Hackszine.com

Most recent posts: page 3 of 6 1 2 3 4 5 6
Browse the complete archive by category or month.

May 30, 2008

SafeHistory: protect your privacy from visited link analysis

A couple of days ago I wrote about the visited link javascript hack that lets any website operator query a user's browser history to determine if they've visited any other particular site. One possible use for this is to detect which Web2.0 social applications a user visits so that you can display the appropriate link badges.

It's a creepy scenario, though, that a website operator can effectively bypass the browser's intended security model to invade your privacy by seeing if you've been visiting other sites. Hackszine reader Logical Extremes commented with a solution to this problem:

This is a common phishing vector. Rather than encouraging broader use, we should be educating and protecting against it. There is a Firefox add-on that explicitly blocks this.

Some hackers over at the Stanford Computer Science Department created SafeHistory, a Firefox plugin that protects against visited link tracking techniques. It works by only allowing the a:visited property to apply to off-site links that were previously visited from the current URL.

This seems to be a reasonable way to keep the functionality of visited links without leaking any additional information. I wonder how long it will be before this is adopted as a browser behavior standard.

Stanford SafeHistory
Protecting Browser State Using Same Origin Policy (PDF)

Previously:
Detect which sites a web user visits

May 29, 2008

Wii Balance Board hacks

A few days ago, this video appeared with Matthieu Deru and Simon Bergweiler showing off a hack that allows them to surf Google Earth using a Wii. Unfortunately, there weren't too many details about how it was accomplished and I couldn't track down any source for the C# application that talks to the bluetooth device.

What I did find was this other clip from almost a month ago (?!?) in which Daniel Schneider demonstrates using the Wii Balance Board to navigate the web in Firefox.

That's right. You can actually surf the web:

He's using the latest version of GlovePIE (v0.3) to accomplish this. As far as I can tell, it's still very alpha, and the WiiLi wiki claims it's buggy, but it does appear to work. Daniel has some pointers to how he's configured things, including the Greasemonkey script that allows you to surf without clicking.

For more information on coding GlovePIE scripts that use the Balance Board, peek at the documentation.rtf file that's packaged with the GlovePIE download. There's information around page 70 that describes how the board functions and how to pull the 4 sensor values from each of its feet.

Using GlovePIE and Firefox with the Nintendo Wii Balance Board
GlovePIE

May 28, 2008

Detect which sites a web user visits

Aza Raskin's SocialHistory Javascript library allows you to do something incredibly cool: detect which sites your web users have visited on a per-user basis. The javascript runtime isn't supposed to be privy to the information in a user's browser history, but there's an information backchannel common to all major browsers which allows you to effectively interrogate the browsing history and determine if a particular URL has been visited before.

It works by creating an anchor link to the site in question and applying a CSS style to the link, specifying a different display property for "a:visited". By reading the computed style back from the anchor element, you can then determine the property's value, and consequently if the user had visited the URL or not.

This could probably be used for a number of devious purposes, but Aza's concept for the SocialHistory library is actually really useful. By querying the default URLs that belong to all the major social network sites, you can figure out which sites a particular user visits and custom tailor any social badges that you display. If they use del.icio.us, you show a del.icio.us link. If they visit Digg, you show the Digg button. It's an awesome feature made possible by a pretty freaky security leak.

Now, it's not perfect. It requires that you query the exact URLs that a user may have visited. You can't figure out everywhere they've been, how frequently, or in what order, only whether a particular URL that you know about has been visited before. On the other hand, it's a pretty useful tool considering you aren't even supposed to be able to do this.

How to Detect the Social Sites Your Visitors Use
SocialHistory.js

May 27, 2008

Conquer jet lag with a 16-hour fast

There was an interview with Clifford Saper, a professor of Neurology and Neuroscience at Harvard Medical School, in last week's Science Friday. The discussion was about a study which was just published in the journal Science about a second circadian clock in mammals that is driven by food availability. The research suggests that this second clock evolved as a sleep-cycle "reset" mechanism which allows mammals to very quickly adapt to optimize their wake period and maximize the chances of finding food during times when food is scarce.

This starvation override can take effect after only 16 hours of fasting. When the fast is cancelled by a sufficient caloric intake (read: real food), the body will shift its natural wake time to coincide with the event. So if you want to ditch your jet lag, or if you want to get up earlier in the morning, it might be as simple as fasting for the 16 hours prior to the time you would like to wake up, then eat a big meal. Your body will then override its normal light-based rhythm and wake at that same time going forward.

