WordPress Plugin: Basic Facebook Social Plugins

Today, I saw that Facebook introduced some new features, and one intriguing feature is called “Facebook Social Plugin“. It would be very interesting to have blog posts to be simply “liked”, and having information displayed about activities and recommendations related to your website.

So I decided to take 30 minutes of my break time and write this simple plugin. Since I don’t have much time I decided not to explore XFBML and the SDK as yet. That is why it’s called BASIC. With XFBML, shorter codes can be used, and deeper integration between Facebook and your website can be achieved. I am intrigued, really but I must be realistic.

This plugin is a very simple plugin to embed :

  1. “like” button at the end of your articles/blog posts
  2. activity feed as a widget
  3. recommendations as a widget
  4. Like box as a widget

You can add these cool features with minimal effort.

Most configuration parameters are self-explanatory, but Domain Override simply means you want to display information about another domain instead of where the widgets are hosted. By the way, the widget settings are combined in the Settings > Basic Facebook Social Plugins page.

At this moment this plugin is still waiting to be hosted at the official WordPress Plugin Directory so it can only be downloaded here.

  • Basic Facebook Social Plugins Version 1.0
  • Basic Facebook Social Plugins Version 1.1 * This version will wipe out previous widget settings as it introduces multiple instances of widgets.
  • Basic Facebook Social Plugins Version 1.2

Once available there, a link will be provided. When it’s there, It’s now in the official plugin directory (basic-facebook-social-plugins) so you should be able to install it using the automated, built-in plugin installer too.

You can see the sample for the like button at the end of this post, and the widgets live on this site.

The widgets does not conform to your theme (does not inherit your theme css) but simply bare boxes with Facebook feel. Take note that styling inside the boxes (and texts) are provided by facebook.

Those of you who are concerned about privacy, you’ll be glad to know that your name and profile picture will not just be displayed to anyone:


(This also applies to recommendation and activity box. Only friends will be able to see that you like something.) Facebook has thought of everything.

Try it out and let me know how it works for you.

Shots from Facebook:



Facebook has also written a nice post about social plugins in their blog: Answers to Your Questions on Personalized Web Tools.


  1. This WordPress plugin is written entirely by me, and is provided as-is with no guarantee. It is neither approved nor endorsed by Facebook.
  2. Yes, it is breakable by Facebook if they decide to change the iframe URL.

DD-WRT as Wireless Client

There is something very wrong with the wireless module on the DELL Precision M4300 I am currently using – after a while files begin to get corrupted and Windows will fail to write the event log. I have just had the motherboard changed by DELL last Monday. In the office I did not have any problem for the whole week since I was using a wired connection. At home, I mainly use wireless because my access point is in the family hall.

Bummer! I can’t be wired at home, it’s simply not practical and I have no suitable surface to work on near the access point. It’s a Huawei E960, property of Maxis. It’s a HSDPA modem so where I place it is very important.

I have an antique Linksys WRT54G v2.2 with DD-WRT v24 on it so I decided to convert it to a wireless client. It acts as a wireless client to the main wireless router, and provides LAN connection via the wired ports. Perfect for a busted wireless module.

Steps on the WRT54G:

  1. Do a hard reset
  2. Connect to the router via wired port
  3. Open the Wireless » Basic Settings tab
    • Wireless Mode: Client Bridge
    • Wireless Network Mode: Match Primary Router
    • Wireless Network Name(SSID): Match Primary Router
    • Wireless Channel: Match Primary Router
    • Wireless SSID Broadcast: Enable
    • Network Configuration: Bridged
    • Save Settings
  4. Open the Wireless » Wireless Security tab
    • Set Encryption to match the primary router. I use WPA2 with TKIP+AES and it works fine.
    • Enter encryption key to match the Primary router
    • Save Settings
  5. Open the Setup » Basic Setup tab
    • Connection Type will show: Disabled
    • Set STP to Disabled
    • IP Address: (Primary Router IP is
    • Mask: Match Primary Router (mine is
    • Gateway: (Primary Router IP is
    • DHCP Server: Disable
    • Save Settings
  6. Open the Setup » Advanced Routing tab
    • Change Type to: Router
    • Save Settings
  7. Open the Security » Firewall tab
    • Uncheck all boxes except “Filter Multicast” in “Block WAN Requests”
    • Disable SPI firewall
    • Save Settings
  8. Open the Administration tab
    • APPLY Settings
    • Click “Reboot” button

On the primary router I only had to add the MAC Address of the WRT54G to it so that it allows connection (I have MAC filtering enabled). To look for the MAC address I simply use the Administration » Commands tab to run ifconfig (or of course via SSH). I am not sure on how other hardware would work but I use my eth1 address.

