So I make it through the renewal process, which required generating a new CSR (Certificate Signing Request) for a brand new certificate from the server since the original one had a bit length of 1024 and GoDaddy only accepts 2048 to 4096 bit lenghts (this is a new requirement). After completing the process and getting the certificate installed, I got a nice helpdesk call from a user this morning who has a Centro: “SSL certificate not accepted due to possible expiration.  Check device date & time and re-sync.”

Joy oh joy, exactly what I’d been looking for, another problem and wasted time!

OK, enough sarcasm (but really, can you ever have enough?). Time for Google and Daryl Hunter from the Church IT Roundtable! Although GoDaddy auto-renewed my SSL certificate, I was actually contemplating buying one of their UCC certificates to be ready for when we went to Exchange 2007. Fortunately I read Daryl Hunter’s post about Exchange 2007 without UCC certs, and stuck with the regular certificate for now, because per Palm KB article 43375, certificates with Subject Alternate Names (SANs), such as UCC certs, are not supported at all on Palm devices (“SSL v3 certificates which rely on the Subject Alternate Name field to do load balancing across virtual site names do not work with Palm OS devices.”). So a UCC cert isn’t even an option for me, but it’s cheaper to do Daryl’s method anyway! For now I don’t have to worry about it, since I just have Exchange 2003 for now, and that’s not the present issue (but we will likely be on Exchange 2007 or Exchange 2010 by the time the certificate expires). Additionally, the same article (which has a tool for installing new trusted root certificates on some Palm OS devices–but I didn’t want to mess with touching every single Palm OS device here! And, the tool works on Windows 2000 or XP only, not Vista (and I’m sure not Windows 7 either)) specifically states that, “GoDaddy Class 2 certificates do not work with Palm OS devices.” Time to drop GoDaddy!

Daryl’s favorite SSL certificate vendor (and now, mine too!) is RapidSSL Online. They sell certificates from RapidSSL.com for $17.95 per year (or cheaper, for multiple years), and they’re single root certificates (which menas you don’t have to install intermediate certificates on your server). While RapidSSL Online is cheap, RapidSSL.com directly has a 30 day trial certificate you can sign up for to test for a month, and this is the way I went. When that certificate expires I’ll be purchasing a multi-year certificate from RapidSSL Online, but I wanted to make sure it would work, and it does! I don’t know for sure, but it appears that RapidSSL.com is the company holding the root certificate, while RapidSSL Online is either a reseller or a sub-company of the parent selling the certificates at a discount (the RapidSSL.com certificates aren’t expenive but still cost a lot more than from RapidSSL Online!). Either way, RapidSSL Online claims that their RapidSSL certificates are issued by RapidSSL.com so they should be the same (I haven’t made a purchase yet), and Daryl Hunter has used RapidSSL Online successfully for years across multiple installations.

I generated a new CSR for a new certificate, again (just like I had to do for GoDaddy). I installed the free certificate on my Exchange server’s IIS (I also then exported it and imported the .pfx file onto my ISA 2004 firewall since it does the authentication up front for external clients, but that’s a pretty unique case and in most cases you want this done on the Exchange server). They were right, it’s just a single root on the certificate, signed by Equifax! I had my Palm Centro users (two had complained by this point) try syncing again. It worked! My iPhone also works fine still, and I haven’t had any negative reports from the four Palm Pre users here either. None of my users have Windows Mobile, and my one Blackberry user connects though Blackberry Professional Server rather than with ActiveSync.

So, adios GoDaddy SSL; fortunately they will refund all but $15 of my certificate (for processing since it was issued), and I’ll still come out ahead with RapidSSL Online (GoDaddy was $60 for two years, while RapidSSL Online is only $70 for five years!).

One thing I’ll have to be careful of when I go to Exchange 2007 is that once I use Windows Server 2008 to generate the CSR, it appears I will need to go to extra pains to make sure the CSR is in Printstring format instead of UTF-8, as Palm OS doesn’t support UTF-8 certificates either (Server 2003 uses Printstring by default). Daryl located this useful post while helping me troubleshoot: Ranting about Palm Centro Versamail ActiveSync and SBS 2008. Useful info, I’m sure I’ll be going back when it’s time to renew next time and Server 2008 is in place. By then, I hope we are Palm OS-free; although I loved my Treo 600 and Treo 650 both, the web is littered with forum and blog posts from people who have SSL issues with Palm OS devices (the Palm Pre and Pixi are much more flexible and up-to-date with the Palm WebOS). I was happy GoDaddy “just worked” in the past, frustrated that they “just didn’t work” this time, and happy to save money and move to a company that’s quicker/faster/easier!

