Feuerfest

Photo by Pixabay: https://www.pexels.com/photo/flare-of-fire-on-wood-with-black-smokes-57461/

This topic comes up far to often, therefore I decided to make a blogpost out of it. After all copy & pasting a link is easier than repeatedly writing the same bullet points.

Also: This is my private opinion and this article should rather be treated as a rant.

• Mail templates are separate files? And the workflow to create them is seriously that antique?
  
  • Under Create an email message template (microsoft.com) Microsoft details how to create an email template. But you notice something? They use the term "[...] that include information that infrequently changes [...]" means only static text is allowed.
  • Yep, you can't draft mail templates where certain values get auto-filled and the like. I mean, how many employees, consultants, etc. have to sent their weekly/monthly time-sheet to someone? Is it so hard to automatically fill in the week number, month and automatically attach the latest file with a certain file name in a specified folder?
    • Yes! Automating this with software is surely the best way. But we all know how the reality in many companies looks like, right?
  • Additionally the mail templates are stored as files on your filesystem under: C:\users\username\appdata\roaming\microsoft\templates.
    • This means: Mail templates are not treated as mails in draft mode or the like. No, you have to load an external file via a separate dialogue into Outlook. That's user experience from the 1980s?
  • Workaround: Create a folder templates, create a sub-folder templates-for-templates. Store mail drafts (with recipients, subject, text, etc.) in templates-for-templates. When needed copy to templates. Attach file. Edit text manually. Hit send.
  • Never send directly out of templates-for-templates as else your template is gone.
  • But seriously? Why is this process so old and convoluted? I suspect the feature is kept this way because Microsoft is afraid of people utilizing it to send spam. But.. Sending spam manually? I think this stopped to be a thing at May 5th, 2000 (Wikipedia) at the latest.. Every worm/virus out there has it's own build-in logic to generate different subjects/texts/etc. Why deliberately keep a feature in such a broken state and punish your legitimate users?
• No regular expressions in filter keywords
  • This annoys me probably the most. When you specify a filter "Sort all mails, where the subject begins with Newsletter PC news into a folder", Outlook will only sort mail with the exact subject of "Newsletter PC news"
  • Which is stupid when there is a static & changing part in the subject. I mean it's 2024. Support some kind of wildcard string matching via asterisks is not really new, isn't it? Like: "Sort all mail where the subject starts with "Newsletter PC news*" and then "Newsletter PC news April 2024" will also get sorted.. No. Not in Outlook.
• Constant nuisance: Ctrl+F doesn't bring up the search bar - Instead it opens the new mail window..
  • I mean really? Ctrl+F is the shortcut for search everywhere. Why change that!?
  • Info: Ctrl+E activates the search field on top
• Only one organizer for events
  • Ok, technically this isn't outlook but rather CalDAV and hence Google calendar, etc. suffer the from the same problems. But I still list it as a fault.
  • Why? Microsoft has repeatedly shown the middle finger to organizations like the ISO and the like. When it suits Microsoft's market share, they basically are willing to ignore a lot of common standards (like Google, Facebook, etc..). With their Active Directory infrastructure and Office Suite they have everything in-house and 100% under their own control to make this feature work in Windows environments - which most companies do run. But they don't care.
  • I mean.. On the other hand I'm glad that they follow the standard. It just turns out so often to be a feature we are in need of that I stopped counting.
  • And you already need proprietary connectors to properly integrate your Exchange calendar into other mail programs like Mozilla Thunderbird. So this shouldn't be really a big deal-breaker either..
• Only one reminder for events
  • Due to my Attention deficit disorder I tend to have what is called "Altered time perception" or "time blindness". This means I won't experience 15 minutes as 15 minutes or grossly under-/overestimate how much time I really have left. Best description for non-ADDers I can give is: This means I will think of 15 minutes as "Ah, I still have 1 hour left." That this can lead to situations where I am late or wasn't able to fully prepare something for a meeting should be clear.
  • Therefore it really helps me to be able to set multiple reminders for an event.
  • Usually I do the following: 1 hour before, 30min, 15min. This helps me to break out of the time blindness and synchronize my altered time perception with reality. Enabling me to finish tasks before the meeting/event happens.
  • For events like a business trip which take more time to prepare I often set a reminder 1 or 2 weeks in advance. This way I have time to do my laundry in time and so on.
  • Outlook however only supports the setting of ONE reminder.. Yeah..
  • My workaround is to have events also in my private calendar. (Of course without any details and often just a generic title/description as to not store client information on my private device.)
• Remember Xobni? / The search is horrible
  • Outlook search is a single input field and then it searches over everything. You can't specify if the search term you used is a name, part of the name of a file or part of an email address.
  • In the early 2000s there was Xobni. Slogan: "It reverts your Inbox." - Hence the name Xobni. It was a an add-on which added another sidebar to Outlook. There it displayed all people you've mailed with. And when you clicked on a person you saw all mails, all mail threads and, most importantly, all attachments this person had sent to you (or you to them). You could even add links to the persons social media profiles, etc. It was brilliant. And made work so easy. As often I remembered only the person who sent a file to me or the thread in which it was attached - but not the actual mail or even the subject of the mail, etc. Xobni made it pretty easy to work around that. Making it possible to search Outlook in a way in which our brain works.
  • Well, sadly Yahoo bought Xobni in July 2013 and shut it down in July 2014.
  • But it's 2024 and Microsoft hasn't come up with a similar functionality yet? Really?

