I was puzzled to hear of this vulnerability. I am certain this exact topic has come up before in relation to saving passwords, over a year ago. I thought it was going to be addressed by making the forms non-submittable by JavaScript, and giving the input fields fake blank values when JavaScript read them - of course, only when the form information was automatically entered by the browser.
Did I just imagine all that, or can somebody else confirm this is a long-established problem?
Is there a valid reason to ever have a domain name with stray characters mixed in from different languages?
You're assuming that characters belong exclusively to one language. Try telling a French guy that he can't register café.com because 'c' 'a' and 'f' are English, not French.
I made the mistake of putting of my my pictures in iPhoto (which is a fine program otherwise) and I find I am unable to get out of it. The pictures are categorized nicely in directories but the tags and such are not transferable to any other program as far as I can tell.
If I recall correctly, iPhoto is scriptable with AppleScript and Python. It shouldn't be too difficult (relative term, I know) to extract the information this way.
Re:Sounds logical, but isn't
on
CSS Cookbook
·
· Score: 1
I'm aware of all the factors you site, but I don't think I've ever gotten such code to work in IE and validate.
Can you give an example? I do this on a regular basis without really thinking about it these days.
You never need to use XHTML, it is just much, much, much more convenient if you're taking well formatted XML in and outputting to multiple variants of multiple output formats, like I am.
It depends on your toolset. I'm in a similar situation, and switching between HTML and XHTML is a couple of lines of code. They are both just very similar output formats, after all.
Converting to XHTML and applying CSS is easy and allows the data to be "round tripped" if necessary. Limiting my data to HTML 4 means a lot more complex juggling and the final result has to have information stripped out of it, making it a dead-end in my production system.
I'm not following you. Like I said, XHTML 1.0 and HTML 4.01 are functionally identical - you can have <font> and table layouts screwing up XHTML 1.0 just as you can have clean CSS layouts with HTML 4.01. What stripping out are you talking about?
We all know WHO publishes CSS standards and who is responsible for them.
Actually, I see people mistaking W3Schools for the W3C fairly regularly. Whether it is your intent or not, you help promote this misconception when you link the way that you do.
As for your personal issues with w3cschools, I suggest you take it up with them.
Re:Does any major site use pure CSS?
on
CSS Cookbook
·
· Score: 1
ESPN.com had a high-profile conversion in 2003 that was supposed to reduce its load time and file size signficantly. A peek at the front page today shows that, in fact, the site is contained within divs. On the downside, however, it appears that the front page designers have gotten lazy -- currently the page does not validate against its embedded doctype.
It never did. I distinctly remember when it was first launched, Mike did a couple of interviews saying, in effect, "Aren't standards great!", followed with "We don't actually have to have valid code to be standards-compliant". The whole thing was a PR exercise for the guy to put on his resumé. It was a successful example of separating content from presentation, but that has zero to do with actually complying with standards.
Re:Does any major site use pure CSS?
on
CSS Cookbook
·
· Score: 1
It's easier to use something you know rather than something you don't. A lot of web developers are more comfortable with table layouts than with CSS because they have more experience with them, and the stupider, lazier ones use this as an excuse to not bother with CSS. And, because they continue to eschew CSS, they just get more and more experience with table layouts and the problem gets worse. This is only offset by new developers entering the field, the old ones retiring, and the smart ones switching.
I've been a web developer since the 90s. If I still had to work with table layouts, I'd have switched fields by now. They aren't as easy as their advocates make out; if I had to describe the difference, I'd say that they generate lots of easy work, whereas with CSS you solve a slightly harder problem, but you only have to do it once. Basically, with CSS you work smarter, not harder.
I'd also like to point out an old saying: "A million flies can't be wrong - eat shit!" Just because lots of people do something, that doesn't mean it's a good idea.
Re:Well this sounds promising...
on
CSS Cookbook
·
· Score: 1
The issue with coding is not compliance with CSS standards (those are well published [w3schools.com])
Please don't link to the sleazy W3Schools when referencing the work of the W3C. They have nothing to do with the W3C and are not responsible for the CSS specifications.
Re:Sounds logical, but isn't
on
CSS Cookbook
·
· Score: 3, Informative
I don't think it is technically possible to write a completely compliant page that works in both and uses proper CSS and XHTML. I could be wrong.
You are wrong. There are a few different factors at play here:
Internet Explorer doesn't understand, and thus ignores, many parts of CSS. This doesn't affect compliance because you can usually find another part of CSS that Internet Explorer does understand, to accomplish the same effect. For isntance, Internet Explorer doesn't supprot display: table-cell, which is the easiest method of doing columns in CSS, but you can use floating elements for the same effect.
