Today we’re proud to announce the immediate availability of the major upgrade to WPtouch, WPtouch 2.0 Pro. WIth over 100 new features, a brand new admin panel and more themes available soon, WPtouch Pro is the best rich-mobile theme solution for WordPress websites.

Competitively priced at an incredible value, WPtouch Pro represents intense dedication over the past 3+ months between Duane Storey and Dale Mugford, co-founders of BraveNewCode.

60,000 lines of code with blood, sweat and love were poured into every aspect of the plugin, making it one of the most comprehensive, powerful, modular and easy-to-use WordPress plugins ever made.

Highlights

With more power and customization than ever before, WPtouch 2.0 Pro provides WordPress website owners a flexible mobile theming tool, while offering visitors a rich, fast and polished mobile web experience.

Web-App Mode

Offer your iPhone and iPod touch users a full-screen, AJAX-powered experience when they bookmark your site to their home screens. A first for WordPress mobile themes, WPtouch 2.0’s Web-App Mode automatically converts all local website links to load inside its fullscreen view, without any additional setup or configuration!

And just like native apps on iPhone and iPod touch, you can create and apply your own branded loading screen image that will display while your site fires up in Web-App Mode… sexy!

You can try out Web-App Mode right here on BraveNewCode.com.

Internationalized

WPtouch Pro comes ready with translations into Italian, German, French, Japanese and Spanish, and new languages like Norwegian, Portuguese, Russian and more will be added over upcoming release updates.

Discussion On The Go

In WPtouch 2.0, the full WordPress commenting system is supported. Paginated comments, inline replies and threading all work simply and beautifully. Your desktop theme comment settings are automatically transformed within WPtouch, with no extra setup required.

Coming soon: Intense Debate and Disqus commenting plugin systems will be supported, too, offering more native commenting WordPress power in a mobile experience than anywhere else.

Now Playing: Your Own Mobile Theme

WPtouch 2.0 offers some great theme experiences out-of-the-box, but that’s just the tip of the iceberg.

Our Development Guru Duane Storey has painstakingly planned out a mobile theming framework underneath that provides flexible, time-saving power for theme creators looking to take WPtouch Pro to the next level.

Leverage the included Skeleton template to customize your theme, or of you’re a developer customer build one from scratch, harnessing the Developer Docs available to build your masterpiece.

All of BraveNewCode’s own WPtouch 2.0 themes are based on the very same Skeleton template included with every copy of WPtouch Pro.

Powerful Administration

The WPtouch Pro admin panel is as polished and pretty as the themes it drives. We’ve re-designed the plugin’s admin panel and packed a slew of new features into it.

From the drag and drop page/icon management to the easy to use theme browser/manager, to the new WPtouchboard overview, the WPtouch Pro admin panel might just be the best ever created for a WordPress plugin.

What You Get

For just $29 (CAD):

• A single-domain upgrade and support license for WPtouch Pro
• Re-download the plugin at any time by logging into bravenewcode.com/support
• As WPtouch Pro is GPL, you can modify, tweak or remix the code how you see fit
• Upgrades through all 2.x releases!
• Automatically receive any new free themes we add that ship with WPtouch 2.x
• Direct, professional support from the BNC team for the plugin (excludes custom theme support)
• Access to Knowledge Base articles, and User Docs
• One helluva cool plugin!

For just $59 (CAD):

• A 5-Pack of domain licenses for upgrades and support with WPtouch Pro
• Re-download the plugin at any time by logging into bravenewcode.com/support
• As WPtouch Pro is GPL, you can modify, tweak or remix the code how you see fit
• Upgrades through all 2.x releases!
• Automatically receive any new free themes we add that ship with WPtouch 2.x
• Direct, professional support from the BNC team for the plugin (excludes custom theme support)
• Access to Knowledge Base articles, and User Docs
• One helluva cool plugin!

For just $199 (CAD):

• Unlimited domain licenses for upgrades and support with WPtouch Pro
• Re-download the plugin at any time by logging into bravenewcode.com/support
• As WPtouch Pro is GPL, you can modify, tweak or remix the code how you see fit
• Upgrades through all 2.x releases!
• Automatically receive any new free themes we add that ship with WPtouch 2.x
• Direct, professional support from the BNC team for the plugin
• Access to Knowledge Base articles, and User Docs
• Access to Developer Docs, function reference, PSD templates, resources
• Custom theme support and guidance
• One helluva cool plugin!

To learn more about these packages or to pick up your own copy of WPtouch Pro, please visit the WPtouch Pro product page.

If you have any product questions, feel free to leave a comment here.
~The BraveNewCode Team

After months of hard work WPtouch 2.0 Pro is ready for some beta testing love. We’re looking for a small group of dedicated testers to help make it as solid, safe and snappy as possible. If you’re interested in joining the beta program please read below on what we’re looking for before deciding to dive in.

General Information About The Beta Program

The WPtouch 2.0 Pro beta program is for the paid version of WPtouch. Beta testers participating in the program will receive a copy of the WPtouch 2.0 beta, and gain access to a private beta forum on our Support Forums to log issues and discuss the release.

