your job now.
## You Don’t Know How to WordPress
This is also why I don’t like the idea of making Multisite too much easier. The further you take a developer from writing this code, the further they get from understanding how it all comes together and the harder it is for them to debug their own plugins. If you’re developing a plugin you plan to share with other people, even a teeny tiny one, you need to understand what you’re doing. You need to learn about the way the code interacts with the CMS tool, you need to understand why some things are secure and others are not.
## You Use the Frameworks Wrong
I said before, I love the *idea*. And I do. They’re a brilliant idea and, when done right, work perfectly. The problem with them is, a bit, a problem with WordPress, which is we really don’t have a way to handle children plugins. You see, the *best* thing for a true framework plugin would be to have it be a separate plugin. But without plugin dependency support in core or the directory, it becomes another level of hassle for users.
For example… if you have the plugin as a separate plugin, these are the issues we’ve see for end-users (not developers):
- Not recognizing the framework plugin, and thus deleting it (causing the plugin(s) to break)
- Not recognizing the framework plugin and thinking they’ve been hacked
- Updating the framework plugin separately from the dependent plugins, possibly leading to breakage
- Updating a dependent plugin without updating the framework, possibly leading to breakage
- Different plugins requiring different versions of the framework
And bearing in mind that the framework and plugin developers are different people, that’s another level of coordination/compatibility issues. Frameworks and libraries should be packaged with each plugin (hopefully in a way that doesn’t conflict with other plugins using the framework or libraries). At least until core supports plugin dependencies.
But I still think that’s wrong.
I still think the best framework plugin isn’t a plugin at all, it’s a tool to help you design and build a plugin via your editor of choice. Or maybe a Grunt Script that lets you build it out based on parameters. Time spend making a framework for making the plugin ‘interface’ better would be better spent making the Settings API better.
**Categories:** How It Is
**Tags:** development, essay, plugins, wordpress
---
### [Defines, Variables, and Plugin Dirs](https://halfelf.org/2015/defines-variables-plugin-dirs/)
**Published:** April 1, 2015
**Author:** Ipstenu (Mika Epstein)
**Content:**
If you’ve spent any time looking at PHP code, then you’ve seen defines and variables
## Defines
A define looks like this:
This makes a global **constant** that can be used anywhere. In the case of WordPress, it means they can be used across multiple plugins or themes. This is very useful if you make a suite of plugins that all have the possibility of using the same API key. Then you can tell a user to put `define('MY_PLUGIN_API', '123456');` in their `wp-config.php` file, and tell your code to check for the define.
A define also cannot be *re*defined. If you call it twice, you get errors, so you should be as unique as possible when creating yours.
## Variables
A variable, meanwhile, looks like this:
Variables only exist where they are, so if I have one in one function, I may not be able to call it in another. You can make global variables if needed, and in fact if you don’t, the variable won’t be available to all functions.
## Which Should I Use?
Keeping in mind that defines are constants and variables are, well, variables, the idea is that a constant should be used for things that *should not* change in the running of the code. It also makes your code easier to maintain if the things that must be constant are explicitly so.
So what’s a good define? Actually not really this:
This is a constant, it’s something you should be setting and it shouldn’t be overwritten, but actually I’d want to make it a database field to check on before upgrading. Remember, you *should* be changing that define on upgrade, so having it be a declared constant is a little odd. Now that said, it *is* a good one when you consider you don’t want someone to willy-nilly override it. Except … what if you do? What if you want someone to be able to change it back to re-run an upgrade?
So then really not this either:
Someone’s probably thinking that their plugin directory is a constant and, thus, should be defined like that. Maybe, but it’s a pointless define in WordPress. You already have `plugins_url()` (which this example isn’t using) but it’s really where people use that code that makes no sense. That’s why I included the second line there. That’s what they use it for, and it means two lines of code for one function call.
This actually magically becomes a good define when you have a complex plugin with multiple files and you need to grab the main plugin directory in sub-files. But if your plugin is one file (and yes, that’s where I see it the most), it’s overkill.
This *is* a good define:
But that should never be in your code itself. Not for WordPress at least. That should be in the `wp-config.php`, like I mentioned before.
Basically … there aren’t great reasons to use defines unless you want things that never change. `define('MY_PLUGIN_SUPPORT_HOME','http://help.example.com');` would make sense to me, as would other contact info you want to make sure is never subverted.
## What do you think define is best for?
I’m interested to hear what you guys like to use defines for. I’m certainly guilty of using them for some pretty silly reason.
**Categories:** How It Works
**Tags:** coding, plugins, wordpress
---
### [Mailbag: What's The Diff?](https://halfelf.org/2015/whats-diff/)
**Published:** May 1, 2015
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Ideas can always be copied. Code can be cloned. But you should be an original.
**Content:**
> How do you compare two plugins to see if one’s a fork or stolen? What’s the difference between a fork and a clone?
Sometimes people like to ‘steal’ plugins. This normally happens when someone takes a premium (purchase only behind a firewall) plugin and attempts to give it away for free on WordPress.org. They tend to violate copyright when they do that, but also it’s just not a cool thing to do and I find it distasteful.
Often we catch these since people who steal like that aren’t always very smart and we recognize code that is generally well known and popular. But more often we don’t catch it because [CodeCanyon has 3400+ plugins](http://codecanyon.net/category/wordpress) and [WordPress.org has 37k+](https://wordpress.org/plugins/) and that’s a lot to compare and remember. And that’s when we get an email from a plugin developer who says “So and so stole my work!”
What do we do? We ask them for a copy of their code, in a zip, and say we’ll compare. Most developers are happy to do that. We’re a trustworthy lot, otherwise we wouldn’t be on the plugin team (yes, being a good, moral, and ethical person is very important). Once I have the zip, I download the claimed-clone and compare them line by line.
Well. Not really.
My toy is [DeltaWalker](http://www.deltawalker.com/).
With DeltaWalker I can compare two zip files without having to open the zips and look at each line. In the below example, I’ve got Akismet 3.0 vs 3.1.1 and I can see every single change just by tossing the zips in as files to compare:
[](https://halfelf.org/wp-content/uploads/sites/2/2015/04/deltawalker-Akismet.png)
DeltaWalker is so good, it helps me compare the readmes so I can easily see that someone has just fiddled with the original and not written their own.
What I look for is code style, formatting, and naming conventions. Rarely do two separate individuals use the same code formatting (tabs vs spaces vs tabs+space etc), so seeing their additions will jump out. Similarly, the code style, their internal logic, is often wildly different. Same with naming conventions.
When you look at it, it will jump out at you that generally all anyone does is rename functions or classes. They remove credit and copyright information too, and sometimes they mess with the help docs. Rarely do they add anything of substance. If they *do* then it’s a legit fork and we’ll push them to restore credit and copyright information.
But since it’s generally not, we will quickly see that the plugin is a direct, no feature added, copy, and remove it.
If this happens to you, if your plugin is ‘taken’ and duplicated without any code being added, email `pluginsATwordpress.org` with a copy of your original plugin (and a link to perhaps prove it’s you) and we’ll look at it. If you get an email where we tell you that your plugin is a copy, take a moment to review your code and feel free to talk with us about it. A ‘one line’ change actually MAY be acceptable as a fork, but it’s rare unless it’s adding in a massive feature, or totally changing functionality.
Above all, remember this:
Despite the fact that all plugins in our directory are licensed under the GPL or compatible licenses, we do not allow direct copies of other plugins to be re-listed under somebody else’s name. “Forking” is acceptable only when the resulting fork is of a substantial nature, or when the original plugin is no longer updated or supported.
Always try to contribute back to the original plugin’s authors if you wish to make improvements to the original plugin, instead of creating an entirely new version and thus creating incompatibilities and duplicated code in the repository.
Alternatively, write your own plugin to perform the functionality you want to have, drawing on ideas from the original. Ideas can always be copied.
**Categories:** How It Is
**Tags:** freedom, mailbag, plugins, wordpress
---
### [Who's Following Me Anyway](https://halfelf.org/2013/whos-following-me-anyway/)
**Published:** November 11, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Welcome to the Internet, where everything's made up, and the points don't matter.
**Content:**
There are two basic ways to deal with tracking people who follow you on the internet: don’t do it or overdo it.
In a recent post, [Brian Gardner](http://www.briangardner.com/embracing-the-unsubscribers/) talked about embracing his unsubscribers, as he noticed a number of people un-subbing after he posted a personal post on his personal site. Since then, my friends and followers have asked me about how I feel, and I’ve had to explain that my basic philosophy of ‘tracking’ followers is this: I don’t.
Now this doesn’t mean I don’t keep tabs on metrics and browsers and the like, to know how to appeal to my readers, but it means the raw numbers, like how many people read a post, are by in large ignored. Except sometimes they’re not. At that point, I agreed that my methodology was complicated, and needed a blog post. So here’s when I do and when I don’t and why I do or don’t as needed.
### It’s Personal
For the most part, I don’t track visitors on *personal* sites. I don’t track metrics. I couldn’t tell you who follows my blog on ipstenu.org, and I don’t really care. It’s my personal blog where I’ve decided to write for me, so if I track anything at all, it’s what browsers. A lot of people read the site on an iPhone? Okay, better have a good theme for that! One person is still using Netscape? Forget about ’em.(Sorry Mr. Netscape. It’s 2013, the Internet called and wants you to upgrade.) I never pay attention to the number of my followers on my personal social media accounts. Facebook, Twitter, whatever. I know who *I’m* following. When you stop being entertaining/interesting/enjoyable, I unfollow. It’s all just me being me for me. You’re welcome to read along, but it’s a personal site for personal people.
### It’s Technical
Okay, so what about my *professional* sites? Well, I do and I don’t follow along, depending on how professional the site is. Take this site, for example. While this is certainly my more professional site (I initially split it out because my family reads the main blog and didn’t care about tech babble), I don’t have a dedicated Twitter account for it, or a Facebook fan page. It’s just another aspect of me. I *do* track metrics here, though. It matters a little more when I’m presenting content for education. I want to make sure everyone can read the site, get the data they need, and move on. And I do keep tabs on my subscription numbers a little, but I don’t actively watch who signs up and who leaves. The way I figure it, if you find the information valuable, you read.
The only times I’ve ever actually noticed traffic here was when [Matt Mullenweg](http://ma.tt/2011/07/constantinople-usability/) linked here and I got a massive uptick of rabid folks pissed off that I’d used the naming of Constantinople as a metaphor (you’re welcome for the earworm), and when Ars Technica linked to my posts about stopping the botnets with [mod\_security](https://halfelf.org/2013/wp-login-protection-modsec/ "WordPress Login Protection with ModSecurity") or with [.htaccess](https://halfelf.org/2013/wp-login-protection-htaccess/ "WordPress Login Protection With .htaccess").
This does not mean I haven’t noticed the increase in visitors from tens a day to a hundred and beyond. It just means that since I’m not trying to making a living from this site, it’s not something I dwell on very much. Every time I have to write an article about stats, that means I have to sit and study them here, because I’m just not tracking.
### It’s Professional
But that really wasn’t me being ‘professional.’ What about my site where I have a custom Facebook page, a Tumblr, a dedicated Twitter account, and the whole nine yards? Oh yes, I track. I check analytics to see entry and exit pages, and I even have conversion goals. I notice my bounce rate, traffic flow, and all of those things. For work, yes, I monitor all these things, talk to marketing and sales about how to improve those things, write code to make things serve up faster and better. How did our campaigns go? What should be targeting?
[](https://halfelf.org/wp-content/uploads/sites/2/2013/09/121.jpg)Most importantly here, I try to understand the data I’m getting. We’re really good at collecting data these days, but we’re pretty crap at understanding it and using it to our benefit. How often have you seen [A/B testing result in flawed assumptions](http://yoast.com/conversion-rate-optimization-hypothesise-test/)? It’s not easy understanding what to do with the data. It’s not something you can do quickly, and most of us can use metrics and analysis to prove the point we want to make.
This is hard. It’s *really* hard and worst of all, how much weight you put in everything depends on who your audience is. How hard? Well there is a [science in the testing](http://yoast.com/science-testing/) but not many people use it right.
### It all depends
And that’s really my point here. It *all* depends on what your goal is. Who are your readers and who are you writing for (they may not be the same)? Also who do you *want* to write for?
Everything comes down to having a goal, knowing what you want to do, and doing it. And there is *absolutely* nothing wrong with just writing for yourself.
**Categories:** How It Is
**Tags:** administration, analytics, essay, website
---
### [Software Freedoms](https://halfelf.org/2011/software-freedoms/)
**Published:** March 28, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** GPL does not, cannot, and will not protect the developer who writes the original code. But that's not why we use it.
**Content:**
 Like a million other posts, I’m starting this with a warning: **I Am Not A Lawyer**. Sure, my mom is, but that qualifies me for a cup of coffee, if I have the cash. Personally, I support open-data and open-code because I think it makes things better, but there are a lot of weird issues when you try and pair up software licenses, explain what ‘freedom’ means, and where it’s applicable. For the record, I am *not* getting into the ‘is a plugin/theme derivative software or not’ debate. I will wiggle my toe and point out it *is* a point of contention.
I’m presuming you are already familiar with the idea of what [GPL](http://en.wikipedia.org/wiki/GNU_General_Public_License) is. If not, read the [GPL FAQ](http://www.gnu.org/licenses/gpl-faq.html).
**Why are WordPress and Drupal GPL anyway?**
The people who built WordPress took an existing app (b2) and forked it. Forking happens when developers take a legally acquired copy of some code and make a new program out of it. Of the myriad caveats in forking, you have to remember that the fork *must* be a *legal* copy of the code. In order to create WordPress, Matt et al. were *legally obligated* to make WordPress GPL. No one argues that. The only way to change a license from GPL is to get everyone who has ever committed any code to the project to agree to this, and you know, that’s like saying you’re going to get everyone in your house to agree to what pizza to order.
WordPress and Drupal is GPL because it must be. There is no other option.
**So why is this a problem?**
GPL poses a problem because of interpretations of what ‘derivative works’ are. It’s very clear cut that if you take or use WordPress’ or Drupal’s code, you are taking code built on GPL, which means you must keep your code GPL. The definition of ‘code’ is a bit squidgy. A generally accepted rule of thumb is that if your code can exist, 100%, without WordPress or Drupal’s support, then it’s not a derivative. By their very nature, plugins and modules are seen as derivative. Both [Drupal](http://drupal.org/licensing/faq/#q7) and [WordPress](http://wordpress.org/news/2009/07/themes-are-gpl-too/) have long since stated that this is, indeed, the case.
Themes, modules and plugins are GPL because they must be. There is no other option.
**Except…**
 Except there is. Only the code that relies on the GPL code have to be GPL. Your theme’s CSS and your images actually can be non-GPL (though WordPress won’t host you on their site if you don’t). Also, if you have code that lives on your own server, and people use the plugin to help the app talk to that code, *only* the code that sits on WordPress or Drupal has to be GPL. Your server’s code? No problem, it can be as proprietary as you want! Akismet, a product made by Automattic (who ‘makes’ WordPress, in a really broad interpretation) works like this. So does Google Analytics (most certainly not owned by WordPress), and there are many plugins to integrate WordPress and Google. This is generally done by APIs (aka Application programing interfaces), and are totally kosher to be as proprietary as you want.
Themes, modules and plugins are GPL where they need to be, and proprietary (if you want) where they don’t.
**So what is GPL protecting?**
As we often carol, the GPL is about freedom. And “free software” is a matter of *liberty*, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer.” Freedom is a tetchy subject, misunderstood by most of us. For example, freedom of speech does *not* mean you get to run around saying what you want wherever you want. Free software is a matter of the users’ freedom to run, copy, distribute, study, change and improve the software. This is pretty much the opposite of what you’re used to with the iOS, Microsoft and Adobe. Free software may still charge you, but once you buy the software, you can do what you want with it. Your freedom, as a user, is protected.