This is good enough for now, although I am hoping that the notebook gets fixed. I am not going to pack the WRT54G along to Starbucks or any cafe just to get wireless connection.

Malaysian Twitter & Facebook Users Makes Fun of Rais Yatim

You can consider this as an honest and sincere opinion from me, as a Malaysian and a heavy Internet user. Maybe, if Rais reads this it will be much fun.

It’s all because of this news article: Malaysians advised against being immersed in Facebook, Twitter.

In twitter, the tag #yorais has been spreading like mad. The tweets are hysterically funny but too insensitive so I don’t think I should include them here.

In my own opinion, Rais should have not linked any of the online services with religion. In short, he should not have assumed when he has no idea himself.

From the text: “He chided some Malaysians who belittled those who were no savvy of the Facebook and Twitter culture.” it looks like Rais is offended by some people who might have said he’s left behind in technology. What I think he should do, is learn instead of condemning technology.

Admit it, everything has its own disadvantages and advantages. It’s not Facebook that Rais should condemn – it should be the users or more specific Malaysians. There exists fanatics and extremist in every single thing in this world and Facebook is not excluded.

It’s unfair to condemn services just because they were created by Westerners. Blame the users.

Facebook and Twitter has helped a lot of users even Malaysian to publicize their businesses and meet old friends, just to name a few. If you use something correctly it’ll be good, and vice versa.

As a matter of fact I just saw one of my respected businessman being bombarded with bad comments in a fan page named “I hate XXX” just because he made a bad comment about another related profession. Not cool.

I wish that Malaysian ministers would learn more instead of following the traditional way of thinking and assuming – what we all do in our beloved country. Don’t you?

The Star even published the outcome of Rais’ statement: Rais comment has Net users boiling, creates global sensation


Do I need to reboot the machine after increasing the maximum number of open files at /etc/security/limits.conf?

No, you don’t need to. This morning I struggled to convince someone that the server does not need a reboot. It was because of this: Increasing the number of file handles on Linux workstations.

ulimit – Provides control over the resources available to the shell and to processes started by it, on systems that allow such control.

limits.conf is configuration file for the pam_limits module

It takes effects immediately upon re-login. It’s hard to explain things that only you understand internally. I wish I have a formal Red Hat training so that I can explain better.

In the end I just rebooted the system so that other person who thinks (he/she) knows everything will be satisfied. Now (he/she) is.

Those struggling to get some proof you can probably forward this url which should have better reputation than this blog.

Delayed Yahoo! Messenger Custom Message Updates

Borrowing Google’s term – I have lately been using a flaky connection when connecting to the Internet. What I noticed is that my Yahoo! Messenger list becomes static and no custom messages are being updated. When I looked at my friend’s list, the custom message I set wasn’t showing. I was also not able to see when people get online or offline. I’m using Yahoo! Messenger for Windows.

I’ve tried all that I can think of – changing connection preferences, clearing message archives because I thought they grew too big, and up to the extent of reinstalling the whole application. I even blamed Symantec Endpoint Protection for it.

I found a simple remedy today – disable the “Always sign in to my mobile phone when I sign out of Messenger“. I have always thought that this option is convenient, especially when someone wants to convey a message for me when I’m not online. Well, okay I admit being lazy as this can easily be done by clicking on “Sign in to <cellphone number>” in the menu.

It turns out that the server is confused when you are online/offline so frequently – flaky connection. It’s a bug, yes.

Why am I not using Pidgin? Because I still want to separate my identities with the “send-as” functionality. With Pidgin I always revealed my identities to different group of people, and I don’t like it. I’ll reuse it once this feature is added.

So if you’re facing the same issue and have the option turned on, try to disable it.

Battery Powered Server

For real?


The black box with two terminals is a 12V battery, and it looks like a lead-acid battery. Is it a DELL? Is it an IBM? Is it an HP? No, it is a Google. That’s right people, it’s a unit of many Google’s server inside its data center containers. It’s a 2U thick server, with a Gigabyte mainboard holding 2 CPUs, 2 hard disks, and 8 pieces of RAM.

