Developer finds major coding errors in Facebook, MySpace Developer finds major coding errors in Facebook, MySpaceIDG News Service - Social networking sites MySpace and Facebook have apparently fixed coding errors that could have allowed an attacker access to all of their users' data and photos.

The simple coding errors are alarming considering the extent to which social networks have gone to reassure their users that their data will be safe. The problem involved the way the sites handle requests for data from other domains, known as the "cross-domain policy."

Sites such as MySpace and Facebook typically block other domains from requesting and receiving data for privacy reasons, except for their own vetted subdomains.

Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains.

Since the subdomain also hosted all of Facebook's data, it would be possible to steal data by luring a victim to a URL with a Flash application rigged to grab the data if the victim had their auto-login enabled, which most people do, according to Schaap's blog.

A "more invasive and hidden exploit could harvest all the user's personal photos, data and messages to a central server without any trace, and there is no reason why this wouldn't be happening already with both Facebook and MySpace data," Schaap wrote on his blog.

He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.

MySpace disagreed with the severity of the error, saying it would have only exposed information that was already public. The problem was with the sproutbuilder domain, and it has since been fixed, a spokeswoman said in an e-mailed statement.

"No public MySpace data was exposed and the vulnerability was never exploited," the statement read.

A look at Facebook's latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.

In an e-mailed statement, Facebook said it "worked with the researcher who identified this issue to fix it. We have not received any reports that it was ever exploited."

Mozilla Raindrop Keeps Messaging Personal

Today, Mozilla announced a new open source project called Raindrop, a service that pulls your social content from multiple sources and organizes it in one place to create a centralized messaging experience that matters to you.

The goal of Raindrop is to make email and messaging personal again, and allow complete customizability in how you manage that information. It brings in content from multiple, sources such as Twitter, RSS feeds, and email, and presents it in one central, web-based front end. Thus, instead of having to watch multiple sources just to keep up on your personal conversations, you can focus on one single bucket.

Raindrop can also decide which conversations are important to you and your life, and "bubble up" that information to the top—while keeping the less important messages out of the way. In addition, like all Mozilla projects, Raindrop will be extensible—whether through HTML, Java, CSS, or APIs—in order for you to further personalize your experience.

Mozilla says that the goal is not to invent a new protocol or system, but better handle ones that already exist. The video demo (above) explains some of the basic principles behind Raindrop.

Raindrop is still in very early stages, and isn't something the basic user can try out just yet, but it's certainly something we'll be keeping an eye on.

Waver a google wave application! :)

Waver is a Compact Google Wave Client

Windows/Mac/Linux (Adobe AIR): Waver allows you to keep a single-column view of Google Wave open on your desktop at all times from which you can read, compose, and keep an eye on what's happening in your Wave inbox.

We've featured ways to keep on top of your Wave inbox before, but if you're not the type to keep things open in your browser (or you don't use Firefox), free Wave client Waver is a decent alternative. The client is merely a standalone version of Google Wave's mobile interface, but it works perfectly as a compact, out-of-the-way client. You can view your inbox, search for waves, view them, reply to them, create new ones and even manage your Wave contacts, all from inside the app.
Waver isn't the only Site-Specific Browser (SSB) to integrate with Wave. For those that want a full, multi-column Wave-focused client, free app Waveboard aims to tightly integrate Wave with OS X, adding, for example, support for Growl notifications.
Waver is a free download for all platforms, and requires Adobe AIR.

LiveBrush a cool adobe air application

Livebrush Makes Design Creation Simple

Adobe Air: If you're looking to put a flourish or two on an invitation, business card, or web page, Livebrush makes it super simple to create your own designs without purchasing advanced vector-based software.
Using Livebrush is as simple as swirling your mouse about. If you want to get more nuanced you can—the examples on their site show some really detailed image results. For adding just a bit of visual interest to the sidebar of your blog or the edge of your stationary, however, Livebrush is easy to pick up and play with.
You can choose from different styles, fine-tuning your brush behavior and weight as you go. Livebrush supports layers and you can export the final product as a PNG file. Upgrading to the Pro version for $10 unlocks additional features like the ability to export vectors. Check out the video below to see Livebrush in action:

If you have a favorite resource or tool for adding flourishes and decorations to your design work, let's hear about it in the comments.

GreaseChromium! ?

The nightly builds of Google Chrome's open-source foundation, Chromium, includes a feature that might mean great things for Greasemonkey fans. Click on a user script file, such as at UserScripts.org, and Chromium asks to install it as a working extension.
Judging from the developers' discussions at the Chromium wiki, Greasemonkey, or at least some kind of user script support beyond thecurrent, very geeky installation method has been a hot topic. The latest builds tackle user script support by re-mapping them into extensions, automatically activated at their relevant sites. You can give it a test by installing the latest Chromium build in Windows. We'll assume this feature will make its way very soon to those keeping updated on Chromium builds for Mac and Linux.
Before you get too amped, though, it must be said that support is still rudimentary. Scripts that mostly replace one thing on a page with another seem to work fine, but those that pull off custom themes and page manipulations are touch and go. In other words, the more Greasemonkey-specific functions appear in a script, the less likely it is to work in Chromium. That said, it's reassuring to see some of the great Grease realm opened up to the up-and-coming browser.

