Slashdot Mirror

'I see that I'm legitimately on the https://www.foobar.com/ site, and Foobar is telling me that Google wants permission. I trust Foobar and Google, so I'll click Allow,'"

Let's see. You're on the attacker's website and you trust it (apparently because it has https in the URL), and you trust Google, so you allow the attacker free access to your google account. How is this Google's fault again? I mean, you give access to your account to people you shouldn't and it's someone else's fault?

The mistake here is Google wants permission. That's not what's happening. It's Foobar asking for permission by pretending to be google. So while you would trust Google to give you access to foobar without giving Foobar too much info. You don't trust Foobar directly. So youclick Allow on Google but you're actually clicking on Foobar.

'I see that I'm legitimately on the https://www.foobar.com/ site, and Foobar is telling me that Google wants permission. I trust Foobar and Google, so I'll click Allow,'"

Let's see. You're on the attacker's website and you trust it (apparently because it has https in the URL), and you trust Google, so you allow the attacker free access to your google account. How is this Google's fault again? I mean, you give access to your account to people you shouldn't and it's someone else's fault?

Her web pages appear to be HTML.

Wow, look at that. Right in the damn HTML4 spec:

The robots.txt file

When a Robot visits a Web site, say http://www.foobar.com/, it firsts checks for http://www.foobar.com/robots.txt. If it can find this document, it will analyze its contents to see if it is allowed to retrieve the document. You can customize the robots.txt file to apply only to specific robots, and to disallow access to specific directories or files.

robots.txt, and the meta tag defined later in the same document, are indeed rules.

Her web pages appear to be HTML.

Wow, look at that. Right in the damn HTML4 spec:

The robots.txt file

When a Robot visits a Web site, say http://www.foobar.com/, it firsts checks for http://www.foobar.com/robots.txt. If it can find this document, it will analyze its contents to see if it is allowed to retrieve the document. You can customize the robots.txt file to apply only to specific robots, and to disallow access to specific directories or files.

robots.txt, and the meta tag defined later in the same document, are indeed rules.

Hi there; I'm the software architect and implementor of HyperScope, and thought I'd provide some more info on the OPML capabilities of what you can do with it.

HyperScope is like OPML and HTML hyperlinks on steroids. There are so many different kinds of addressing your nodes that its not even funny. You can do direct addressing using hiearchical placement, even if there are no anchors:

mydoc.opml#2A

Where 2A is the second node (2), followed by it's first child (A). Node numbering always alternates between letters and numbers for readability; so you might have 2A3B. These are generated automatically and will work across all OPML documents, not just ones that have been marked up with the optional HyperScope namespaced attributes.

You can target node IDs, which are unique values that never change for a node even if it is moved around; these always start with a 0:

mydoc.opml#0626

Node IDs are optional, and placed on an OPML outline node using the hs: namespace:

<outline text="foobar" hs:nid="0626"/>

Node IDs are optional, and are created on document creation or editing, while the node hierachical numbers above work for any OPML file.

You can target based on label, using the optional hs:label attribute:

<outline text="foobar" hs:label="mylabel">

This would be the following address:

mydoc.opml#mylabel

Now, here's some cool stuff; once you've hit your target address using direct addressing, you can start to use relative addresses to move relative to the one you just targeted. For example, once I've gone to 'mylabel', I could jump down in the node hierarchy then to the next 2 nodes using the following:

mydoc.opml#mylabel.d2n

Which is .d for down and .2n for next two. You can jump through the hierarchy using many of these, including successor (.s) for going to the next sibling of the current node, independent of children; predecessor (.p) for the same, but for the previous sibling; back (.b), which will take you to the previous node that is right before you, independent of hierarchy; next (.n) for the same but forward; up (.u) to move up an ancestor; down (.d) to move down; tail (.t) to move to the last child sibling on my level; head (.h) to move to the first child sibling on my level; and more.

Once you've done these, you can start doing some other fun stuff. I can now do an indirect link, which is .l (that's a lower case L):

mydoc.opml#mylabel.d2nl

The 'l' is magical; it says: "once you've found the final node after dereferencing the other addresses, look inside the contents of this node, and take the first address you find then follow it."

For example, if the node that lies at mylabel.d2n has the following contents (that's an encoded HTML hyperlink in there):

<outline text='Make sure to see the document: &lt;a href=&quot;http://foobar.com/important.opml#2&quot ;Important&lt;/&lt;/&gt;

then adding that .l will cause HyperScope to extract
http://foobar.com/important.opml#2, and follow it and dereference it, which will cause the browser to jump to important.opml, then jump to node #2.

So indirect links let you create a layer of indirection between you and a set of links. You could imagine combining this with the node labels to create a kind of link database; just create a file that you always use that has named nodes for important links that you want to go to, then use indirect links against these. This is exactly what Engelbart does; I've sat and watched him and studied how he uses the system. You can see modern screencasts of that system and his work practices at these blog posts of mine: http://codinginparadise.org/weblog/2006/03/new-scr eencast-of-douglas-engelbarts.html and

Both Fubar and Foobar work here. How do you know which one has he had in mind?

I do not know how to have a HTTP page, and a HTTPS Javascript transaction.

This is just a wild, totally unconfirmed guess, but it might be JavaScript security blocking the call because it's going to a different server. I believe http://www.foobar.com/ and https://www.foobar.com/ are as different as http://www.google.com/ and http://www.msn.com/ as far as JavaScript is concerned.

I do not know how to have a HTTP page, and a HTTPS Javascript transaction.

This is just a wild, totally unconfirmed guess, but it might be JavaScript security blocking the call because it's going to a different server. I believe http://www.foobar.com/ and https://www.foobar.com/ are as different as http://www.google.com/ and http://www.msn.com/ as far as JavaScript is concerned.

So, are you saying that because Apple has a short QuickTime demo of Dashboard and Spotlight and Automator and a half dozen other "top ten" features of Tiger that there is no point discussing these further?

How do you embed links in /. posts without getting the stupid trailing domain in brackets? like this

I am the person who did the original testing for MacRumors. Here are the final steps:

The raw aac file that QTFairUse produces can be played in a windows app called foobar.

To play back in itunes is a little harder. One must run an application called faad.exe to fix the "atoms?" of the aac file. After that is done one must add the MPEG-4 wrappers using the program mp4creator found in MPEG4IPutils. Make sure to use the -optimize tag, or else the file will triple in size. After this is all done you end up with a m4a file with the decrypted aac content in a MPEG-4 wrapper playable in itunes.

I wouldn't mind an automatic Google Are You Feeling Lucky? feature in my address bar.