It’s not really battery powered, but the battery kicks in once the main power is lost. This effectively eliminates the need for more expensive and space consuming giant UPS’s (uninterruptible power supplies) which are batteries anyway. Is this a better solution? You be the judge.

If you ask me, I’d like to have one of those Magnetek power supply unit to install on my PC. The battery can nicely fit in a tower casing, much better than having separate UPS units. However I think the mainboard itself must be custom because the 12V to 5V conversion takes place there. The power supply unit only outputs 12V (approximately 13.65V).

However I can’t find any info on how long can the battery can actually supply power.

Story found on CNET: http://news.cnet.com/8301-1001_3-10209580-92.html

RegisterFly Resurrected as RegFly

I received an email yesterday:


It’s from RegFly, a resurrection of RegisterFly the lousiest domain registrar ever. I had very bad experience with them – slow system, buggy, unresponsive customer support. And now, they are no longer an ICANN accredited registrar so I guess they are reselling. Even the main domain regfly.com is registered under Tucows.

ICANN announcements:

Stay away. Look for an ICANN accredited registrar.

Image Hotlink Protection

Have people been stealing images from your websites? Well, there are not so many interesting images in this site so I don’t really have that problem. You can add a watermark to your image, but I guess everyone knows that.

Another form of image theft also involves bandwidth theft. It’s has many names – hotlink, inline linking, leeching, and many others. As many of us uses shared hosting and we have limited bandwidth, it will eventually reach the barrier if bandwidth is being stolen from other sites.

I have 1.5TB monthly bandwidth limitation, but I still don’t agree to people stealing my bandwidth by hotlinking images especially since I host quite a number of sites in this account. On Apache hosting it’s easy to prevent hotlinking by utilizing .htaccess file:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourdomain\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ /nohotlink.pne [L]

WordPress users can add the above lines before the WordPress rewrite rule:

# BEGIN WordPress

What the configuration does is check whether HTTP_REFERER to match the specified domain, or if it’s empty (direct calls, for example). If not empty and unmatched it sends the content of file /nohotlink.pne to the browser. Why? Because when images are loaded with the <img tags the referrer is the page calling the image. You can also define a nonexistent image so that a broken icon is displayed on the hotlinker’s site, or better still replace the last line with:

RewriteRule .*\.(jpe?g|gif|bmp|png)$ - [F]

My implementation will cause the image to be replaced with:

Hotlink protection

By the way the hotlink protection image is named with the .pne extension to prevent an infinite rewrite to occur. You can also use other image formats, and any other extensions. Some fussy browser might not display it correctly but who cares, the point is to prevent people from hotlinking, isn’t it?

Try it out yourself. Good luck!

Deleting Emails From Someone Else’s Mailbox

No, it’s not possible unless you have their passwords.

From my moonlighting jobs and previous jobs I usually include myself in the SysAdmin or IT email groups or distribution lists. I received a good one yesterday (translated from Malay):

There are different headaches in maintaining email servers, for example one might complain of too many spams but sometimes “valid” emails gets filtered. But this one really made my day.

Be Careful With OpenID

No, there is nothing wrong with OpenID, and there is nothing to worry about security or privacy. Giant players like Yahoo! and Google has also been implementing OpenID for quite some time.

I lost my account at Stack Overflow because I was using WordPress.com as an OpenID. Well, I lost it for about a day because the nice people at Stack Overflow was nice enough to help me merge my previous account and a new account I just created.

What happened? I used OpenID without a full understanding on how it works. I used my WordPress.com URL http://romantika.wordpress.com which I used as a placeholder back then to get an API key for Akismet. What WordPress does is embed the OpenID endpoints into each of the blog URL. For example:

<link rel='openid.server' href='http://romantika.wordpress.com/?openidserver=1' />
<link rel='openid.delegate' href='http://romantika.wordpress.com/' />

One important thing that you need to realize is that once you deleted a blog URL in WordPress.com, you will never get it back and a page saying that the blog has been deleted will be displayed. I deleted my WordPress.com blog to prevent it from becoming an eyesore, and to avoid redundancy. Little did I know that my OpenID vanishes along with the blog.

