About an hour ago we turned blogs.perl.org back on. There’s also a blog post where we explain what happened in a lot more detail.
If you have an account on the site then you will have received an email explaining what you need to do now. Basically, we’ve invalidated all of the passwords so you’ll need to ask the system for a new one.
Sorry again for the inconvenience. And huge thanks to the rest of the blogs.perl.org team (particularly Aaron Crane) for fixing this.
It seems that last night blogs.perl.org was hacked. I first became aware of it when someone pointed me at this story a few hours ago. As you’ll see, the contents of the mt_author table have been made public.
We’re still investigating the extent of the hack. But, as a precaution, we have configured the site so that all dynamic pages return a 404 response. This will, unfortunately, prevent you from logging on to the site.
We will publish more information when we have it.
Apologies for the inconvenience.
- As I said, the mt_author table was leaked
- This contains both your username and password
- The password is salted and encrypted (with crypt)
- If you use your blogs.perl.org password elsewhere, we strongly recommend that you change it
Here’s a cut-down version of the published data that includes only the name columns. Hopefully you can use this to work out whether or not you have an account on the system.
It’s ten days since we announced blogs.perl.org and it still doesn’t work properly.
Our mistake was to launch it on a really underpowered server. It worked fine when there were half a dozen of us testing it out, but when the entire Perl community descended on it to take a look at the site (and to sign up for accounts) the server collapsed under the strain.
All of the problems that I’ve been told about so far have been down to memory allocation issues. The server has 512 MB (corrected from KB – it’s bad, but not that bad!) of RAM and it really needs four times that.
Things have calmed down over the last few days though. I suspect that’s largely because people have lost interest in the site and have given up trying to register. We’ve also switched all of the MT processes to using FCGI. I see that a few people have registered successfully and are posting entries on the site. I salute their persistence.
We have a plan for fixing the situation, however, and that will be put in place over the next week or so. The site will be moving to a new server with a more appropriate hardware configuration. We hope to minimise the amount of downtime whilst this happens.
I can only apologise, once more, for the problems. I hope that once the new server is up and running, you’ll all consider giving blogs.perl.org another try.
I hope it’s obvious, but none of these problems should be taken as a reflection on the quality of Movable Type or the work that Six Apart have done for us on the site. The problems all come down to capacity planning on the part of the people running the project.
Which reminds me – if you’re ever looking for someone to do capacity planning on your web site, I’m not the right person for the job!
It’s quite possible that over the last year or so you’ve heard me muttering about a secret project that I’ve been working on. Well, this morning I can finally reveal what it is.
Do you ever wish that the Perl community had a centralised blogging site where anyone could set up a blog for free? Something, perhaps, that allows you to use modern blogging features like images in your posts or tags.
If you’ve ever wished for something like that, then can I suggest that you take a look at blogs.perl.org. I think it might be just what you’re looking for.
The site is built using Movable Type and we were lucky enough to get some people from Six Apart to build it for us. I’d like to particularly thank Steve Cook of their professional services division who has done a lot of the actual work. Thanks also go to Jeremy King who designed the site and David Jacobs who is their manager and allowed them to work on the project on company time.
From the Perl community I need to thanks Aaron Crane who is hosting the site and Curtis Poe and Aristotle Pagaltzis who have both been involved in planning this project. Many other people have given invaluable advice or have been early testers of the site. Thanks to everyone who has been involved.
All that remains now is for you to try it out. You should regard it as a beta test version, so some of you will find problems. When you do, please just let me know and we’ll fix them.
I hope you enjoy the site and find it useful.
Update: Yes, there seems to be one quite glaring problem with it. That’s the web server errors that are generated occasionally when someone tries to log in (or out). Seems to be a resource allocation issue with the server. We’re looking into it. Please bear with me.