facebook and browser security

It's been less than a year since I joined facebook, after a long battle of keeping social networking sites at arm's length.  I was surprised at just how much fun it was, which really has only so much to do with facebook, and so much more to do with all my friends from high school, and my relatives I hadn't seen for years.

One of my initial concerns with facebook (and any social networking site) was the security, both in terms of technical security (someone posts a virus as an archive of pictures, as a real example), and also in terms of social engineering (say you leave a post about going on vacation for two weeks ... and the "wrong" people see it, and break into your house while you're away).  But really, those issues are really avoidable, as long as the end-user is smart - don't trust a file you don't know (scan it!), and beware of TMI in your posts.

But as of this morning, I have a new security concern with facebook - about:blank.  When I tried to accept a friend request this morning, nothing would happen;  when I tried to post a comment - nothing; basically, as of this morning none of the buttons on facebook work for me anymore.  And the reason why?  They are all attempting to run scripts from "about:blank".

Let me back up just a bit.  I deal with web security as part of my job, and as such, I am just bit more paranoid, and run tools to avoid common network threats.  I use Firefox as my web browser, and a special plug-in called NoScript that warns me when a site is trying to run a script from an untrusted source.  And what is an untrusted source?  Let's put it this way:  If I'm on cnn.com, and that page needs to run a script that comes from cnn.com - that's okay, that's trusted.  If it's trying to run a script from virusworld.net or someone's IP address, that's NOT okay!  Basically, scripts MUST come from the same domain as the page that is trying to run them.  If not, NoScript blocks them.

Once a script has been blocked, I can tell NoScript that "it's okay, I trust that site".  I've done this for a number of apps that I am aware of and trust (amazon has a number of scripts from their a3.com domain, for example - I know where they're coming from & trust them).  So, in most cases, if I trust the site with the script, it really not a problem.  I just tell NoScript to allow it.

The problem is, "about:blank" is not really a site.  It's supposed to give you a blank screen in your browser, but it should NEVER be running scripts!!!  In fact, this is a known security hole in some browsers - by tricking the browser to see a script coming from "about:blank", it thinks it's a local script, and does not apply the same security it would if it thought it was coming from across the internet.

In other words, the developers at facebook are now doing something that any web developer with a half-hour security class should know is absolutely WRONG to do!  And there's absolutely no reason for them to use this method unless they PLAN on doing something malicious!  (I still hope they did it because they were clueless, rather than malicious ...)

Now, I could allow "about:blank", but that would mean that ANY SITE could run scripts as about:blank - not what I want at all.

So, I may be done with facebook.  It hasn't even been a day, and I am sincerely hoping the facebook developers realize their glaring error and remove this reliance on "about:blank" (after all, it worked before without introducing this security hole).  But, until they fix the issue, you probably won't see much of me on facebook (unless I post something through this blog or YouTube).

Again, I hope they fix their mistake very soon.  I absolutely LOVED getting back in touch with everyone!

Absurdism in HTML

For various reasons, I've been thinking about absurdism lately. I'm especially fond of works such as Tom Stoppard's "Rosencrantz and Guildenstern Are Dead", and Samuel Beckett's "Endgame" (both of which I happened to see at UMD many, many years ago ... maybe that has something to do with it). But of all the places you might find absurdism, I never expected to see it in HTML code.

Today, buried in the depths of JSP/HTML, I came across a "summary" attribute for a table that made me really stop and think. Now, the point of a "summary" attribute, is SUPPOSED to alert screen readers and other text-only display devices, and help describe the information contained in the table. This summary was strait forward, and absolutely absurd:

a simple table to hold our rows

Yep. Absolutely correct, yet absolutely useless information. Beautiful, in it's way.

Still, if you follow the semantics of the HTML document, what Adobe Dreamweaver does for the "title" element is a downright contradiction:

<title>Untitled Document</title>

Frankly, any software that writes HTML like this shouldn't be trusted.

:P

Making Music ... maybe

Oh, so many years ago, I got my first PC from my dad, including a program called "Electronics Workbench". My entire goal of this computer was to begin developing circuits for sound design, and experimental music. Well, rather than music, I ended up with a career in computers instead. And here I am today.

Despite how interesting I find computers, I still find that my first love is still music. But music, and the cost of musical instruments is not one of my family's priorities, so I have found little time to take more than a passive role listening to music (and then usually on the bus to & from work, or late at night when everyone else is asleep).

About a year ago, I discovered the Linux MultiMedia Studio (LMMS), a complete open-source sound/song editor. It includes a ton of samples, has several different oscillators and synthesizers for creating your own sounds, full two-way MIDI interface, and of course the ability to sample from other audio files.

