article - Dave's Blog

Search
My timeline on Mastodon

Tweet from David Risney

2016 Sep 2, 8:53
Follow up question: If I'm mistakenly put on an email chain, should I hit "reply all" and link this NYT article? https://twitter.com/belong_io/status/771823316302606337 
PermalinkComments

Tweet from David Risney

2016 Jun 6, 10:37
History & design of the biohazard symbol ☣: http://99percentinvisible.org/article/biohazard-symbol-designed-to-be-memorable-but-meaningless/  Creator sends angry letter over sartorial usage
PermalinkComments

Tweet from David_Risney

2016 Feb 17, 3:30
Well done, tense, fake Back to the Future prequel trailer: http://www.avclub.com/article/tense-prequel-fully-explores-back-futures-terroris-232391 …. Doc must trick terrorists into giving him plutonium.
PermalinkComments

Tweet from David_Risney

2015 Nov 10, 3:18
CIA Realizes It's Been Using Black Highlighters All These Years http://www.theonion.com/article/cia-realizes-its-been-using-black-highlighters-all-1848 …
PermalinkComments

Retweet of oneunderscore__

2015 Oct 20, 5:52
Back to the Future II writer Bob Gale: Biff Tannen was based on Donald Trump. No joke. http://www.thedailybeast.com/articles/2015/10/21/how-back-to-the-future-predicted-trump.html … pic.twitter.com/kGvrFxhxxc
PermalinkComments

Tweet from David_Risney

2015 Oct 12, 9:31
Auto generating clickbait articles via neural network: http://larseidnes.com/2015/10/13/auto-generating-clickbait-with-recurrent-neural-networks/ …. And the result: http://clickotron.com/ 
PermalinkComments

Tweet from David_Risney

2015 Sep 25, 12:21
Additional article info suggest the VW emissions cheating is likely intentional and not a bug http://www.bloomberg.com/news/articles/2015-09-25/volkswagen-said-to-manage-faked-test-results-from-german-offices …
PermalinkComments

Tweet from David_Risney

2015 Aug 4, 3:06
Enjoying this inspirational cord cutting Ars article: http://arstechnica.com/staff/2015/08/i-finally-kicked-cable-tv-to-the-curb/ …. Can I use HBO Now subscription with HBO Go app on Xbox One?
PermalinkComments

Retweet of runasand

2015 Jul 22, 8:01
Great article about #HackingTeam's third-party acquisition of zero-day vulnerabilities and exploits by @vlad902: http://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ …
PermalinkComments

Tweet from David_Risney

2015 Apr 2, 10:43
Tesla's April fools headline fooled stock trading algorithms causing $1.50 jump: http://www.bloombergview.com/articles/2015-04-02/tesla-stockholders-can-t-take-a-joke …
PermalinkComments

Retweet of ericlaw

2015 Feb 1, 6:02
http://www.theonion.com/articles/fingerprints-on-lombardi-trophy-to-be-used-in-doze,37899/ …
PermalinkComments

newsycombinator: The Hitchhiker's Guide to the Galaxy Game – 30th Anniversary Edition

2015 Jan 27, 8:31
Hacker News @newsycombinator :
The Hitchhiker's Guide to the Galaxy Game – 30th Anniversary Edition http://www.bbc.co.uk/programmes/articles/1g84m0sXpnNCv84GpN2PLZG/the-hitchhikers-guide-to-the-galaxy-game-30th-anniversary-edition …
PermalinkComments

lunarcicadas: when did monsters that live under your bed start writing clickbait articles

2015 Jan 17, 4:05
Yandere Boyfriend LC @lunarcicadas :
when did monsters that live under your bed start writing clickbait articles pic.twitter.com/Fwsqh8gcBH
PermalinkComments

sharkfucker96: when did monsters that live under your bed start writing clickbait articles

2015 Jan 17, 4:05
Yandere Boyfriend LC @sharkfucker96 :
when did monsters that live under your bed start writing clickbait articles pic.twitter.com/Fwsqh8gcBH
PermalinkComments

On exploiting security issues in botnet C&C...

