hack page 6 - Dave's Blog

Search
My timeline on Mastodon

Homemade GPS jammers raise concerns

2008 Apr 22, 4:33Reaction to Phrack's howto on GPS jammer. Sounds like the article wants to make it into a bigger issue than it is: "Information in the article that appears in the current issue of the online hacker magazine Phrack potentially puts at risk GPS devices usePermalinkCommentsgps gps-jamming phrack government

URI Fragment Info Roundup

2008 Apr 21, 11:53

['Neverending story' by Alexandre Duret-Lutz. A framed photo of books with the droste effect applied. Licensed under creative commons.]Information about URI Fragments, the portion of URIs that follow the '#' at the end and that are used to navigate within a document, is scattered throughout various documents which I usually have to hunt down. Instead I'll link to them all here.

Definitions. Fragments are defined in the URI RFC which states that they're used to identify a secondary resource that is related to the primary resource identified by the URI as a subset of the primary, a view of the primary, or some other resource described by the primary. The interpretation of a fragment is based on the mime type of the primary resource. Tim Berners-Lee notes that determining fragment meaning from mime type is a problem because a single URI may contain a single fragment, however over HTTP a single URI can result in the same logical resource represented in different mime types. So there's one fragment but multiple mime types and so multiple interpretations of the one fragment. The URI RFC says that if an author has a single resource available in multiple mime types then the author must ensure that the various representations of a single resource must all resolve fragments to the same logical secondary resource. Depending on which mime types you're dealing with this is either not easy or not possible.

HTTP. In HTTP when URIs are used, the fragment is not included. The General Syntax section of the HTTP standard says it uses the definitions of 'URI-reference' (which includes the fragment), 'absoluteURI', and 'relativeURI' (which don't include the fragment) from the URI RFC. However, the 'URI-reference' term doesn't actually appear in the BNF for the protocol. Accordingly the headers like 'Request-URI', 'Content-Location', 'Location', and 'Referer' which include URIs are defined with 'absoluteURI' or 'relativeURI' and don't include the fragment. This is in keeping with the original fragment definition which says that the fragment is used as a view of the original resource and consequently only needed for resolution on the client. Additionally, the URI RFC explicitly notes that not including the fragment is a privacy feature such that page authors won't be able to stop clients from viewing whatever fragments the client chooses. This seems like an odd claim given that if the author wanted to selectively restrict access to portions of documents there are other options for them like breaking out the parts of a single resource to which the author wishes to restrict access into separate resources.

HTML. In HTML, the HTML mime type RFC defines HTML's fragment use which consists of fragments referring to elements with a corresponding 'id' attribute or one of a particular set of elements with a corresponding 'name' attribute. The HTML spec discusses fragment use additionally noting that the names and ids must be unique in the document and that they must consist of only US-ASCII characters. The ID and NAME attributes are further restricted in section 6 to only consist of alphanumerics, the hyphen, period, colon, and underscore. This is a subset of the characters allowed in the URI fragment so no encoding is discussed since technically its not needed. However, practically speaking, browsers like FireFox and Internet Explorer allow for names and ids containing characters outside of the defined set including characters that must be percent-encoded to appear in a URI fragment. The interpretation of percent-encoded characters in fragments for HTML documents is not consistent across browsers (or in some cases within the same browser) especially for the percent-encoded percent.

Text. Text/plain recently got a fragment definition that allows fragments to refer to particular lines or characters within a text document. The scheme no longer includes regular expressions, which disappointed me at first, but in retrospect is probably good idea for increasing the adoption of this fragment scheme and for avoiding the potential for ubiquitous DoS via regex. One of the authors also notes this on his blog. I look forward to the day when this scheme is widely implemented.

XML. XML has the XPointer framework to define its fragment structure as noted by the XML mime type definition. XPointer consists of a general scheme that contains subschemes that identify a subset of an XML document. Its too bad such a thing wasn't adopted for URI fragments in general to solve the problem of a single resource with multiple mime type representations. I wrote more about XPointer when I worked on hacking XPointer into IE.

