Entries
Filters: Sorted by date
Bizex
I’m going to try not to turn this in to a blog about Windows security exploits but this one is genuinely interesting in that it actively tries to steal financial information and important passwords. Bizex spreads itself by spamming messages over ICQ advising the recipient to visit a specific URL. When they visit it, Internet Explorer exploits are used to download and execute the main payload which then infects their ICQ program and uses it to message their contacts. The worm also scans their hard drive for information relating to a number of well known financial services which it then uploads to a server via FTP, and it apparently snoops on their browser for any passwords travelling over HTTPS connections as well.
[... 216 words]Crap marketing sites
i-am-asian.com is McDonald’s excruciating “I’m lovin’ it” site targeted at Asian Pacific Islander Americans. With gems like whether we’re sipping green tea or enjoying a Big Mac sandwich, we’re helping make the magic mix called America become even richer
you can’t go wrong. Meanwhile, the infamous beef industry sponsored cool-2b-real has rebranded itself as “zip 4 tweens”—for “tween” kids—not quite teens but definitely not children!
Where’s the raging platypus when you need him?
Novel security measures
An article on SecurityFocus led me to this site about Port Knocking. Port Knocking is an interesting security technique in which a box sits online with no ports open to connections and awaits a specific sequence of connection attempts. A user wishing to connect to the box must first attempt to initiate connections to ports in a specific, secret order. Once they do, the box starts up the required service (such as an SSH daemon) on a designated port and allows the user to connect properly.
[... 145 words]“I’m Brian and so’s my wife”
I’m subscribed to a whole bunch of mailing lists, mostly as a lurker as I have a hard enough time just keeping up with some of them. One of those lists is Bugtraq, which is pretty much required reading for anyone with sysadmin responsibilities for a server connected to the public internet. Bugtraq is the central hub of the “public disclosure” security community and is actually surprisingly low traffic with only twenty or so messages a day. It’s fascinating to watch the latest exploits for all manner of popular software packages tick by on an hourly basis.
[... 285 words]Recommendations for a cheap US dial-up provider?
I’m in the market for a cheap US dial-up internet provider. I’m connected via broadband most of the time but I really need to get a backup modem account. In the UK, dialup accounts are available for free with the cost of the phone call as the only charge applied. I haven’t heard of any similar deals in the states, so I’m looking for recommendations. I won’t be using it very often so the cheaper the better.
If foxes can learn Ruby, why can’t you?
Why The Lucky Stiff’s (poignant) guide to Ruby is shaping up to be a masterpiece. Trust me, you’ve never read a programming language guide that’s even remotely comparable. Even if you have no interest in Ruby you should check it out, if only for the cartoon foxes. Here’s Why’s explanation of Ruby’s array syntax:
[... 219 words]Catching up with Harry
I’m not sure how I missed this, but Harry Fueck’s new book The PHP Anthology was published by SitePoint back in December, as a hefty 2 volume epic. Harry is the guru behind PHP Patterns and really knows his stuff. While the book is at first glance a cookbook for solving web related problems, Harry also uses it as a platform for teaching sensible development practises:
[... 237 words]Advanced Python network programming
Understanding Network I/O, Part 2 by George Belotsky (via The Farm) is the best tutorial on the subject of network programming I’ve seen yet. It provides a detailed explanation of simple threaded network clients, thread pools using the Queue module and asynchronous I/O using both Twisted and Python’s asyncore library—then discusses the strengths and weaknesses of each approach.
[... 93 words]End user license agreements hit a new low
So apparently there’s an unpleasant worm going around AOL Instant Messenger at the moment. Only it’s not a worm—it’s a semi-legitimate piece of adware which asks you for permission to “modify the instant messenger software, deliver additional content such as advertisements and promotional messages” and announces that “In addition, the software will interoperate with your current instant messaging client so as to permit the automatic sending of advertising messages originating from your computer to your contact or ’buddy’ list regarding content offered by PSD Tools or its suppliers.”
[... 126 words]Hacking the political system
Danny O’Brien has a fascinating post up about the nature of hacking and how to game entrenched political systems. It’s all worth reading, but the part about how Fax Your MP was created as a deliberate political hack in particular caught my attention. I’ve long been a fan of Fax Your MP and it’s really interesting to see some of the ideas behind the system explained:
[... 380 words]Automatic line ending conversions in IE
I’ve just updated my SitePoint blog with a tale of Javascript debugging woe. To cut a long story short, Internet Explorer for both Mac and Windows automatically converts sane line endings in to the platform specific alternatives whenever you assign a Javascript string to the value attribute of a text area. It’s the kind of quirk that can take up a whole morning’s worth of debugging.