I'm going to give this a try. I've struggled all my life with getting up in the morning. Interestingly enough, I've also never eaten breakfast. My first meal of the day is lunch, which means I am basically fasting for over 16 every day between dinner and lunch the following afternoon. Perhaps if I skip dinner one night, eat breakfast early in the morning, and then start eating breakfast regularly, I'll turn into a morning person. I'm not really expecting results, but it's worth a try and I'll let you all know how it goes.

Science Friday: Circadian Clock Sets at Lunchtime [via ParentingSquad]

May 26, 2008

Code Kata: exercise for the software developer

It's no news that practice is the only path to being truly great at something. The art of software development is no different. The demand for programmers the way it is, however, means that a lot of folks jump into their careers head first with a certain level of formal subject knowledge, but very little practical experience. Likewise, even experienced developers are sometimes so busy that not enough time gets devoted to the practice of the craft. Dave Thomas recognized this problem and came up with a collection of short, defined practice exercises for software developers, the Code Kata:

Code Kata is an attempt to bring this element of practice to software development. A kata is an exercise in karate where you repeat a form many, many times, making little improvements in each. The intent behind code kata is similar. Each is a short exercise (perhaps 30 minutes to an hour long). Some involve programming, and can be coded in many different ways. Some are open ended, and involve thinking about the issues behind programming. These are unlikely to have a single correct answer. I add a new kata every week or so. Invest some time in your craft and try them.

Some of the example scenarios are expressed in Ruby, but aside from that they are language agnostic. What I like is that the exercises cover a wide breadth of scenarios, some of which I encounter daily in my work, and some only rarely. Even working through the problems and roughing out a solution in my head seems to be a useful tool for keeping the problem solving faculties sharp. Trying to solve problems like these involves no real deadlines or pressure, which is the necessary environment for devoting a little time regularly to focus on honing your skills.

Do you use any other resources for staying on top of your game? Let us know in the comments.

Code Kata

May 25, 2008

Polaroid emulsion lift

There's a technique called the Polaroid emulsion lift that allows you to transfer a Polaroid print to different materials, such as glass, rock, or watercolor paper. Essentially, you soak a completely dry photo (one that has set for at least 24 hours) in hot water and carefully peel the emulsion layer from the photo backing. The thin layer of film can then be carefully removed, spread over a new surface and allowed to dry.

The video above shows how the process works, and there's a link to more specific details below. This is supposed to work best with type 669 film due to it's really think emulsion layer. That said, people have had great results with other types of film, and a thinner emulsion layer will produce cool crinkly effects and tears, which can also be desirable.

Polaroid emulsion lifts
Emulsion lift example on YouTube

May 24, 2008

Colors: Nintendo DS homebrew paint application

Wired's how-to Wiki ran an article about installing homebrew apps on your Nintendo DS, describing how to install and use Colors, a really pro-looking sketch application. It seems like such a simple application, but its capabilities as a sketch tool (in the hands of someone with artistic talent) are stunning. It uses the pressure sensitivity of the DS touch screen to control the stroke width, much like how you might use an expensive Wacom tablet, except completely portable.

Running homebrew apps on your DS is about as simple as purchasing a compatible flash cartridge, so there's nothing too intimidating about using (and maybe developing) some of the great applications that are available from independent developers.

Colors!
Hack a Nintendo DS to Make an Awesome Digital Sketchbook [via LifeHacker]

May 23, 2008

Helmer render cluster: 186 Gflops in an IKEA cabinet

I usually get all excited about tiny, noiseless, low-power PC hardware, but I have to admit that this 24 core, 186 Gflop render cluster built into an IKEA Helmer cabinet is pretty inspiring. Most cool is that when it's not overburdened and jumping to swap, it's still a reasonably efficient setup for its performance specs:

The most amazing is that this machine just cost as a better standard PC, but has 24 cores that run each at 2.4 Ghz, a total of 48GB ram, and just need 400W of power!! This means that it hardly gets warm, and make less noise then my desktop pc.
Render jobs that took all night, now gets done in 10-12 min.

Janne opted for modifying the Helmer cabinet instead of using standard PC cases because the 6 cases would have cost about as much ass the motherboards and CPUs. Most of the modification involved cutting holes for airflow, power supplies, and cabling, but it looks like the Helmer's drawer dimensions accommodate the ATX motherboards almost perfectly.

I'm not all that familiar with the software behind 3D rendering (anyone care to point us to some howtos?), but Janne is using a batch management system called DrQueue that looks quite useful for a lot of distributed applications. It takes care of distributing jobs between the clsuter's nodes, allowing you to manage and monitor each of the nodes remotely from a central interface. Pretty cool stuff.