Internet Explorer misunderstands some parts of CSS. This is less of a problem than it was. You'll get many people complaining about the "broken box model", but this was actually fixed way back in 2001 for those developers that don't trigger "quirks mode". Usually you use hacks - which can come in valid and invalid flavours - to supply alternative code to Internet Explorer. For example, * html #foo { width: 50%; } is perfectly valid CSS, yet is ignored by every standards-compliant user-agent and listened to by Internet Explorer.
XHTML is intended to be served as application/xhtml+xml, which Internet Explorer doesn't understand at all. However, in a compatibility concession, RFC 2854 expressly condones serving it as text/html. Lots of people are confused about this, but the facts are simple if you actually read the specifications. Serving XHTML 1.0 as text/html does not make it invalid, and is completely in line with the specifications. However, all user-agents will actually treat it as HTML and not XHTML. This is by convention, not mandated by the specifications though, and you should not write XHTML expecting it to be interpreted as HTML.
The anonymous coward was completely correct - it's perfectly possible to use valid code with Internet Explorer by simply limiting yourself to the subset of code that works in Internet Explorer and is defined by a W3C specification. This can be extremely frustrating at times, but it's usually better than the alternative.
In addition, you shouldn't really focus on the XHTML bit. There are very few people who actually need XHTML, and despite the buzz, it has nothing to do with standards compliance or CSS. XHTML 1.0 and HTML 4.01 are functionally identical in these respects.
One of the big problems in politics is communicating with and informing the general population. Not only does the Internet itself make it easier than ever to do so, but offshoots like mailing lists, wikis, etc help to organise people and information. We already know these things have the ability to coordinate efforts to build things as complicated as operating systems. Why not apply that experience to other problem domains?
The real problem is that current MPs mostly grew up without the Internet and haven't gotten to grips with it. This is why MySociety's work to get them on board is so important. For instance, it took me thirty seconds to find out that my MP "replied within 2 or 3 weeks to 73% - 96% of messages sent via WriteToThem.com during 2005, according to polling data -- well above average amongst MPs," and I can sign up to get an email every time he speaks in Parliament.
Far from fuelling a crisis in politics, I think the web can be incredibly beneficial. Unfortunately, there is incredible inertia amongst government to adopt new strategies like this.
People who need better performance would change the settings.
If they were clueful enough to a) understand that their settings have been changed, and b) figure out how to change them back.
I suspect a decent amount of people would complain about how slow their computer has got lately, and end up going out and buying a brand new computer, just like they do when they get clogged up with spyware etc. It's certainly possible that manufacturing a whole new computer and chucking the old one away is worse for the environment than leaving the computer at its original setting.
The first script is merely ridiculous: 12 lines of code (not counting empty and comment lines) to do:
HEAD slashdot.org | grep 'Server: '
This code won't catch 404s and other errors. Theirs will. Furthermore, assuming the Ruby library is conformant, their code can deal with multi-line headers, while yours would break.
Things like grep aren't suitable for parsing HTTP responses. You might get results for simple cases, but there are all kinds of corner cases out there that require a proper script. Go ahead and use grep for quick hacks, but you're causing yourself trouble down the line if you expect to use it for anything non-trivial like a spider.
How do you make money from a web site? I mean, the client has all the source, and can do whatever with them, no? (well, copyrights and all, but its still open source, and you sold it to them, so...).
A lot of legitimate users have the Referer header switched off or otherwise unavailable. Apart from the privacy factor, it's also common for "firewalls" [sic] to disable or change them.
Of course, you wouldn't know this, because anybody who finds out is automatically banned from your website, so they don't have a chance to leave a comment or even find your email address letting you know about the problem.
Sadly a lot of aural browsers simply scrape the text out of a page rendered by a normal web browser. As a consequence, it's rare to find one that actually renders CSS as if it were an aural browser and not a screen browser.
AJAX suffers from some severe performance problems.
This is a nonsensical thing to say. It all depends on what you are doing. Ajax can significantly increase performance too. Remember when GMail was first launched? The #1 thing everybody said was that it was fast. Why? Because it used Ajax.
We looked into using several AJAX-based Web forum systems, from several different vendors. After trying them all, those of us who were working on the project were quite disappointed. The performance of the AJAX-based products was absolutely terrible.
Without mentioning what those systems were using Ajax for, there is zero useful information there. It's certainly possible that Ajax decreased performance in these cases, there's plenty of people throwing Ajax at things where it just isn't useful just because it's the buzzword du jour. On the other hand, there's also plenty of people using it as just another tool, and getting decent performance and usability improvements out of it.