Once installed, new versions of the beta will be released through the admin panel in WordPress. When the official 2.0 release is available, testers can upgrade to it through the admin from the beta as well.

Beta testers should be aware that WPtouch 2.0 Beta 1 is incomplete. We will issue updates to the beta over the coming weeks to improve stability and complete features, and we’ll ask for new rounds of review with a list of changes for testing.

As with any beta release, we expect to see bugs and issues which (though unlikely) may affect the stability of your WordPress environment. It is not recommended to join the beta program unless you are comfortable with beta releases and feel capable of restoring software and databases associated with your WordPress setup. That said, we don’t anticipate any serious issues or concerns with the betas.

Areas Of Focus

We ask that if you are interested in a beta of WPtouch Pro that you fall into at least 1 of 3 categories:

1. You’re interested because of the many new features, and want to try and help improve the new theme(s) it offers
2. You’re interested in designing/developing a custom theme with the new Skeleton
3. You’re damn good at finding bugs and testing software, and think you can help us with your awesome bug squishing abilities

Requirements

To join the WPtouch 2.0 Pro beta program, we require the following:

1. You have or create a BNCID* (to assign the license and forum access)
2. You have a WordPress.org self-hosted website running WordPress 2.9.x
3. The necessary admin credentials to upload and activate plugins on your WordPress installation
4. That’s it!

*You can register for a BNCID by clicking the ‘Register’ link in the header of this website.

For beta 1 we will only be testing on 2.9.x. WPtouch 2.0 Pro will support WordPress 2.8, 2.9, and 3.0 officially, but our focus for beta 1 is on current versions of WordPress.

The purpose of the beta program is to harden and shore-up any issues related to the working functionality of the software, so we’d kindly ask that you do not publish reviews of the WPtouch 2.0 betas as product reviews at this time.

We’d also ask that you resign yourself to being a top-secret spy and not spreading information and details about the plugin before we do, if at all possible. We’re not crazy like Apple but do appreciate solidarity!

Enough Already! Gimme A Copy!

Hold your horses! First thing’s first: there are a limited number of spaces in the beta program.

We’ll contact those who want to join on a first-come, first-serve basis. We’ll send out a welcome mail and fill you in on the details if you’re in the group. If not, don’t worry: WPtouch 2.0 Pro will be released in June, and that’s not far off!

Register for the WPtouch 2.0 Beta

Updated: The beta registration is now closed.

• Makes it easy for users to choose from different themes and set them up quickly, for those who want an easy, fast mobile solution that looks and works great…
• While also providing a framework for those who want to customize themes, and even build their own from scratch

The two different paths are indeed very different, both from a user perspective and a coding perspective… ensuring both paths were well-designed was a feat.

We opted for a brand new admin panel to help solve some the issues we faced, and we think the combination of vertical/horizontal tabs for navigating the WPtouch settings alleviates our concerns.

There are also other great things about WPtouch 2.0, and we wanted to share a little more about what they are today.

The BraveNewCode Way

We pride ourselves and our business on providing quality. Quality means different things in different contexts, to different people, but to us it translates into our users and customers feeling knowing that they are working with something that’s had a great deal of thought, care, consideration and work put into it. They should feel confident (and if we’re lucky) even delighted to have it in their arsenal of tools that run their websites, business, etc.

Because there’s a paid version of 2.0 (we’ll be releasing this first, but indeed a free version will be released later as well) we wanted to ensure that the highest degree of quality we could muster was at the foundation of the work.

We do not take the growth of this plugin lightly. Since its become one of the most popular plugins for WordPress (was in the top spot just the other day, and downloaded over 700,000 times!) we’ve thought deeply about what it would mean to grow the plugin in a good way, extend its capabilities and the talents of WordPress as a publishing platform. It’s always tempting to want to throw a price tag on something like this that’s popular, but we’ve always felt that if WPtouch was going to have a paid version it would have to do more, much more.

As we move into an age where mobile internet usage is fast becoming as important (and maybe soon, more important) than desktop access, WPtouch has the potential to be something powerful for website owners to publish content for mobile visitors.

We put a fair amount of critical thought against the ideas we generate to discriminate which we want to act upon. Both Duane and myself are constantly generating new ideas and it’s a great asset as a small company to be able to creatively generate so much possibility. Though it can also be a lynch: we must filter these ideas, and determine which are valuable to act upon in an immediate manner and which should be shelved for ’someday’.

And we don’t always agree, but I’d hate to have a partner whom did not carry a different vision. One of our strengths is looking at and approaching things differently, it’s something we work on all the time at improving and synthesizing.

So arriving at what WPtouch can become and how it should get there has been a journey lasting nearly a year, and that doesn’t include the time it’s taken building it.

Support

When WPtouch was a fairly small plugin, it wasn’t very hard to support it. But given the popularity of WPtouch and the growing user base, more users are looking for help and support. Right now there are two options: the community forums on WordPress.org and the Support Forums on this site.

