CatSpit

It was only a few years of pointless arguing later that the spoiled brat fight between Apple and the music labels finally ended with agreement on a scheme that would deliver DRM-free music to all of us via iTunes. So byebye, CD’s. It’s been real.

I still remember the very first CD I bought, the excitement of scraping away futilely at the shrink-wrap [what's this shiny stuff? blimey it's hard to get off] from Killing Joke’s Millenium EP and then playing it about 5 zillion times.

Each play sounded as good as the last! I marvelled at the sound quality on my tiny little speakers and the fact the tape never got stuck in the player! No more tape to tape dubbing for me, oh no sir! No more ‘Chromium Dioxide’ or, if you were feeling flush, the elusive ‘Metal’ tape. I was so thrilled with the thought of never having to tease out tape birds-nests-oh-so-gently and then slowly wind back onto the casette with a pencil again!

Of course, with this advance of technology the art of the mixtape was lost forever and the romantic side of me will always feel slightly melancholy about that. I somehow miss the extra work which went into those. It’s the x-factor, the love, the thought, the care that evolves what is otherwise just a collection of songs into an insight into someone’s soul. They always sounded like shit but that wasn’t the point, was it?

Most people these days don’t know what the fuck a quality mix is, let alone the requisite late nights that should be spent planning the perfect solution. the ideal song selection and the right mood transition for the right person. If you don’t know what I’m talking about, read High Fidelity by Nick Hornby immediately. I’ll even let you off lightly by allowing you to watch the unexpectedly good film instead if you want.

Kim and I must have burned an entire field of beehives in candles with the late nights we spent meticulously recording songs for each other when the Atlantic separated us and we’d not see each other for half a year at a time. This along with a forest of handwritten letters, another lost art but that’s one Kim’s probably thankful for as my writing may quite possibly be the worst scrawl that ever did infect this planet. That was back in 1990, fast forward to 2009. First off, damn that was 19 years ago and I feel .. damn. That’s a long time. Wow. ..

Damn it.

[musical interlude]

Fast forward to 2009 and I think its safe to say that the CD just died. DRM and Quality/Bitrate were the last two barriers to breakout sales for Apple/iTunes and now they have been removed I don’t see why anyone would buy a CD. For the price of a few CD’s you can get an iPod classic which stores more music than you can shake a stick at. In addition, I bet only highly trained professionals could tell the difference between a 256 bitrate AAC file and a CD. I know I can’t.

Of course, the gamble / strategy part in all of this is that a good chunk of people are going to buy the higher quality music which takes up more hard disk space. Hence people are going to need, rather than want, the latest iPhone and iPod touch models that go beyond 32GB when they come out. Admittedly this won’t be everyone, but I don’t think anyone would argue that it will be more than would otherwise. Brilliant, really.

SAN FRANCISCO, Jan. 6 /PRNewswire-FirstCall/ — Apple(R) today announced several changes to the iTunes(R) Store (http://www.itunes.com). Beginning today, all four major music labels — Universal Music Group, Sony BMG, Warner Music Group and EMI, along with thousands of independent labels, are now offering their music in iTunes Plus, Apple’s DRM-free format with higher-quality 256 kbps AAC encoding for audio quality virtually indistinguishable from the original recordings. iTunes customers can also choose to download their favorite songs from the world’s largest music catalog directly onto their iPhone(TM) 3G over their 3G network just as they do with Wi-Fi today, for the same price as downloading to their computer. And beginning in April, based on what the music labels charge Apple, songs on iTunes will be available at one of three price points: 69 cents, 99 cents and $1.29, with most albums still priced at $9.99.

Thinking about Security is not a luxury, it is essential. You ignore it at your peril until that one day disaster strikes and you’re buggered. My theory on it is much like the old adage where two blokes encounter an angry Cheetah and one guy begins to put on his running shoes. His friend comments that he’ll never outrun the Cheetah to which the first replies “No, but I can outrun you”.

Thus, to me security is a matter of running faster than my friends or the blog around the corner. Make others an easier target. My strategy is to at least eliminate the common ways by which you can get attacked by bots which are a lot more pervasive and common than their human inventors. I think that it’s important to recognise that whatever you do, there will always be some l33t out there who will find a hack around if they get it into their head that you are today’s teatime snack.

Thus, I don’t go too overboard and focus on bang for buck. If you are running the typical environment of WordPress / PHP / MySql there are some simple yet effective steps you can take to minimise the size of the bullseye on your forehead. If you haven’t done at least some of these I strongly recommend that you do.

Users: When you create your MySQL database also create a new database user with a nonstandard name and strong password. Assign this user an administrator role and then delete the default admin user. Do the same thing in wordpress. By default WordPress creates an ‘admin’ user.  Create yourself a new user with admin credentials and then nuke the old admin. Sorry, pal.

Database: Change your database table prefix. The default wp-config.ini creates all tables with a wp_ prefix and the easiest time to change this is by editing the config file before wordpress installation. It’s also a fairly simple matter to change it after installation if you need to. The reason for changing this prefix is that assuming the h4ckb0t has had a chance to see your database, the bulk of attacks will probably come from some kind of SQL injection attacks using standard scripts. Having a different and unguessable prefix on your tables gives you some sanctuary from bots but not necessarily from a person.

Access: Lock down your public web directories. Make sure that only the files and users you want to see your content have access to them. There are a series of good guides on how to do this easily via .htaccess files. You certainly want to restrict wp-admin (I only allow connections from specific IP addresses to this and deny all else), but you should look into restricting wp-content and wp-include directories as well. Above all else protect your king the wp-config.php file in the root. This seems straight forward but I’m having a bit of a problem when I do this on the wp-content. For some reaons when I use the following file it seems to break the css formatting on the whole site… Suggestions anyone?

Order Allow,Deny
Deny from all
<Files ~ “.(css|jpe?g|png|gif|js)$”>
Allow from all
</Files>


Hide Plug-ins: Some plug-ins (especially older ones) have quite a few vulnerabilities in them that can be exploited. While you definitely want to stay on top of the iterations of new releases, you also want to prevent the plug-in directory listing. Simply drop an empty index.html file into the wp-content directory.

So that’s it. As anyone who is worth their salt can tell you, this is a beginning. If you want a truly secure installation, I am not your man. But the above steps should enable you to not get eaten by the most common Cheetah.