SVG and MPEG. Through the Media Fragments Working Group I found a couple more fragment scheme definitions. SVG's fragment scheme is defined in the SVG documentation and looks similar to XML's. MPEG has one defined but I could only find it as an ISO document "Text of ISO/IEC FCD 21000-17 MPEG-12 FID" and not as an RFC which is a little disturbing.

AJAX. AJAX websites have used fragments as an escape hatch for two issues that I've seen. The first is getting a unique URL for versions of a page that are produced on the client by script. The fragment may be changed by script without forcing the page to reload. This goes outside the rules of the standards by using HTML fragments in a fashion not called out by the HTML spec. but it does seem to be inline with the spirit of the fragment in that it is a subview of the original resource and interpretted client side. The other hack-ier use of the fragment in AJAX is for cross domain communication. The basic idea is that different frames or windows may not communicate in normal fashions if they have different domains but they can view each other's URLs and accordingly can change their own fragments in order to send a message out to those who know where to look. IMO this is not inline with the spirit of the fragment but is rather a cool hack.

PermalinkCommentsxml text ajax technical url boring uri fragment rfc

Miscellany: INSERT COIN

2008 Apr 1, 1:16Change HP printer status LED to read 'Insert Coin': "This little perl program allows you to set the "Ready Message" on HP printers to whatever you'd like."PermalinkCommentshumor prank printer hack hardware howto

Robert Hensing's Blog : Click-through cloaking (coming to a hacked site near you).

2008 Mar 31, 1:08"Why would the bad guys do this? To buy time. ...say you arrived at that site via a search engine and you were clueful and you got owned. You're going to give the URL that tried to exploit you to your local IT security geek and he's going to paste it iPermalinkCommentssecurity web internet spam microsoft blog research

Wooster Collective

2008 Mar 18, 1:04"The Wooster Collective was founded in 2001. This site is dedicated to showcasing and celebrating ephemeral art placed on streets in cities around the world." More cool street art and hacksPermalinkCommentscultural-disobediance art street-art street graffiti via:boingboing blog

Mechanically Separated Meat - Blog Archive - Super Mario World vs. the Many-Worlds Interpretation of Quantum Physics

2008 Feb 19, 8:57A video of a player's many attempts at the same level in a hacked Super Mario World game overlayed on top of one another.PermalinkCommentsvideo mario game quantum-physics via:boingboing

Chumby will be cool, despite its name

2008 Feb 19, 1:51

Bedside ChumbyI signed up for the pre-release beta and purchased a Chumby last year. Chumby looks like a cousin to a GPS unit. Its similar in size with a touch screen, but has WiFi, accelerometers, and is pillow like on the sides that aren't a screen. In practice its like an Internet alarm clock that shows you photos and videos off the Web. Its hackable in that Chumby Industries tells you about the various ways to run your own stuff on the Chumby, modifying the boot sequence (it runs Linux), turning on sshd, etc, etc. The Chumby forum too has lots of info from folks who have found interesting hacks for the device.

When you turn on the Chumby it downloads and runs the latest version of the Chumby software which lets you set alarms, play music, and display Flash widgets. The Chumby website lets anyone upload their own Flash widgets to share with the community. I tried my hand at creating one using Adobe's free Flash creation SDK but I don't know Flash and didn't have the patience to learn.

Currently my Chumby is set to wake me up at 8am on weekdays with music from ShoutCast and then displays traffic and weather. At 10am everyday it switches to showing me a slide-show of LolCats. At 11pm it switches to night mode where it displays the time in dark grey text on a black background at a reduced light level so as not to disturb me while I sleep.

I like the Chumby but I have two complaints. The first is that it forces me to learn flash in order to create anything cool rather than having a built-in Web browser or depending on a more Web friendly technology. The second complaint is about its name. At first I thought the name was stupid in a kind of silly way, but now that I'm used to the name it sounds vaguely dirty.

