Here’s the short story:
My site got hacked. I started getting charged way too much for bandwidth overages. Customer service was bad and failed to find a solution for me. I signed up with Dreamhost and have been more than satisfied so far. It gets technical after this, but you can keep reading for the full story…

Long Story:

1. Media Temple Exploit #1026
First off, I was on a gridserver (GS), so I can’t vouch for any of their other hosting packages, so keep that in mind as you evaluate MediaTemple. Their other services might be better. This is what happened to me…

Last November my site was the victim of a major MediaTemple hack. A large number of WordPress powered sites were affected by the exploit which added code to .htaccess files as well as index files. Bad news. While nothing was permanently damaged and no data was lost, the fact that so many MediaTemple accounts could be compromised so easily really makes you question the security of their whole operation.

The other thing that was strange about the MediaTemple hack was how they handled their PR throughout the ordeal. MediaTemple has a “system status” section on their site so that anyone (customer or not) can see what issues they are working on at any given moment. This is brilliant. It says to people, “No, we aren’t perfect, but as you can see we fix things as soon as we can.” It builds trust and makes you wonder what is really happening at hosting companies that aren’t so transparent. But when the MediaTemple hack happened, the response was slow. The argument could be made that this was for security reasons. Maybe. But it really seemed like they were covering something up. I got emails informing me that they would be changing my passwords, but it took a long time to get things under control and you can see that issue #1026 has several long posts on their site outlining the whole thing.

But accidents happen, and I wasn’t going to let one incident kill a relationship that had up to this point been so stellar. So I stuck with them.

2. Slow Sites
My sites started getting sluggish and unresponsive in March. Font Burner was practically unusable taking a minute to load the homepage at times and sometimes being down completely. Then at times it would work just fine. I haven’t gotten any explanation for this, and never found anything wrong with my files that would cause such sluggishness. This may seem like an unmeasurable thing, so let me reassure you that this isn’t just a passing observation. I use tools like yslow and caching tools to make sure my sites are as fast as possible. I have worked on sites hosted through most of the major hosting companies, so I know the difference between a poorly optimized site and a slow server like GoDaddy (AKA slowdaddy). For whatever reason, MediaTemple was regularly slow. This is something that isn’t supposed to happen on a gridserver. That is the main benefit of being on the grid compared to other shared hosting options.

3. GPU Overages
It was about this same time that I started receiving my first notices of GPU overages from MediaTemple. At first it wan’t very expensive, but each month it slowly increased. Granted, my Font Burner website is a bandwidth hog that was built to support hotlinking to the fonts I host there. As more and more people use Font Burner, my bandwidth will obviously increase. I accept that. But as I researched GPU usage and optimized my site, I learned some interesting things about MediaTemple. Let me explain…

The GPU itself is a unique measurement invented by MediaTemple. Here’s a link to their GPU FAQ’s. Basically, this is a measurement of the amount of their server’s processor your site is using. Since the gridserver distributes the load of your website across a grid of machines, they chose processor usage as a way to identify the heavy users. That’s fair. If you are using more than your share of the grid, you should pay more. But the thing that is deceptive about MediaTemple’s marketing that this is strangely absent. You don’t see it mentioned in their description of the product. All you see is “100gb of storage, 1TB network traffic, 100 domains, etc.” The catch is that you will hit their GPU limits way before you ever get anywhere close to using that much storage, traffic, or total websites. So the $20/month cost is very misleading.

4. Expensive Excessive Charges
At $0.10 per GPU it doesn’t sound that expensive if you are going over your GPU limits. Trust me, it adds up. If you are 3 GPU’s per hour over your limit it will cost you $50 per week. That is what you would pay for their Dedicated Virtual server for the whole month.

So I prepared myself for the ever increasing GPU usage that I would be using by optimizing my sites. Again, I learned some interesting things about MediaTemple. The main cause of GPU usage comes from your error pages, specifically the 404 pages. These pages are hogs because they redirect you to an error page any time a url is typed wrong, of from clicks on links to pages on your site that don’t exist. The first thing MediaTemple recommends is to fix broken links or create files at the location where you get the most errors. Here is a link to their GPU tutorial.

