RIAA Web Site Trashed

Got Hacked?

This is what tech folk at RIAA, the “Famous” Recording Industry Association of America, been facing for the past few days.

Apparently, some geeks found out that RIAA’s main web site is powered by an older version of Exponent Content Management System (CMS). This version of the CMS contains many vulnerabilities including “SQL Injection”. As soon as this piece of information is realeased through posts on Reddit, some “happy” people started to “experiment” around the exploit. Eventually, the site was brought down and some hacker made the site to link to popular pirate sites like Pirate Bay.

As we all know, the worst of the worst bug to have on a public serviced web site is “SQL Injection”, especially if the site’s database stores high sensitive information. In this case, I doubted that RIAA had anything valuable to anyone.

This all goes back to the hot topic of “Security”. Rule number one: treat every visitor as if he/she is evil. Apparently to RIAA, only single Mom and poor college students who jack a couple mp3s are evil. Like one of the comments on Reddit points out:

I guess that’s the kind of thing you get when you hire more lawyers than programmers.

Of course RIAA has restored their site. But to replace with another version of CMS or a different solution might take while. So be aware, it will go down at any moment again.

At the mean time, check out the post on Reddit.

RIAA with no Contents

RIAA displaying links to Pirate Bay

Cross Site Scripting Hack

IE vs FF on Javascript - 01

We all know how painful it is to deal with the standard differences when it comes to javascript programming across IE and Firefox. There can be many to be listed, but I’m going to list them out as a series of posts over time. These are going to be my findings, so correct any mistakes i may have.

Access DOM Object in an attached event

let’s say you have a link on the page that you want to attach an onclick event to
and assume addEvent is a method created to support both IE and FF

Under Firefox, if you want to access the linkObj, you can simply use “this”

linkObj.addEvent(”click”, function(){
alert(this.href);
})

Under IE, you can’t use “this” because “this” will referrer to the document object
instead, you have to use srcElement, and pass in e as an argument

linkObj.addEvent(”click”, function(e){
var thisObj=e.srcElement;
alert(thisObj.href);
});

WebKit gets Native getElementsByClassName

Woohoo! This is beyond exciting, seriously. If you are familiar with DOM traverse with javascript (which i’m 99% sure you are, cus you are reading my blog), you should be excited as well.

Think about the limited ways that we have today about DOM traverse:

  • getElementByID
  • getElementsByTagName
  • getElementsByName (limited to form elements under IE)

And for those of you who remember who Simon Willison was, he released one of the fastest traverse function “getElementsBySelector”, you know the pain. It has never been perfect, but only to make it as efficient as you can. Seriously, with all the crazy Ajax applications we are developing, “id” and “tag name” is simply not enough for us. jQuery, Prototype, and all the libraries try to support the well known XPath, but none can come close to native support.

getElementsByClassName is one of the more common functions requested by JavaScript programmers (and added by JavaScript libraries); it works along the same lines as getElementsByTagName and getElementById in looking up elements of a web page by their properties. In fact, it’s so common that in the new in-progress HTML5 specification it’s been added to the official DOM API. Last week WebKit joined upcoming versions of Firefox and Opera in supporting this new feature.

The advantages of a native implementation are clear:

No additional JavaScript library files required
Clearly specified and consistent behavior
Blindingly fast

The results speak for themselves. Web applications that do a lot of class lookups should see noticeable speed improvements when run with any of the native implementations, and existing JavaScript libraries can fill in for older or less advanced browsers. John Resig has run a different benchmark of the same functionality in Firefox 3 and observed a similar native vs. JavaScript/DOM speedup ratio.

I LOVE YOU WEBKIT!!!! KEEP THIS UP!!!
On the other side, it’s sad to see how slow other browsers are on the same race… sigh…

53 CSS-Techniques You Couldn’t Live Without

Yes, 2008 is here. Looking back on how we have mastered on CSS styling, it is very cheerful. There are many lists out there that showcase all kinds of cool things you can do with just CSS+XHTML, but this list in particular is one of my favorite. Many techniques shown here are not necessary something new, but definitely something we have to deal with almost on every project.

http://www.smashingmagazine.com/2007/01/19/53-css-techniques-you-couldnt-live-without/

Here are few of my favorites out of the 53 techniques:

1. Displaying Percentages with CSS

2. Dynamic Pie Chart with CSS

3. CSS Diagrams

There are a total of 53 techniques listed there, you can check them all out from the link above.

