the world. according to koto

Valuable information and excellent design you got ...

2012-05-08T10:10:20.946+02:00

Valuable information and excellent design you got here! I would like to thank you for sharing your thoughts and time into the stuff you post!! Thumbs up. www.cheapbeatsearphones.com/

I've been getting attacked by malware sites, a...

2012-04-30T11:49:02.967+02:00

I've been getting attacked by malware sites, and I see this in my log files -

PHP Warning: PHP Startup: timezonedb: Unable to initialize moduleModule compiled with module API=20060613PHP compiled with module API=20090626These options need to match in Unknown on line 0
And, even Magic Quotes GPC are disabled - all the server security aspects have been taken care of - I'm looking for a fool proof fix - any suggestions?

We at Jexaa specialise in providing quality modern...

2012-04-29T17:42:54.488+02:00

We at Jexaa specialise in providing quality modern technology to consumers at unbelievable
prices.If you're looking for a versatile and multifunctional android tablet PC, you will be
overwhelmed by the choice on offer from our online shop.
Thanks!
Android Tablet

Pretty good post. I just stumbled upon your blog a...

2012-04-28T05:49:16.723+02:00

Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts.I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have enjoyed reading. Nice blog. I will keep visiting.

history.pushState() should work in both of them, i...

2012-04-24T01:21:25.515+02:00

history.pushState() should work in both of them, it's widely supported now - http://caniuse.com/#search=push

Any updates for FF10+, Chrome 18+ etc. ??

2012-04-23T19:56:22.215+02:00

Any updates for FF10+, Chrome 18+ etc. ??

I recommend you to take a look at this http file s...

2012-04-17T21:57:20.937+02:00

I recommend you to take a look at this http file server. You can set up your own file server for managing and sharing files through web browser. It's like DropBox but self-hosted so that you can keep all your confidential files on your own server. The web based UI looks and feels like Windows 7 Explorer. It offers features that are not possible with a FTP server such as zipping files, downloading multiple files and folders in single download etc. It's also easier to set up and administrate than a FTP server.
http file server

I was actually annoyed by the very same thing, so ...

2012-04-13T13:45:06.708+02:00

I was actually annoyed by the very same thing, so I wrote an extension, the 'CRX Inspector', to address the issue. It'll let you browse the source code of extensions without making you install them first. Look it up in web store if you like.

As for the XSS vulnerabilities: the disturbing thing is, that small unpopular extensions built by ignorant amateurs are *not* the only ones you'll find them in. I've found several in hugely popular ones - including AdBlock and a number of 'by Google' extensions. Sloppy coding practices, e.g. the use of innerHTML, are putting millions of users at risk.

data:_,alert(/i/)//firefox data:text/html;base64,&...

2012-04-08T02:15:15.317+02:00

data:_,alert(/i/)//firefox
data:text/html;base64,<<<<<<<>>>>>>>>> //opera

Doesn't work on AdBlock Plus ;D

2012-04-01T13:53:41.454+02:00

Doesn't work on AdBlock Plus ;D

Thanks for telling all the spammers ಠ_ಠ

2012-03-29T14:43:47.422+02:00

Thanks for telling all the spammers
ಠ_ಠ

Agrh, fixed, thanks!

2012-03-29T11:11:32.690+02:00

Agrh, fixed, thanks!

"After all, it's their DOM your messing w...

2012-03-29T11:05:20.911+02:00

"After all, it's their DOM your messing with"
I'm not usually a grammar nazi, but this "your" just makes me cringe.

It's ScriptNo, and once you start Trusting a f...

2012-03-29T03:24:40.734+02:00

It's ScriptNo, and once you start Trusting a few sites it doesn't seem to break anything anymore; in this respect it is like NoScript's default setup. Also it's fairly mature by now, having switched over to using the ContentSettings and WebRequest APIs available with Chrome 17.

It doesn't, however, have some of the more advanced functionality of NoScript, like surrogate scripts, the XSS filter, or the Application Boundaries Enforcer, and it also doesn't block plugins (but the click-to-play flag is available for that, and Chrome blocks most plugins by default anyway) or frames (but Better Popup Blocker works well for that).

Thanks for the heads up, Krzysztof. The next rele...

2012-03-28T20:56:23.712+02:00

Thanks for the heads up, Krzysztof. The next release of AdBlock will fix the second vulnerability. As Wladimir mentioned, the first only prevents hiding rules from working, though blocking will still work.

Yes, it is confusing. Wasn't my idea to name ...

2012-03-28T13:57:17.004+02:00

Yes, it is confusing. Wasn't my idea to name a competing extension "Adblock".

Anyway, I think that Adblock Plus is completely waterproof now. Web pages can no longer mess with extension pages, not even theoretically.

Sorry, I confused the extensions - so many AdBlock...

2012-03-28T13:17:18.027+02:00

Sorry, I confused the extensions - so many AdBlocks to choose from ;) I've already contacted Michael about the issues.

Yup, we have to wait for webRequest ( http://code....

2012-03-28T12:30:34.359+02:00

Yup, we have to wait for webRequest ( http://code.google.com/chrome/extensions/trunk/webRequest.html ) until real ad blocking is supported, so I consider the first vulnerability just a sweet, interesting trick. But you should fix the second one nonetheless ;)

Nice vulnerability you found there. Just a note: A...

2012-03-28T12:26:06.410+02:00

Nice vulnerability you found there. Just a note: Adblock Plus for Chrome is not affected, only Adblock. As to CSS tricks - yes, that's a Chrome limitation and not something that extension authors can currently fix (Adblock Plus for Firefox is fine).

Thanks for the article, it's very interesting....

2012-03-28T08:44:01.612+02:00

Thanks for the article, it's very interesting.

Anyway, the best adblock you can have is turning plug-ins (Flash) off, which is supereasy in Opera, easy in Chrome, and possible in Firefox with Flashblock (there might be easier way I don't know about). And then whitelist sites like Gmail, YouTube, Google Maps or Dropbox, which use Flash for something useful.

Great article!

2012-03-28T06:36:31.690+02:00

Great article!

and firefox's adblock is not exploitable becau...

2012-03-28T04:47:48.559+02:00

and firefox's adblock is not exploitable because it uses browser level filters ,something chrome doesnt let you do

Is it possible to translate this into an extension...

2012-03-28T00:05:52.098+02:00

Is it possible to translate this into an extension that would work in browsers to strip the referrer header from being sent? I hunted around for ways to do it in Chrome, but all I found was extensions that tacked on rel="noreferrer" to EVERY link in pages you visit.

Obviously, this would break a lot of functionality for certain websites, so some would need to be whitelisted, but I believe that would be a helpful privacy tool in some circumstances.

I came across a site recently that had, I feel, a ...

2012-03-27T23:32:34.210+02:00

I came across a site recently that had, I feel, a good alternative to both arguments for and against Adblock. It just has a nice little message at the top that says "Hey, we see you're using adblock. That's cool, but would you consider unblocking us?"

But, out of curiosity I hunted around to try and discover how they were detecting Adblock and found a Javascript file that contains the text, but I can't make heads or tails of it. Unfortunately, Pastebin doesn't seem to have line numbers on it, but ctrl+f for "can't" (w/o quotes)

http://pastebin.com/VTK9sAie

This is the site http://alternativeto.net/

Theres a little bit about these scary warnings and...

2012-03-27T22:48:01.101+02:00

Theres a little bit about these scary warnings and what they mean on a section of Google Code's website, but its written more towards extension authors than end users.
http://code.google.com/chrome/extensions/permission_warnings.html