Thinking of setting up a Tor node at home? Don’t.

I’ve been a privacy advocate for a long time; back in the mid-90s I’d wear my PGP ‘munition’ T-shirt while walking around the Boston common, both to support Phil Zimmerman’s defense fund and to enact my own small protest against government restrictions on free speech.

I’m also a big fan of Cory Doctorow’s writing, and a few months read both Little Brother and Homeland, his vision of not-too-distant future of a dystopian United States in which Homeland Security mounts an all-out offensive against freedom in the name of safety. The books are frightening in that it’s easy to see a path between where we are right now and the world he depicts. I stocked up on tin foil after finishing the books.

I resolved to do my part to help secure the basic human right of freedom of speech, even if in just a small way, by setting up a Tor relay on one of my servers. I run a small business and have ample bandwidth and compute cycles, and I felt that helping the Tor network grow was a great way to participate in the free-speech movement.

The Tor network architecture uses a three-hop graph. A user connects to the network via a bridge; the next hop is to a relay, and the final hop to an exit node which makes the final hop to the service the user wants to use. Bridges and relay nodes are equivalent in terms of how they are set up, and a bridge can be either public or hidden, the latter being used to help obscure the initial connection tor the Tor network in regimes where network traffic is heavily scrutinized or suppressed. You can read full details of the architecture at the Tor Project home page.

Exit nodes carry potential legal issues and so I decided to run a relay. It takes only a few minutes to set this up on a Linux distribution…a download and a few configuration file tweaks and you are up and running. I gave the node 1 MB/s of bandwidth so that it would have a good chance of being promoted to being a published entry point.

I set the node up on a Monday. The first sign of trouble was on Wednesday, when my wife asked why she couldn’t watch a show on Hulu. I took a look and saw an ominous message: “Based on your IP-address, we noticed that you are trying to access Hulu through an anonymous proxy tool…” The streaming ABC site displayed a similar message. The new Tor relay was an obvious source of the message, but I’d also recently been using a VPN to watch World Cup games that were blocked in the USA, and that could’ve been a trigger, too.

The next day I logged on to one of my banking sites. I was blocked. A second banking site had also blocked me. I needed to renew a domain at Network Solutions. Denied: “There’s something wrong with your credit card…”

What had happened?

A fundamental weakness of Tor is that in order to connect to the first node, you need to know the IP address of the first node. Tor handles this in two ways; a small set of bridge nodes are kept secret and distributed only by email…these are used by dissidents in China, for example, where Tor traffic is heavily censored. The large majority of bridges, though, are available in public lists, and many companies scrape these lists and blacklist any IP found on them. I’d been blacklisted for supporting free speech.

Some of the blocks were easy to fix. I called Hulu and the support technician manually removed my IP from their blacklist. Others (my banks, for example) cleared themselves automatically a few days after I disabled my Tor relay.

Some were not so easy to fix. Network Solutions is still blocking me, and just yesterday I tried to do an online transaction on my state government’s web site: “There is something wrong with your credit card…”

My solution to this nagging problem is the same one that I used to watch the blocked World Cup games…a VPN to a server somewhere else in the world. Since my IP is blacklisted, I just come in with a different IP.

My advice to anyone who wants to support free speech by running a Tor relay on their home or small business network is simple.

Don’t do it.

The Tor Project downplays or ignores the risk of running a Tor relay, focusing instead on exit nodes. Their goal is to grow the network, so I can’t fault them. However, it’s clear that many organizations are throwing a wide net around Tor traffic and putting all of it in the ‘evil-doer’ basket. Even if you are just trying to do your part as a citizen of the world to promote free speech, you will be slapped down. My IP presumably is now on watch lists that I don’t know about, both private and governmental. Is my traffic being collected? What tripwires did this trigger? What other ramifications are there? These are questions that I don’t know the answer to right now.

I still support Tor and what it stands for. The Tor Project is making a big push right now to encourage individuals to create Tor nodes in the Amazon cloud, and I’m all for that as long as you keep in mind that Amazon is a third party and subject to subpoena and to national security orders. It might well be that the AWS Tor nodes are currently under heavy scrutiny…we just don’t know. If you don’t physically own the entry node, there’s no guarantee that your traffic is not being de-anonymized. The Tor Browser Bundle can be useful in providing a layer of anonymity to your web browsing, but you should approach it with a dose of skepticism.

If your goal is anonymous network access, one approach would be to set up a private Tor entry point, one that you physically control, and obfuscate the traffic coming out of it. This would prevent your IP from being scraped off the list of public relays, and presumably would help prevent traffic analysis at your ISP from identifying your IP as being part of the Tor network. This approach doesn’t help the Tor project, really, but it will help anonymize your traffic. The Tor Project maintains a list of hidden entry nodes, but it’s trivial to build a list of them (they are distributed by email) and so you should assume that they have been compromised and just use your private bridge.

I still want to promote free speech. My focus is shifted away from Tor and I’m instead promoting the ‘encrypt everything’ movement. The idea is that if more people use encryption for everyday communication such as email and IM messages, the encrypted traffic becomes the norm rather than sticking out like a big flag. Unfortunately, 20 years after Zimmerman posted his PGP code, it’s still not easy for the average user to implement strong encryption. That’s where I’ll spend my effort…in making things simpler.

Perry Donham is president of KidPub Press, one of the world’s oldest websites (launched in 1995).

