Slashdot Mirror

Had a play earlier as I was worried you might be susceptible to a similar thing as the MySpace "Samy is my hero" style XSS attack.

The following was witnessed:

• Inserting script tags = tags removed before publishing.
• Inserting style tags = tags removed before publishing.
• Inserting element on events (onclick, onblur, etc) = attributes stripped before publishing.
• Inserting basic element style attributes = tags left in, style applied.
• Inserting advanced element style attributes (stuff that can rewrite DOM) = just those attributes stripped, formatting attributes left intact.

So for all of the basics, the Google Page thingy passes all basic tests on XSS attacks.

Well done :)

I'm even recommended it on my forum already because the security gives me enough peace of mind to not regret doing so.

"Other than adds, what else could fund 'free' services online?"

I know not many people get donations to work, but with a good level of transparency some people who care deeply about a site or service will pay for it.

The assumption people make is that the service is part of a company offering, that it's being paid for implicitly when other products or services are purchased. People assume that *someone* must be paying for it.

By giving transparency, and translating the accounts into what it means for the users, I've found on the forum I run that users have been willing to fund our server fully, with enough money in the kitty for the next 6 months.

In return we publish a full record to all of our members of every transaction that is made, and commit ourselves to only using donations to fund the service offering.

We did this because adverts never raised enough money for our medium-sized site anyway... and the cashflow was far too erratic (Adsense clickthrough revenues can vary quite wildly). Most users became de-sensitised to adverts and we spent a lot of time tweaking the adverts so that they would remain in the consciousness of the users.

It was dire.

Donations have worked for us though. So much so that we now have an abudance of bandwidth, CPU and RAM, so are looking to start an online radio service too :)

You can see the accounts that we publish on our front page here: http://www.bowlie.com/forum/ and registered members can view our entire cashflow over the years here: http://www.bowlie.com/accounts/

In essence, users aren't stupid and do appreciate the need for the site to have a revenue stream. If you respect the users, and are up front with them about the costs, cashflow, etc... and can communicate that X amount of money = Y amount of time in existence, then the part of your audience who value what you do will step in and help fund you.

However, this puts a pressure on making sure that what you do has value. Generic low value sites without rich content of their own, will likely not find that the above model works for them. Some users have to really be passionate for it to work.

"Other than adds, what else could fund 'free' services online?"

I know not many people get donations to work, but with a good level of transparency some people who care deeply about a site or service will pay for it.

The assumption people make is that the service is part of a company offering, that it's being paid for implicitly when other products or services are purchased. People assume that *someone* must be paying for it.

By giving transparency, and translating the accounts into what it means for the users, I've found on the forum I run that users have been willing to fund our server fully, with enough money in the kitty for the next 6 months.

In return we publish a full record to all of our members of every transaction that is made, and commit ourselves to only using donations to fund the service offering.

We did this because adverts never raised enough money for our medium-sized site anyway... and the cashflow was far too erratic (Adsense clickthrough revenues can vary quite wildly). Most users became de-sensitised to adverts and we spent a lot of time tweaking the adverts so that they would remain in the consciousness of the users.

It was dire.

Donations have worked for us though. So much so that we now have an abudance of bandwidth, CPU and RAM, so are looking to start an online radio service too :)

You can see the accounts that we publish on our front page here: http://www.bowlie.com/forum/ and registered members can view our entire cashflow over the years here: http://www.bowlie.com/accounts/

In essence, users aren't stupid and do appreciate the need for the site to have a revenue stream. If you respect the users, and are up front with them about the costs, cashflow, etc... and can communicate that X amount of money = Y amount of time in existence, then the part of your audience who value what you do will step in and help fund you.

However, this puts a pressure on making sure that what you do has value. Generic low value sites without rich content of their own, will likely not find that the above model works for them. Some users have to really be passionate for it to work.

If Proxy Firewalls offer a comparable level of security to a Yale lock, then we are seriously in trouble!

From my own forum: How to defeat a Yale lock using nothing but a plastic bottle

" If you work around a problem, it hides from the user that the problem exists."

This is VERY true.

Which is why on my site I purposefully avoid giving a hoot that IE can't display PNG's properly.

When I tell people to use Firefox, it's an added sense of wonder when they do and see that suddenly the images don't have grey backgrounds after all. It also helps hammer home just how cruddy the software (IE + Windows... it is an integral part of the OS afterall) that they were using actually is.

It's the same with bugs. Providing that the bug doesn't lose me a user or breach security, I will leave the nagging ones there and let the user see it.

Dev teams (esp. MS ones) are far proactive about fixing bugs when hordes of dumb users are complaining on their forums and community sites, than when a few geeks speak out... if we do the covering up for them, then all we're doing is prolonging the life of the bug.

Not true.

I'm converted by philosophy, but not in practice.

I have this year installed a number of Linux distros (Red Hat, Gentoo, Mepis, Debian, Mandrake) and am yet to find one that recognises all of my hardware (my RME-DigiPST sound card proving impossible to get working) or fulfils all of my software requirements (a contact manager that can sync with both an Ericsson and Motorola phone for example).

I am still finding that each time I look at Linux that I lack things... be it something that replaces ID3-TagIt, or rips and encodes similar to EAC and LAME.

I've knocked together this Wiki page for the forum I run as several of us want to migrate. As you can see... it's not been updated in a while and the few unanswered questions are still unanswered.

Now, the point of this post is this... each time I have looked at Linux to date I find it is not quite ready, but that it is closer to being ready. Each time I find it easier to jump into, and easier to get started on and with fewer outstanding questions.

However... each time it has still failed to do everything I do with my computer. So I stay on Windows and think "maybe tomorrow"... and then get lazy.

When I'm lazy I stick to Windows, because it does work.

Then I read articles like this, which are preaching to the philosophically converted. Articles such as this remind me that I've yet to switch, remind me that I'm being lazy... they remind me that I had some unanaswered questions and that I should ask them again.

I personally think there is a lot of value in this. It's already put it back on my desk as a fun thing to do this afternoon (give Gentoo another try!).