I would not have lost my Stack Overflow account if I realized earlier that they already allow multiple OpenIDs. So if one OpenID provider vanishes, I can use the alternatives and not bug the guys at Stack Overflow. Although, they did mention:

Accounts are keyed on unique OpenID strings, so if by some accident you end up with multiple accounts, or a “new” registered account you don’t want — don’t fret! It is super easy for us to merge any two (or more) Stack Overflow accounts. Just email us at [email protected] with the user IDs or the user page URLs. We’ll merge them for you no problem.

For my next projects, if I include OpenID support I will definitely follow the steps of Stack Overflow by allowing multiple OpenIDs to be attached to one account.

Facebook Is A CIA Device?

I’ve recently received a chain of emails, originated from a celebrity in Malaysia on how Facebook is a device used by CIA and how CIA is harvesting data of the world population in order to reach world domination. The email was quite elaborate, and I am impressed by the level of thinking the celebrity has.

I am not saying I know for sure, or even have the slightest idea whether or not CIA is really using Facebook to reach this objective. All I know for sure is that Facebook is located in the US and there may be a law to dictate that all data must be surrendered to the law enforcement authority when requested.

One thing that I am sure about is the value of privacy. It is indeed true when someone shares their home address, contact numbers, family members, and profession it is at least available to the owners of the site. Any site. We’re no longer talking about Facebook. It has been around at least since Sir Timothy John Berners-Lee invented the world wide web in 1990. Well, thinking carefully it can also happen on paper.

So, we can’t really focus on Facebook alone. Avoid inserting too much information even in forums or advertising spaces. I’ve seen how naive people can be when they post their full names, ID numbers, phone numbers, home addresses, including the full name of their child inside public forums, just to allow the forum administrator to send birthday gifts or vouchers. Post the pictures along, and it’s complete. Now everyone knows how you look like, and you can easily become a crime target.

That is why I am pissed off with something as little as publishing my ID number online, which is practiced by many public bodies in Malaysia. On survey forms at the shopping store, when asked to fill in personal details I input dummy data. Do you know they sell valid phone number and addresses for good money? After a while you will receive phone calls from telemarketers selling stuff you don’t really need.

I value my privacy. Do you?

Perl CGI + Apache + Windows

I have always thought it’s difficult to migrate Perl CGI script to Windows. I was wrong, and today I learned how to do it. The configuration part is actually 100% similar!

# This line will ensure only .cgi and .pl files are executed as CGI
AddHandler cgi-script .cgi .pl
Alias /request/ "C:/request/"
<directory "C:/request">
    AllowOverride None
    Options +ExecCGI
    Order allow,deny
    Allow from all

Now, all .cgi and .pl files are executed as CGI when run from the /request URI. You might have seen the ScriptAlias directive before – it processes everything in the specified directory as CGI. As an example:

ScriptAlias /request/ "C:/request/"
<directory "C:/request">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all

See the lack of the AddHandler directive? It’s no longer needed but it may be included if needed for other locations or directories. Now everything will be executed as a CGI. A CSS file in the directory will cause the server to return Error 500 (Internal Server Error).

One important thing when working with CGI is the shebang – the first line of the script that contains the full path to the interpreter. On Linux it looks like this:


While on Windows it will look like this:


This is the only problem with portability as you can’t have more than 1 shebang line!

Installing Perl is another part of the exercise. On Windows, the easiest way to get Perl is to install ActivePerl from ActiveState. If you’re migrating some code over to Windows, other than the Shebang you will need to install the required Perl modules. CPAN is available, but I suggest that you don’t use it unless very necessary. Since CPAN downloads the source code and tries to compile libraries, on a bare Windows system it’ll fail.

If you’re missing Perl modules you’ll see the error “Premature end of script” depending on how your Error 500 pages are configured. In Apache log, you’ll see:

[Fri Feb 13 10:00:21 2009] [error] [client 10.xx.yy.zz] Premature end of script headers: test.cgi
[Fri Feb 13 10:00:21 2009] [error] [client 10.xx.yy.zz] Can't locate DBD/mysql.pm in @INC (@INC contains: C:/Perl/lib C:/Perl/site/lib .) at C:\request/utils.pl line 7.

That’s when we need to use ppm utility provided with ActivePerl:

> ppm help
Type 'help command' for more detailed help on a command.
    describe   - describes packages in detail
    exit       - exits the program
    help       - prints this screen, or help on 'command'
    install    - installs packages
    .... snip ....

Based on the error above, it’s time to install DBD::MySQL module.

ppm install DBD-mysql

I’m all set!