And of course, this list can not conclude everything, but the charming people who left comments there (>700 comments, now when can i get this kind of traffic) also included some really important techniques. For example, CSS Drop down menu - this can be a pain if you are trying to re-invent the wheels (trust me, ain’t as easy as it seems)

Happy New Year

Happy new year to everyone. 2008 is finally here.

Looking back at 2007, it was definitely an interesting and exciting year. Here are a few highlights (the ones i can remember at least)

  • Release of Mac OSX Leopard
  • Adobe AIR
  • Adobe Flex Chart 2
  • Aptana Reached v.1.0
  • jQuery and Prototype both released its own official book
  • Gmail got a total face lift on the core
  • Google released many new applications (too many to list)
  • Microsoft SilverLight
  • IE8 was finally announced

Now 2008 is here, it’s going to be another interesting year again. Here are the stuff that are on my watch list (besides BeiJin Olympics - WooHoo):

  • Internet Explorer 8 - some sort of beta and crossing my fingers that it will be released
  • Firefox 3
  • HTML 5 - not that i’m over predicting, but looking at the WebKit’s advanced movements on HTML 5 implementation, we might just have a chance of having it here earlier.
  • Google Knol - yes, the wiki
  • Other Google applications
  • Adobe AIR - hopefully it gets out of beta
  • SilverLight - not a fan, but interesting to see how it will act this year
  • ECMAScript 4
  • WebKit

Okay, i just figured the list can go on and on and i can possibility put everything here, which is what makes 2008 interesting.
I’m going to take this chance to thank everyone who has read my blog in 2007. Although I have been doing a pretty lousy job of keep it updating everyday, but I truly thank everyone whether you were just passing by, bookmarked it, or left a comment. Let’s all have a happy 2008. Cheers everyone!

WoW BG AFK - AppleScript

Run ScriptEdit and put the following script in there and follow these instructions:

1. Run World of Warcraft >> Login >> Ready to Queue for BG

2. Run the Script

3. Go find a spot to hide

4. Requeue :3

set CR to ASCII character of 13
set space to ASCII character of 32
set random_time to {80, 170, 240}
repeat
tell application “System Events”
set rn_index to (random number from 1 to 3) as text
set rn to item rn_index of random_time
tell application “World of Warcraft” to activate
keystroke “qews” & space
keystroke “h” using command down
delay rn
end tell
end repeat

Google’s New Toy Knol

Got Wikipedia? Google does now.

I’m sure anyone of you that is reading my blog knows what Wikipedia is. It was a brilliant idea to bring everyone on the web together to create information knowledge database. But now, after years of Wikipedia.org’s domination, Google is moving into the space to take a sweet chunk of it.

The new tool called “Knol”, stands for “a unit of knowledge”, was announced by Google today.

Earlier this week, we started inviting a selected group of people to try a new, free tool that we are calling “knol”, which stands for a unit of knowledge. Our goal is to encourage people who know a particular subject to write an authoritative article about it. The tool is still in development and this is just the first phase of testing. For now, using it is by invitation only. But we wanted to share with everyone the basic premises and goals behind this project.

So what’s so sweet about this? Let’s look at it from two different perspectives:

1. From Google Perspective, it means more traffic, more impression, and of course leads to more money. The idea of Wikipedia is already matured itself over the years, just like the blogs. It is less known to people who are not that technical, but for any programmers, a Wiki for a project is sometimes a must. But ever since the release of Wikipedia.org, you now get high school or college students put that on their homepage (why? think essay and boring researchs). In another words, Wiki has matured itself to draw enough attention on the web that converts into high quality of traffic. I don’t think i need to say more why this means more money for Google. See this picture for yourself:

2. From an end user perspective, we get more functions around the information than we had with Wikipedia. When you put all google’s currently offered applications on the table, it ain’t that hard to link them to Knol. Think about all the possibilities. I got a few here

  • Knol Search (or wiki search if you will) backed by Google Search Engine
  • Google Map integrated into Knol whenever there’s location involved
  • Google Gears to let you take the information offline
  • Knol Search inside of Blogger

This is by far one of the biggest news Google released on the 4th quarter. I would personally consider it as a nice Christmas present and great hopes for the new coming year for all of us.

IE Automatic Component Activation Preview Now Available

The IE team has just released the preview version of the change. As mentioned one of the earlier blog post, the annoying “click here to activate” on embedded contents on IE will be reverted in up coming Service Pack release.

As promised, a preview of this update is now released for download. We will still not get it through regular windows update, but for testing purposes, it is ready.

A couple of weeks ago, we announced that an optional preview for the Internet Explorer Automatic Component Activation was coming in early December, and I’m happy to say that it is now available. Read Knowledge Base article 945007 for full details, along with links to the specific downloads for each operating system.

