Other new tips:

• Logorrhea
iChat keeps its logs in a binary format, which makes it impossible to search the logs using the UNIX command line. Logorrhea provides a GUI program that allows you to browse and search your iChat logs. It'd be great if it just converted them to text.
• Gibson Research's ShieldsUP!
A web based port scanner that you can use to test how well your firewall is setup. You have to scroll down the page and click the link (it gets generated according to your IP address)

In the case of pyblosxom, the attack works if you have SMTP notification of comments turned on. If you have comment notification turned on, the attacking program injects the commands for a complete SMTP transaction into the fields for the comment form. The way that Python's smtplib works is to jam text into the SMTP connection. So if the body of the comment happens to look like this:

blasterattacko@aol.com
To: blasterattacko@aol.com
From: blasterattacko@aol.com
Subject: PyC(5D9A983C,url)dlq9F

UeFb8RE4XhzEn6 9dwVwadJWbqLXc2EjtIcmkc9Q7f1aeAnNqR

.

The updated plugin wraps To: From: and Subject: in the comment body in html tags, so a comment that has that data in it will still display, but will be illegal as SMTP commands.

I've updated the metaweblog plugin to accomodate all the new changes in 0.9, and I've put a new copy up on my home page.