Here’s the article:

Hack Attack

So who would you like to hack today? A bank, a website, a corporation or perhaps a government agency that’s rubbing you the wrong way? The hacktivist group LulzSec is taking requests. Or maybe you’d like to get your hands on some stolen credit-card accounts to boost your personal spending level or purchase some malware that will divert a business’s payments from its vendors to you. A malware seller called Zeus not only can do that but also provides customer support. Hacking has become a service and entertainment business — and in a quantity and at a quality never before reached.

Hacktivists, pranktivists, idealists and malware coders are oozing past the circa-2000 network-security gates of corporations and governments with ease. Among the biggest hacks was the one that brought down Sony’s PlayStation Network. Some fingered the politically motivated group Anonymous, and authorities in Spain have arrested several purported members. But Anonymous has said, Not us.

When Sony announced that it had finally restored service, the gang of merry hacksters called LulzSec began to trample through its websites, including Sony Pictures. LulzSec, which makes a point of pointing out holes in Web security, used a hack called an SQL injection, then tweeted about it: “We accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?” It has since broken into gaming companies such as Bethesda Softworks and Minecraft. It used a hack called a distributed-denial-of-service attack to lock up the CIA’s website; it accessed account information from Citibank.

LulzSec may be the headline hacker, but it’s not the most malevolent. The black-hat, criminal side of the practice is booming by adopting a similar approach. Cyberthieves have shifted their focus to social networks. Instead of attacking corporate firewalls head-on, they are breaching corporate sites using social engineering, convincing someone within a company that an e-mail is from a friend or colleague. It’s a technique called spear phishing: the idea is to identify vulnerable targets — say, someone in human resources or finance — and, through them, burrow into corporate networks. They are feasting on small and medium­size businesses like wolves on lambs.

There is also a real cyberwar being waged by nations. Reports of cybersecurity incidents from federal agencies have increased 660% over the past five years, to 41,776 in 2010, according to the Government Accountability Office’s information-security-issues director. The networks of the Department of Defense (DOD) are probed millions of times every day. More than 100 foreign intelligence agencies have attempted to penetrate DOD networks or those of military contractors — attacks characterized as APTs, or advanced persistent threats. At least one got into the Pentagon via Lockheed Martin by cracking the RSA security token, the random-number-generating device that many companies use for secure access to computer networks.

To experts, this is just another sign that the older technology that protected IT is passé. “User-named passwords are breakable now. They weren’t when they first started,” says Bill Conner, CEO of Entrust, an IT-security firm. “Tokens have been around a long time. One lockmaker has now been breached. Even tokens aren’t good against some of the new-age cybercrimes.”

The New Threat Matrix
It adds up to an entirely different threat matrix bubbling up on the Web. The hacker community that once operated in its dark recesses has broken the surface, embracing social networks and exploiting them to expand in all directions, legal and otherwise. “What we are seeing is beyond a technical improvement,” says Dave Jevans, chairman of the Web-security firm IronKey. “They have a social element to bring people together [via the network] to create more sophisticated attacks than we’ve ever seen. That’s what makes it accelerate.”

And it’s not just Nigerian spammers and post-Soviet computer jocks anymore. In the past quarter, the IT-security company AVG traced hack attacks tied to about 700 ­command-and-control servers — servers that take over computers infected by botnets — used by various hackers around the world. “About 30% of the hackers were in the U.S.,” says CEO J.R. Smith. “This is a shocking experience to see the data being stolen — medical data, business data. The volume of data being stolen is constantly increasing.” So is his business, since the thieves are also expanding into cell phones. Smith says his company blocks 10,000 malicious mobile-app downloads every day.

LulzSec and Anonymous have been proving with alarming regularity that the data we’ve entrusted to corporations and institutions isn’t as safe as we’d like. If information privacy wasn’t our first concern, it’s now in the top slot. Anonymous evolved from the fringy website 4chan, where posters frequently signed in as anonymous, and gained acclaim as the hacking force that attacked MasterCard, Amazon and PayPal for canceling Wiki­Leaks’ accounts after WikiLeaks released a trove of U.S. diplomatic cables. LulzSec is thought to be a splinter group of former Anonymous members.

LulzSec’s name is a play on the texting abbreviation LOL, as in laugh out loud, which is what LulzSec has been doing at the networks (it claims to do it “for the lulz”) that in its view aren’t protecting users. Its members are skillful enough to hack into an FBI affiliate site and, according to LulzSec, leak its user base as well, always with a tweet. When an IT-security firm offered $10,000 to anyone who could hack its website, LulzSec did it — and refused the money.

But it seems LulzSec might be shedding its Robin Hood persona in favor of more nefarious activity. Recently it announced via Twitter that it is teaming with Anonymous to steal and share data. In announcing Operation Anti-Security (#AntiSec), LulzSec stated plans “to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments.”