KidPub just celebrated its 18th birthday…very few web sites can claim to have been around for as long as KidPub has.

We’ve made some significant changes at kidPub in the past few months that, while not really obvious to most, are setting us up for what should be significant growth in 2013.

The first is a change to the servers that run KidPub. We’ve moved from relatively old hardware to some very fast Intel Core-i7 rack-based servers. The old hardware was struggling a bit and some pages on kidpub.com were taking several seconds to load. With the new hardware the most heavily used pages load in just under 1/5th of a second (200ms). For our members and guests it means that pages are very fast…and the new servers should hold us for the next few years. KidPub is in the top 50,000 web sites (measured by Quantcast) and traffic is growing at about 30% per year.

The second big change is a migration from our old book royalty tracking software, Dashbook, to a new Filemaker system that was built in-house. The new system is much more efficient and automates a lot of the process that goes into publishing our books. We spent most of January building the software. Now everything about each book is in one spot, and tasks such as setting up a new book on Amazon, which used to take 20 to 30 minutes, can be accomplished at the click of a button. As we launch new advertising for KidPub Press and also our new Watergrass Hill imprint for adult authors this automation will let us focus on the books rather than the process.

The new Filemaker system and the retirement of Dashbook means that we are now 100% Mac in all the software used…Dashbook was the last Windows program in the mix. And yes, we’re still building Hackintoshes to run everything, though the web servers are running CentOS Linux.

2013 is going to be a big year for KidPub. We should see traffic grow to 3,000 visitors a day, and the new KidPub Press For Adults business is going to occupy a lot of our time. I still can’t believe that I’ve been doing this for 18 years now…time to start planning that 20-year celebration, eh?

[Note: This was originally posted on kidpub.com in February 2013]

Thanks to everyone for the birthday greetings! It’s been an amazing eighteen years…KidPub has grown from a small Linux computer in my living room with a few web pages on it to this incredible worldwide community of amazing young writers; from just a few visitors a week to over 3,000 visitors a day! I get email now from parents who were members back in the ’90s and have kids who have grown up with KidPub. How crazy is that?

For readers who don’t know the story of KidPub, here is the short version. Back in the mid 1990s I was working at a large computer company, Digital Equipment Corporation. One of my jobs was to do research on a brand new thing, something called the World Wide Web. I decided that the best way to figure out how it worked was to create my own web site. I had a friend whose daughter loved to write, and I made a little page to post her stories. Back then there were only 10,000 or so web sites in existence…now there are more than 200 million. I started receiving email from other kids who liked to write, asking if I would post -their- story, too. Pretty soon there were dozens, then hundreds, then THOUSANDS of stories posted from kids all over the world.

And it’s just kept growing.

Like Dr. Who, there have been several versions of KidPub. The original pages looked pretty comical…I hand-drew the logo, and I didn’t really know how to format a web page, so everything had a grey background. Stories were sent in by email, and I tried to format them as best I could before posting them. Around 2000 or so the entire site was rebuilt, and then again around 2008. There was a ‘notebook’ theme that we used for a couple of years, and finally what you see now was created.

KidMUD, by the way, appeared for the first time in 1996. The first version was destroyed by an evil player, and it was rebuilt several times. The current version was created in 2005.

For many years, KidPub was just a hobby. In 2008 I decided to devote my efforts full-time to it and the new KidPub Press book publishing company. Now we have a small staff, and the little computer in my living room has been replaced by a rack of servers in a datacenter in Los Angeles. We’ve become the largest publisher of books by kids with over 300 titles in print, and KidPub was featured last April in a front-page New York Times story on kids and publishing. By the end of this year we’re projecting growth to 5,000 visitors each day at kidpub.com and 450 book titles in print.

It’s been an incredible ride for the past 18 years and I can’t wait to write the post for our 20th anniversary. And our 25th. And our 40th.

Through all those years, the one thing that has been constant is you, our members and visitors. I simply love reading all your stories, comments, arguments, posts, and everything else. I am incredibly proud of our members. Frankly, you just amaze me with your writing and the way you create KidPub in your own image. My philosophy is that kids are good people, and what I do is give you the tools to express yourself and then just step back to see what happens. It’s a big, ever-changing family and every morning I wake up excited to see what you’ve come up with.

Thank you so much for making KidPub something special. All of you.

Perry

About an hour and a half ago my wife and I sat on our back porch and watched a spectacular overhead pass by the International Space Station (ISS), chased by the Space Shuttle Discovery. This is Discovery’s last flight, the end of NASA’s shuttle program, and it was the last opportunity for us and all of humanity to see those two bright stars chase each other across the sky.

The night was perfect: Chilly and windy but ’severe clear’. The kind of night where you can count all of the Pleiades and a few extras for good measure. A thin crescent moon was just setting, and the pair of spacecraft lit up on the northwest horizon right on time: 6:58pm EST. This was a nearly overhead pass, 83 degrees, and the two were as bright as I had ever seen them, as if they knew that this was their finale. Just as they passed overhead at their zenith a third satellite crossed their path perpendicularly, icing n the cake.

I remember watching the very first shuttle launch, unable to leave the television set for hours. And now I’ve seen the last pass. It’s been a good run. A lot of incredible science has been accomplished, but there was always time for the astronauts to just sit back ad enjoy the ride.

Godspeed, Discovery. I’m sorry the ride is over.

