futtta's blog » Technology

Severe vulnerability in iGoogle Facebook-gagdet

frank — Tue, 27 Jul 2010 21:11:18 +0000

I by chance discovered a severe security vulnerability in iGoogle’s Facebook-gadget (more than 1 million users!), which allows an attacker to log into an other user’s Facebook account, bypassing authentication.

I contacted the author and the Google security team and they confirmed there appears to be a problem which they’ll look into. While they do so, I would strongly advise everyone not to use the iGoogle Facebook gadget. Once the hole is closed, I’ll provide more info on how this could be exploited.

Possibly related twitterless twaddle:

Why I dislike Facebook’s Like widgets

frank — Mon, 26 Jul 2010 15:17:12 +0000

I like Facebook. I like sharing stuff there, I like liking friends’ activities and I like friends sharing and liking my links and posts. But I really, really don’t like Facebook’s Like buttons and similar boxes! Because I see some serious problems with the like button;

The page containing the “like”-widget loads and renders significantly slower (i.e. performance impact)
Facebook can track me visiting this page, even if I don’t click on “Like” (i.e. privacy issue)
When I do click “Like”, I have no way of checking what will be shown on Facebook. And indeed the buttons are already being used to spread spam, malware is expected to be next (i.e. security risk)
“Liking” a page enters me into a relationship with the page owner, allowing them to “publish updates to the user [and] target ads to people who like [their] content” (i.e. 2nd privacy issue, severely aggravated by the security risk)

No, call me old-fashioned, but I’m much more at ease with the normal Facebook share-mechanism;

a simple link, so no performance impact
no contact with Facebook unless clicked on, so tracking of my surfing behavior is not possible
an intermediate screen shows what you’re about to share, meaning a much lower security risk
no forced relationship with the page owner, i.e. “avert 2nd privacy-risk: CHECK”

But as I can’t force site-owners to remove the “Social Widgets”, I can only install something like No FB Tracking to disable the virus that is the Facebook Like-button. And whine about it on my blog, off course.

Possibly related twitterless twaddle:

Over vanalles en nog wat

frank — Thu, 22 Jul 2010 11:18:24 +0000

Een paar kleine ditjes en datjes, het moet hier niet altijd proper uitgewerkt zijn:

Dropbox is tof, maar niet perfect: op Android een file aan je Dropbox toevoegen doet pijn aan het gat en de Windows-versie wilt ook thuis de proxy van het werk gebruiken (auto-detect proxy werkt niet).
WP-YouTube-Lyte zit aan versie 0.4.1, de afmetingen van de player zijn nu configureerbaar. Het ding is al bijna 2300 keer gedownload (cumulatief voor alle versies) en op basis van de downloadcijfers na een release gok ik dat het op een site of 300 geïnstalleerd staat.
Van cijfers gesproken, afgelopen maandag met deze blog de 100.000 pageviews gepasseerd, dank daarvoor anonieme passant.
Ik draai al een week ofzo op Firefox 4 beta1 (zowel op Windows als op Ubuntu), lekker stabiel voor een eerste beta. Tabs on top is inderdaad logisch en html5 video (met WebM) op YouTube lukt nu ook, maar aan de nieuwe theme en add-on manager is nog “wat” werk. Beta2 zou eerstdaags uitkomen, maar het is nog wachten op de grote javascript snelheidswinst (waarmee FF terug dichter bij de concurrentie zou moeten komen).

En nog wat: als het gesprek even stilvalt, vragen mensen niet meer naar het weer, maar naar je mening over de slaagkansen van droomkoppel De Wever & Di Rupo. Ik zeg dan dat ze moeten slagen en dat ze dat zelf ook weten want dat het er anders niet goed uitziet voor onze portemonnee en dan verwijs ik naar een interessant artikel dat ik daarover op Apache las en het gesprek valt weer stil.

Possibly related twitterless twaddle:

Cross-platform cloud storage with Dropbox

frank — Tue, 20 Jul 2010 14:56:49 +0000

When a good friend of mine bought a Sony Xperia X10 Mini Pro (that small dude does have a keyboard) and couldn’t find JungleDisk in the Android market, I went looking for alternatives (I had already looked into cloud-based storage/ backup back in 2007) and found Dropbox.