Helmer render cluster
DrQueue

May 22, 2008

Keywurl: keyword search for Safari

Keywurl is a nifty little Safari plugin that adds simple keyword search to the address bar. Say you wanted to pull up the Wikipedia entry for hacks: just type "wiki hacks" into the address bar. Looking for photos tagged with makerfaire? "flickr makerfaire" will take you to the appropriate place.

The latest beta version for Leopard allows you to right click on any form field and add a search shortcut keyword for it. This would easily let you add keywords like "hacks" or "slashdot" that would let you query for articles on your favorite sites. Unfortunately, there isn't a Tiger build of this version yet, so revision slackers like me will have to wait. You can also get at the keyword settings manually through a new button in the Safari preferences panel.

I haven't been using this long enough to tell if I'm going to keep it, but so far it's really promising. At the very least, it sends me to the right place when I type in a search term into the address bar instead of the search bar by accident.

Keywurl

May 21, 2008

Aluminum foil is a scissor sharpener

I got sucked into reading one of those 15 amazing things you never knew about aluminum foil articles. One of the claims was that you could sharpen a pair of scissors by cutting aluminum. It sounded about as plausible as mending a broken leg by driving it over with a station wagon, but I'll be damned if it doesn't work.

It's as simple as folding over a sheet of tinfoil a couple times, and then cutting it repeatedly with the dull scissors. It doesn't really grind a new edge or anything, but it has a similar effect to honing a knife edge on a steel sharpener. What's nice is that you get the honing result without needing to get a precise angle on the honing tool. The scissors push against the foil and move past it at the right cutting angle and you get a sharper edge.

I wonder if this is how the Ginsu knife could slice a tomato so darned thin after grinding on a sheet of marble and cutting through an aluminum can.

15 awesome uses for aluminum foil

May 20, 2008

Duff's Device: loop unrolling for interpreted languages

In 1983, Tom Duff invented a really strange way to use the C language's switch and case statements for the in code "unrolling" optimization of large loops. As an example, he described a simple loop that copies an array to an output register:

	send(to, from, count)
	register short *to, *from;
	register count;
	{
		do
			*to = *from++;
		while(--count>0);
	}

On every iteration of the loop, in addition to the copy that is being performed, the count variable is decremented and a comparison is done against 0. Duff's Device allows you to achieve the same result, but with only an 8th of the overhead:

	send(to, from, count)
	register short *to, *from;
	register count;
	{
		register n=(count+7)/8;
		switch(count%8){
		case 0:	do{	*to = *from++;
		case 7:		*to = *from++;
		case 6:		*to = *from++;
		case 5:		*to = *from++;
		case 4:		*to = *from++;
		case 3:		*to = *from++;
		case 2:		*to = *from++;
		case 1:		*to = *from++;
			}while(--n>0);
		}
	}

What happens is that the loop is unrolled 8 times, so each iteration of the loop runs the internal code 8 times over without the comparison. The genius of Duff's Device is that it takes advantage of the way the C switch/case structure works. The first time through, if the iterations don't divide evenly by 8, the loop code is executed enough times to equal the remainder of iterations/8. It's a little bizarre, because the "do" statement occurs within the switch, but there are "case" statements within the "do". Nevertheless, it's valid C.

Before someone cries foul, remember that this is only really suitable for speeding up the performance of inner loops when no suitable, better algorithm is available. If you code C, most modern compilers are smart enough to automatically optimize your code and unroll loops for you.

For interpreted languages like PHP or Javascript, however, you sometimes need to do a little optimization on your own if you want to squeeze out some extra performance. Luckily, both languages have a c-style switch statement.

Andy King wrote about a slightly altered version of this loop unrolling algorithm which ditches the switch statement and breaks the normal Duff's Device into two separate loops, one for the remainder and one for the unrolling. In Javascript, it performs a simple addition loop in only a third of the time of a normal for loop (testVal++ is the normal loop's interior):

function duffFasterLoop8(iterations) {
  var testVal=0;	
  var n = iterations % 8;
  if (n>0) {
    do 
    {
      testVal++;
    }
    while (--n); // n must be greater than 0 here
  }
    
  n = parseInt(iterations / 8);
  do 
  {
    testVal++;
    testVal++;
    testVal++;
    testVal++;
    testVal++;
    testVal++;
    testVal++;
    testVal++;
  }
  while (--n);
}

It's not as syntactically clever as Duff's Device, but it's a good way to manually unroll an inner loop and get the best performance for your extra effort.

Duff's Device
Andy King's Optimizing JavaScript For Execution Speed

May 19, 2008

Flying bike for Google Earth

"Some guy who's never met Mike" wrote in to tell us about Mike's Flying Bike, a completely unconventional flight-sim interface created from a bicycle, a Sun SPOT sensor/microcontroller, and Google Earth.