In short: "Ajax completely lacks performance" == stupid. "Ajax harms performance when used to do [x], [y] or [z]" == useful information.
Oh, are you volunteering to retrofit everyone's website now?
Of course if you build something that's structurally broken, it's going to cost to go back and fix it. The idea is to not fuck things up in the first place.
In the case of websites, they get redesigned all the time, so all you have to do is wait until the next redesign and say "oh, by the way, can you not fuck it up this time or I'll fire you".
Slashdot's new comments aren't ADA compatible... nothing that uses AJAX is.
Nonsense. The design strategies to provide backwards-compatible and accessible JavaScript have been well known for getting on a decade and are constantly improving. Don't judge JavaScript based on what Frontpage jockeys and cut-n-paste kiddies do with it.
Stupid screenreaders will happily read everything between script tags.
a) Which ones would these be? JAWS doesn't. IBM Homepage Reader doesn't. EMACSpeak doesn't. Opera's aural mode doesn't. Those are the most significant aural user-agents, and JAWS alone accounts for the majority of blind surfers.
b) You shouldn't be putting anything between <script> tags anyway, you get a better cache hit ratio when you factor out the JavaScript into external resources.
Fix the obvious problems with the screenreaders first before you go around suing websites.
A lot of the accessibility problems (e.g. missing alt text) simply cannot be fixed by user-agents, at least not unless you figure out the holy grail of strong AI. On the other hand, these problems can be fixed quickly and easily on the website side of things using existing technology. No, I'm going to have to stick with my original opinion that site owners should fix their sites.
Imagine that the federal government had to pay 30% of any businesses costs associated with the ADA. If a business had to install 15 mini -elevators, it bills 30 percent to the government. If a business had to redesign its website, it bills the government for 30%.
Where are you getting this 30% from? Apart from special cases, designing a run-of-the-mill business website so that it's accessible is easy. The technology is already built into HTML and CSS. The only thing stopping most people from doing it is ignorance. Know what you are doing and there's no difficulty. Accessible websites rarely cost 1% more to design, let alone 30% more.
Okay, there are exceptions, like captioning for videos, but those are exceptional cases and vastly outnumbered by the more typical kind.
No, XHTML labelled as text/html still gets rendered in "standards mode", it's just that "standards mode" isn't very, well, standard. It's just slightly better than "quirks mode", which is basically the same as Internet Explorer 5.5.
Good thing, I'm only pro-Python, not a zealot then. I switched a while back, and got a big productivity boost. mod_python+PostgreSQL+Kid for templating works nicely. Just moving over to Apache 2.2 now, and considering replacing Kid with Genshi. Currently hosting legacy PHP apps on a separate proxied Apache instance, but looking at running them as Python WSGI layers with WPHP.
There's a lot of movement in the Python web development space right now - Turbogears, Django, web.py, Pylons, WSGI... it's unlikely that there's nothing that would appeal to you.
I think this is what people mean when they call the management and design of the PHP language 'amateurish'. Blatant lack of good engineering practice.
Totally agree 100%. Another example: did you ever use nl2br() to convert newlines into <br> elements? It's an extremely common thing to do. In a minor patch release, they changed the function to generate XHTML instead of HTML. In one stroke, everybody who thought they were generating valid HTML had errors in their code. This might not sound that bad, until you realise that nl2br() can appear a lot in large projects, there's no way to get the old behaviour of nl2br() back, and if you have a decent QA process in place, you'd be being notified of the errors across all the websites you maintain. You end up having to go back and change all your code to use generic string replacement functions.
Now, maybe you might say that it's a sensible thing to change (I disagree, there should be different functions for HTML and XHTML), but at the very least, they should have put a change in semantics in a major version update, not sneaked it in between 4.0.4 and 4.0.5.
It's not really the design of the language that's the real problem (although it's not pretty), it's the cavalier attitude from people who don't seem to take a professional attitude to their work that really grates.
Slashdot Mirror
I was puzzled to hear of this vulnerability. I am certain this exact topic has come up before in relation to saving passwords, over a year ago. I thought it was going to be addressed by making the forms non-submittable by JavaScript, and giving the input fields fake blank values when JavaScript read them - of course, only when the form information was automatically entered by the browser.
Did I just imagine all that, or can somebody else confirm this is a long-established problem?
You're assuming that characters belong exclusively to one language. Try telling a French guy that he can't register café.com because 'c' 'a' and 'f' are English, not French.
If I recall correctly, iPhoto is scriptable with AppleScript and Python. It shouldn't be too difficult (relative term, I know) to extract the information this way.
Can you give an example? I do this on a regular basis without really thinking about it these days.