While we drop by our free forums whenever we can to answer questions, often ongoing client commitments limit our availability on the forums. To that end, the paid version of WPtouch Pro will allow us to dedicate the time to provide full support in our forums for paid users, addressing issues in a timely, comprehensive manner. We’ll also be supplying supporting documentation based on the WPtouch codebase which will help developers and users who wish to make their own enhancements or customizations.

A New Hope

The most frequent areas of request for WPtouch are compatibility with other WordPress plugins, and having more theme customizability.

Users want to see their favourite plugins work well with WPtouch, and want to be able to brand and customize WPtouch in ways that are not currently available to them without some form of fixed modification which will not survive plugin updates.

WPtouch 2.0 aims to take care of both of these concerns, and we think we’ve come up with some enterprising ways of doing so. There are a slew of other enhancements, changes, features and additions to 2.0, but we’re focusing this post on a couple of things which we know many users want to know about.

Other Plugins

It’s not sustainable for us to try and support the integration of thousands upon thousands of plugins available for WordPress. it’s also not going to work if we simply tell our users to ask developers of other plugins to find a way to make them work with our plugin without adding anything to WPtouch to make it easier to do so.

With 2.0 there’s an entirely new codebase, and with it Duane’s packed in a variety of ways that ensure WPtouch is pluggable, extensible and modifiable by WPtouch theme authors and plugin developers. We hope that with these changes plugin authors can quickly and easily add modified functionality to their plugins for WPtouch, or create entirely new plugins which can hook into and provide functionality for WPtouch itself and/or its themes. It’s a brave attempt from our side at solving one of the things we (and our users) have struggled with most.

It doesn’t mean we won’t build in some out-of-the-box support for various plugins, but it does mean we want other plugin developers to feel empowered to come up with solutions for their products when working with WPtouch, in much the same way they do for WordPress itself and desktop themes.

After all, WPtouch is now becoming a mobile theming platform, and less a plugin that will give your site a generic, Apple-esque mobile application appearance. Because of this, our focus will be on creating innovative themes that harness the power of the devices they’ll be shown on. We can’t both do that and find ways for these themes to work with every plugin out there. It’s not practical and it’s not reasonable for us. That said, wherever possible, we will work together with other developers to ensure they have the tools and information necessary to make their plugin(s) compatible with WPtouch.

New WPtouch Themes

WPtouch 2.0 ushers in a whole new theme mechanism which allows for theme switching in the admin. WPtouch 2.0 will ship with a few themes, and we plan on having many more down the road. When you install and activate WPtouch 2.0 you’ll now find an admin panel that defines a global vs. theme options ideology.

There are global WPtouch features and settings which apply to general setup and all themes, while a new active theme tab generated by themes themselves govern all the settings to do with that particular theme only.

We’ve worked hard to flesh out and distinguish what a theme needs to be able to do and access from what the plugin itself needs to govern and control. It’s been an exhausting process— ensuring that themes can be flexible while also having a foundation to build upon that saves themers time and energy building out their dream mobile site.

Custom Themes

We hope this new approach inspires others to create custom themes themselves, and we’ve set the stage with a new Skeleton theme (a theme template with the basic features, hooks and guts needed to start building out a custom theme). The Skeleton will start out as a theme that resembles the current 1.9 theme in many ways, and we’ll likely grow and expand upon the Skeleton over time, or have other Skeleton templates.

Down the road we can also see people wanting to share the themes they create with others, and that would be great to see. Our focus for now, however, will be ensuring that those wishing to endeavor to build a theme with WPtouch have the tools, guidance and support in doing so, and that begins with Skeleton.

Custom themes can do everything our own themes do, and of course go off in their own unique directions. In fact, we’re building all of our themes off the same Skeleton, too. Really nothing we’ve done or do is required from a theme standpoint, so creatively a themer can leverage our work and code, or roll 100% custom if they so choose.

When the WPtouch plugin is updated, all custom changes, settings, themes, etc., remain the same.

Any new features that can be taken advantage of will not affect or break a custom theme, or any theme, for the matter. Custom/user themes live outside WPtouch’s plugin directory, while separation between the global WPtouch admin settings and theme features ensures a smooth environment for custom work.

Themers can add new theme functionality provided by plugin updates easily if they want, or ignore the changes (they will most likely be added to the Skeleton and documented, and will be easy to see in action).

If capabilities are depreciated in favour of others at some point, they won’t be removed, so if you build a theme the day 2.0 is released it’ll always work with WPtouch. Wherever possible, we want those building and working with WPtouch to feel confident that they can do what they want to do without the fear that they’ll have their efforts quashed with subsequent releases.

Summary

To summarize: plugin features we add will not affect the functionality of a working theme, in much the same way that the core of WordPress adds functionality without breaking existing themes (for the most part, if they’re coded well).

Themes are user-selectable in the admin, and you can copy a theme to your custom folder to start editing its files if you so choose.

Support for 3rd party plugins will be handled not by direct plugin support, but rather through the ability to hook into WPtouch, and add/modify/remove a plugin’s functionality for better compatibility with WPtouch.