Wii => Vii ???

Just as u and i though iPhone gets copied was crazy enough, let me introduce you with Vii. Confused? In plain simple term, a copied version of Wii.

God, i’m so “proud” of being a Chinese.

HTML 5 Sneak Preview

Lachlant Hunt wrote up a blog post that gives us a Preview of HTML5

In one of my earlier post Webkit Introduces: HTML5 Media Support, we reviewed the media support of the HTML5, but there are much much more. In this post, Lachlant Hunt highlighted some really useful features introduced in HTML5.

To give authors more flexibility and interoperability, and enable more interactive and exciting websites and applications, HTML 5 introduces and enhances a wide range of features including form controls, APIs, multimedia, structure, and semantics.Work on HTML 5, which commenced in 2004, is currently being carried out in a joint effort between the W3C HTML WG and the WHATWG. Many key players are participating in the W3C effort including representatives from the four major browser vendors: Apple, Mozilla, Opera, and Microsoft; and a range of other organisations and individuals with many diverse interests and expertise.

What really excites me is the new structural layout. Instead of having a crazy load of divs (which i know we are all guilty of doing so) to achieve a simple layout, we now have a structure like this:

See the difference? The tag itself now makes sense. Just like the “header” tag we had before.

Unlike previous versions of HTML and XHTML, which are defined in terms of their syntax, HTML 5 is being defined in terms of the Document Object Model (DOM)—the tree representation used internally by browsers to represent the document.
The advantage of defining HTML 5 in terms of the DOM is that the language itself can be defined independently of the syntax.

null

Did you catch the phrase “the language itself can be defined independently of the syntax”? Oh yeah! Just imagine a well formatted DOM Tree where objects are nested perfectly. Not to mention how much easier and more efficient it will be when it comes to DOM Manipulation through javascript.
Let’s all cross our fingers and hope HTML5 gets released as soon as it can.
Go check out the “How to Contribute” section of the original post. Your help will matter the speed of HTML5’s release.

Back in States

I was on a business trip last week in China and now I’m finally back to the states. Some of you might have noticed the lack of posts for the past few days. I’m going to make up for those as soon as i’m recovered from the stupid jet lag.

Internet Explorer 8

It seems like the IE team is getting into another hype of blog posting at the year end. It is definitely a good thing for all of us who are anticipating on any updates from them.

This time, Dean Hachamovitch, the General Manager released some hopes to the much waited Internet Explorer 8. There has been way too many rumors and guesses. I would consider his post as a confirmation of IE8 being under development and ready to be revealed not far from now.

Of course, some people care about other aspects of IE8 much more than they care about the name. As I’ve walked different people through the plan, I’ve gotten “Does it have feature X?” “When is the beta?” “When does it release” and even the more thoughtful “What are you trying to accomplish with this release?”

You will hear a lot more from us soon on this blog and in other places. In the meantime, please don’t mistake silence for inaction.

In his post, he also released some naming candidates for the new internet explorer (and of course with a sense of geeky humor)

IE 7+1
IE VIII
IE 1000 (think binary)
IE Eight!
iIE
IE for Web 2.0 (Service Pack 2)
IE Desktop Online Web Browser Live Professional Ultimate Edition for the Internet (the marketing team really pushed for this one ;-)
Ie2.079 (we might still use this for the Math Major Edition)

IE7 Object Overwrite Bug

Jon Sykes has found an interesting bug in IE7. In his post found a bizarre bug in IE7, he demonstrated the bug with some simple test scripts. Quite frankly, it should be a rare case to happen, but surely I’ve experienced the same bug before. I was so frustrated by it and had to rewrite portion of my code to work around it (not that hard)

There is a bug in IE7 where by a line of code inside a conditional statement that NEVER runs, can cause an object that is set with a fairly standard object declaration to be whipped. Even weirder is that it will have whipped the code even if you put a debug alert of the object before the code that does the whipping. Confused? I know I am.

Thankfully it does look fairly simple to work _around_ and avoid. But it’s probably a debug nightmare, and it’s a bug I couldn’t find referenced anywhere, so I figured it was worth sharing.

<script type=”text/javascript”>
this[‘test’] = {};
alert(this[‘test’]);
// will spit out [Object object]
</script>

<script type=”text/javascript”>
alert(this[‘test’]);
// will spit out Undefined in IE7
// this next chunk of code should never run.
if (true == false){
alert(”This never fires”);
// THIS SHOULD NOT IMPACT ON ANYTHING !!!!
var test; // take this line out and it works fine
alert(”This never fires”);
}
</script>

As you can see from the above example, the line “var test;” should never be executed since it is within “true==false” condition. But somehow it gets fired.

