fire page 4 - Dave's Blog

Search
My timeline on Mastodon

RFC 3514 - The Security Flag in the IPv4 Header

2008 Jun 30, 3:57"Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a security flag in the IPv4 header as a means of distinguisPermalinkCommentshumor rfc security ipv4 ip

TippingPoint | DVLabs | Mozilla Firefox 3.0 Vulnerability

2008 Jun 18, 3:57No details in the article other than remote code execution. Browsers are hard.PermalinkCommentsbrowser firefox security

Teach the Controversy - Intelligently designed t-shirts urging you to show both sides of every story

2008 Jun 17, 12:32Some of my favs: UFOs creating pyramids, a periodic table of elements consisting of 'Air', 'Water', 'Fire', etc., and satin in overalls burying fossils. I'm surprised by the lack of FSM.PermalinkCommentshumor via:boingboing satire religion science clothing shopping tshirts evolution intelligent-design

Firefox Mobile Concept Video on Vimeo

2008 Jun 12, 10:45Neat stuff for a Mobile Firefox concept: "A demo of an experimental UI for Mobile Firefox by Aza Raskin, Head of UX for Mozilla Labs. See azarask.in/blog/post/firefox-mobile-concept-video for more information."PermalinkCommentsbrowser interface video firefox mobile ui phone

Dragon Head

2008 Jun 1, 11:39

sequelguy posted a photo:

Dragon Head

This dragon head sculpture actually breathes fire at night. Note the burnt brush around the head.

PermalinkCommentsarizona art franklloydwright taliesinwest scottsdale dragonhead

URI Fragment Info Roundup

2008 Apr 21, 11:53

['Neverending story' by Alexandre Duret-Lutz. A framed photo of books with the droste effect applied. Licensed under creative commons.]Information about URI Fragments, the portion of URIs that follow the '#' at the end and that are used to navigate within a document, is scattered throughout various documents which I usually have to hunt down. Instead I'll link to them all here.

Definitions. Fragments are defined in the URI RFC which states that they're used to identify a secondary resource that is related to the primary resource identified by the URI as a subset of the primary, a view of the primary, or some other resource described by the primary. The interpretation of a fragment is based on the mime type of the primary resource. Tim Berners-Lee notes that determining fragment meaning from mime type is a problem because a single URI may contain a single fragment, however over HTTP a single URI can result in the same logical resource represented in different mime types. So there's one fragment but multiple mime types and so multiple interpretations of the one fragment. The URI RFC says that if an author has a single resource available in multiple mime types then the author must ensure that the various representations of a single resource must all resolve fragments to the same logical secondary resource. Depending on which mime types you're dealing with this is either not easy or not possible.

HTTP. In HTTP when URIs are used, the fragment is not included. The General Syntax section of the HTTP standard says it uses the definitions of 'URI-reference' (which includes the fragment), 'absoluteURI', and 'relativeURI' (which don't include the fragment) from the URI RFC. However, the 'URI-reference' term doesn't actually appear in the BNF for the protocol. Accordingly the headers like 'Request-URI', 'Content-Location', 'Location', and 'Referer' which include URIs are defined with 'absoluteURI' or 'relativeURI' and don't include the fragment. This is in keeping with the original fragment definition which says that the fragment is used as a view of the original resource and consequently only needed for resolution on the client. Additionally, the URI RFC explicitly notes that not including the fragment is a privacy feature such that page authors won't be able to stop clients from viewing whatever fragments the client chooses. This seems like an odd claim given that if the author wanted to selectively restrict access to portions of documents there are other options for them like breaking out the parts of a single resource to which the author wishes to restrict access into separate resources.

HTML. In HTML, the HTML mime type RFC defines HTML's fragment use which consists of fragments referring to elements with a corresponding 'id' attribute or one of a particular set of elements with a corresponding 'name' attribute. The HTML spec discusses fragment use additionally noting that the names and ids must be unique in the document and that they must consist of only US-ASCII characters. The ID and NAME attributes are further restricted in section 6 to only consist of alphanumerics, the hyphen, period, colon, and underscore. This is a subset of the characters allowed in the URI fragment so no encoding is discussed since technically its not needed. However, practically speaking, browsers like FireFox and Internet Explorer allow for names and ids containing characters outside of the defined set including characters that must be percent-encoded to appear in a URI fragment. The interpretation of percent-encoded characters in fragments for HTML documents is not consistent across browsers (or in some cases within the same browser) especially for the percent-encoded percent.

