NiX0n's Rants and Streams of Conciousness

Google Bot Got PWND!

2009-03-04T16:16:00.007Z

Every once in a while, I write a test web page for the sole purpose of crashing a browser. Almost all of them implement some sort of infinite recursion. Many of them use JavaScript to force the recursion, but about a year ago I wrote one using frames (don't worry, it's just the source code).

As you can see, it's quite a doosy right off the first step. Under the intended conditions, this page would force a browser to re-request the page an exponentially increasing number of times (4ⁿ exactly). Unlike previous variants of my browser crashing pages, this one successfully crashed every browser I tested it in (i.e. IE6/7, Firefox, Opera, Chrome), some harder than others.

It tricks any agent into thinking it's a new page it's requesting because every URL has a unique token appended to the URI's query string. So, this not only forces the browser to re-request the page, but also prevents the browser from using an existing copy of the page in the its cache. One way or another, the browser's memory will fill up and crash.

Up until now, I've all but forgotten the glorious Frames Galore! script. That is, until I was browsing my Apache web server access logs for the website and discovered something very interesting (and humorous).

Line-after-line-after-line of these:

66.249.73.85 - - [03/Mar/2009:15:35:28 -0500] "GET /test/frames.php?24a0d270ecf9e10b89780563935a4523 HTTP/1.1" 200 571 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

It seems that one of Google's children has been trapped in this script for over a month now without any signs of escape. Initially, I [arrogantly] pondered to myself, "I wonder if this will crash the bot;" by way of logic that the bot's behavior is similar to traditional browsers. But, if it's gone on for over a month now, there's probably no such thing as crash for this bot (at least not this easily). It will probably crash my web server before it does considering the raw horsepower (i.e. FLOPS, RAM, bandwidth) available to it.

Even if I can't crash the bot, it's still a funny notion that the machine doesn't know when to stop. It's like a little kid playing monkey in the middle, but doesn't realize that the big kids aren't going to let him have the ball any time soon.

Be Weary of Event.observe()

2008-02-25T19:47:00.004Z

In a day when I thought I was safe from all the cross-browser incompatibilities, I've been bitten in the ass once again. If you're a bit confused as to why I would think such things, you obviously haven't used a Javascript framework like Prototype. Up to this point, the only cross-browser issues I've concerned myself with, are CSS ones--and boy, there still are many, even with IE7 around). So what's my latest beef with Microsoft's craptacular Internet browser? Before I can answer that, I have to take a brief moment to explain Event.observe().

Event.observe() abstracts element.addEventListener() and element.attachEvent() which basically allows a 1-to-many relationship between an element's event and its listeners. It's a great idea, and comes in handy for me personally for many projects I work on.

In and of itself, Event.observe() is pretty easy and works without problem; however, one would assume that when push comes to shove and the event gets triggered, the listeners would be called in the order they were registered in. Well, those making that assumption would be mostly correct. This is where the browser from Bizarro World, Internet "Motherf**king" Explorer, comes in. IE appears to do the exact opposite.

To better explain, I'll use some code for example. We'll use three files: index.html (I've omitted the doctype for brevity), first.js, and second.js.

index.html

<html>
<head>
<title>Mai File</title>
<script type="text/javascript" src="first.js"></script>
<script type="text/javascript" src="second.js"></script>
</head>

<body>
</body>
</html>

Note: first.js came before second.js.

first.js


var a = "first";
Event.observe(window, 'load', function(event)
{
 alert("first:" + a);
});

And second.js is almost identical.

second.js


var a = "second";
Event.observe(window, 'load', function(event)
{
 alert("second:" + a);
});

When we open up our favorite browser (if it's Internet Explorer, you should be castrated), and visit our page, two alerts will pop up: "first:second", and "second:second". Left of the colon tells us what script is calling the alert() (in a matter of speaking). On the right of the colon, it tells us which script set the variable 'a' last. So according to our results, the variable 'a' was set to "second" last, which second.js was parsed second like we expected. And the alerts came in the order we also expected them.

Now we try this very same page in IE, and what do we get? "second:second", and "first:second". The exact opposite. The files were parsed in the correct order, but the event listeners were called in the opposite order.