WordPress’s adherence to GPL is for the user, not the developer.
**What’s so free about this anyway?**
The term ‘free’ is just a bad one to use in general. Remember, freedom of speech, as it’s so often used in inaccurate Internet debates, does *not* mean you can say whatever you want. ‘Free speech’ means ‘You have the right to say what you want, but I have the right to kick you out of MY house if I don’t like it.’ So what are these GPL freedoms anyway? In the GPL license you have the four freedoms: (1) to run the software, (2) to have the source code, (3) to distribute the software, (4) to distribute your modifications to the software. Really they should be ‘rights’ and not ‘freedoms’ if you want nit-pick, and I tend to think of the freedom of source code to be similar to data freedom. The freedoms of open-whatever are for the people who use the whatever, not those who come up with it.
Software freedoms are for the user to become the developer.
**So if GPL is for the users, what protects the developer?**
 Not much, and this is where people get pissed off. If anyone can buy my software and give it away for free (or pay), why would I even consider releasing something GPL? The question, as Otto puts it, really should be [‘What exactly are you selling in the first place?’](http://ottopress.com/2011/why-you-should-use-gpl-for-commercial-themes/) What are we selling when we sell software? I work on software for a living, and I never sell my code. I’m hired to write it, certainly, and I do (not as often as I’d like). Most of what I do is design. It’s part math, and part art. My contract doesn’t allow me to keep ownership of my art, which sucks, but if I was a painter, I’d sell the painting and lose the ownership anyway, so what’s the difference? That painting can get sold and resold millions of times for billions of dollars. And most artists die starving.
Software Freedom doesn’t stop people from being dicks (though they should).
**So what *good* is the GPL to the developer trying to make a buck?**
It’s not. But that’s not the point. GPL isn’t about the guy who wrote the code, it’s about the guy who gets the code (again, *legally*) and says “You know, this is great, but it should make milkshakes too!” and writes that. GPL is all about the guy who uses the code and the *next* guy who takes the code and improves on it. If you have an *open* community where everyone has the privilege and right to use, view, share and edit the code, then you have the ability to let your code grow organically. If you want to watch some staid, tie-wearing, Dilbert PHB lose his mind, try and explain the shenanigans of Open Source development. “Develop at the pace of ingenuity” versus “Develop at the pace of your whining users.”
Software Freedom isn’t about making money, it’s about making the *next* thing.
**Why would I want to use GPL?**
 If you use WordPress, you use it because you have to. I prefer the Apache licenses, myself, but the purpose of using *any* software freedom license is, at it’s Communist best, a way to make software all around the world better for everyone. You stop people from reinventing the wheel if you show them how to make the axle in the first place! Did you know that Ford and Toyota independently came up with a way to make your brakes charge your hybrid battery? They latter opened up and shared their tech with each other, only to find out how similar they already were! Just imagine how much faster we could have had new technology if they’d collaborated earlier on? With an open-source/free license, my code is there for anyone to say “You know, this would work better…” And they have! And I’ve made *my* code better thanks to them.
I use ‘free software’ open source licensing on my software to make my software better.
**Categories:** How It Is, How It Works
**Tags:** essay, license, software
---
### [Plugin Licenses, Upsells, and Add-ons](https://halfelf.org/2012/plugin-licences-upsells-addons/)
**Published:** July 5, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** If you can't obfuscate your code, or have an API just to check a license, how are you supposed to earn any money with a plugin in the WordPress repository? Stop thinking about hiding your code and start extending it.
**Content:**
*This post is dedicated to [WPEngine](http://wpengine.com/), who [donated to help me get to WCSF](http://www.indiegogo.com/halfelf-wcsf2012). While I don’t use them, I think that if you’ve outgrown WordPress.com and aren’t quite ready to host everything yourself, but you still want the plugins and themes, then you should check these guys out. They aren’t cheap, but then again, I firmly believe in paying for what’s important.*
**Read the comments before you comment. Otto haz the smartz.**
One of the many rules of WordPress.org hosted plugins is you can’t phone home. Actually you can, and the rule really is ‘Don’t phone home without a damn good reason.’ To use Akismet as an example, it phones home with information to help verify who posted on your site, and are they a damn dirty spammer. That’s a damn good reason. But phoning home to check “Did Bob pay for a license?” is not. That’s considered abuse of the “serviceware” guideline, and essentially making an API just to make sure a license is okay isn’t okay. Now making money on your plugins is an awesome thing. But when your code is open source and anyone can see it, how do you keep people honest?
To get down to brass tacks, I’m going to take a little jounrey the wrong way, before I get to some suggestions on how you can provide ‘free’ and ‘pay’ versions of a plugin on the WordPress repository, and not cause any guideline issues.
Let’s start out with the most common way people restrict you: A license key. If you put in a plain license key check like this, it’s easy to crack:
Okay, you say, I want to encrypt things so that I tell someone ‘your license is ipstenuisreallyneatsheismadeofturtlemeat’ but when I look at my code, it shows ‘`774ffc4efce8da294dff77f35f75df98`‘ instead (that’s `md5(ipstenuisreallyneatsheismadeofturtlemeat)` as it happens). Wait. We can’t encrpyt code. Or rather, we can’t include encrypted code in a plugin, it’s against the no-obfuscation rule. We’d want to decrypt that instead. So I give you the code string instead and run it this way instead (Just pretend that `$options['license']` is a site option.):
But then I have the problem of anyone can just look and see what’s going on again. You could go the extra step like putting `ipstenuisreallyneatsheismadeofturtlemeat` in a file and then pull off something like this:
Is this easily decrypted? Yes. Is this easily circumvented by editing the code and removing the if? Again, yes. In fact the only way to really do this would be to use an API on your server to check the validity of the license (which you can’t do if you want to be hosted on WordPress.org anyway – no APIs just to check licenses), and *even then* I can strip mine your plugin and remove all checks like that. So why bother? Because you want to make a living on your code, and that’s certainly a fair-go! But as Otto rightly says, [we can’t stop piracy, so why are we trying](http://ottopress.com/2011/why-you-should-use-gpl-for-commercial-themes/)? DRM doesn’t work, and reverse engineering hasn’t proven sustainable. Maybe we’re building the wrong mousetrap.
If we throw the code solutions out the window, because we know they won’t work, where are we left? The next most common thing I see is people offering two plugins. A free, totally open GPL one on the WordPress repository and then a version behind a pay-wall that you would ‘replace’ that free one with. For example, I have a Rickroll plugin, and let’s say I wanted to make a Rickroll Pro version that let you change the video to anything you want, just put in the YouTube URL. I would have a settings page on my free version that pretty much says “Hi, if you want to change the video, visit halfelf.org/plugins/rickroll-pro/ to download.” And now I have to code Rickroll Pro to check if Rickroll (free) is installed and active, and refuse to activate if so. Furthermore, my users have to be told to delete the free Rickroll.
You know what? That’s a pain in the butt. What if instead I coded a Rickroll Pro add-on. No, I don’t mean ‘add this file to your plugin’ but ‘Install this second plugin, which will add functionality to Rickroll.’
It’s a second plugin, yes, but now I can have Rickroll free look for Rickroll pro. Not active? The settings page (which I would keep in Rickroll free) would tell you ‘Hey, you don’t have Rickroll pro! Install it and get more things!’ or ‘Hi, you have Rickroll pro installed by not active. Don’t you know it’ll never give you up? Activate it and have fun!’
Now the code muscle becomes a question of ‘How do I ensure my dependency checks work?’ First, [Scribu wrote an awesome plugin dependency plugin](http://wordpress.org/extend/plugins/plugin-dependencies/), and the only flaw with it, is you’d have to install a third plugin. We don’t want that here, since yet another plugin is problematic. But looking back, that code grew out of a trac ticket about [handling plugin dependencies](http://core.trac.wordpress.org/ticket/11308). Now there’s a nice way to check: [is\_plugin\_active()](http://codex.wordpress.org/Function_Reference/is_plugin_active)
You could go to town with the checks in there. Like if the plugin isn’t active, deactivate the child and so on and so forth. I’m not going to write it all for you (though [Otto wrote a lot about it for themes](http://ottopress.com/2012/themeplugin-dependencies/))
Now going back in your parent plugin, you can run the same check:
The one last thought I had on this was how to handle pro upgrades. Since I don’t like to upgrade a plugin a lot unless I have to, I’d make it an ‘upgrade both’. In Rickroll Pro I’d set a version constant, and then in that check to see if it’s active call, reference that version. So Rickroll, after verifying Rickroll Pro is active, would come back and say ‘My current supported version of Rickroll Pro is 1.5 and the constant is set to 1.0. You should upgrade!’ Then every time I write a new version of Rickroll Pro, I’d update Rickroll to point to the new version, and when they upgrade from WP, they would get notified about Rickroll Pro needing an update too.
Probably not the most efficient or effective way about it, but the other option is [a self hosted plugin update API](http://clark-technet.com/2010/12/wordpress-self-hosted-plugin-update-api).
Bear in mind, because of GPL, all these hoops and ladders can be circumvented. Your plugin can and will be taken away for free. Don’t fight the pirates with registration circuses, and limit the weight of your code by selling the right thing. It’s a strange idea to think that giving your code away for free will help you earn money, but at the very least, not fighting against the pirates will give you time to write better, more secure, code. And that certainly will earn you more money. Then sell your support, because that time **is** money.
**Categories:** How It Is, How To
**Tags:** freedom, license, open source, plugins, wordpress
---
### [New Smilies?](https://halfelf.org/2014/new-smilies/)
**Published:** May 5, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I switched to using the new smilies ala WordPress.Com. It wasn't hard.
**Content:**
While the arguments for and against are pretty hot and heavy (see [the trac ticket for more](https://core.trac.wordpress.org/ticket/24970)), it’s no secret I’m pro-new smilies. The old ones are too small, too pixelated, and too (pardon the phrase) web 1.0. They look *old* and out of date on my site.
Here they are at normal size:
And here’s double:
These are both gifs, to illustrate the size issue. Notice how they’re fuzzy?
I want to make one thing clear, pun intended. *None of my issues have to do with Retina*. I don’t like ‘small’ anything. The smilies are too small, much like the font on many people’s websites, the pixelization is hard for me to identify. In fact, while I’m using the new smilies here, you’ll notice they’re bigger. Sure, cause I tossed this in my CSS:
And that’s all it took to make them something I felt was readable. But the beauty, and why I like the new SVG images, is that I *can* make them larger like that, without losing readability.
Thankfully, due to the curmudgeony efforts of the new smilies’ biggest naysayer, Otto, we have a filter! I’ve talked about this before, in [how I handled both SVG and PNG as smilies for IE](https://halfelf.org/2013/ie-8-and-svg-smilies/). I have a couple options here. I could write some code myself, or I could use [New WordPress.com Smileys](https://github.com/avryl/new-smileys) (which is on GitHub for reasons, the code is fine!).
I like the plugin a lot. I like it so much, I refactored my SSL Grins plugin to use them with the fancy pants new span code (instead of images). But… Well, I already had this done by the time his plugin came out, and I like how I accounted for things differently. The only real difference though is he uses spans, and I just swap out the images:
But why don’t they all show up in my comments section? Where’s the martini!? I also upgraded my plugin [SSL Grins](https://wordpress.org/plugins/wp-grins-ssl/) with an ‘easter egg’ of code that hides anything in this array of [smiled\_hide](https://plugins.trac.wordpress.org/browser/wp-grins-ssl/tags/5.2/wp-grins.php#L84). This works on both my version of the smilies plugin and Avryl’s. and looks like this:
Now this is possibly the jankiest, stupidest, code I’ve written in a while. I’d rather just have the words be there, and filter “If any of the values in this array is a partial match to the name of the smilie we’re looking at right now, don’t show it.” But I’m not clever enough with arrays and preg matching at this point, so I did that ugly list, and used this:
So at this point, [pull requests are welcome](https://github.com/Ipstenu/wp-grins-ssl) because I’d love to clean that up!
**Categories:** How To
**Tags:** css, function, javascript, wordpress
---
### [All is Revealed](https://halfelf.org/2014/all-is-revealed/)
**Published:** May 14, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Faster slides with HTML5 and all is revealed!
**Content:**
I had [some issues with SEO Slides in the past](https://halfelf.org/2013/seo-slides-pie/ "SEO Slides Is A Pie"), mostly around how it’s not *quite* what I need while also being more than I need and less. I banged around this for a while, before I remembered that I’ve seen a lot of people use WordPress for slides in a way that I never really loved, while others used something decidedly *not* WordPress.
Step back.
I don’t believe that I should use WordPress all the time just because I’m a WordPress person. I thought about what I want from my slides:
1. A way to load them locally or remotely
2. A way to control them and see my notes
3. Usable on mobile
4. Embed-able by me and me only
5. “SEO” friendly
That last one really means “HTML should be readable so a screen reader could make sense of it for the blind.” And that’s really the primary reason I ended up with SEO Slides to begin with. But when I stepped back to really think about what SEO Slides did, and what I needed, I realized that while I really do love it, it made it harder for me to *make* slides.
Let me explain. SEO Slides’ interface is not the WordPress post editor. I suspect, if it was, I’d be happy since I can mangle HTML there all day long. But SEO Slides doesn’t let you at the source code of the page, you have to use their GUI, and I was having a hell of a time with things like centering and floating and wrapping… All things I’m a boss at with HTML.
In addition, I’d recently discovered serious limitations with pageload, especially on mobile. The fixes in 1.5.0 didn’t fix it for me (actually it became worse with my slides taking over fifteen minutes to load, at which point I gave up). This is not to say I don’t love SEO Slides and what it does, it just didn’t fit my personal workflow. As much as I loved it when I did my EDD presentation for WP Sessions, I wasn’t satisfied.
So as I contemplated my vodka over Passover, I came to the possibility that maybe WordPress was totally overkill for slides. Maybe, like with a Gallery, it was too much and too complicated for something that should be more simple. To me, HTML is simple. It’s straight forward, direct, and I still use it every day. With the exception of paragraph tags, I wrote this post in HTML mode.
I did what comes naturally to me. I went and poked around what some of my friends have done (and kept up or not…) and finally decided that I was going to try out [reveal.js](https://github.com/hakimel/reveal.js).
Wow.
Installing was simple, just a git clone. And while the directions claimed you can’t use speaker notes unless it’s running locally, I found this not to be the case. Maybe it’s because I’m on Chrome, or maybe that’s not updated. Either way, it’s awesome for me since I can suddenly control my slide-deck on my laptop. Making my own slides was also pretty basic, I made a folder for each deck, tossed in the images and the index.html, and went to town. It’s really that easy to do, though I wish there was a basic, example, and not just the big one. Still, a search and replace of HTML is super fast.
It loads faster than SEO Slides, works better on my iPad, and the only thing I can’t do is embed. I’ll live. I’m also sure it can be done, since (the freeium version that hosts it for you) [has an embed ability](http://help.slides.com/knowledgebase/articles/254996-embedding-decks). The other massive gain is that it’s smaller. When you upload media to WordPress, you get multiple images, and I have to pre-load each page (or load it on the go). This gets heavy since I like background images and pretty things.
With reveal.js, I just upload one image and I’m done. It loads everything at once, since it’s one HTML page, and the image (while large) is just reused. And that was good enough for me. Also I get to use [remotes.io](http://remotes.io/) to remote control my slides from my notes (I use the iPhone app [Scan](https://itunes.apple.com/us/app/scan-qr-code-barcode-reader/id411206394?mt=8), by QR Code City, and paid for it because I hate ads).
I may go back to SEO Slides (who should consider an import from reveal… Hmmmm) but this works for me now. We’ll see if I love it in the long term. I suppose I should actually read stats and see if anyone but me even cares about the slides…
**Categories:** How To
**Tags:** coding, design, javascript, slides
---
### [Hotlink Protection](https://halfelf.org/2010/hotlink-protection/)
**Published:** August 11, 2010
**Author:** Ipstenu (Mika Epstein)
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2/2010/08/image-missing.png) Hotlinking is putting a link to someone else’s webpage’s graphic on your site. This is also called bandwidth theft. Directly linking to a website’s files (images, video, etc.) means that when someone accesses your website, they draw bandwidth from another. If you use an `IMG` tag to show a picture from someone else’s page on your blog, forum post, or website, that’s hotlinking. You’re stealing their bandwidth.
