Category: Tech

Posted on
by

Yesterday the Los Angeles Times ran an article about the fact that, in response to soaring gas prices, smaller cars are outselling light trucks (which include SUVs, pickups, and minivans) in the US for the first time since 1996. Last night I was going through old magazines that we’d just tossed in a bag before moving. I found the September 2006 issue of Westways (the California Auto Club’s magazine), with a cover story about the new breed of small cars, wondering when the market would shift in response to the high prices. Now there’s timing.

On a related note, 9 months of driving a Prius has given me a somewhat different perspective on “good” and “bad” mileage. When I see averages of 38–48 MPG over the course of a tank of gas, and can get up to 60 MPG on straight, flat stretches of freeway, advertisements touting 25–30 MPG just don’t sound that enticing.

Posted on
by

Last month, eWeek reported that PayPal intends to block unsafe browsersfrom accessing their site. They’ve focused on phishing detection and support for Extended Validation SSL Certificates. So what are these features, and why does PayPal think they’re critical? And just which browsers are they likely to block?

Phishing protection has an obvious appeal for a site whose accounts are one of the biggest phishing targets on the web.  Opera 9.1 and up, Firefox 2, and Internet Explorer 7 check the websites they visit against lists of known fraudulent sites. These browsers will warn the users before they accidentally type their credentials into a bogus log-in form. While this makes no difference when a user is already on PayPal’s site, it does mean the user is less likely to get his or her password stolen, and thieves are less likely to carry out fraudulent transactions with the account.

Extended Validation or EV certificates are like normal SSL certificates: they encrypt your web activity to prevent eavesdropping. What makes them different is that EV certificates require the issuer to verify the site owner more thoroughly. Browsers with EV support will display an indication that the site has been verified, usually by turning part or all of the address bar green. This is intended to give the user greater confidence that the site is legit. EV certificates are currently supported by IE7 and development versions of Opera 9.50 and Firefox 3. (You can preview a version of Opera with EV support by downloading Opera 9.50 beta 2.)

(It’s worth noting that Opera 9.50 beta 2 is stricter about verifying EV certificates, and will not show PayPal with a green bar because it loads images and scripts from another site. More recent preview releases will, like IE7 and Firefox 3, be satisfied if the main page is EV and the resources are all protected by regular SSL.)

So which browsers might get turned away at the gate?

In a follow-up story, PayPal clarified that they have absolutely no intention of blocking current versions of any browsers, and that they would only block obsolete browsers on outdated or unsupported operating systems. So an Opera 9 user on Windows XP isn’t likely to get shut out of PayPal anytime soon. But a Windows 98 user might have cause for concern.

Browser detection is extremely tricky to get right, requiring frequent adjustments. It looks like PayPal intends to take the minimalist approach: Assume most browsers are capable of handling what you send them, and only block the problematic ones.

(Originally posted at Opera Watch as a follow-up to Blocking IE6)

Posted on
by

Sorry for the lack of updates this past week. I was just way too busy prepping for our move this weekend.

A couple of interesting news bits I noticed when I got into work this morning:

It looks like I’ve been lucky with installing Windows XP Service Pack 3. I’ve had no problems with the one machine I installed it on. According to Information Week, a lot of people are having serious problems with SP3, including BSOD on AMD-based systems.

Also, NetCraft has a screenshot of a PayPal page with both the green bar of an Extended Validation (EV) SSL certificate and a cross-site scripting (XSS) vulnerability. It’s a step or two beyond the standard lock icon, but there are still limits to what an EV cert can tell you. Unfortunately PayPal and others are really trying to drum “green bar = safe” into people’s heads.

Posted on
by

Wow… you know gas is expensive when the spammers start hawking gas cards.

Our support contact address received a message touting “Finest List of Nurses Including Email Addresses – Free $50 Gas Card” I had to wonder what the heck it was, so I took a look at the message. They were trying to sell “sales leads” — i.e. names and contact information — of nurses, and were offering to throw in the gas card if you spent enough on “leads” to do your own spamming.

Posted on
by

Andrew Gregory points out that some browser detection scripts might have trouble when Opera 10 eventually rolls around. (Edit: Hallvord also comments.) Why? Because one of the easiest, ways of testing for a version number is to do look for the the “Browser n” or “Browser/n” patterns. The problem is that this strategy only grabs the first digit of the version number. That works fine for 1–9, but once you hit 10, suddenly it looks like 1 again.

Firefox and Safari, currently at just before and just after 3, are likely safe for now, but IE is creeping up on 8, and with their new, faster release schedule, IE10 may only be a couple of years away.

I’ll admit, I’ve written code like that myself (not the specific example, but I’ve done regexp matches that only look at the first digit), but always on sites that I expect to be able to maintain. Of course, one of the lessons to learn from Y2K is that shortcuts get entrenched, and code you thought you’d have time to clean up long before it became a problem has a tendency to stay in use far longer than you expected. And we’ve seen the same thing with web script archives, where someone’s example code that mostly worked in IE4 gets enshrined as “the” way to accomplish something, even though there have been better ways that work more consistently for years.

Posted on
by

It’s clear that a lot of people don’t actually read web pages before they respond to them. They’ll do things like…

  • Contact someone with a similar name, even when it’s clearly the wrong sort of organization — say, a student writing club and not the bookseller that’s been causing them problems.
  • Ask a blogger for a job application for a company mentioned in the post.
  • Ask unrelated tech support questions on a blog post because they used the wrong search terms for their problem.
  • Ask for help creating Flash animations on a forum dedicated to the Flash super-hero, then get indignant when people have the gall to point out that they’re in the wrong place.

Now, usability guru Jakob Nielsen reports on a study showing just how much people don’t read. In the average visit, users only read 28% of your text if you’re lucky. You have to drop way down — to 111 words — just to count on visitors reading half of it.

Depressing, but it explains so much. And it suggests there’s a benefit to highlighting key phrases. If they’re only going to read ¼ of the text, you may as well make sure it includes the important stuff.

Posted on
by

Mark Pilgrim, in The Day the Music Died, points out what happens when DRM meets market failure.

On August 31, Microsoft will turn off the servers that validate their “PlaysForSure” DRM system (this predates the system they use for the Zune). This means that anyone who has bought music that uses PlaysForSure will not be able to transfer it when they upgrade or replace their computer, or get a new music player.

It won’t be an instantaneous death like DIVX was, or like a subscription system, because it doesn’t phone home whenever you try to play a track. But it’ll be a lot faster than simple technological obsolescence. I can still play my old VHS tapes until my VCR breaks down (and then I could probably still get it fixed if I really wanted to), even though I don’t think I’ve seen a pre-recorded tape in a store in years.

This is also why I prefer to check Amazon’s MP3 store first, before going onto the iTunes Music Store, and then prefer DRM-free iTunes Plus to standard iTunes tracks. Given their current position, Apple isn’t likely to get rid of iTunes anytime soon, but if they ever did, I’d be in the same boat as people who purchased PlaysForSure tracks. (Though I’m hoping they’ll move the entire catalog away from DRM long before that happens.) Whereas since Amazon’s tracks are plain, ordinary MP3s, they could abandon the business tomorrow and I’d still be able to play the tracks for as long as I can find software that plays MP3s.

(via ma.tt)

»All pages site-wide with this tag