Why this is? I have no idea. What this means though is, you can't write event listeners that depend on other event listeners of the same event. This can be quite annoying for those of us who use the window.onload event for bootstrapping and have a desired "order of operations."

Why Blink 182 Sucks

2007-12-31T16:58:00.000Z

[an excerpt from a Facebook Group Thread]

Blink 182 fans are inherently hypocrites. If there's any oxymoron here, it's "Pop-Punk." Punk is rooted in anti-establishment and anti-corporate movements. Blink's very essence contradicts this very message. You can't be a punk, and milk the very corporations you claim to detest.

At no point in Blink 182's career, did I ever get the impression that they were ever truly punk at heart. They always appeared to be MTV-cookie-cutout synthetic-punksters. In lesser terms, they were tools. Tools, who's only purpose was to make money for the corporations they represent.

Their music was mediocre at best. With the exception of a few tunes (I admit, "Adam's Song" wasn't all that bad), it was all very monotonous. Every song sounded exactly the same. So, any originality (if any) they had quickly faded. Unfortunately for many, these rhythmic and melodic boundaries are intentional, as they maximize a bands popularity (a concept well-known by the music industry). For those with limited musical taste, consistent and repetitive sounds have the musical attraction of a moth's irresistance to fly into a bug zapper. This is the exact science behind Pop music. It works. It makes money.

For those of you Blink 182 fans who are incapable of arguing with me in a civilized manner, don't bother replying to me. Calling us anti-Blink people "Emo Fags" is not acceptable. It does not fare well in your argument, nor is it at all relevant. If you're going to argue, do it right. Argue my my above points, or not at all. I'm neither a fag, or an emo. Not that it matters, but emo's aren't real punks either. They lack a certain necessary backbone.

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

2007-05-03T14:47:00.001Z

That is all.

Wet Birthday Suits

2007-02-03T05:22:00.000Z

As Martha Stewart says, "It's a good thing," as she bends over to dominate your nether region with her fist. helpless little bunnies are gathering support for their matrix theology group that meets at the local meat packing plant. Nobody ever asks about the Purple Eskimo in the corner. They kind of just let the Saudi Arabians wrestle the antelope with chicken-wire until their pants fall off from laughing at their inebriated grandmothers.

Edible crotchless pantie liners, and homeless people battling each other with broken Wii-mote straps until their brains bleed from an overdose of chicken pot pie. No, Popeye didn't enter the Olympics this trimester. He didn't have enough toilet paper to raid Game-stop's sale on dead rats and Pokemon feces.

The president is drafting up new constitution that would allow multi-gendered kindergarten basketball coaches to sell crack to underage prostitutes while singing the Canadian national anthem backwards with his or her clothes from a Jamaican sweatshop conveniently located on the border of Berlin and Moscow. Apples and Tangerines may taste good out of the sundial but the german kite makers aren't going to be very happy when they find out there highest ranking yuppie franchise isn't going to make it past it's first fiscal quarter.

If it were up to me, I wouldn't even want to dance with those hippies. They smell of whiskey and fresh-squeezed baby oil. I can't even radio it into the authorities because they don't believe in a economic system entirely dependent on Neil Patrick Harris blow-up dolls.

Escape Utility

2007-01-24T16:28:00.000Z

Sometimes you'll find yourself needing an escaped string. Just so you don't have to write one yourself, here's a simple PHP page to help you escape and unescape large strings.

This can also come in handy if you need to get convert large documents into xml/html friendly versions. If you take a gander of the source of a page (from a browser) after you've converted. You will find between the <textarea> tags, html friendly text. Enjoy ;)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>NiX0n's Escape Utility</title>
<style type="text/css">
<!--
table { width: 100%; }
th, td { width: 50%; }
textarea
{
 display: block;
 height: 500px; 
 width: 100%;
 overflow: scroll;
}
-->
</style>
</head>