In a missive it released after its 1,000th tweet, LulzSec explained a bit of its philosophy: “Yes, yes, there’s always the argument that releasing everything in full is just as evil, what with accounts being stolen and abused, but welcome to 2011. This is the lulz lizard era, where we do things just because we find it entertaining.” In the meantime, counterhackers are vowing to track down LulzSec’s membership.

Sony didn’t find hacking particularly entertaining when its PlayStation Network was shut down on April 20. For more than a month, Sony had to take the network down, leaving about 100 million players without their fun and no doubt forcing parents to pay more attention to their children, and vice versa, until the company got it going again at the beginning of June — at a cost of $173?million. The PlayStation Network had barely returned to action when LulzSec barreled into many of Sony’s more than 10,000 websites worldwide. Yet when Sega’s site was hacked by an unknown interloper, LulzSec signaled that it would track down the culprit.

LulzSec’s beef with Sony — indeed, with just about everybody — is that the company’s Internet security isn’t good enough, so it must be named and shamed. Within Sony, the reaction was as much frustration as anger. It was not as if PlayStation owners were launching cruise missiles at endangered animals. The PlayStation Network was a community that willingly shared information; it depended upon a certain level of civil behavior. Nonsense, said LulzSec.

The Black Hats Are Winning
In that same release, LulzSec also warned the public about what it wasn’t noticing: the everyday hacking of banks, businesses and individuals, incidents that the IT-security experts concede are growing rapidly. Black-hat hackers are adapting social networks to establish an evil ecosystem while exploiting its vulnerabilities to steal data and money. Their tool kit includes social-engineering techniques that dupe you into coughing up passwords. Their malware is getting better: botnets (networks of infected computers) are growing, as are “man in the middle” schemes that redirect your Web traffic.

It’s a new plug-and-play environment as hackers specialize, link with other specialists as needed and offer a variety of goods and services. You don’t even have to be a hacker to use some of the available products. There’s 24/7 customer support. Malware consortiums like Zeus produce botnets that let you invade and infest computer systems. You can obtain specific parts of botnet code that you can customize for your own use to hack individual bank accounts. Need a “mule” to set up an account to transfer stolen money into? That service can be provided too. “There’s a whole supply chain here,” says AVG’s Smith. “The guys who develop it, update, use it, and people who have to get the money. It’s hard to find the guy.”

Not that the cops aren’t looking. Zeus suffered a major hit when the U.S. charged 70 people with involvement in the cybercrime ring in September 2010. Its response was to merge with SpyEye, another botnet maker. The point, as with any other merger, is to improve efficiency and profits. The combined Zeus-SpyEye, for example, is making an even more damaging bot called “browser in the middle” that allows thieves to manipulate the data that a user sends to a bank. The bank may see six authorizations for payment when the user thinks she’s sending one. When the bank acknowledges the six authorizations, the browser intercepts and shows the user only one.

Hackers have discovered that small and medium-size businesses (SMBs) are far more vulnerable than major corporations. SMBs can’t afford the kinds of costly defenses the big guys can erect if they choose. The stakes are higher too. If someone hacks your personal bank account, you’ll be made whole. But courts in many states have ruled that if someone hacks a business account and the bank followed standard security protocols, the business is on the hook for the money.

Hackers haven’t forgotten about you either. While the Web has encouraged sharing via Facebook and LinkedIn, those networks have become portholes to problems. Friend the wrong person and go to that unknown friend’s recommended website, and you are asking for trouble, buddy. A Facebook bug called Koobface that takes over your account is infecting a million accounts daily, says IronKey’s Jevans. As for LinkedIn, he says, “I can make a very authentic-looking LinkedIn invite.”

Hackers are also using the data gamed from social-network sites to build credible individual identities with which they can infiltrate corporations and websites. Even if you don’t have a Facebook account, someone could create one for you — as happened to the head of Interpol.

The Counterattack
The good guys aren’t standing still, of course. The focus now is to disconnect a person’s e-mail and browser from the rest of the network with a variety of security layers. Companies are also figuring out new ways to protect themselves from employees who work at home beyond the corporate firewall and from the growing threats via mobile devices, including iPads and other tablet computers. Until then, corporations and government agencies are well advised to keep the doors locked, change the default settings and train employees to be on guard for spear phishing and social engineering.

We think in terms of Moore’s law — that computing speed doubles every 18 months. But “hackers are thinking in days,” says Entrust’s Conner. There are things you can do to help protect yourself: not just changing your passwords but also making them long enough and complex enough to be a meaningful deterrent. But at a more basic level, it’s about not oversharing with people you may or may not know and being a little more cautious even with people you think you know. It takes a little of the social out of social networks, but it’s safer.

