Watch out: “Share this” plugin monitors your blog and your visitors

Alex Günsche · January 29, 2008

The popular “Share this” WordPress plugin monitors your blog and your visitors. Each time a visitor calls a page of your website containing the Share This widget, they will download a so-called webbug. It’s the image at the bottom of the Share This widget.

Although the unique identifier of the webbug is generated randomly (something like 775e8ba2-8ea3-48a9-a071-6ebdd986d676) on your blog at the first usage, the sharethis.com server (from which the image is loaded) is able to associate your site with this unique identifier by the HTTP referer a browser sends. Therefore, using similar techniques as e.g. Google Analytics, sharethis.com is able to see how many visitors you have and which of your pages they viewed. In my opinion, this is quite insolent, as it massively invades your and your visitors’ privacy.

How can you protect yourself from this? You need to modify the file share-this.php from the plugin. The easiest way is to simply delete line 702 (in “Share this classic”, v1.5.1) where the image code is generated:

<div id="akst_credit"><a href="http://sharethis.com"><img src="http://r.sharethis.com/powered-by?publisher=<?php print(get_option('st_pubid')); ?>" alt="Powered by ShareThis" /></a></div>

Another option would to beat sharethis.com at their own game: Replace (also in line 702) get_option('st_pubid') with ak_uuid() (their internal function to generate the unique identifier), thus messing up their database. ;) Just kidding — just remove the code as described.

Update: Looking a bit deeper into the plugin, I realized that it’s not only a webbug that the plugin loads, but also, each bookmarking is redirected to sharethis.com’s server! This means, whenever somebody clicks a bookmarking link, they are first sent to sharethis.com’s server and then redirected from there. You can overcome this, too, by a little modification: Change line 304 of share-this.php (in “Share this classic”, v1.5.1) to return base; — then you and your visitors are taken to the bookmarking service directly.

Update 2: More occurences of the offending technique are on the page which Share This displays when JavaScript is deactivated. Again, each bookmark link redirects to sharethis.com first, and the image in the footer is a webbug. To disable these items, change line 1132 in share-this.php to print('<li><a href="'.$link.'" id="akst_'.$key.'">'.$data['name'].'</a></li>'."\n"); and remove the footer (some lines deeper).

AfLinks-Plugin: Affiliate-Daten in WordPress-Beiträgen

Alex Günsche · January 16, 2008

Auf contutto.com gibt es jetzt das AfLinks-Plugin. Das AfLinks-Plugin versieht den Content von WordPress-Beiträgen mit Affiliate-Links, d.h. bestimmte Schlagworte im WP-Beitrag werden mit Werbung versehen. Fährt man mit der Maus über einen solchen Link, erscheint eine kleine Vorschau mit Bild und Beschreibung. Die Links werden von der Software entweder vollautomatisch erzeugt, oder man kann Produkte über eine zus. Suchmaske im WP-Editor auswählen und manuell verlinken.

Die Affiliate-Daten stammen aus dem Account des jeweiligen Webmasters bei Affili.net. Der Import erfolgt halbautomatisch über ein Script, er kann auch per Cronjob vollautomatisiert werden.

Vor allem interessant dürfte dieses Plugin für die Betreiber von Artikelkatalogen sein, die damit den betreuten Content besser kommerziell verwerten können. Aber auch für andere Webmaster, die etwa dezente Werbeformen suchen oder vielleicht nicht viel Platz für Banner haben, ist dieses Tool geeignet.

Das AfLinks-Plugin ist OpenSource (GNU GPL) und kann kostenlos von der Contutto-Website heruntergeladen werden. Demo und Doku sind ebenfalls vorhanden.

Codelog theme released

Alex Günsche · December 19, 2007

Usually, plugins are my business, but now I’ve also released a WordPress theme. Of course, it’s not the first WordPress theme I’ve developed, but it’s the first that I have revised to release it as generic theme. More information and download at codelog.net.

Advanced Search 2.0 (really!)

Alex Günsche · November 14, 2007

Unbelievable – it took more than one year from version 0.1 to the 1.0, which we released yesterday. But I have dedicated the last 24 hours to proceed coding on the Advanced Search, and so much has been changed that a jump to 2.0 seems justified – even if only a single day has passed since the last major release.

What exactly has been changed? Well, I was working on the upgrade of Advanced Search Lite which was actually a quick’n'dirty ripoff from Advanced Search. I started again to rip the code from the new AS to make the new AS Lite, when I realised I could as well merge them and have two plugins in one. For me this would mean less duplicate code to care after, for the user it means that they have more choice along with a slimer code base.

And so I merged Advanced Search and Advanced Search into one plugin download. They appear in the Plugin panel as two separate plugins. One can use either one or the other or even both at the same time. Also, there were even more features added: Blog visitors can now switch between searching strings or words(!), WP’s internal search can be transparently replaced with the FULLTEXT (i.e. word) search, and Advanced Search Lite can now also be used as a widget.