PermalinkCommentschumby review flash linux

4.12: Mother Earth Mother Board

2008 Feb 15, 4:29FTA: "The hacker tourist ventures forth across the wide and wondrous meatspace of three continents, chronicling the laying of the longest wire on Earth."PermalinkCommentsvia:swannman neal-stephenson

Hackszine.com: Accelerometer motion analysis

2008 Jan 24, 9:45Interesting thoughts on using accelerometer info.PermalinkCommentsvia:swannman electronics accelerometer wii wiimote research:wii-remote

IPv6 Roundup: Address Syntax on Windows

2008 Jan 9, 11:34

IPv6 address syntax consists of 8 groupings of colon delimited 16-bit hex values making up the 128-bit address. An optional double colon can replace any consecutive sequence of 0 valued hex values. For example the following is a valid IPv6 address: fe80::2c02:db79

Some IPv6 addresses aren't global and in those cases need a scope ID to describe their context. These get a '%' followed by the scope ID. For example the previous example with a scope ID of '8' would be: fe80::2c02:db79%8

IPv6 addresses in URIs may appear in the host section of a URI as long as they're enclosed by square brackets. For example: http://[fe80::2c02:db79]/. The RFC explicitly notes that there isn't a way to add a scope ID to the IPv6 address in a URI. However a draft document describes adding scope IDs to IPv6 addresses in URIs. The draft document uses the IPvFuture production from the URI RFC with a 'v1' to add a new hostname syntax and a '+' instead of a '%' for delimiting the scope id. For example: http://[v1.fe80::2c02:db79+8]/. However, this is still a draft document, not a final standard, and I don't know of any system that works this way.

In Windows XPSP2 the IPv6 stack is available but disabled by default. To enable the IPv6 stack, at a command prompt run 'netsh interface ipv6 install'. In Vista IPv6 is the on by default and cannot be turned off, while the IPv4 stack is optional and may be turned off by a command similar to the previous.

Once you have IPv6 on in your OS you can turn on IPv6 for IIS6 or just use IIS7. The address ::1 refers to the local machine.

In some places in Windows like UNC paths, IPv6 addresses aren't allowed. In those cases you can use a Vista DNS IPv6 hack that lives in the OS name resolution stack that transforms particularly crafted names into IPv6 addresses. Take your IPv6 address, replace the ':'s with '-'s and the '%' with an 's' and then append '.ipv6-literal.net' to the end. For example: fe80--2c02-db79s8.ipv6-literal.net. That name will resolve to the same example I've been using in Vista. This transformation occurs inside the system's local name resolution stack so no DNS servers are involved, although Microsoft does own the ipv6-literal.net domain name.

MSDN describes IPv6 addresses in URIs in Windows and I've described IPv6 addresses in URIs in IE7. File URIs in IE7 don't support IPv6 addresses. If you want to put a scope ID in a URI in IE7 you use a '%25' to delimit the scope ID and due to a bug you must have at least two digits in your scope ID. So, to take the previous example: http://[fe80::2c02:db79%2508]/. Note that its 08 rather than just 8.

PermalinkCommentsroundup ip windows ipv6 technical microsoft boring syntax

Dev-Toast : Blog Archive : Uncrippling Bluetooth in Vista RTM

2007 Dec 28, 3:55PermalinkCommentsbluetooth hack howto vista

Wired 13.08: Art Attack

2007 Dec 23, 8:48Banksy article and interview in Wired.PermalinkCommentsart article banksy graffiti hack humor wired streetart interview

BBC NEWS | Entertainment | Paris Hilton targeted in CD prank

2007 Dec 23, 8:46Banksy replaces Paris Hilton CDs with his own satirical music and cover art in stores.PermalinkCommentsart article culture graffiti hack humor music parody prank streetart paris-hilton bbc

Wooster Collective: A Wooster Exclusive: Banksy Hits New York's Most Famous Museums (All of

2007 Dec 23, 8:44Banksy adds his own pieces to NY's museums.PermalinkCommentsart article culture graffiti hack humor museum nyc painting prank streetart banksy

Johnny Chung Lee - Projects - Wii

2007 Dec 17, 9:25Johnny Lee has a couple of projects involving the Wii remote. In the first he uses his fingers as his pointers Minority Report style and in the second he uses an LED pen and a projector to create a whiteboard system.PermalinkCommentsblog bluetooth wii wiimote remote free hardware hack ui howto interactive johnny-lee