So I went about fixing my broken links and creating files in places where I was getting excessive error pages. I had a uniques situation here because of how Font Burner is setup. If you are one of the 12,000 people who have downloaded the Font Burner WordPress plugin you had to manually enter the name of the font you want to use into a box in your WordPress admin. If you make a mistake (capitalizing the name for example) this will create a link on every page of your site to a file that doesn’t exist on my site. It’s inevitable, and there isn’t much I can do about it. It happened on a dozen fonts or so, so I simply created fonts at those locations and with those names. Problem solved. Actually, no. Not at all. Read on.

5. Disappointing Customer Service
I fixed many links and dramatically corrected the errors found in the GPU tool that MediaTemple provides. This had almost no impact on my total GPU usage. I was very surprised by this, so I called them. Up until this call I have only talked to competent helpful people at WordPress. This call was different. The guy reassured me that if I had fixed the 404 errors, I should be seeing a drop in GPU usage. I took his word for it and gave it some time to see if thing leveled off. They didn’t. So I called again and got the same answer. This person even told me that he saw a dip in my usage. It wasn’t until I got off the phone that I realized that he was looking at the current days usage. For the current day, their stats are about 12 hours behind. Since his reading was only a few hours into the new day, he thought I was below my limit. In fact I was almost at the limit just from the time in the middle of the night when my traffic is the lowest. Terrible analysis.

I commented on the support ticket. Silence. For days.

I tweeted about it and started asking people for an alternative to MediaTemple that they recommended. I was surprised to get a response from an MT worker through Twitter. They promised to look into it if I DM them my account number. So I did. Silence.

So I began the process of moving web hosts. I was looking at GatorHost, Bluehost, and Dreamhost. I decided on DreamHost because I liked how they let you move to a VPS if I needed to upgrade. I chatted with their support team on their site and was satisfied with their answers. I liked their control panel (almost as nicely designed as MT). The price was less than MT and they got lots of good praise from bloggers. Their customers are as loyal and vocal as the MediaTemple people. I found some negative reviews, too, and carefully measured the pros and cons.

I began moving my websites over and recreating databases. I was transferring files and setting things up pretty steadily for a few days. It isn’t an easy task, and not something I would have done if I could have stayed with MediaTemple. I had everything transferred over when I finally got a response on my open support ticket from MT. They said they would pass my issue over to someone else who could advise me about upgrading or something.

After my DNS switched over, I closed my account with MT once I was sure I had everything I needed from them backed up. I got a phone call from someone at MT while I was at work. I asked them to please call back because I really wanted to talk to them. The gal said, “sure,” but the phone call never came.

Happy With DreamHost
So now, I am done with MediaTemple and so far every thing is going will with DreamHost. One of the bonuses of DreamHost is that they make it really easy to host Google products like gmail, google calendar, etc. on your own domain. Loving that. I haven’t had to upgrade to a VPS yet, surprisingly. The speed of my site has been satisfactory, and I haven’t noticed any sluggishness. I hesitate to give them my full endorsement having only used them for about a month, but so far I am impressed. Perhaps, I was just a bad match for MediaTemple because of my unique Font Burner needs. If you are thinking about switching hosting companies, you can save $50 from Dreamhost if you use the promo code “adrian3″ when you sign up for a year. I will check in on this post again after I have been a DreamHost customer longer. Hope this was helpful to you!

In Search of a Truly Creative Occupation

Fine Art in Museums: Tigers in Zoos

I hope you enjoy our thoughts, and watch for me to post the next chapter in the conversation soon…

The truth is that, yes, I take my writing very personally. The writing that I admire the most is from authors who aren’t afraid to let their emotion carry over to their written words. For example…

Some authors are visionaries.
Some are great teachers.
Some are prolific creators.
Some do it with humor and logic.
Some do it with honesty.
Others are articulate.
Some are fanatics.
Some do it with insightful commentary.
Some are trendsetters.
Some are committed to excellence.
Some are consistently random but fascinating.
Some are just experts.