Why did it take me so long to drink the Mac Kool Aid? KidPub Press has recently started to produce ebooks for Kindle and Nook, and I wanted to also offer them on iBooks. Well, guess what? The only road to iBook publishing is through an iTunes plugin, and it has to be running on Mac OS/X.

Fine. We had a Lenovo T60p sitting unused in a corner, and it turns out the building an OS/X system on the laptop is relatively painless. A day of reading and loading and -voila- we now have the equivalent of a MacBook Pro. I’m writing on it right now.

For some reason I never fully grasped that MacOS is basically UNIX and a windowing system. Now I’ve been a Linux fan since 1994 and have had countless Linux boxes. There are two or three in the house right now, and the KidPub servers all run Red Hat Linux. It took about a minute of playing with the new HackBook before I realized that I was right at home. i suppose at some level I knew that MacOS had roots in BeOS and NextStep, both UNIX variants, but to be honest the entry price of a retail Mac had been a barrier to my even powering a Mac up.

Now that Apple has moved away from the PowerPC and embraced the intel platform it’s much simpler to get OS/X running on a variety of PC-purposed hardware. The T60p is really quite a nice platform…fast, crisp graphics, lightweight…I think it runs better under Snow Leopard than it does Windows.

I’m pretty heavily invested in the Windows platform for business software but I keep reaching for the T60p HackBook Pro. I have a lighter laptop for traveling but I have the feeling that this is the machine that I’l be using for research, browsing, email, and the like. And when it comes time for a technology upgrade at KidPub Press…

A quick thank you to the folks at SOS backup for not hassling me when I asked for a refund.

You might have noticed a trend in my posts…I seem to be obsessed with backup software. The latest saga started with the purchase of a pair of Buffalo Linkstation NAS boxes. I love these things…they run Linux, have click-and-configure RAID 1 mirroring, and are fast enough that I can use them for my daily work instead of a local drive. The configuration in each is a pair of 500G drives in a RAID 1 array. To feed my backup paranoia there’s a job that runs nightly to back up each box to the other.

What I REALLY wanted, though, was cloud backup of the Linkstations. Guess what? Nobody is doing that right now. It might LOOK as though folks like Norton and SOS are doing it, but when the bits hit the wire it just isn’t happening. SOS Backup said thy could, and I believed them enough to pony up $80 for a license. After a week of trying everything in my bag of tricks, I just couldn’t get the software to work. Best I can tell there are issues with NAS drives and Windows 7 64-bit.

To their credit, tere was no hesitation in issuing a refund. I explained the problem, asked for a refund, and the next day it had been processed. Thank you!

Their exit interview / poll asked why i was leaving. I explained, as I’ve done to other companies, that there must be not even a glimmer of doubt in backup software. It needs to work the first time, the second time…every time, the same way, with no errors or tricks to get it working. Bottom line is that I just didn’t trust the software.

The cloud backup company I trust the most these days is Mozy, but even they aren’t offering backups for NAS drives.

So, what’s the solution? Fortunately it’s trivial to ‘jailbreak’ the Buffalo Linkstation to get a root shell, and I’ve simply set up a nightly cron job that uses rsync to backup my work files to a remote Linux server. Knock wood, with two sets of mirrored files and a remote backup I can sleep at night. At some point Mozy will offer NAS backups, and all will be well again.

Last year around this time I was searching for a robust backup solution for KidPub Press. You might recall that I’d narrowed my evaluation down to Acronis True Image Home 2010, which I purchased and installed, then uninstalled after it failed to meet even basic backup requirements.

Fast-forward a year. I’ve just set up a RAID array for backups here in the office and am revisiting the backup strategy. Despite the earlier problems with Acronis 2010, I read through the data sheet for True Image Home 2011 and it sounded like they had produced a solid product this time around.

Wrong!

I bought the upgrade and installed. The installation had a few glitches, which should have been a red flag…there should be absolutely no surprises when installing software that is designed to give you peace of mind. The initial file-based backup went well and took less time than I thought it would, and subsequent incremental backups appeared to run just fine, too.

Not so much for email. I set up a scheduled email backup for every two hours. The first one failed. The second one failed. The third one failed. I did a quick search on the Acronis site for the issue. Guess what? They know about the problem…basically, you can’t backup your email files when Outlook is running.  The solution? Close Outlook before running the scheduled backup job.

Excuse me? I though you just said that I should stop what I’m doing every two hours, close Outlook, and wait for Acronis to back up the PST files.

What a sorry piece of junk. But it gets better…a search on the Acronis knowledge base shows that Acronis True Image Home 2010, last year’s version, had the same problem.

How can a software team, producing a product that should be rock-solid, introduce the same critical bug two versions in a row and not catch it in testing before releasing the product? It’s just mind-bogglingly pathetic.

So, that’s all for Acronis. I’ve uninstalled the thing and will never think about them again.

I wonder what Acronis employees use to back up their machines? Mozy?

I was out in several of our nation’s major airports again this past week, and was once again struck by just how pathetic TSA’s so-called security procedures are. I really think that it’s time for Americans to acknowledge the massive failure that is the TSA and demand that we stop wasting taxpayer dollars on such an ineffective bureaucracy. Bruce Schneier is spot-on: The TSA and its procedures are strictly security theater, put in place to lull the traveling public into believing that their security is being somehow improved.