“The main thing is that it’s going social. If you look at Lulz, would you believe a hacking group has a p.r. office, a Twitter account and a request line?” asks Jevans. “It’s crazy. It’s creating a whole new culture of people who feel they are entitled to do it.”

That’s sort of how LulzSec feels. It has prodded the public for its watching-the-train-wreck attitude toward hacking. But even LulzSec doesn’t know how long it can last. British officials recently arrested a hacker who may be part of the group. “We’ll continue creating things that are exciting and new until we’re brought to justice, which we might well be,” says LulzSec. “But you know, we just don’t give a living f— at this point. You’ll forget about us in three months’ time when there’s a new scandal to gawk at.”

At the rate the hackers are moving, it may be even sooner than that. It’s the damage that could be lasting.

Read the article at time.com

A better way to share large files is to use a great easy-to-use free service called Dropbox. Here’s how to do it:

1. Click this link and create your account
2. It will then prompt you to install Dropbox, go ahead and install it
3. You will now have a Dropbox folder on your computer which looks like any other folder. But it is a special folder because you can use it to share files with anyone else or to make your files available on any other computer

Once you have Dropbox installed, here’s how you can use it to send us files:

1. Open your Dropbox folder and make a new sub-folder inside it
2. Drag all the files you want to share into that folder
3. Right click on the new folder and from the Dropbox menu choose ‘Share this folder…’ (this will open a window in your web browser)
   
4. Enter the email address(es) of who you want to share it with and click the ‘Share folder’ button.
   

Personally, I’ve been storing FTP connection details in FileZilla’s site manager because I have so many websites to manage but now that I’ve learned that it is a security risk, I’ve looked into finding a safer approach.  The solution I’ve come up with is to use a password management tool called KeePass Password Safe to store the connection details instead of putting them into FileZilla. KeePass is a free open source application for securely storing and managing your sensitive login credentials. It also allows you to automate the steps for opening up an application and logging in to it. Using this feature I can store the FTP connection details for my websites and launch FileZilla directly from KeePass, making it almost as convenient as using FileZilla’s site manager but much more secure.

Automating KeyPass to work with FileZilla

Here’s how I set up KeyPass to make it automatically open FileZilla and initiate the FTP connection:

1. I make a special group (folder)  for my FTP connections (this can contain sub folders to aid organisation)
2. When adding a new entry, I set the URL field to:

   cmd://"C:\Program Files\FileZilla FTP Client\filezilla.exe"

   You can use Tools > URL Field: Select Application… to auto-populate this field for you
   

3. Enter the ftp url as the title and the username and password
4. In the Auto-Type tab, make sure Enable auto-type… is checked and Inherit default auto-type… is selected
   
5. Edit the parent FTP group and in the Auto-Type tab enter the override sequence:
   {TITLE}{TAB}{USERNAME}{TAB}{PASSWORD}{ENTER}
   

Now when you want to connect to one of your websites:

1. Open up KeePass
2. Right click on the appropriate entry and select URL(S) > Open In Browser (or Ctrl + U)
   This will fire up FileZilla
3. Flip back to KeePass and right click entry again and select Perform Auto-Type (or Ctrl +V)
   This will log you in to the account

Another Improvement – local & remote directories

One convenient site manager feature that’s missing from this approach is the ability to automatically set the local and remote paths once you’ve logged in. But even this can be accomplished using KeePass. My approach is to store the paths in two custom string fields. To do this, just go to the advanced tab on an entry and click the Add button to add the custom fields. I called mine Custom 1 and Custom 2.

Then change the auto type sequence that you entered in step 5 above to:
{TITLE}{TAB}{USERNAME}{TAB}{PASSWORD}{ENTER}{DELAY 1000}{TAB}{TAB}{TAB}{TAB}{TAB}{S:Custom 1}{ENTER}{DELAY 3000}{TAB}{TAB}{TAB}{S:Custom 2}{ENTER}

Note that there is a 3 second delay before changing the remote directory – this is to allow enough time for the connection to be established before attempting to change directories. You may have to increase this if you have a slow connection to your FTP servers.

