Slashdot Mirror

Yeah, what the hell is wrong with the Tropicana people?

I'm sure it won't.

I tried upgrading to Leopard on my G4 iBook. Tried it for a couple months, then downgraded back to Tiger.

Some of the UI decisions they made in Leopard, like folders in the Dock that display as all of their contents stacked in a pile instead of a folder icon, were completely brain-dead. There was enough public outcry (and third-party workarounds) that Apple added options to fix the behavior in newer versions, but they still go with the stupid options by default. Did they forget to do usability testing, or did they simply ignore the results? Did it not occur to them that when you've got four dozen items in your Applications folder, making the folder look almost like the Address Book is confusing? Or that a distant star shining through a transparent menubar looks like something's wrong with your screen?

Other problems I noticed:

• CUPS browsing is disabled by default
• Editing multiple items in iCal is more awkward; they fixed part of it, but the details appear in a popup instead of a sidebar so they're always in a different part of the screen depending on what you're editing
• Spotlight's "Show All" function doesn't group the results by categories
• The selected tab in an application like X-Chat turns gray whenever another window has focus, so you can't see which tab was selected

Also, I think getting rid of the rounded corners was a terrible choice. I found a hack that brings them back if you want.

I also ran into driver issues - I couldn't get my Canon scanner to work, and couldn't communicate with my Nokia phone over Bluetooth. It reminded me of Vista users complaining about their driver woes.

Then there are UI problems with Tiger that Leopard simply left unchanged:

• FTP still doesn't work (try ftp://ftp.mozilla.org/pub/mozilla.org/ for example)
• Windows like Spotlight's "Show All" search results window aren't associated with any application, so Cmd-Tab won't switch to them; in Leopard the "Add Printer" window has this problem too

I don't see how Snow Leopard could be worse.

I find it easiest to not validate anything on input, because I don't know what my output is necessarily going to be - could be HTML, could be PDF (for example). If I am outputting to non-HTML I don't want to wade through HTML-encoded soup to get something sensible back out.

What I mean by input validation is aborting with an error if the user has submitted invalid data, e.g. entering "foo" in an e-mail address field. Nothing is encoded or escaped at this point. If I need to store it in a database, the data is stored as-is, using the Perl DBI's automatic escaping feature to make sure SQL injection attacks aren't possible (I can think of one occasion when this wasn't adequate and I had to wring my own routine). Whatever else I need to do with the data, any necessary escaping gets done only as the data is being used, it's never stored that way. If I need to send it back to the browser, HTML escaping doesn't happen until I actually print the HTML, or immediately before.

If I'm outputting to web, I then always validate / encode *all* content, usually using something like the Microsoft AntiXSS library. This stops user-inputted markup from being rendered, but it also stops markup that's been maliciously inserted into your database from being remembered. Remember the SQL injection attack that appended a javascript snippet to every field it could find? It was looking to do an XSS attack.

That's a very interesting idea. Because I use Perl's DBI, I don't normally worry about SQL injection, because I so rarely include a raw variable in a query string (and I'm very careful if I do - for example, I might use a variable that's looping through a list of field names, but the list isn't user-submitted, it's hard-coded into the script).

If you need to chuck out user-generated markup, make sure you contstruct your whitelist and ruleset very carefully.

Yes, I think I have done that. However, this sort of thing is very easy to get wrong, and one little slip can result in disaster. Hopefully I've done everything correctly.

Yes, that was exactly my complaint too.

...from the other side of the pond, Obama is the right choice. Palin's stance on creationism alone should be enough to decide this particular issue.

I'm a Creationist; I also consider myself to be more pro-life than Palin is. Palin's positions on those two issues certainly don't frighten me.

I voted for Obama.

Exactly.

BannerFilter, but I've been neglecting it for years. :-\

Here you go!

Heh, you did that too? ;-)

Here's a HyperCard stack I created to disable FoolProof, which prevented users from dragging icons in the Finder (and probably did a couple of other things, but that was the main feature I remember).

Sometimes I'll use an address like whatever@NOSPAM.phroggy.com but the beauty of that is, I added DNS records to make the domain resolve as-is. ;-)

If you want to block adds get "bannerfilter" http://phroggy.com/bannerfilter/ It is free, easy to setup and use and catches most everything and you can add sites yourself just by editing a file. It works as an addition to "squid". You can install this on one machine on your local network and it can filter adds for the whole network. It is browser independent so the ads get blocked in Opera, Mozila, IE or whatever you use.

Sorry, but you have no idea what you're talking about.

Second method is too expensive to implement by ISPs, ie, check all packets pass thru the ISP for known IP addresses of sites they want to block.