Dropbox is an Amazon S3-based cloud-storage solution with client software for just about every system, Android included. Moreover it offers an API for platforms or applications that need Dropbox access as well. The basic account (with 2Gb storage) is free (sign up here and some more free storage thank-you-very-much), so I installed it on the Windows laptop at work, on my Linux “disktop” and on my HTC Hero and (at first sight) all seems to work exactly as advertised (free, easy, cross-platform).

And now that I have external storage that allows sharing files with anonymous users, I could offload some files from my own server? But more importantly; I really should look into reworking that old backup shell-script again (I’ll have to get dropboxd up and running first though). Or maybe I’ll just install WP Time Machine to automatically back up just this blog to my Dropbox-account?

Possibly related twitterless twaddle:

Inventing Androids made easy

frank — Mon, 12 Jul 2010 05:18:56 +0000

Google announced “App Inventor for Android“, a Java Web Start based IDE that allows everyone and your mother to create innovative Android-apps by simply dragging & dropping blocks around;

Watch this video on YouTube or on Easy Youtube.

Granted, this isn’t the web-tech approach I was hoping for (just frigging copy/paste Palm HP’s WebOS’s MOJO, will you Google?), but this sure seems like a great leap forward! Now let’s hope people will do more then let their cat purr on our phones.

If you want to play around with App Inventor, you’ll have to apply for access first. While eagerly awaiting an answer from Google, you can already take some pictures of you cat or you could browse the documentation and the tutorials.

Possibly related twitterless twaddle:

March of the Androids

frank — Mon, 05 Jul 2010 21:07:35 +0000

Lots of exiting things happening in Android and HTC Hero-land these last few weeks:

June 22nd: I flash my HTC Hero with VillainRom 10.3 (i.e. Android 2.1 aka Eclair + HTC Sense)
June 23th: Google releases the source code for the blazingly fast Android 2.2 (aka Froyo)
June 23th: CyanogenMod announces that he and his team will create CM6 based on these sources for a great number of HTC devices, including the Hero CDMA (the US model for Sprint)
June 29th: HTC finally pushes out Android 2.1 for Hero in Europe
July 1th: The VillainRom-guys announce VillainRom 12 based on that new ROM
July 3th: Lox, one of the CyanogenMod developers, announces the first Hero (GSM) Froyo-build
July 5th: HTC released the kernel sources (based on 2.6.29) they used for Hero
July 5th: Lox & co are working on a merged HTC Hero GSM and CDMA build based on the official kernel sources

So I flashed my Hero again, with VillainRom 12 (clearly more responsive then 10.3, a few bugs are solved as well) and I’m looking forward to flashing CyanogenMod 6 once that’s stabilized. Because, after all, Hero’s like their Androids fresh, don’t they?

Possibly related twitterless twaddle:

Eclair on HTC Hero: going rogue with Villainrom

frank — Mon, 21 Jun 2010 22:21:40 +0000

I flashed my HTC Hero again, this time with an Android 2.1 image from Villainrom. Why not wait for the official update? Well, we’ve been waiting for quite some time now, the HTC-update might not even work on a rooted device and a colleague of mine was running Villainrom 10.1 for over a month now and was quite pleased with it.

So if you want to go rogue as well, go Villainrom using this installation guide. And in case things happen that aren’t described in that detailed howto, here are 5 things I had to learn the hard way;

Formatting your SDCARD when on a Modaco rom might not work, having a colleague nearby who can format for you on his handset or PC might help.
If flashrec complains “Could not run command” but your device is already rooted then forget about flashrec, you’re a superuser now
nandroid+ext might not work, just perform a normal nandroid backup
market downloads sometimes don’t work, in my case this was solved by resetting privacy and location-sharing settings to their (permissive) default settings
Villainrom provides OTA-updates, but these aren’t always applied, re-downloading and re-applying the update did the trick for me.