Amateur Time Hackers Play With Atomic Clocks at Home

2007 Dec 12, 9:21Article on amateur atomic clock enthusiastsPermalinkCommentsclock time wired geek technology science atomic-clock article via:boingboing

Windows Media Center and Zune Integration Hack

2007 Nov 28, 1:23One of the new Zune features that had me the most excited was the claimed improved Windows Media Center integration which unfortunately turned out to simply mean support for the Win MCE video format (with an exception for HD). I wanted to be able to pick shows recorded by my Win MCE and have the Zune automatically sync up the latest episodes. However, with the improved podcast support in the Zune software one can easily create a ridiculous hack to accomplish this.

The new Zune software has podcast support which does everything I'd want to do with a Win MCE recorded TV series so the goal is to shoehorn a TV series into a Zune podcast. An overview of the steps: Create an XSLT that converts Win MCE data to a podcast, run the XSLT as a scheduled task every few hours per TV series, setup a Web server pointed at the resulting podcasts and the Win MCE Recorded TV directory, and subscribe to the resulting podcasts in the Zune software.
  1. Reading through the Win MCE data stored as an XML file in "C:\ProgramData\Microsoft\eHome\Recording\Recordings.xml" and the spec for podcasts I created an XSLT to convert a series from Win MCE data to a podcast.
  2. I added a new task to the Scheduled Tasks to run my XSLT using my xsltproc.js script. The task runs a handful of commands that look something like the following:

    C:\windows\system32\wscript.exe C:\users\dave\bin\xsltproc.js C:\Users\Dave\Documents\trunk\development\mce-zune\mce-to-podcast.xslt C:\ProgramData\Microsoft\eHome\Recording\Recordings.xml --param title "The Daily Show With Jon Stewart" --param max 4 --param baseURI "http://groucho/" --param thisRelURI "tds.xml" -o "D:\recorded tv\tds.xml"

    For each TV series I run a command like the above and that outputs a podcast for that series into my "D:\Recorded TV\" directory.
  3. Zune only allows http URIs for its podcasts so I installed a web server on my Win MCE server. I'm running Vista Ultimate so it was quick and easy for me to install IIS7 but any Web server will do. Then I pointed it at "D:\Recorded TV\".
  4. Once all the above was done I just subscribed to the resulting podcasts via my Web server and viola! Since I'm forced to use a Web server I can even run the Zune software on a machine other than my Win MCE server. You can see a screen-shot above of my Zune software showing my Colbert Report podcast.
PermalinkCommentstechnical xml mce hack windows media center zune windows xslt podcast

Ex College Roommate News

2007 Nov 9, 2:38Jon's leaving for Germany today which of course is sad. On Wednesday, Jon came over and we watched Hackers. There's a few things you probably wouldn't notice without repeated viewings of the film: In similar ex college roommate news, I'm going to California over the weekend for Angie and Kane's goodbye party. They're heading for Australia for like a year or something. Angie's got a blog about her travels but rarely seems to update it. I'll get to see Carissa and Elijah there too, almost completing the ex college roommate experience. To avoid confusion I should mention that unlike everyone else I know, Carissa and Elijah aren't leaving the country.PermalinkCommentspersonal nontechnical

chumby

2007 Oct 17, 10:49Chumby is a hackable little wifi computer. Its like an expensive alarm clock that also shows you stuff off the Internet. I kind of want one.PermalinkCommentspurchase shopping wifi wireless opensource flash design hardware chumby

Hixie's Natural Log: A low-bandwidth, high-latency, high-cost, and unreliable data channel (Cached)

2007 Oct 16, 12:22FTA: "Look at all those zero cents... there are data bits there, lying unused! It struck me that with every single restaurant transaction I could set the cents field to some number under my control, thus allowing me to communicate with myself at a lPermalinkCommentsblog humor hack food article encoding restaurant via:ericlaw
Older EntriesNewer Entries Creative Commons License Some rights reserved.