<body>
<form action="escape.php" method="post">
<table>
 <tr>
  <th>Unescaped</th><th>Escaped</th>
 </tr>
 <tr>
  <td>
   <textarea name="unescaped"><?php
    switch(isset($_POST['escape'])?$_POST['escape']:false)
    {
    case "escape":
     echo htmlspecialchars($_POST['unescaped']);
     break;
    case "unescape":
     echo htmlspecialchars(stripslashes($_POST['escaped']));
    case false:
    default:
     break;    
    }
   ?></textarea>
   <input name="escape" value="escape" type="submit" style="float:right;" />
  </td>
  <td>
   <textarea name="escaped"><?php 
    switch(isset($_POST['escape'])?$_POST['escape']:false)
    {
    case "escape":
     echo htmlspecialchars(addslashes($_POST['unescaped']));
     break;
    case "unescape":
     echo htmlspecialchars($_POST['escaped']);
    case false:
    default:
     break;    
    }
   ?></textarea>
   <input name="escape" value="unescape" type="submit" style="float:left;" />
  </td>
 </tr>
</table>
</form>
</body>
</html>

[adult swim] Fix: Now Requires ActiveX

2006-11-11T02:53:00.000Z

[adult swim],
Shame on you. I thought you were one of us, "The Fix" requires ActiveX now!

What about the Linux users? What about the Mac users? What about the reluctant Windows user who refuses to install ActiveX, the one thing about Internet Explorer that makes it a heaping pile of crap, on his or her Open-Source, Standards compliant, browser. Don't sell out to Microsoft! Just because Google is kicking their ass, doesn't mean they're not threatening.

Fedora Core 6 Leak

2006-10-24T13:45:00.000Z

I constructed the URL on this mirror. you could probably do the same for other isos
ftp://ftp.kaist.ac.kr/pub/fedora/linux/core/6/x86_64/iso/FC-6-x86_64-DVD.iso
ftp://ftp.kaist.ac.kr/pub/fedora/linux/core/6/i386/iso/FC-6-i386-DVD.iso

This is the title of a post about nothing

2006-10-06T19:56:00.000Z

Evil robot puppies mixing martinis for hampsters on their wedding days. If it were up to me, I wouldn't even sell elf blood to the Japanese. Have you seen what they've done to black history month? Jessie Jackson is probably spinning in his grave. At least I gave my slaves names, unlike some corporations *gives Enron the stink eye*. Violence is a sign of radioactive manure. At least that's what Scientology has taught me. Sir Isaac Newton was practicing witchcraft when he invented gravity in the 1400's. That was the only reason Christopher Columbus could sail around the world in an empty shaving cream box. I've wasted a lot of time during the year and a half voyage to the center of the moon, but it was all worth it when the topless kangaroo gave me a rodeo clown for my afternoon tea-party.

I believe I've lost my train of thought. I'm pretty sure it derailed a mile back, but the horse theologically molesting kittens is more than welcome to sell heroin to Mexican software developers while they sleep. while (true); I've got to get outside while the weather is still blistering the souls out of my shoes. I'm sorry for the pun, but the mad scientist in my rubicks cube just ate my baby's toy crack pipe.

If there was ever a time when I should stop writing slanderous accusations about how Microsoft uses prostitutes to compile their inbred shock absorbing poop-scoop of an operating system, it was long after Google crushed them with an iron sock made of keyboard jockeys and Japanese businessmen.

w00t4Ri22l3!

Just Another Meaningless Taco Assasination

2006-09-26T12:49:00.002Z

While assaulting fruit of many faces at Meijer, 24 hours a day, flandering penguins of many colors bouncing off the walls in splotches, smashed their noses in chocolate mouse laced with ribbon on turntables forged their own signatures on waffles with spam. Visited by Eclipse gum foils sun setting at a known uninhabited crack light string wander, speaking gumbo soup.

~The "J" Man

Internet Explorer Flash Object Hack

2006-08-09T15:28:00.001Z

In April, Microsoft had the brainy idea to deactivate "Active" content. Instead of fixing ActiveX controls, they decided to simultaneously annoy both the users and the developers. If you don't know what annoyance I'm talking about, either you've done the right thing and used another browser, or you simply haven't visited a website with flash content. In order the user use Active content, he/she must "Click to activate..."

What a pain.