Many ISPs use caching proxy servers such as Squid because it makes things CHEAPER for the ISP. Squid cuts down on bandwidth usage, while improving speed - I even use it on my LAN at home. Some ISPs silently redirect all traffic on port 80 through a proxy server transparently, so customers don't have to set anything up; WPAD is a better alternative.

I wrote a redirect script for Squid called BannerFilter, which blocks advertisements. Several ISPs are using it.

Tomahawk Desktop is probably the first desktop Operating System comes with its own DNS server. Therefore, Tomahawk Desktop, does not use your ISP's DNS server. It does its own DNS resolution. Its too expensive to block the Tomahawk Desktop :)

Just because it happens to be the first one you've encountered, doesn't mean it's the first one. Most Linux distributions ship with BIND, although it's not usually enabled by default because it's not normally a good idea on a desktop system (DNS resolution will be faster if you use your ISP's DNS servers, unless your ISP sucks ass).

Any of those things that were added on later were major hacks to the system. Some, like the non-preemptive MultiFinder (switcher) were ingenious hacks, but hacks nontheless.

One of my favorite hacks, introduced with System 7.1, is the Fonts folder.

Prior to System 7.1, all fonts were resources stored in the System suitcase. Since the System suitcase is always open, its resources are available to all applications, so any application can use any fonts that are in the System suitcase. If you were to use ResEdit to copy a font resource into a text file and open it in SimpleText, the font would be available in SimpleText as long as the document was open, even if the font was not installed in the System.

Prior to System 7, the typical way of managing them was to use the Font/DA Mover application to move font and desk accessory resources between suitcase files; System 7 added support for this in the Finder. A bit of trivia: the only time you'll ever see a "Move" progress bar in the Finder is when moving something into/out of a suitcase, since there's no UI to move a file between volumes (you can only copy, then delete later).

System 7.1 introduced the Fonts folder. All resources in any file placed in the Fonts folder that looks like it should be a font (i.e. a font file or a font suitcase) will be loaded as if they were in the System suitcase, and accessible to all applications. Notice I said all resources, not just all font resources. So, if you were to create an empty font suitcase, and use ResEdit to copy non-font resources (such as icons) to it, then drop the font suitcase in the Fonts folder, all those resources will be loaded as if they were in the System suitcase.

Yeah, I'm a Mac nerd.

uses a protocol that is not only open, but also an Internet RFC, and probably has more implementations than any other protocol; both clients and servers.

Obviously you've never actually read any of the IRC RFCs, have you? They're terrible. The RFCs were clearly written as afterthoughts to try to document the protocol that was already in use, but since each client and each server implements things slightly differently, no RFC (or combination of them) actually completely describes anything accurately.

What's the maximum length of a nickname? RFCs 1459 and 2812 both say nine characters, but most servers allow some other length.

RFC 2812 says the characters {}|~ are equivalent to []\^ for case-insensitive matching, e.g. when comparing nicks. RFC 1459 erroneously omitted the ~ and ^ equivalency. Many servers (e.g. what's used on FreeNode) don't adhere to this specification at all, treating them as different characters (so foo[] and foo{} can be two different users on the same network, which the RFCs forbid).

Which channel modes take arguments, and which don't? Show me where an RFC explains how to correctly parse /MODE #channel +om-vcb nick1 nick2 nick3!name@example.org. What was just done to nick2, and how can you tell?

A solution to all these problems (ISUPPORT) was submitted as a proposed RFC, but never approved by the IETF. It's worth mentioning that ISUPPORT conflicts with the existing RFCs, but that's OK because nobody ever implemented the feature it conflicts with. If the server doesn't support ISUPPORT, you pretty much just have to guess.

Those are just examples I can think of off the top of my head. Yes, by your definition, I'm a proper hacker.

Banner over the free sandwiches provided by Microsoft at OSCon 2003

2) I would like to see what you P233 does when you try to use dynamic webpages (PHP, Perl, MySQL)? Anything below 1GHz will simply die under something like it with a medium amount of users.

That's a load of crap. A P/233 is fine for a web server, even with dynamic pages. Remember that a "medium amount of users" will not all be hitting the server simultaneously. My home page has some pretty damn complex back-end code (over 2700 lines of object-oriented perl) which takes about 0.6 seconds to execute normally (about half of which is just compiling) on a dual PII/300. You could assume it might take two full seconds to execute on a P/233. Those two seconds aren't that significant when you consider the big picture - remember that network latency is a bottleneck for most people. And simpler scripts would be MUCH faster than two seconds. Remember that he's talking about home use; that suggests that a second or two of delay isn't going to hurt anything.

As for a "medium amount of users", I get over 2,000 unique visitors per month, which only counts dynamic page views (not graphics or other static content), doesn't count known robots (they're excluded by user_agent), uses cookies to ensure each visitor is only counted once per browser session regardless of how many pages they view, and also checks IP addresses to avoid over-counting users with cookies disabled. From the perspective of a web server, 2,000 unique visitors a month is practically nothing.