Code generation vs data driven programming
Via Ned Batchelder, this interview with pragmatic Dave Thomas on code generation closely reflects my own nascent thoughts on the issue:
[... 369 words]width = str(len(str(len(lines))))
The above monstrosity came up today while writing a function to add zero padded line numbers to a chunk of text:
[... 78 words]The dangers of PageRank
A well documented side effect of the weblog format is that it brings Google PageRank in almost absurd quantities. I’m now the 5th result for simon on Google, and I’ve been the top result for simon willison almost since the day I launched. High rankings however are not always a good thing, especially when combined with a comment system. A growing number of bloggers have found themselves at the top position for terms of little or no relevance to the rest of their sites, which in turn can attract truly surreal comments from visitors from search engines who may never have encountered a blog before.
[... 469 words]Hot Links
The thing I love about RSS, and by extension web services, is that they allow people to take publically available data and combine it in ways never thought of by the originator of the feed. The internet is awash with examples of this, from useful services such as Feedster to useless amusements like I despise you and your so-called taste, the most insulting extension of the Amazon API I’ve seen to date.
[... 249 words]The return of the Spong Monkeys
Via Eric Meyer, at least I’m not the only one selling out. Joel Veitch’s infamous Spong Monkeys can now be seen in two TV ads for Quiznos sandwhiches: We love the subs and Take a buck off (Quicktime movies). It’s nice to see such awesome and uniquely British talent recognised at a global level.
I’ve sold out!
What can I say—the lure of the mighty dollar proved too much. I’ve just made my first post to my new client-side scripting blog over at SitePoint, as a paid columnist.
[... 244 words]No more usernames in URLs
This one could get very interesting. Microsoft have announced that an upcoming update to Internet Explorer will remove the ability to include usernames in URLs completely. This is in response to the growing problem of so called “phishing” scams, which use trick URLs to con important information such as passwords and credit card details out of unsuspecting browser users.
[... 730 words]Iterating over a sequence in reverse
At work today we stumbled across a situation where we needed to display a list of items in reverse order. The decision to show them in reverse is made in the presentation layer, so altering the code that generates the list in the application logic layer would add coupling between the layers that we would rather avoid. Python’s reverse() function acts on a data structure in place, which we would rather avoid as well. Then we realised that Python’s generators could be used to create a proxy around the sequence allowing us to cycle through it in reverse without altering the sequence itself. Here’s the code:
[... 242 words]Solving comment spam
There are two main schools of thought concerning comment spam: the optimists and the defeatists. Optimists believe that comment spam can be beaten with technology; defeatists (maybe I should call them pessimists) believe that comments are as doomed as email and we’re all going to hell in a hand basket.
[... 967 words]Simple tricks for more usable forms
My second article for SitePoint has been published: Simple tricks for more usable forms. It examines a whole bunch of CSS and Javascript tricks for improving the usability of web based forms without impairing their accessibility to clients that don’t support those technologies. The article has already had some useful feedback on the forums, including the valuable observation that auto-selecting the contents of a form field when it receives the focus can have a negative effect on the usability of Unix browsers, where mouse buttons are frequently used for coping and pasting.
Defending web applications against dictionary attacks
Over at Reflective Surface, Ronaldo M. Ferraz discusses the usability of an authentication system that locks down an account for a certain period of time after three failed login attempts. Ronaldo sees this as a trade off between usability and security, but I see it more as an added security issue in that it allows malicious third parties to lock other user’s accounts armed only with their username.
[... 398 words]Moveable Type now kills PageRank on comment links
This is pretty cool: Moveable Type 2.661 is out and includes a whole bunch of comment spam fighting features, including one inspired by my own anti-spam measure of disabling PageRank on links from comments by sending them through a redirect. This is great news for me as the redirect acts as a deterrent, and deterrents are only worthwhile if people know about them in the first place. With the most popular blogging system (at least amongst comment spammers) now featuring the same deterrent hopefully SEO spammers will start to get the message.
You mean there IS an IE team?
Robert Scoble went to lunch with the head of the Internet Explorer team—yes, they still exist, despite having released nothing but security patches for over two years.
[... 220 words]