We may create modules that help perform some of this 3rd party functionality, but we’re hoping that developers themselves take to the streets themselves.

One More Thing…

Our WPtouch 2.0 themes will support web-app mode.

For iPhone/iPod touch visitors this means they can bookmark your website to their home-screen and your website will automatically be saved as a self-contained application which will run in fullscreen mode.

This means no address bar at the top of the screen, nor navigation bar at the bottom. Just your mobile site, in full and glorious view.

All posts, pages, comments, etc., are handled with Ajax. This means a super-fast and highly-optimized custom website experience for your website visitors, as native as one can get to a native application on the iPhone/iPod touch.

You can even define a loading image (the screenshot at the top of the page is just that!) that will show while your website fires up!

Launch Details, Beta

We haven’t finalized launch details or the beta release, but we’re getting closer everyday to be able to do so.

We would like to reveal some demos of the plugin in action, and announce release information soon. We’re excited about it all but first need a few more pieces to fall into place, so hang tight!

Pricing and other details will be a part of those announcements.

The best place to get sneak previews is to follow BraveNewCode on Twitter.

To be notified when WPtouch 2.0 will be available, visit WPtouch.com and use the sign-up form.

First, no system is entirely secure. Ultimately you try to do your best to secure a system by adding obfuscation, encryption, obscurity, passwords, etc., but each of those systems has weaknesses as well. Even the public key encryption that forms the basis of SSL is attackable, it just currently relies on a level of computational complexity to make it nearly impossible for the average attacker.

The latest attack involved a user on Network Solutions going around and reading information from the wp-config.php file which contains the basic database information for WordPress itself. Once the user had that information, they effectively had the ability to change all the WordPress related configuration settings and stored content. The following are listed as reasons why this attack was successful, so I thought I would comment on each in order.

1. The file permissions on wp-config.php weren’t restrictive enough. On Linux machines, you can assign file permissions separately for the owner of a file, for the group the file is in, and for everyone else. This is typically written in octal notation as 644 or 640, where the first digit is the owner’s permission (6 means read and write), the second digit the group (4 means read-only) and the last digit is for everyone else (a zero indicates it’s not readable or writable). A lot of articles I’ve read about this exploit indicate that this attack would not have worked had the permissions not allowed reading of the file by everyone. That’s probably true. Unfortunately it doesn’t take into account the reality how wp-config.php is created, or how the average Linux system sets file permissions. I can’t speak to how wp-config.php is created, but if it doesn’t already do it, WordPress should probably set the permissions on that file to 640 upon installation. In any case though, simply check the permissions of that file after an installation and adjust them accordingly.

   Unfortunately on most of the Linux systems I’ve encountered, the default mask for the files is usually 664, meaning the files are readable by everyone, and writable by the owner and the group. In an ideal world the second parameter would always be a 0 or a 4 as well (or a 5 for executable files), but many hosting providers require web files to be group readable as well, since Apache doesn’t run as the file’s owner. On some sites that use suPHP, the PHP process will actually be run as the owner of each PHP file, which basically means only the owner attribute is really important, and the others could conceivably be set to 0.

2. The WordPress database password is stored in plain text. This is true, but there’s no real way around it. If the permissions of wp-config.php are set such that wp-config.php can only be read by Apache or the owner of the file, then this part really isn’t that relevant. But some people are arguing that if the password wasn’t stored in plain text this wouldn’t have happened.

   One option is to store the password in an encrypted form using symmetric encryption. As several people pointed out on Twitter, this is sort of useless since it would require storing the encryption key somewhere in plain-text as well, which causes the same problem. Also, the typical symmetric encryption library on PHP is mCrypt I believe, and it’s rarely installed on a host.

   Another option is to store the password in an encrypted form using public/private key encryption. The password could be encrypted using the private key, the private key deleted, and then the public key either stored on disk or in a PHP file. If anyone acquired the public key, they could easily decrypt the password, but it would provide a slight barrier for anyone not familiar with how public key cryptography works. Also, the public key could be stored as 640 or 600 on disk (although this is effectively a non-issue if those permissions were used originally). This type of scheme also relies on OpenSSL being installed, which it often is, but not on 100% of systems.

   I saw one comment on a site saying the password should be stored using MD5 and a salt. Since a hash is not reversible, this wouldn’t do the trick – ultimately MySQL requires an unencrypted password, so one-way transforms aren’t going to help.

If you’re an end-user that has a site hosted somewhere, you should do the following:

1. Set the file permissions on wp-config.php to be 640. If you have SSH access you can do that by typing “chmod 640 wp-config.php”. If you have an FTP program you can usually do it by adjusting the file properties

If you’re a hosting provider, here are some tips:

1. Don’t allow other users to browse each other’s directories. The base user directories should not be navigable by end users, only the main owner and potentially the group (depending on how Apache is set up)
2. Don’t assign users to the same group Apache is in. If you require group permissions for Apache to run, don’t assign other users to that group or they will always have the same rights as Apache
3. Scan your users’ directories for any wp-config.php files that has everybody permissions as readable and potentially adjust them all
4. Change the default file mask so that the everyone/world permissions are not readable by default
5. If your site somehow needs everyone permissions to be readable, then you probably need to re-architect your hosting environment.

