Ad Management services versus doing it yourself

Should you use an advertising management solution such as DFP Small Business or do it yourself?

(DFP stands for DoubleClick For Publishers. DoubleClick was bought by Google in March 2008 for $3.1 billion.)

If someone approaches me and wants to advertise on one of my sites my usual response is to tell them to use Google's AdWords program and target my site or pages on my site with their adverts. In my opinion, Google does a great job and they only take 32%. I don't have to get involved at all.

Sometimes it is worth my while to split that 32% with an advertiser and I'll add their advert to a site for a given time period.

The advantages of doing it yourself are advantages for the the advertiser, not for you the publisher:

• If you host the advert's image and text on your site then it is almost impossible for Ad Blockers to block the ads because they are integrated images.
• Your advertiser gets a one-way follow link to their site from your page.

The disadvantage is that you have to create an embedded solution to allow advertisers to upload their adverts to your site (the sophisticated solution) or you have to do it manually. Doing this yourself requires work on your part either way and you will have to measure the Return On Investment and if that extra revenue over AdSense is worth it.

Should the team upgrade to the latest version?

I manage a couple of teams of .NET developers. Like everyone else we are under pressure and deadlines to push out the next feature and keep our products moving forward, feature rich and profitable. Nothing new here.

The usual arguments put forward to justify an upgrade to the latest version of a framework or tool are one or more of the following:

• It has new features.
• It fixes bugs
• It runs faster

They are acceptable and reasonable reasons but in my opinion not the most important.
The most important reasons for me to keep us on the latest releases are for developer engagement, retention and recruitment.
As a developer I hate to hear about features that are available but I cannot use because I'm not on the latest release and I know that most other developers feel the same way. The latest feature or paradigm in the current RTM version of your framework might not be the best solution for your project but we don't want it to be excluded because we don't have access to it. We want to be able to actively exclude it because it's not right for us.
When recruiting new members onto your team it makes it easier to be able to say "we use .NET [latest version] with ASP.NET MVC [latest version] and jQuery [latest version]." There are obviously other factors involved but this (1) eliminates the fear that the tools might not be current and (2) keeps you open to almost all developers out there. i.e. those that don't want to regress to earlier versions of a framework. We might not be using any features that have been introduced in the latest versions (we are) but at least that option is open to us.
For engagement and retention it's important for the same reasons. Everyone's happy because we all have access to the latest.
I believe that early upgrade is important to reduce the pain and is ultimately more efficient. If the team is used to upgrading the frameworks and/or tools frequently then it will be familiar, less painful and easier to plan for. For example, we try and upgrade to the latest version of jQuery once a quarter. We do this because our QA team likes to do a full multi-browser regression once a quarter and an upgrade to a new version of jQuery requires this type of regression.
I rarely attempt an immediate upgrade when a new version is released. I like to let it bake for 4 to 12 weeks and read some of the upgrade comments and let the owners address any of the issues the early adopters have encountered. By then there are a few good instructional blogs out there on how to deal with unusual errors and edge case upgrades.
I usually isolate the upgrade to be done by one developer, have him or her extensively document the experience and put a hard time limit on the upgrade attempt. If possible we push the upgrade out as its own release and don't combine it with features and bug fixes.

SQL Injection Attack from 82.45.20.100

While perusing the application logs this morning I noticed a number of SQL Injection attempts. The site that was being attacked uses MVC with automatic Form values to object binding so the exceptions were being thrown early on in the controller when the framework was trying to bind the attack string to, for example, a boolean.

Here are some of the attack strings the system logged:

 

%20AND%201=1
%20AND%201=2
' AND '1'='1
' AND '1'='2
' AND 1=1/*
' AND 1=2/*
AND 1=1/*
AND 1=2/*

The source of the attack:

IP: 82.45.20.100
City: Bristol
State: England
Country: United Kingdom
ISP: Virgin Media Limited.

The attack bot wandered around the site and tried many different entry points as you'd expect. Some of the attack points on the site identified it as an attack through the pattern being requested and stopped processing .An initial inspection of the database shows no damage.