Karmik Kola goes bust... Had been waiting eagerly for it..
but early reports says its way too buggy to make a shit to it.. jus yet.
Advice :: wait about a month so that the major bugs are squashed...
Gonna use it to setup my server on the vps hosting i m about to buy :)

Best OpenSource Portals Out there...! part 1 [EXO Portal] Hi.. this post is about all the greatest web portal avaliable out there.. for free!..

I will list them out here based on which one I think is the best..

1.) Liferay.
2.) Exo GateIn
3.) Alfresco.
4.) Exo Portal.

So this post is about EXO PORTAL ::

The Good ::

Neat Inerface, Starts without much issues..
The most comprehensive wiki for developers .. Thats A BIG +.
Most easy interface when making new pages or content.
Nice drag and drop layout management and content creation
The use of widget(Like Google Gadgets).. can register widget in the application registry.
Can even copy remote widgets in the local repo.

The Bad ::

Needs JAVA 1.5 ... this is not mentioned anywhere in the download page..
found that out in their wiki..
Incomplete error messages.. need to figure out at places what information you didnt provide completely.

Is slow.. being bound to java 1.5 it is supposed to be slow.. it is
lack of community generated contents.!
lack of social features.

url : exoplatform.com

HOW TO CREATE A ROUNDED DIV USING ONLY CSS Creating Rounded Divs is a Basic requirement while developing kool looking websites.
But most techniques use images to create the curve. This fails miserably in many conditions and its hard to get a consistent look.

How do we do it ?

To create the rounded corners, you use inline element that acts as the actual pixel for your corner.

You also need a container element, such as a div.

The XHTML Required for Rounded Corners

<div class="container">
 
 
 
 
 
 CONTENTS GOES HERE
 
 


 
</div>

In order for your corners to be visible, you need to have your container div be a different color than the background color of the page.

.container {background:#ccc;
color:#fff;
margin:0 15px;}

As you can see, I also set the left and right margins a little off the edges so that they would be easier to see the rounded corners.
Each corner is written as a b element classed either rtop or rbottom. Then inside of this element are 4 more b elements, classed r1 through r4. To get the correct colors, you need to set the rtop and rbottom elements the same as the page background color. Then you set the r1 through r4 elements the same background color as the container.

.rtop, .rbottom{display:block;
background:#fff;}
.rtop *, .rbottom *{display: block;
height: 1px;
overflow: hidden;
background:#ccc;}

Setting the overflow to hidden ensures that the elements inside rtop and rbottom won't extend past their allotted space.
The last thing you do is set the right and left margins of the r1 through r4 elements so that they get progressively smaller and create the curve you're looking for.

.r1{margin: 0 5px}
.r2{margin: 0 3px}
.r3{margin: 0 2px}
.r4{margin: 0 1px; height: 2px}

The height on the r4 element helps insure that the entire section doesn't take up too much space.

Four Rounded Corners

Sed do eiusmod tempor incididunt ullamco laboris nisi ut labore et dolore
magna aliqua. Quis nostrud exercitation qui officia deserunt ut enim ad minim
veniam. In reprehenderit in voluptate mollit anim id est laborum. Duis aute
irure dolor consectetur adipisicing elit, ut aliquip ex ea commodo consequat.
Lorem ipsum dolor sit amet, qui officia deserunt cupidatat non proident.
Eu fugiat nulla pariatur. Ut labore et dolore magna aliqua.

How to Successfull INDEX your BLOGGER , BLOGSPOT blog in GOOGLE Blogger in its second incarnation has been a better service but it still has a few glitches.

I found it a little difficult to find a way to get my blog indexed.

Since blogger doesn't allow one to upload a file. so it becomes impossible to create a sitemap using some tool and submit that xml file uri to google webmasters tools.

so what do we do?

If you have not already enable google webmasters in blogger enable it.

SCREENSHOT :

GET FULL-SIZE IMAGE

Step 1: Get your blog verified.
Goto http://www.google.com/webmasters/ , login, then add your blog. Thats all your blog is added and verified.

Screenshot :

GET FULL-SIZE IMAGE

But wait that does not make it indexable. Why?
Because google needs a sitemap.

Step 2: Add a Sitemap using your feed url.
Goto "SITEMAPS" section in "Site Configuration" section and add a sitemap as shown in the screenshot, add "feeds/posts/default" to your blog address. This is your infact your feed address.

ScreenShot:

GET FULL-SIZE IMAGE

Step 3: Check the indexing status.
If all is well then the sitemap you added will show a green arrow after a while.

ScreenShot:

GET FULL-SIZE IMAGE

Thats all your blog will be indexed in time.