It depends on your toolset. I'm in a similar situation, and switching between HTML and XHTML is a couple of lines of code. They are both just very similar output formats, after all.
I'm not following you. Like I said, XHTML 1.0 and HTML 4.01 are functionally identical - you can have <font> and table layouts screwing up XHTML 1.0 just as you can have clean CSS layouts with HTML 4.01. What stripping out are you talking about?
Actually, I see people mistaking W3Schools for the W3C fairly regularly. Whether it is your intent or not, you help promote this misconception when you link the way that you do.
It's not just me that has a problem with them.
It never did. I distinctly remember when it was first launched, Mike did a couple of interviews saying, in effect, "Aren't standards great!", followed with "We don't actually have to have valid code to be standards-compliant". The whole thing was a PR exercise for the guy to put on his resumé. It was a successful example of separating content from presentation, but that has zero to do with actually complying with standards.
It's easier to use something you know rather than something you don't. A lot of web developers are more comfortable with table layouts than with CSS because they have more experience with them, and the stupider, lazier ones use this as an excuse to not bother with CSS. And, because they continue to eschew CSS, they just get more and more experience with table layouts and the problem gets worse. This is only offset by new developers entering the field, the old ones retiring, and the smart ones switching.
I've been a web developer since the 90s. If I still had to work with table layouts, I'd have switched fields by now. They aren't as easy as their advocates make out; if I had to describe the difference, I'd say that they generate lots of easy work, whereas with CSS you solve a slightly harder problem, but you only have to do it once. Basically, with CSS you work smarter, not harder.
I'd also like to point out an old saying: "A million flies can't be wrong - eat shit!" Just because lots of people do something, that doesn't mean it's a good idea.
Please don't link to the sleazy W3Schools when referencing the work of the W3C. They have nothing to do with the W3C and are not responsible for the CSS specifications.
You are wrong. There are a few different factors at play here:
The anonymous coward was completely correct - it's perfectly possible to use valid code with Internet Explorer by simply limiting yourself to the subset of code that works in Internet Explorer and is defined by a W3C specification. This can be extremely frustrating at times, but it's usually better than the alternative.
In addition, you shouldn't really focus on the XHTML bit. There are very few people who actually need XHTML, and despite the buzz, it has nothing to do with standards compliance or CSS. XHTML 1.0 and HTML 4.01 are functionally identical in these respects.
One of the big problems in politics is communicating with and informing the general population. Not only does the Internet itself make it easier than ever to do so, but offshoots like mailing lists, wikis, etc help to organise people and information. We already know these things have the ability to coordinate efforts to build things as complicated as operating systems. Why not apply that experience to other problem domains?
We've already seen the beginnings of this. TheyWorkForYou.com publishes and indexes what MPs say in the Houses of Parliament, and notifies people when something they are interested in is discussed - with all the source code for the website available and a web service too. A few days ago, the same team launched an open-source online petition system backed by the UK government (sign the "fair use" petition). The same team also have a number of other projects in the same vein, such as mailing lists for MPs. Some MPs now have weblogs. Across the pond similar work is being done in the USA.
The real problem is that current MPs mostly grew up without the Internet and haven't gotten to grips with it. This is why MySociety's work to get them on board is so important. For instance, it took me thirty seconds to find out that my MP "replied within 2 or 3 weeks to 73% - 96% of messages sent via WriteToThem.com during 2005, according to polling data -- well above average amongst MPs," and I can sign up to get an email every time he speaks in Parliament.
Far from fuelling a crisis in politics, I think the web can be incredibly beneficial. Unfortunately, there is incredible inertia amongst government to adopt new strategies like this.
If they were clueful enough to a) understand that their settings have been changed, and b) figure out how to change them back.
I suspect a decent amount of people would complain about how slow their computer has got lately, and end up going out and buying a brand new computer, just like they do when they get clogged up with spyware etc. It's certainly possible that manufacturing a whole new computer and chucking the old one away is worse for the environment than leaving the computer at its original setting.
This code won't catch 404s and other errors. Theirs will. Furthermore, assuming the Ruby library is conformant, their code can deal with multi-line headers, while yours would break.
Things like grep aren't suitable for parsing HTTP responses. You might get results for simple cases, but there are all kinds of corner cases out there that require a proper script. Go ahead and use grep for quick hacks, but you're causing yourself trouble down the line if you expect to use it for anything non-trivial like a spider.
No, it's not still open-source. Open source doesn't just mean access to the source code..
A lot of legitimate users have the Referer header switched off or otherwise unavailable. Apart from the privacy factor, it's also common for "firewalls" [sic] to disable or change them.