Photo by ThisIsEngineering: https://www.pexels.com/photo/woman-working-on-computer-hardware-19895718/

I watched an interesting video from the Youtube Channel GamersNexus. It's title is "ASUS Scammed Us".

And in this video they show how the ASUS RMA process is broken and many customers are faced with repair bills higher than the original costs for the devices. Or ASUS claims parts need to be repaired which are not broken according to the customers. Another big topic is also that ASUS regularly claims the customer caused the defect and hence repair isn't covered under their guarantee.

Yeah.. While watching the video you get the feeling the process was designed that way to maximize profit. This means it's intransparent, not flexible enough and generally doesn't have the customer at the core of it's view/goal.

Which sucks. And gained ASUS a place on my "Do not buy from ever again"-list... The video is linked below:

Or, if you prefer a link, here: https://www.youtube.com/watch?v=7pMrssIrKcY

Photo by Tim Gouw: https://www.pexels.com/photo/man-in-white-shirt-using-macbook-pro-52608/

I'm just so fucking happy right now I have never been a customer of GoDaddy. As I learned via Reddit yesterday GoDaddy closed the access to their DNS API for many customers.

No prior information.

No change of the documentation regarding API access.

Nothing.

For many customers this meant that their revenue stream was affected as, for example, the SSL-Certificates for web services couldn't be automatically renewed. Which is the case when you are using Let's Encrypt.

Therefore I can't say it in any other words: GoDaddy deliberately sabotaged it's customers in order to maximize it's income.

Yeah, fuck you GoDaddy. You are on my personal blacklist now. Never going to do business with you. Not that I planned, but sometimes decisions like this must be called out and sanctioned.

When customers asked why their API calls returned an HTTP 403 error (Forbidden) GoDaddy provided the following answer (accentuation done by myself):

Hi, We have recently updated the account requirements to access parts of our production Domains API. As part of this update, access to these APIs are now limited: If you have lost access to these APIs, but feel you meet these requirements, please reply back with your account number and we will review your account and whitelist you if we have denied you access in error. Please note that this does not affect your access to any of our OTE APIs. If you have any further questions or need assistance with other API questions, please reach out. Regards, API Support TeamAvailability API: Limited to accounts with 50 or more domains Management and DNS APIs: Limited to accounts with 10 or more domains and/or an active Discount Domain Club plan.

Wow. The mentioned OTE API meanwhile is no workaround. It's GoDaddy's test API. Used to verify that your API-Calls work, prior to sending them to the productive API. You can't do anything there which would help GoDaddy's customers to find a solution without having to pay.