I have a few things I’d like to publish here that won’t fit on Twitter and will be easier to reference here than on IRC where I still may have discussed some of it already (in the #citrt channel). Now to find the time! Hopefully soon. Poor neglected blog… :-) Maybe with such a cool new backend I’ll post more often. Not that I posted at all while running the betas and release candidates…

If you don’t use a podcatcher such as iTunes to subscribe to podcasts, you can subscribe in Google Reader and stream episodes from your web browser, in addition to just downloading the MP3 file from the JesusGeek post directly.

The interview was complicated by a few connection losses while recording, so if the audio sounds awesome John gets the credit for making it work anyway, and if it has any issues, blame me! I also lost my notes about which WordPress plugins I was going to talk about in my XP-to-Vista conversion on my laptop and didn’t realize it until we were recording, so that was a bit more off-the-cuff than I had intended. Live and learn!

Austin, in his comment, links to an article in Scholoarpedia on Synesthesia which I begin to read and find rather interesting. However, as I get down to the “Top down and contextual effects” portion of the article, I notice that there’s a sentence with a typo in it, specifically “The second experiment (6) used an ambiguous grapheme (‘A’ or ‘H’) embedded either in between ‘T’ and ‘E’ (as in ‘THE’) or between ‘C’ and ‘A’ (‘CAT’).” If you notice, at the end there, the ambiguous grapheme as an ‘A’ really is between ‘C’ and ‘T’, not between ‘C’ and ‘A’ as the sentence states (this makes more sense looking at the image provided in the article to illustrate).

Now, I was feeling generous and figured, hey, why not mention this to someone at the site so they can fix it? Actually, my first thought, being linked into the middle of the article, was “I already have a Wikipedia account, I’ll just fix this for them real quick.” Of course, they use the same MediaWiki software and default theme (hence the confusion, especially when linked to an anchor within an article), but Scholarpedia is not actually Wikipedia, as I quickly infer (and I haven’t had a scientific paper with a model named after me published with over 250 hits in Google–yet, if ever–so I can’t create an account). No problem, I’m sure there’s a contact form around. Nope. I can’t find one, anywhere on the site. Well, I just noticed the only email address I’ve run across on the site, suggestions @ scholarpedia.org, hidden away on the detailed requirements for authors page. No useful information on the About page, or the Help page. Oh wait, on the Instructions for authors page, it does have a random other email address, for a specific person. But they seem pretty much of the opinion that if you aren’t a famous scientist, you have no need to contact them about anything. Ironically, their Copyright page even says to “Contact Scholarpedia for copyright details.” Without mentioning a way to do so.

Oh well, maybe I’ll grab those two random email addresses I found and send them a quick note. If I get around to it; they can certainly find it here if they bother to look. I guess sometimes it takes is someone who graduated high school after being homeschooled to find the errors the super-genius scientists miss… ;-)

Thus ends this rant. Thanks, I feel better now. School 100% complete for the semester as of a very short time ago, so I’m quite happy to work the hot-air typing muscles for a few before getting to bed later than I should, again (but the exam got completed and submitted!).

Before you critique:

• Yes, the header image of our building (a holdover from the old site) will be replaced. Some areas already have new headers, we’re just waiting for the rest to be finished up.
• Most (if not all) of the pages, including the homepage, are valid XHTML. We checked.
• The sermon podcast feed is coming, we’re working on some technical details of the iTunes listing first, and I already took care of some of the technical issues of FeedBurner redirection (FeedSmith plugin required a few tweaks to forward a separate podcast feed).
• Print stylesheets are on the to-do list but aren’t implemented yet.
• Extended upcoming event information has yet to be entered.
• Some people listed on the site need to be hyperlinked to contact info. I’m researching the best way to do this without exposing them to spam scrapers, whether a contact form or perhaps a solution based on this email obfuscation article. There’s also this WordPress Plugin, which I like but have a few issues with. A combination of the two sounds best; whether I’ll leave this up to someone else or try and tackle it myself I’m not sure of.
• I’d like to add some Microformat markup in several places, using the hCard spec.

