Update your Etherpad

Periodically we sweep through sites that run Etherpad and check for any instances that are out of date.. This time we were alarmed by the number of out of date instances that contain security issues..

Please update your instances.. This is the list of URLS of out of date instances that contain security issues.

· https://piratepad.ca

· https://factor.cc/pad/

· https://pad.systemli.org/ (pads removed after 30 days of inactivity)

· https://pad.fnordig.de/

· https://pad.lqdn.fr/

· https://tihlde.org/etherpad/

· https://etherpad.wikimedia.org

· https://bitpad.co.nz/ (Tor hidden service, pads removed after 30 days of inactivity)

· https://etherpad.mozilla.org/

· https://text.allmende.io/

· http://notas.dados.gov.br

· http://board.net (Demo and FAQ: http://board.net/p/community)

· http://notes.occupy.net/

· http://piratepad.be

· http://pad.openerp.com

· http://pad.planka.nu/

· http://pad.tn/

· http://etherpad.brownbag.me/

· http://lite.framapad.org

· http://pad.hdc.pw/ (Email-Notification,SSL coming next, running in Austria)

· http://pad.op99.org

Etherpad CLI Client

Interact with Pad contents in real time from within Node and from your CLI.

Screenshot from 2015-03-02 13:03:14
The CLI can be used to catch edit events from Etherpad. Changes are sent as Changesets so there is no performance drop or additional bandwidth required. We use the fastest possible method to reflected changes of a pad.

The CLI Client can also be used to append content to a pad.

5 seconds getting started…

sudo npm install -g etherpad-cli-client
etherpad https://beta.etherpad.org/p/clitest

See what else the Etherpad CLI Client can do!

The CLI Client was developed as part of our new load testing tool that we hope to release within the coming weeks. Development was funded by UCI & Primary Technology Ltd.

Etherpad v1.5.1 – “We’d rather die standing than live on our knees” edition

What’s new TLDR;

Mostly bugfixes, one security/privacy fix. One UI feature (Chat and Users always on screen)

Screenshot from 2015-01-24 18:14:11

NEW: High resolution Icon
NEW: Use HTTPS for plugins.json download
NEW: Add ‘last update’ column
NEW: Show users and chat at the same time (try it)
NEW: Support io.js
Fix: removeAttributeOnLine now works properly
Fix: Plugin search and list
Fix: Issue where unauthed request could cause error
Fix: Privacy issue with .etherpad export
Fix: Freeze deps to improve bisectability
Fix: IE, everything. IE is so broken.
Fix: Timeslider proxy
Fix: All backend tests pass
Fix: Timeslider stars
Fix: Translation update
Fix: Check filesystem if Abiword exists
Fix: Docs formatting
Fix: Move Save Revision notification to a gritter message
Fix: UeberDB MySQL Timeout issue
Fix: Indented +9 list items
Fix: Don’t paste on middle click of
SECURITY Fix: Issue where a malformed URL could cause EP to disclose installation location

Push file changes to your editbar with this nifty plugin!

This nifty plugin will push contents straight from a file to your editbar.

Consider you have HTML that is written from a third party application to a file. When that file is updated your editbar reflects the changes in real time.


In this picture you can see some output from Mumble showing the Server users is reflected in the Pad Editbar.

Super simple yet super useful! What will you use ep_filemon for?

Etherpad 1.5 – Turkey Slayer Edition

Usually on releases the first thing we do is tell you what’s new and why you should upgrade. If you are looking for this, scroll down.

This release is different. What makes Etherpad such a great project is the number of contributors that can maintain the software. This means that should one maintainer be unable to maintain Etherpad others can step in. So the first thing we want to do on this release is hat tip the contributors between 1.4.1 and 1.5. Now you know who to hire for your next Etherpad project!

