____ _ _ __ __ _
_ \ ___ __ (_) __ _ _ __ \/ ___ ___ _ _ _ _ __
/ _ \ '_ \ / _ '_ \ \/ / _ \/ _ \ __ '_ \
_ __/ _) (_ __/ __/ _ _ _)
____/ \___ _.__/ _ \__,_ _ _ _ _ \___ \___ \__ \__,_ .__/
_ Discussing the URL Change As we recently announced in [info]news, we have changed the canonical URL of most journal, community, and syndicated content. While we did offer subdomains to Paid users in the past, this is now the canonical URL that we will link and redirect to for all journals. However, all communities are located at http://community.livejournal.com/username and syndicated accounts at http://syndicated.livejournal.com/username. Due to the way certain proxy servers are configured, and the fact that the HTTP RFC prohibits it, the canonical URL for journals with a username starting with an underscore will be http://users.livejournal.com/username. We are however offering a free rename if you fall into this group. So now the technical side of all of this and why it was a required change; bear with me as its 3am my time and I'm sitting in John F. Kennedy Airport after a five hour flight. Late last week we become aware that it was possible to use the "-moz-binding" CSS attribute within Mozilla and Mozilla Firefox to execute arbitrary offsite JavaScript. As this attribute is designed to allow attaching an XBL transform and JavaScript to any node within the DOM, it is quite easy to use in a malicious fashion. We immediately altered our cleaner to strip this attribute from entries and comments, though also realized that wasn't even half the battle. As we allow custom CSS in many of our styles, as well as the ability to link to an external stylesheet in a variety of fashions, it was quite possible to take advantage of this exploit and hijack the session cookie of any user who views your journal. As we, along with many other sites, used one cookie to authenticate a user, this cookie was quite powerful if stolen. If the user had not chosen to bind their cookie to their IP address, a malicious user could steal it, login as that user, deface the account and SPAM with it, as well as modify that user's style to include the exploit thus causing this problem to spread much like a virus. Borrowing the idea from another development team within Six Apart, we decided we needed to break our cookies into three categories. One cookie would be our application management cookie, this cookie would only be accessible on www.livejournal.com where we will not display untrusted content. A second cookie will be accessible on all subdomains of livejournal.com, though it only will say if you are logged in or not; it is solely for optimization. We then will issue one cookie for each journal you visit. This cookie will be only accessible on username.livejournal.com or community.livejournal.com/username as it is limited to a single journal. This cookie will only grant you the permission to read protected entries and post in the particular journal. This means that if the journal owner steals your cookie, they will be able to do nothing more than view their journal and comment upon it as if they are you. In the end you will have n+2 cookies, with n being the number of journals you visit. Due to the fact that we cannot clean every external CSS stylesheet linked to every time we generate a journal page, this change is required. While it does not fully protect us from some new cross site scripting vulnerability that can be exploited via entries or comments, they are much easier to block, patch, and recover from quickly. With Mozilla deciding to allow the execution of arbitrary JavaScript via CSS, there is no other viable solution than the one we have undertaken. We developed a plan to phase all of this in over the next week, URL change first and then followed by the cookie change, though this morning we were made aware that this was being actively exploited. As such we took our week time line and shortened it to about twelve hours. While URLs have been changed at this time, our cookie handling change has not yet happened. This should however be expected to take place within the next day or two as well as various other cleanups and fixing bugs we've already encountered. Please feel free to let us know if you have any questions and open a support request if you find a bug or encounter a problem. Sorry all of this came with just about zero warning, but in the end we could not wait longer to fix this problem.Thanks to Daniel Silverstone for providing me with a cache copy of the text.
The future for Ruby and Emacs is looking hopeful. I learned that a
proper Ruby grammar for the semantic package is being worked on,
which will enable class browsing and intelligent completion.
I am still disappointed that there's no version of Emacs
that uses Xft or Pango for anti-aliased font rendering. To get sharp fonts,
I still need to use a bitmap font like misc-fixed. If I were in the
business of offering bounties for open source development, dragging
Emacs into the GTK2/Pango era would be the biggest one.
Checking the mailing lists indicates that Pango is not
suitable
for Emacs, but no alternative scheme ever seems to bear fruit.
Yet if Aquamacs can do it...
If somebody came along with a decent TextMate-a-like for GNOME, I'd
pay good money for it. I've never been really happy with an editor
since Cygnus
Ed.
Hallski and I keep talking about this,
and only just manage to resist wasting months of time on trying to
write one ourselves.
Does "Web 2.0" mean anything? Till recently I thought it didn't, but the truth turns out to be more complicated. Originally, yes, it was meaningless. Now it seems to have acquired a meaning. And yet those who dislike the term are probably right, because if it means what I think it does, we don't need it.So what's the reasoning that means we don't need the term? Graham writes: "Web 2.0 means using the web the way it's meant to be used." There's nothing fundamentally new, but there is a groundswell of understanding of what's been there all along. For me, that's a wonderful encapsulation of both current web trends and my aspirations for XTech. "Web 2.0" is a just a handy label for this. "The Web as it was meant to be used" will strike a chord with many web practitioners today--whether it's sensible use of web services with REST, improving user interaction in web design, or open semantics and data interchange. If you're involved in using the web as it's meant to be used, consider submitting an XTech proposal.
The future for Ruby and Emacs is looking hopeful. I learned that a
proper Ruby grammar for the semantic package is being worked on,
which will enable class browsing and intelligent completion.
I am still disappointed that there's no version of Emacs
that uses Xft or Pango for anti-aliased font rendering. To get sharp fonts,
I still need to use a bitmap font like misc-fixed. If I were in the
business of offering bounties for open source development, dragging
Emacs into the GTK2/Pango era would be the biggest one.
Checking the mailing lists indicates that Pango is not
suitable
for Emacs, but no alternative scheme ever seems to bear fruit.
Yet if Aquamacs can do it...
If somebody came along with a decent TextMate-a-like for GNOME, I'd
pay good money for it. I've never been really happy with an editor
since Cygnus
Ed.
Hallski and I keep talking about this,
and only just manage to resist wasting months of time on trying to
write one ourselves.
Does "Web 2.0" mean anything? Till recently I thought it didn't, but the truth turns out to be more complicated. Originally, yes, it was meaningless. Now it seems to have acquired a meaning. And yet those who dislike the term are probably right, because if it means what I think it does, we don't need it.So what's the reasoning that means we don't need the term? Graham writes: "Web 2.0 means using the web the way it's meant to be used." There's nothing fundamentally new, but there is a groundswell of understanding of what's been there all along. For me, that's a wonderful encapsulation of both current web trends and my aspirations for XTech. "Web 2.0" is a just a handy label for this. "The Web as it was meant to be used" will strike a chord with many web practitioners today--whether it's sensible use of web services with REST, improving user interaction in web design, or open semantics and data interchange. If you're involved in using the web as it's meant to be used, consider submitting an XTech proposal.
Next.