There is a case in which this sort of ‘theft’ is ethically permissible, though some webhosts don’t like it. If you have multiple Yahoo! sites, and one is low on bandwidth, you can shuttle some of your content to the other site, and thus split up the bandwidth. This isn’t always a good idea, as if it’s against the Terms of Service on your host, they can kill you. Which is why you should always back up your websites on your on computer. If you own your own domains (like I do) and have multiple ‘subdomains,’ then it’s okay to share an image. ipstenu.org is considered a different website that photos.ipstenu.org, so I have to tell my server it’s okay to share between the two. But that’s code geeky.
What the common websurfer needs to know is this: direct linking to a picture, movie file, or any other content on someone else’s site, unless it’s a simple URL link to that site, is bad form, ethically asinine, and impolite. It’s akin to stealing electricity from your neighbor by plugging into their outlets.
But what do you do when someone’s hotlinking to your server? Most of us find out about this via a nastygram from our webhost saying we’re using too much bandwidth. Bandwidth controls how fast you can view the net from your home, as well as how much data a website can share with the world each month. Having more bandwidth is better all the time, but forcing users to use more bandwidth with image heavy sites and poorly coded web pages is not cool. Still, sometimes you have a moderate site and one image becomes super popular.
This is where you need to learn about hotlink protection. The most basic code is this:
```
# Simple Hotlink Protection
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com(/)?.*$ [NC]
RewriteRule \.(gif|jpe?g?|png)$ - [F,NC,L]
```
This basically says ‘If you’re not from yourdomain.com, and you’re trying to see an image, you’re not me, go away. Sometimes I make that last line something like this:
```
RewriteRule \.(gif|jpe?g|png)$ http://mydomain.com/hotlink.gif [NC,L]
```
Which shows them a ‘No, don’t do that’ image. If you’re going to do that, use a SMALL image, since that will use up some of your bandwidth.
For most people, that works just fine, but I’ve run into a couple situations that were weird.
## Multiple Subdomains
If you’re using a lot of subdomains (like, say, with WordPress MultiSite) you’ll find pretty quickly that the normal hotlink protection rule will block subdomain.yoursite.com from getting images from www.yoursite.com and we don’t want that! For one subdomain, it’s an easy fix:
```
# Simple Hotlink Protection
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com(/)?.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(subdomain\.)?yourdomain.net(/)?.*$ [NC]
RewriteRule \.(gif|jpe?g?|png)$ - [F,NC,L]
```
But what about multiple sites? At 12 subdomains, you don’t want to have to add these links in manually every time! Thankfully, the geniuses at Perishable Press have [created the Ultimate htaccess Anti-Hotlinking Strategy](http://perishablepress.com/press/2007/11/21/creating-the-ultimate-htaccess-anti-hotlinking-strategy/). You can read the whole post for the details, but here’s the basic code:
```
# ultimate hotlink protection
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} \.(gif|jpe?g?|png)$ [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?domain\. [NC]
RewriteRule \.(gif|jpe?g?|png)$ - [F,NC,L]
```
Simple. Elegant. Genius. All you have to do is change **domain** to whatever your domain is. Notice there’s no .com or .net in there? There doesn’t need to be. This is the one I use for this site:
```
# ultimate hotlink protection
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} \.(gif|jpe?g?|png)$ [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?ipstenu\. [NC]
RewriteRule \.(gif|jpe?g?|png)$ - [F,NC,L]
```
That’s it. Just change domain to ipstenu and I’m done.
## Letting Other Sites Use Your Images
The other major gotcha to this is what about other sites where it’s okay if they link to you? For example, I have a livejournal site (I know) that’s a mirror of another blog. To take care of that, I added in this as my last condition:
```
RewriteCond %{HTTP_REFERER} !^http://ipstenu.livejournal\. [NC]
```
Here I specified the URL a little more, since I don’t want all of livejournal nabbing my images. Of course, ironically enough, the line where I call ipstenu has the funny side effect of allowing any URL with the name ‘ipstenu’ in it to access my site. Which is a risk I accept right now.
If you’re using my first example, the simple protection, then just like you added in a subdomain, you add in your other URLs
```
RewriteCond %{HTTP_REFERER} !^http://ipstenu\.livejournal\.com(/)?.*$ [NC]
```
This will save you some headaches down the road, but just remember which one your using. Otherwise, like me when I made a new subdomain, you’ll sit there wondering why the heck the images are broken!
**Categories:** How To
**Tags:** administration, images, wordpress
---
### [Email PopUp](https://halfelf.org/2013/genesis-email-popup/)
**Published:** November 13, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Blame Chris Lema for diving into jquery, CSS, and a pop-up ad that isn't a pop-up.
**Content:**
*Edited to note: The popup is **NOT** on this site. You’re not missing anything.*
[Blame Chris Lema.](http://chrislema.com/) Not for “making” me do anything, but for making a good article that was insightful and inspiring. But then again, he’s good at that.
When I read the article he wrote about [Growing your Email List](http://chrislema.com/growing-email-list/), I was interested. While I don’t have the same needs he does, I do want to pull in more subscribers to one site. Look, in general, I don’t worry about [who’s following me](https://halfelf.org/2013/whos-following-me-anyway/) on my personal sites. However I do have a site, one site, where I do care about the followers, especially since I broke my old mailing list a while back.
### Revisiting My Options
The old mailing list worked, but no one could sign up any more, and it was becoming a hassle. It was finally time to move off the old and embrace some new. But what new? I’m a huge proponent of self hosting, but to be frank, I hated managing email server stuff and Mailman is both long in the tooth and not exactly user friendly for the non-technical people. It was time to accept that this was not my forte, and you know what? I didn’t *want* to learn it. Since 100% of the news on that site was pushed via WordPress, it was logical to use something I already had: [Jetpack](https://halfelf.org/2013/jetpack-koolaid/ "Jetpack Koolaid"). It had subscriptions, done.
### “I broke it.”
That was in the body of the email I sent.
I emailed everyone on that old list and explained the situation. I apologized for my screwup, and explained how they could re-subscribe if they wanted. Within 12 hours, 50% of them did. That was good enough for me, and while I’m watching more people trickle in, I think it’s going to top out around a 70% retention rate. That’s not bad at all. A handful of people emailed me back laughing (literally ‘LOL’ was the entirety of more than five replies) and saying it was okay, thank you for letting them know. I was heartfelt, I was honest, and I was deprecating.
I’ve always had a link to my email list in my sidebar as an alias, `domain.com/updates` linked to `domain.com/mailman/list/updates`, so changing that to an actual page all it’s own with a subscription form was crazy simple. New page, delete redirect, done.
Back to Chris though. See, the most enlightening thing I gleaned from his email was the horrifying fact that *pop-ups work*. He didn’t give me stats or anything, but I believe him. When I read that, I believed him enough that I went and read other articles about those ‘non-annoying’ pop-ups. Chris and I are vastly different people, passionate about different things, and obsessive about others. But we share a talent for writing, telling stories, and engaging. We also share a hate of pop-ups. His is certainly *not* annoying.
Actually I’ve barely noticed his, except to go “Oh, there was a pop-up to get him in my email.” No, I didn’t sign up, I like getting Chris in my RSS box.
### jquery
This was the hardest part so let’s tackle it first. All I have to do is show it in a pop-up. Except it’s not *really* a pop-up, it’s a sliding tab. Sure, I could use anything I wanted, but like Chris, I hate pop *ups*.
This part stumped me hard. Chris got it easy by having a third-party hand him the code. I, like many people, have an email list and want to use that. But I’m still very much a rookie when it comes to jquery, so when I ran into this information about [how to code a wordpress.com follow button](http://fgiasson.com/blog/index.php/2011/10/02/wordpresss-follow-button-for-non-wordpress-com-users/) and [Follow me button on WordPress with MailChimp](http://lightdigitalmedia.com/2013/07/follow-me-button-on-wordpress-com-with-mailchimp/), I did a little dance.
The jquery actually comes straight from WordPress.com (I viewed a *lot* of source to reverse this one):
If I enqueued that in my theme, then all I’d have to do is call this somehow in my theme:
The jquery would automatically handle placement and everything, so I struck upon the dead-simple solution.
### Widget
Since I only need to use this on a WordPress site, I put it in a widget, and slapped some CSS around it to make it sexier. The very simple [(Genesis skewed) widget](http://my.studiopress.com/tutorials/register-widget-area/) is as follows:
Yes, I hard coded in the “Follow Site” title bit. Couldn’t figure out how not to, since I needed the link in the title. If this was a normal widget, I’d use the ‘before\_title’ and ‘after\_title’ trick, and while that’s supposed to work with Genesis too, I hit a wall and was in a time-crunch. That said, afterwards, all I had to do was drop Jetpack subscribe widget into the widget area, and the jquery code went into a function to show in my footer. Done. Time for the elf to study up on jquery, though, as I still don’t understand it all.
Bonus note:
That little bit of code says “If someone has subscribed, make sure the popup is up when they visit.” It shows them that they *have* subscribed successfully, which is great, but I quickly realized I could tweak that to pop up when someone visited my site from, say, Facebook or RSS links:
The RSS folks are pretty small, and I doubt they care, but the FaceBook people were absolutely delighted. I want to stress that I was doing this specifically because I have *very* non-technical people, and even having a link for email updates was beyond them. But having this slide-up is non-offensive and apparently much needed. My email subscribers tripled within a week.
**Categories:** How To
**Tags:** coding, css, javascript
---
### [jQuery Toggling](https://halfelf.org/2014/jquery-toggling/)
**Published:** November 14, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Just a quick toggling in jquery to show/hide some text.
**Content:**
I was working on some basic code where I wanted a div to show or hide based on a link. This is simple stuff, but it took me a while to remember it since it’s actually baked into MediaWiki (where I normally use it).
First up is my HTML code:
Like I said, this is basic stuff. I can get more into it and do things like change the text of the title when you click, but for now this suffices.
Now for the jquery:
This code got tossed into a toggle.js file and then enqueued with wp\_enqueue\_script, with a jquery dependancy. Done and done.
I’m sure this could be done with pure CSS, but I believe in release and iterate.
**Categories:** How To
**Tags:** coding, javascript, wordpress
---
### [WordPress iOS App: Good for Bloggers](https://halfelf.org/2014/wordpress-ios-app/)
**Published:** November 5, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The verbification of WordPress lets me down when I reflect on the iOS app.
**Content:**
This is a big distinction.
The app is great. I love using it to write a blog post when I’m on the go, and save for my annoyance that it wants to default to publish and even if I move it to draft, it saves the date and time *that* moment in time, it’s a good app.
But it’s not great for **non**-bloggers.
Let me step back. I run a little database site on WordPress. It’s a listing of TV shows and characters and while it has a blog, it has a bunch of custom post types. Want to know what you can’t write on the iOS app? Pages and CPTs. You also can’t add new users or plugins or anything like that. All I can do is write up a blog post about things. Sure, I can upload pictures but I can’t add them to the library in general, just to posts (and yes, I care about that sometimes). Uploading and setting a featured image is also more complicated than it should be. I often end up with the image uploaded twice.
Realistically, I look at the iOS app and I’m not sure who the target audience is. It’s very easy to add my WordPress.com account and view my reader there, but that’s a different group of people than the ones who want to blog. Then there’s the thought of actually blogging. If you’re on WordPress.com, you can’t add custom post types, so that issue is null, but you still can’t edit pages or Portfolios (which comes with all .com blogs now).
It makes you start to wonder if there should be separate apps, for WordPress.com and self-hosted people, and to that I think not. I’m always going to be logged in to WordPress.com on my iPad because of Jetpack and a desire to see my stats. But at the same time, I really don’t care as much about my WordPress.com blogs. I should, but over time I’ve merged them all into my self-hosted sites because it’s easier for me to go to one place. It’s with that in mind I think we should just have one place for all our WordPress iOS/app needs.
Then you have to consider what the use-case is of a WordPress app. For me, it’s that I want to work on a draft post while on the go and save it offline, only to have it magically get tossed up onto my blog when I’m online. I think of it like Numbers and iCloud. I can edit my archery spreadsheet on my iPhone while I’m at the range and it’s automagically updated on my laptop when I next open Numbers there. Of course, WordPress blogs don’t really work that way.
But at this point, that’s *all* the iOS app is good for, because I can’t administer my site from it. This isn’t so bad, since people like Boren are rabid mobile-first devs for the WordPress admin dashboard. At the same time, we’ve only had it be mobile responsive since 3.8 or so, and it’s been spotty for doing ‘everything’ due to OS limitations, which makes it imperfect. As much as I’m a fan of using WordPress to WordPress, it’s the simple things that make me look at [Desk](http://desk.pm/) for my laptop. Someplace to write.
Except for that, the iOS app still fails because I can *only* write a blog post, and most WordPress sites are more than just blogging now.
At WordCamp San Francisco 2014, I heard more and more people refer to their sites as ‘A WordPress’ than ‘A WordPress blog.’ Every day at work I hear people asked if they would like to setup a WordPress on their site. We’ve verbified the word, but we haven’t verbified the app yet.
**Categories:** How It Is
**Tags:** apple, review, software, wordpress
---
### [iPad Mini](https://halfelf.org/2014/ipad-mini/)
**Published:** June 25, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A little ditty about my iPad Mini and why I like it so.
**Content:**
I normally don’t review hardware. I like it, but given my one experience with serious electrical work (buy me a coffee, it involves a barn roof), I tend to not mess with it. So I’m purely a hardware consumer.
That means when things like the iPod came out, I was highly interested. A deck of cards and it has all my music? I’m in! Now I have an 8G iPhone (yes, the smallest one) and it’s perfect for what I need it for: a phone and a walkman. Don’t get me wrong, I have a couple games (Tetris, Bejeweled, and Dungeon Raid), but for the most part I use my smartphone to handle the phone and texting stuff, directions when I’m in a new place (which happens a lot now) and listening to baseball games.
I also have a laptop, which I use to code and write and … well you know what they’re for. Then I have an iPad. I’ve had one since they first came out as I’ve always had a mad crush on the idea of an [Apple Tablet](https://ipstenu.org/2004/wheres-the-tablet-macintosh/). Back in 2004, a whole decade ago, I wanted it for ebooks. Today, I use it for books, comics, surfing the web, Angry Birds (do do doot do!), email, and writing. Yes, I like writing stories on my iPad.
Recently, I started looking at the iPad Mini as a viable choice. It’s smaller, lighter, and still retina. At the time, my iPad was the ‘new’ iPad (3rd gen, with Retina), and it worked well, but always felt heavy and clunky in my purse. The main issue I had with the mini was how would reading *comics* feel.
Answer? *Awesome*. The retina display is somehow better on the mini, crisper and clearer without me having to crank the brightness up. It has good battery life (reading all day) and the apps are more responsive than my iPhone. There’s less lag jumping between them. This is due to the beefier processor, I know. I also got more disk space, so now I don’t have to download one manga at a time and delete it when I’m done. I like to re-read.
The only thing I don’t like is reading it in the sunlight, which I know is a common kvetch of the iThings. I love reading on my deck or patio, in the sun, so now I just sit with my head in the shade and it works out. Also, and this is a first world problem, my iPad is so crisp, my eyes get tired reading on it. Though that I’ve solved by changing the iBooks font and colors.