So, you pedal this stationary bike to pick up speed and take off. Then you manipulate various hand levers and the handlebars to affect the elevator, aileron and rudder controls. It's never been so fun to fly around the Earth. In your living room. On a bike.

Mike's Flying Bike for Google Earth

May 18, 2008

Make custom fonts with FontStruct

Paul from the Compiler blog pointed out a cool flash application called FontStruct. It's basically a WYSIWYG editor for fonts, allowing you to easily create a TrueType font of your own design without having to learn your way through all the intricacies and difficulties of professional fontography.

The site includes a big gallery of Creative Commons licensed fonts that were created with the program. Whether you create your own or download an existing one that you like, it's a solid resource.

FontStruct [via Compiler]

May 17, 2008

Protect your luggage with a starter pistol

I can't say how realistic this is, and I probably won't be using the advice myself, but Jon Udell wrote about a plausible strategy for subverting the TSA rules into protecting your check-in luggage. The trick is to declare a firearm (in this case a starter pistol) which, by policy, forces your bag to be inspected in your presence and then locked in transit.

I'm given a little card to sign, the card is put in the case, the case is given to a TSA official who takes my key and locks the case, and gives my key back to me.
That's the procedure. The case is extra-tracked...TSA does not want to lose a weapons case. This reduces the chance of the case being lost to virtually zero.

It's odd that you can't request to have any check-in inspected and secured for flight in your presence. It'd only be worth the hassle for a few people, and it'd save them a lot of grief. Then again, why can't we expect the same level of accountability and professionalism from security-cleared baggage handlers and TSA officials as we can from anyone at DHL or Fedex?

Personally, I just bring any laptops and cameras with me in my carry-on. It presents its own hassle during screening due to the asinine "remove all electronics and put them in separate buckets" policy, but at least they show up on the other end of the flight.

Pack a starter pistol to deter luggage theft

May 16, 2008

Python pizza status

Nothing goes better with some Python hacking than a little pizza. Nick Jensen couldn't wait for his pizza to arrive to begin hacking, so he spent the 30 minute wait-time writing a Python script to track the pie's progress:

I discovered an interesting XML feed the other day when I ordered a pizza from dominos. After seeing a dumb commercial about what some idiots do in their 30 minute pizza-waiting time, I remembered hearing something about being able to "track" your pizza online. So what did I do during my 30 minutes you ask? I went on over to dominos website to check out this amazing tracking device. It turns out to be just a flash app hooked up to an XML feed and Tamper Data revealed it was coming from here.

The details and the Dominos python script are below. Suffice it to say that you can pull an XML status on your Dominos order by hitting http://trkweb.dominos.com/orderstorage/GetTrackerData?Phone=phonenumber (where phonenumber is your 10 digits). You can easily parse this from other languages if you're not the Python type.

You've got 30 minutes... to write a python script
dominos.py

May 15, 2008

Gmail notification cube

Jamie Matthews created a nifty notification cube that glows when his Gmail inbox has a message.

I was given a lovely glowing cube by the generous people at Linden Labs as a freebie at a job fair yesterday, and I decided that it was far too attractive to simply sit there on a shelf, pulsating forlornly until its batteries went flat. How about making it useful, while maintaining its visual appeal?

A simple python script runs on his computer, periodically screen-scraping his Gmail inbox looking for new mail. It then outputs a message to the serial port, indicating the mailbox status. On the other end of the serial connection is a Boarduino, which receives the message and toggles power to the cube.

You could start with his code and get a jump-start on doing something similar. It looks like this could inspire a fun project or two on a lazy afternoon.

How to make a Physical Gmail Notifier

May 14, 2008

Debian/Ubuntu users: update your SSL keys and certs

It was announced yesterday that sometime back in September 2006 a line of code was removed from the Debian distributed OpenSSL package. That one line of code was responsible for causing an uninitialized data warning in Valgrind. It also seeded the random number generator used by OpenSSL. Without it, the error went away, but the keyspace used by affected systems went from 2^1024 to about 2^15. Oh noes!

A large majority of Debian and Ubuntu systems are affected. To correct the problem, you'll need to not only update OpenSSL, but also revoke and replace any cryptographic keys and certificates that were generated on the affected systems. From the Debian security advisory:

Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections. Keys generated with GnuPG or GNUTLS are not affected, though.

For most people, this boils down to your ssh server's host key and any public key pairs used for remote ssh authentication. Any keys or certificates generated on the affected machines for SSL/https use also need to be revoked and regenerated. It's pretty ugly, really.