Of course, it's quite a bit different than noodling on the piano, or strumming a guitar. It's a lot more like creating your own paint-by-numbers, and then telling the computer, "okay, paint!". So, since discovering this cool system, I've made sure it was installed on every one of my Linux machines ... but have yet to really sit down & give it a good honest try.

So, this morning, I was the first one awake, and sat down with the LMMS manual and walked through the initial tutorial, and tried some of the subsequent experiments. I do feel a lot more familiar with how it works now, and feel like I'm ready to start making some music. Now, I just have to have the discipline to TRY, rather than passively listening to music while playing solitaire or sudoku.

Time will tell ...

NBA Finals Disappointment

For the past several weeks, ABC has been having problems with the sound not matching the video. I kept hoping that the problem would be fixed before the NBA Finals ...

No such luck! Tonight, the Spanish SAP is playing over the broadcast.

Now, I don't know if the problem is at ABC, or my local Charter Cable (Rosemount, MN). All I know is I was hoping to watch the NBA Finals ... but not knowing Spanish, I guess I'll find something else to do, and check ESPN's site from time to time.

More Charter Cable trouble

So once again, Charter cable is out. Or rather, all I get is a "One Moment Please" screen. This is starting to happen on a weekly basis now. What is really frustrating is there is no number you can call for support - they only have sales (and I don't see the point in upgrading when I can't get what I am paying (being robbed) for). It really makes me reevaluate why I am paying way too much for cable.

How Novell is Killing SuSE Linux

I just can't hold back anymore. I've been running Linux a long, long time, and in the past five years, I have been working more and more with SuSE Linux. About five years ago (roughly), Novell acquired the rights to SuSE Linux in the United States. They created a set of custom distributions (SuSE Linux Enterprise Desktop, SuSE Linux Enterprise Server), but there plans beyond that have always been questionable. Personally, I am not sure if Novell is even sure which direction they are heading.

One of the first things they did was replace the functioning OpenSuSE mirror system with something of their own design - something that will fail with any large update. Each mirror "hides" behind download.opensuse.org - so the end user has no control over which mirror they are using (all up to Novell). This would not be so bad, but with almost every large update, there is always some piece of software missing. Frequently, this breaks the entire system. You cannot simply choose another mirror - you're pretty much dead in the water until someone updates that mirror (which you can only find out by keep trying the update again and again until it works).

Beyond their issues trying to keep their mirrors together, they seemed to forget the purpose of an operating system with the release of OpenSuSE 11.1. Now, most of the time with software, a "dot" release is an update, not a complete rework. Not so for Novell and SuSE! OpenSuSE 11.1 breaks more things than it fixes. In 11.0 sound worked, you had a configurable (and more secure) login manager, just to name my two biggest annoyances. My SuSE 11.0 played sound beautifully, PulseAudio worked well, and I had made this system a central part of my music system. That was over as soon as I upgraded to 11.1, where it seems like they pretty much threw sound out the window.

And then there's Novell's commercial offering. SLES and SLED 10 have held on to Java 1.4 well beyond it's end-of-life, and now SLES and SLED 11 are skipping right to Java 6. So, for all those apps certified for Java 5 (like, well, all of them), obviously SLES and SLED are not for you! Or, be prepared to maintain your own custom install of Java, separate from the system (and why are we paying for support?). Worse, their "support" forums actually suggest users mix their distributions - just combine OpenSuSE repositories with the SLED/SLES repositories in your list of update sites. Following this piece of advice will guarantee you break your system beyond repair!

Novell has made SuSE into a useless nightmare. All the predictions were true.

Go Ubuntu!!!

A Nice Way to Spend a Saturday Afternoon

After a busy week of rescheduling training sessions - and altering my home schedule in the process - I got to spend a lazy Saturday morning with my wife (with just a little bit of housework).

We were just thinking about lunch when I saw I had a call from my sister ... also looking for lunch, and suggested we visit our favorite restaurant - the Mediterranean Cruise Cafe. How could we say "no"?

So we all met at the Cruise, Kitty & I, Clint, Lisa and baby Benjamin. It was surprisingly quiet, so we got lots of attention from our host Sammy. We ended up all getting their Luncheon Feast - which involves filling the table with so many plates of food it's all but overwhelming. We then spent the rest of the afternoon talking and eating. We found Benjamin likes pitas & hummus, as well as the lentil soup. It was a nice, relaxing afternoon with family (including "cousin" Sammy!).

No women with swords this time, though ...

Astra Cervus ex Machina? Really?!?

(For my TiVO friends, be very careful thinking about the title of this post ...)

One of my favorite shows came to an end last Friday night. It was a show I was reluctant to watch at first, but have come to believe that it was probably the best science fiction / soap opera ever produced for television.

I've read a lot of blogs from those who didn't like the ending ... many saying it went on too long after the climax. But I thought it was important to wrap up those storylines, and more importantly, tie in once again the themes of faith and miracles to the conclusion.