So why blog about this? Well my iPad *also* has an SSH app ([iSSH](https://itunes.apple.com/us/app/issh-ssh-vnc-console/id287765826?mt=8)) and a file editor ([Diet Coda](https://itunes.apple.com/us/app/diet-coda/id500906297?mt=8)) and when you toss in WordPress and Chrome (with my normal profile saved), I can bring just my iPad to a WordCamp and be able to work or take notes. I joked I needed a svn/git app, but really I just use Coda, sync with DropBox, and pick up the files when I’m at my laptop. Yeah, it’s pretty cool.
**Categories:** How It Is
**Tags:** apple, hardware, review
---
### [You'll Never Take My Freedom!](https://halfelf.org/2011/youll-never-take-my-freedom/)
**Published:** August 2, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** I may not agree with what you do, but if it's legal, I will defend your right to do it.
**Content:**
I am an adherent to [GPL](https://halfelf.org/2011/software-freedoms/).
This means I understand what it means, what it protects, and what it does not. So when in the beginning of August I saw a guy selling [200 free WordPress plugins for $9](http://www.warriorforum.com/warrior-forum-classified-ads/424733-finally-money-making-wp-plugins-instanly-turn-your-boring-websites-into-35-625-yr-atm-machines.html), I really don’t mind. I mean, I, personally, think that selling the plugins is the wrong way to go about it.
**I will defend your right to resell MY plugin**
Look, I may think it’s a total dick move, and I may personally find it distasteful, but what I don’t find it is illegal. Morality is something else. I am legally permitted to take a plugin from another site, a paid plugin, and if it’s GPL, I can give it away, sell it, or do what I, as a user, want to do with it. Would I? Actually, yes. I have. It’s called *forking* a plugin. But I always attribute the authors, thank them, and point out what I did to make this plugin different.
In fact, it’s not the reselling at all that fired up my blood. It was this one line where he says you can’t resell the plugin compilation for less, and you can’t give it away.
It’s *highly* possible what he meant was ‘This set is a set, don’t steal my shit!’ And to that, yes, don’t take his hard work and steal it, that’s uncool. But where he looses his right to say that is when he tries to revoke freedoms clearly laid out in GPL, notably, I have the right to take a GPL licensed plugin and do what I want. You just can’t have it both ways.
**Don’t worry! This can be fixed!**
Otto pointed out that, as he’s also using images and other possibly non-GPL items in his product, that in a way, this is okay. Well, that’s nice, but he still can’t take away my GPL freedoms. He can do a pseudo-split license, and say “These products are GPL, and as such, all GPL freedoms remain intact. THESE products, however, are not GPL, and fall under the following provisos.” That’s a lot of work, I know, but suddenly he’s GPL-compliant! Yay!
Of course, that assumes he had the right to use those non-GPL items in the first place. And we already knows he’s buzz-worded some BS.
> 1\. I have Full Master Resale Rights and Each One of the Plugins Listed Above Has Resale Privileges attached to them.
>
> 2\. Because of the Master Rights, I have the each developers expressed permission to offer Private Label Rights to All Who Purchase WP Million Dollar Plugins.
>
> 3\. Being That these are Unique & Rare Resell Rights Plugins You Have a Two-fold Benefit,
> a) The Personal Use of the WP Million Dollar Plugin
> b) The Ability to Offer This Unique/Profitable Package to Your Customers.
The rampant abuse of capitalization aside, items number 1 and 2 there doesn’t make a lick of sense to me. First, I know that [at least one plugin dev didn’t give any ‘extra’ permissions outside of what GPL already provides](https://twitter.com/#!/markjaquith/status/98069275037806592). So if we know this guy didn’t ask permission, what ‘master right’ does he have? Not a one, that I can come up with.
GPL freedoms don’t require asking permission to reuse them, they don’t permit ‘private label rights’ (which actually is just marketing speak, and [means nothing at all legally](http://en.wikipedia.org/wiki/Private_label_rights)) or any rights that further *restrict* your freedoms.
Another easy way to fix this is to not include the plugins, but instead sell it as a $10 book: The 200 best plugins for your site, how to find them, which ones to use, and why they’re great! Imagine a book that could help you get started by breaking down the best plugins for what you’re trying to do? A lot of newbies would kill for that. So sell THAT. Sell your own work. If you’ve done the research, sell it. But unless you make the plugin, or are going to support it, you’re nothing more than a hotdog vendor.
**Free is better, right?**
In the end, peer pressure reverted this $9.95 deal into a ‘free’ download by the end of the day, which I did not try (since the amount of layers to download looked like a rip off to me, and lead to a $950 … thing). No one ‘won’ anything, though. I’m sure the guy feels blasted by the people who descended upon the forums (as well as the ones who private messaged him). It’s fairly clear the forum regulars were not pleased by the onslaught nor their attitude.
A lot of agony could have been avoided if research had been done in the beginning. If more time had been spent looking up what was being sold, and why, instead of slapping marketing speak (much of which has been removed). When selling becomes more important than doing the right thing for the product and the users, you’ve lost something. Make good things, make *that* important, and not making money and selling them. If that’s all you care about, I’ll make sure to avoid your product.
By the way… It’s Word**P**ress, with a capital P.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, license, open source
---
### [The Legality of Forking](https://halfelf.org/2011/the-legality-of-forking/)
**Published:** August 29, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** "An avidity to punish is always dangerous to liberty. It leads men to stretch, to misinterpret, and to misapply even the best of laws. He that would make his own liberty secure must guard even his enemy from oppression; for if he violates this duty he establishes a precedent that will reach to himself." -- Thomas Paine
**Content:**
*Update: This post is **just** about the legal aspects of forking. If you just want to talk about the morality of it, please go read [The Morality of Forking](https://halfelf.org/2011/morality-of-forking/).*
You may have heard about this. WooThemes hired a couple of developers who used to work for Jigoshop, and forked one of their plugins.
> Last week [WooThemes announced the hiring of Mike Jolley and Jay Koster](http://wpcandy.com/reports/woothemes-forks-jigoshop-into-woocommerce "WooThemes forks Jigoshop into WooCommerce, launches WooLabs"), as well as the forking of Jigoshop e-commerce plugin into the soon-to-be-released WooCommerce. Jolley and Foster previously worked for [Jigowatt](http://jigowatt.co.uk/), a WordPress and Magento development shop, spending the last year working on the core of Jigoshop.([WP Candy: Jigoshop team and WordPress community members share thoughts on forking](http://wpcandy.com/reports/jigoshop-wordpress-community-share-forking-thoughts))
When you read it that way, it looks a little weird, doesn’t it? Shady even. After all, this is a case of one company cherry picking ideas from another, and then taking developers to continue working on their version.
Here, read this view of events:
> But of course, open source makes it so easy to simply “steal” someone’s idea and hard work. And justifying it by hiding under the umbrella of open source and “legal” [forking](http://en.wikipedia.org/wiki/Fork_(software_development)). ([WooThemes Forks Jigoshop and they brag about it](http://blogforprofit.com/wordpress/woothemes-forks-jigoshop/))
I’m going to go out on a limb here and present a point of view that many people will disagree with.
**It’s not theft.**
Freedom is a complicated, annoying, thing, and sometimes having a freedom means you accept the consequences of that freedom. In the US, we have freedom of speech, which means we can bitch about our government if we want to. But that also means someone else, who has the polar opposite of your views, has the exact same right you do. And I will defend that person with my dying breath that they have that right, no matter how much I detest what they’re saying.
You have to keep that in perspective when you start talking about rights and legality. WooThemes had the legal *right* to do what they did. That doesn’t mean you don’t get to think that it was a dick move, and you may, but what it was, was 100% above-board. They were honest about it, and it was legal. The GPL affords us the freedom to make plugins, fork WordPress if we wanted, and do what we want, so long as we don’t *restrict* the freedoms even more.
We pay a heavy price for these freedoms, don’t get me wrong. All freedoms have a cost. We all pay for them. Thomas Paine’s famous quote reflects on the ‘free’ part of open-source in a strange way: “What we obtain too cheap, we esteem too lightly; it is dearness only that gives everything its value.” The core code of WordPress is free to us, and perhaps we devalue it for that price. Certainly the unrealistic expectations of many users is that this is a free product, and as such they deserve all things for free.
It’s possible that many people are dismissing this forking because hey, it’s a free world! WordPress is free, the plugin was free, the plugin was GPL, we’re all free to do what we want. But WordPress, when it hands us a dizzying array of freedoms in usage, is clearly giving us liberty that can be easily abused. It’s possible this is the case of abuse of that liberty. To judge that, we have to look at the whole picture.
> Woo’s bid to buy out the Jigoshop project grossly undervalued the business and didn’t come close to covering our initial development costs, not forgetting the planning, time and effort both the Jigowatt team and community put into the project.
>
> Woo then made to an offer to ‘collaborate’ which led to their decision to fork Jigoshop. What hasn’t been made public is that collaboration offer included conditions which would have given WooThemes full strategic control over the direction and development of the Jigoshop project in the future. ([Jigoshop: Our Forking Views](http://jigoshop.com/blog/2011/08/26/our-forking-views/))
So clearly we can see that an offer of purchase, and collaboration, were made. They were felt to be not right. That was Jigoshop’s right and choice. Was it the correct choice? Only time will tell. That holds true of both Jigoshop and WooThemes. But up to this point, the whole deal is above-board, fair and just. And then WooThemes said ‘Well, they don’t want to work with us. That’s fair. We’re going to fork. And we’re going to take their core devs with us.’
This is *still* not theft.
See, WooThemes had no power to ‘take’ those devs unless Jigoshop undervalued them. That is *Jigoshop* esteemed their own developers too lightly. If the devs had been happy with their compensation, the direction of the plugin, and the company, they wouldn’t have left.
> If you are a company with an open source project gaining momentum, your core developers absolutely must have a vested interest in your company. And not 1%. It has to be a good chunk of the pie. Enough that the developers feel your company is also their company. Then if another company comes along to hire them, the developer is much more likely to tell them, “Buy the company or take a hike.” ([Lessons learned from the Jigoshop – WooCommerce fiasco](http://bradt.ca/archives/lessons-learned-from-the-jigoshop-woocommerce-fiasco/))
In the corporate world, I’ve signed a contract that says, should I leave my company, there are jobs I have legally agreed *not* to take for 12 months following my termination. My contract also prohibits me from doing certain types of freelance work. Not that long ago, a friend complained that it wasn’t ‘fair’ that we were restricted like that. I looked at her and pointed out “No one made us sign these contracts. We read them, and we chose to sign them.”
I’m no stranger to signing NDAs and other documents that restrict me from telling you things like who banks at the company I work for. I *can* tell you things that are publicly known, but not things that are not. That sounds fair, doesn’t it? I also can’t blog about my company with certain details, and on pain of being fired, I can’t talk to the press about anything. I don’t have to like it all the time, but it’s something I agreed to and that’s a choice I have to live with. Many of my friends who work in other ‘worlds’ can’t understand how a company can restrict my private life. I point out that I signed a contract that promised I wouldn’t, and I keep my promises. If I didn’t, would I be the person they liked and respected?
No one here violated a contract, lied, cheated, or stole. So why are people chapped and are they right to be so?
Right and wrong are tenuous. What’s right for you isn’t right for me, and that’s a part of why we have the law, which defines right for ‘everyone.’ Of course, we all know that even then, right is subjective. The law is imperfect, we know this, that’s why we have judges and jurys who listen to the situations that surround illegalities and make judgements based on not just the black and white of a situation, but the entire picture.
What WooThemes did was legal and fair. End of story. We cannot stand and shout for the freedoms of WordPress and GPL without defending their actions. That doesn’t mean we have to like them. If this makes you decide to never support WooThemes or Jigoshop again, that’s your choice too, and one I will defend till my dying day. I feel that I should point out here that some people who are decrying WooTheme’s move are the *same* people who were all up in arms for Chris Pearson’s Thesis theme to abide by the GPL.
We live by the GPL sword, and we’ll die by that sword for as long as we stay GPL. The community clearly wants to be GPL, or we’d not have gone after Thesis with such animosity. That means we have to accept that sometimes what’s right isn’t what we would do. But then again, no one’s making you use the forked plugin.
Someone’s bound to bring up the fact that even [Matt ](http://ma.tt/)doesn’t like forking. That would be incorrect. WordPress is a fork of B2. Matt’s problem with forking is pretty easy to understand:
> Forking is not usually ideal because it fragments the market for users
Notice how Matt doesn’t say he doesn’t like it, but that it’s not ideal? That does rather apply to this situation. By forking a plugin, you make two versions of it. Were we not all recently delighted when the TimThumb fork (WordThumb) merged with Tim to fix the problems? Were we not ecstatic when WPMU merged with WordPress to make MultiSite? Multiple plugins that do the same thing mean multiple places to have to patch.
And yet. There are already a handful of similar plugins out there. Having competition drives people to make better products and prevents us from resting on our laurels. It’s great you made the best plugin ever, but now what? It’s true this fork may be damaging to the community, and it’s true that it may have caused hurt feelings. But what matters more is where are Jigishop and WooThemes going *next*? How will their plugins make themselves notably different?
In the end, if you don’t like it, vote with your feet, but you owe it to yourself to defend everyone’s freedom with the same ferocity you defend your own. Even the people you hate.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, license, open source, plugins, wordpress
---
### [The Morality of Forking](https://halfelf.org/2011/morality-of-forking/)
**Published:** August 31, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** "Those who expect to reap the blessings of freedom must, like men, undergo the fatigue of supporting it." -- Thomas Paine
**Content:**
Having already established that [Forking is Legal](https://halfelf.org/2011/the-legality-of-forking/), I felt it best to take the other end of the argument.(This was intended to be all one post, but at about 3000 words, it needed to be split up.)
Clarification here. Jigoshop is a product of Jigowatt. I call them Jigoshop in both my posts because it’s easier for my brain.
Gil Rutkowski remarked (without knowing I was already writing this):
> Funny how people pick and choose between the “SPIRIT” of the GPL and its literal legal application to fit their argument. ([@flashingcursor on Twitter](https://twitter.com/flashingcursor/status/108265767467880448))
We often sum up GPL as “Do what you want with this software. Just let other people do what they want with the software you make from it.” If you’re not familiar with it, I think I can sum up the *spirit* of GPL as “Don’t be a dick.” ([Wil Wheaton in Exile](http://wilwheaton.typepad.com/)) People get in a lot of arguments about the ‘spirit’ of things. You’ve probably heard someone complain “He’s following the letter of the law, but not the spirit.” Basically what that means is someone is obeying the law, but not what it means.
How can that even be? If the law is the law, then the law is the law and there should be no wibbly wobbly involved! It happens because of intent. The intent of the law in general is really something we shouldn’t have needed to be told in the first place, when you think about it. Primum non nocere: First, do no harm. Doctors are taught this, and you’d really think that’s self-evident! And yet, even the US Declaration of Independence starts out “We hold these truths to be self-evident…” If they were self-evident, why are we saying thing?
People are selfish. We care about ourselves first, then the people closest to us, and so on and so forth. To say the ‘spirit’ of the law means we’re no longer actually talking about the law as a legislative statute, but about the idiomatic application there of. We’re now talking about how we feel the law should be, which is pretty iffy territory. Talking about the spirit of the law brings up things like the moral ambiguity of the law, and the ethics we try to impose on others. What’s ethical for me may not be so for you, and so on.
So what does the moral aspect of GPL have to do with the recent forking of Jigoshop’s eCommerce plugin? Interestingly we can see how both parties ended up at the fork because they were selfish. Jigoshop didn’t want to give up control and neither did WooThemes. Neither was willing to concede, and in a way, they both ‘lost’ because of it.
Was Woo being a dick to fork the plugin? Yes. And no. You have to keep this in perspective.
You see, *no one* has made a ‘Killer’ eCommerce plugin for WordPress. Not even Jigoshop. From what I’ve been told, Woo has struggled to make their own killer plugin for eCommerce, and failed at it. I will leave it to others who actually use eCommerce on their sites to determine which plugin is queen, but I feel comfortable saying that taking someone else’s work, even when you credit them, *can* be a dick move.
