The commenter gave the name “Diane Pearce Votes for Obama Again” and linked to my.barackobama.com. I thought it was slightly weird, but not weird enough to merit further investigation.

Then, three hours later, another comment came in on a different blog posting, this time from “Diane Pearce Loves Barack Obama”: “All I know is that I work at a large Pharmaceutical corporation in Clayton NC and I endroce Barack Obama with all my being. I would love for all my friends and colleagues to re-elect Obama in 2012!! I LOVE YOU OBAMA.”

That exceeded my weirdness threshold, so I looked into it a bit further.

The two comments gave two different email addresses, Reitter@gmail.com and Lipovsky@gmail.com, both of which appear to be based on people’s names and neither of which is related to the full name given by the commenter.

One of the comments was posted from an IP address in the United Arab Emirates. The other was posted from Indonesia.

I Googled for pages matching “Diane Pearce” and Obama, and there were 264 matches, many of which were similar comments. I did the same Google search a half hour later, and the count was up to 270.

Someone is clearly astroturfing here. The motives for this, and whether the people doing it are in reality trying to help or hurt Obama, are left as an exercise to the reader.

Diane Pearce Votes for Obama Again my.barackobama.com Reitter@gmail.com 86.96.226.22

In a nutshell, sometimes when you paste text into the editor, the editor inserts an invisible copy of the pasted text.  You won’t see the invisible text at all in the editor; it’s visible in the HTML view, but WordPress users often post without every looking at the HTML view (that is, after all, the whole point of the editor).  Even if you do look at the HTML, you probably won’t notice the hidden text block unless you know to look for it, which most people obviously don’t.  It is not clear whether this invisible copy is inserted in addition to a visible copy of the same text, or whether it’s inserted instead of the visible copy you intended.

Although the text is not visible in the editor, it is in the HTML, which means that when you publish your blog entry, the hidden text goes along with it.  Search engines will happily index it and even show you snippets from it in search results if you search for a keyword that’s found in the hidden text.  Furthermore, syndicators of your blog that strip out HTML style attributes (including, e.g., the feed syndicator at LiveJournal.com) will render the previously invisible text for the world to see.

I was posting a blog entry about some idiots emailing me a Web site username and password, and I cut and pasted their email into my blog posting and then edited it to remove the username and password before publication.  Although I edited the visible text successfully, the unedited, invisible text remained and was picked up by the search engines and LiveJournal.  Voilà!  Time to change a bunch of passwords. *sigh*

This is not a terribly serious security hole, as these things go, but it is real and needs to be addressed.  Unfortunately, the maintainers of WordPress do not seem to be taking it particularly seriously.  I sent this report to security@wordpress.com:

I am running WordPress 2.8.4.

I recently posted a blog entry…

Here is what appeared, without my knowledge at the end of the unfixed version that I first published:

<div id=”_mcePaste” style=”overflow: hidden; position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px;”> … </div>

In other words, for some reason, when I pasted the email message text into the Visual editor, somehow this hidden text block got pasted, in addition to the visible text block that I then edited, and the hidden, unedited text block remained in the blog entry when it was published.

I don’t know how this happened. I don’t recall doing anything unusual that might have caused it when editing the blog entry.

The security issue here should be obvious — it is a big problem that text that someone pastes into a blog entry they are editing can end up being inserted into the published blog entry without their knowledge. In my case, the problem is particularly egregious, since usernames and passwords were involved, but any time text gets published that the author isn’t aware is being published, that’s a problem.

The text was invisible in my blog because of the style attributes, but Google indexed it anyway, which means that it could show up in Google search results if you searched for the right keyword. Not only that, but when the syndicated LiveJournal feed of my blog picked up the blog posting, the style attributes were stripped, and the text became visible on LiveJournal to everyone who reads my blog there.

