A tortoiseshell is quite unlike a wp2shell. Credit Maddydumont.
Last Friday, a new and extremely serious vulnerability in WordPress was announced. To summarise, WordPress installs from 6.9 onwards (roughly December 2025) can be compromised remotely, allowing attackers to gain full access to the hosting account that it is running on.
We ensured that all Managed WordPress sites were upgraded promptly, as we do with all vulnerability announcements affecting WordPress and its plugins. As it happens, many of our managed sites were not vulnerable due to some custom hardening rules that we apply by default to managed installations.
We also have a large number of customers running unmanaged WordPress installations on our hosting accounts. Maintaining the security of these installations is the customers’ responsibility and we generally try to avoid interfering with customer sites. In this case, the severity of the vulnerability, and the speed with which we saw exploitation attempts, meant that we felt compelled to take action.
Many users don’t take security too seriously, assuming that their site isn’t important enough to be a target. The reality is that all sites are a target, as compromised hosting accounts can be used to send spam email, or host malicious files for other attacks, and cleaning up after an attack is a lot of work for everyone.
The exploit can be prevented by a simple and non-invasive addition to a site’s .htaccess file that blocks requests to certain URLs. Therefore, we took the step of scanning our hosting servers for WordPress installations that hadn’t been updated (most sites will update themselves automatically) and added the necessary rules, along with a comment explaining why it was done.
Of course, if you don’t want to spend your Friday evenings worrying about critical security updates, our Managed WordPress is still welcoming new customers.
We infer that the site wifi was one of the first things to start working in the setup process
We’re silver sponsors for this year’s Electromagentic Field. Held 16th–18th July in Eastnor Castle Deer Park, it’s a magical camping festival full of weird and wonderful things. We went in 2024 and saw a huge variety of amazing things including a very big Tesla Coil.
This year, in addition to our direct sponsorship of the festival, we’re providing various internet resources to help keep things running. We’re an upstream provider for the network and are already seeing traffic flowing. We also provide some offsite backup space.
Some of our staff are going to be at EMFCamp too and have some things to show. We think there’s something space-themed being created by @bencc@morehammer.uk, and GCHQ will be back with their interactive treasure hunt. We asked our staff for more clues about GCHQ.NET, but they all denied all knowledge about it. In fairness, that’s exactly what we’d expect the organisers to say.
One project we’re helping out is the copper telephone network. To interoperate with the world, we’ve donated a Virtual Private Server to run the SIP gateway to allow inbound and outbound calls. We hear rumours that it might be possible to get VDSL over copper phone if for some reason gigabit Ethernet in the middle of a field wasn’t good enough.
Rather than pictures of text, we prefer actual text.
We’ve recently updated the look and feel of our homepage. All the work has been done in-house by our own staff, and we’re hopeful that other organisations might steal some of our unusual ideas:
No pop-ups; any feature requiring a cookie banner will not be permitted, and you definitely won’t be pestered to join a mailing list.
The website should clearly state what services we offer and how much they cost.
The website should be fully accessible.
No third party dependencies – everything is served from a mythic-beasts.com domain on servers we own and operate.
Minimal number of HTTP requests and small pages so our front page is faster than the home page of high performance content delivery networks.*
No existing feature should stop working as a result of the redesign.
Works perfectly for an IPv6-only user.
In updating our homepage, we’ve tried to better describe what it is that makes us different and in order to backup our claims of “fair, no-nonsense pricing” we’ve now documented our pricing policy in unnecessary detail.
We are always adding features to our website and control panel, and over the last year we’ve had a particular focus on improving accessibility. We now have an internal instance of Pa11y which automatically checks our pages for accessibility issues. Pa11y caught an accessibility regression in our rollout which we’ve now resolved. If you do encounter accessibility issues on our site, please do report them.
We’re also in the process of updating our website to consistently show prices inclusive of UK VAT, and have now done so on our homepage. For historical reasons, we’re not consistent on this, although we do always state which one it is. VAT treatment is always tricky, as many of our customers are not in the UK and thus may pay a different rate of VAT, or no VAT at all, and we also have many VAT-registered customers who prefer ex-VAT prices. Showing VAT-inclusive prices can make us look more expensive compared to our competitors – always check that you’re comparing like with like.
