So, here is a condensed list:

My web site is using WordPress as the “engine” to build a convenient and efficient site. WordPress happens to be using “themes” to appropriately display the contents (that is what is differentiating each WP website from the others). This capacity has helped develop a thriving community of themes, some being free, some being purchased.

The main trouble is that themes like any other piece of software are susceptible to bugs and could be exploited by hackers. I recently noticed that my (previous) theme was clearly outdated (not updated in the last 24 months) and including some known security issues leaving it open to abuse.

Lesson learned: Do not use any piece of software (including a WP theme) if it is not actively supported.

Application: I decided to drop the free (and unsafe) theme I was using. I swithed other to one of the “official” themes from WordPress.org. And I am learning to configure it properly. Hence the changes you can currently observe.

So, I decided to create a kind of online portfolio in order to show only a severely reduced number of images – but specially curated to keep only those I really love. Thus they will become alittle more accessible.

But it became also the opportunity to share some of my intentions behind the pictures (in French). I don’t always randomly shoot pictures . I have some projects, some ideas, some intent. Sometimes, I can assemble them in a lighter package grouped around a common tune I chose. These portfolios now become available on :

Wild focus (photo.roumazeilles.net)

Updates are much less common, but it’s more of my own photo raw personality.

My recent experience has led me to find useful data, mostly under the form of checklists of things to verify on the web site when looking for the origin of such an error. So, I recommend you try relying on these resources:

• WordPress erreur 500 (by Kyodev, in French)
• How to clean a WordPress Hack (by Sucuri, also provider of security services that I did not evaluate myself)
• How ot fix the 500 internal server error on your WordPress website (by Lyn Wildwood,)
• Damm you WordPress 500 Internal Server Error

• Worried about WordPress and GDPR? Start Here
• GDPR: What Does the New Data Regulation Mean for Your Website, Business and Data?
• How to make a WordPress website compliant to GDPR
• Automattic and the General Data Protection Regulation (GDPR)
• GDPR Compliance and WordPress Forms: Everything You Need to Know

Have a nice read!

Please, note: I am not a lawyer or your Legal Department, it all merely comes from my reading and my understanding.

Deployment

Cookies

First step (normally, this should be in place for quite some time already, since this started a long time ago): Add an informative message to inform visitors that you are collecting cookies.

I simply used a small plug-in (you can find others too) : Cookie Notice from dFactory.

Pros: It is working in various languges (and in English), it has been tested on more than 500,000 sites before mine, it starts in less than a minute.

Contact form

For many reasons, you will need to have a decent contact form (including to be able to answer GDPR-related requests). I recommend a simple and small (and free) forms editor like Ninja Forms.

In two minutes, you will have a working contact form. Don’t forget to add the checkbox with “By using this form you agree with the storage and handling of your data by this website” (This should be present on all your forms).

Then, you need to create a “Contact” page in WordPress. You will include the specific code to include the form you just created with the following shortcode:

Small GDPR support: Ninja forms allow you to setup forms without storing any data on the web site, reducing the load to comply with GDPR in simpler forms.

But, don’t forget to enable the sending of the confirmation message to the comment author (all the more because the post-form message includes mention of this confirmation – be consistent).

On top of this, if your web site includes a comment system (quite common fact), I recommend using a plugin to include the standard reminder checkbox: WP GDPR Compliance from Van Ons. Bonus: It makes some recommendations on various GDPR-related cases.

Data Protection Officer

Name somebody (with an email address) as the internal interface for all private data issues. It is not compulsory (for smaller teams) but it is so much clearer (and recommended) that somebody feels i charge of this (even the CEO). This person will be contacted bu visitors willing to know what data you collect and how to remove all their personal data from the web site (these are legal requirements).

Make sure that this person is reachable through a very easy interface (including the contact form or some other form).

Privacy policy

Above all, you must make sure that you can explain simply what are your intentions about private data you will collect (private data include email, name, IP address, etc.) and how you intend to comply with your legal obligations. This page must tell it all simply.

Try and write it right on the first attempt. You are legally bound to inform all your users any time you make a change (even simple ones)…

This is a WordPress page, rather than a poost (it must stay readily available and easily reachable by all even in the future).

I recommend to -more or less- follow the GDPR themes (it’s easier):

• Existence (or not) of a Data Protection Officer, in charge of the whole process of personal data handling
• Definition of data collection, handling, storing, transfer and removal processes
• Creation of a process to notify any data breach
• Explicit consent to data collection
• Right to access (and removal) of personal data

Access to personal data

You must give full access to any user’s personal data stored on the web site. This is realtively easy using a plugin (GDPR compliance from Scribit) and a specific page where you will only write the shortcode:

[gdpruserdata]

Of course, you can add some more details (refer to the plugin help information for more options).