…

When I Google for “<div id=”_mcePaste” style=”overflow: hidden; position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px;”>”, Google finds 83 matches (if you tell it to display all matches, rather than letting it filter out the ones it thinks are similar), so clearly I’m not the only person who has been bitten by this, although I haven’t looked to see if any of the other inadvertently exposed text is as security-sensitive as it was in my case. Also, if you Google for “_mcepaste hidden”, you will see that others have run into this issue, although it doesn’t look like anyone has realized the security-hole aspect of it.

I hope you will take this issue seriously.

I didn’t hear back from them for two days, so I wrote to them again.  I didn’t hear back from them for another five days after that, so I wrote to them again.  They finally responded, “Switch from the Visual to the H TML tab to see hidden blocks.  Visiaul is a WYSIWYG and seems to be doing exactly as it should… That said, we can look into putting up a little warning message if the content contains hidden text.”

I responded:

I don’t understand what you are saying.

It is not correct behavior for a WYSIWYG editor to paste hidden text into a document and not tell you that it is there.

You could make a case that it is correct behavior if (a) there were some purpose to the hidden text and (b) it happened every time. Neither of these is the case. There is no purpose to the hidden text; when the WYSIWYG editor pastes properly, the text is visible, not hidden. And it only happens rarely, thus making it rather clear that it is a malfunction rather than intended behavior.

Even if the behavior were both intended and functional, neither its existence nor its purpose is documented anywhere, nor is the user informed in any way when invisible text is pasted. Therefore, it would still be a security issue in this case, because it is making data that people publicly visible that people don’t expect to be publicly visible without informing them.

If there is a purpose to the hidden text, then what is it?

I also told them that displaying a warning message would be a good start, but not inserting hidden text into blog postings for no discernable reason would be a better solution.

I’ve heard nothing further back from them.

I am publicizing this issue both to warn other WordPress bloggers about it and to ask publicly for the WordPress development team to acknowledge that this bug is a security hole and commit to fixing it.

It would have been nice if somebody at LJ had mentioned to me that my articles weren’t being fed there.

Now y’all need to go back and read everything I’ve posted since March 17.

Make no mistake, Belman and his ilk are scared. The smear tactics which worked so well against John Kerry in 2004 just don’t seem to be working on Obama. So, what’ an ideologue to do? The answer, apparently, is to take a gaggle of absurd accusations against Obama, combine them into a hastily written hodgepodge of rumor and innuendo, and throw them out into the blogosphere in the hope that “a lie can travel halfway around the world while the truth is putting on its shoes.”

Here’s what the smear-mongers want you to believe:

Read more…

I’ve been invited to be a contributor to Jewneric. I’ll be “simulblogging” my Judaism-related articles on my blog here as well as on Jewneric. If one of the articles here piques your interest, you may wish to follow the comments about it on Jewneric as well as here. I’ll post cross-links at the ends of siimulblogged articles.

If you register on the site through the link http://www.trenchmice.com/trial/ts60/, you’ll get a free 60-day “gold” membership.

Alas, shortly after she did this, I discovered that LiveJournal has a rather annoying deficiency in its syndication mechanism…. Comments on syndicated feeds go into LiveJournal, not into the original feed. This is somewhat annoying. I want comments on my articles to go into my blog, not into LiveJournal. Also, I’d rather see comments stick around for a while, and LiveJournal expires syndicated feed articles after a couple of weeks.

What’s odd about this is that my RSS feed specifies with each article the correct comments link. There’s no reason why LiveJournal couldn’t post that comments link for each article, instead of or at least in addition to its own, but it doesn’t.

I’m not the first person to stumble over and be annoyed by this problem. Fortunately, at least one of the other people who encountered it came up with a solution I could easily implement for myself. In this article, Michael Hanscom described modifying the RSS template for his blog to add a paragraph to all content syndicated to LiveJournal asking people to comment on his original blog rather than on the syndicated copy of it. Thanks, Michael!

I implemented his most excellent suggestion and went one step further. The paragraph I’m now adding to my blog articles when they are syndicated into LiveJournal is customized to give the correct comments link for each article.

Perhaps eventually the LiveJournal folks will handle this better, but in the meantime, I’ve got a reasonable workaround.