Consider that long line you stood in at the TSA checkpoint, waiting to show a TSA agent your photo ID and boarding pass. It seems very official, with badges and magnifying glasses and ultraviolet lights. We can take comfort that any of the million-plus individuals on the governments No Fly list would be stopped dead in their tracks by such scrutiny.

In reality, it is trivial to board a plane if you are on the No Fly list. Think about it. The agent at the checkpoint is relying on an ID and a document that you yourself hand to them. Also, what is being checked? Is your name being entered into a terminal to see if it matches a name on the list of know or suspected terrorists? Is there a paper copy? Has the agent memorized the million names on the list?

No, what’s being so diligently checked is whether the name on the ID matches the name on a piece of paper that you have produced. Same number of letters? Spelled the same, or at least close? You’re good to go. That TSA agent, front line defender of our flying safety, is little more than a uniformed elementary teacher checking spelling.

There’s nothing complicated about boarding a plane if you are on the No Fly list. Simply pick up a prepaid debit card at your local convenience store (while you are there you might as well pay cash for a prepaid cell phone in case you need to make an untraceable phone call). Go home, open up a browser, and purchase a ticket using your debit card. Use a name that you know isn’t on the list. When the day comes to fly, check in online and print the boarding pass with the false name on it. While you’re there, save the page…it’s a PDF file. Open the PDF file with Acrobat and edit the name on the boarding pass to match the one on your real ID. Print the second pass and head for the airport.

At the airport, hand your real ID and the matching boarding pass to the TSA agent. As long as you didn’t typo your own name, you’ll walk right through.

At the gate, hand the gate agent the boarding pass with the false name on it. They check the name against ticketed passengers. It matches, so you are free to get on the plane.

Incidentally, if you aren’t flying but just want to meet someone at the gate, or maybe shop at the duty free store, you can print your own boarding pass for any flight that you wish and just walk through the TSA security with it using the same technique.

This ridiculous system is costing taxpayers billions of dollars every year. Although it has its critics, the system in place in Israel seems to be much more effective and much less intrusive. It’s real security, not security theater. Tell your congressional representative that you are tired of wasting money and ask for a thorough review of the TSA and its ineffective policies and procedures. If you don’t know who your representatives are, visit congress.org to find out.

Ever think about how much you trust your software? For most of the things we do on a PC, there’s really very little trust involved. We expect Word to display text as we type it, or our calculator to return accurate numbers, but for the most part we accept the little idiosyncrasies and shortcomings of our applications and work around them, if we even notice them.

When it comes to backup software, though, the story is a little different. There’s no room for mistakes. In an earlier post I wrote about selecting a backup solution for our Linux servers, and part of that process included whether or not I got a good feeling when running the application. Any little glitch, unexpected response, or slow refresh meant that I’d cross that package off of the list.

I did the same thing when choosing a Windows backup solution for my daily work desktop.  Ghost was ok, but a bit slow, and I’d read that there were issues running it under then-beta Windows 7. I did some research and found that Acronis had a popular solution in their True Image Home product. It includes an innovative ‘continuous’ backup feature that does an incremental backup every five minutes which I found attractive. It retails for about $50, a bargain for some peace of mind.

Acronis worked reasonably well under Windows 7 RC. It was a bit of a resource hog and would slow the machine to a crawl on power-up as it rechecked every file on the system, but I got used to it. I ost and recovered a file or two over the month that I used it and was happy with the result.

Then came the installation of the production version of Windows 7. I’ll cut to the chase: Acronis completely failed. It wouldn’t run a backup, instead displaying a blank alert box: Ok? I don’t think so. Worse, I was not able to open ANY of the backed up files from the prior installation. Instead of simply refreshing directories on my base Windows 7 install, I had to dig up backup DVDs of those files and rebuild the machine manually.

Acronis’ answer to the high-severity bug ticket I filed? We know it’s a problem and we’ll get back to you. That was several weeks ago, and from the chatter on the Acronis user forum it’s clear that it wasn’t just me seeing this problem.

This kind of failure in a backup product is simply inexcusable. Fortunately I had backups of my Acronis backups, and I feel truly sorry for those who didn’t. Granted, rolling back to Windows 7 RC is a temporary fix, but Acronis has lost the single most important feature of their product: Trust. They have lost me as a customer for life, and probably anyone who asks me what I use for backup.

I replaced Acronis with Cobian, an open source solution that works extremely well. Unlike Acronis, which saves files in a proprietary format, Cobian stores files in standard format, so even if Cobian won’t start I can still get to my files. It does everything you’d expect it to, and does it efficiently. It offers features that Windows 7 backups doesn’t, and best of all it’s free.

Just a few weeks after my post evaluating backup and recovery solutions for Linux, we had a hard failure on one of the machines that we use for daily editing work. It holds most of the master files for active books. It was one of those failures that ends up being cheaper to replace the machine rather than repair it.

On the plus side, it was an excuse to pick up one of the quad-core Intel machines that Gateway and others are deep-discounting right now. And it was a perfect lesson in the value of regular backups. Since we Ghost the machine daily (sometimes more often, using Ghost’s triggers), we were able to recover our data with just a few hours of lost work. It takes about ten minutes to set  up automated backup tasks in Ghost and other backup software, and then you just forget about it until you need it (and you WILL need it!).