Text. Text/plain recently got a fragment definition that allows fragments to refer to particular lines or characters within a text document. The scheme no longer includes regular expressions, which disappointed me at first, but in retrospect is probably good idea for increasing the adoption of this fragment scheme and for avoiding the potential for ubiquitous DoS via regex. One of the authors also notes this on his blog. I look forward to the day when this scheme is widely implemented.

XML. XML has the XPointer framework to define its fragment structure as noted by the XML mime type definition. XPointer consists of a general scheme that contains subschemes that identify a subset of an XML document. Its too bad such a thing wasn't adopted for URI fragments in general to solve the problem of a single resource with multiple mime type representations. I wrote more about XPointer when I worked on hacking XPointer into IE.

SVG and MPEG. Through the Media Fragments Working Group I found a couple more fragment scheme definitions. SVG's fragment scheme is defined in the SVG documentation and looks similar to XML's. MPEG has one defined but I could only find it as an ISO document "Text of ISO/IEC FCD 21000-17 MPEG-12 FID" and not as an RFC which is a little disturbing.

AJAX. AJAX websites have used fragments as an escape hatch for two issues that I've seen. The first is getting a unique URL for versions of a page that are produced on the client by script. The fragment may be changed by script without forcing the page to reload. This goes outside the rules of the standards by using HTML fragments in a fashion not called out by the HTML spec. but it does seem to be inline with the spirit of the fragment in that it is a subview of the original resource and interpretted client side. The other hack-ier use of the fragment in AJAX is for cross domain communication. The basic idea is that different frames or windows may not communicate in normal fashions if they have different domains but they can view each other's URLs and accordingly can change their own fragments in order to send a message out to those who know where to look. IMO this is not inline with the spirit of the fragment but is rather a cool hack.

PermalinkCommentsxml text ajax technical url boring uri fragment rfc

Feed Folder Deprecated; Use Internet Explorer 8

2008 Mar 7, 7:20

Internet Explorer 8 has made my plugin Feed Folder obselete in functionality and implementation -- which is good!

IE8's Feed Folder feature screen shot.IE7 Feed Folder plugin screen shot.

I made Feed Folder for IE7 because I wanted the Live Bookmarking feature from FireFox. The Feed Folder plugin for IE7 would allow you to display your feeds as virtual folders in your Links Bar. When your feed is updated the virtual folder is updated as well with the new feed items. I use del.icio.us to store all my links so I could add virtual folders of my daily links, my friends blogs links, quick reference links, etc. etc.

My plugin relied on shell folders to implement the virtual folders I described above, but IE8 doesn't support shell folders in the Favorites Bar. But I'm OK with Feed Folder not working in IE8 since there's a much better implementation already there. IE8 does better than my plugin on a number of points: First, there isn't the horrible perf. issue that my plugin had on Vista. Second, when a feed is updated the virtual folder flashes to note the change in status. Third, unread items are bolded and the bolding bubbles up from feeds contained in subfolders. And lastly, the middle click button is supported to open items in a new tab.

Accordingly, I don't plan to work on Feed Folder anymore unless someone comes up with a good reason. Instead I mark Feed Folder deprecated and suggest you use Internet Explorer 8 instead.

To use this feature in IE8 simply drag a feed from your feed list in your Favorites Center onto your Favorites Bar. Or, when viewing a feed, click on the 'Add to Favorites' Star Plus icon thing in the upper left, and select 'Monitor on Favorites Bar'. A .url Internet Shortcut file is produced as usual, but if you open up the .url file you'll see there's some additional info about the feed.

PermalinkCommentsie8 feed feedfolder plugin technical browser ie rss

VRML Plugin and Browser Detector

2008 Feb 27, 3:14This page helps you determine if you have a VRML plugin and lists plugins available.PermalinkComments3d browser firefox ie plugin vrml tool

Download and Install the Cosmo Player VRML Plugin

2008 Feb 27, 3:13Cosmo VRML player plugin for IE and Firefox.PermalinkComments3d plugin visualization vrml firefox cosmo ie browser web

Test results: Bidi in window title and tooltip

2008 Feb 22, 9:50FTA: "This page summarises results for a set of tests aimed at discovering whether bidirectional text is displayed as expected in the window title bar and tooltips." Punchline: generally, no they're not.PermalinkCommentsbidi internationalization w3c browser web ie6 firefox opera

Vegas and New Year

2008 Jan 2, 8:57

Normal Sized Slot MachineTwo and half weeks ago Sarah and I went to Las Vegas where I got to see Jesse, Pat, Chris, and (briefly because he's some kind of big shot too busy for his friends now etc) Grib from college. They're mostly in San Jose and I hadn't seen them for a while so it was a lot of fun to hang out. We all stayed at the MGM which is a nice hotel with some good restaurants. In other Vegas related links, Sarah added Sarah's Las Vegas restaurant reviews to her reviews and Jesse has Jesse's Vegas photos up too.