Is there something that all these authors have in common. If I had to guess at the source of this talent I would put my money on passion. When you are truly passionate about something it is very hard NOT to let your passion show through in your writing. The opposite is definitely not true. If you don’t care about a topic it is impossible to write a compelling essay about it.

The question that this leaves me with is whether or not the world needs another lifeless web design blog. How many CSS galleries, Photoshop tutorials, top ten lists, and free font/icon/theme blogs do we need? At what point will the pendulum swing back to the side of truly passionate discourse about design? Will there be a resurgence of critical thinking similar to the days when BADG and SpeakUp dominated the design blogosphere? I truly hope so. In the meantime, I will continue to strive toward writing passionate and personal posts.

1. Victims of Scams/Cautious Shoppers
Whenever I get ripped off, I usually use my blog as a place to vent. Several of these rants generate traffic for me because I am not the only victim in most of these cases. For example, the most popular search on my site is for “Privacy Matters Scam” which I posted over three years ago. Apparently, the fraud continues with that organization. It also looks like the Nebraska gas stations are still up to no good because people are searching for “Cost of Gas in Nebraska.”

Cautious shoppers are also finding my site as they do their homework on local companies like “Mac Shack Fort Collins.” It makes me feel good to know that my posts are more than just rants, and people are finding useful information to help them deal with bad situations.

2. Software Pirates
I was amazed by how much traffic I get from people searching for activation numbers for the Adobe Creative Suite. I wrote a post about my frustration with Adobe, but the traffic this post receives seems to be exclusively people looking for a “Photoshop CS3 Serial Number.”

3. Unique Longtail Content
Unlike the software pirates, it is reassuring that people are finding the unique content I create here on Adrian3. Searches for topics of my essays like, “What to do on your Last Day of Work,” or “How can I improve my dream memory?,” and “Where is Velveeta in the grocery store,” are evidence that their is an audience for my obscure ramblings.

If you have a blog, I would encourage you to write about your unusual, non-traditional ideas because people will find them. Common sense might tell you that a broad post that appeals to the masses would generate the most traffic, but actually the opposite is true. The reason for this is that the popular topics are also the subject of many more blogger’s posts. Competition is much higher for a post about Ashton Kutcher, than it is for a more obscure post about the Ashton Kutcher Camera.

Other longtail topics I have written about include:
iTunes Orphans (A post about how to remove orphaned iTunes Files)
Stop Motion Movie
Good mechanical pencils
MacBook Pro Crashed (I feel for these people!)

4. Original Creations
A good portion of my traffic also comes from people looking for things I have created. This is probably the most rewarding result of my traffic analysis because I really love it when my creations get seen and used. My most popular creations include:

iPhone Control Panel Plugin
Font Burner
Konami Easter Egg
Sofa Control scripts

By pure coincidence I happened to be looking at my robots.txt file last night. Actually, I didn’t even have a robots.txt file on my site. I was playing with Google’s Webmaster Tools and noticed that Google was giving errors when it read my robots.txt (which didn’t exist). I went to the address where there shouldn’t have been a file at all (http://fontburner.com/robots.txt) and saw a page of text filled with links to porn/spam sites. This sent me off on a wild goose chase to figure out how my site had been exploited.

The first place I looked was at my .htaccess file. My guess was that they were using the .htaccess file to redirect robots.txt to some other file. In my .htaccess file I noticed this code which I was pretty sure wan’t put there by me:


RewriteEngine On

RewriteRule .* http://allvideo.org.uk/in.cgi?4&parameter=sf [R,L]


The thing that threw me off was that this looks like legitimate code because the first line looks like it might be telling Google not to index the images of your site. Is this the work of a clever hacker adding decoy code before the really nasty stuff?