Sources

Am I the only one who can't use the API? (Reddit)

Warning: Godaddy silently cut access to their DNS API unless you pay them more money. If you're using Godaddy domain with letsencrypt or acme, be aware because your autorenewal will fail. (Reddit)

Photo by Markus Spiske: https://www.pexels.com/photo/green-and-yellow-printed-textile-330771/

I finally got around to update to the recent version of Bludit. And as I made two changes to files which will be overwritten, I made myself a small documentation.

Changing the default link target

Post with code example, here: https://admin.brennt.net/changing-the-default-link-target-in-bludits-tinymce

1. Open file bludit-folder/bl-plugins/tinymce/plugin.php file
2. Search for tinymce.init
3. Then we add the default_link_target: '_blank' parameter at the end of the list
   • Note: This has since been renamed to: link_default_target: '_blank'
4. Don't forget to add a semicolon behind the formerly last parameter

Add proper iframe sandboxing

Add the following to the tinymce.init block in the bludit-folder/bl-plugins/tinymce/plugin.php file

                sandbox_iframes: true,
                sandbox_iframes_exclusions: [
                        'youtube.com',
                        'youtube-nocookie.com',
                        'youtu.be'
                ]

TinyMCE no adds the sandbox="" parameter to all added iframes automatically. This breaks embedding YouTube videos. This changes disables the sandbox for the listed exclusions.

Keep the syntax highlighting

This is outdated, since Bludit 3.18.4 I use a different solution: A better approach to enable line-numbers in Bludit code-blocks

Original post: https://admin.brennt.net/bludit-and-syntax-highlighting

1. Open: bludit-folder/bl-plugins/tinymce/tinymce/plugins/codesample/plugin.min.js
2. Search for <pre and in the class property add line-numbers. It should now look like this: t.insertContent('<pre id="__new" class="language-'+a+' line-numbers">'+r+"</pre>")
3. A little after that pre you will also find t.dom.setAttrib(e,"class","language-"+a), add the line-numbers class in there too, it should look like this: t.dom.setAttrib(e,"class","line-numbers language-"+a)
4. Edit a random blogpost with code in it to verify that newly rendered pages get the line-numbers and syntax highlighting.

Enhancing Cookie security

Update August 2026: This is obsolete since Bludit 3.19

Mozillas Observatory states that the Bludit Session Cookie is missing the samesite attribute and the Cookie name isn't prefixed with __Secure- or __Host-. I opened an issue for this on GitHub (Bludit issue #1582 Enhance cookie security by setting samesite attribute and adding __Secure- prefix to sessionname) but until this is integrated we can fix it in the following way:

1. Open bludit-folder/bl-kernel/helpers/session.class.php
2. Comment out the line containing: private static $sessionName = 'BLUDIT-KEY';
3. Copy & paste the following to change the Cookie name:

   • // Set the __Secure- prefix if site is called via HTTPS, preventing overwrites from insecure origins
     //   see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes
     //private static $sessionName = 'BLUDIT-KEY';
     private static $sessionName = '__Secure-BLUDIT-KEY';

4. Search for the function session_set_cookie_params
5. Add the following line to add the samesite attribute to the Cookie by adding the following line. Also add a comma at the end of the formerly last line.
   • 'samesite' => 'strict'
6. it should looks like this:

   • session_set_cookie_params([
         'lifetime' => $cookieParams["lifetime"],
         'path' => $path,
         'domain' => $cookieParams["domain"],
         'secure' => $secure,
         'httponly' => true,
         'samesite' => 'strict'
     ]);

Check is the RSS-Feed works

1. Access https://admin.brennt.net/rss.xml and verify there is content displayed.
   • If not: Check if the RSS-Plugin works and is activated

Apply / check CSS changes

I made some small changes to the Solen Theme CSS. These must be re-done when the theme is updated.