Counting all hits, via "wc -l" on Apache's access_log, I get around 200,000 hits per month, give or take, mostly due to people running BannerFilter's update script from cron jobs. Again, from the web server's perspective, this is also practically nothing.

Don't underestimate the usefulness of an old, slow box.

2) I would like to see what you P233 does when you try to use dynamic webpages (PHP, Perl, MySQL)? Anything below 1GHz will simply die under something like it with a medium amount of users.

That's a load of crap. A P/233 is fine for a web server, even with dynamic pages. Remember that a "medium amount of users" will not all be hitting the server simultaneously. My home page has some pretty damn complex back-end code (over 2700 lines of object-oriented perl) which takes about 0.6 seconds to execute normally (about half of which is just compiling) on a dual PII/300. You could assume it might take two full seconds to execute on a P/233. Those two seconds aren't that significant when you consider the big picture - remember that network latency is a bottleneck for most people. And simpler scripts would be MUCH faster than two seconds. Remember that he's talking about home use; that suggests that a second or two of delay isn't going to hurt anything.

As for a "medium amount of users", I get over 2,000 unique visitors per month, which only counts dynamic page views (not graphics or other static content), doesn't count known robots (they're excluded by user_agent), uses cookies to ensure each visitor is only counted once per browser session regardless of how many pages they view, and also checks IP addresses to avoid over-counting users with cookies disabled. From the perspective of a web server, 2,000 unique visitors a month is practically nothing.

Counting all hits, via "wc -l" on Apache's access_log, I get around 200,000 hits per month, give or take, mostly due to people running BannerFilter's update script from cron jobs. Again, from the web server's perspective, this is also practically nothing.

Don't underestimate the usefulness of an old, slow box.

And: what do you need flash or MNG/APNG for if all you want is a red/green-annoyance? To make really good fakes of Luna GUI elements?

GIF and PNG work fine for me...

Or if you have a proxy, and you want everybody who connects to it to benefit from it you can use bannerfilter. It works with squid. Alot of rules are automaticly created and you can set your own rules as well ofcourse. Works as a filter for banners as well as popups (it replaces the popup with a self-closing javascript page). I'm using it for quite some time now and haven't been able to detect any flaws.

* Your chosen theme is logged, so if you change it from the default and come back tomorrow, I could deduce that you're a returning visitor. Also, whether a particular hit is the first for your current session is also logged, so I can tell whether you quit your browser before returning. Reading the log is obnoxious, though.

Why don't you post your honeypot address here? Mine is honeypot@bl.phroggy.com. I'll add yours to the list of hidden links on my home page, if you'd like.

Isaac Asimov's Foundation series. I highly recommend it. :-)

Crash

Cannons and Castles is my port of an Apple II game. Here's an old screen shot.

Cannons and Castles is my port of an Apple II game. Here's an old screen shot.

I created Cannons and Castles in HyperCard, a sort-of port from an Apple II game. I attempted to make it as unHyperCardlike as possible, which I accomplished with lots of XCMDs and a hell of a lot of coding.

I must agree with the AC: HyperTalk was great. It had a gradual learning curve, it made basic things simple, and reasonably interesting things possible, if occasionally tedius. It prepared me for OOP - in HyperCard objects such as buttons are tangible rather than abstract (you can create them, move them around, set various properties, etc. with a normal GUI interface), and you can call handlers and functions in them from other scripts ("get foo("bar") from btn "Click Me" if I remember correctly). Even lexical scoping was new to me, coming from BASIC. Ah, those were the days.

here

the supposed great harm of spam

My thoughts.

Besides, Apple hasn't improved their font management at all since they added the font folder back in OS 8 (or was it 9?), it was due for an overhaul.

It was 7.1.

Prior to System 7.0, fonts were resources inside the System suitcase which could only be managed via applications like Font/DA Mover, or ResEdit and similar. In 7.0, the System suitcase could be opened in the Finder, which showed the fonts, sounds and keyboard layouts it contained. Each of these could be dragged out of the System suitcase into a font or sound suitcase, or into a folder to create a stand-alone file. Useless trivia: dragging items into or out of a suitcase is the only time you'll see a "Move" progress window in the classic Mac OS Finder.

System 7.1 introduced the Fonts folder, using an interesting hack: all resources in font suitcases or stand-alone font files (new in 7.0) in the Fonts folder were treated as if they were part of the System file itself; these resources were available to all applications. As I recall, the Finder would not allow fonts to be removed from the Fonts folder while applications other than the Finder were running, and new fonts were only available to applications launched after the new fonts were added. Naturally, fonts could no longer be added to the System suitcase.