Then, you can direct the requests to this page which will display the full breadth of personal data. As this is not a very nice page (rather dry reading), I recommend to keep it masked (I don’t feel it is necessary to show it permanently to all – answering requests should be enough).

Annoncement

Maybe not the worst or the most complicated, but I finally added a small message on the web site to announce the deployment of this whole process. Explaining is better than waiting for people to ask. And the message is positive: You care about your users and visitors.

I had noticed the “trusted_domains” configuration parameter; I had also noticed that it was apparently linked to failed attempts from a different location (different of my usual personal computer). But I did not understand it well.

As a matter of fact, a very clearly written post from Lukas Reschke, A tale about trusted_domains has been the source of my enlightenment.

The default installation of ownCloud had easily allowed me identify that www.mydomain.com in the list of trusted domains (of domains used to publish the cloud information). I thought that my difficulty was coming from trying out of mydomain.com (as if I was on the server), but my trusted_domains list needed to simultaneously contain www.mydomain.com and mydomain.com.

This was rather silly, but I did not think more about it: I was not typing the same address depending on where I was connecting (by luck, or rather lack of luck) and I started to believe that the location was important (and it was not really).

So, I replaced

'trusted_domains' =>
array (
0 => 'www.mydomain.com',
),

with

'trusted_domains' =>
array (
0 => 'www.mydomain.com',
1 => 'mydomain.com',
),

Done!

The advantage of using this connection parameter was to avoid a security risk (well explained in the above post) and to allow different addresses to be used to access the same cloud server. For example, when users on the internal company network are using a different address (access through internalcloud.local) than those outside (access through mydomain.com). In this case, we would use configuration parameters like:

'trusted_domains' =>
array (
0 => 'www.mydomain.com',
1 => 'mydomain.com',
2 => 'internalcloud.local',
),

Good! One problem solved.

After that, it’s clear that ownCloud is a very good product to replace DropBox with a tool more personalized and more secure (at least, it is not hosted in an unknown place like DropBox).

For years, I used Google authenticator applet on iOS. I knew that it would be a pain if my phone stopped working (or if I replaced it). The only reason I was OK with this, was that I had setup Google authenticator on two phones (I happen to have one for business and one for personal use – don’t ask why…)

Actually, replacing one of these smartphones pushed me into testing Authy as a replacement for Google. And I should have done this earlier. There is no way I will switch back to Google after this.

Authy provides:

• A cute user interface
• Shared accounts between several phones (and a fast way to switch from one old phone to a new one)
• All the needed 2FA bells and whistles (compatible with the TOTP standard)

In thirty/forty minutes, I recreated all the factors for my accounts (e.g. Google, Outlook, Evernote, Dropbox, or even Ubisoft). And this was needed because I could not transfer this knowledge from the old phone to the new (even though I had both phone working in front of me). But in three/four minutes I could extend it to my other phone. So, any time I need to replace a phone, I can extend/transfer in a matter of minutes, independently of the number of web sites are included in Authy.

I feel much safer. What would have been happening if I had lost/broken my phone with the codes from Google Authenticator? (graceful degradation, no risk of losing access to many web sites at a time in case of a single failure).

I feel much more positive about extending my use of 2FA/two-factor-authentication to  much more web sites because of the added ease of use (longer-term commitment).

Furthermore, Authy is available for several Operating Systems:

• iOS
• Android
• Windows
• Google Chrome

Go and install it!

I am using an optical fiber connection (actually limiteless here) and I synchronize from a Synology DS413j which is defintely weak in CPU (a mono-core ARM). This is probably understating the actual maximum capacity of ACD. Nevertheless, I ran around 60 GB per day for several days. This can be judged on a few hundreds of giga-bytes:

Complement:

The actual transfer speed fluctuated (I was using the server in real production during the initial synchronisation, by adding and moving many files around). The most interesting is that a parameter actuall influenced the overall rate: The number of simultaneous threads/files simultaneously synchronised (no surprise here). The initial value of 3 was nearly immediately upgraded to 6 files and the rate quickly stabilized around 60 GB/day. When I climbed to 9 simultaneous files, the rate went nearly up to 90 GB/day (a little before the yellow curve stops). But moving up to 12 files did not bring any additional gain (out of the graph). You may have to experiment to find your own value (probably depending on the CPU of your Synology server and the possible limitations of your link to ACD).