I’m sure I’m forgetting some things, but I think we have a pretty good foundation. In addition to the above finishing touches, we can now refocus our attention towards doing something about the Lakeview Worship site, desperately in need of equal attention but still the home of our excellent new worship CD, not that I’m biased or anything :-)

And thus 2007 comes to a close, with a not-so-subtle nod to HTML/XML closing tags. Which is fitting; I’ve spent a good chunk of time with the church websites this past quarter. The results aren’t public yet, but things are moving along. (There’s a poll to take at the end of this post, for good readers who make it to the end or bad ones who skip ahead ;-)

The past week and a half have been very relaxing. My in-laws came around Christmas, and are back through tomorrow. It’s been good to see them, and my son is enjoying getting to know them a little since they live 2.5 hours away, and his long-term memory isn’t all that great yet! He turned one last week, and immensely enjoyed his banana bread “cake,” some of the most sugar he’s been allowed to eat.

I’ve had less time to spend online than I’d planned, and the time I did spend was primarily reading, learning, and helping a friend get his website up and running (he used to be Lakeview’s Media Pastor, now he’s a professor and runs video production company Media 21 on the side). I also spent some time reading through WordPress core source code and Trac. I was able to submit two or three small patches that may or may not make it in some form into WordPress 2.4, coming out in January! I also updated most of my WordPress installs, including this blog, to version 2.3.2 within seven hours of it being released this past Saturday.

WordPress Babblings

Why the focus on WordPress? Well, I calculated recently, and I’m actually involved with (running myself or set up for work or family or friends) twelve WordPress installations right now! This blog runs forty WordPress Plugins, and some of those I use on the other installs as well! I’ve been having a lot of fun working with WordPress from the technical side, but this past semester, as I’ve mentioned, I had a Technical Writing class that pretty much took all of my writing creativity, resulting in my lowest monthly post count ever in December! I thought when the semester ended I’d be right back in the saddle here (and I managed a post or two), but it turns out I needed a break!

If you’re interested, here’s an approximation of what those twelve WordPress installations I mentioned are:

• This blog (1)
• My son’s blog (1)
• My wife’s blog (1) (now about obsessions and compulsions! Some of which I share, or at least strongly approve…)
• Pastor Nathan’s blog (1)
• Blogs of a missionary from Lakeview and a Director at the Indiana Assemblies of God District Office (2) (still somewhat in development)
• Two WordPress-as-Content Management System installs for Lakeview, not public yet (2)
• Media 21 website for Rob Price (1)
• An inactive install at one of my domains for testing (1)
• An old blog I ran for a while a few years ago (1) (Don’t you wish I’d give you a link? It’s not hard to find!)
• An unofficial blog for my homeowners association (not turned over to residents from the builder yet, can’t get enough people out to the meeting to vote! Hence blog!) (1)

That makes twelve! I may also get around to setting up an internal WordPress installation for our intranet, which is how I got started with WordPress for the church in the first place but of course, the intranet got stuck on the back burner!

I’ve promised in the past that I would post about the work I’ve been doing on the church websites and converting them to WordPress. As you can see, I’ve been doing a lot more with WordPress than just the church, and I’ve discovered a lot of tips, tricks, plugins, and all kinds of WordPress stuff, and a lot of general website stuff as well! I know some Church IT readers are interested in this kind of thing, as they are involved with or are responsible for their own church websites. Others probably don’t care in the least! I don’t want to overwhelm readers with WordPress and websites, but I’m curious how many of you are interested.

Why have I not written much about WordPress until now? Like I said, I haven’t been sure how many of you would be interested. Also, I kept finding new information so fast I didn’t have time to post the old. And I wanted to provide some context first; I want to start at the very beginning. (“…a very good place to start. When you read, you begin with A B C.” Oh wait, this isn’t the Sound of Music! :-) Anyway, I want to start at the beginning and describe the reasons for choosing WordPress, what the catalyst was for the project, what steps we’ve been taking, what’s changed as the project has continued (another reason not to post, things keep changing!), and then get to the meat like plugins and links and implementation. I haven’t had the time to fill in the high level stuff yet, so I’ve skipped jumping in in the middle! Another good reason to hold off is politics. Not the presidential election, as interesting as that may be to some, but a church website at a larger church has reach among many areas and departments, and while the sailing has been more smooth than I could have hoped for on a project of this size (really! I have awesome coworkers!), there are always bumps and friction when working with others and I don’t want to publicly vent or air dirty laundry.