If anyone has any other suggestions (or notices any mistakes), drop them in the comments below and I’ll update this post accordingly. Ultimately, every user needs to take responsibility for the security of their own site. While it’s easy to point the blame at WordPress, this type of exploit can occur with any PHP program that makes use of a database when it’s configuration files are exposed to all users on a system.

WPtouch is now at 1.9.9.7, with the last few updates aimed at shoring up outstanding bugs and issues. The latest updates have fixed admin problems to do with the RSS feed area, fixing CSS styling for GigPress support, and adding a new option to choose your bookmark icon to be flat instead of having the ‘Glossy Effect’ automatically applied to it.

Also previously we address some icon upload issues and removed older, orphaned code.

This update is recommended for all users.

UPDATED: WPtouch 1.9.9 introduced a bug which has been fixed in WPtouch 1.9.9.3. Please upgrade ASAP if you’re experiencing the issue.

Today we’re releasing an update to WPtouch to address a few issues which have been reported in the last while, and also add and revise a few existing features.

Tricky Fixes

Of note in terms of bug fixes are a fix for the admin page failing to load on some hosting setups, and a fix for some mobile browsers that have issues with return false;.

Fresh Features

In the what’s new category there’s been improvements to the comments via ajax and for iPhone/iPod touch visitors leaving comments they’ll now see the unique keyboards built into the iPhone for entering urls and e-mail addressses.

We were working on client-side text-size changing, but that’s not quite prime time so it hasn’t been included in this update.

Below you’ll find the complete list of changes.

Changelog

• Added HTML5 types for comment url and email (devices capable now show unique keyboard layouts for these inputs)
• Added and refined jQuery code, effects
• Revised post/page image sizing auto-detection features
• Changed the way Ajax comments work – will now work for everyone
• Changed code referencing javascript:return false; to javascript:void(0);
• Changed admin panel to stop using Ajax that would sometimes fail to load
• Removed comments-ajax.php from theme (not needed anymore)
• Removed ajax comments option from the admin (not needed anymore)
• Removed obsolete code orphans from old code methods
• Bug fixes

The update notification should appear in your WordPress admin shortly.

Earth Hour Screenshot

The features in this version include:

• Ready for 2010!
• Brand new admin panel with options
• Updated Earth Hour page design (now dark- uses less screen energy!)
• Updated banner design
• Added option to set custom page text
• Added option to choose image, set custom image
• Added option to preview Earth hour page
• Updated code, css, js etc
• Tested in IE 6+, Firefox 2+, Safari 3+, Opera 9+
• Updated POT file for new translations

Last year we had approximately 1,000 sites participate in Earth Hour using our plugin, and we’re hoping even more people show their solidarity this year. For more information, visit the Earth Hour plugin page.

If you’re fluent in another language and would like to translate Earth Hour, please translate the associated POT file (included in the plugin download), and send us the .PO file via our contact page.

Even if you’re not having any trouble you should update anyways, no harm done in doing so.

Issues covered in this release are:

• Fixed an undefined function error
• Stopped GigPress CSS from loading in the header when it’s not enabled
• Fixed error where Icon Upload would fail in admin
• Updated Ajax Upload script to v3.9

300px PNG Format

<a href="http://www.wptouch.com"><img src="http://www.bravenewcode.com/wordpress/wp-content/uploads/2010/01/Works_w_WPtouch_300.png" alt="" title="Works with WPtouch" width="300" height="124" /></a>

WPtouch 300px (png)

300px JPG Format

<a href="http://www.wptouch.com"><img src="http://www.bravenewcode.com/wordpress/wp-content/uploads/2010/01/Works_w_WPtouch_300.jpg" alt="" title="Works with WPtouch" width="300" height="124" /></a>

WPtouch 300px (jpg)

150px PNG Format

<a href="http://www.wptouch.com"><img src="http://www.bravenewcode.com/wordpress/wp-content/uploads/2010/01/Works_w_WPtouch_150.png" alt="" title="Works with WPtouch" width="150" height="62" /></a>

WPtouch 150px (png)

150px JPG Format

<a href="http://www.wptouch.com"><img src="http://www.bravenewcode.com/wordpress/wp-content/uploads/2010/01/Works_w_WPtouch_150.jpg" alt="" title="Works with WPtouch" width="150" height="62" /></a>

WPtouch 150px (jpg)

In their own words:

The point of the foundation is to ensure free access, in perpetuity, to the projects we support. People and businesses may come and go, so it is important to ensure that the source code for these projects will survive beyond the current contributor base, that we may create a stable platform for web publishing for generations to come. As part of this mission, the Foundation will be responsible for protecting the WordPress, WordCamp, and related trademarks. A 501(c)3 non-profit organization, the WordPress Foundation will also pursue a charter to educate the public about WordPress and related open source software.