At the exact same time that WooThemes is being a dick for forking, they’re doing a right thing. No that’s not a typo, they are doing A thing that is right. We all know that ‘hacking core’ for WordPress (or any app) is a terrible thing. Merging changesets is a nightmare, no matter what tool you use, and a fork makes it just as hard to incorporate changes. So would not a *better* solution be to make a WooTheme add-on plugin that just changed the parts of Jigoshop they didn’t like? A Woo/Jigo integration plugin?
That would be a wonderful, perfect world. Let me know when we get there. Sometimes the direction of a plugin is such that you *have* to fork it to do what you want. The developers don’t want to follow your dream of unicorns and puppies. Until we reach the perfect world, we fork. Now, it took a bit of reading to verify that WooThemes was unable to make their desired changes *without* editing core plugin code. That left them with only a few viable options. They could submit the changes to Jigoshop and hope for the best, or they could hack the Gibson. Basically, this was the best choice for WooThemes and really, nothing’s wrong with that.
The problem is that WooThemes is going to be making money off this acquisition. Their WooCommerce plugin will be free, just like Jigoshop, but just like Jigoshop, they aim to make a living off the plugin. Off someone else’s work. To be fair, that’s what I do. I support other people’s ‘stuff’ all the time. I’ve not written a lick of code for Windows in years (except DOS and PowerShell scripts) but their products pay my bills. Does that make me a thief?
No, it makes me an opportunist. WooThemes is being opportunistic as well. Remember how I said we are, all of us, selfish? Well so is Woo. They see a chance to make money and use a plugin that works, and not their own with a weird history. (Did you know Nacin was once going to head up WooCommerce before he was snatched by Matt? That’s fun to look at in retrospect.) Woo had a series of unfortunate issues with their own plugin, and it never worked right. They weren’t a dick because they talked to Jigoshop first (they didn’t have to), and I rather hope they said ‘Okay, we’re going to agree to disagree on the direction of the plugin and fork it.’ If Jigoshop first learned of the fork via Woo’s blog post, then they were entirely dicks.
Was Woo being a dick to ‘head hunt’ the developers? Yes. And again, No. Yet again, perspective is important.
I said before that the developers they ‘stole’ wouldn’t have left if they had a reason to stay. People leave companies all the time for myriad reasons. They also stay with companies for others. In the ‘traditional’ corporate world, people get a job and stay with it for a million years. In the freelance world, though, people switch jobs around a lot more. Even so, people only leave companies for three reasons:
1. They hate it here
2. They found something better
3. They were let go
That’s really it. So if someone chooses to leave a company, options one and two are there on the table, and you have to be honest to ask if they would have left if Woo *hadn’t* made the offer? And there’s where the dick move *possibly* lives. Was it Woo’s promise of skittles and beer that made them leave, or was there something wrong at Jigoshop? It’s far too early to point fingers at anyone, especially the developers who may discover they made a poor choice. You have to take risks, after all, or you never succeed.
WooThemes was dickish if they bribed away the developers. But they weren’t if this was just one of those serendipity moments. What if the developers said ‘Wow! Woo shares *our* vision!’ We don’t know, so we have to speculate, but either way, the decision was the developers and not WooThemes or Jigoshop, so any dickery actually belongs to the devs and them alone.
Since I was asked, my personal opinion is this: WooThemes pulled a dick move which in no way violated the letter or the spirit of GPL.
See the spirit would have been violated if, as another shop did recently, they lifted the plugin wholesale, made a couple tweaks, rebrand it, and released it without telling anyone. You know who I’m talking about here. That was violation of the spirit of GPL. But WooThemes was upfront about this. They talked to Jigoshop first, and everyone seems to have known what was going on before the news broke.
While I dislike that WooThemes did this, I will defend their right to do so (and Jigoshop’s right to be upset) until the day we all stop using GPL.
The whole reason I wrote the first post, however, was the high number of people I talked to who said that the spirit of the law was violated. It really wasn’t. Yes, these were dick moves, but the spirit of the law is the meaning, and the meaning of GPL is that you can’t impose *more* restrictions on a GPL product than it started with. No one did that. What Woo did was pretty shitty to their neighbor, don’t get me wrong, but it didn’t kill GPL. It hurt feelings and left a bad taste in the mouth, but that’s not the spirit of GPL either.
The Spirit of GPL is freedom. It’s sharing your work, working together, and when you take someone’s work, being open about them and crediting them. And while you don’t have to like what Woo did, they did not harm the spirit of GPL, because we’re all here, talking about it and still abiding by it.
I can but hope that the fallout from this is that we’ll finally have an eCommerce plugin that stands up as the best because of worth and not because that’s all we’ve got, but we’ll have to wait a couple of years for that to settle.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, license, open source, plugins, wordpress
---
### [PMC Sues THR Over Open Source Code](https://halfelf.org/2011/pmc-sues-thr-over-open-source-code/)
**Published:** September 14, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Open Source goes to court, but this time none of the regular players are involved.
**Content:**
Bet you never thought you’d hear that one!
Today [Deadline’s Parent Company Sues The Hollywood Reporter’s Parent Company For Copyright Infringement](http://www.deadline.com/2011/09/breaking-deadlines-parent-company-files-lawsuit-against-the-hollywood-reporters-parent-company-for-copyright-infringement/). They posted a link to the [complaint](http://www-deadline-com.vimg.net/wp-content/uploads/2011/09/PMC_vs_THR_Complaint110914175112.pdf) and its [exhibits](http://www-deadline-com.vimg.net/wp-content/uploads/2011/09/PMC_vs_THR_Exhibits110914164154.pdf). And this is where I sat up and blinked.
See, TVLine uses WordPress. And part of their claim is that their (I assume) home-grown plugin was lifted. Specifically this file: `http://www.tvline.com/wp-content/plugins/todaysnews/js/jquery.featuredarticle.js`
Now, I’ll totally allow that the site stole the code. But it’s WordPress which means the code is GPL which means … they can. They’re dicks about it, mind you, but they totally can. I’m interested to see how this one plays out.
ETA: By ‘the code’ I mean not JUST that .js file, but the HTML, the specific WordPress calls, etc. THR actually isn’t using WordPress, as it happens.
**Categories:** How It Is
**Tags:** copyright, freedom, license, wordpress
---
### [GPL Freedoms - Yep, Porn's Good!](https://halfelf.org/2011/gpl-freedoms-porn-is-good/)
**Published:** October 10, 2011
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** You may not like it, you may find it distasteful, but it's perfectly acceptable, license wise, to use certain products for anything you want. Just don't break the law.
**Content:**
Did you know you can use WordPress for a porn site?
Did you know you can use Drupal to show autopsy pictures?
The freedoms of GPL don’t just extend to the software itself, but to *how* you use it. See, most of the time when we talk about GPL freedom, we’re talking about how you’re free to take the code and turn it into a monkey if you want to. But lately, there’s been an effort to remind people that part of GPL also means we don’t restrict your *usage* either.
WordPress has a link to ‘Freedoms’ at the footer of all admin pages, and that duplicates the Bill of Rights found at [WordPress’s Philosophy](http://wordpress.org/about/philosophy/):
> WordPress is licensed under the General Public License (GPLv2 or later) which provides four core freedoms, consider this as the WordPress “bill of rights”:
>
> - The freedom to run the program, for any purpose.
> - The freedom to study how the program works, and change it to make it do what you wish.
> - The freedom to redistribute.
> - The freedom to distribute copies of your modified versions to others.
Drupal doesn’t spell it out as clearly, but given that they have [fetchgals](http://drupal.org/project/fetchgals), which can pull in thumbnails of porno pics (if I read that right), I feel confident to say that Drupal doesn’t care what you use Drupal for. Joolma! puts a lot of stock in people using their product for their communities and nowhere did I find note of a limitation of what you *cannot* do.
The point is valid, however. You can use WordPress, Drupal, Joomla! and pretty much any GPL software for whatever purpose you want, moral or immoral, legal or illegal. This is interesting when you compare it to most EULAs, like Microsoft Office:
> 7\. SCOPE OF LICENSE. The software is licensed, not sold. This agreement only gives you some rights to use the features included in the software edition you licensed. Microsoft reserve reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not
> \[…\]
> • use the software in any way that is against the law;
GPL doesn’t tell you that you can’t use it in a way that’s illegal, and perhaps Microsoft only does to escape a potential lawsuit for someone saying “Aha! You used Office to draft your Mainifesto!” We live in over litigious times. Open Source, by telling us ‘Do what you want, it’s not our beef.’ removes themselves from those issues cleanly and without ass hattery.
One of the tenets of American Law is our freedom to speak our mind. Part of being an American Citizen is that you have the right to defend your beliefs, no matter how much I oppose them, and so long as no one breaks the law, that’s fine. I can ask you to leave my house if you do it on my private property, and you can ask me to leave yours. But if we meet on the street I cannot have you arrested for that. I will defend your freedoms just as you must defend mine, regardless of any agreement or lack there of.
This applies to Open Source because I have the right to use WordPress, Drupal or Joomla! in ways *you* may find distasteful. As long as I’m not violating the agreement of my ISP, the laws of where my server is located, and the laws of my nation, I’m allowed to call you names, insult your heritage, and show nudie pics of pretty girls. On the other hand, I cannot publish your personal information (it’s a violation of invasion of privacy) and I cannot post naked pictures of you without your consent. Actually, my webhost won’t permit and naked pictures at all, so there’s that.
So when you see a site run by WordPress, Drupal or Joomla! that’s doing something you hate, there’s very little you can do about it. Report it to their webhost if you think it’s breaking the law, but otherwise celebrate people in their freedom.
**Categories:** How It Is
**Tags:** copyright, essay, freedom, hosting, license, open source
---
### [GPL - Oh Dear God](https://halfelf.org/2012/gpl-oh-dear-god/)
**Published:** February 28, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** GPL - I don't really care what flavor you use but won't anyone think about the users?
**Content:**
I come to code from a strange direction. I was a fangirl and I learned all about webpages because of that. Perhaps it’s because of that humble begining that I look at the GPL arguments much as I look at ‘shipping’ arguments in fandom. Shipping is when fans believe a relation*ship* to exist between two characters, regardless of anything being scripted. A great example of this is *Xena: Warrior Princess*. Some people thought Xena and Gabrielle were a couple. Some people didn’t. When the two argued, there were fireworks. Now, with shipping, sometimes a miracle occurs and the couple *do* get together (see Mulder/Scully in *The X-Files* and Grissom/Sara in *CSI: Crime Scene Investigation*), but most of the time the arguments go on for eternity.
That’s pretty much how GPL arguments make me feel. Ad nasuem. I hate them, and I was sorely tempted to post this with comments turned off. But various people asked me my opinion and that they’d *like* to see this posted, so… you’re masochists. This all started with [Rarst](http://rarst.net) asking me what I thought about a GPLv2 vs GPLv3 in a trac ticket in WordPress to [fix plugins about page license requirement](http://core.trac.wordpress.org/ticket/16898). I should note that he and I don’t see eye to eye about GPL, and we’re still pretty friendly.
Here’s the thing. I don’t have a horse in this race. GPLv2, GPLv3, MIT, Apache, whatever. I don’t have a license I love beyond measure. You see, I work for The Man, and having done so for 13 years, I have an acceptance of things I can’t change. One of those things is ‘This is how we do things.’ You accept that, even if things aren’t the most efficient, or even if they’re not the way you’d do them if you could choose, this is what they are.
I view the GPL issue in WordPress with the same antipathy. It’s not that I don’t care, it’s that I accept the rules for what they are and I have no reason to rock the boat. WordPress says ‘If you want to be in our repositories, and you want to be supporting our official stuff, you have to play by our rules.’ This is good business sense, it’s good branding, and it’s self-protection. With that in mind, I recently changed a plugin of mine to use code that was MIT licensed.
> **Expat License (#Expat)**
>
> This is a simple, permissive non-copyleft free software license, compatible with the GNU GPL. It is sometimes ambiguously referred to as the MIT License. ([MIT License compatibility with GPLv2](http://www.gnu.org/licenses/license-list.html#Expat))
That’s easy enough. But I’m sure you’ve heard people argue that GPLv3 and GPLv2 are incompatible, or Apache is, and those are true statements. Because they’re incompatible, however, does not mean you can’t use them together, it means you can’t incorporate them!
Let me explain. No. [Let’s let Richard Stallman explain](http://gplv3.fsf.org/rms-why.html):
> When we say that GPLv2 and GPLv3 are incompatible, it means there is no legal way to combine code under GPLv2 with code under GPLv3 in a single program. This is because both GPLv2 and GPLv3 are copyleft licenses: each of them says, “If you include code under this license in a larger program, the larger program must be under this license too.” There is no way to make them compatible. We could add a GPLv2-compatibility clause to GPLv3, but it wouldn’t do the job, because GPLv2 would need a similar clause.
>
> Fortunately, license incompatibility only matters when you want to link, merge or combine code from two different programs into a single program. There is no problem in having GPLv3-covered and GPLv2-covered programs side by side in an operating system. For instance, the TeX license and the Apache license are incompatible with GPLv2, but that doesn’t stop us from running TeX and Apache in the same system with Linux, Bash and GCC. This is because they are all separate programs. Likewise, if Bash and GCC move to GPLv3, while Linux remains under GPLv2, there is no conflict.
What does that mean? It means I could write a plugin in GPLv3 and use it with the GPLv2 (or later) WordPress and not have any issues. However what I cannot do is take that code, put it into WordPress, and distribute it as a new version of WP Core. And that’s (most of) why we shouldn’t have the GPLv3 plugins in the WordPress repository. The fact is that often new core features get their start as plugins, and if we allow GPLv3 in there, we run the risk of breaking licensing.
[](https://halfelf.org/2012/gpl-oh-dear-god/licenses/)Worse, if we get our *ideas* from a GPLv3 plugin and rewrite it to GPLv2, we still are at risk for violation. This is the same reason, to bring it back to fandom, why authors can’t read fanfiction. If they use *your* ideas, you can sue them. We have enough headaches with Hello Dolly, let’s not add to them. And before someone thinks I’m overreacting about that, I wish I was. I’ve watched copyright wars before, seen friends lose their websites over it, and I can’t imagine that a TV show would be less agressive than a software company when they feel their rights have been infringed. It’s terrible, but it’s the reality of the litigious society in which we live.
So why don’t we just move WordPress to GPLv3?
If it helps to think of software in a different way, pretend you have two versions of server software, Server 2.0 and Server 3.0. You can use the files from Server 2.0 on the box with Server 3.0, but you can’t use Server 2.0 files on Server 3.0. They’re not backwards compatible. That’s the first problem with GPLv3, we’d have to make sure every single bit of code in WordPress is *able* to be moved to GPLv3.
This is clarified in the GPLv3 FAQ: ([GPLv3 FAQ Update – Converting GPLv2 to GPLv3](http://gplv3.fsf.org/wiki/index.php/FAQ_Update#I_have_a_copy_of_a_program_that_is_currently_licensed_as_.22GPLv2.2C_or_.28at_your_option.29_any_later_version..22__Can_I_combine_this_work_with_code_released_under_a_license_that.27s_only_compatible_with_GPLv3.2C_such_as_ASL_2.0.3F))
> **I have a copy of a program that is currently licensed as “GPLv2, or (at your option) any later version.” Can I combine this work with code released under a license that’s only compatible with GPLv3, such as ASL 2.0?**
> Once GPLv3 has been released, you may do this. When multiple licenses are available to you like this, you can choose which one you use. In this case, you would choose GPLv3.
>
> If you do this, you may also want to update the license notices. You have a number of options:
>
> - You may leave them as they are, so the work is still licensed under “GPLv2, or (at your option) any later version.” If you do, people who receive the work from you may remove the combination with parts that are only compatible with GPLv3, and use the resulting work under GPLv2 again. If you do this, we suggest you include copies of both versions of the GPL. Then, in a file like COPYING, explain that the software is available under “GPLv2, or (at your option) any later version,” and provide references to both the included versions. If you have any additional restrictions, per section 7 of GPLv3, you should list those there as well.
