Posted on
by

ISC is reporting a new type of vulnerability in web browsers that the discoverer has termed as “Reverse Cross-Site Request,” or RCSR.

Basically, on a site with user-generated content—like a hosted blog—it’s possible to add a form that looks like the site’s login form. If the victim has an account on the same site, and has asked their browser to save their password, it will auto-fill the form. If the attacker can somehow trick the visitor into submitting the form—say, with an invisible image submit button (ever clicked randomly? Or to get back to the page after looking at another window?)—the attacker gets the visitor’s password.

What’s new about this is that all it requires is plain HTML, not scripting, which most blog hosts and similar sites already block.

Chapin Information Services discovered the bug in Firefox 2, and reported it to Mozilla. It turns out that Internet Explorer 6 and 7 are also vulnerable, but only if it’s on the same page as the real login form. Mozilla is currently trying to determine the best way of resolving the problem without breaking all the passwords people have already saved. The ISC article links to the bug report, so you can follow the discussion. Microsoft has only said that they’re “aware of the issue.”

At the moment, I’m glad I don’t let web browsers save my passwords.

Posted on
by

Last week my goal for Nanowrimo was to stay right on track. Hit 20K on the 12th, 25K on the 15th, 30K on the 18th. But I realized that the last few days of the month aren’t going to give me much time to write. We’re going to a concert on the 29th, leaving me only the evening of the 30th to finish the last ~3000 words. Add to that the fact that Nano’s official word counter seems to run a little shorter than OpenOffice’s, and I really need to be aiming for something like 50,500 words.

So my new goal is to finish by the 28th.

For now, that means aiming for 2,000 words a day instead of just 1,700. In some ways it’s easier, since I’ve gotten used to it. But it’s getting a lot harder to sit down and start. I’ll spend all day wanting to get home and start writing, and then I’ll sit down, check my email, read some webcomics, read a couple of blogs… And once I do start writing, I’m letting myself get distracted by web surfing that starts as, say, research on medieval surgery and veers off on a tangent that sucks up an hour reading about the overseas territories of the U.S. (Sometimes, hypertext is not your friend.)

The next few days are going to be tough. Tuesday evening’s out, and I’ve got a project at work due Wednesday that may have me staying late if I can’t figure out the solution earlier. And of course, Thursday afternoon and evening are taken.

I made 32K tonight, though. For the first time, Nano expects me to finish on deadline.

Word Count: 32,101

Current Mood: 😴tired

Posted on
by

I didn’t get much written yesterday, but I made up for it today, and passed the 25,000 word mark right on schedule. I am now just over the half-way mark.

A subplot jumped out at me on Monday, and while it’s slowing the A plot down, it seems to be working into things that need to happen for both the A and B plots.

Word Count: 25,032

Posted on
by

Mostly random stuff this morning. Read some comics. Finished Callahan’s Cross-Time Saloon. Errands in the afternoon. Late lunch at Ruby’s, which always lends itself to not needing dinner that night. Weather went from warm and sunny to gloomy and cool during lunch.

Picked up writing early evening. My goal is to hit 20,000 words by the end of the weekend, which should put me on track (20K/50K = 12d/30d = 40%). Looks like I can make it.

Concluded that the progress gauge I’ve been using here is either using something other than time to determine the goal, or just plain b0rked. It went from 13,105 yesterday to 12,896 today. Maybe it’s based on average words/day or something.

It’s odd to be writing with the only goal being word count. But it’s also oddly liberating. That’s kind of gone down now, since I’ve been establishing a world and characters, and at the very least I have to keep things more or less consistent. I guess it’s the freedom to mess up. It doesn’t matter if what I write is crap. As long as I finish it, I can revise it as much as I want later.

I had a bit of conflict insert itself into the story today. Completely unintended, but the character was acting grumpy, and started explaining why. In such a way that’s going to make things complicated for a while.

One of the big problems I’ve been having since I started to see the overall shape is that the stuff I have the best handle on comes near the end of the story. I’m enough out of practice to not have a sense of how long it’ll take to get there, but I want to get a sense of where the characters are before I start writing too far ahead.

Word Count: 17415