IEBlog: Tools for detecting memory leaks

John Hrvatin, the Program Manager for Internet Explorer has just written up some of the perspectives that the IE team is taking on IE memory leak issues.

nternet Explorer 7 improved the situation by releasing all references to Jscript objects attached to the DOM tree when IE navigates away from that page. This allows the Jscript engine to then garbage collect those Jscript objects and recover that memory. We’ve also made the same changes in IE6 on Windows XP SP2 (shipped originally with the June Update). However, as some web developers have pointed out, those changes don’t solve the problem entirely. IE still leaves behind anything not attached to the tree when we tear down the markup. In addition, sites that users keep open for extended periods of time, such as Web-based mail, can still cause IE’s memory usage to continually grow if the site doesn’t take care to avoid the leak patterns.

This is definitely a plus on the confidence I have on IE. Just recently, the Firefox team started to investigate on the memory leaking issues. It’s a common issue amount, i’ll say, all the browsers available today. But seeing IE team has been putting up quite an effort on trying to solve the problem makes everyone feel comfortable.

But the criticism on Jscript is still high. Remember the my post earlier regarding Gmail gets a facelift on the javascript? One thing mentioned was about a Gmail programmer reverse engineered the Jscript and was horrified to see how many hard coded object references and so on. I personally think IE team is on the right direction on solving the problem

Internet Explorer 7 improved the situation by releasing all references to Jscript objects attached to the DOM tree when IE navigates away from that page.

Memory leak in some sense is a type of logical bug. Remember the old days of programming where every cycle counts? This is the same still in today’s web application design where every bit of memory, cpu usage, and of course time execution counts. I do admit when a program gets to a certain size with many objects built in, the cross references on the objects can get very overwhelming and quickly become a memory leaking problem. In my opinion, there are two different approaches to fix the problem:
1. Quick patch by looking at leak pattern
2. Dig up all the references, either fix them from the root or rewrite the entire library

Allow me to expand these two approaches with their cons and pros.

1 Quick patch by looking at leak pattern
Pros: quickly identify the issue and resolve it. The turn around on it can be extremely fast. The patch can either be a fix on the existing code, or extra code that prevents the pattern from happening.
Cons: Since the fix only solves a particular problem based on the result of the problem, it can either mask out the real problem behind or introduce other problems. (that’s why no programmers like to be the fire fighter)
2. Dig up all the references, either fix them from the root or rewrite the entire library
Pros: To solve a problem, it’s almost not arguable to say solving it from the root is the right thing to do. In a heavily OOP structured environment, drawing out the ULM diagrams to demonstrate each possible execution path a lot of times can make the root of the problem to surface. By going down this path, you usually won’t end up introducing new problems (remember, i said usually, it all depends on how much depth you are going down and how careful you are)
Cons: In many cases, this path can take heck a lot more time than the quick patch. It involves tossing away a lot of codes and rewriting stuff from scratch. It is harder to QA the result and if not careful, new critical bugs can be introduced.

I personally think the IE team should take the second approach on the Jscript if they haven’t already. I’m pretty sure the IE team is tired of never ending quick fixes and quite frankly, we, the developer, are pretty tired of sudden changes in behavior after almost every quick patch release.

Google Might Release GDrive soon

According to an article on Wall Street Journal, the much talked about rumor “GDrive” or “GSpace” can become reality in a few months from now.

Google is preparing a service that would let users store on its computers essentially all of the files they might keep on their personal-computer hard drives — such as word-processing documents, digital music, video clips and images, say people familiar with the matter. The service could let users access their files via the Internet from different computers and mobile devices when they sign on with a password, and share them online with friends. It could be released as early as a few months from now, one of the people said.

If they releases it by the end of this year, it will be the best Christmas gift ever for everybody.

There has been a lot of rumors about the new innovative products Google has been trying out. Things like “GDrive”, “GPhone”, “GBroadband”, and the list goes on. A lot of them have already been dropped by Google, at least for now. But something like the online storage, it’s a product that is too hard for Google to let it slip. There are a hand full of applications out there that utilizes Gmail and use it as an online storage. I’m pretty sure Google realizes it and since the kind of usage does not breach any legal issues or user agreements.

With GDrive, we can now hope that all the services we are already getting, like wordprocessing, spreadshett, etc. will be managable through a centralized storage space. Let’s have our finger crossed, blog about it like crazy to push on this much anticipated service. Google, you are the man!