Since we’re already talking about Perl, if you need mod_perl you can use ppm to install:

ppm install http://theoryx5.uwinnipeg.ca/ppms/mod_perl-2.0.ppd

At the end of the installation it’ll ask for your Apache’s module directory and copy mod_perl.so there.

The rest is easy:

LoadFile "C:/perl/bin/perl58.dll"
LoadModule perl_module modules/mod_perl.so
Alias /mprequest "C:\mprequest"
<location /mprequest>
     SetHandler perl-script
     PerlResponseHandler ModPerl::Registry
     Options +ExecCGI
     PerlOptions +ParseHeaders

Of course, PerlResponseHandler should be set depending on what you need.

Have fun with Perl!

When Security Is Not Secure

I was going after a moron who was disturbing my wife’s blog and reached an IP number. Utilizing nmap, I found out that port 80 on the IP is open.

-(~:#)-> nmap -A -T4 XXX.XXX.XXX.XXX
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2009-02-09 23:52 MYT
Warning: Giving up on port early because retransmission cap hit.
WARNING:  RST from port 80 -- is this port really open?
WARNING:  RST from port 80 -- is this port really open?
WARNING:  RST from port 80 -- is this port really open?
WARNING:  RST from port 80 -- is this port really open?
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
Interesting ports on XXX.XXX.in-addr.arpa (XXX.XXX.XXX.XXX):
Not shown: 1673 closed ports
25/tcp   filtered smtp
80/tcp   open     http            (GoAhead-Webs embedded httpd)
443/tcp  open     ssl/unknown
1720/tcp filtered H.323/Q.931
5000/tcp open     UPnP?
5001/tcp open     commplex-link?
5100/tcp open     admd?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF:n\r\n\r\n<html>\n<head>\n\x20\x20<title>501\x20Not\x20Implemented\n</title></head>\n<body \x20bgcolor=\"ffffff\">\n\x20\x20<h2>501\x20Not\x20Im
SF:\n\r\n<html>\n<head>\n\x20\x20<title>400\x20Bad\x20Request</title>\n\n<body \x20bgcolor=\"ffffff\">\n\x20\x20<h2>400\x20Bad\x20Request<h SF:2>\n\x20\x20<p>\n\x20\x20Your\x20request\x20has\x20bad\x20syntax\x20or\
SF:d</title>\n</head>\n<body \x20bgcolor=\"ffffff\">\n\x20\x20<h2>501\x20No
SF:d</title>\n</head>\n<body \x20bgcolor=\"ffffff\">\n\x20\x20<h2>501\x20No
Device type: general purpose
Running: Microsoft Windows Longhorn
OS details: Microsoft Windows Longhorn Preview
Nmap finished: 1 IP address (1 host up) scanned in 122.444 seconds

And so I went to look at what the HTTP server offers. It’s a D-Link DCS-950 camera, most probably port-forwarded using a router since the browsing IP from the computers are also the same.

I went to the D-Link website to look for the product manual and as I suspected it is using the default password, admin/admin. Here’s what i saw:


Anyone recognize this place?

The point here is that a device that is intended to serve as a security tool, can also be used against you. The dumbest thing you can do it leaving your devices on default passwords.

Ha… I can see someone changing tab to open their router configuration panel which have the default password. 😉

But hey, this camera is cool. I would not hesitate to install one or two at home. It can also be a PPPoE dialer (ADSL) so it can connect directly to a modem and dial the Internet. One bad thing I noticed is that to login and browse the images you need to use IE as it utilizes ActiveX.

Filters! Yahoo! I Want Better Filters!

I have been a long time Yahoo! Mail user (since 2001), and a paying customer of Yahoo! Mail Plus for 5 years+ (since 2003). There were no Gmail back then, and I needed a permanent email with POP3 access. Yahoo! slowly improved their services, although one thing that I have always been annoyed about is the unavoidable error that will be displayed if I try to access the web interface while my email client is pulling email via POP3. Every time!


In June 2004, I received an email informing some improvements. I didn’t really noticed them, really.


But then again, this is what I am really disappointed about. The “temporary” message has been there since the release of the new GUI.


And here is the antique filter form. Furthermore, Plus users can only create 50 filters. What’s that about?


Come on, Yahoo! please improve Mail. While you’re at it, IMAP service wouldn’t hurt too.