1. Backups
2. Synchronization between several machines (several PC and several iPhone)

CrashPlan easily provided the backup feature despite a high volume of photo files (more than 2 TB as of today), but was relatively poor interms of synchronization. So, it was time to spend some energy defining the whole need/specification and finding a true solution.

Specification

For backup, my requirements have long been defined:

1. At least three backup copies
2. At least two different technologies (e.g; not to rely only on optical drives or hard drives)
3. At least one off-site location (to be protected against theft, fire hazards, etc., think off-site, or cloud, or external/bank safe box)

For synchronization, previous use of DropBox and Evernote (on small volumes) allowed me to confirm the precise needs I had:

1. Real-time sharing of some critical files with daily updates (as for Evernote note files, or the database for my password management application, etc.)
2. Encryption of all comms (I don’t want to leak my passwords or my bank account data).

Solution

I was clearly influenced by several factors in my choice, and I will try and make these explicit (your solution may not be strictly identical to mine). So, let’s start by what I chose to deploy.

A smal file server (a Synology DS413j) at my home. It hosts 4 hard drives of 3 TB (initially, four Western Digital RED) in SHR/RAID 5 mode for a total capacity of 6 TB.

The large capacity was defintely dictated by the the need to host a large multimedia server and a large quantity of digital photos (Today, we have altogether much more than 100.000 pictures on this server).

The choice of RAID 5 was a very early one because of its optimum balance between overall dedundancy (you can loose one hard drive with no data loss) and cost (you loose less data to redundancy than in other two-disk RAID configurations). The Synology SHR technology is even better because is allows disks with different capacities (the two smaller ones define the maximum capacity. So, you’d better have one 500 GB with three 4 TB bigger ones; It would be a waste) and it accepts (like all RAIDs) to replace one failed drive with a new one (during the rebuilding of RAID/SHR, you have no more data protection but this is temporairy – and you can keep working in paralle).

Going to Synology was even more justified by a single important item rarely listed in RAID sevrer comparisons: The software offering is specially attractive at Synology. DSM (Synology OS) hosts  “packages” for many applications. The complements I installed (see below) are provided as ready-to-use instalations and can be easy to install even if you have minimal understanding of the inner workings of a server.

So, I was able to deploy a two-stage solution:

1. PC-to-Synology synchronization (three PC via Cloud Station Server)
2. Synology-to-Amazon synchronization (Amazon Cloud Drive through Cloud Sync)

Cloud Station Server and Cloud Sync are two applications from Synology which are installed in about 5-6 minutes (including download time) from the  “Packages Center” of Synology DSM.

If we start looking at the synchronization between PC (or iPhone) and Synology, merely opening the Cloud Station Server in the list below (in the management interface of my Synology DS413j DSM) leads us directly to a menu allowing to download the Windows application (or iPhone app) to install before starting synchronizations between PC and Synology cloud server.

A few clicks and it’s done. Nothing could be simpler. a few minutes and synchronization is starting. It runs in background (it does not hinder normal PC activity) and you will only notice the new change to the file icons showing that it is already synched ot the cloud (see examples below) or that it is still waiting for synchronization (blue tag).

At this point, PC are synchronized, via the Synology server. You can consider that this is a backup since I chose to keep all most recent 32 versions of each file modifications and to not let Synology wipe deleted files (they are stored in the server dust-bin). So, this is a Time Machine feature on top of a backup.

Important notice: The synchronisation between PC and Synology cloud server is very fast and does not eat up resource even on a small/old PC (contrary to some backup programs I would not dare name, like Cobian Backup). this is re-assuring: The end-users can forget about the backup running in the background, stopping if the PC goes to sleep and starting again when it wakes up. This whole process has nearly no impact on the PC behaviour.

Similarly, the iPhone and iPad can use synchronization (of some files, I don’t want them overwhelmed) when on the move.

The second feature replicates these data to another location (here, I chose to synchronize with Amazon Cloud Drive aka ACD because its cost is only 70€/an which appears very reasonable and can be reduced if you have Amazon Prime and a lot of photos). I understood that transfer speed would be limited by my RAID server (the DS413j is quite old and has a very cheap ARM CPU, but it defintely did not break the bank) rather than my bandwidth (I have optical fiber broadban) or by Amazon (all users observe that Amazon is going fast).