1. Open bl-themes/solen-1.0/css/style.css
2. Change link color:
   • Element: .plugin a, ul li a, .footer_entry a, .judul_artikel a, line 5
   • Change: color: #DE004A;
   • To: color: #F06525;
3. Change link color when hovering:
   • Element: .plugin a:hover, ul li a:hover, .footer_entry a:hover, .judul_artikel a:hover, line 10
   • Change: color: #F06525;
   • To: color: #C68449;
4. Fix position of the blockquote bar:
   • Element: blockquote::box-shadow, line 24
   • Change:  box-shadow: inset 5px 0 rgb(255, 165, 0);
   • To:  box-shadow: -5px 0px 0px 0px rgb(255, 165, 0);
5. Format code in posts:
   • Add the following element after line 37:

   • /* My custom stuff */
     code {
         font-size: 87.5%;
         color: #e83e8c;
         word-wrap: break-word;
         font-family: 'Roboto Mono', monospace;
     }

6. Same padding-bottom as padding-top for header:
   • Element .section_title, line 136
   • Change: padding-bottom: 0px;
   • To: padding-bottom: 0.6em;
7. Disable the white blur for the introduction texts:
   • Element: .pratinjau_artikel p:after, line 277
   • Change background: linear-gradient(to right, transparent, #ffffff 80%);
   • To: background: 0% 0%;

Solen-Theme changes

1. Make header smaller:
   • Open solen-1.2/php/mini-hero.php
   • Remove line 4: <h2 class="hero_welcome"><?php echo $L->get('welcome'); ?></h2>

Photo by Kaique Rocha: https://www.pexels.com/photo/people-walking-on-pedestrian-lane-during-daytime-109919/

Nowadays, it feels like everyone of us uses at least five different social networks. Mastodon, Twitter/X, Facebook, Instagram, TikTok, LinkedIn, etc. Even messaging apps like Whatsapp and Telegram try more and more to become social networks of their own. Allowing you to follow channels of your favorite brand, celebrity, topic, etc. And even technical sites like GitHub are slowly getting new social features. Following the age-old mantra, "User retention and engagement are key."

Unfortunately, I have a basic problem with all these social networks. See, a human being is not a single-interest individual. Each one of us has multiple interests. And those can vary widely. Additionally, they overlap in different parts of our lives. Sure, your kids are your most valued and precious interest, and you love sharing your experiences with them. What about professional or job-related experiences? Or your leisure time crafts like gardening or cooking? Do you fancy some videogaming to relax? Are you politically active? Help out in your community? All of these are good examples.

Unfortunately, I have a basic problem with all these social networks.

But.. What, and forgive me my ignorance, what if I'm only interested in your job-related experiences? Or your experiences as a developer of some open-source software I use, and I simply wish to be a little ahead on the information flow. And not rely on some IT news site but instead get it directly from the developer?

I don't know your kids. So why should I care? Surely some stories are nice and sweet. Alas I have the same limited time each day as everyone else. Therefore, for me, information reduction is key. I don't want to be constantly bombarded with bits of knowledge I don't want and don't need to know. Each single social network out there forces me to swallow every single drop that comes out of the "digital information water tap".

Each single social network out there forces me to swallow every single drop that comes out of the "digital information water tap".

Yes, you can unfollow. Or block people entirely. Maybe blacklist some channels. Click the "show me less of this" button. But again, these are partially incomplete features. What if I am interested in only some aspects of a person's life? Not their garden, not their kids, not their political views. How do I filter that? Or those "lovely contacts" that set up automatic content generation and spill 3-5 posts into your feed every single day. Do these features help in such a situation? No, they don't. And that is the problem I have with social networks in general.

Currently, I feel the only option offered to me is a rather ultimate one. Block, unfollow, unfriend, or mute. And while the unfollow feature is somewhat usable, it still doesn't solve my problem.

The solution, or: What Google+ did right

The main feature of Google+ was that the content creator was able to group his contacts into circles, for example, a circle called "family" for family members and a circle called "coworkers" for work-related postings. And then he or she could share content only with that circle (or both). Or decide to share publicly for everyone. The follower or friend, of course, was able to group his or her friend into different circles. But the key point was: It was possible to choose which content stream to display by clicking on the button for each circle on the left of Google+.