I think this is a really great endeavour, especially with regards to things like WordCamp which are starting to be taken advantage of by commercial organizations. I also think that as a non-profit they will attract many businesses that can donate to the WordPress Foundation while receiving a tax credit, which is really a win-win for both parties. I also applaud WordCamp New York for donating their budget surplus, over $28,000, to the WordPress Foundation.

For more information on the foundation, head on over to the WordPress Foundation website and browse around.

Steve Jobs reveals the iPad

Apple announced the iPad today, and at first I have to say I was underwhelmed, though just hearing the chatter regarding the launch on Gizmodo, Twitter, Ars Technica and other tech news sites at the time.

This evening I took some time to watch the keynote video posted by Apple, reviewing the whole 1+ hour love-in of Apple’s ‘Latest Creation’. Afterwards I had a few new takeways and a few more positive thoughts about the device, its potential, and where BraveNewCode might fit in with its impact.

Though I still remain a little skeptical about the net worth of a device like this in my own life, I think for a good many others this might be something that really helps push computing to a new level in their lives, and brings great web content to that many more people.

Capabilities

It sure seemed to me that the full breadth of the device’s power and ‘Magic’ won’t be understood or known until it’s held in the hands, much like the iPhone for many people. I can’t tell you how many people I’ve handed my iPhone over to who, in just a few minutes start grasping what all the chatter is about. I think the same will hold true for this device, and over time as more 3rd party apps are built that harness its potential its wow factor will increase in multitudes.

mobile(BIG)Safari

Safari is touted as ‘the world’s best browser’ by Apple, and in testing for things like the Acid 3 test, it does indeed stack up as such. So what would the best browser in the world feel like on a large, crisp touch display? I’d have to think it’d be pretty nice, and the demos given by Jobs surely do give the impression that that’s the case.

So while it dwarfs the power of mobileSafari on the iPhone and really does put the power of the internet in your hands (minus, of course, Flash) I was left thinking about whether something like WPtouch would be at all desirable on a device like this.

WPtouch Possibilities

There are no doubt many who will think that the attention given to mobile website customizations and solutions (of which WPtouch belongs) do not or need not apply on a device such as this. I think they’re wrong, or at least, not thinking about it as creatively as they could.

Just as there’ll be revolutions for iPad apps created by iPhone app developers that are already making great apps for the iPhone and iPod touch (cough, Loren Brichter) I strongly think there’s a whole new breed of touch browsing customizations that can be brought to websites which not only enhance the the experience of browsing a website, but also improve upon it, taking advantage of the intuitive input method that is touch. A great example of this occurred during Phil Shiller’s demonstration during the keynote of the touch-specific gestures and capabilities built into Apple’s new iWork suite on the iPad. The way that a user is able to perform certain tasks on the iPad are far more intuitive, simple, powerful and fast when compared to the mouse/keyboard input paradigm.

There are of course things that are more difficult on a device like the iPad, or iPhone. In these cases thoughtful consideration about how to reduce or eliminate these barriers will enhance and improve a user’s experience of a website or web application, and minimize the barriers to e-commerce, great content, and so forth.

So with these ruminations in mind I think that BraveNewCode is ideally positioned to look at what these kinds of improvements and advantages might look and feel like. Because we love WordPress so much (just like you probably do, too) we think that adding unique and powerful support for this new breed of web browsing and publishing devices is a must for the active community of WordPress users who will likely be iPadding in the near future.

The Waiting Game

But for now, we’ll all just have to wait a few months before we can get our hands on one, or settle for dabbling with the latest SDK.

We were flattered to hear from our awesome hosting provider, ServerBeach that they’d recently written a post about WPtouch, thanks guys!

ServerBeach Rocks

We’re honoured because to us, ServerBeach is one helluva hosting company. Fast, courteous response times to the very minor issues we’ve faced, extremely smooth and fast performance coupled with exceptional stability and capability have been beyond enjoyable. Since choosing to move over every one of our websites to their services a few months back from Media Temple and a string of nightmares (poor service, performance, security issues) we’ve not turned our heads.

We’re not affiliates and aren’t getting a penny for this praise. We just wanted to take the time to holler back some praise for a host that’s noticed us and our work.

I think this is the start of a beautiful relationship, doll.

Now that the management pane is in place and hooked up, we’ll be adding a few new features (such as hash tags) there in the future. In addition, we’ve also updated the documentation for WordTwit 2.3.0 to provide help with installations on WordPress MU.

If you install WordTwit 2.3.0 and run into any problems, please drop a comment and let us know. Happy Tweeting!

Update – we just pushed out a minor update, 2.3.1. It has all the goodies mentioned above, plus support for the is.gd url shortener and also the ability to view the number of times a bit.ly linked has been clicked (if you use bit.ly).

Dale spoke at WordCamp Whistler about WPtouch back in its infancy, and I spoke about mobile blogging in general down at WordCamp Portland a few months ago. Chances are that one of us will be speaking at WordCamp Vancouver, but it’s too soon to tell who it will be or what the topic will be (if it happens).

