Category: Tech

Posted on
by

A few years ago, it seemed like everyone was using X in their software versions. Mac OS X. Windows XP with DirectX and ActiveX*. Flash MX, ColdFusion MX, and anything else by Macromedia MX. Macromedia managed to confuse things by releasing two rounds of MX versions, such as Flash MX, Flash MX 2004 (essentially versions 6 and 7).

It’s fallen a bit out of favor. Among those still unwilling to use plain version numbers, vintages are still popular. Office 2007, Norton Security Suite 2006, etc. Even though Apple still uses the X to promote its operating system, the last two have put a lot of emphasis on the cat-themed code names: Panther, Tiger, Leopard. And then there’s Windows Vista.

What do you think the next naming fad will be?

*ActiveX was actually a cross between two naming fads. For a while, everything Microsoft did seemed to be Active—Active Desktop, Active Directory, etc.)

Posted on
by

ISC is reporting a new type of vulnerability in web browsers that the discoverer has termed as “Reverse Cross-Site Request,” or RCSR.

Basically, on a site with user-generated content—like a hosted blog—it’s possible to add a form that looks like the site’s login form. If the victim has an account on the same site, and has asked their browser to save their password, it will auto-fill the form. If the attacker can somehow trick the visitor into submitting the form—say, with an invisible image submit button (ever clicked randomly? Or to get back to the page after looking at another window?)—the attacker gets the visitor’s password.

What’s new about this is that all it requires is plain HTML, not scripting, which most blog hosts and similar sites already block.

Chapin Information Services discovered the bug in Firefox 2, and reported it to Mozilla. It turns out that Internet Explorer 6 and 7 are also vulnerable, but only if it’s on the same page as the real login form. Mozilla is currently trying to determine the best way of resolving the problem without breaking all the passwords people have already saved. The ISC article links to the bug report, so you can follow the discussion. Microsoft has only said that they’re “aware of the issue.”

At the moment, I’m glad I don’t let web browsers save my passwords.

Posted on
by

Microsoft is really pushing for people to make sure their websites and apps are compatible with IE7. Apparently this is a real concern for a lot of people who relied on certain proprietary features, bugs, and quirks in IE6. I guess they figured they wouldn’t have to worry about future versions. (Hmm… I wonder where they got that idea?)

The fact of the matter is, I’m not worried. I tested my personal sites and the sites I’d built for work months ago, using the IE7 betas, and more recently with RC1. I made a couple of minor changes to some stylesheets, but that was about it.

Why? I’ve been writing standards-based code for years. I validate it from time to time, and I test to make sure it works in the latest versions of Firefox, Opera and Safari as well as IE. So the code was already portable.

Plus, anything new I’ve built since January has been designed with IE7 in mind from the beginning.

Most of the changes were to workarounds for IE6. Either stopping them from running on IE7 (if the bug was fixed), or keeping them running on IE7 (if it was done using a CSS hack).

Posted on
by

Received the replacement battery for the PowerBook yesterday. It was shipped out via DHL, with a prepaid return label for shipping the old battery back via regular mail.

Last night I drained the old battery, plugged the new one in, and packaged up the recalled one in the box. At lunch today I went to the post office to send it off.

As I was walking up the steps, I remembered the “Does this package contain anything liquid, explosive, or otherwise hazardous?” question that postal clerks are required to ask. If you’re mailing a defective battery that could theoretically burst into flames, how exactly are you supposed to answer?

I figured it would be best not to joke about it.

As it was, I just said it was a laptop battery straight out, so the question didn’t come up.

»All pages site-wide with this tag