On the minus side, I’m now starting to be obsessed with data protection…a rack of RAID is just what we need right now…

About a month ago I started evaluating backup solutions for the web sites I host on my remote servers. I’ve had a little Netgear NSLU2 (Slug) doing the job…the Slug is a tiny Linux server…it’s about the size of a deck of cards…that come with two USB ports and an ethernet connection. Although the NSLU2 is preinstalled with a Linux distribution, I reflashed it with Debian. The little Slug has been doing nightly backups via rsync for three or four years now, storing them on an external drive. Once a week I burn a snapshot to DVD.

Why replace something that works? I’m beginning to worry that the NsLU2 might give up the ghost. I suppose it’s just paranoia, after all the thing has an uptime of 342 days today, and seems to be working fine. I think it was the launch of the new KidPub Press bookstore that made me rethink the backup strategy.

The difficulty I had finding a solution is that the servers are running a Red Hat variant of Linux (CentOS), and I wanted to to backups to a local Windows 7 box, mainly for ease of use. Even though the Slug does a great job, it’s incredibly slow…it takes a couple of hours to build a1G ISO image for burning to DVD, for example. My requirements were pretty simple. I need to do a one-way daily mirror of several directories and the MySQL databases.

I evaluated seven solutions:

• SiteShelter
• HandyBackup
• Backup4All
• Site Vault
• Unison
• DeltaCopy
• cwRsync

The first four are commercial products ranging in price from $200 to $40. The last three are open source.

Of the commercial solutions, only SiteShelter was able to properly mirror the remote server. The issue is that most of the backup programs rely on an Attribute flag on a file to determine if a file has been archived, however the flag doesn’t exist in the Linux filesystem. The symptom of this is that an incremental backup will download everything, even ify ou’ve just done one, because the software doesn’t have any way to tell if it has already downloaded a file.

SiteShelter is able to correctly manage incremental backups from the Linux box. Its interface leaves a lot to be desired, though. In its defense, the program is supposed to be run as a service, but I don’t think that’s an excuse for having an awkward human UI. Of the three commercial solutions it is the most expensive, at $200 for a single license. Although I thought SiteShelter was promising, I really didn’t see any advantage in using it versus using rsync, which is free.

The trouble, of course, is that there is no native rsync for Windows. I started looking for rsync ports. Most of them rely on Cygwin, and excellent Unix emulator for Windows that’s been around for as long as I can remember. Installing Cygwin just to get rsync seemed like overkill, ven for a Linux guy like me. Instead, I found three packages hat bundle just enough Cygwin with rsync to provide a backup solution for Windows.

Unison is the most complicated, and I rejected it for its complexity. It just does way more than I need, and just configuring it for a quick test took an hour.

DeltaCopy works but suffers from a very poor user interface. I didn’t have a lot of confidence in it because of this.

I settled on cwRsync. Although it has a UI based on GTK, I didn’t use it. It is identical to rsync on the Linux side, so I simply copied over my rsync script from the NSLU2. I had to change the destination directory, but that was the only configuration required, and the exclusion file I’ve added to over the years didn’t need to be changed at all. Ten minutes setting up the batch file to run in Windows Scheduler and I was done with my backup solution. It’s fast, secure (uses SSH), and just works, which is my #1 criteria for any product.

One other bit of information…a few of the commercial products try to back up MySQL databases by logging on to them directly. I didn’t get a lot of good feelings about these, and they seemed terribly slow. Because I ended up using rsync, I stuck with my old database backup strategy, which is a cron job that runs on the server that uses mysqldump to create snapshots of all of the critical databases. These files are dropped into a directory that rsync monitors for its daily run.

I now have a solid backup system to a Windows machine that is fast, easy to use (the remote directory structure is duplicated locally), and provides a quick burn to DVD. That it is free and a familiar and trusted solution is icing.

I recently spent about a week evaluating shopping-cart platforms for the new KidPub Press online bookstore. My requirements were actually fairly simple; I wanted something that:

• Is easy to administer
• Can be made to look like a bookstore
• Has PHP as the underlying code
• Integrates with Linkpoint as a payment gateway

The three prime contenders were Drupal (already in use at kidpub.com), Magento, and Zen-Cart.

I ruled out Drupal pretty quickly. even though I’ve used it for several years for the main KidPub site, I see it as a CMS platform, and what I really wanted was an e-commerce platform. Drupal can certainly be made to look and act like a bookstore, and it does have a Linkpoint module (though it is ‘beta’ code), but at the end of the day Drupal is about managing content, not transactions.

Next up was Magento. I’d read rabid reviews of the thing written by people who are just in love with the platform. I tried for about a day and a half to get Magento running correctly on my staging server without much luck. Wrong PHP version. Wrong SSL library. Database problems. I’m no slouch, having been knee-deep in Linux and Unix for about twenty years now, and I couldn’t get Magento to run in a way that gave me any sort of confidence. Letting it manage credit card transactions was out of the question, and it turns out that Magento and Linkpoint don’t play well together. Authorize.net? Out-of-the-box. Linkpoint? Good luck.

Zen-Cart was actually my second choice. Magento LOOKS fabulous, and I wanted that look for the store. Zen-Cart looks, well, a bit homemade, and there’s an expectation that you will roll up your sleeves and dig into the code if you want anything other than default behavior. To be fair, I’ve seen some outstanding sites powered by Zen-Cart, but I honestly don’t have the talent at hand to do such design work.