The tentative date for WordCamp Vancouver is on June 12th, 2010, and it will most likely be in downtown Vancouver. For more information, check out the official WordCamp Vancouver website, or follow WordCamp YVR on Twitter.

WordTwit 2.2.5

A small update to WordTwit adds bonafide WordPress 2.9+ support. Minor bugs and fixes were baked in as well.

WPtouch 1.9.7

We lauded a couple of the new feature adds on Twitter yesterday, and things progressed well enough that a release of the new version could be made today. 1.9.7 adds a couple of oft-requested things, post-thumbnails instead of calendar icons and the ability to change the font used for H2 on the post listings, post and page titles.

For Post Thumbnails we perform some eye candy additons for you: You just pick your thumbnail, and we add the rounded corners and reflection automagically. The admin options for the post listings are now: Calendar Icons (default), Post Thumbnails, Post Thumbnails with random images (to fill the posts that don’t have thumbnails associated) and show neither (for those minimalists out there).

Instead of trying to describe all of this in detail in a post, I’ve whipped up a quick video to go over setting up the new features.

Click here to view the embedded video.

From all of us at BraveNewCode, have a safe and happy holidays everyone and we’ll see ya in the new year/decade!

For those of you who haven’t seen it, we’ve also been tinkering with a BuddyPress plugin called BuddyPress Geo.

Click here to view the embedded video.

• Fixed php logic in adsense-new.php (thx JeanPaulH)
• Added support for GigPress’ Upcoming Shows to be a drop down in the header menu
• Changed relative comments logic, added function for GMT detection
• Adding padding, size to multipage links
• Removed WP version from footer (security vulnerability)
• Changed admin RSS feed from Support Topics to Twitter Topics
• Updated admin settings image
• Fixed cutoff tweets from WordTwit in the drop-down
• Verified WP 2.9 compatibility

For GigPress support all you have to do is have it installed and activated, then enable WPtouch support in the WPtouch admin. The rest is automatically taken care of.

WPtouch and Themes

We’ve said it before and it bears repeating: Themes for WPtouch is a lot more difficult than it may seem.

Since we’re aiming at WordPress 2.7 and higher we’re going to take advantage of the parent/child theme capabilities in WordPress. Wherever possible and practical we’ll always favor support for native WordPress capabilities and features.

This means that if WordPress introduces something like thumbnails in posts functionality (forthcoming in WP 2.9), we’ll add support for it over other third party solutions.

Cutting down on plugin bulk is something we enjoy about WordPress, making great (former) plugin features and capabilities a part of its core and reducing the need for third party solutions to be added in order for a smaller subset of functionality (like post thumbnails).

It’s a tough thing because some plugin developers that have their work enveloped into WordPress may have had other ideas. We think that the whole nature of a plugin for WordPress is to fill or add functionality which is ‘essential’ for a subset of users. Occassionally (and more often, progressively) the subset becomes wanted by almost the entire WP community, and such features should then be a part of the core.

Themes are tricky with WPtouch for a number of reasons, but most notably the way that our users can choose, apply, customize and maintain themes requires significant code and UI considerations.

We just simply won’t put out a half-baked solution. Its not the BNC way and it’s not what people have come to expect when using our plugins. So rest assured when it does arrive (and it indeed will) Themes and WPtouch will be enjoyable, easy to use, and powerful.

We’re back on the horse this week, and we’ll continue to update and improve existing branches of our plugins while we work towards re-launching the website, support forums, and larger plugin updates.

Below is a list of recent changes for both releases, enjoy!

WPtouch

• Added Twitter updates menu item support for WordTwit’s new features
• Added CSS for TweetThis and AddThis plugins to be hidden
• Added page/post title to HEAD for Tweet purposes
• Added user agent detection for non-apple mobile devices to be served Twitter link correctly
• Added 180-degree animation to post-arrow dropper and removed excess JS and code
• Added new tab pane for the header (menu, tags, categories, account)
• Added more theme compatibility for other touch devices
• Added ‘edit, delete, spam’ links for admins on comments
• Changed default OBJECT and EMBED css to only apply to .post, not site-wide
• Changed comment ajax routine
• Changed ‘Links’ appearance adding support for link categories, removed favicon scripts
• Changed the way the header links are setup
• Small refinements in the theme CSS all-around
• Made progress towards reply and pagination in comments, not there yet

WordTwit

• Added fixes as suggested by majilab for tweets & languages
• Fixed bug with Twitter display times in WPtouch
• Added ability for WPtouch to display recent tweets in header
• Added a widget to show recent tweets
• Updated minimum WordPress version requirement to 2.7
• Fixed a CSS bug on avatars
• Admin js and css files now only load on WordTwit Options page
• Validated the admin XHTML with W3C standards

Support Forums Outage

The support forums will be down as of 12:01am EST on Thursday, November 19th, 2009. We’re upgrading and changing our support forums and service, and as a result will close the forums until the new ones are launched.

We apologize for this, but there’s no way we can continue to answer all questions while re-launching.