>
> - You may update them to say “GPLv3, or (at your option) any later version.” At this point, any versions of the work based on yours can only be licensed under GPLv3 or later versions. Include a copy of GPLv3 with the software.
>
> - You may also update them to say “GPLv3” only, with no upgrade option, but we recommend against this. Include a copy of GPLv3 with the software.
That doesn’t sound terrible, does it? You can go from GPLv3 to GPLv2, so long as you remove all the GPLv3-and-up code. Backwards compatibility is complicated, and forward isn’t much better. The second problem is the bigger one. From the GPLv3 FAQ: ([GPLv3 FAQ Update – permission to change release](http://gplv3.fsf.org/wiki/index.php/FAQ_Update#Consider_this_situation:_1._X_releases_V1_of_a_project_under_the_GPL._2._Y_contributes_to_the_development_of_V2_with_changes_and_new_code_based_on_V1._3._X_wants_to_convert_V2_to_a_non-GPL_license._Does_X_need_Y.27s_permission.3F))
> **Consider this situation: 1. X releases V1 of a project under the GPL. 2. Y contributes to the development of V2 with changes and new code based on V1. 3. X wants to convert V2 to a non-GPL license. Does X need Y’s permission?**
> Yes. Y was required to release its version under the GNU GPL, as a consequence of basing it on X’s version V1. nothing required Y to agree to any other license for its code. Therefore, X must get Y’s permission before releasing that code under another license.
And why would WordPress want to switch to GPLv3 anyway? Other than having more licenses compatible with GPLv3 than GPLv2, the other main differences didn’t strike me as anything WordPress needs. You can read [ifrOSS’s document](http://www.ifross.org/en/what-difference-between-gplv2-and-gplv3) and come up with your own opinion, of course. Basically in order to get WordPress moved to GPLv3, every single person who ever submitted code to WordPress has to be contacted and sign off on the change. Now, unless a clever lawyer type can argue that the act of submitted code to core reliquieshes your ‘ownership’ thereof, and the code becomes community
 code maintained and manged by WordPress, *and* as such WordPress does not need to gain consent from all contributors, then *maybe* this can be done. But that’s a long, mess, legal conversation.
Finally, the real question is who are we protecting here? [Remember, GPL is not about the *developer* but the *user.*](https://halfelf.org/2011/software-freedoms/ "Software Freedoms") The extra ‘freedoms’ that come in GPLv3 don’t really strike me as being about the user, and that worries me a little. Patent protection, permitting code to be kept from the end user, and tivoization are all great things for a developer who puts out the code, but as the person who wants to adapt it later, that sure feels pretty restrictive to me.
Will I use GPLv3 ever? Sure. But not in my WordPress code.
**Categories:** How It Is
**Tags:** coding, copyright, essay, license
---
### [Fork With Restraint](https://halfelf.org/2012/fork-with-restraint/)
**Published:** April 9, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** While the GPL allows you to fork plugins, you should think long and hard if there's a reason you need to do this.
**Content:**
I love that the GPL lets you fork. In fact, two of my plugins are forks and one’s an adoption. I think that’s one of the best things about GPL, [the freedom to adapt and move on](https://halfelf.org/2011/the-legality-of-forking/). But every single time you fork a plugin, you cause a couple problems that many people are either ignorant of or just don’t care about.
**Confusion**
If you look up ‘WP Grins’ there are three plugins. ‘WP Grins’ is the original, ‘WP Grins Lite’ is the first fork, and ‘WP Grins SSL’ is the third. Each one is pretty explanatory. The plugins are similar, but you get the idea from the title what’s different. And in each case, each forker took the time to say ‘this is what’s different’ in obvious ways, and to credit those who came before. This is important because, based on name alone, there’s not a whole lot to differentiate the plugins.
Multiple ‘things’ with the same name is confusing. That’s really very obvious isn’t it? That’s why companies spend hours and months fighting to protect their trademarked names. The name of a ‘thing’ is important, and the difference between the names is the crux of everything. In a predominantly text world, your name is everything.
**Bad Feelings**
This is where it gets weird. As you all know, I’m a huge supporter of forking. [But sometimes when you fork, you’re a dick](https://halfelf.org/2011/morality-of-forking/). There are a lot of weird things to consider when you fork, and for me, the first one is ‘Is the plugin I’m forking something you pay for?’ Generally speaking, if I’m even *considering* forking a for-pay plugin, I’ll try to start up a dialogue with the developers first, because I know that these people are trying to make a living, and I’m a dick if I take that away from them. Yes, GPL says I *can* do it anyway, but there’s the law and then there’s the *community*.
A lot of the time we tout the ‘spirt’ of GPL and I really hate that. We’re actually touting the cohesiveness of the community. That we know plugins are often free, but pay for support, or behind a pay wall, or a million other things. But. If you take away someone’s ability to make a living, **you are a raging dick**.
Strong words, but ones I firmly believe in. It’s no secret I’m not fond of the IncSub folks and their behind-a-paywall/yearly fee for plugins. My issue isn’t their code, however, or their prices, but their attitude. And while I don’t like them, I will support till my dying day their right to do it. And if someone logs in to their site, gets an account, downloads everything and then puts it up on their own site, well, I’ll support IncSub in kicking them while they’re down, because it’s just not nice.([This actually happened in November 2011.](http://wordpress.org/support/topic/where-to-turn-too?replies=5))
As Jane Wells put it:
> The GPL does allow for redistribution of GPL code. You can even charge for it if you like. However, here at WordPress.org that sort of behavior is not encouraged or supported in our repo. If you redistribute, we expect to see modifications not available in the original. We show respect for the authors of GPL code by only promoting redistributions that are useful as new contributions through helpful modifications.
Which is why, when I forked the plugins I did, I made clear changes. Works on SSL now! Works on Multisite! And none were pay-for.
But what does ‘being nice’ have to do with this?
**It Pays to Be Nice**
WordPress’s strength is their community. It’s the people who dream and invent, and the GPL has given those people tremendous amounts of freedom to be creative and expressive. Where WordPress runs into problem is personality conflicts and clashes (even the smartest people can be assholes). And where you will see the most of those conflicts and clashes is when it comes to GPL and who has the ‘right’ to do whatever. (Second only to GPL is SEO.) Once you incur the ire of a community, your ‘cred’ drops amazingly. That’s why so many of us are accused of ‘drinking the Kool-Aid’ when we tout the GPL party line.
A quote in my comment ‘guidelines’ is from Lord Buckley, “If you know what to do and you don’t do it, there you bloody well are, aren’t you?” We all know the right things to do are to be good people. To respect each other and treat our fellow man with kindness. I don’t care what religion you are, or even if you worship the FSM. The only way we all get through this thing called life is to be decent people. Taking away someone’s source of income is rarely nice, and when you do it and say ‘I did this because it’s GPL and I can!’ then you’ve done it for the wrong reasons. Just because you can do something doesn’t mean you should. We all learned that as children, that just because I can throw a rock at Timmy’s head doesn’t mean I should.
**Theft**
When we get to college, many of us experiment, for the first time, with being able to walk away from things we don’t want to do, even though we should (like your classes). And many times, these young adult challenges, where we do the wrong thing, come with no serious repercussions, and we determine that it’s okay to break some rules. This curious attitude follows us into adult life. It’s okay to steal cable/music/movies because the companies that provide them make a lot of money, and the artist never sees it anyway, so we’re not hurting the people who really matter.
Taking someone’s product that is for sale, making a change and giving it away, is perfectly acceptable in the GPL. But that doesn’t make it right. That makes it legalized theft, and it will hurt your standing in the community. And that’s what people mean by the ‘spirit’ of GPL. You and me and everyone else who writes code or contributes are the *spirit* of GPL. And when you hurt one of us, you hurt us all.
Go ahead and fork plugins, it’s what makes WordPress, and any GPL product great. But when you fork, do it for the right reasons, and remember that the developer you’re forking from is a person too.
Treat them how you’d like to be treated.
**Categories:** How It Is
**Tags:** coding, copyright, essay, freedom, license, open source
---
### [How To Submit a WordPress Plugin](https://halfelf.org/2012/submitting-wp-plugins/)
**Published:** May 7, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A non-technical how to get your plugin in the WordPress repository.
**Content:**
I’m not a super-psycho coder. But between being a busybody and being a volunteer plugin referee, I do spend a disproportionate amount of time looking at the code people put in for plugins, which means I actually see a lot more code, and a lot more submissions, than you might expect. This puts me in a place where I actually can offer some of the world’s most basic advice ever, that a surprising number of people seem to miss, about how to submit your plugins, what will get them downcheked, and what you really just shouldn’t do.
This list is not all encompassing, but touches on the issues I see the most often.
## What You *Must* Do
Failing to do the following will likely end up in your plugin being yanked (or not approved at all).
### Read The Guidelines
We are not pirates. These are not wishy-washy rules, though they are intentionally kept as light as possible. You see, the more you make a rule “You can’t do this!” then the more you get “Well, you said I couldn’t dig to China, not Australia!”(That’s a true story on my part. I once got my kindergarten school class to dig to China. After being told not to, I got them to dig to Australia. At this point, they said ‘No digging tunnels at school.’ My parents explained in more detail why this was dangerous, and we watched *The Great Escape* to understand tunnel collapse. I forget how Dad explained the distance, but I remember a long explanation about the earth’s core being molten, and no, you can’t dig under the ocean. I was bummed. I was also 4.) The basic guidelines are on the front page of the [Developer Center](http://wordpress.org/extend/plugins/about/), but it’s the [expanded guidelines](http://wordpress.org/extend/plugins/about/guidelines/) you really need to read. I helped write those guidelines (over beery emails with Otto) and he and I both hate that we have to spell certain things out, but apparently they’re unclear. Just read them. If you think you’re doing something that might be on the far side of okay, ask around. Tweet, post in the forums, or find a plugin dev you respect and ask them directly.
### Check Licences
All plugins must be GPL2 (or later) compatible. This is pretty basic, but a lot of people don’t realize what that means. First, there’s the issue of [GPL2 versus GPL3](https://halfelf.org/2012/gpl-oh-dear-god/). While the WordPress repository accepts GPL3 plugins, it’s still not compatible with everything, so make sure the code you fold into the plugin will work with which ever license you chose. If you don’t want to use GPL, you don’t have to! Remember, there are a lot of [GPL Compatible Licences](http://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses). At the same time, there are a lot of [incompatible licences](http://www.gnu.org/licenses/license-list.html#GPLIncompatibleLicenses) as well. And there are the [Non-free Software licenses](http://www.gnu.org/licenses/license-list.html#NonFreeSoftwareLicenses). When you’re only releasing your own code, this is pretty easy. You pick a compatible license and move on. When you’re incorporating other people’s code, however you have to study their license carefully.
Generally I’ve seen people get dinged for using the Creative Commons license, and in most cases this is because they’re not using the [CC0 license](http://www.gnu.org/licenses/license-list.html#CC0). That is the *only* CC license that really works with GPL (except for CC BY ND). Your code really shouldn’t be CC licensed, anyway, though. Just don’t use it.
### Provide the code
When you submit your plugin, put in a link to the code so it can be downloaded and checked. (See [Expanded Guidelines, Rule #16](http://wordpress.org/extend/plugins/about/guidelines/)) If, for some reason, you can’t because the code is behind a paywall, or you don’t want it in the wild, don’t worry! The only people who see that link are the plugin review team, and they’re trustworthy. They don’t need an API key, either, they just want to make sure you’re not breaking the repo guidelines. If you don’t provide a link to the code, you don’t get in. It’s really that simple.
### Don’t break the other WP rules
Did you know you can’t use ‘wordpress’ in your domain name without permission? If your author or plugin URL is http://mycoolwordpressplugins.com then your plugin will be rejected. (See [Expanded Guidelines, Rule #17](http://wordpress.org/extend/plugins/about/guidelines/)) In addition, you’re still going to be held subject to the forum rules with your account. I mention this because if you get blocked on the forums for rampant asshattery, you won’t be able to check new code in. Basically remember that it’s the internet, and we can see your behavior on Twitter, Forums, Faceybooky, etc. Don’t be an idiot.
## What You *Should* Do
Not doing the following won’t get you punted from the repo, but they’re still good to do, in order to provide the best support possible.
### Write a good readme
A good readme file is going to tell the person everything they need to know before they download the plugin. This means:
1. Describe what the plugin does
2. Explicitly state any and all requirements
3. Be upfront about any external accounts required (for APIs or what have you)
4. Inform users if their information is being sent to another site, where, and why (not necessarily technical explanations, just ‘Your IP, browser specs, etc will be sent to Google for Analytics purposes. This is required if you want to use Google Analytics.’)
5. Include screenshots of the options
6. Include a screenshot of what the plugin looks like on the unmodified default theme
7. Document if no support is provided (or if support is handled somewhere other than the WordPress forums)
#### Credit Appropriately
A subset of that is that if your plugin is a fork of someone else’s, be the good person and credit them! It’s not required all the time, but take a look at the copyright information on a plugin. Sometimes they say they require credit in the code. If so, you’ve got to do it. Even just a line that says “Copyright 2009-2011 Some Other Dude” and then “Copyright 2011 Me” below it. That’s a nice CYA. If you want to be really nice, put their userID under ‘contributors’ in the readme file, and they’ll have their pretty face on your plugin.
### Write Good Code
Using good code is complicated. I don’t pretend to be the best at it myself (seriously, the level of shenanigans I went through over nonces cannot be measured on a human scale). But I know that good code is secure code. I know I should use [nonces](http://codex.wordpress.org/WordPress_Nonces) in certain situations, I know to [protect against SQL injections](http://codex.wordpress.org/Class_Reference/wpdb#Protect_Queries_Against_SQL_Injection_Attacks), and I know to not let total strangers upload executable files (so they can’t upload a PHP file that wipes my DB, for example). And I know when to go find Otto, WePay him a beer, and say “So what the hell did I do wrong, here?”
Writing good code is exceptionally complicated, which is why, if you’re going to write a large plugin, you need to know what you’re getting into. The problem a lot of people get into is the classic ‘Your eyes are bigger than your stomach.’ When you write a plugin, keep it simple. Start with the code you know, slowly fold in the new stuff. Try to test as many different ways as you can think of, but know that you’re going to miss something.
## What To Do If Your Plugin Is Yanked?
Every plugin developer’s worst nightmare is waking up to find that their plugin was yanked from the WordPress repository.
Don’t panic!
 This happens when your plugin has been reported as possibly being in conflict with the developer guidelines, or it has a security hole. Many times you will *not* be notified when this happens. Sometimes you’re not notified because the report is found to be incorrect, and sometimes it’s because you’ve been warned before. And, once in a while, it’s because the person who closed your plugin doesn’t have the ability to email you. Surprise! There are some people on the plugin repository team who don’t have the access to the plugins email system, so when they close your plugin, they’ll ask someone else to email you. If that person is busy, it might take a while.
When a plugin is closed, the rest of your plugins are usually checked over to make sure they’re not also having an issue. For example, if you have one plugin with a front facing link that’s turned on by default, all your plugins will be checked for that and, if they all have the same problem, they will *all* be yanked. This is why you need to keep up to date on the plugin guidelines, and follow the [WordPress Development Blog](http://wpdevel.wordpress.com/).
As soon as you find out your plugin is closed, email plugins@wordpress.org and ask what you can do to restore it. Posting in the forums won’t help much.
**Categories:** How To
**Tags:** copyright, design, essay, license, open source, wordpress
---
### [The Responsibility of Freedom](https://halfelf.org/2014/the-responsibility-of-freedom/)
**Published:** March 12, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** With great freedom comes some very odd responsibilities when it comes to reselling products.
**Content:**
I’m sure you know there are clubs out there that re-sell WordPress products at a far lower cost than their original source. This post is not about that being right or wrong via the GPL, nor is it about the morality.