Migrating from FileZilla Site Manager

If you are already managing a lot of sites in FileZilla Site Manager you can import them into KeyPass. Unfortunately there is not a direct import option but it can be done in a slightly round about way. KeyPass can import from a generic CSV file but FileZilla does not export to CSV. It does export to an XML file which turns out to be a similar file to the one it has already saved in your computer so you can simply track down that file (you will need to find that file anyway to dispose of it safely). This is stored in the application data folder. On Windows Vista and Windows 7 that file should be located at:
C:\Users\[username]\AppData\Roaming\FileZilla\sitemanager.xml
(for Windows XP try documents and settings/profile/application data/filezilla/sitemanager.xml)

To import this data into KeyPass you can follow these steps:

1. Convert the XML file to CSV. I did this by importing it to Microsoft Access and exporting it as a CSV.
2. Clean up CSV file – remove unwanted columns
3. Import CSV to KeyPass
4. Verify all data has been correctly imported
5. Securely delete all files created in this process (I used sdelete)

Making FileZilla Safe – Kiosk Mode

In addition to storing site manager details in sitemanager.xml, FileZilla also stores the most recent connections in recentservers.xml and the latest connection in filezilla.xml. To stop it from storing any passwords you can put it into what is called ‘Kiosk mode’. This is not a menu option but a hidden feature that must be turned on in an optional XML configuration file called fzdefaults.xml. This will be located in the same directory as filezilla.exe, or if it does not exist you will find a sample file in the docs folder under the FileZilla installation. Just set the value of the Kiosk mode setting to 1 to enable it. If you are creating a new fzdefaults.xml from fzdefaults.xml.example, you can delete all the other settings and data from the file just leaving the Kiosk mode setting.

Then securely delete sitemanager.xml (with something like sdelete) or open it up and remove the passwords. FileZilla will overwrite recentservers.xml and filezilla.xml so those shouldn’t contain passwords anymore (but no harm to check).

PS.: The FTP protocol itself is insecure as it is unencrypted, but by using the system outlined above, it is closing off one more way that hackers can get into your websites.

The rollout of Google Instant started Wednesday in the U.S. and will continue across different regions over the coming months. According to information on Google.com:

Google Instant is starting to roll-out to users on Google domains in the US, UK, France, Germany, Italy, Spain and Russia who use the following browsers: Chrome v5/6, Firefox v3, Safari v5 for Mac and Internet Explorer v8.

It is not yet officially available in New Zealand but if you have a Google account you can try it out if you are logged into your Google account. Just go to google.com and if it changes to google.co.nz scroll down to the bottom of the page and click on the link ‘Go to Google.com’. If you are on the iGoogle page, do an initial search to get to the search page. You will know that Instant is turned on if you see a little message to the right of the search box that says ‘Instant is on’. Just start typing and you should see the search results appear on the page as you type – that’s if it works. In my test it worked initially but then stopped working (the results on the page were no longer being refreshed as I typed). I got it working again by starting over in a new tab.

You can also check it out by watching Google’s promo video:

Google Instant may have ramifications for some websites visibility in searches. As people start to type they will see the results of multiple search queries flash before them and may find something of interest before they have completed what they were originally planning to type. A website that shows up at the top of the results for the full query may not show up on the partial query where the searcher jumped off. It appears to me it that this could have the effect of making shorter keywords more valuable in search engine optimisation.

Another impressive advancement in Google Instant is that it takes personal information into account in the search results, so it can potentially present a different set of search results to different people typing the exact same query. This sounds like it could make SEO more challenging. Some are even making bold claims that this innovation will bring about the end of SEO – Google Instant Makes SEO Irrelevant. But Google’s Matt Cutts in his thoughts on Google Instant assures us that SEO won’t die but acknowledges that it is likely to change:

The search results will remain the same for a query, but it’s possible that people will learn to search differently over time. For example, I was recently researching a congressperson. With Google Instant, it was more visible to me that this congressperson had proposed an energy plan, so I refined my search to learn more, and quickly found myself reading a post on the congressperson’s blog that had been on page 2 of the search results.

1. Think of what someone looking for your type of product/service might type into a search query.
2. Write down a list of keywords/terms.
3. Think of common variations and modifiers for those terms and add them to your list.
4. Examine your website to see if those keywords already appear or find ways of adding extra text to incorporate the most important keywords.
5. Top priority is to make it human readable – you don’t want to turn people away by having your site not easy to read or seeming spammy.
6. The words in your titles and headings are given most importance by the search engines so your most important keywords should be here. The title is meta data and does not appear on the page itself but appears at the top of your browser window and also in search results. Headings do appear on your page and there are a number of different levels of headings – H1, H2, H3, etc. H1 is the top level heading and is given the most importance. Ideally you should just have one H1 heading on your page.
7. Keep the title and the main heading similar, but it is a good idea to vary them a little from each other in order to incorporate different variations of your important keywords.
8. Don’t stuff your titles and headings with keywords – this looks spammy and can dilute the effect of your keywords.
9. Some tools that can help you find important variations on your keywords: Google Adwords Keyword Tool, SEOBook Keyword Tool, Quintura, Google Search Based Keyword Tool, Google.com (click wonder wheel and/or related searches).
10. You can add a new article, page or blog post to your website on a topic centred around some keyword or term that you want to get found for. But don’t make it look spammy or manipulative – write primarily for the real people visiting your website and make sure it sits naturally into your website structure.