What sold me on Zen-Cart was that after literally two days of wrestling with Magento (and not getting ANYTHING to work), it took about ten minutes to get Zen-Cart up and running. Another few hours of tweaking and adding product, and I had a complete e-commerce site with full payment gateway integration AND that looks and acts like a bookstore. There’s a ‘book’ product module available, and I paid for a template look-and-feel that I thought was nice.

I’m pretty comfortable tweaking the PHP code in Zen-Cart, and I’ve done a moderate amount of customization. My impression of the Zen-Cart community is that there isn’t a lot of deep coding expertise, at least among the majority of users. There’s a lot of ‘find this line and change this value’ advice in the forums. That’s fine, Zen-Cart is a simple system and if I need to tweak a table or edit PHP to change some text, I don’t mind.

If what you need is just shopping-cart functionality without a lot of bells-and-whistles, consider Zen-Cart. Magento, in my opinion, just isn’t ready for commercial deployment. And Drupal? It’s still a pretty good CMS system.

You can see our Zen-Cart implementation at the KidPub Press bookstore.

Those of you who know me even moderately well will be stunned to hear me say this: Windows 7 marks the end of the line for Linux on the desktop.

I’m a huge proponent of open source, and of Linux in particular, and I’ve actively used Linux since around 1994. Two of my current computers are running Ubuntu, and I use CentOS on the site’s web servers. In my former role as an analyst at a large market research firm in Boston, I wrote that Linux had boxed itself into a corner on the desktop by trying to be too much like Windows. Linux UI developers, particularly the Gnome and KDE teams, succeeded in their goal of making Windows users comfortable enough with Linux to switch by making their UIs so close to Windows’ as to be indistinguishable.

At that moment, any differentiation between Linux and Windows was lost. Desktop hardware has become robust enough that we don’t need an OS and GUI that runs ‘faster’ on limited specs. User applications like email and the browser are nearly identical. And, for corporation, why retool IT to deploy a desktop that looks and feels (and, for the most part, performs) just like Windows? Why not stick with Windows?

A few years back, though, Microsoft accidentally left the door unlocked and the car running when they shipped Vista. IT departments avoided it like the plague, but at the same time needed to update their installations. Distributions like Ubuntu came exceptionally close to making serious inroads on the corporate desktop, solely due to the enormous void left by Vista. That window of opportunity lasted a couple of years, and Linux could have pushed through the final barrier of resistance to deliver on its promise of an inexpensive, solid desktop solution.

It didn’t make it. Windows 7, now out as a release candidate, is so much better than Vista and XP that IT departments are going to breathe a collective sigh of relief and haul out their checkbooks. Win 7 is peppy, just like Ubuntu / Gnome, it’s pretty, and nearly all of the little things that drove frustrated Windows users to Linux have been fixed. There’s even less of a difference now between Linux and Windows on the desktop, except for the still large number of Windows applications that have no usable Linux counterpart.

Ah, but what about netbooks? Surely that’s the perfect place for Linux!

I disagree. I own a Linux netbook (the Acer One), and I love it, but only because I wiped the nearly useless, watered down software that it came with and installed Ubuntu (with a custom kernel that I compiled myself for speed and efficiency). The Linux experience on netbooks just isn’t that great. Once Win 7 is customized for the netbook market, there will be no compelling reason to install Linux on one.

Lest you think I’ve completely abandoned Linux, it isn’t true. I’m an open-source proponent, just not a zealot. Linux in the server room still makes a lot of sense, and there will always be those companies who embrace open-source technologies as a matter of principle. As an analyst it was quite clear that there weren’t significant financial incentives to choose Linux over anything else in the data center, and there will always be a split between the Unix camp and the Windows camp. Linux just makes sense on a server.

On the desktop, though…I’m a Win 7 convert!

KidPub was on the road with a booth at the NJ State Homeschooling Convention a few weekends ago.  Some people hate trade shows, but I’ve always found them a great way to get feedback from your audience. Back in the day I did many shows as Editor of 73 Magazine, then later on with CUSeeMe Networks, and now with my own publishing company.

Here are a few notes for those who are thinking about doing their first show and might be wondering how to maximize their time.

1. Keep the message simple. Are you introducing a new product? Trying to sell an existing one? Both? Don’t confuse the audience…you have about 15 seconds to capture their attention, and if there’s too much information at your booth, they’ll just walk away. Pick the message that you want to drive home, and build your booth around it.

I violated this rule at the NJ show, and it haunted me for two days. We have two lines of business…books and a membership-driven web site. On the first day I tried to talk about both and ended up confusing people. On the second day I let the visitors drive which they wanted to talk about, which worked better, but I could have avoided the issue entirely by just doing one or the other.

2. People will take just about anything that you hand to them.  If you wait for visitors to come to your booth, you’ll miss about 75% of the attendees. It isn’t rude to walk up to a complete stranger and hand them a brochure at a show…they are there to collect information. Standing around behind your table is much too passive, you must get in front of your booth, hand out information, and literally lead people back to your table.

3. ASK FOR THE SALE. Even professional sales people forget this simple advice. You aren’t going to make a sale unless you ask for it. Create urgency by offering a ’show special’ price, and ask visitors point-blank if they want to purchase RIGHT NOW. Again, it isn’t rude…visitors don’t have a lot of time to spend while you go through a long-winded sales pitch. Show them what you’ve got, tell them the price, and ask for the sale. If they decline, hand them a coupon for the special price that they can redeem later.

