I share the sentiment. We've been with Rogers for at least ten years (cable and internet), but I got my Teksavvy modem a few days ago and tomorrow my account goes live, and then we're canceling both. (Who needs TV?) Taking the advertised values my bandwidth would almost be cut in half, but my connection with Rogers has been terrible bordering on unusable. I'm not just being bitchy, very often I can't even get web pages to load. I think my account might be flagged for heavy throttling because of high amounts of encrypted traffic, but I don't give a damn, I'm paying for internet access so it better fucking work.
In my experience it's often policy not to allow students access to any other material to read during a test/exam period because it could be used to cheat. You're also not allowed to hand in your exam early and get such material from your bag, possibly because it could be disruptive (I'm just guessing at their reason).
True dat. I just finished my exams last week and they were all printed single-sided, so the backs of each page are fulled with scribblings or brainstorming or anything else to keep me occupied for the large portion of the exam period after I've finished. I wore out my wrist one day drawing a fairly detailed fractal pattern for 20 minutes until my hand died. (I don't write by hand very much.)
If the server didn't check the request ID then you wouldn't just be able to inject it into your own page, but anyone's. If you have someone who has cookies logged into the site (assuming they don't authenticate based on IP as well or something) then if you can have them load a specially-crafted page you could inject Javascript which would gather their cookies and send them to you, potentially allowing you to long in to their account.
Again, it doesn't seem to be exploitable here, but it's still interesting.
Well, this is interesting. Their login page doesn't escape anything when displaying your entered username back to you if it's invalid, so any HTML/Javascript could be injected. Try for yourself, enter this as the username:
The requests are blocked if they don't have a valid request ID, so you don't seem to be able send people to the page and have it load a script that will steal their cookies or whatever, but it's still a little disturbing to see that even this much is possible.
This article is unclear to the extent of bias. I've been trying out the service (you get 50 online song credits when you register) and it actually seems really neat. A DRM-free store is always good and the additional features are nice. You can listen to a song as many times as you want. I can also listen to any song online that I've already got a copy of on my computer (if you true them enough to download and run their app). I don't see what all of the hate is about.
Here's some code to automate it. Horribly hacked-together Python, but it seems to work. it should be able to be easily modified to get more (or more complete) songs, but it's a start so I figured I'd post it.#!/usr/bin/env python
# encoding: utf-8
import urllib
import re
def get(url):
return urllib.urlopen(url).read()
def getMusic(query):
encoded = query.replace(" ", "%20")
feedURL = "http://next.lala.com/api/AutoComplete/songAutoComplete?prefix=%s&webSrc=lala" % encoded
page = get(feedURL)
pattern = re.compile(r"\"playToken\": *\"([^\"]+)\"")
tokens = pattern.findall(page)
print "%i tokens found." % len(tokens)
for token in tokens:
url = "http://next.lala.com/api/Player/getTrackUrls?flash=true&webSrc=lala&widgetId=LalaHeadlessPlayer&T=" + token
fileURL, = re.findall(r"\"url\": *\"([^\"]+)\"", get(url))
print "Downloading %s" % token
output = open("%s.mp3" % token[:6], "w")
output.write(get(fileURL))
output.close()
def getMusic():
getSong("Chemical Brothers")
if __name__ == "__main__": main()
4. Level the ads to have the same average volume as the clips themselves. Every time I play a video on IFILM and am deafened by ads that are twice as loud as the videos they are accompanying, I'm less likely to purchase that product that I've just seen advertised on every video I watch.
I'm not entirely sure, but I'd guess that AAC doesn't work on the Zune, and WMA doesn't work on the iPod, and OGG works on next to nothing. Actually, non-DRMed AAC does work on the Zune, including iTunes Plus purchases. AAC is most well-known for Apple's use of it, but it's not their format. Wikipedia goes into a ton of detail.
The prices are competitive except for memory and HD upgrades, which are vastly overpriced. It's not difficult to do them yourself, but still, it's worth noting.
They never specified that it was a lossless track, though, did they? To most people, 160Kbps is the same as CD quality, and if they got lossless files, they'd be irritated that the files were so large or that (depending on the format) they didn't know how to play them.
Yes, they probably should have specified beforehand, but when the bitrate isn't specified, you shouldn't be expecting lossless.
The fact that we're racing to the moon again is a depressing statement about what we've been doing recently, though I guess any progress is better than none.
Slashdot Mirror
Wow. Wowowwowowo. I did not know that that service existed.
<3
I share the sentiment. We've been with Rogers for at least ten years (cable and internet), but I got my Teksavvy modem a few days ago and tomorrow my account goes live, and then we're canceling both. (Who needs TV?) Taking the advertised values my bandwidth would almost be cut in half, but my connection with Rogers has been terrible bordering on unusable. I'm not just being bitchy, very often I can't even get web pages to load. I think my account might be flagged for heavy throttling because of high amounts of encrypted traffic, but I don't give a damn, I'm paying for internet access so it better fucking work.
I cannot wait until tomorrow.
I love that this was modded insightful.