.CO is the first truly global, recognizable domain to come along in years. Understood around the world as an abbreviation for “Company,” “Corporation” and “Commerce”, .CO is easy to recognize, simple to remember and flexible to use. It offers international recognition in a fresh landscape where you can still choose the name you want, not just settle for what’s available.

Whether or not this translates into wide-scale adoption remains to be seen. Other alternative top level domains such as .biz and .me haven’t exactly gone on to dominate the web. However .co could potentially be looked at as a shorter version of .com (and we all know how hard it is to find a good .com name these days). ‘.co’ is already is used as a second level domain for a number of countries, e.g. New Zealand (.co.nz), United Kingdom (.co.uk), India (.co.in), Indonesia (.co.id), Israel (.co.il),  Japan (.co.jp), South Korea (.co.kr) and Cook Islands (.co.ck). I can see the potential appeal for owners of these domains as an international version of their domain.

I have already registered sww.co as alternative version of sww.co.nz. I just like the brevity of it – so next time you are coming to this site you can leave out the .nz and save yourself 3 keystrokes!

Google Insights for Search has been around since 2008  but is still in ‘beta’ mode (test mode) – check it out here.

For the uninitiated, a content management system is the administration side of a website that facilitates the management, updating and expansion of the website. There are a vast amount of different systems out there, a handful of widely used ones and there are some web companies that custom build their own systems.  Broadly speaking they can be categorised as:

• Open source CMS
• Proprietary commercial CMS
• In-house custom developed CMS

While there may be some excellent proprietary and custom developed systems in use, open source content management systems are the most widely used and as a result generally lead the way in terms of ‘state-of-the-art’ in features, usability and security. There are a few top open source CMS platforms in particular that are highly active projects in terms of the pace of continual development, improvement and enhancement. Such systems run millions of web sites and on such a scale that any problems are quickly discovered and fixed. Whereas if you compare a custom developed system, it is unlikely to find a pace of development and improvement that comes anywhere close and it is also unlikely for find the same level of available features and capabilities as you would in a top open source platform.

Advantages of Open Source CMS over proprietary or custom built:

• more likely to be an evolved stable platform
• often more refined usability – i.e. easier to use
• usually will have a much wider range of features/capabilities
• easy to find another developer who can work on your website (so you are not locked in to the original developer for future work on your website)
• typically well optimised for search engines
• portable to a wide range of web hosting environments
• generally will cost less because many specific features that you need are already built in or available as plugins/modules and the wide range of options for choosing a developer
• no additional fee for the CMS software itself

Of course within open source there are many different systems available but three of the most widely used are WordPress, Joomal and Drupal. Each of these three are well refined systems with a large community of developers and are continuously improving and evolving at a rapid pace. They each have their own particular strengths and are all great solutions for different situations. There are also a number of other widely used and respected CMSs out there. The bottom line, if you are someone looking to get a website built, is to ask your prospective web developer what CMS they would use for your web site and why. If they propose a custom built or proprietary system, ask why they consider it to be a better fit for your situation than an open source system and compare the advantages they provide with the advantages of open source systems outlined here.

This approach can be used for planning a website – structure, functionality, features, content, business model and what ever else you can think of. While it can be done with pen and paper, a good software tool offers much more flexibility as you can easily move things around, change them and you never run out of paper.

I’ve started using a freely available took called FreeMind for website planning and I find to be ideally suited for the job. It’s a great way to start putting structure on your ideas and – you can keep adding ideas as you think of them, go back and reorganise and fine-tune them.

Here’s a screen-shot of it in action:

So what did I do to get things back on track? Well the thing that did it was to change the lang attribute in the html tag to “en-nz”:

<html xmlns=”http://www.w3.org/1999/xhtml” dir=”ltr” lang=”en-nz”>

This, when set, appears to be the main criteria that Bing uses to determine which region the site should be indexed in. So it looks like it overrides server location and country code top level domain. My lang attribute had previously been set to “en-us” which got picked up from the default settings in WordPress, the platform that my site is built with. After I made the change it took 1-2 weeks before things got sorted in Bing. The interesting thing is that Bing indexed a few of the internal pages before indexing the home page and other more important pages. So we had the strange situation where some of the pages of my site were showing up in the regional search results but the home page wasn’t.

Does this open up the possibility of being able to target different regions with different pages on a website? It appears that way but I’ll have to do another experiment to find out. So here’s the experiment: I’ve set up a page entitled Web Design Ireland and I’ve set the lang attribute to “en-ie” in order to see if I can get indexed in the regional search results for Ireland.