Of course, you wouldn't know this, because anybody who finds out is automatically banned from your website, so they don't have a chance to leave a comment or even find your email address letting you know about the problem.
Sadly a lot of aural browsers simply scrape the text out of a page rendered by a normal web browser. As a consequence, it's rare to find one that actually renders CSS as if it were an aural browser and not a screen browser.
This is a nonsensical thing to say. It all depends on what you are doing. Ajax can significantly increase performance too. Remember when GMail was first launched? The #1 thing everybody said was that it was fast. Why? Because it used Ajax.
Without mentioning what those systems were using Ajax for, there is zero useful information there. It's certainly possible that Ajax decreased performance in these cases, there's plenty of people throwing Ajax at things where it just isn't useful just because it's the buzzword du jour. On the other hand, there's also plenty of people using it as just another tool, and getting decent performance and usability improvements out of it.
In short: "Ajax completely lacks performance" == stupid. "Ajax harms performance when used to do [x], [y] or [z]" == useful information.
Of course if you build something that's structurally broken, it's going to cost to go back and fix it. The idea is to not fuck things up in the first place.
In the case of websites, they get redesigned all the time, so all you have to do is wait until the next redesign and say "oh, by the way, can you not fuck it up this time or I'll fire you".
Nonsense. The design strategies to provide backwards-compatible and accessible JavaScript have been well known for getting on a decade and are constantly improving. Don't judge JavaScript based on what Frontpage jockeys and cut-n-paste kiddies do with it.
a) Which ones would these be? JAWS doesn't. IBM Homepage Reader doesn't. EMACSpeak doesn't. Opera's aural mode doesn't. Those are the most significant aural user-agents, and JAWS alone accounts for the majority of blind surfers.
b) You shouldn't be putting anything between <script> tags anyway, you get a better cache hit ratio when you factor out the JavaScript into external resources.
A lot of the accessibility problems (e.g. missing alt text) simply cannot be fixed by user-agents, at least not unless you figure out the holy grail of strong AI. On the other hand, these problems can be fixed quickly and easily on the website side of things using existing technology. No, I'm going to have to stick with my original opinion that site owners should fix their sites.
Where are you getting this 30% from? Apart from special cases, designing a run-of-the-mill business website so that it's accessible is easy. The technology is already built into HTML and CSS. The only thing stopping most people from doing it is ignorance. Know what you are doing and there's no difficulty. Accessible websites rarely cost 1% more to design, let alone 30% more.
Okay, there are exceptions, like captioning for videos, but those are exceptional cases and vastly outnumbered by the more typical kind.
No, XHTML labelled as text/html still gets rendered in "standards mode", it's just that "standards mode" isn't very, well, standard. It's just slightly better than "quirks mode", which is basically the same as Internet Explorer 5.5.
Good thing, I'm only pro-Python, not a zealot then. I switched a while back, and got a big productivity boost. mod_python+PostgreSQL+Kid for templating works nicely. Just moving over to Apache 2.2 now, and considering replacing Kid with Genshi. Currently hosting legacy PHP apps on a separate proxied Apache instance, but looking at running them as Python WSGI layers with WPHP.
There's a lot of movement in the Python web development space right now - Turbogears, Django, web.py, Pylons, WSGI... it's unlikely that there's nothing that would appeal to you.
Totally agree 100%. Another example: did you ever use nl2br() to convert newlines into <br> elements? It's an extremely common thing to do. In a minor patch release, they changed the function to generate XHTML instead of HTML. In one stroke, everybody who thought they were generating valid HTML had errors in their code. This might not sound that bad, until you realise that nl2br() can appear a lot in large projects, there's no way to get the old behaviour of nl2br() back, and if you have a decent QA process in place, you'd be being notified of the errors across all the websites you maintain. You end up having to go back and change all your code to use generic string replacement functions.
Now, maybe you might say that it's a sensible thing to change (I disagree, there should be different functions for HTML and XHTML), but at the very least, they should have put a change in semantics in a major version update, not sneaked it in between 4.0.4 and 4.0.5.
It's not really the design of the language that's the real problem (although it's not pretty), it's the cavalier attitude from people who don't seem to take a professional attitude to their work that really grates.
It can be more useful than a brick when the network connection is down? No? Then it can't do everything an OS can do.
Perhaps if you read the article, you would see the links to this information.
Er, try reading both articles I linked to. The USA has two different rankings - one within USA borders and one for extra-territorial activities.
Have you seen the news today? Journalists fall victim to ethnic and sectarian violence, US troops carry out more unlawful arrests. Oh, and you've dropped even further down the Press Freedom Index. Far from "higher standards than the rest of the world"; there are over fifty countries with freer speech than the USA.