End of the year…and more WordPress Babblings

This is the part where I say Happy New Year! And also where I ask you to vote for how much I should talk about WordPress and websites here in 2008:

(Poll coming here as soon as I get the darn plugin working correctly! Sorry!)
There should be a post tomorrow as well; as they say, when one tag closes, another opens! :-D

In this photo, the three guys around the table on the left (left-to-right) are Matt Bradshaw, a desktop support technician, and Brian Slezak, all from Church of the Resurrection. These guys either develop for their website or have recently, and I got to chat with them at a techie level about website development (not design!). We talked about different backend CMS options (CMS in this case is Content Management Systems, not to be confused with CMS meaning Church Management System, which apparently has been around as that acronym for twenty years and isn’t officially changing to ChMS any time soon per some Roundtable discussion Wednesday afternoon!), and we also shared some stories about some vulnerabilities we’ve had exploited on our websites for various nefarious purposes in the past and how we discovered and dealt with them.

In our afternoon Roundtable session, we discussed spiritual issues surrounding Church IT departments, which I didn’t end up with many notes on. We moved on to Church Management Systems, which had some useful information but my few notes are not in an easily digestible format. In our room, three churches currently use Shelby, two use ACS Technologies, and we had one user each of Fellowship Technologies and Microsoft CRM (which has been heavily customized). This provided some fodder for both theoretical and practical discussion about each system, but I think we were all about ready to wrap up after a long day of discussion and thus this was probably a little less informative than it could have been, but there were a few new gems of knowledge I gleaned. This is one area where I think the vendors in the room should probably have been allowed to participate rather than just observe, because we had vendor reps from Shelby, ACS, and Microsoft CRM (or an integrator of this one) in the room and the systems are sufficiently complex that they may have been able to provide additional information. Oh well, they are great folks to talk to outside of the Roundtable format and I think everyone is making great connections and relationships with the vendors and the attendees.

We moved to the main meeting room after the afternoon Roundtable and got to hear for 30 minutes from Rev. Adam Hamilton, COR’s Founding and Senior Pastor. It was very informative hearing from his point of view, and several people had some very well thought-out questions to ask him afterwards. Around his talk, we watched a leadership video and an awesome, hilarious movie about Facilities Managers (“FMers”) created by I believe the COR facilities manager. It was sooo stinking funny! About 90 laughs per minute! There was another similar video earlier today as well, just as funny. The best part is that everything in the videos about FMers applies just about equally to ITers, which I’m sure made it extra funny for all. We had a half-hour break after this and then it was time for a great dinner at 6:00 from a local BBQ joint catered to a room down the hall, sponsored but I don’t know which vendor paid this time.

7:00 brought a worship service and sermon from Clif’s wife and the band from her church plant, which were excellent. At 8:00 they opened a room (until 11:00 pm at the latest) for hangout and open discussion, where I stuck around for 15-20 minutes and then caught a ride back to my hotel again from Dean Lisenby and Josh Wyse from ACS (thanks Dean!), where I am writing most of this post.

Going back to this morning, I can’t forget to mention that Jason Powell lost his Roundtable name badge and had to make a “fake” one for himself. He was razzed first thing this morning, and he was kind (apparently I said “king” rather than “kind” when writing this post late last night, so let me clarify: JP is cool, but not king :-) enough to post for a photo just so I could blog about it!

In other news, back on the home front I ran into an issue back at Lakeview today: I let the SSL certificate expire for our OWA webmail (which also is used for RPC over HTTPS in Outlook, and by our Treos with ActiveSync). So I spent part of the afternoon Roundtable remotely accessing the Lakeview network and working to resolvethat situation. Technically, the certificate didn’t expire, the renewed certificate was just never updated on the servers. This was for a variety of reasons, the main ones being that it fell off my priorities list with everything else going on, and also I didn’t have the username/password information handy for that account and didn’t find the time to track it all down with all the steps that will likely require. I have a temporary solution halfway in place now (everything but some Treos are working again) that I have to tweak tonight before I go to bed (also known as right now), and it should give me the time to deal with the original problem in the next few weeks. I won’t get into the details for both security reasons and because I’ve spent enough time recapping today already!