Yes, that leaves room for improvement. I can't control with which circle(s) the creator associated me. But for me, it was a step in the right direction. One, which sadly was shut down by Google.

One step further

How about a social network where each profile of a person has several feeds (or streams)? Several. Not just one. And of course, we are allowed to define, create, and delete as many feeds (or streams) as we like. And every follower can choose to just follow one stream (or none at all) or the whole profile with all feeds. Sounds a bit like (Hash-)Tags? Yes! Exactly! As hashtags in themselves are nothing different than key words. Each post can be linked to any number of feeds. Like a post about budgeting your new hobby can be shared in your streams labeled "Finance Tips" and "Gardening".

Then the burden of information sorting and reduction is shifted from the followers to the creators. Giving them the burden of choosing what to post where. But in return they should get users who are more engaged, as they are actually only consuming content they are interested in. Well, in theory. The whole psychology and market behavior regarding social networks is not my strong point. And I fear that most people just don't care. They just scroll past that content that is not interesting to them and never think about whether they should be forced to scroll that much, let alone how to fix that problem.

Google+ was social media for me. Forget every other network.

But I remember that Google+ was social media for me. Forget every other network. There, I engaged the most. I posted the most. I commented the most. And I actually learned more than in any other social network I've been or am still active in.

Yes, Twitter has lists, Mastodon too, and so on. But these networks weren't designed around that feature! It wasn't displayed prominently on the start page. Always hidden 2-3 layers deep in some sub-section of some rarely used menu.

I still miss Google+.
(Does this count as an "Old man yells at cloud"-post? 😅 )

Photo by Miguel Á. Padriñán: https://www.pexels.com/photo/email-blocks-on-gray-surface-1591062/

Some rather fun stories revolve around my usage of mail addresses. Like many IT people, I like to use identifiable email addresses. In my case, it means I always use companyname-DDMMYYYY@my-domain.tld or website-domain-DDMMYYYY@my-domain.tld when I need to specify a mail address.

This has the advantage that I can verify if the sender matches the recipient address. Obviously, Paypal won't send mail to some-webshop05072024@my-domain.tld. And it is a good pointer when some customer database was leaked or if sites are selling customer data. I experienced it like 10 times already: the mail associated with a certain website or shop got spam right after I deleted my account there. Truly unsuspicious...

And in the few cases where a company's customer database was leaked several times, I can easily change the mail address and still track if the new address is being spammed or not.

The unexpected benefit of unique mail addresses

The first real surprise came to me some years ago when I bought new furniture for my new flat. When the furniture was being delivered and built up one of the people setting them up said to me: "Ah, I see we work at the same company."

I was confused and replied: "Uh, no. I'm not working for (that furniture company's name). Why do you think I do?"
"Well, according to the receipt you got the employee discount.", the man replied. I was dumbfounded. I definitely didn't lie, and when I was in the store and purchased the furniture the employee also said nothing regarding this topic.

Then it dawned on me: My mailaddress! It was companyname@my-domain.tld! But.. I thought in disbelief, "It's only in the local-part!" Well.. Looks like the employee doesn't understand the structure of mail addresses and that everyone is free to choose the part before the @-sign (the so-called local-part or username). And thought I do work for the company, and gave me the discount without saying a single word. Wow.

Basic IT-Security in the banking industry?

And today? The same happened. With my bank. I needed an appointment and called them. As I didn't provide a mail address to them in all these years they asked for one to set up the online calendar entry. I told the customer rep to use bankname2024@my-domain.tld. The representative immediately asked in surprise: "Oh! You work for one of our branches?"

Well.. I was a bit shocked as, until that point, I thought that bank employees were at least minimally trained to properly read mail. In order to detect at least the most obvious phishing attempts. It seems I was wrong.

I gave the rep a quick run-down on the structure of mail addresses and said that basically everything in front of the @ is irrelevant (or at least should be treated as such). And that was it. On to the next adventure with mail addresses!