* We measured our homepage at about 300ms, compared to 2-5s for popular content delivery network homepages we compared with.
Taking the tree theme to heart, Dam Designs have built the core structure direct from the forest. The ducks have gone but beavers are in.
We’ve been to Robocon again this year, renewing our sponsorship of the Dam Designs team (formerly Little Devils) and their redesigned autonomous self-driving robot. The team is now a mixture of primary and secondary school students and with several years’ experience behind them, they took on 16 teams in this year’s more difficult arena.
Each robot is allocated a quarter of the arena, and the goal is to get as many points as possible by collecting cubes and dropping them in their own quarter of the arena. Bonus points are available for dropping cubes in the smaller “home area” within the quarter, or stacking cubes on top of other cubes. Four green cubes start in the central neutral zone and part way through the competition, higher scoring red cubes start to drop one by one. For full details see the competition website.
Is it a bug or a feature?
In the quarter final, the team pushed a code update to prefer picking up the higher scoring red cubes. Unfortunately it didn’t quite go to plan, and by mistake they coded their robot to ignore the lower scoring green cubes entirely. This resulted in a heart stopping moment at the start of the competition where the robot drove to have a view of the neutral zone and then stubbornly sat still while all the competitors cleaned out all the low scoring cubes. As soon as the high value red cubes were dropped the robot rushed in to collect them and take them home, neatly winning the round.
Whilst this wasn’t the intended behaviour of the code, it turned out to be a very good strategy for winning the round. A debate within the team followed: patch the code to try and get extra points from a green cube, or eat sweets and re-enter the winning robot for the semi final unchanged? The engineering conclusion was WONTFIX and the robot won the semi-final too.
Robot collecting a red cube and returning to base and stacking on a green cube for double bonus points
Third place
In the final the team got unlucky; the robot spun the wrong way and spent a very long time staring at the wall instead of looking for a cube in the neutral zone. Whilst the robot very slowly turned itself around, the competing robots picked up the green cubes and collected some points. In the final seconds our team’s robot spotted a red cube and rushed towards it but was powered down by the end of the round before it was able to fetch it.
We’re delighted to announce that we’ve renewed our silver sponsorship for Electromagnetic Field 2026. We’re also providing EMF with internet transit and backup services in our virtual server cloud.
EMF is a long weekend camping in a field which is filled with approximately everything. Last time we saw huge tesla coils, a paper rocket factory, and active satellite tracking amongst many other things. The various attendees have had two years to build on the learnings of Astrophysics for Supervillains so we are nervously looking forward to the results.
The field comes with everything the modern camper needs: not just power and internet but space to pitch your tent, a 2G GSM phone network and a full copper phone system. You can bring and use your own fax machine or classic Nokia GSM phone.
Lots of our staff members are looking forward to a fun weekend.
Equinix AM5 is strangely absent from most “what to do on a night out in Amsterdam” guides, but this was the destination for three of our team who went on a company-funded all-nighter back in October.
We acquired our Amsterdam presence in 2017 as part of our acquisition of BHost. We integrated it into our core network and migrated all customers onto our own virtual server platform.
Since then, we’ve refreshed much of our London data centre space with our data centre expansions to Telehouse and City Lifeline including moving to fully-routed networking.
Our Amsterdam site was next in line for an upgrade, but it’s location presented some logistical challenges. Firstly, it’s a bit tricky for us to get to. Secondly, the Amsterdam data centre freeze meant that we couldn’t follow our preferred approach of deploying new kit in an adjacent empty rack, migrating, and then decommissioning the old space. The upgrade had to be done in-place, which is unavoidably more disruptive.
In order to minimise the impact of this, we ended up doing the vast majority of the work in a single, overnight session.