PassPack gives you a free account (did I mention it was free?). You create a user ID, a passphrase, and a Packing Key, all distinct. PassPack creates an encrypted container using your Packing Key, which is encrypted on your web browser using JavaScript and standards-based encryption. Only this encrypted “bundle,” without your Packing Key, is then stored on the PassPack servers. Want a password? Log in, enter your Packing Key if it’s timed out (5 minutes by default, up to 15 minutes), find the relevant account alphabetically, by tag, or search (all very Web 2.0 and AJAXy-smooth), and click it to…reveal your login name and a scrambled-looking (unreadable) password field. Click in this field and use the Ctrl+C keyboard shortcut to copy the password, and paste in to the site in question (URL also saved as an option to make it easy). This means the password never appears on the screen, it’s just stored directly in your clipboard, and you don’t have to retype it.

So you can copy and paste the password, so what? Well, they also have an auto-login bookmarklet you can save in your browser. Save the URL of the login page along with the password at PassPack, and then just click the Open and Login link within PassPack to open the website in a new window. Then, click the “PasssPack It!” bookmarklet you previously set up. If the site has been “trained” before (even by another user), it fills in the username and password fields and clicks Login to get you into the site! If it’s not been trained for this site, you are walked through a very simple process of clicking the bookmarklet, clicking the username field, then the password field, then the Login button to train the system. So far out of about twenty sites, only two have had issues and not been trained successfully (a Plesk 7.5 dedicated server control panel and the ZoHo group of sites, including the Church IT Podcast Wiki, were the malfunctioning sites, which have been reported to PassPack); these can still have their login information memorized like any other account, on- or off-line, they just won’t auto-login with the bookmarklet.

The folks at PassPack have implemented a few other nice features besides the slick and speedy interface and somewhat novel readable-only-by-you encryption scheme:

• They have a nice anti-phishing setup in place to prevent your PassPack credentials from being phished easily.
• If you keep the site open, it functions offline and can be saved to their server the next time you connect (it also auto-saves if you don’t disable this option).
• One-time keys are available for you to print out and carry with you. If using a public internet terminal, log in to PassPack with one of these one-time-use keys, and copy-and-paste the scrambled password you need. Then you never have to type a usable password into the insecure computer (for PassPack or the target site).
• Export and Import of your data, in unencrypted format, if you wish to switch between other password-saving applications that also give you access to your data in text format.
• Backup and Restore of your encrypted data, so you have a copy on your computer in addition to on their server (you choose whether the backup will use your regular Packing Key or a unique one).
• They will generate a unique password for you to use when registering a new account somewhere, which they will of course remember for you.

You may be wondering where this Packing Key thingy comes from. (I can hear you now, “David, this thing is awesome, sign me up, but what the heck is a Packing Key anyway?!”) PassPack has some of the best help I’ve ever read, which is even available contextually when you click Help within the site. They handily have an answer about Packing Keys and why they’re so handy. They do a much better job of explaining that and just about everything else about the service than I could, given that they wrote it and I’ve just used it for a day. But I’ve found it to be exciting, apparently secure, well-designed, and actually fun.

It should go without saying that besides the great interface, being able to access your passwords from any web browser very easily, along with the off-site storage, is probably the single biggest benefit to using PassPack over a Windows utility. Even the auto-login bookmarklet it cross-platform, cross-browser code and is a simple JavaScript bookmark — no need to install a Firefox Extension, IE Add-In, or any other code running on your machine outside of JavaScript.

I do see one potential downside: their Terms of Service contain several limitations (yes I read it! Well, the parts they highlighted at least…):

1. You are not allowed to store information about financial accounts (banks, etc.), although this may be legal CYA considering I don’t know how they could possibly enforce this given they don’t have access to your data.
2. If you don’t login at least once every six months, your account is “inactive” and they delete everything.
3. You only get 32k of storage per account (they estimate 75-100 entries worth of entries), with no upgrades available yet. Accounts active before August 1st (missed it by less than two weeks, darn!) got 128k of storage (150-200 estimated entries).

I’m sure PassPack intends on offering upgraded service with more storage at some point, but those three conditions may limit my use of their service, and possibly yours. I know I have 23 entries already saved, and I’ve barely scratched the surface with the quantity of online accounts I maintain. It’s at least worth a shot in my opinion. If you like the concept and want an alternative, Clipperz is worth a look, it’s also free and PassPack even has a comparison of their two services. It doesn’t do the anti-phishing stuff like PassPack but it does have many other similar features, which I have not tested extensively. They also do not prohibit the storage of financial details and actually provide a template to hold credit card and bank account information. They also keep the data from leaving your browser unless it’s encrypted so they have no access when it’s on their servers.