One of the tricky things about logging SQL Injection attacks is that if you're logging them to a database then your logging process might facilitate the attack when the initial attack failed. I have 2 suggestions for this this:

1. Ensure that any code you use to insert or update to the DB is appropriately parameterized and injection proof.

2. Become a SQL Injection expert and try and break your fortress with injection attempts.

I'm a little bit surprised that SQL Injection attempts are still going on. I would have thought that any site worth taking over would have dealt with this by now. It's been over a decade since this became a well known security problem.

 

 

The Servant Leadership Training Course

I've just finished The Servant Leadership Training Course on CD.

There isn't anything new in this book and if you've read and understood the other popular books in this area then this will just be a repeat.

However, having this information repeated to you on a regular basis is very useful. And having it repeated from a different point of view is even more useful. For that reason I enjoyed it. The first quarter of the book was a bit redundant but the rest was good.

I didn't care much for the author's condescending tone and attitude but if you look past that you'll see that the material he's presenting is of value.

 

 

 

Install an HttpModule in IIS 7.5 on Server 2008 R2

Mostly for my own notes for when I next need to do this again. Assumes that the HttpModule has already been compiled and that you have the DLL.

Copy the DLL to the server and put in any folder.

Install the module into the GAC

1. Right click on a command window and select "Run as administrator"
2. At the command prompt type "explorer c:\windows\assembly" without the quotes.
3. Find the folder that you copied the DLL to and while holding down the control key right click this folder and select "Open in a new window".
4. Drag the HttpModule DLL from the new window and drop it into the c:\windows\assembly window.
5. The HttpModule is now installed in the GAC.

Add the module to IIS 7.5

(This assumes a .NET 2.0 module (there's a good reason why it's .NET 2.0 and not 4))

1. Open IIS and navigate to root. This is usually the machine name and adding the module here will ensure that it operates on all websites.
2. In the Features View find the IIS section and double click on Modules.
3. Click "Add Managed Module"
4. In the Name field put any name you want.
5. In the Type dropdown you should find the module that you added to the GAC above. Select this.
6. Leave the "Invoke only for requests to ASP.NET applications or managed handlers" unchecked.
7. Click OK and you're done.

This HttpModule will now execute against every request on all web sites.

Kintiskton LLC IP Ranges

There's a company called Kintiskton LLC who either own or are owned by Mark Manager and they provide a trademark protection service. They have a spider that crawls the web attempting to identify their customers' copyright material posted on sites other than their customers'. In principal I don't have a problem with this because I agree that copyright should be respected.

There's a good write-up about them here: http://endellion.me.uk/info/Kintiskton.html

The problem is that their spider aggressively spiders sites without respecting the robots.txt file. It hits the site hard and fast and ignores the crawl-delay directive and exclude directives. Ignoring the excludes directive is understandable (but not tolerable) as rouge web sites that are violating copyright could "hide" their content from respectful spiders by adding an exclude directive in the robots.txt file for that part of the site. This spider, however, also ignores the crawl-delay and is also not very well written as it generates a fair number of errors in the log files making it easy to see.

If you want to exclude this spider from your site you can exclude these IP ranges: 

65.208.151.112 - 65.208.151.119
63.110.158.48 - 63.110.158.55
65.200.47.0 - 65.200.47.7
65.208.189.24 - 65.208.189.31
65.208.185.96 - 65.208.185.103
65.211.195.16 - 65.211.195.23
5.208.151.112 - 5.208.151.119 (probably a mistake - see Zap's comment below)

If you discover another range that they are using please post as a reply to this blog post and I'll add it to the above list.

 

Google Maps slows down on Saturday mornings

I use Google Maps a lot to investigate a place I'm going to or to get direction there. I've noticed that on Saturday mornings Google Maps often fails but when it doesn't it just runs real slow and I get this message:

Still loading... Slow? Use the troubleshooting guide or basic HTML.

My theory is that everyone is using Google Maps to find directions before or while going out on a Saturday and this is overloading their maps servers. When are you most likely going to need directions? When you go somewhere you haven't been to in a while or ever. That's not going to happen during the week when you're going to and from work, that's going to happen on the weekend when you have the time to adventure off the beaten path. So my guess is that the requests to the mapping service peaks over the weekend.