The end result is a very substantial upgrade to our Amsterdam site. As well as the deployment of our new networking platform, the virtual server hosts have been replaced with faster, more power efficient models. Existing customers have been live-migrated onto the new servers which feature all NVMe storage for much faster IO. In the new year, we have further capacity due to be installed and we will fully decommission the previous generation of servers. Whilst using low carbon energy to power servers is good, not using energy is even better.
This upgrade was months in the planning, including co-ordinating shipment of the new servers from a local supplier, and working closely with Equinix staff to perform the PDU swap. An earlier preparatory trip to (amongst other things) identify the best local pizza suppliers was also essential. We’re very grateful to the staff that put in some very long hours to make it go so smoothly.
The DNS Fund exists to help maintain these critical projects. (Image xkcd 2347; CC BY-NC 2.5)
One of our founders, Pete Stevens, has joined the expert advisory panel for the Nominet DNS Fund. Nominet are intending to distribute £370,000 to open source DNS projects.
The fund has a very simple goal, to improve security and sustainability of open source DNS projects. The means is similarly simple, make it as easy and straightforward as possible for open source critical infrastructure components to access needed funds.
We’re excited to be able to help to steer the fund. One thing that attracted us was the implementation goal of ‘Minimum Viable Bureaucracy’; the application form must be short and it must be simple to complete. The fund wants to fund people and organisations that are good at writing and maintaining software, not specialist form fillers. An individual applying has to answer eight questions and a maximum of 2000 words. We enthusiastically encourage answers that are short and to the point (not least because Pete will have to read them!).
We’re also overjoyed that the fund can consider ‘boring’ applications. Maintaining a project or bringing more developers in to ensure long term sustainability of a project are things that are in scope. The fund does not require new features and new code; fixing and improving existing code is fine. The fund will also be able to support projects that are dependencies of DNS projects, as well as those which directly relate to DNS.
The application form is here. Please share with any project that is in scope and would benefit from funding.
As an independent virtual server hosting provider, VMHaus was not financially viable. Post acquisition, we significantly reduced the costs of running VMHaus by using economies of scale from Mythic Beasts. We could recycle retired servers and disks from Mythic Beasts into VMHaus making their hardware effectively free. We provided rack space and transit from Mythic Beasts data centre space at cost price, taking advantage of Mythic Beasts economy of scale and buying power. However, an energy crisis and high inflation post-Covid meant that VMHaus would likely never become financially viable and in 2024 we took the decision to close the company. We gave all VMHaus customers six months notice to migrate to another server, with an offer of discounted hosting in the Mythic Beasts cloud.
VMHaus ran used a pre-payment model; customers had to buy credits in advance, then use up the pool of credits by running virtual servers. If your credits ran out, the servers stopped working and it was your responsibility to refill the meter before this happened. They also had some neat technical features we’ve incorporated into the main Mythic Beasts cloud – per-second billing, cloud-init for customising installs at boot and fully private network segments for each virtual server with IP address portability.
The pre-payment model made the shutdown of VMHaus a bit more complicated as VMHaus held funds that would not be used prior to the shutdown of the company. In order to refund unused credit, we needed customers to tell us where to refund it to, so in order to put a time limit on the wrap-up, we gave customers with positive balances a choice: get a refund, or donate the balance to the NLNet Foundation, defaulting to the latter if we don’t hear from you. The credit balances were typically very small, and in many cases, the accounts had been inactive for a number of years. Donated balances were each rounded up to the nearest dollar, reflecting the fact that this option saved us PayPal payment fees.
The NLNet Foundation funds projects that create and maintain key internet infrastructure – the sort of software that VMHaus and Mythic Beasts rely on.
We’re very pleased to say a large number of customers actively asked us to donate their balance, and combined with the balances from customers who didn’t respond to our many email reminders,we ended up with a final balance of $5240. We rounded this up to €4550 and sent it to NLNet Foundation.
Little Devils and their duck covered robot dragon.
Robocon is a competition run by Hills Road Sixth Form College in Cambridge. Teams of secondary school students build autonomous robot dragons which rampage around the area stealing sheep and gems and taking them back to their lair. The more things your robot dragon steals the better. As soon as we heard there were Robots and Dragons we sponsored one of the teams: the Little Devils.