I’ll follow up soon to let you know what happens, it will be interesting to see. If you use RSS, you can follow my RSS feed from http://sww.co.nz/feed.

Aidan,

I’ve brought this up with our indexing team to see if we can find a solution. I’ll let you know as soon as I hear back.

~B

Google is still the King of search and this deal is not expected to de-throne it, but by combining their market share the Microsoft/Yahoo combo will make a more compelling platform for advertiser’s dollars.

Since it’s unveiling in May, Bing has been fairly well received. Personally however, I have no plans to switch. After trying it out a few times, it left me unimpressed with the quality of the search results. Take for example a search for “Nelson web design” (a term I check occasionally to see how sww.co.nz is ranking in local searches). Here are the top 10 search results that Bing returns right now (NZ only search):

No. 1 is a valid result, but nos 2 & 3, both from the same domain, are not at all relevant results. In fact they are just temporary development pages on the nelson.co.nz domain of our partner, Digital Promotions, and the real Digital Promotions website appears much further down at position 10. The nelson.co.nz domain crops up again in position 6, another irrelevant result, indicating an overly heavy emphasis on domain name over content. I count only 6 relevant results in the all-important top 10. Not a very smart result for an allegedly ‘smart’ search engine (or ‘decision engine’ as Microsoft prefers to call it).

Here’s what Google returns for the same search:

Hey, that’s more like it – Stellar Web Works listed at a respectable 5th position (and even finds it’s way to no. 1 in the map results!). This time all ten results are relevant.

So, after this little test my faith in Bing is definitely a bit shaky. But with the recent Yahoo deal it looks like it is going to become part of the our web developer world and something we are going to have to work with from a SEO perspective. And if it gains traction, a bit of competition for the Google monster might not be a bad thing!

The Video Conversion Task

I already knew what tool I was going to use to display the video – since it was a WordPress based website I would be using a WordPress plug-in and from previous research I discovered the awesome WordTube plug-in which I have used on other sites and found to be really excellent for managing and displaying videos on a WordPress web site. WordTube is based on the JW Flash Media Player and so if you have a non-WordPress web site, you can use the JW Flash Media Player. Since this is a Flash based player the format required for the video is the FLV (Flash Video) format. So the video conversion task that we are dealing here with is: Convert a portion of video from a DVD disc to a FLV file.

Step 1 – Get the video off the DVD and into a file on your computer (Rip the DVD)

The problem here is that DVD ripping software has become associated with piracy and has been chased underground by the movie industry. This causes problems for legitimate users. Piracy is big business and there will always be plenty of vendors offering software for this purpose. But since much of this software is already on the fringes of legality you really have to be careful of what you download and install – I’m always wary of the potential for viruses or Trojans embedded in software, so I try to find out as much as I can and make sure the source is trustworthy before installing anything. To cut to the chase, the software I ended up with here was DVD Decrypter 3.5.4.0. This is a tool that was freely until 2005 when the developer was threatened with legal action and decided to cease development of the software to avoid the potential for legal trouble. Fortunately the software is still available through different sources (I found it here). DVD Decrypter did it’s job just fine and what I ended up with was the raw files from the DVD – VOB, IFO, etc. The important file here is the VOB file which is essentially an MPEG2 file (you can change the extension to .mpg and it will play in a media player such as Windows Media Player). With DVD Decrypter I was able to select only the chapters that contained the potion of video I needed but not the exact snippet since it was not contained neatly within a specific chapter.

Step 2 – Convert VOB (or MPEG) to FLV

When I found the Riva FLV Encoder, I thought it was going to be the only solution I would need for this part of the task. As it turned out, it wasn’t quite that easy. One of the input formats that Riva is supposed to work with is MPEG2. So I simply changed the .VOB extension to .mpg and tried converting it with Riva but Riva gave me this error: “The encoding of your video file has failed. This can be caused by a not supported combination of parameters or by a not supported video codec”. So I thought maybe the MPEG format wasn’t quite right. I found a convertor utility to convert from VOB to MPEG and created my MPEG file that way – that didn’t work in Riva either. I finally came across the open source WinFF tool (a GUI version of the command line FFMPEG video conversion tool). It converts between a wide range of formats including MPEG to FLV. Unfortunately, unlike Riva it does not have a simple option in the GUI for selecting just a portion of the source to convert. In Riva you can specify the starting point and duration in seconds which is great if you just want a portion of the original video in your final result. So what I ended up doing was using WinFF to convert the VOB/MPEG to AVI and then used Riva to convert the AVI to FLV.