Deleting this code from my .htaccess file didn’t seem to affect my robots.txt file so I kept looking for a solution.

At this point I opened a ticket with MediaTemple, my web host to see if they had any advice. They responded quickly with a link to a knowledge base article called “Working with a php injected website.” This article confirmed my .htaccess suspicions and also pointed me to a line of code found in php files. Removing the .htaccess code was easy, but how do you find a line of code in the thousands of php files on a WordPress powered site?

MediaTemple also hinted at the possibility of needing to reinstall all WordPress files, something that I really didn’t want to do. I did some searching and came accross a good writeup of the situation on kyle-brady.com called “WordPress, MediaTemple, and an Injection Attack.” If you are a victim of this attack, I encourage you to read this post because it gives instructions about how to fix and identify the problem as well as many comments from other victims.

It turned out that in addition to removing the malicious code from the .htaccess file I also had to remove code from the index.php files in the root of my site. Once that was all cleared out, my robots.txt file issue was corrected. It looks like other people encountered deeper problems that affected the links in blog posts. Those people had to recreate their recent blog posts manually. Yuck.

This whole ordeal has left me feeling violated and unconfident about both WordPress and MediaTemple. If someone can add code to your .htaccess and your index.php files, that is a major hack. I feel lucky that they didn’t do more harm than they did because it seems like if you can hack those files you could easily take a site down or worse.

I am unsure who is actually to blame for this exploit, if anyone is. I heave read that MediaTemple blames WordPress and WordPress blames MediaTemple. There are reports that Drupal sites have also been exploited, so the problem isn’t limited to WordPress only. WordPress has released an update in the last week, but I don’t see any evidence that this issue was addressed in the latest security fix.

MediaTemple has told me that they changed all affected sites passwords for FTP. They also said that they scanned their servers and removed the malicious code. This is a confusing statement because neither of these things appears to have been done in my case. My FTP password still worked, and unless I removed the code before they did, they didn’t remove it from my site.

The good news is that the issue is (hopefully) behind me. If you are hosted on MediaTemple, I would advise you to take a look at your robots.txt (even if you don’t have one) because if I hadn’t noticed it I never would have known my site was infected. You may be a victim of the hack and not even know it.

Easter Egg Plugin

I am proud to introduce my latest WordPress Plugin. This one is called “Konami Easter Egg” and it makes it easy for anyone to create custom easter eggs on any WordPress powered website. If you aren’t quite sure what an easter egg is, let me backup and give you a little history lesson. Easter eggs are hidden secrets that can be found in movies, websites, books, Tivo remote controls, and pretty much anything where the creator has hidden secrets. They are called “easter eggs” because they are hidden treasures that you have to find. The creators of these things often hide them as a wink to other people who know the secret code.

One of the most famous easter eggs was created by video game maker Konami in 1988 when they hid a code in their Contra game that allowed the player to gain 30 extra lives. The code was entered by pushing a sequence of buttons on their controller. The code was “up up down down left right left right b a start select.”

The Konami code has since been used in countless games and has transcended into popular culture. Most recently, the code has been added to Facebook with “start select” being replaced by “enter.” There is even a website dedicated to documenting all the websites that use the Konami code, http://konamicodesites.com/.

I have always been intrigued by easter eggs and have long wanted to be able to add hidden things to websites that I make. When I learned about a javascript file called konami-js available on Google Code I realized that I could make a WordPress plugin for creating secret codes that reveal hidden messages on a website.

My plugin will hopefully appear in the WordPress plugin directory soon, but if you would like to test it out ahead of time, please contact me and I will send you a demo.