I was disappointed that one story thread didn't resolve - or maybe resolved a little too simplistically. I've heard rumors that there was more content written, but there just wasn't enough time to include it, so a quicker solution was had. Whether that's true or not, I have no idea. Yet despite my disappointment, the conclusion played in well with the over all themes of the show, and just added one more piece of hope and wonderment to an amazing show.

I hope the success of the show will inspire more studios to consider sci fi. I also hope that sci fi producers and writers will see what made Battlestar Galactica so successful, and emulate the storywrighting (and I mean wrighting) and commitment to production in future shows.

Go, Pack, Go!

For tonight, at least, I am a Packer fan!

I sure hope they can do us a favor, and help keep our slim hold on a Playoff spot (we sure won't see a wildcard!).

As far as all the Vikings fans blaming Childress - do you really think he coaches them to turn over the ball?!? Of course not. The blame lies on two guys who are probably staring at their toes today. Buck up! Get a grip!!! You're off to face the Giants!!!

Skål Vikings!

For the past several weeks, I've actually written several blogs about the Vikings - all in my head, as a matter of respect for the team. I've thought of many clever and discouraging things to say about the way the team was playing ... but I've followed the old maxim about "if you can't say anything nice ...".

Sunday, however, I saw the Vikings I had been waiting for all season. Penalties held to a minimum, no bone-head plays (although the defensive touchdown on our second possession left me with a sense of deja vu), and we really looked like we were in control most of the game.

What has been sad to see the past Sundays was all the effort and improvement by individuals that just wasn't translating to the team. Great plays on the offense and defense were being negated by stupid penalties; so many great plays countered by bone-head moves the next play (and the next, etc). Now, it's finally looking like it's starting to gel.

The only thing to watch out for now is hubris. I think that's what got us at the beginning of the second half yesterday - luckily, we got back to the game and held on the rest of the half.

As far as Childress as a coach ... earlier this year, I was on the "he's got to go" side, but now I am reconsidering. Penalties have consistently been declining - something that has plagued the Vikings as long as I have watched them. Perhaps discipline is setting in in the locker room & on the field (a far cry from Tice's Vikings). As far as the QB position, Childress stuck firmly with his choice, until it was obviously the wrong one. I think that he stood by his decision (and QB) as long as he did speaks a lot to his determination and commitment. It's good to have a coach who worries more about the game than his popularity rating with the fans.

It's not too late to take the NFC North!

Asta la MS Vista

About a month ago, I got a new laptop from work. It came with XP installed, but a Vista DVD was included as well. Being a curious guy, I thought I'd give it a try ...

The first thing I couldn't help but think was how much the new interface looked like a Gnome desktop I had used on Linux some five years passed. It didn't take me long to realize that all that extra "eye candy", as cool as it looks, only takes up more screen real estate (my favorite theme is actually one with a very small frame & buttons, leaving more room for my actual important content). I'm sure MS is imitating (reverse-innovating?) Apple's windowing system rather than linux, but it's still interesting how old the "new" Vista desktop looks.

In case you haven't guessed, I primarily use Linux, not Windows. Like most Linux users, I have a better than normal understanding of how operating systems work, or should work. So, when I found certain actions required the system to pause, and the user alerted to an "Administrative" task, I thought there was real merit to the concept. This is actually built right in to the Unix and Linux kernels - a "user" space for user actions, and a "system" space - when a user needs to do something in "system" space, they need some sort of authentication - typically, asking for the root (linux administrator) password. While I am not sure exactly how Vista achieves this, I guarantee it's not in the kernel, but somewhere that causes a lot of slowness to even switch to administrative mode. I should note, too, that just being an "Administrator" on Vista is not enough - it will still prompt you to continue every time.

Similarly, if you run an installer program that extracts and runs files as part of the installation process (pretty common, really), you will be prompted when the extracted files try to run. Again, probably a good safety measure aimed at trojans from the internet that may try and install software without your knowledge, but when faced with the practical task of installing programs, well, be prepared to click "Continue". A lot.

Of course, all this can simply be disabled, which is far, far easier than trying to configure that balance between ease of use and security. (I could go on a tirade here about how security has to be USABLE, not just AVAILABLE to truly be security, but another day...)

Still, there is something to be said for the "newness" of Vista ... I can't think of any specific "oh this is better than XP" items, but just because it was different from the same old XP I've been using for 6+ years (more like 9, considering how much like Windows 2000 it is), there was a certain cool factor to using Vista.

That is, until I started seeing Mr. BSOD on a regular basis.

The "Blue Screen of Death" was fairly common prior to Windows 2000, but it seems to make a strong comeback in Vista, or at least it did for me. Multiple times a day. At first, it seemed almost random, and there was no one act that was causing it as far as I could tell. Then yesterday morning, as I logged into work to check my e-mail, BSOD. Rebooted, tried to check my e-mail again, BSOD. I did this five times, getting quite frustrated, and finally gave up on Vista.