An improved solution

While the approach outlined above does work, I was a bit concerned with the quality of the end result. Converting to AVI before converting to FLV seemed like it would have a negative effect on the video quality since AVI is a format with a high level of compression and therefore not ideal to use as the source for creating the FLV. So I dug a little deeper into WinFF and its backend, FFMPEG, and discovered the command line options –ss and –t which allow one to specify a start point and duration as in Riva. However, I discovered the seek option (-ss) didn’t work right on VOB files so I ended up converting to DV format first and then converting from DV to FLV with the –ss and –t options to select the desired snippet from the video. I choose the DV format because it is a high quality format and the extra step did not have any noticeable effect on the end result.

Summary of steps and tools I used to convert the DVD for viewing on the web

1. Extract the DVD files to hard drive: DVD Decrypter 3.5.4.0
2. Convert VOB to DV format: WinFF
3. Convert DV to FLV and extract the desired video segment: WinFF (with -ss and -t command line options)
4. Display the FLV on website: WordTube (for a WordPress web site) OR JW Flash Media Player (for any other type of web site)

I know there are many other ways to accomplish this task but one of the nice things about the solution outlined here is that it does not require any expensive software – all of the software I have listed here is free software and it gets the job done.

1. Third party payment gateways
2. Your own business merchant account

Third party payment gateways

These do not require you to set up a special merchant bank account. As a result they are quicker and less expensive to set up. For these type of systems the checkout takes place on the 3rd party web site and the name of the third party provider will appear on your customer’s credit card statement. The funds go into the third party’s account and afterwards are transferred to your own bank account. Paypal is the most widely used 3rd party payment processor. Other examples are Worldpay, Paymate and 2checkout. Google also provides one called Google Checkout but it is not yet available for New Zealand businesses (currently only available in USA and UK) [UPDATE: Google checkout is now avaliable in NZ].

Your own business merchant account

A merchant account is a special bank account that allows you to receive credit card payments. A regular shop that takes credit cards will have a merchant account. For internet payments, a special type of merchant account is required; it is called a ‘card not present’ merchant account. Usually the fees for this type of merchant account are higher since there is more risk of fraud. Most New Zealand banks can provide merchant accounts. In addition to having a merchant account you also need a payment gateway. The payment gateway acts as a ‘middle man’ between your merchant bank account and your web site to securely complete the transaction. With this type of system you usually pay fees to both the bank and the payment gateway and there are usually setup fees involved. You will also need to go through an application process and meet certain standards (e.g. business credit history) to qualify for a merchant account. For these types of systems the checkout can take place directly on your own web site (although the payment gateways typically also provide an option for doing the checkout on their web site). Examples of payment gateways that can be used with New Zealand merchant accounts include DPS, ANZ eGate, Paypro, Paystation and BNZ Buy-Line.

Not Sure Which To Choose?

Having your own merchant account will provide a smoother customer experience at the checkout because the customer does not have to get taken to a 3rd party web site. However, if your sales volume is on the low side, your costs are going to be significantly higher and you will have fixed costs regardless of whether or not you make any sales. This is why many new online businesses choose to go with a third party processor. Of the third party processors, Paypal is the most popular because they tend to be the most competative with their charges and they are widely known and understood by online shoppers. If you expect low sales volumes or are uncertain of the volume of what sales volumes you might expect Paypal is good option to go with. If you are more confident of of what you expect to turnover, you can do some maths and do a comparison of costs based on your expected sales.

I have put together a document containing a matrix of the different options (both 3rd party and payment gateway/merchant acct.) available in New Zealand:

Payment Gateway Options [Word Document]
NOTE: This was last updated in Feb ’09, so please check websites for up-to-date information

At Stellar Web Works we specialise in building web sites on content management systems. We have worked with a number of different content management systems and have come to favour using the popular WordPress platform as our CMS of choice. WordPress is well known as the most widely used blogging platform but what is less well known that it is also an excellent general purpose content management system that makes a great platform for building a wide variety of web sites. WordPress, built with the PHP programming language and MySQL database platform, is very extensible and can be customised to add any special functionality and features that a web site might require. Here are some of the reasons why we think WordPress is a great choice for a CMS:

• Easy to use – the administration interface is logical and intuitive. Even a person with very limited computer skills will have no problem using WordPress to update and manage a web site.
• Search engine friendly – WordPress provides the tools and features that can be used to build a web site that is well optimised for search engines
• Powerful extendible platform – WordPress is designed to be customised and extended by means of building ‘plug-in’ components that can add functionality to cater for the specific needs of a particular web site
• A mature stable platform – WordPress has undergone more than 5 years of active development with new and improved versions being released on a regular basis
• Large active developer community – Many developers create and make available plugins that add new features to the platform so for many special web site requirements, chances are that a plugin has already been created to handle it
• Full flexibility of design and layout of web site – WordPress has a very flexible templating system that allows the web developer complete freedom in designing the web site.