DateJs - Little Ninja Date Library

Okay, i have to admit this is the first time i’ve seen a date library. I did do a bit of digging and found out how behind I am on js date libraries. But out of all the ones i found, none of them matched DateJs. The site has a kickass design with a little red Ninja logo holding a sword. I’m not too sure why the Ninja was chosen to represent this library, but what the heck, it looks ass kicking.

The whole idea of DateJS is to translate common date strings into a usable and accurate timestamp. The result is similar to php’s strtotime function following GNU >> Date Input Format syntax but in real time as you type.

A couple tries from Rey Bango at Ajaxian.com

And of course, a couple tries from me trying to break it

After a few tests, it seems like it caps at the number 99. You can do +99 days/years/ect., but as soon as you hit 100, it refuses to calculate. I guess that’s just a small limitation purposely added, shouldn’t be too hard to remove.

One interest thing that I have been wondering about is the string “The Day After Tomorrow”, equally as “+2 days”. Somehow this string has never been taken in consideration (doesn’t work on strtotime in php either :\ )

Gmail New Sender Profile Feature

I just noticed this new feature on gmail when i logged in today. It’s a little tool tip that pops up when you mouse over the sender in your inbox.

The little tooltip provides the profile of the sender; shortcuts to quickly send an email to the sender; to see all the conversation from the sender, and much more.

I’m for one is not a huge fan of mouse over events, but this one from gmail with a slight delay is great. It does not bother me while i’m reading my email and gives me quick access information and pages quickly. And it is not overly big to cover too much stuff. Great Job Gmail Team!.

Gmail Tooltip Feature

Product pages: so much suck, so easy to fix

Just came across this awesome article by Amy Hoy on web User Experiences. The much talked about User Expirence a lot of times either get overly abused or completely missed out.

What really bother me is that a lot of new sites today lean towards providing cutting edge functionality but misses the usability. What really attracts ppl to the site is not just because how bad ass your Ajax app is and absolutely not how good you can make a page look pretty. What really counts is how user friendly is your site, in another word “User Experience”. Your site doesn’t have to look top notch, as long as it has a good user experience flow, and looks elegant, ppl won’t bounce.

I love the opera example she made. The previous design was just a complete disaster. All the characters they came up with in the flash didn’t help them in any posstive way. When you landed there, all you see is that ugly flash which dis-encourages the user to continue on and click on the download link. That’s a broken user experience right there.

First Experiences Last a Lifetime

Your mother always told you first impressions count, and the same is true of web sites. You don’t get a lot of time to sell yourself to a potential customer who loads your page; most people are lazy, and more importantly, impatient. You have to go the extra mile, because they won’t (and that is the natural and proper order of things). All the research seems to indicate that you have mere seconds to convince a shopper that he or she just has to have what you’re selling (or offering for download), to hook ’em and leave ’em wanting more, but not too much more.

User Experience Basics

We’ll get to the practicum in just a moment but first, let’s talk — very briefly — about some super basic UX tenets:

* Be nice to your users and customers (and potential customers).
* Design as if your main goal is to inform and educate.
* Be honest and forthcoming, while you’re at it.
* Help your users and customers to do what they want, not what you want them to do.
* Be consistent with your message and quality of service (and I’m including software design here, folks).
* Scientific, measurable “usability” doesn’t necessarily make for a good experience.
* Good design makes people feel good.

Firefox 1.5 Homepage

Opera Old Homepage

Understanding Web Design

Have you ever wondered why some company’s official website’s design turns out to be a complete disaster? It’s not like these company doesn’t have enough money to lay on the table. Here’s an article about “Understanding Web Design” by Jeffrey Zeldman which in my opinion outlines the common mistakes and signs that leads to a website design disaster.

Some who don’t understand web design nevertheless have the job of creating websites or supervising web designers and developers. Others who don’t understand web design are nevertheless professionally charged with evaluating it on behalf of the rest of us. Those who understand the least make the most noise. They are the ones leading charges, slamming doors, and throwing money—at all the wrong people and things.

EU: Airline Web Sites Must Improve Or Be Closed

Over 200 European Web sites selling airline tickets, including many run by leading airlines, are misleading to consumers and will be shut down if they do not improve, the European Union’s consumer chief said on Wednesday. Consumer Protection Commissioner Meglena Kuneva gave airlines such as Ryanair and the owners of the other travel Web sites four months to “get their act together” or face possible closure of their sites.

I don’t think aireline websites are the only ones out there that are misleading and are far freaking behind. Look at the real estate websites in the states, government web site, school website…. Oh yes, the list goes on. It’s not that expansive to hire a web team on part time to put up a nice and useful website.





Close
E-mail It