As far as teachable moments go, there's probably a lot to think about here. Software developers have this weird natural tendency to want to fix and reengineer things that aren't even broken. I'd go so far as to say that the desire to reengineer is inversely proportional to a programmer's familiarity and understanding of the code. I think it comes from our intense desire to make sense of things. It's the guru who's able to channel that hacker urge into solving new problems instead of creating new bugs out of old solutions.

DSA-1571-1 openssl -- predictable random number generator
OpenSSL PRNG Debian Toys (more discussion of the problem here)

May 13, 2008

drop.io - simple anonymous file sharing

Sometimes I need to send files to people that are too large to attach to an email. Inevitably, the solution is to upload it to an ftp or web server that I have access to and then send the recipient a download url. It's a pretty inefficient process, and unless you like your ftp server becoming an overwhelming mess of random downloads, you have to remember to go back and remove things at a later date.

drop.io is a web service that solves this sort of problem perfectly. You create a drop URL with a unique name, upload a file to it, and set an expiration time when it will be deleted, all in a single step. The drop folder can have both an access and an admin password, and you can choose what level of access (read, read/write, read/write/delete) the non-admin has. After you've created a drop folder, you can continue to add files and notes to it via the web interface or by email. Each drop also has a phone extension that will allow you to call in and record messages that are added to the drop. It's brilliantly simple.

What I like best is that aside from tracking IP for legal or terms of service violations, it's completely anonymous. You don't make an account to use the service. There is no profile. The drop folders aren't search indexable unless you choose to make them without passwords and publish the URL somewhere crawlable. You can renew the expiration period of the drop, but when it expires, it goes away along with its contents.

I like.

drop.io - Simple Private Exchange

May 12, 2008

Cross browser session data with Javascript

By storing data in the window.name property, you can store data between page loads and across domains without ever sending a cookie to a server. Thomas Frank created the sessvars.js library which makes use of this browser quirk, allowing you to store up to 2 MB of client-side session data.

This is really powerful for a few reasons:

client-side, you can store way more data than allowed by traditional cookies
none of the data is transferred explicitly to the server, minimizing bandwidth used for each page request
allows you to talk between pages in different domains

Keep in mind that anything you store via this mechanism will be visible to any other site that a person visits, so this is best for storing non-sensitive data that you want to retain between page loads. This would be great for caching returned AJAX data that you would otherwise have to refetch and reprocess.

Session variables without cookies

May 11, 2008

A VAX in your Linux box

Like many, my first introduction to the Internet came by way of a VAX/VMS server operated by the local University where I lived. A friend of a friend scenario landed me an account on the system, and after about a week I was hooked. It wasn't long before I signed up for a night class so that I could parlay an official student record into an account of my own (I was in high school at the time).

I was recently wondering about what's happened with OpenVMS. Is it still around? Will it run on normal PC hardware?

It turns out there are still a number of VMS devotees and hobbyists out there, and OpenVMS can still be found running not only on hobbyist legacy systems, but also in modern server environments where security, fault-tolerance, and uptime command a high premium over hardware cost and operating system popularity. There's even a freely available hobbyist license for OpenVMS, and you can get the installer media shipped your way for $30.

But what do you run it on if you don't have a VAX or Alpha in your basement? An emulator, of course! The SIMH emulator, created by the Computer History Simulation Project, is capable of emulating a DEC VAX and will run on a Linux, Windows or OS X host machine.

The most difficult thing, from what I've read, is that you need to jump through a number of hoops to get the OpenVMS license and media and the license needs to be renewed yearly. Phillip Wherry wrote a very extensive howto in 2004 that walks you through obtaining the media, building and configuring the SIMH emulator in Linux, and installing OpenVMS on your virtual VAX. If you want to run OpenVMS on Windows or OS X, there are pre-compiled SIMH binaries available for both platforms. The installation process should be the same for whichever host system you use.

Keep in mind that Phillip's howto was written in 2004, and I haven't gotten my OpenVMS hobbyist license yet, so I don't know for sure if there are any gotchas in there. The DECUS user group still seems to be alive and the company that ships the OpenVMS media is still taking orders, which is a pretty good sign. If any readers out there are currently running this setup, please give us an update in the comments. I'm excited to see some of my old DCL scripts running again, so I'm keeping my fingers crossed for good news here.

Running VAX/VMS Under Linux Using SIMH
SIMH VAX Emulator (Linux and Windows)
SIMH binaries for OS X
Encompass - DECUS User Group (Sign up for membership which is required for the license and media
Order Form For OpenVMS Hobbyist CD Media