Vegas DinnerSarah and I saw the Blue Man Group (video from a concert) and the Price is Right Live Show. The Blue Man Group was very cool although the music was all rock with a heavy drum focus (not depicted in the videos I linked) which I got a little tired of. But despite that I really enjoyed the show, very funny and I totally recommend it. The Price is Right Live Show is like the regular show on TV except the recording is not televised and its not hosted by Bob Barker or Drew Carey. So folks from the audience are still called up to play the same games and really win prizes. It was advertised as hosted by Todd Newton, B-list game show host, but was instead hosted by JD Roberto who hosted such things as "Reality Remix" and the show "Are You Hot? The Search for America's Sexiest People". The showcase showdown included the 2008 version of my car and thankfully I wasn't picked to compete for that because, well I don't know where they bought the car, but I would have gotten the price very wrong. We sat right next to the stage for that show and had a good time.

MGM Grand in Las VegasFor New Years Eve Sarah and I stayed in and watched the glitched Seattle Space Needle fireworks show from a safe distance. On New Years we went to a pot-luck at Todd's house and had a fun time. Todd's place is on the top of a hill and has a lovely view of Washington's snow-capped mountains.

PermalinkCommentsnewyear vegas lasvegas personal bluemangroup

Gmail S/MIME for Firefox

2007 Oct 15, 1:33Info on a plugin for FireFox that gives GMail S/MIME support. This is a similar idea to the last but these folks have executed the idea in a different fashion.PermalinkCommentsarticle browser blog cryptography crypto mail mime mozilla pgp privacy security extension firefox gmail google

e-ignite: Webmail With Encryption and Signing

2007 Oct 15, 1:31This is a howto on using encryption with web based mail clients. This article suggests a FireFox plugin. I should look into doing this in IE.PermalinkCommentsemail secure webmail google gmail pgp encryption howto article

Ad Blocking built into IE7

2007 Sep 11, 2:55There's been some news recently on some guy hating on FireFox for its ad-blocking.

On a similar note here's a fun tip for IE7 users I got from Eric. You can get decent ad-blocking in IE7 by putting ad servers in the restricted zone. By default script inclusion is blocked between different zones so you can put domains that serve up ads in your restricted zone after which, normal internet zone sites won't be able to include script from them. This covers most of the ads I run into these days.

I use Fiddler to figure out the domains that are serving up ads which incidentally also has an ad-blocking^H^H^H^H general purpose content blocking plugin. Here's a screenshot of Slashdot and ArsTechnica from my browser. Notice the large blank areas in the screenshots:
PermalinkCommentsad-blocking personal ad ie7 technical browser tip ie

I don't think that you understand! - Firefox3 Vulnerable by Design | GNUCITIZEN

2007 Aug 27, 11:26The article is a bit rambling but he makes an excellent point at least in separating the FireFox description of the feature from what it actually does.PermalinkCommentsfirefox security w3c standard via:swannman article

roachfiend.com - ErrorZilla - Useful error pages for Firefox

2007 Aug 21, 10:22Replace FireFox's error pages with some useful options like check archive.org or coral cache.PermalinkCommentserror mozilla firefox reference extension cache archive whois

Lifehacker Code: About This Site add-on (Firefox) - Lifehacker

2007 Aug 21, 10:19More URI related stuff in a FF plugin.PermalinkCommentslifehacker mozilla reference extension firefox review article

ErrorZilla err ErrorSoft

2007 Aug 21, 4:04Seeing ErrorZilla I realized I could easily do a similar thing to the IE7 404 page using the same technique I used for the XML view and the feed view.

So that's what I did: I made a new 404 page for IE7. There's not much new here technically if you've read the previous blog entries to which I linked. My 404 page change adds links to the Internet Archive, the Coral Cache, and Whois Tool.PermalinkCommentsarchive personal res cache resource ie7 technical browser whois 404 error extension

Bug 389580 - some schemes with %00 launch unexpected handlers on windows

2007 Jul 29, 12:54Mozilla's bug notes on the previously marked FireFox exploit.PermalinkCommentsfirefox bug browser security mozilla windows ie7 microsoft

Billy (BK) Rios - Remote Command Exec (FireFox 2.0.0.5 et al)

2007 Jul 29, 12:51Notes on a recent FireFox security exploit.PermalinkCommentsfirefox hack security browser ie7 windows
Older EntriesNewer Entries Creative Commons License Some rights reserved.