Unfortunately, yet another IE hack had to be conceived, once again sacrificing the elegance of HTML. Luckily Microsoft suggested a fix. This fix required an external script to write the <OBJECT>/<EMBED> HTML. It works, but the suggested code was still a little less object oriented as I would have liked. If we're going do this with scripts, we mind as well make it modular.

So here it is, we have 3 (4 if you count the swf) files: FlashObject.js, implementation.js, mypage.html

First off, the Class definition:

// FlashObject.js

function FlashObject(URL)
{ // This is the contructor (Default Values)
    this._URL = URL;
    this._Width = 800;
    this._Height = 600;
    this._Bgcolor = "#ffffff";
    this._Align = "middle";
    this._Quality = "high";
    this._Classid = "d27cdb6e-ae6d-11cf-96b8-444553540000";
    this._ScriptAccess = "sameDomain";
}

FlashObject.prototype.changeURL          = function (URL)         {this._URL     = URL;}
FlashObject.prototype.changeAlign        = function (Align)       {this._Align   = Align;}
FlashObject.prototype.changeWidth        = function (Width)       {this._Width   = parseInt(Width);}
FlashObject.prototype.changeHeight       = function (Height)      {this._Height  = parseInt(Height);}
FlashObject.prototype.changeBgcolor      = function (Bgcolor)     {this._Bgcolor = Bgcolor;}
FlashObject.prototype.changeClassid      = function (Classid)     {this._Classid = Classid;}
FlashObject.prototype.changeQuality      = function (Quality)     {this._Quality = Quality;}
FlashObject.prototype.changeScriptAccess = function (ScriptAccess){this._ScriptAccess = ScriptAccess;}

FlashObject.prototype.show = function ()
{
    document.writeln('<object classid="clsid:'+this._Classid+'" '+
        'codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" '+
        'width="'+ this._Width +'" height="'+ this._Height +'" align="'+this._Align+'">');
    document.writeln('<param name="allowScriptAccess" value="'+this._ScriptAccess+'" />');
    document.writeln('<param name="movie" value="'+this._URL+'" />');
    document.writeln('<param name="quality" value="'+this._Quality+'" />');
    document.writeln('<param name="bgcolor" value="'+this._Bgcolor+'" />');
    document.writeln('<embed src="'+this._URL+'" quality="'+this._Quality+'" bgcolor="'+this._Bgcolor+'" ' +
        'width="'+ this._Width +'" height="'+ this._Height +'" align="'+this._Align+'" '+
        'allowScriptAccess="'+this._ScriptAccess+'" type="application/x-shockwave-flash" '+
        'pluginspage="http://www.macromedia.com/go/getflashplayer" />');
    document.writeln('</object>');
}

Next comes the implementation (implementation.js)(new FlashObject("swf/flash.swf")).show();If you want to change the defaults, it's as easy as

var hack = new FlashObject("swf/flash.swf");
hack.changeHeight(1000);
hack.show();

I'm sure, if you had to make this more dynamic, you could do it in a php file. (be sure to use header("Content-Type: text/javascript");)

Last but not least, the html will look like this.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>mypage</title>
<script src="js/FlashObject.js"></script>
</head>
<body bgcolor="#ffffff">
<!--url's used in the movie-->
<!--text used in the movie-->
<script src="js/implementation.js"></script>
</body>
</html>

Sources:
ActionScript.com
robertnyman.com

The REAL Facts behind Microsoft

2006-07-18T20:20:00.000Z

Internet Explorer causes cancer
Terrorists use Internet Explorer to build weapons of mass destruction
Microsoft has Lobbyists in D.C. to abolish the Emancipation proclamation
Microsoft uses child slavery to build it's 360's
Bill Gates is a pedophile
Steve Ballmer eats babies, and beats his wife
ActiveX (used by Internet Explorer) is a highly contagious Sexually Transmitted Disease
Internet Explorer killed my father and raped my mother
Microsoft sells credit card information acquired through Internet Explorer to Abortion Clinics and Assisted Suicide Centers
The Halo Saga uses subliminal queues to convince players to start fires in their sleep

Support Honest Business Practice, Use FireFox
www.mozilla.com