4. Save money on booth decorations. Here in Boston, you can spend a couple of hundred dollars on a single 6′ x 2.5′ vinyl banner for the back of your booth. Or, you can go to Vista Print and get the same thing for $25. No one is going to remember what your booth looked like when they leave the show…make it look nice, but don’t spend a fortune on decoration just because you like it.

5. Use the 15-foot rule for signage. For some strange reason, even though people go to trade show vendor areas to look at the booths, they will do everything they can to avoid actually visiting your booth. They’ll avoid eye contact with you, walk out of their way to keep outside your zone…it’s really silly but I see it all the time. Because of this, any important message that you want to be seen should be readable from about 15 feet away. The message should be nonthreatening and make the viewer want to come over to see what you are doing.

6. Wear comfortable shoes. Take some time during your pre-show planning to consider what you’ll need to stay comfortable during the show. If you’re a small business it might just be you manning the booth, so take water, simple snacks, paper towels, and maybe a special treat or two, plus comfy shoes. You’re going to be standing for eight or more hours a day for a couple of days.

7. Take plenty of notes. You’ll have lots of great insights and ideas during the show. You’ll completely forget them if you don’t write them down. Just keep a little notebook under the table and jot them down as they come to you…you can process them once you’re home.

8. LISTEN. This is your chance to do invaluable market research. It’s tempting to want to explain everything about you, your company, your product, the weather, and so on, to every visitor that walks into earshot, but avoid the temptation and just listen. You’ll find out whether people understand what you do, or are confused by your messaging, by listening to their questions. You might even start a conversation with, “What do you think we do here?”

I think that this is one of the biggest reasons to do a show…it gets your company in front of thousands of potential customers in a short period of time, and it allows you to observe how they react to your product.

9. Talk to other vendors. You’ll get to know your immediate neighbors pretty well, but make a specific effort to talk to other vendors at the show, even your competitors. Find out what shows they go to, how they are doing at this show, look for opportunities for cooperative marketing, and get your name out there. Be sure to bring a long a stack of your business cards to hand out to these folks. Follow up with the vendors that interested you after the show, even if it’s just a ‘Nice meeting you’ note.

10. Have fun. Shows can be a lot of fun. Take the time to wander a bit and take it all in.

Good luck at the show, especially if it is your first. You’ll have a great time, meet a lot of nice people who are genuinely interested in what you do, and gain valuable insights into your business!

Fresh, constantly changing content is the lifeblood of many web sites, but generating content can be challenging. The audience at KidPub are voracious readers of books written for teens and tweens, and we’ve turned to Twitter to help drive traffic to our site.

There are about 150 well-known (to teens at least) authors who regularly use Twitter. We use a simple script developed by Kent Brewster to search Twitter for updates from 100 of these authors and display them on a page called YA Tweets. KidPub readers love it…they can catch the latest news from their favorite authors in what feels like a very intimate way. What did Meg Cabot have for breakfast? What’s Maureen Johnson thinking about as she writes her next book? It’s all there in the tweets. You can see our page in action here.

You can easily apply this technique to your own demographic. What is vitally interesting to your audience? Create a search filter for Twitter that reflects what matters to your readers, and display it on your site. Surround the page with links out to your other content, and you have a self-generating, constantly updating traffic attractor.

Just a quick post about Peter Shankman’s Help a Report Out (HARO) service. If you haven’t heard of it, it is a social network operating by Twitter and email of about 50,000 individuals. Reporters, journalists, authors, and other media tap into the collective knowledge by submitting requests for information, and receive responses from whoever feels that they can help out. A typical request might be, “I’m a reporter for the NY Times looking for individuals who have recently vacationed in Ohio, for an article on where to go when you can’t afford anything else.” HARO requests come out three times per day.

We’re launching a new feature at KidPub where we will feature an author of young-adult books, and the kids will have a chance to ask the author questions. Not terribly original, I know, but it’ll be a fun thing to do. I sent out a HARO request this morning asking for any authors who might be interested in helping out, expecting two or three, or if I was lucky, five.

In five hours I received just under 100 responses, including notes from executives at several well-known publishing houses. It’s going to take a week to sort through them all! This is social networking at its best, and it’s why the ‘Google Buys Twitter’ rumor is so persistent…real-time access to tens or hundreds of thousands of human brains is the ultimate search engine, at least for some classes of queries.

Hats off to Shankman and HARO!

Here’s a chart of recent traffic at KidPub. Keeping in mind that our audience is under the age of 15, what day of the week would you expect those peaks to fall on?

You’d think that we would see a nice little peak on Saturday and Sunday, trailing off as the kids went back to school for the week.

You’d be wrong. The peak traffic day for KidPub is Wednesday, and it’s been that way for years. Our lowest traffic day of the week is Saturday. I’ve never quite figured out why this happens, but you can practically set your clock by it. Is it that homework is lighter in the middle of the week? Are the TV shows less enticing? I’ve asked my members in the past bu haven’t come up with anything conclusive.

Because it’s so regular, I plan around it. I tend to send press releases out on Wednesdays so that visitors from the press will see a very active site. I try to do maintenance tasks and upgrades on weekends when I know that traffic will be lighter. It’s the Rhythm of KidPub.

Many small companies, like KidPub, have to watch every dollar spent. I’m always looking for ways to cut costs while not sacrificing either quality or progress toward my business goals. For a publishing company, PR is incredibly important, but it can also be incredibly expensive. We send out a press release for each books that is published, plus releases for contest announcements and general news.  It can add up to five to ten releases each month.