TroubleShooting :

If you have set your blogger account to redirect feeds to some other feed aggregation services such as feedburner.com. You need to unset this. Thats how I solved my problem. Without this google will fail to index using your feeds.

What lasts a millisec is often so beautiful!

TAKE A LOOK AT THIS!

I found this image some where on the net :) initially I didnt notice but then I was really impressed at the concept.

I like to collect images.

Beagle Indexing Service Wont Start
The Beagle indexing service crashes after running for a short while.

IF this is happening to you then your indexes have probably gone corrupt due to an unclean shutdown. The easiest way to correct this is to go to ~./beagle directory and clean the entire directory.

You need to stop the beagle service prior doing this :

Clean these files and directories :

Restart the daemon :

Check the indexing status :

How to protect this from happening ??

Simple when u leave your system unattended and its under a threat of unclean shutdown stop the indexing service and yes.. make regular backups of the index.

FileSystem Checks, Why are they Important! and How to Perform Them :)

To keep your system healthy... please pay attention to what it says.. (Once in a while atleast)

Platform : Linux
Command 1: init 1 (as root!)
Command 2: umount -a (very important as check should be done only in readonly mode)
Command 3: fsck -vcfy
OR
Command 3: fsck -vyf

--------------------------------------------------------------

Explaination : "init 1" drops to single user mode, "umount -a" unmounts all block devices. Finally we use "fsck" command which is the filesystem checking tool.

The switches used are as follows :

"-c" to check for BAD BLOCKS (takes a hell lot of time)

"-v" to verify the data.

"-f" to force in case of some error.

"-y" to say yes to all prompts.
-----------------------------------------------------------------------------------

How to Mount an ISO/NRG file in Linux
A simple easy way to mount the images in seconds.

The command : "mount"
Syntax : "mount -t iso9660 -o loop image-path mountpoint"
Root Access Required : true

Example : #mount -t iso9660 -o loop /home/myhome/dir1/dir2/image.iso /home/myhome/somedirectory

How to unmount ?
#umount /home/myhome/somedirectory

Gotchas :
You can only have a limited number of mounted loopback devices(explained later). So if you try mounting too many images you will need to unmount the earlier ones before doing so.

How does it work ?

A image is a copy of the media, so it can be mounted just like other "block devices" onto some "mount point" (any folder on which the system has permission). So basically what this mounting does is to "MAP" the block device, in this case its LOOPBACK block device to the folder and thus we are able to see the contents of the image inside the folder.
As there is a limit to the number of loopback devices the OS(linux kernel) supports we can not mount ant number of images.

Cant Mount .NRG files ?? :P
Yeah! its not done this way......
Soluntion ?
Here you go!... "mount -o loop,offset=307200 image.nrg /wheretomount"

How To Make A DSL Connection in LINUX(Debian based)? FOR THOSE WHO DO NOT HAVE A "ALWAYS ON" OPTION (Unlimited Usage) :D

what you need:

pppoeconf: configures PPPoE/ADSL Userfriendly tool for initial configuration of a DSL (PPPoE) connection.
.................................
Source: Debian 3.0r0 APT / Linux Dictionary V 0.16

Install this tool, start it as root
then follow the simple prompts.

How to DIAL? :
you can start the connection with "pon provider-name" as stated at the end of pppoeconf wizard.

How to DISCONNECT? :

you can terminate all the connections by "poff -a".

FILES

/etc/ppp/peers/dsl-provider is pppd options file for your dsl provider.
/etc/ppp/pap-secrets and /etc/ppp/chap-secrets are described in pppd documentation. pppoeconf may add lines to theses files.
/etc/ppp/ip-up.d/0clampmss and /etc/ppp/ip-down.d/0clampmss are used to clamp MSS if needed.
/etc/network/interfaces is network interface file for your system.

KDE 4 wont login properly! (Nothing but a white screen displayed) Enabling Translucency with COMPIZ on will corrupt your KDE 4.

The culprit :
COMPIZ doesn't go well with COMPOSITE extension of XORG so enabling translucency will corrupt the display on poor or low end graphic cards.

The Solution :
The easiest way to get around this is to delete( rather make a backup of this directory by renaming to something like kde4.bak) the ~/.kde4 directory but this will erase all your personal settings. :( in KDE4.
So the next time you log in it will recreate this directory with fresh default settings.

A way to get your personalized settings back is to copy ~/.kde4/share/apps from the previous directory to the newly created kde4 directoy.

NOTE! :
copy only those folders whose data u need.

DevDailies Tech Blog

NAVIGATE

Cubics

PROJECT SHOWCASE

TECHNORATI

Latest @DevDailies

Categories

About DevDailies

Mozilla Raindrop Keeps Messaging Personal

Waver is a Compact Google Wave Client

Livebrush Makes Design Creation Simple

The XHTML Required for Rounded Corners

Four Rounded Corners

FILES

Blog Archive