A list of web design companies in Nelson, New Zealand

Stellar Web Works

Your best choice for web site design and development in Nelson (yeah of course I’m biased;), but seriously, do give us a look if you’re after professional results at affordable prices)

Baby-e

One of our partners, Baby-e is the web design company of Leon Dalziel. Leon has a flair for design. We work together on many projects.

Digital Promotions

Another close partner of ours. Digital Promotions do a lot of accommodation web sites. We have worked together on a number of sites. They specialise in an Apple based content management system called Manila and provide hosting for it.

Bounce Marketing

Bounce Marketing, the company of Katrina Lambert is also a partner of ours. Although not exactly a web design company, it is a company that can help you promote your web site, drive traffic to it and get results from it.

Andy McCubbin

Freelance web designer/developer who I’ve collaborated on projects with.

Graphic Flavours

Web site design by Ayelet Fleming. I’ve worked with Ayelet on a number of projects.

DevelopMental

The company of Nelson based developer, Steve Bryant, specialising in website and windows application development.

SunRoom

The web team of Charlie & Melissa Evans along with Michaela Blackman. Friends of SWW. Specialising in sites and e-commerce solutions built on WordPress and Magento.

Lucid Design

Lucid Design is a graphic and web design company founded in 2000 by Galen King. Lucid Design moved it’s base from Golden Bay to Nelson in 2009.

Nimbus Advertising

Nelson based advertising agency headed by Dave Knight and Jo Williams and offering web design as one of their services. SWW has collaborated with Nimbus on one of their web projects.

Thadeus Creative

Web and graphic design by Steven Hussey. I’ve developed a site based on one of Steven’s designs.

Cactus Software

Web site design and development and custom software application development

Blueflowers web design

Web design company of Mariska Noordik & Mike Widdowson based in Rai Valley

Hothouse

A larger agency that do web design, marketing and branding

@ web one

Two web design businesses, Peter Lowish Internet and Internet Specialists, joined together to create this one.

Sprocket Web Design

Web design company of Duncan Heal

Avoca House Design

Web design company run by Brendyn Montgomery (who is also an award winning traditional Irish musician that you can catch playing on Wednesday nights in the Free House)

Site Productions

Web design company of Rick Coleman based in Mapua

Web Kiwi

Web design company of Adrienne Ford

Net Maestro

Web design company run by Gareth Lawes

Seafront Web Design

Web design company of Wendy Whitehead in Ruby Bay

Purple Oar Software

Web site design/development company of Paul Roper

Dry Crust Communications

A Richmond based publicity company that offers web design as one of their services

Fig Tree Design

Wendy Alessi’s web design company, Fig Tree, specialises in the design and development of gorgeous websites for small to medium sized businesses.

Website Revolution

Web design company of Maggie Sweetman, specialises in Flash websites.

Downing Design

Nelson based web design, graphic design and advertising, run by Tony Downing.

However, if you do not have any experience with getting a website set up and/or little or no technical knowledge of the workings of the internet, you’ll probably struggle with how to evaluate a web designer. The purpose of this article is to give you some ideas of what to look for in a web designer and to get you thinking about matching up a web designer with your own particular needs and requirements.

Questions to ask a web designer

• What technologies do you use to build websites? e.g. static HTML, HTML templating system such as Dreamweaver, Content Management System, server side scripting languages
• Will I be able to make updates to the website myself without any special technical knowledge?
• What is your process for designing and building a website?
• What is your approach to search engine optimisation (SEO)?
• Do you provide training for managing the new website?

Questions to ask yourself about a web designer

• Does the designer design sites that are intuitive and easy to use?
• Does the designer do a good job of visually showing visitors how to take action?
• Do they explain issues in a way I can understand?
• Does the designer have the range of skills needed to build the website that I require?
• What credentials and experience does the web designer have?

Comparing pricing from different designers

Does the price represent good value for my money? Keep in mind that a well designed website for your business is an investment that will pay for itself many times over in sales, while a poorly crafted site will drive away potential customers. A cheaply put together website may seem like a bargain at first but in the long run it may damage your business.

Price and quality often (but not always) have a direct relationship, i.e. you get what you pay for. Designers who are overly inexpensive often lack experience, don’t understand much about online marketing, or don’t truly have a grasp of good web design techniques. A website from such a designer may cost your business dearly in the long run.

When comparing quotations from different design firms, be sure to look carefully at what each designer is offering for the quoted price. Examine their portfolio to see what type of work they produce and ask to speak to some of their clients.

Consider too what happens after the website is built, who will maintain the site and keep it up to date and fresh? What type of analysis will be available for evaluating the performance of the site?

A poorly designed website can cost you money, drive away customers, and hurt your reputation.

Oh, and by the way, if you are looking for a creative, technically savvy, and cost-effective designer, check out Stellar Web Works!