When I started shopping around for a PR agency to handle my account, I quickly realized that press releases were going to be a significant slice of my marketing budget. I wanted to know if there were alternatives to traditional agencies that might save money but still be effective.

I’ve used some of the online firms in the past with limited success. They typically charge a per-release fee with a suite of add-on services that can inflate the final bill. These companies, such as PRWeb, do an ok job of sending out your release and tracking it, but it seemed that my releases were getting lost in the flood of PR that goes across their wire.

Finally, by a stroke of luck, I found Mondo Times and its sister site, EasyMediaList. Mondo’s goal is to be a source of media information. Say you wanted to send a letter to the editor of the Milwaukee Herald. it takes just a few clicks on Mondo to pull up contact information for the paper. Mondo is a membership site, and to get the phone, fax, and email of the editor it’s $80 a year.

That’s actually a pretty good deal, and I use this service to look up editorial information for hometown news media of each author that publishes with KidPub Press. I’ve found that the local newspaper nearly always will run a story about the young author.  Mondo lets you search by city, so it’s quick work to find the half a dozen news outlets in an author’s hometown and put together a list for the press release.

The better deal at Mondo, though, is their Professional level membership at $199 per year. You get all of the data and lookup features of the $80 membership, but you also get five free mailing lists for Mondos sister site, EasyMediaList.

EasyMediaList sells contact lists for media. You can purchase lists by state, major metro area, subject, and so on. The lists are priced according to size and range from $30 to a few hundred dollars each.  For KidPub, I used four of my five free lists from Mondo membership to grab the top 100 media outlets, the educational media list, and the parenting and kids media lists. The lists are high-quality (for example, Parenting Magazine, Scholastic, Nickelodeon, and Sports Illustrated Kids are included) and clean…I get very few bounces on the emails included.

I send out press releases to segments of these lists, depending on what the news is. Do they work? Yes. I’ve gotten responses from many major media outlets from releases sent to these lists. It’s well worth the $200 annual membership fee.

The other piece of the shoestring is Skype. We only have one phone in the office, and for $5 per month we’ve set it up with an inbound phone number and unlimited domestic calling, and it includes an answering machine. I can afford to spend afternoons on the phone calling media contacts…the phone numbers are on the EasyMediaList lsits…to follow up on press releases. I think that editors appreciate hearing an actual person on the other side of the press release, and I’ve gotten a great response.

Between Mondo and Skype the majority of KidPub’s PR needs are met, and I can concentrate on growing the business instead of worrying about the marketing budget.

I’ve written before about Quantcast and how I believe that they are one of the few services producing reliable market data on website performance. One of the features that they offer is a little graphic showing the mix of users of your site. They don’t name it, but it’s a kind of classification graph that splits your traffic among addicts, regulars, and passers-by.

An addict is someone who visits your site at east once each day. Regulars visit at least once each month, and passers-by drop by once and then never show their face again. Here’s an example from KidPub:

The way to read the information is that fewer than 1% are KidPub addicts and represent 4% of all visits.  Fourty four percent of the traffic is from regulars, who represent 20% of all visits. Just over half of the traffic is generated by passers-by, who make up 80% of all visits.

This is extemely useful information that shows that I need to work on converting passer-by into regulars. These numbers are substantiated by the Google Analytics bounce rate number for the home page of about 70% (in other words, 70% of visitors to the site leave after viewing the front page of the site).

In comparison, here’s what Facebook looks like:

Well over half of their visitors are regulars, which is where I’d like KidPub to be, too. Facebook rival Myspace has a similar pattern. These are sites that are capturing and keeping a community of loyal users. Even though KidPub has a dedicated group of users, we need to do a better job of pulling in the passer-by, helping them see that KidPub can be a fun, engaging place to visit again and again.

Data like this can be invaluable in helping you track and understand your traffic and should be the baseline you use to measure work done in this area.

I saw an interesting article in Delivery magazine today profiling the US tween market (kids ages 8 to 14), which is our market here at KidPub. There were a couple of factoids that stood out. First was the size…23 million strong. Next was the average disposable income, $2,047.

The last fact was the most fascinating. Of the 23 million tweens in the US, eighty five percent (85%) spend at least one hour PER DAY on the Internet. That’s a $47B market that is spending a minimum of 5 to 7 hours per week online.

I don’t think we’ve really figured out yet how to deliver a message to tweens in a way that is responsible, respectful of their age, and yet effective. This is population that doesn’t notice banner ads, pop-ups, pop-unders, or contextual advertising. The kids I’ve talked with about it say that they simply ignore this kind of advertising.

It seems like old-fashion word of mouth (or word of mouse, these days) is probably the most effective way to get a message out to this group. Social networks are starting to show their potential for this kind of marketing, but few will admit to targeting tweens. Facebook demographics are continuing to skew older, and although it’s hard to assess Twitter’s audience, I think it’s also an older crowd.

At KidPub we’ve offered more than one word-of-mouth program, including a reward for referrals and an invite-a-friend link on every page. None have really been successful, and we’re still looking for a way to encourage our members to invite their friends.

The bottom line is that tweens represent an exciting market, but one that is already savvy and largely resistant to marketing methods that have been around for as long as the web itself. We’ll continue to market one tween at a time!