Heartbleed OpenSSL vulnerability

Like many sites, some of our servers were vulnerable to this critical vulnerability in OpenSSL, which provides SSL encryption that you would normally expect to keep data safe!

All servers were patched within a few hours of the announcement, and as a precautionary measure, we have revoked and reissued all our SSL keys and certificates, ensuring that any private keys are now useless.

In addition, we only process payments through Paypal, so we do not hold any sensitive financial information.

Because so many sites were exposed to this vulnerability (some estimates say about two thirds of the internet!), we recommend that you change your passwords on all services that you use, including ours.

Power outage at London data centre

A major power outage at our London data centre took out our servers this morning, along with several thousand other sites. Services have been down for several hours and are currently being restored. We apologise for the inconvenience, and we will update this post when we have more news.

On the upside, this is the only downtime we've had for a couple of years.

Update: service has now been restored. We will continue checking for any other issues arising from this outage.

PHPMailer grows up

When PHPMailer moved to github, it was maintained in my personal fork. It's now moved to the PHPMailer organisation, so you can now find it, fork it, star it, report issues and send PRs at https://github.com/PHPMailer/PHPMailer

Synchromedia leads the way with PHPMailer

PHPMailer is a programming library for creating and sending email in PHP, and it's probably the most widely-used code for sending email in existence, being the email component used in WordPress, Drupal, CodeIgniter, Yii, PHPList and many other projects. We've been involved with the project since 2003 and became maintainers in 2008. It took a detour to the Apache incubator project on Google code. It wasn't getting much love on there, and the original SourceForge project was languishing, despite still receiving thousands of downloads per week (of old, buggy code!), so we set up a fork on GitHub that's been steadily growing in popularity over the last couple of years. Last week the developers got together and we agreed to make our fork the official, canonical home of the PHPMailer project, and we couldn't be happier. Open source software is a big part of our work, and we like to contribute wherever we can, but it's especially nice to be able to lead a project that's so central to what we do (it's at the core of Smartmessages).

So what happens next? Well, now you have a much nicer venue to report bugs, make a fork, ask for pull requests and all the other wonderful things that GitHub brings. What are you waiting for? Get coding!

Smartmessages goes international

We've just rolled out a refresh of our user interface to match our forthcoming web site; We're using stronger, flatter colours, tighter spacing, bigger targets so it works better on mobile devices.

But there's something big under the new shininess...

We've made the switch to UTF-8.

Email is one of the last holdouts of 8-bit character sets, not least because they are usually more compact less complex and more reliable than other representations, an important property when all that's needed is a simple message. The ISO-8859-1 ("Latin 1") character set has long been the standard for email since it supports nearly everything that's needed in all of Western Europe, and it's what we (and many other email services) have been using for years. Problems begin to crop up when you need characters outside that range, a great example being the Euro symbol, €, which doesn't exist in that character set. There are some workarounds, like using HTML entities, but they are inelegant and don't work in plain text.
The UTF-8 encoding provides access to the full Unicode character set, and it's really the only sane choice for supporting multiple languages, though it takes more space and requires more processing power. We're supporting the full range of 4-byte characters, which covers all European languages, Chinese, Japanese, Russian, Greek and many more, plus oodles of funny-shaped squiggles from notations you've never heard of, and (much more interestingly) full-colour Emoji characters (all subject to your recipients' operating system support). As yet we don't support right-to-left languages such as Arabic and Hebrew.

Unicode is available in any normal-text field, so mailing list names, templates, from names, subscriber properties, descriptions, branding elements etc are all up for it. Some special fields don't support unicode, in particular email addresses, so we don't let you use it anywhere it would break things. You don't need to do anything different, you can just type non-English characters and expect them to work.

One issue with UTF-8 content is not up to us - the tools you use need to be UTF-8 aware, so that means all you Luddites running Notepad on Windows XP need to get with the programme. Also note that all uploads and downloads are now using UTF-8 too.

Short version: you can now use any characters you like within Smartmessages.

This is a big change that opens up many possibilities for our service, but there are many corner cases that we may not have covered, so if you see any stray question marks, odd characters, or unexpected strings of garbage text, please let us know so we can find out what's up and fix it.

A new-look Smartmessages

Last weekend we rolled out a complete overhaul of our user interface. For the most part it was a revamp of the underlying systems that provide our web interface, so it won't come as too much of a shock to our long-term users, but there are hundreds of small visual and usability tweaks throughout the site.

So what's changed under the hood?

• Switch to HTML5 based on html5boilerplate
• A new consistent CSS framework built on Twitter Bootstrap 2 and LESS
• Responsive layouts for improved usability on small screens
• A complete overhaul of template structuring using Smarty 3's inheritance
• Switch from Prototype.js to jQuery (1.7.2), requiring a rewrite of all Javascript
• Removal of nearly all images
• Use of vector artwork and fonts (with FontAwesome)
• Javascript graphs courtesy of Morris.js
• YSlow optimisation
• SPDY protocol support

We're hitting a score of 98 on Yslow - we would be at 100 if Google set longer expiries on their web fonts! We actually had to report bugs in Yslow as we were being marked down for using SPDY! Replacing images with font glyphs generally means that things look much cleaner and sharper on high-resolution devices such as iPad 3, plus it helps reduce the number of trips to the server.
Combined with SPDY support in browsers that support it (Firefox 11+ and Chrome), this makes for a much snappier experience overall. SPDY is a good fit for Smartmessages as we deliver everything over HTTPS anyway.

All of these changes took about a month to implement, and they improve our ability to change things in future, so we've now got a great base on which to build the new features we're planning!

We hope you like it.

ISP Outage: resolved

Our ISP appears to be having connectivity problems that has taken all of our servers offline. We're not sure what's up yet, but will update on here when we do.

Update 18:11: Our ISP is suffering a DDoS attack resulting in packet loss; they are investigating.

Update 18:51: DDoS traffic has been blocked upstream, services are now back to normal. Our apologies for the inconvenience.