The Little Devils are five primary school girls who entered a competition for secondary students because the rules didn’t forbid it, and somehow everyone forgot to tell them it was too hard for them. Which is just as well: it wasn’t.
The contest
The goal of the contest is to build a robot and program it to complete a set of challenges autonomously (without human input) within a specially designed arena. Each team gets a quarter of the arena as their home area. At the back of the area is their lair. The arena contains sheep and gems (cardboard cubes) and points are awarded for each sheep returned to the team’s home area, with extra points for placing a sheep or gem on top of the lair. This involves picking the cube up and placing it on a 15cm high shelf.
2D barcodes are displayed around the arena, on the lairs, and on sheep and gems.
Each team is supplied with a ‘brain’ as a starting point for building their robot. This is a Raspberry Pi Zero with an attached camera. This comes with OpenCV and some libraries that tell you every time the camera sees a 2D barcode, along with an estimate of how far away the barcode is and what angle it’s at. The brain also has motor controllers, and general purpose IO.
The battle arena for the Robot Dragons, with machine readable codes on all the sheep (cubes) and gems (coloured cubes).
Collecting sheep and gems is made even trickier by the fact that once you get close to one, the camera can’t focus on it, so the robot has to guess exactly where to stop in order to pick it up. Once picked up, the robot can then search for the marker for its lair and drive towards it to drop the item off. If they taught trigonometry in primary school they could write more sophisticated software that would work out how to travel based on any marker they can see. We’re already looking forward to next year.
This year’s competition took place on 9th and 10th April, and we were pleased to see a variety of robot designs and programming approaches. Some teams tried to round up as many sheep into their space as possible. The Little Devils’ approach to collecting sheep and gems was a vacuum grabber which would try to pick up the cubes and then drive them back to their lair to get the bonus points.
The Robot
Dragon with robot arm, sucker and a lot of ducks.
One of the most important skills in professional programming is the rubber duck technique. This robot has a Redundant Array of Independent Ducks such that programming can continue at full speed even if a duck is lost in the battle. The ducks were a late addition, and resulted in some last-minute code changes; in testing the Dragon wasn’t laden with ducks and moved faster, so some constants in the code had to be tweaked in order to drive the motors harder to cope with the additional weight from the ducks.
The robot has a software-controlled robot arm to pick up the sheep and gems. There’s a vacuum pump that switches on when the robot thinks it has a gem. Once the pump is on, it lifts up the arm high in order to clear the camera’s view. There are two powered wheels; selectively driving one or both allows the robot to turn or travel forwards or backwards. All of the software was written by the team members with the robot manufacturing done under adult supervision.
The result
We’re really pleased to report that the Little Devils took the third place trophy. We are somewhat concerned that this appears to be the plot for an origin story where a set of super villains destroy humanity with their robot army. Perhaps we should have put “you must not take over the world” in the sponsorship agreement.
Early in 2023, we started providing sponsored hosting to the Open Rights Group (ORG), in order to support their campaign for digital rights in the UK. Our motivation for sponsoring them is simple: we require security in order to provide our services, and our encryption requirements have only increased since we last mocked the government’s plans to ban it. The current government’s latest efforts on this front underline the ongoing importance of the ORG’s work.
Encrypted data can only be accessed by the holder of the key. This locks out everyone else – including the government. Successive governments keep trying for a magical solution which gives them, and only them, access too, despite the fact that such an approach only serves to undermine the security of the legitimate, everyday uses of encryption. It turns out that when faced with implementing the impossible, providers will simply turn off security entirely, as Apple have just done by disabling Advanced Data Protection for UK and only UK users.
We continue to support the Open Rights Group and their work to try and allow UK users to secure their own data. Our sponsored services provide public facing servers for the ORG website, the @openrightsgroup@social.openrightsgroup.org fediverse presence and the blocked.org.uk service which tracks which sites have been blocked by major UK ISPs. We also host internal Nextcloud, Collabora Office, Matrix and email services.
Post by @openrightsgroup@social.openrightsgroup.org
.jpg){kind=link}