In my experience it's often policy not to allow students access to any other material to read during a test/exam period because it could be used to cheat. You're also not allowed to hand in your exam early and get such material from your bag, possibly because it could be disruptive (I'm just guessing at their reason).
True dat. I just finished my exams last week and they were all printed single-sided, so the backs of each page are fulled with scribblings or brainstorming or anything else to keep me occupied for the large portion of the exam period after I've finished. I wore out my wrist one day drawing a fairly detailed fractal pattern for 20 minutes until my hand died. (I don't write by hand very much.)
> With your help, 182 have taken action so far.
Surprisingly low, but I guess it hasn't been up that long.
If the server didn't check the request ID then you wouldn't just be able to inject it into your own page, but anyone's. If you have someone who has cookies logged into the site (assuming they don't authenticate based on IP as well or something) then if you can have them load a specially-crafted page you could inject Javascript which would gather their cookies and send them to you, potentially allowing you to long in to their account.
Again, it doesn't seem to be exploitable here, but it's still interesting.
I decided not to investigate further when I realized what I was doing. :V
Well, this is interesting. Their login page doesn't escape anything when displaying your entered username back to you if it's invalid, so any HTML/Javascript could be injected. Try for yourself, enter this as the username:
"><script>alert(document.cookie);</script><input type="hidden" "
The requests are blocked if they don't have a valid request ID, so you don't seem to be able send people to the page and have it load a script that will steal their cookies or whatever, but it's still a little disturbing to see that even this much is possible.
This article is unclear to the extent of bias. I've been trying out the service (you get 50 online song credits when you register) and it actually seems really neat. A DRM-free store is always good and the additional features are nice. You can listen to a song as many times as you want. I can also listen to any song online that I've already got a copy of on my computer (if you true them enough to download and run their app). I don't see what all of the hate is about.
Well damn, I just posted my own worse code, thinking it would be forgiven because it was the first. Now I look stupid. Nice work anyway.
...and someone posted better code well I was working on this shit. Oh well.
I really should preview. >_<
#!/usr/bin/env python
# encoding: utf-8
import urllib
import re
def get(url):
return urllib.urlopen(url).read()
def getMusic(query):
encoded = query.replace(" ", "%20")
feedURL = "http://next.lala.com/api/AutoComplete/songAutoComplete?prefix=%s&webSrc=lala" % encoded
page = get(feedURL)
pattern = re.compile(r"\"playToken\": *\"([^\"]+)\"")
tokens = pattern.findall(page)
print "%i tokens found." % len(tokens)
for token in tokens:
url = "http://next.lala.com/api/Player/getTrackUrls?flash=true&webSrc=lala&widgetId=LalaHeadlessPlayer&T=" + token
fileURL, = re.findall(r"\"url\": *\"([^\"]+)\"", get(url))
print "Downloading %s" % token
output = open("%s.mp3" % token[:6], "w")
output.write(get(fileURL))
output.close()
def main():
getMusic("Chemical Brothers")
if __name__ == "__main__": main()
Here's some code to automate it. Horribly hacked-together Python, but it seems to work. it should be able to be easily modified to get more (or more complete) songs, but it's a start so I figured I'd post it.#!/usr/bin/env python # encoding: utf-8 import urllib import re def get(url): return urllib.urlopen(url).read() def getMusic(query): encoded = query.replace(" ", "%20") feedURL = "http://next.lala.com/api/AutoComplete/songAutoComplete?prefix=%s&webSrc=lala" % encoded page = get(feedURL) pattern = re.compile(r"\"playToken\": *\"([^\"]+)\"") tokens = pattern.findall(page) print "%i tokens found." % len(tokens) for token in tokens: url = "http://next.lala.com/api/Player/getTrackUrls?flash=true&webSrc=lala&widgetId=LalaHeadlessPlayer&T=" + token fileURL, = re.findall(r"\"url\": *\"([^\"]+)\"", get(url)) print "Downloading %s" % token output = open("%s.mp3" % token[:6], "w") output.write(get(fileURL)) output.close() def getMusic(): getSong("Chemical Brothers") if __name__ == "__main__": main()
Add CTRL to the mix to clipboard it instead.
4. Level the ads to have the same average volume as the clips themselves. Every time I play a video on IFILM and am deafened by ads that are twice as loud as the videos they are accompanying, I'm less likely to purchase that product that I've just seen advertised on every video I watch.
They're referring to the amount of time it takes to render the page, not to download it.
The prices are competitive except for memory and HD upgrades, which are vastly overpriced. It's not difficult to do them yourself, but still, it's worth noting.
Is there a link you could give me about that? (Not doubting it, just like to have a source.)
Yes.
They never specified that it was a lossless track, though, did they? To most people, 160Kbps is the same as CD quality, and if they got lossless files, they'd be irritated that the files were so large or that (depending on the format) they didn't know how to play them. Yes, they probably should have specified beforehand, but when the bitrate isn't specified, you shouldn't be expecting lossless.
I don't think they're duping their fans if 99% of them don't know or care about the difference.
The fact that we're racing to the moon again is a depressing statement about what we've been doing recently, though I guess any progress is better than none.
I don't think this story means what you think it does.