This post is about *responsibility*.
In my home office hangs a poster “Flynn Lives” which I have to constantly remind me “I fight for the users.” It’s a nerd level joke most of my fellow developers and support gurus get, but many people I help would not understand the point. My job, as a WordPress Support Guru, is to help people. This is simple, straightforward, and obvious.
My other job, though, is to make their lives easier and better. It’s my responsibility, when I write code, to make it do something to make someone’s life easier. Even if the only person it helps is me, the point is that someone is being helped. If it’s just me, it’s really easy to support myself. “Hey, Ipstenu, you know this broke?” “Yeah, added to my list!” But when it’s someone else, how does that change?
I firmly believe there’s an expectation of support with all plugins and themes hosted in the WordPress.org repository. Period. That means, yes, I have code I don’t put up there because I don’t care to support it. But I know that expectation puts responsibility on me as more than just “Someone who writes code.” I can’t just write code, drop it into the world, and never support it.
“But Ipstenu,” I hear you say. “Isn’t that what WordPress.org does? It just dumps WP into the world. I never see the devs in the forums!”
You’re not WordPress.org. You’re not that big, that complex, and that intricate. Unless you’re BuddyPress-levels of plugins, and you’ll notice they have support forums. Instead of directly supporting WP, the core devs of WordPress who are dedicated to WordPress have people like me, who traipse about the forums and help. And when I see broken things, I either take it to trac or help the person who found it do so. My determining line is “Can I fix it? Okay, I’ll trac it and patch it.” If I can’t, I help them. Low hanging fruit.
The point here is that all this wonderful software came with a responsibility to make it great and help people. What does this have to do with sites like those Justice League Clubs that offer cheap/free versions of pay-wall’d software? They’re not helping you.
Oh, in the short term they’re helping you by giving you something for free. They’re getting you further in your site development than ever before. However that help ends at the provisioning level, because you aren’t paying for support from these resellers, you’re paying for product. That’s okay, so long as you know what you’re paying for, and a lot of people don’t. If people did know what they were paying for, they wouldn’t use nulled themes with base64 backdoors in them.
The ethics and morals of reselling someone else’s work aren’t at play here. Yours are yours, mine are mine, and that’s just fine. What is at play is what are we paying for, what are we providing, and what are we devaluing when we resell someone else’s product?
Devaluing is the easier one. People sell products at cost in order to make money. It’s simple. I work for a company that sells space on a computer and world wide availability from anyone to that space. We sell it at a price that allows us to make money, but also that allows us to hire amazing people like me who work on WordPress, write some of the code, test it, and otherwise spend all this time on WordPress, *just because* it’s software you use!
The value of the product is, again, not just in the product, but in the service. And the service is more than just access and accessibility, but also in the support you get. No matter what people think, we aren’t just rolling around in money and laughing at you. We reinvest that money in ourselves, our hardware, the software (some of which we give to you). But what we *always* do is support that. Sometimes the support isn’t what you want to hear, but we do our best to solve problems, or explain why we can’t.
So what are you paying for? Support! In the end, you’re pretty much always paying for support. You buy Microsoft Office and you don’t get the kind of support you get with WordPress, but you pay a lot more money. Where’s the support? When Word crashes, it sends (or asks you if it can send) a report back. That report gets noticed and acted on so that if it’s solvable, it’s solved. The next upgrade you get has a patch, and that crash doesn’t happen again. That’s support!
You can also get [actual support](https://office.microsoft.com/en-us/support/) from Microsoft (though I know of no one who’s done so). They have people who write fantastic help docs and who monitor their forums and twitter. If you took Word (let’s pretend that was legal) and resold it, would you have all that?
But that’s a quite extreme example. WordPress plugins are significantly smaller in scale than MS Office. So why is Office (and Adobe Photoshop etc) so expensive if they don’t give you half the help that the free WordPress product does? There are a lot of reasons. Patents and copyright are expensive, and frankly we’re all willing to pay for it. When Apple dropped the price of the new OS down from hundreds to $25, we were all suspicious. When it became free, we flipped out.
But Apple wisely noted that making us pay that much money wasn’t helping them as much as it might. Free gives you a certain brand loyalty because we get to try before we buy. And we *will* buy those apps and those app add-ons (though I don’t fully approve of games that force you to pay to play all the time). We buy them because after we get the base product for free, we see the real value in the cost of the other products and we’ll pay for them willingly. Apple takes responsibility for their free software in interesting ways. We have to pay for assistance (most of us via the Genius Bar). And in the WordPress ecosystem, that too is what you pay for. The help.
So back to this whole “I’ll take your paid software and give it away” thing.
What are we paying for? I’ve heard tell that ‘Paying for support’ is a rip off. So is paying for documentation. I can see why some people balk at paying $25 a year for ‘support’ they may not ever need, and I’ve seen some companies work by letting you pay per-ticket. Though that makes people feel like you’re nickel-and-diming them, and I do agree it can come across that way. And yet that support which they so casually toss aside like an old shoe is where these free-software-clubs fall down.
There is one club that says they will support all the plugins they re-host. Many of us are suspect at the possibility of that actually working well, though given the odds of how small their sales will be to start with, it may end up sustainable. The problem is that they’re not going to be patching upstream. They’ll fix your issue, and then when the real source pushes the next version, they get to reapply their patches. Strikes me as a lot of work.
Is the payment system for some WordPress plugins and themes broken? I don’t think so. I think it’s not optimal for the user nor for the developers just yet, but monetizing these things is still relatively young. There will be mistakes and bad choices along the way. Finding the balance between the freedom of the GPL and the desire to make a living is difficult.
The ultimate responsibility we have with WordPress is to give back. We give back with support and with improving things for everyone. If we’re just doing things for ourselves, after all, we don’t share them. Are these clubs failing in those responsibilities? Not yet. But all eyes will be on them if they do.
**Categories:** How It Is
**Tags:** coding, copyright, essay, license, open source, wordpress
---
### [It's Not GPL and That's Okay](https://halfelf.org/2014/its-not-gpl-and-thats-okay/)
**Published:** October 13, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** The patchwork elephant of websites means that there isn't one answer for everything.
**Content:**
I’m probably starting a wildstorm here, but I want to put this out there. I don’t always use 100% GPL products on my sites, and that’s okay.
Please put down your pitchforks!
I am a happy Open Source person. If you give me a choice between two equally good products, one being Open Source and the other not, I’ll pick Open Source any day of the week. But. There’s a reason I use Apple Pages and not Open Office. Pages *works* for me. It fits my workflow, it fits my brain, and it makes me write more easily. Since I’m often sprawled on the couch writing with my thumbs on my iPad Mini, it makes perfect sense to use Pages and iCloud.
But there’s another place I don’t worry too much about GPL or Open Source, and that’s when I’m coding something that is only ever going to be for me.
I was working on a new site and we were looking for icons to properly represent how we felt. We needed a toaster. We didn’t have one in Font Awesome or Genericons, so I pulled up [Symbolicons](http://symbolicons.com/)! The catch? It’s not GPL. But the thing was, we knew we’d never be distributing these icons. It was for one website, so why did it matter?
And the fact is that for this use case, it did not matter at all!
[](https://halfelf.org/wp-content/uploads/sites/2/2014/10/file2021235840650.jpg)
Understanding what I’m doing, who it’s for, and where it’s going to be used is highly important. And understanding what I want to support and maintain is equally important. For the most part, open source doesn’t come with Apple Care or companies like OWC who specialize in bailing people out or helping them extend things. WordPress doesn’t come with that, for good or not, it’s really a ‘figure it out as you go’ sort of product.
There are use cases to consider. Who’s going to use the computer? What do they know? Is it worth teaching them Linux or can they keep using their Mac? Much like I do when I’m mentoring someone, I don’t try to push my ideals on someone, or assume my way and my solution is the only solution. When I look at GPL, yes, it’s my default. I always start there. But I don’t stop there and I don’t let it blind me to what things need to be, because the best solution may not be open source, it may not be GPL, and it may not be WordPress.
So long as you’re not violating a license, use what suits your needs. But do pay attention to those licenses.
**Categories:** How It Is
**Tags:** administration, copyright, essay, freedom, license
---
### [Great Walls of Fire](https://halfelf.org/2014/great-walls-of-fire/)
**Published:** March 7, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** When speed causes a slowdown, you may be offloading your site into inaccessibility.
**Content:**
If your website is ‘international’, you’ve probably already run into this. If you’ve ever worked for cooperate America, you’ve seen this happen. If you’re on an out of date browser, you’ve definitely seen it.
It’s that horrible day when your site looks like absolute crap because something critical to your site isn’t loading because it cannot be accessed from where you are.
Let’s step back.
Using Google’s Open Sans doesn’t work in China because Google is, generally speaking, blocked in China. What does this mean for people there? Well their WordPress dashboard is going to load slowly, in fact for many it’s so slow as to be unusable. This is because WP 3.8 uses Google fonts on the back-end. Now, you can disable it with the [Disable Google Fonts](http://wordpress.org/plugins/disable-google-fonts/) plugin, but many people feel that’s a poor user experience.
I want to take a moment to note that while I, personally, dislike using Google for required fonts on WordPress, there was a discussion on bundling vs linking that took place in November 2013. At that time, everyone agreed bundling (that is including the fonts with WP) would be best, however *how* to do that was more complicated. In order to provide a good experience for all users and all languages, it got messy and large really fast. You can read up on the history on make/core: [Open Sans, bundling vs. linking](https://make.wordpress.org/core/2013/11/11/open-sans-bundling-vs-linking/).
That being said, by remotely calling Google, there are two main issues: privacy (which I’m not getting into) and accessibility (that’s what I want to poke at).
We know that calling Google remotely, for everyone in a country with good internet speeds, is great as it speeds up your site! That’s the premise behind [Use Google Libraries](http://wordpress.org/plugins/use-google-libraries/) after all. If someone’s already downloaded the files in their cache for JS (or fonts), then the next site they visit will load faster if it uses the same ones! It’s a sound, and accurate, theory.
But are you making your site inaccessible with your need for speed?
What happens when someone *can’t* load Google? In the case of the Use Google Libraries plugin, it falls back to using WP’s standard, which is good, but that initially connection has to fail first! The same happens for WordPress’s back end, which means the time it takes to load your site is *longer* for those users.
I tell this to people a lot, and generally they reply “Well I don’t have users in China.” or “This doesn’t affect my visitors.” Really? *REALLY?* Sorry, but that is one of the most shortsighted views I’ve ever heard in the history of ever, and one I tell people “Yeah, that’s an incorrect and rather arrogant conceit.”
Let me tell you a story. I went to Japan for 12 days to hike O’Henro with my Buddhist brother and our agnostic father. We made the “A Jew, a Buddhist, and an Agnostic walk into a temple…” jokes. While there, I checked in on my websites and on my regular sites I visited, only to find out that some were blocked because we were using a net connection that went through a country those sites blocked. Why? Because “no one” who would ever visit their site was from there.
I no longer use those services, I no longer support those sites. My father goes to China regularly (he does risk assessment on the disused weapons caches in China). I turn off Google Fonts on his website in order that he, and his customers, can see the site as intended. You can tell me all you want that ‘no one’ visits from those places, and you’re just wrong, and arrogant, and yes, I strongly disagree with WordPress having made Open Sans via Google a requirement like that.
My personal dislike of Google aside, it’s a reality I look at more than I wish I had to that people and places *block* third parties. This is why I get on the case of plugin developers who use third-party services when they don’t have to. They’ve created an unnecessary dependency on this other service, which will crazy to debug when someone says their code doesn’t work.
Your code should be as self-sufficient as humanly possible. Offloading for ‘speed’ doesn’t work for all situations, and instead can make things slower by causing more external resources to load. Have you ever looked at those scan reports where they say your site calls too many sites for JS or CSS? This is what you’re doing. Even though it increases the odds that people who can get to these sources will already have the files cached, people who can never access them have a worse time. And then loading them locally will make your site heavier and load slower, unless you use proxy-caching (like Pagespeed or Varnish).
It’s not a perfect solution for everyone. This is why websites are hard.
**Categories:** How It Is
**Tags:** accessibility, google, wordpress
---
### [Mountain Lion and SVN](https://halfelf.org/2012/mountain-lion-and-svn/)
**Published:** July 27, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Real fast, if you're having SVN problems with Mountain Lion, and have an 'old' version of SVN, read this.
**Content:**
Caveat: You need [root access](http://support.apple.com/kb/ht1528) on your Mac to do this!
Ages and ages ago, when I first was using MAMP and all that fun stuff, Apple didn’t include a version of SVN. I had installed, and promptly forgotten about, my 1.4.4 install sitting out there. Now, I know I upgraded it to 1.6.something at some point, but I only found out that was wiped out when I went to svn up some code on my site and it all died. My version of SVN was too old.
`svn --version` was coming back as 1.4.4 and I knew that was wrong. I complained on Twitter, and Eric Hitter pointed out that Xcode has SVN (and Git) so I went and installed that. It didn’t work, I was still stuck on 1.4.4.
After checking that, indeed, svn was located at `/Applications/Xcode.app/Contents/Developer/usr/bin/svn`, and that ran the right version, I deleted 1.4.4 manually by removing the following folders:
```
/opt/subversion
/usr/local/bin/svn*
/Library/Receipts/Subversion*
```
Then I made a fast alias `ln -s /Applications/Xcode.app/Contents/Developer/usr/bin/svn svn` over in `/usr/local/bin/` to redirect my scripts, and finally I followed the directions from [Panic](https://panic.com/coda/support.html) to fix Coda, and changed the Subversion tool path setting in the Files pane of Coda’s Preferences to `/Applications/Xcode.app/Contents/Developer/usr/bin/svn`. I also changed git to `/Applications/Xcode.app/Contents/Developer/usr/bin/git` and made a fast link for that too, since I can.
Have a happy weekend!
**Categories:** How To
**Tags:** coding, macintosh, svn
---
### [Capital H Dangit](https://halfelf.org/2012/capital-h-dangit/)
**Published:** August 16, 2012
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Stealing capital P to save myself a little embarrassment.
**Content:**
My new gig at DreamHost comes with a minor ‘d’oh!’ and that is it’s a capital H. Which I seem to be incapable of remembering. So I wrote a function. I stole capital\_P\_dangit() and swapped the WordPress for DreamHost. To save myself from embarrassment, here it is:
Now. Here’s where it gets fun. No ‘hacks’ posts will be affected by this code! Otherwise how would I show it to you here? Normally this is where you would just run `remove_filter( 'the_content', 'capital_H_dangit', 11 );` in the functions file for your theme. Due to the way I’ve wrapped my various functions into mu-plugins, the down and dirty way was to wrap the above block of code with a check for `if ( $blog_id != 2 ) { { ... }`.
Most of the time you won’t care about things like this. I just needed it so I could demonstrate code. I’ve done the normal filter remove here so I can also say ‘Wordpress’ in my code related posts. For proof this works, I assure you, 100%, that [I typed in ‘Dreamhost’ over in my post about quitting my job and going to work for them](https://ipstenu.org/2012/wp-quit-bank/).
Sorry about that, Simon!
**Categories:** How To
**Tags:** coding, function, wordpress
---
### [Version Control](https://halfelf.org/2013/version-control/)
**Published:** January 8, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Using version control correctly isn't that hard, but when you do it wrong, it's painful for everyone.
**Content:**
[](https://halfelf.org/wp-content/uploads/sites/2/2012/12/mind_control_4.jpeg)I’ve noticed a lot of people don’t really ‘get’ what version control is, or how it works. This is most evident when you watch the WP plugin repository.
Around 400 commits are made daily to the repository, which doesn’t seem like a lot until you compare it to [core trac commits](http://core.trac.wordpress.org/timeline). Now WordPress Core never commits until they’re sure the version in trunk is functional (since many of us use trunk on live sites), something most devs don’t have to worry about unless they use trunk as ‘live’… Let’s not talk about that.