Only seven hours later, I had XP and Office installed and patched, and ready to get back to work.

Meanwhile, my OpenSuSE 11.0 installation just runs. It does fancier eye-candy than Vista. And if I log in as root, I can delete the entire system without so much as an "are you sure?". Okay, that might not seem like a good thing ...

Vacation 2008

I'm nearing the end of my vacation this summer. My wife has been calling it a "stay-cation", since we chose to stay in town. I do miss getting away from the city, but we had a good time doing things right here in the metro.

We also found out this week that Kitty has been accepted to school this fall, something we were pretty sure would happen, but now know for sure. This was actually the primary reason for staying home rather than renting a cabin this year.

I've placed a bunch of photos from my Vacation 2008 on Picasaweb, shown as thumbnails above. One of the pictures has a bald eagle eating a fish on a fallen tree - but you'd never know it looking at the thumbnail.

There is also a map of my vacation photos as well.

Where did we go?

• Minnesota Valley National Wildlife Refuge
• Minneapolis Institute of Arts
• Lebanon Hills Regional Park (Dakota County)
• Paddleford Mississippi Cruise

"Web 2.0" Reflections (Thing #23)

A lot of "Web 2.0" seems like so much flash, and much of it with it's share of security risks. However, where "Web 2.0" shines seems to be where the technology bests fits with it's users needs, and does not aim to lead it's users to work in a particular way; nor does it attempt to secure a market share.

Today marks the 15th anniversary of the public release of HTML and HTTP, and today, the web is still in it's infancy, according it's primary inventor.

Flash, cool factor will always have it's appeal, but without community buy-in, it will merely be a "flash" in the pan. HTML and HTTP were contributed to the public fifteen years ago, and XML five years later. While Netscape and Microsoft fenced over features in their JavaScript (and JScript, respectively), the ECMA-262 standard laid out the rules for developers to write browser-side scripting that could work regardless of the user's choice of browser.

Competition is good. Collaboration is better.

On "Web 2.0" tools (Thing #22)

One of the greatest tools available today has got to be craigslist. Not only has it been a tremendous aid every time I have to clean the garage, but it's been a great way to get tickets to the Minnesota Opera.

I think one of the best things about craigslist is it's simplicity: it does what it's intended to, and little more. Evolution at it's finest.

The only thing wrong with craigslist ... what is a "st paul", anyway?

ON Web-based Apps (Thing #21)

There are a lot of advantages to web-based apps, especially when combined with network storage. While I would not trust sensitive documents to Google Docs, it becomes very useful for storing a shopping list (especially when comparison shopping).

Google Docs is also a great way to share information - I've used it in the past to compile a camping equipment list.

Hmm ... presentations ... now that sounds like fun!

On PBWiki (Thing #20)

PBWiki seems to have a very nice package for starting up a new community site. This is an area that has expanded by leaps and bounds, as people realized what they could do with the technology (and who knows what's next).

On Wiki-Wiki (Thing #19)

Wikis are just plain cool. I think Wikipedia was most likely my first experience with a wiki. I've been a contributing user for a while, and haven't contributed all that much.

My favorite, though, is my small contribution to the Superior Hiking Trail entry, especially this picture.

The Apache Wiki was my inspiration for bringing MoinMoinWiki in house several years ago. One of my favorite features was it's ability to format different types of source code (which is likely why Apache Software Foundation uses it). Like Plone, MoinMoinWiki is written in python, but at the time I looked at it, it did not have the GUI editor - a major downside.

WebJunction, MINITEX (Thing #18)

Silly me! Trying WebJunction Minnesota with Firefox (on Linux, no less!) ... painful. I guess I should have heeded the warning.

I do frequently use one MINITEX site - the MnLINK Gateway. Minnesota has a wealth of materials available through inter-library loans, including technical books from the U of M.

More on Tagging (Thing #17)

I guess I've talked about tags and tag clouds on a couple of posts now. Yep. Very cool stuff.

One thing I did notice, when I was looking at my blog before, it seemed like there should be a good way to list all the tags (or "labels") used on my site. When I didn't see it at first, I went to "Customize" my site, clicked on one of the "Add page content" links, and sure enough - a list of labels!

That should make it easier to find all my Web 2.0 stuff, right?

On del.icio.us (Thing #16)

The tag cloud is one of the more interesting visual reporting tools I have seen. I had first noticed it used on blogs.sun.com, and ended up creating an account on del.icio.us some time ago to play with it in action myself.

Of the links I have on del.icio.us, the most popular one seems to be the TV guide on zap2it.com, linked by 241 other people.

It's also interesting to be able to see what tags other people are using for bookmarks.

How could we implement tagging in Amanda? ...