Synology Cloud Sync provides this in a matter of a few clicks. Just provide your Amazon login and password. Synology will do it all for you. Synchronization will start in a minute at most (I tried it with Google Drive too. this is as simple and as fast – bandwidth is quite high, which is a good thing; I thought about trying c hubic from OVH, but Internet comments and face-to-face talks with past users seem to point to a product without the needed performance and reliability you want here).

Observations

A few remarks I may have to add after some real-life use:

• The DS413j has a very small CPU from ARM. the CPU workload stays very high (~100%) during all the synchronization phase.
• The first synchronization is lenghty (several days or several weeks depending on the data volume). I recommend to build the data set progressively (not to bunch all your data on the first day).
• Next synchros will generally be much faster (nearly instantaneous).
• Recently modified files tend to be synchronized first.
• I used Cloud Sync to link my server to Amazon, but there is also a solution to synchronize from Synology to Synology: Cloud Station Share Sync. I did not try it but it could be worht exploring if you already have to geographical locations (A second home? A company with two offices?) and two Synology servers. It seems to be as simple as synchronizing with Amazon Cloud Drive.

• In order to elevate the RAID server reliability, you’d better choose hard drives designed for 24/7 use. I would point to Western Digital RED (specailly designed for RAID servers) or Hitachi UltraStar (24/7 version of the DeskStar drives). Also, if you can avoid having all 4 or 5 identical drives, it will reduce the risk of seeing them all failing nearly simultaneously. See BackBlaze statistics on hard drives reliability.
• You may ask where are my “three backup copies”. I actually have the following:
  • The original files on a master PC
  • A manually-copied copy on a separate hard drive (at least one, sometimes two or three of them on spare drives)
  • A synchronzied copy on the Synology server
  • A synchronized copy on Amazon Cloud Drive
• While the Synology DS413j is no longer listed, you can stil purchase the DS416j ou DS418j.
• On the Synology NAS server, I ensured that the synchronized directory is not visible to Windows: A ransomware can’t see it, it would have to hack through the Synology software. this is protecting me against those ransomwares which try to encrypt netork drives too. (Anyway, I can still control my data through the web interface of DSM).
• If a ransomware tries to encrpyt my files (they may then be synchronized in encrypted form), I made sure that versioning is enabled on Synology (This way, I could travel back in time and avoid “paying the ransom”).

Now, Roumazeilles.net helps you and can be transparently accessed through both addresses:

https://www.Roumazeilles.net/

http://www.Roumazeilles.net/

For most people, this will change nothing. For those who prefer to keep some of their browsing (a little more) discreet, it may help.

Useful reading: HTTPS Everywhere | Electronic Frontier Foundation

If you really want to go into more gory technical details, I can mention that this move was made possible (easy) by my web hosting provider (OVH) who provides a free SSL certificate that I only needed to enable in my administration interface.

But it may be less nice that that. And much more complicated according to Mike Hearn, one of the designers of Bitcoin.

Food for thought: “The resolution of the Bitcoin experiment” (relatively geek content, but clearly built).

Recommended.

this time, the intent is to share Marion Jonchères’ passion for cold, ice, snow and altitude. Here, you will only find extreme sports, high altitude mountaineering, North Pole or South Pole. But this is based on detailed commentaries and spectacular pictures.

I recommend you to go and see Ice-Altitude.com (and don’t hesitate to stop and leave your email to receive her information letter – in French).

I’ve got a Fiber connexion to the Internet (at Numéricable, one of the main ISP in France) which is forcing a dynamic IP address on me (no fixed IP address, even with a premium; They’ve settled in the XXth century). This would not be very serious except that I host a RAID server from Synology (a DS413j DiskStation with 4 hard drives in RAID-5 redundant mode) which provides several services I would like to share with the Internet (while I’m travelling with my iPhone or my laptop, I’d like to get access to my files through FTP, or my email server).

So, I decided to set things right in order to appropriately locate the Synology DiskStation in a sub-domain of my own (e.g. mail.roumazeilles.net).

The solution I opted for:

Dynamic IP addess:

Since my IP address is dynamic, there’s no way I can progress until I solved this single issue. I chose to use the DDNS service DDNS from Synology. Since I use DSM 5.0 (the most recent software version from Synology), I can reach the appropriate option through the control panel and the “External access” menu. I just added a DDNS, selecting Synology as a service supplier, and I recorded the name I wanted (let’s say ds). From this point, despite the IP address changes, my DiskStation is always accessible at ds.synology.me.

