Lazeez's Corner

Thanks for all those who commented, your feedback has been very valuable.

Alright, time for some decisions.

I guess after all 130+ comments, it’s agreed that the new system should be implemented. It will take a little while to do, but it will get done.

Some changes will be required, like the clear definition of what is filtered out and what’s not. What will fall under this filter is any story containing any of the codes ‘pedo’, ‘lolita’, ‘boy’, ‘gi’.

The definitions of those codes will be amended to make them crystal clear.

boy, gi will be persons under the age of consent.

pedo will be person over the age of consent initiating sexual contact with a person under the age of consent.

lolita will a person under the age of consent initiating sexual contact with a person over the age of consent.

Since this is part legal issue, we’ll define the age of consent at 14 years since this is the lowest legal age of consent anywhere. That’s how it was in canada and still is in some states and other places in the world. So ‘boy’ is any male 13 years of age or younger. ‘gi’ is any female 13 years of age or younger.

Since this system will rely on correct coding, I will add a link at the end of each story for readers to report missing codes. We’ll do our best to enforce proper coding for those four codes. I’ll also change the submission wizard to ask the question whether the story contains sexual contact between a person over the age of consent and another under the age of consent.

Since filtering out database results by codes is computing intensive, I won’t be opening the current category exclusion preferences system for free accounts. Each story will be flagged filtered or not according those codes when posted or when the codes change. So this filter will apply strictly to those 4 codes.

For those concerned about ‘censorship’, this isn’t censorship. This is choice. Censorship would be if somebody else gets to decide whether you would be allowed to read something or not. Choice is when you get to choose.

Update 2010-05-07: Due to feedback and reading various references, I reverted the definitions to 12 and under instead of 13 and under and rephrased the pedo and lolita definitions to be in harmony with the most popular definitions I found.

Pedo: An adult initiating sexual contact with a pre-pubescent child (boy or girl, 12 or under)
Lolita: A pre-pubescent child (boy or girl, 12 or younger) initiates sexual contact with an adult (I know lolita doesn’t work properly for boys, but what else can we use? Lolito?)

I added the ’12 or under’ bit to the pre-pubescent part to remove ambiguity. I don’t want to hear the line, ‘but my character got her period at 10′.

Yesterday, this site got hacked again! No, not storiesonline.net, but this blog, hosted at storiesonline.org.

In the last three weeks it happened two times prior to this. One time a redirect iframe got injected into the database and the second time, another iframe got injected into the site’s index page. I cleaned them up each time after changing all my passwords from the database’s password to the sftp to the management. Everything! I changed each and every password only to get hacked again.

It turned out that the hosting company, Network Solutions got all their servers hacked. They’re battling the problem, but as far as I can tell, they’re losing the battle. The proof was yesterday’s intrusion.

However, this time, it happened just as Google was checking the site and found the malware on it and blacklisted the site. And since I host most of the images used on storiesonline.net here on storiesonline.org, SOL.net got partially blacklisted.

That was the straw.

I moved the domain to a new host (one that I trust much more) and started the site from scratch, just in case the old site still had some backdoors inserted somewhere in WordPress’s complex database structure. I created a fresh wordpress installation, along with a fresh new theme (do you like it?) and imported the articles through an xml file. As far as I can tell, nothing got lost other than the malware.

After that, I requested a new review from Google and the new site passed with flying colour. Now it’s just a matter of time  until all browsers fetch the new listings from Google and the warnings will go away.

We’ve had support for externally linked stories since the start of the site. However, the feature wasn’t exactly popular and generally led to confusion and frustration with the readers and misuse and abuse by some authors.

I’ve decided to phase out support for externally linked stories. As of today, the ‘New External Story’ button in the site’s submission wizard is gone.

[Update: 2010-04-15]: Transition is now complete. There are no more externally linked stories on the site.

Since Monday, November 9th 2009, in the afternoon, all secure pages on the site from the log in page to the subscription system are causing browsers to report an expired security certificate error.

Impact:

Not much really. The certificate still works for encryption, so no data is ever compromised. All a user has to do is to make their browser accept the certificate temporarily (allow an exception) and all will be well.

What happened?

Why such a lapse in security? Well, this is interesting.

The current (expired) certificate was obtained from Entrust two years ago. It had a duration of two years. And as it turned out, Entrust has interesting new policies.

First: They only alerted me last Wednesday about the impending expiration of the certificate instead of their usual 30 days. So I didn’t remember to renew on time. It would have been fine if we simply renewed.

Second: Entrust’s new amazing policy of not accepting any purchases for less than $1000.

A single, standard URL certificate for 4 years is $538 with Entrust (it started at $299 per year in 2003). That’s what I usually get and the site doesn’t need any more than that. So if I were to keep dealing with Entrust, I would have to buy something else; something that I don’t need. I would have to invent a domain to get a certificate for it.

So, I decided to get a certificate from Verisign instead. They are much better priced anyway and they accept my insignificant business dealings of $356 for the same type of certificate for the same period of time.

However, certifying a site requires verification of the business entity behind the site and that takes 4 to 5 business days to finish and produce the certificate.

I started the process on Thursday, and hopefully we get the new certificate by tomorrow.

So for now, just accept the current expired certificate and everything would work as usual.

Sorry for any inconvenience.