Etherpad is mostly a British-German alliance. The majority of our funding comes through US organizations and Primary Technology. We’d like to see more funding arrive through donations and sponsorship. These donations have less strings attached so will keep us more independent and neutral. If you can help, please visit the donation section on Etherpad.org

@webzwo0i, @marcelklehr, @Gared, @simong, @BjarniRunar, @luto, @l-y-n-x, @beaugunderson, @cristo-rabani, @prtksxna, @0ip, TranslateWiki team
And finally Myself: @JohnMcLear

TLDR; What’s new and why should I care?
> Full Etherpad Pad Export and Import
> Bug fixes, tests, UI/UX polishing & updates of dependencies
> Speed improvements to all pages. Page load times improved by ~30%.
> Support for instance Sharding (Scaling Etherpad to multiple servers)
> Better documentation & more language support.

Nice things for users:
> Control 5 now does Strikethrough.
> Better experience at higher DPI screens (use of icons instead of fonts)
> 30% Faster page load
> Full Pad Portability (Export/Import)

While this release is mostly a bugfix & performance release we have updated about 20% of the overall Etherpad code since 1.4.1 so we have given it a major release number.

Our release schedule is heating up as we get more and more commercial support ergo more active development.

Some cool things Etherpad can do that it couldn’t before
> curl HTTP POST files right to your Etherpad Instance
> Export other HTTP block elements (Such as subscript/superscript)
> Talk to your pad
> Switch between pads without reloading the editor

Demo Etherpad

Demo Pad, have a play!

Etherpad 1.5 plugin upgrade

This article is aimed at plugin developers.

When we upgrade Etherpad to 1.5 some(very few) plugins will require minor changes.

Broadcasting to all clients

If your plugin uses socket IO to broadcast a message to each client connected to your Etherpad Instance.

var clients = socketio.sockets.clients();
for(var i = 0; i < clients.length; i++) {   clients[i].json.send({type: "COLLABROOM",     data:{       type: "shoutMessage",       payload:{         message: message       }     }   }); }


var clients = socketio.sockets.adapter.nsp.connected;
  for(var client in clients) {
    clients[client].send({type: "COLLABROOM",
        type: "shoutMessage",
        message: message

Browser type detection

$.browser is no longer available.

We now expose browser.

Simply removing $. should fix this however browser does behave slightly differently so you should change to browser and run your front end tests on all devices you need to support.

Etherpad Version 1.4.1 Released – Unpremature

Shut up rambling John. Just tell me what’s New and why should I upgrade/care?

* Huge MySQL performance improvements (InnoDB to MyISAM)

* User Leave
* Export File Name
* Preprocessor Hook for DOMLine attributes

* Script to reinsert all DB values of a Pad

* Allow for absolute settings paths

* Get Pad ID from read Only Pad ID

* Exception on Plugin Search and fix for plugins not being fetched
* Font on innerdoc body can be arial on paste
* Fix Dropping of messages in handleMessage
* Don’t use Abiword for HTML exports
* Color issues with user Icon
* Timeslider Button
* Session Deletion error
* Allow browser tabs to be cycled when focus is in editor
* Various Editor issues with Easysync potentially entering forever loop on bad changeset

Shut up John, why no update for so long?
Thanks to you guys supporting my other project I have been crazy busy and that means no time for Etherpad, thankfully other project members have lead the way but things haved moved slower than we’d all like. Etherpad is still a project very close to my heart and I’m making plans to commit more time to move things forward in 2015.

Remember people, cloud hosting where you can’t replicate the system locally is going to cost you long term. Did anyone else just notice Google changed Google Drive/Docs interface yet again, can anyone find any of their documents? I tried.. Gave up.. Hillarious. TAKE CONTROL.

Also props to services such as Own Cloud gaining traction, we love you guys, you give control. Keep on being smashing.

Nginx reverse proxy SSL security issue

Until today the example Nginx reverse proxy config for Etherpad allowed for weaker SSL encryption than is acceptable.

You can see if your instance is vulnerable by checking your instances SSL cert

Check your Nginx config to see if this line exists:


If so replace with:


Restart Nginx then check your instances SSL cert

We updated the wiki to reflect this change.