The Konami Easter Egg plugin is available now through the WordPress Plugin Directory. Here are the installation instructions:

Click here to view a screenshot of the settings page of the Konami Easter Egg Plugin.

konami easter egg screenshot

Installation
Installing Konami Easter Egg is very easy and do not require any template modification. Just follow these steps :

1. Upload the folder ‘easter_egg’ to the ‘/wp-content/plugins/’ directory.

2. Activate the plugin through the ‘Plugins’ menu in WordPress.

3. After activating the plugin you should see “Easter Egg” in the sidebar under “Settings.”

4. *IMPORTANT* Before the easter eggs will appear it is important that you enter the name of the outer most Div tag used in your theme templates. This can be found by viewing the source code of a page on your site. The first Div after the will look something like “<div id=”wrapper”>”. Take the name of this div (in this case it would be “wrapper” and enter it in the settings page for the plugin.

5. Enter the YouTube code of the video you would like to show.  Change the “key” if you want a unique key combination to unlock the easter egg. Change the message to say something unique. Customize the CSS to change the appearance of your Easter Egg as desired.

6. Congratulations, you did it!

By the way, I wonder what would happen if you entered the Konami code right now. Only one way to find out!

100 Web Designer’s to follow on Twitter according to Digital Labs

50+ Designers on Twitter according to Vandelay Design

16 Genuite, Authentic Designers on Twitter according to Six Revisions

25 Most Popular Web Designers on Twitter according to Best Web Design Schools

44 Web Designers to Follow on Twitter according to Think Vitamin

50+ Designers on Twitter, Grain Edit’s favorites

Font Burner
Smashing Magazine lists Font Burner among their list of 50 Useful Design Tools For Beautiful Web Typography.

Six Revisions lists Font Burner as one of their top 20 Useful Typography tools.

TripWire Magazine lists Font Burner among their picks for 60+ Typography & Font Mega Toolbox.

Speckyboy Design magazine praises Font Burner as one of 21 Typography and Font Web Apps You Can’t Live Without.

Font Burner WordPress Plugin
The Font Burner WordPress plugin has about 1500 downloads from the WordPress Plugin directory.

iPhone Control Panel Plugin
Over 250 downloads so far.

Found Photography
Listed as one of 87 Great Photography Blogs and Feeds by Epic Edits

Phone Feedr
Phone Feedr has been added to the web app section ofApple’s website. I can’t say that has lead to a flood of traffic, but 18 sites have signed up so far, so that’s something.

My first post went live yesterday and I am looking forward to talking about design again regularly. When I wrote for Be A Design Group and the audience of mainly designers it was a bit like “preaching to the choir” so the expanded audience should give me plenty of new material to explore. After all, if a designer can’t communicate with non-designers he isn’t much of a designer. That’s my opinion at least. I hope you add Red Rocket to your regular reading and jump into the conversation by leaving comments. See you over there!

It is kind of silly to put the weight of the world on the shoulders of something as trivial as Twitter, but that’s what I am going to do. Unlike Facebook where you only interact with people you already know, your Twitter network is farther removed. You follow friends of friends and people you are interested in but don’t know personally. In general, I am not very trusting of people outside of my safe circle of friends. Part of this is just general insecurity, but the other part is from observations about how strangers interact with each other online. For example, take a look at Digg or YouTube and follow almost any comment thread. The comments are filled with hateful arrogant people that tear people apart for no reason at all. Read enough of the negative threads and you seriously start to question what has become of the human race.

So I guess that was part of my hesitation about joining Twitter. Why would I expose myself to people I don’t know and another source of negative comments? As a blogger my experience is that the most vocal group of commenter isn’t the people that liked your posts. The people who comment are the ones who don’t like your ideas. That negativity is a big part of the reason I stopped writing for Be A Design Group and its audience of designers.

Once I started tweeting and following people on Twitter I was surprised by the tone of everything people wrote. Tweets are generally honest and trusting. Conversations are helpful and sincere. People are grateful when you follow them and generous in their interactions. This was the opposite of what I was expecting. Maybe my perception of humanity was a little off.

Despite evidence to the contrary, people are generally good. Most people will help you when you are in need. Twitter proves how much each of us craves friendship and how quickly we can let our guard down and invite people see behind the walls we construct. That is good news for people like me who were beginning to wonder where all the good people had gone.