2014 Jun 23, 4:26


On exploiting security issues in botnet C&C software:

Hackers “are learning that it’s not so easy to write secure code,” Toro says. “Most of us in the business of securing our applications and systems know that bulletproofing software is an extremely expensive and exhaustive undertaking. Malware creators who have to look to their own defences would have to slow down the production of new attacks.”

FYI, if you want to know what it looks like when you hack a hacker, look no further than the seminal 1995 film Hackers.

PermalinkCommentstechnical security

Subtleties of postMessage

2013 Jul 15, 1:00

In IE10 and other new browsers one may create MessageChannel objects that have two MessagePorts each connected (w3c spec calls it entangled) to one another such that postMessage on one port results in the message event firing on the other. You can pass an array of ports as the last parameter to postMessage and they show up in the ports property of the message event arg.

Origin

The postMessage here is like the worker postMessage and unlike the window and iframe postMessage in that it applies no origin checking:

  1. No origin postMessage in workers and MessagePorts: postMessage(messageData, ports)
  2. Origin postMessage in windows and iframes: postMessage(messageData, targetOrigin, ports)

Unfortunately the origin isn't an optional parameter at the end to make the two postMessages have the same signature.

On the event handler side, the event arg always has an origin property. But in the no origin case it is always the empty string.

Source

There is also a source property on the message event arg which if set is an object that has a postMessage property allowing you to post back to your caller. It is set for the origin case, however, in the no origin case this property is null. This is somewhat reasonable because in the case of MessagePort and Workers there are only two endpoints so you always know the source of a message implicitly. Unlike the origin case in which any iframe or window can be calling postMessage on any other iframe or window and the caller is unknown. So not unreasonable but it would be nice if the source property was always set for consistency.

MessageChannel start

When a MessageChannel is created it has two MessagePorts, but until those ports are started they will queue up any messages they receive. Once started they will dispatch all queued messages. Ports don't have to be started to send messages.

A port may be started in two ways, either by explicitly calling the start method on the port, or by setting the onmessage callback property on the port. However, adding an event listener via addEventListener("message", does not start the port. It works this way in IE and Chrome and the spec states this as well.

The justification is that since you can have only one callback via onmessage that once set you must implicitly be ready to receive messages and its fine to start the port. As opposed to the addEventListener in which case the user agent cannot start implicitly because it doesn't know how many event listeners will be added.  I found Hixie stating this justification in geoloc meeting notes.

Links

W3C Spec

Opera introduction

PermalinkCommentsDOM html javascript postMessage technical web-worker worker

The Making of Pulp Fiction: Quentin Tarantino’s and the Cast’s Retelling | Vanity Fair

2013 Feb 28, 3:03

The first independent film to gross more than $200 million, Pulp Fiction was a shot of adrenaline to Hollywood’s heart, reviving John Travolta’s career, making stars of Samuel L. Jackson and Uma Thurman, and turning Bob and Harvey Weinstein into giants. How did Quentin Tarantino, a high-school dropout and former video-store clerk, change the face of modern cinema? Mark Seal takes the director, his producers, and his cast back in time, to 1993.

PermalinkCommentsarticle movie film interview pulp-fiction

Sadly, this is not The Onion

2013 Feb 28, 3:02

Not The Onion subreddit is for real stories that sound like The Onion articles. This is a compilation of those stories into a page that looks like The Onion.

PermalinkCommentshumor news

NOAA FAQ - "Why don't we try to destroy tropical cyclones by nuking them?"

2012 Nov 5, 5:28

This sounds like an Onion article but is actually a real article on NOAA’s website describing why we can’t use nukes to destroy tropical storms. This in the frequently asked questions.

PermalinkCommentshumor storm nuke noaa

DSL modem hack used to infect millions with banking fraud malware | Ars Technica

2012 Oct 1, 6:33

According to the links within this article, although the root URI of the router requires authentication, the /password.cgi URI doesn’t and the resulting returned HTML contains (but does not display) the plaintext of the password, as well as an HTML FORM to modify the password that is exploitable by CSRF.

The attack… infected more than 4.5 million DSL modems… The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites.

PermalinkCommentstechnical security html router web dns csrf
Older Entries Creative Commons License Some rights reserved.