Rest assured we’re hoping to make many improvements, so when things are up and running again they should be much better: )

Thanks,

The BraveNewCode Team

There’s been a lot of hubbub lately regarding security and WordPress. You’ve probably read a few of the more popular articles about the matter, and likely heard some of the opinions from notable technology gurus. Some of the solutions to increase and maintain security for a WordPress installation are rather straightforward— others… not so much. But they all don’t do anything after an attack or compromised WordPress installation has occurred. This is what Integrity for WordPress seeks to change.

We’ve come up with a plugin that uses a variety of methods to detect if WordPress has been modified in any way. We’re calling this plugin Integrity for WordPress, and it’ll do just that: verify the integrity of a WordPress installation, including themes and plugins. If they are hacked selected e-mail addresses will be notified immediately about the change, told what file(s) were modified, and given some options to act against it.

But we’ll get more in-depth with what Integrity does a little later in the article. For now let’s look at existing solutions so we see what Integrity isn’t.

A, B, U: Always Be Upgrading

Matt Mullenweg, co-creator of WordPress himself recently recommended and advocated that users are best protected by trusting WordPress’ security, with a caveat that it’ll require WordPress users to be running the latest release always.

This approach is indeed a valid one, and certainly for many users it’s easy enough to follow. It doesn’t ensure certain types of WordPress attacks or compromises don’t happen but it does protect against some of the more serious and dangerous ones. However, there are real-world use scenarios where ABU is next to immpossible, if not just impracticable.

We have several larger clients who on an hourly basis are monitoring their websites, making redundant backups, adding/changing content and so-on. If they’re going to do an upgrade they’re going to backup the entire ftp environment along with grabbing a database backup, and that costs time and money.

We also have clients who have an intimate theme/plugin scenario where an upgrade may possibly disrupt this. We work as hard as possible to future-proof our work but other plugin developers and the whole of WordPress itself can’t be quantifiably determined with regards to what will happen next and how it will happen.

So let’s assume there’s a pool of people for whom ABU isn’t viable.

Permissions and Server Side Security

We don’t profess to be gurus in these areas ourselves, but their are some rudimentary precautions and steps you can take to add security to your self-hosted WordPress installation. They’re a very good idea but often require more than a freshman’s knowledge when it comes to applying them properly to your WordPress install. Setting the correct permissions requires knowledge of FTP programs and unix; modifying php.ini or similar requires at least some working knowledge of Apache and server environments. Every web host is also a little different in how they apply settings, what type of allowances/blocks they allow customers to control, and so on.

User Accounts / Coding Practices

Another way for WordPress to be compromised is through the admin account or by using certain types of PHP code in a WordPress theme. Once a hacker has access to an admin account they can do pretty much anything. If your theme contains easily compromised code it’s impossible for WordPress to protect, save for WordPress deciding not allow that code to be used at all which isn’t a very nice approach— potentially thousands of websites unknowingly running themes with these types of holes would be broken instantly upon a WordPress upgrade that disallowed such code.

Existing Plugins

Looking at the WordPress repository for security-related plugins you’ll find a number which on the surface look to be helping the WordPress security scenario but ultimately fail to cover some of the most basic routines (such as checking WordPress and user files for changes) or scanning and repairing permissions on a WordPress install.

So there are indeed plugins out there, but most aim to cover one specific area of WordPress security and none actually prevent themselves from being compromised.

Introducing Integrity for WordPress

Integrity for WordPress does a couple things which are unique. First, it looks at your ‘WordPress Fingerprint’ to determine what is a healthy environment for your WordPress install. It’ll make some recommendations for you and provide some one-click options to beef-up your WordPress security if you choose, but you don’t have to if you don’t want to, and Integrity will still help you if you have a security issue.

There are occasions and circumstances where file and folder permissions may be loosened intentionally, and we think it’s unrealistic to expect all users to remain vigilant on security fronts such as permissions— it’s simply not going to happen because it never has happened, even when their were/are very good reasons for this to be so. Maybe you get an error trying to do something because a particular plugin requests permissions to be changed so you do so. Maybe you have some custom code which needs a more lazy chair environment to run. Regardless whether it’s as a result of sloppy or incorrect code Integrity seeks to add protection and detect issues on your WordPress install.

One of the more common forms of attack on WordPress (and many other kinds of) websites is a Cross-site scripting (XSS) attack. The exploit is pretty simple and in many cases it’s not about compromising your WordPress installation but instead adding chunks of code which represent malware, advertisements or other malicious activity.

The attack isn’t geared to destroy or disable your WordPress environment, but rather to add the code without being detected. In the case of an XSS attack, Integrity would detect this issue and assist you in resolving it.

Last but not least we’re building a method for the integrity of Integrity itself to be verified. Any security plugin faces this pink elephant in the room issue: No matter how strong a security plugin tries to be in preventing security issues with WordPress if it itself is compromised it’s all over. That’s why we’re working hard to develop a method for Integrity to check against itself to see whether it’s genuine and unmodified.

We’ll be posting more in the coming days/weeks ahead as we push for a public beta launch of Integrity for WordPress, so stay tuned!