Instead of going into code today, I’m going to explain a little theory and talk about what version control is, why you want to use it, and *how* to use it.
If you’ve ever saved a document, had MS Word crash, and come back to be asked what version of the document you want to restore, then you actually already have an idea of what version control is. You’ve possibly just never had to do it yourself. Version control is a very simple concept: saving versions of a file so you can go back to the older ones. Sounds easy right? Yes and no. Most people are accustomed to a different way of saving.
Traditionally, we’re taught about saving as something you do regularly and often. After all, we’ve all lost that crucial document by forgetting to save. Apple has been changing this on us, having a much more robust auto-save process, and a better restore. It coaxes you into a place where you don’t think about saving anymore. There’s no save button on my iPad, and I actually use it to write a lot of the time. That freaks me out still, but so far it’s worked really well.
In contrast, I have my coding. I sit and write, save a lot, test a lot, and when I’ve got a change that works, I commit my code. You see, version control is like a second type of saving. One save is me working, and one save is me ready for someone else to test. But the best thing about version control is *how* it saves changes. You check in code, and SVN (or Git), and the server checks the changes and records what changed in a way that is easy to read. Here’s an example picked at random from the hundreds I skimmed today:
[](https://halfelf.org/wp-content/uploads/sites/2/2012/12/thediff.png)KatePhiz’s checkin of changed codeSee how beautiful that is? Right away you can see what changed between versions! You, and anyone else who wants to troll a revision log, can see what you changed, which makes it easier for people to write a change log for you (if you happen to work that way).
Where I see the most people making mistakes with version control is missing out on the two rules you need to adhere to, if you want to use them effectively.
1. Never Delete Files
2. Trust The Tool
That’s it. That’s all you have to do. I see a lot of people correct files by deleting them and uploading new versions. This is flat out doing it wrong, but I can see why people think it’s what they should do. You have to trust your tool, and know that it will see the new file, tell the differences and record that. If you delete a file, it stops you from being able to compare it to earlier versions and that’s a problem. Bug tracking becomes much harder, as you no longer have a quick and easy way to see what changed. Sure you can compare two files, but you’ve now put up a barrier for the next guy who picks up your code. What if she *doesn’t* have that previous version? What if she has no way to get to it, and you were hit by a bus and are in a coma? Or not. But still, building barriers between yourself and the next person is lacking foresight. Worse, you build barriers for yourself.
It’s hard to trust the tool, and just as it took me months to get used to the iPad’s way of saving files, you have to get used to how version control saves things. This isn’t FTP where you’re always replacing a whole file, you’re making incremental changes. A check in is not a delete and replace (unless you’re using some of the horrific tools I’ve had the dubious pleasure of using in the past). Getting past that one hurdle will make your life much better with any tool you use.
As for never deleting, I come to this from working at a bank. We never deleted anything. Ever. Not once. You always keep all versions of your code, even the broken stuff, because legally you had to. But in the end, I feel that was a great practice to get into. Disk space is cheap and you won’t ‘run out’ of space any time soon. I keep a copy of every plugin’s latest version on my hard drive, and I’m not out of space.(I don’t have SVN checkouts, that would be a little much.) Also there’s no point to deleting your older code, since they’ll just show up in SVN anyway. It remembers everything you checked in. Ever.
Now, I cannot give you advice on the best way to tag or branch code, as each person comes up with their own methodology. I will say this: Don’t use ‘trunk’ as your stable releases on SVN. Git’s a little different, but I wouldn’t use it there either. Instead, use trunk as your playground. When you have a functional change, commit that minor change. When you have a major change and it’s ready to go, tag it and release it. In that way, your beta testers can safely use trunk, and your normal users never get hurt. By the way, making frequent commits may feel like a smart move, but you don’t need to. Check in a working copy. Oh and don’t go back and edit your tagged versions, unless it’s a very minor change. Someone is sure to have downloaded it, just tag a new version and go forward. As I always explained to people at the bank “You don’t go backwards with code, you go forward.”
I don’t expect this to be a perfect primer on how to use version control, nor was it meant to be, but I hope I demystified it a little. If you have great primers for people on SVN or GIT, aimed at first time users, please share them!
**Categories:** How It Is, How It Works
**Tags:** coding, svn
---
### [World Time Event Shortcode](https://halfelf.org/2013/world-time-event-shortcode/)
**Published:** May 5, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Embed a time-zone friendly event notice in your blog posts? Why not!
**Content:**
I had a need. A need for timezones. I happened to post about an event happening at 2pm ET, under the mistaken assumption that people knew how to convert timezones, or at least go to a website for it. Instead, after a weekend full of emails and me snapping at them for being under educated (don’t schools teach this stuff anymore?) I linked them to a page.
Then I thought “Well heck, they won’t click that. Why not embed it.” Alas, TimeAndDate.com didn’t let you embed, but worldtimebuddy.com does. With a hat tip to Rarst for the link, I pulled this shortcode out:
I can’t make this a plugin because it has a powered-by link, and while I *could* remove it, I won’t. If the link was put in by the script itself and not my return, it’d be fine for the repo, but since I’m only going to use this a few times, I’m leaving it be.
**Categories:** How To
**Tags:** coding, shortcode, wordpress
---
### [DreamHost Logo ala CSS](https://halfelf.org/2013/dreamhost-logo-ala-css/)
**Published:** May 7, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Making a logo with CSS is pretty fun and cool. Props to Clee, my coworker.
**Content:**
This was done by Clee, my coworker. I tweaked it, prefacing things with `dh` to make it more portable and then slapping it into a shortcode so I could embed it here:
The code is as follows (you can see his original code at [codepen](http://codepen.io/anon/pen/bmprK)):
Now actually that’s not CSS, it’s LESS, which I can’t inline apparently (or maybe I just don’t know how). Either way, it’s a funky cool CSS trick!
**Categories:** How To
**Tags:** coding, css, shortcode, wordpress
---
### [Shortcode: MLB.TV](https://halfelf.org/2013/shortcode-mlb-tv/)
**Published:** June 23, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A quick shortcode to show MLB.TV videos.
**Content:**
I like baseball, I like the Indians. I like embedding content. Why MLB.tv likes to make their stuff not easily embeddable is beyond me. I think `[mlbtv id=28142247]` is way easier to deal with if I’m using the visual editor. I grabbed the default sizes from their settings.
\[mlbtv id=28142247\]
Looks just fine.
**Categories:** How To
**Tags:** coding, shortcode, wordpress
---
### [Don't Fear The Auto Update](https://halfelf.org/2013/dont-fear-the-auto-update/)
**Published:** October 28, 2013
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** WordPress Auto-Updates are not terrible, they're not evil, and this comes from a woman with tinfoil in her hats. They're okay by me.
**Content:**
I was not surprised to see the backlash to Auto Updates. We spent a lot of time trying to figure out how to explain to people that while you can disable it, we really, really, really, really, don’t want you to, and basically ended up with a Codex page that explained how to configure it and then Nacin’s followup post that is, indeed, [the definitive guide to disabling updates](http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7). But people hate it or love it, and there’s no middle ground. This was, as I implied, somewhat expected.
[](https://halfelf.org/wp-content/uploads/sites/2/2013/10/3445973356_2f8510869b.jpg)Reasons why people hate it have varied from “I want to control my own updates!” to “This 3.7 upgrade broke something, so clearly you’re not ready!” Oh and don’t forget “You suck, I hate this! Why would you default this to on!?”
I want to stress one really important thing here. The automatic background updates for WordPress are for *minor updates only*. We’re not talking about auto-upgrading people from 3.7 to 3.8, but just 3.7 to 3.7.1 – These are small, minor, updates. When someone comes to me and complains that major releases don’t always work, I have actually said, “So? We’re not talking about major releases.” And of course, “You *are* making good backups on these super important websites, right? Right?”
It’s really easy to get bogged down with all the variable permutations about what updates could include and forget that WordPress started out simple. Yes, it’s defaulted to “on” because after intensive testing, and careful thought, WordPress core devs are pretty darn sure that these minor updates, which are more often than not security related, will not break a site. I’ll get back to breaking sites in a second. The point is that minor updates were picked specifically because it’s known that major upgrades can often break things.
Why is it defaulted to on? This is my reasoning here… Because the people who wouldn’t turn it on are the people who need it most. If they don’t know it can be turned on, they won’t do it. And they need it. The people who don’t read all the nerdy things are the ones who are still running WordPress 3.4 (no I’m not kidding). I spend a lot of time debugging WP without ever seeing or really ever looking at their site. I know a lot of users don’t upgrade because of laziness, or fear, so I want to address this (see? told you I’d get back to breaking sites).
### Don’t fear updates
I said this on Twitter: If your site breaks every time you update WordPress, it’s time for a theme and plugin audit.
So what’s an audit? How does one audit?
It’s really simple. I have a longer presentation I give on this, but let’s go over how simple and basic this is.
**Who is the author?**
This is really obvious. With one exception, every plugin I use that’s made by core developers is updated to fix problems right away. It’s tested on versions of WordPress in the Beta stage, or even on trunk. It’s reliable because the *author* is reliable. Using a plugin by Mark Jaquith? No fear!
**How active is the author?**
Sometimes even I have no idea who that author is, so I look them up. And I want to see how active they are in WordPress. If someone is engaging on trac and writing plugins and themes, and posting about WordPress, yes, I take the time to read up on them. Remember, I’m auditing the plugin! So I want to see that this author is active and writes or contributes in a way that I approve of. That helps me trust them. Now I’m not expecting them to code as prolifically as Nacin, or write as frequently as Chris Lema, or even scour trac like Scribu. I have realistic expectations. One of my favorite developers is ‘try-lingual’ when it comes to CMSs, so I’ll check on her to see if she’s able to keep up with all the myriad CMSs her code works on. She knows about every release coming up? No fear!
**How popular is it?**
The more a plugin is used, the more people are banging on it in a diverse myriad of environments in ways the author probably never imagined. This is good. This means that the odds are higher than normal that the plugin will work on a bog-standard setup. It also means if I have a common server type (shared) it will probably work. The odds also go up for a more active volunteer environment. Popular plugin, used by thousands? No fear!
**How often is it updated?**
This is a careful thing. I don’t particularly worry if a plugin is old (i.e. not updated in over two years) if the plugin is simple, or made by someone very reliable. Heck, I haven’t touched the code in Impostercide in years, but I do update the readme every couple of WordPress releases to avoid people thinking it’s been abandoned. That said, I do like to see if the complicated ones are at the very least updating their readmes to say “yes, compatible up to the most recent version.” That tells me not only are they testing, but they’re aware of what’s going on in WordPress. Updates are reasonable? No fear!
**What does the code look like?**
[](https://halfelf.org/wp-content/uploads/sites/2/2013/10/william-sadler-iron-man-3-bill-and-ted.jpg)This is hard. This is really hard. I review plugins, and write them, and it’s just plain *hard* okay? If I’m lucky, I don’t actually have to do this. Examples? Okay, try [StudioPress’ Genesis Theme](http://www.shareasale.com/r.cfm?b=346200&u=728549&m=28169&urllink=&afftrack=). I don’t look at their code, unless I need to make a child theme. Even then, it’s a case of trusting them to do the best by me. I believe in their code more than mine most of the time. Another example? Anything managed by WordPress.org. But what about the rest? When it’s simple, I can read through the code, make sure it’s not doing anything nefarious and move on. When it’s not, I hire someone else to do it. You heard me. I pay people to do what I can’t *because an audit of code is important*. Now I don’t do this for every site. Personal/play sites? I may wing it, knowing I make good backups. But a big, company site? Oh you bet every single line of code was checked. Good code? No fear!
### Really? No fear?
No. Not really. You have to keep in mind that none of these are absolutes. I don’t look at just one thing and say “Done, I have no fear.” I mean, I say ‘no fear’ in these explanations, but the truth is it’s the combination of these things that makes me fear *less*. WordPress is doing a good thing here and I’m not afraid of it.
And in case you’re wondering, I’m using auto-updates on all my sites.
**Categories:** How It Works
**Tags:** coding, security, updates, wordpress
---
### [Genesis Favicons Multistyle](https://halfelf.org/2014/genesis-favicons-multistyle/)
**Published:** June 30, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** Multisite? Favicons? Genesis? Why yes, let's make them sing!
**Content:**
For the longest time I used .htaccess to shunt my favicons to the right place based on the requesting domain. This basic logic worked well, but was starting to get weird and it didn’t always work depending on if I was using pagespeed to trim out leading domains or not, and of course when I tightened security it got weirder.
Now I’ve know you can use [custom favicon in Genesis](http://my.studiopress.com/snippets/images/#custom-favicon) and that’s pretty simple. But … I have to make my life complicated. See I use Multisite *and* I don’t edit my themes. No, really, this theme? I only edited it to update it. I don’t edit them, I use custom CSS and functions to edit via hooks and filters, the way you’re supposed to.
So how do I override favicons for five sites on a Multisite? Why with an MU Plugin!
/*
Plugin Name: Favicon Replacement
Description: Replace Favicons
Version: 1.0
*/
// No, you may not have your favicon
remove_action('genesis_meta', 'genesis_load_favicon');
global $blog_id;
if ( $blog_id == 2 ) { // EXAMPLE1.COM
add_filter( 'genesis_pre_load_favicon', 'example1com_favicon_filter' );
function example1com_favicon_filter( $favicon_url ) {
return 'http://example.com/images/favicons/example1.ico';
}
} elseif ( $blog_id == 3 ) { // EXAMPLE2.ORG
add_filter( 'genesis_pre_load_favicon', 'example2com_favicon_filter' );
function example2com_favicon_filter( $favicon_url ) {
return 'http://example2.com/images/favicons/example2.ico';
}
} elseif ( $blog_id == 4 ) { // SUB.EXAMPLE.COM
add_filter( 'genesis_pre_load_favicon', 'subexample1com_store_favicon_filter' );
function subexample1com_store_favicon_filter( $favicon_url ) {
return 'http://sub.example.com/images/favicons/sub-example.ico';
}
} else { // This will fill in EXAMPLE as well
add_filter( 'genesis_pre_load_favicon', 'example_favicon_filter' );
function ipstenu_favicon_filter( $favicon_url ) {
return 'http://example.com/images/favicons/example.ico';
}
}
[/php]
To explain quickly, the code checks for site #2, shows a specific favicon, and does it for #3 and #4 before defaulting to the main site. I 'hard code' in the full URL to make sure I don't mess it up and there isn't any crazy cross site shenanigans. Obviously this will get a little long over time, and if I ever stop using Genesis for a site, I'll instead hook into
**Categories:** How To
**Tags:** coding, favicon, genesis, wordpress
---
### [All Comments By Email](https://halfelf.org/2014/all-comments-by-email/)
**Published:** August 4, 2014
**Author:** Ipstenu (Mika Epstein)
**Excerpt:** A WordPressy way to list all comments by email address from the comments page.
**Content:**
By default, when you look at the list of comments on your WP Admin dashboard, you get a list like this:
On that list, if you click on the IP address of the commenter, you go to all comments by that IP, but if you click on the *email* you get a mailto link, to let you email the person. That’s great, but as my friend, and fellow fansite runner, Liv pointed out, a lot of people post from multiple IP addresses these days, but only one email. What she wanted was for the icon that gave you the number of approved comments to link to that person’s approved comments.
Me, being the sort to poke around, decided to see if that could be done. I already knew how to filter columns and tables, after all. What I learned was that there actually isn’t a filter for those columns, and the only way around it was to replace it. This means I was going to have to rebuild everything, and in doing so, I wanted that email address to be a link to the search. While annoying, it was pretty easy:
```
50 )
$author_url_display = substr( $author_url_display, 0, 49 ) . '…';
echo "';
echo '
' . __( 'Ping List', 'pinger-list' ) . '
';
echo '
' . sprintf( __( 'There are %s unique ping locations for this site.', 'pinger-list' ), $pings_count ) . '
';
echo '