DNS subdomain:

After that, I need to point mail.roumazeilles.net onto ds.synology.me. This is slightly more complex because my roumazeilles.net domain nam is reserved atz Gandi and it is pointed toward a server hosted by OVH. It’s the hosted server (rented from OVH) which includes all the information relating to roumazeilles.net. So, I went to my server control panel and, in its DNS configuration, I modified (in your case, you may need to add) a CNAME record.

mail 10800 IN CNAME ds.synology.me. (Don’t forget the final dot/period in your CNAME entry, or it won’t work!)
Since I am lucky, my control panel at OVH includes an easy way to get the correct syntax (it’s safer): I tell it the mail subdomain is described by a CNAME record pointing to ds.synology.me (a bit terse, but not difficult).

Then, I only had to wait for the DNS information to “propagate” (from a few minutes to a few hours, sometimes up to 24-48 hours). And a little check using ping mail.roumazeilles.net confirmed that it answered from my Numéricable IP address.

You can listen to the interview and read more to form your own opinion by visiting Benswann.com article on Snowden and the interview the US government does not want you to see.

As a matter of fact, there is no obvious difference for the casual observer. I just verified the correct operaiton of my web design production environment (you couldn’t probably care less) and I modified the geographical coordinates of the web site (latitude and longitude) that you probably don’t see but which allow Google and others to locate me on Google Maps (at least, as soon as it will be taken in to account by Google, of course) in the Courbevoie city where I live now.

If you really want to know how I did this, I just added (or, rather, updated the following HTML code snippet in the page headers:

Google Analytics screen copy:

As you can see, really, the million award came only because, last week, there was a sharp peak of more than 80,000 visits in a day (I kept oscillating between 900,000 and 1,000,000 visits but could not jump this symbolic barrier). And it comes with nearly 1.5 million printed pages (another deeply symbolic figure to reach).

What is funny is that this load peak (perfectly handled by the OVH web server) just came a few days after the personal experimentations I was mentioning here to optimize Roumazeilles.net and YLovePhoto.com performance. As a matter of fact, the actions that I applied were really representative of what must be done to have a web site doing much more than the usual web business card:

• A small dedicated server (much better than the shared web hosting services which are really cheap but stay very limited in case of a sharp traffic increase);
• WordPress in a recent version (here, version 3.0.1);
• The W3 Total Cache plugin to optimize the cache and the performance of the WordPress web site (my analysis of W3 Total Cache);
• Reducing the less-than-important operations through the search for low performance using the performance analysis tool of your web site;

But on top of the technical face of the case, I am not a little proud of having received more than a million visits.

• You cannot avoid mentioning the Google webmaster tools. They do a lot of things and contain a performance evaluation but it is very crude and updated at frequency that you cannot control (several days if not several weeks between updates).
• Pingdom: Full Page Test has the enormous advantage of being precise and not requiring anything more than your browser. Give it an URL and it will tell you what happens and how fast. Great.
• Using Firefox, there is a nice plugin to observe the load times and the detail of what is loaded: Firebug. It will produce the graphic display below.



• But if you want to go even one step further, you should complete Firebug with the Google Page Speed extension, which will provide precise recommendations about what you could do to improve your page load times.

After testing/evaluating the load times of the pages of YLovePhoto.com because the administrative tools from Google were indicating that they were really too long, I discovered that there was a lot to improve there.

photo credit: Viernest

Through a small search for data, I discovered that there was already a set of WordPress plugins all devoted to this low-visibility task. In the past, I had used PHP_Speedy, but it seems that it does not work well with the most recent versions of WordPress (the plugin is probably no longer maintained by its author). I needed a much better solution.

I chose W3 Total Cache and this is changing the life of my web sites: Some loading times were simply divided by 10! It is probably already very perceptible by some of the visitors and it now makes glaringly obvious the next weakness: The slow behavior of some external inserts like Facebook badges, Flickr blocks or external ads.

The only drawback of this plugin (W3 Total Cache) is the sheer number of options (which makes it utterly adaptable), but as far as I could judge the default options are very inteligently chosen and the help information or the installation automated messages are really written to avoid novice web admins to stay locked or blocked on falsely optimized options. Strongly recommended since I deployed it on Roumazeilles.net and YLovePhoto.com.

Today, I learned that Bloglines will close its doors and stop completely its services in the coming days (on the 1st of October 2010); I have to switch immediately to a new service.

I started to look into the available options, either an on-line RSS aggregator (Google reader comes immediately to mind), or a Windows-based aggregator on my PC. Dear reader, do you have some recommendations for me?