Update 2009-11-11 2:00 pm: The issue has been resolved and a new security certificate has been installed and activated.

Today, the 21st of September 2009 I rolled out preliminary support for portable devices with small screens. This support is restricted to story display and the new stories list and the updated serials list.

I will be rolling out support in other pages gradually.

For now, if you stumble on bugs, let me know and I’ll correct them. Also, if you have other suggestions that could help, let me know.

Alright, so we’ve moved. The move yesterday took about two hours from when the servers were shut down to the site being accessible again. It was fairly uneventful.

However, the site is not back up to to its old normal self. We’re still missing the hefty hardware required for content search. We’re running on a single database server with large memory. The current speed comes mostly from the database being completely cached in the RAM. So disk access is strictly for flushing MySQL’s memory back to disk.

We’re now looking for either a decent disk array to hook up to the server, or a server with decent hard drive space and high processing capability to replace the current one. So content search (where you can search for stories according to text contained in them) is still missing.

Again, with a problem that took the site offline for a considerable amount of time. So, what happened?

Well, it turned out that the hosting location that I have the servers in, is in the process of being closed down. They didn’t give me prior warning. So there were people moving servers and racks to a new location (our turn will be on Friday).

Somebody knocked the power cord from the database server’s array and that took it offline. We spent the afternoon and the evening trying to recover and rebuild the array and each time it starts to work then reports a failing disk. After the third time and a report of a different disk failing, we figured that it’s the array itself that’s hosed and not the disks.

At midnight, we removed the array and replaced it with a server with some drives in it and restored the database from the morning’s backup. Due to this, we had to forego the Content Search function until we get a new solution.

So the net result is that we lost nearly 12 hours worth of data and an expensive piece of hardware.

Since we’re moving on Friday, we will deal with the Content search problem and the new hardware after the move.

So this is the first announcement that on Friday, June 19th, the site will be offline for few hours. We will need to move the servers physically to a new location and have the DNS entries updated to point to the new IP addresses. So that may take anywhere from two to six hours. Hopefully as close to the lower end as possible.

After that, we’ll need to get new hardware to replace the old one and when that happens, we’ll need to take the site offline again to make the replacement. But that will be about 15 days or so after the move. I’ll make the appropriate announcement when the time comes.

The lesson learned?

You can never have too much redundancy and backup backup backup…

Oh yeah, before I forget, the site will be offline again on Friday June 19th. Sorry for the inconvenience folks!

Due to some new constraints, I have had to make some changes to the scheduling of delayed postings.

From now on, instead of posting delayed stories and chapters at midnight Eastern time, it will be at 9pm Eastern time.

Well, it does. When it rains it seems to come from all sides.

Last night, a network outage 10 days after the last one.

Tonight, a catastrophic hardware failure in the database servers’ raid at 8:15 pm on the 27th. We’re scrambling to find and configure a replacement. It will definitely take a while and some data has been lost.

Sorry for the inconvenience folks. We’re doing all we can to get things up and running again.

Update 1:55 am: Well, we’re piling it on. On top of the hardware problems we’re having, the replacement server raid that we got turned out to be faulty AND Rogers (the backbone provider) is doing a network maintenance just like last night, without any warning. The tech working at the data center can’t communicate with the outside world to make sure that we get new software to install of the hardware (which is dead at the moment too).

Update 6:30 am: Things are coming along well. We’ve managed to get the database for the storiesonline.net domain going. It’s fairly operational. However, we lost everything that happened from 4:00 am EST on the 26th, so roughly 48 hours of activities have been lost (the latest back up was corrupted, the previous one worked.)

The secure connections over https (for log in and for payments) are not working. We haven’t figured it out yet. The admin pages aren’t fully working yet. So be patient about updates.

Not everything is as it should be, but it’s definitely better than being offline completely.

Update 28th, 2:25 pm: well, the site is almost back to normal, but the submission processing is broken. It needs some work. It will take until the evening to get it done and start processing submissions again.

Your patience is appreciated.

When I started implementing the site’s various RSS feeds, I took the easy road and I used a token in the URL itself for authentication. It was an acceptable solution all that time ago. However, with the proliferation of RSS aggregators and their facilities for finding RSS feeds, I found that I could easily subscribe to any member’s RSS feed that uses those facilities like Google reader.

The upcoming change will have an impact on some of you.

From next Monday on, RSS feeds on the site will require authentication. Most news readers these days support the authentication protocol required. Usually, it will only require that you enter your storiesonline’s user name and password once, and after that, your news reader should take care of the rest.

If your news reader doesn’t support this functionality, then you need to change readers.

Sorry for any inconvenience that this may cause; but there is no way around this, especially with the existence of the library RSS feeds.

Update: I’ve created additional non-authenticated feeds for the New stories and the updates pages. However, for various reasons, not all stories show up in the non-authenticated feeds. So if you choose to use these feeds, you may miss stuff. But, I figure it’s better than no feeds at all. To find the various feeds, including the non-authenticated ones, check the RSS feeds page.

Second update: Firefox does not work properly with the new authenticated feeds. It asks for authentication once and if you create a live feed, the second time around you’ll get ‘Live bookmark failed to load message’ without telling you why. The only way to make firefox work with the authenticated feeds is to follow the hack outlined below in the comments.