Only slightly less useless trivia: notice I said ALL resources in font files and font suitcases in the Fonts folder would be used - not just fonts. When I used System 7.1.2 (the first version of the Mac OS to support the PowerPC, mostly via an m68k emulator), I was playing around with ResEdit and discovered how to make color versions of the many black-and-white icons used throughout the system without actually removing or modifying the original icons; I put the color icons into a font suitcase which you can download here if you're feeling so inclined. Simply drop it into the Fonts folder, and you'll have color icons!

Wow. This is all truly worthless. I should be ashamed of myself. Are there any other serious Mac geeks out there who actually remember all of this stuff? Speak up, so that we may all be pitied together.

It occurs to me that when PC users said Macs were toys for computer-illiterate people and couldn't be customized like PCs could, this is the sort of stuff they never imagined, and the reason we smugly laughed at them. Apple's GUI is so nice that people often don't realize there's anything under the hood.

Is this what you're looking for?

Shameless plug: if you run Squid, here's mine.

Thanks for making me aware of that interesting feature.

This page passes W3C validation, and still crashes IE.

I suppose anyone who programmed on their calculator during math class can answer this too.

I wrote a two-player Chess game for my TI-82 (mostly) during math class. After awhile, you kinda get used to the buttons.

Here.

Please mod this down so I don't get slashdotted too badly. :-X

Look at http://phroggy.com/articles/monster.html, then http://www.theonion.com/onion3846/nation_afraid_to _admit.html...

If you want to see something really funny check out Phroggy's website at phroggy.com. Haha, what a loser! No wonder he has to troll for dates among underage chat girls with low self-esteem...

I use Mozilla on all platforms I'm running but combine it with bannerfilter on squid. Mozilla doesn't support regexps yet for picture-blocking but is host-based until they fix bug 78104. Disk cache is switched on though as I'm the only user on my system so I don't see this as a possible security problem.
Cookies are selectively permitted and pop-ups are blocked.
Security is imho the biggest reason to use Mozilla in stead of IE.

Well, Microsoft and Yahoo don't get paid just because some guy using a yahoo e-mail account e-mails someone using a hotmail account.

Uhh, of course they do. You can't check your mail on Yahoo or Hotmail without going to their Web site, which contains advertising banners. The companies are getting paid to run those ads.

(Whether you choose to see them or not is another matter, of course, but most people do, so the companies do get paid.)

Here is the picture that "says it all," since it's being Slashdotted.

My home page allows the user to choose among several different themes, many of which look like windows on a desktop in a variety of operating systems. Your default theme when you first visit the site is chosen based on your browser and operating system. If you use a 4.0 or better browser, it chooses one of the more complex themes based on your OS; if you run Netscape 3 (which doesn't support background graphics in table cells) you get the Plain theme, and if it doesn't recognize your browser, you get the Simple theme which renders nicely in Lynx.

Robots and spiders, such as those who might be trolling for e-mail addresses, aren't recognized and therefore get the Simple theme. At the bottom of the main home page, only shown in the Simple theme, in very fine print, appears a message that is tailored for your particular IP address:

Home page in simple theme

My home page allows the user to choose among several different themes, many of which look like windows on a desktop in a variety of operating systems. Your default theme when you first visit the site is chosen based on your browser and operating system. If you use a 4.0 or better browser, it chooses one of the more complex themes based on your OS; if you run Netscape 3 (which doesn't support background graphics in table cells) you get the Plain theme, and if it doesn't recognize your browser, you get the Simple theme which renders nicely in Lynx.

Robots and spiders, such as those who might be trolling for e-mail addresses, aren't recognized and therefore get the Simple theme. At the bottom of the main home page, only shown in the Simple theme, in very fine print, appears a message that is tailored for your particular IP address:

Home page in simple theme

Now they are responsible for stopping all the pop-under ads, not caused by them. The patent is flat-out stupid, but it might help us out, unless they decide to "license" it.

Now's a good time to get bannerfilter. It runs as a squid redirector, so you wont have to give up your accellerated cache, like you would if you used junkbuster.

If you really want to do this (and hopefully it's not just for slashdot, 99% of sites have worse advertising than they have here), grab squid from Squid, and a redirector script from here. There are instructions in the package for plugging it into squid - they basically involve setting 'redirector' in squid.conf to point to the redirector.pl script in the package.

In the redirector.pl script, set $WWW to the address of a local file or httpd, and $BANNERGIF to 'null.gif', which is a 1x1 pixel image that comes with the bannerfilter package. Point your browser's HTTP/HTTPS proxy to the local address squid is listening on, and you're now ad-free.

The bannerfilter script is customizable through simple text files, and has an sh script that uses wget to automatically update the ad definitions.

No, I didn't write it. I just use it.

Doesn't everyone use Junkbuster? What are these "banner ads" you refer to? =)

For those running Squid, I wrote BannerFilter.

--

--

--

--

--