My first Android 2.1 impressions; clearly snappier (and tests show 2.2 to be a lot faster still), some great apps on the market that weren’t there for 1.5 (Google Goggles looks great!) and most importantly; one of the best mobile browsers around (as confirmed by Quirksmode Webkit tests). So yes, I love my Eclair!

Possibly related twitterless twaddle:

Embedding HTML5 YouTube video with WP YouTube Lyte

frank — Wed, 16 Jun 2010 15:27:00 +0000

I re-implemented newTube.js, an earlier experiment to embed HTML5 YouTube video, into my WP YouTube Lyte plugin. This means that WP YouTube Lyte (for easy lite YouTube embeds, reducing download size & rendering time substantially) can now also use the HTML5-based YouTube video-player to play your embedded video.

If the -experimental- HTML5 option is enabled, WP YouTube Lyte will embed HTML5 YouTube video if:

Your visitor uses a browsers that supports the h264 (Safari, Chrome, IE9) or WebM (currently development versions of Chrome, Opera and Firefox) video codecs
Your visitor is enrolled in the YouTube html5 beta

If these requirements aren’t met, your visitors will see a Flash-based version of the YouTube video you specified.

As newTube.js is sort of a dirty hack which replaces the LYTE dummy player with an iframe with overflow:hidden, in which the full YouTube-page is carefully positioned to display only the player, there are some other caveats to take into account as well:

It might break if YouTube implements x-frame-options for their video-pages
Positioning of the player might be a few pixels off in some browsers
Some buttons in the embedded player (e.g. view full screen) won’t function properly
This might (not) work on iPhone/ iPod/ iPad’s (there are known issues with iframes & overflow in mobile Safari that might affect html5 embedding, feedback is welcome)

But apart from all this small print, is works rather nice if I may say so myself. Or better still, just look at this little They Might Be Giants gem embedded here;

Watch this video on YouTube or on Easy Youtube.

Possibly related twitterless twaddle:

Lovin’ the WordPress plugin ecosystem

frank — Tue, 25 May 2010 03:53:54 +0000

I’m a sucker for simple things and in my book, WordPress (the open source software) is a great example of a simple yet powerful solution for publishing on the web. The last few days I experienced their plugin-ecosystem to be just as simple and powerful.

If you have a plugin to share and you:

register on wordpress.org
fill out a form to submit your plugin for inclusion in their repository
after confirmation upload your code (together with a structured readme-file) via svn

Then boom, automatically;

plugin pages (for description, installation, faq, changelog, …) are created and populated with information from the readme and base php-file
a zip-file is created containing your stable version
your plugin is listed on the “new plugins” page

Before you know it, you’ve got a bunch of real users (wp-youtube-lyte was downloaded 128 times in 2 days) who can rate your plugin and provide you with feedback. And every time you upload a new stable version via svn, a new zip-file is created and your users will get a notification in their wp-admin pages, allowing them to upgrade by simply clicking that upgrade link. Don’t you love it when a plan comes together?

But enough raving already, got to go create that admin-page for my plugin now, as requested by a user. I’m a sucker for real users!

Possibly related twitterless twaddle:

Lite YouTube Embeds in WordPress

frank — Tue, 18 May 2010 07:45:06 +0000

This 3rd episode in the “High performance YouTube embeds” series brings you yet another way to use LYTE instead of normal YouTube embeds: wp-youtube-lyte. This WordPress-plugin will automatically replace YouTube-links that start with “httpv://” with Lite YouTube Embeds, thereby significantly reducing download size & rendering time.

wp-youtube-lyte plays nice with the great “Smart Youtube” plugin, in which case it will take care of the default embeds (httpv), while Smart Youtube will parse the other types (httpvh, httpvhd, httpvp, …).

You can download the plugin from http://futtta.be/lyte/wp-youtube-lyte.zip.

A quick demo maybe, to finish things off? Owen Pallett performing “Lewis takes action” live in the KCRW studios:

Watch this video on YouTube or on Easy Youtube.

Possibly related twitterless twaddle: