Head over to Flig.ht Data and check it out!

1: Overuse of the options table:
get_option() and set_option() are wonderfully useful features, if used in moderation. If not used in moderation, they result in a hellish jumble of entries in the wp-options table. Instead of using many discreet entries, an “options” object or array should be serialized into a set_option() call. While this may be overkill for a very simple plugin, once you get to any number of options it is a necessity.

2: No NONCEs
This is such an offensive mistake it makes me cry a little. As I(and Mark Jaquith and Vladimir Prelovac and many others) have written, using nonces is a must for any plugin which takes options from a user. Strangely enough, the nonce field is included, but then never checked (WTF?). Without the use of nonces, a nefarious user can arbitrarily change your plugin settings, and possibly even take over your database. Particularly if there are

3: No SQL Injection Security
Not having nonces is one thing. It’s bad, but I’ve forgotten from time to time myself. But not even escaping input before putting it in the database is, to quote “Yahtzee”, pants on head retarded!. Escaping user input is probably the single simplest and most basic security. It’s the last line of defense against people replacing your header image with horrific porn. Don’t write code without it.

4: Unnecessary use of global variables
This exists on two levels:
A) In purpose.php, both $wp_query and $post are called into the function via global. While this probably won’t do any harm, globally including everything everywhere is what made earlier version of php such a nightmare and it looks messy. If you don’t need a variable, don’t include it.
B) $var1-$var4 are declared to static values at the top of the file where they will clutter up the global namespace. They are never accessed from their global context, they are always get_option()ed. In fact, the only reason they are declared here is so that they can be add_optioned into options. EVERY TIME THE CODE RUNS. That’s four superfluous function calls every single time the file loads. This should be done once, on plugin install. Not every single time WordPress loads a page.

5: Include vs. Require
I realize that this is pretty nit-picky, but, when including files that are required for the program to function, the appropriate function is require() (or better yet, require_once(). If the file is missing, the code to break while trying to include the file, instead of mysteriously throwing messages about redeclaration of functions.

In conclusion, while the concept of a plugin framework is laudable, Fire Studio’s implementation falls far short of any reasonable mark of best practices, and only serves to encourage worst practices.

As always, head over the the µAudio page at Wordpress.org or grab a copy from my µAudio page.

Head over the the µAudio page at Wordpress.org or grab a copy from my µAudio page.

Those of you waiting for the 0.7 release with the new sidebar widget shouldn’t have too much longer to wait. It’s coming with some major changes to how µAudio handles javascript. There will probably be a 0.6.2 release in the next week or so to fix any lingering bugs with the current implementation, and then 0.7 will have the new code.

• New Dashboard Widget
• Better number formatting
• 2.7 Compatible

Mosey over to the µMint page at wordpress.org or grab a copy from my µMint page.

I am happy to announce the release of a new plugin today: µMint. Like my other µ plugins, it’s a small, lightweight plugin to (hopefully) do something useful. In this case, µMint allows you to painlessly integrate Shaun Inman’s Mint into Wordpress. Unlike the currently existent solution, µMint does not make use of iframes. Instead, µMint is designed to work with both the Exposé API, by Adam Livesley as well as the included API, µAPI for Mint. Furthermore, there is a development version of a connector whcih allows Wordpress to directly query Mint, when the two share a database.

µAPI does more than just get your stats, it displays them for you. You can have your choice of a sidebar widget, a dashboard widget, or both. And, in the µ plugin philosophy, stats are cached periodically to reduce the number of API calls required.

I think that µAPI neatly bridges the gap between Mint and Wordpress, and I hope you’ll give it a try.

µMint for Wordpress Dashboard

And yes, screenshot 5 is real, the minimal installation is just 495 Bytes!

Thanks for all you patience.

Although it has been generally well received, there is some controversy surrounding Chrome. Initial concerns hinged on the End User License Agreement — or EULA — specifically, terms it contains regarding the user’s intellectual property. In addition, there are serious questions about how much information Chrome collects and what, if any, anonomizations are made to the data before Google logs it.

The potentially offensive terms from the EULA relate to the intellectual property of the user. Specifically, Google more or less asserts a an unlimited license to anything you do with the browser:

11. Content license from you
11.1 You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

(Emphasis courtesy of Gizmondo)

Although Google appears to have backed off of the EULA terms, there are still potential issues with the browser. As CNet’s Ina Fried reports, there are potentially serious issues with what and how much user input google tracks through Chrome’s “OmniBar”:

…Google will have access to any keystrokes that are typed into the browser’s Omnibox, even before a user hits enter…Google has every intention of retaining some of that data even after it provides the promised suggestions… the company plans to store about 2 percent of that data…along with the Internet Protocol address of the computer that typed it.

In theory, that means that if one were to type the address of a site–even if they decide not to hit enter–they could leave incriminating evidence on Google’s servers.

While I do plan to give Chrome a try, I think that at this point the only logical choice is to stay away from Chrome as a day to day browser.

Update: In addition to the flaws listed above, Google apparently couldn’t be bothered to patch the Java exploit in WebKit.

A new, improved and very throughly tested 0.3 branch is out. Check out my µAudio page, or head over to µAudio at wordpress.org for a copy of your very own.

Thanks to WordPress.org user jonner for pointing out a couple of bugs.

Unlike the beta versions, RC1 mostly works most of the time. In particular most boneheaded and stupid bugs are gone, and you no longer need to be a php genius to set the system up. In addition, a brand new advanced options page under the “Settings” menu allows you to turn off potentially unnecessary options (like watermarking).

Cruise over to the Profiles Homepage, or hit Profiles at wordpress.org for your copy.

Update: Something is hinky with the download at wordpress.org. The one on the Profiles Homepage, works fine.