What do you think, is a 2.0 ok for this? I definitely think so, and I even dare to say that this is the bestest search plugin for WordPress evar, which everybody should have on their blogs. You heard me! ;-)

So, what are you waiting for? Visit the Advanced Search page, download it and enjoy searching 2.0 (no beta!).

Advanced Search 1.0

Alex Günsche · November 13, 2007

Good news everybody! I’m happy to announce Advanced Search version 1.0! Not only is this version finally compatible with WordPress 2.3.x, but it also has been profoundly revised and cleaned up, a good number of bugs have been fixed, and it has a couple of shiny new features.

The most interesting feature is that you can now use the search form in a truly modular fashion without digging in the code: In the new config file settings.php, you can turn each section on or off. For example, if you have many categories and you don’t want people bothering with switching categories (not to talk of long loading times), you can simply turn this section off.

So, grab the new version and install it. And: don’t forget to spread the word! (Many people have requested a new version, not all are subscribed to this blog.)

Unfortunately, there are bad news, too: As a side effect of the cleanup, the plugin doesn’t work with the legacy series 2.0.x of WordPress anymore (on which this site runs, too). But version 0.6 should still do the job for us, and it will stay available for download.

By the way, the new version of Advanced Search Lite is in the making.

Update: Within a mere day, there was a version jump to 2.0!

About plugins

Alex Günsche · October 27, 2007

Dear users of my plugins,

I know I haven’t updated my plugins for a while, even though some of them desperately need updates and although I have some very cool features on my TODO list. The reason is that I’m currently involved in a very big project, and this one really consumes pretty much all of my time and coding energy. That project will be finished by mid of November, and I promise that I will then start working on my plugins again and release a bunch of new versions. I hope you understand that, and I hope you’ll have some more patience. Thank you very much (in advance)!

By the way, my site seems to have a PR of 6 now, and I owe it all to the nice people who are writing nice comments about my plugins on their blogs. Thank you very much (again)! :)

Little Downtime tonight

Alex Günsche · October 17, 2007

Tonight, Oct. 18th at about 4:15 am, the Zirona I server will be shut down because of maintanance in the data center. The work is estimated to take about three hours. During this time, no services like e-mail and web will be available. After the maintenance works, the server is supposed to start up again automatically. It is however possible that there are complications, and it is also possible that they take the entire day or even more to be solved.

Even though downtime is always unpleasant, there’s no reason to be too sad: At least this server will have run more than 373 days untill this “forced” shutdown. This is an very impressive figure, and one shouldn’t take it for granted — it’s more that there are some important aspects that allowed the server to run such a long time.

screenshot of uptime command: 373 days

  • Although the webhost Hetzner did have two severe network problems this year, the servers kept running, which is an indication that Hetzner managed to solve the power issues in the data center (ironically, a power failure was the reason for the last showdown of this server), and the hardware seems — at least in the Zirona machine — not to be as bad as it’s sometimes said of Hetzner.
  • Furthermore we can be happy, that the server was not compromised a single time during it’s now two years of usage — although there were a number of attacks, luckily every single of them could be averted. This is mostly due to the Linux system (to be precise: Hardened Gentoo in our case), but also due the other server applications like Apache, Postfix, Courier, MySQL, vsFTPd, and last but not least to often critisized web applications such as WordPress, Joomla, phpBB and osCommerce. You see, security has a lot to do with clean configuration and regular upgrading (though by far not only).

Therefore: Let’s hope for successful maintenance, a healthy re-awakening of the server tomorrow morning, and for the next uptime rekord!

P.S., 18.10., 11:04: We had a little hickup after the restart due to network rearrangements, but now everything runs fine again.

Spam and Mailserver Configuration

Alex Günsche · August 21, 2007

Due to massive spam attacks, I had to reconfigure our e-mail serive and integrate some additional restrictions. Also, we now use the blacklist of spamhaus.org; even though this organisation called attention through rowdily and arrogant behaviour, they do offer a very good antispam service.

In case you encounter sending (legitimate ;-) ) e-mail to Zirona or other domains on our server, please notify us through our contact form. If you do so, it is important that you provide as much information as possible. In case you got an error message, please attach that message to.

Private Blogging: Regular Impressions

Alex Günsche · August 15, 2007

I’ve got a new private blog, Regular Impressions. It’s German, so it won’t be of Interest for non German readers, and I don’t need to translate the entire blog post. ;-)

ContactNG 0.1 – final release

Alex Günsche · July 16, 2007

ContactNG is a new generation of contact forms. You can display it in the sidebar or on a page. There are different skins which can be selected via the admin panel. Furthermore, the plugin features some intelligent antispam techniques. Tutorial, further information and downloads are available via the plugin’s homepage. Have fun! Feedback and improvement ideas are as always very welcome.