There are so many parallels between when I started at IDC and at Redmond.

A major difference this time is that I would be (mostly) coding in C++ rather than in .NET, so you can expect my posts to be more about my adventures with C++. In my opinion, C++ is like God with enormous power; if you are good (with your coding style and program design), it would reward you. But if you are sloppy with the way you code and anger the C++ God, it will make your life miserable (read understanding convoluted code and debugging).

I hope not to anger the C++ God anytime soon, so am reading up on how to be a better C++ programmer. Maybe I will learn a thing or two and post it here on my blog

The ramifications for this became apparent. Yahoo servers started sending out spam. I had no proof in the beginning but this post verified my suspicions. Spammers became aware of the golden opportunity and started abusing Yahoo servers to the fullest. This led to really tough times for the Yahoo Mail people and their PR guys as apparent from this post on Yahoo Mail Blog. Not only were the email servers overloaded, but ISPs started blocking mails from Yahoo servers which led to delayed/undelivered mails.

Now it seems that Yahoo has changed the way it routes emails through its SMTP servers. Earlier methods were quite trivial as the mail headers would have shown.
Received: from smtp104.plus.mail.re1.yahoo.com (smtp104.plus.mail.re1.yahoo.com [69.147.102.67]) by rly-ma08.mx.aol.com (v120.9) with ESMTP id MAILRELAYINMA088-8c647354bcb3bd; Sat, 10 Nov 2007 01:12:27 -0400
Received: (qmail 55018 invoked from network); 10 Nov 2007 06:12:27 -0000
Received: from unknown (HELO localhost) (myYahooID@myIPAddress with login)
by smtp104.plus.mail.re1.yahoo.com with SMTP; 10 Nov 2007 06:12:26 -0000

Gradually Yahoo started repairing its servers from the smtp11x.plus.mail.re1.yahoo.com series to smtp10x.plus.mail.re1.yahoo.com as the latter still worked for a long time without FROM address checks.

Now the mail headers are more complicated. It seems that Yahoo does some internal checks regarding whether the FROM address is valid and then only routes the emails.
Received: from n3.bullet.mail.ac4.yahoo.com (n3.bullet.mail.ac4.yahoo.com [76.13.13.29])
by mx.google.com with SMTP id d12si10680167and.24.2008.04.05.08.35.00;
Sat, 05 Apr 2008 08:35:01 -0700 (PDT)
Received-SPF: neutral (google.com: 76.13.13.29 is neither permitted nor denied by best guess record for domain of myYahooAddress) client-ip=76.13.13.29;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=neutral (google.com: 76.13.13.29 is neither permitted nor denied by best guess record for domain of myYahooAddress) smtp.mail=myYahooAddress; domainkeys=pass (test mode) header.From=myYahooAddress
Received: from [76.13.13.26] by n3.bullet.mail.ac4.yahoo.com with NNFMP; 05 Apr 2008 07:31:40 -0000
Received: from [68.142.237.88] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 05 Apr 2008 15:34:24 -0000
Received: from [216.252.111.166] by t4.bullet.re3.yahoo.com with NNFMP; 05 Apr 2008 15:34:24 -0000
Received: from [127.0.0.1] by omp101.mail.re3.yahoo.com with NNFMP; 05 Apr 2008 15:34:24 -0000
X-Yahoo-Newman-Id: 666616.8045.bm@omp101.mail.re3.yahoo.com
Received: (qmail 61052 invoked from network); 5 Apr 2008 15:34:24 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;s=s1024; d=yahoo.co.in;
h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:Message-ID: Date:From:User-Agent:MIME-Version:To: Subject:Content-Type:Content-Transfer-Encoding;b=1zOo54htnYlA5Gy3kNjQQVpRD8fYyEbgwwejDXI4Jr/RZ32+QDvvwYLxJOdSkbwWyJhA3P5PfBVX+mGGYePhw3TXtmfqdVSUcu/BGnwpyONzF3umcYLylkOzLBu/URre6lF+6gdEnRPsfIE3isy25r9dfELJke0wDDwqEdCEYg= ;
Received: from unknown (HELO Why?are?spaces?replaced?by??BTW?if?you?read?this?you?are?a?G33K) (myYahooID@myIPAddress with plain)by smtp103.plus.mail.re1.yahoo.com with SMTP; 5 Apr 2008 15:34:24 -0000

BTW I had told this to the Engineering head of Yahoo Atlanta during my internship interview here and he was surprised by this. Unfortunately I couldn’t demo this for him as Yahoo had started fixing this problem starting that day only.

So the next time you curse your service provider for yet another SMS to download a ringtone, remember that they could be actually gathering more data than it meets the eye!

Now I faintly remembered receiving 2 scraps (which obviously looked like Spam) from my friends and that I had deleted them promptly. Could it be a case of Cross Site Scripting? A blog article that I read today confirmed by suspicions.

Now in my previous post I had emphasized my belief that “All input is evil” and even though Google seems to do a pretty good job with Blogger, filtering out bad HTML and unwanted scripts; it has failed to do that with Orkut. Especially when it keeps adding more and more features to make the UI richer and interactive, the importance of such measures increases.

OK, I had a tremendous urge to call this post “Hacking Web Interfaces”. But due to some uneducated folks who believe hacking is a bad word, I think I will stick to its euphemism.

The most direct way to feed random data to a web-service is in a raw format. Use telnet for absolute low level communications or tools like Fiddler, for communications at a higher level like HTTP. But with sites hosting hundreds of script files and html pages on their server, this approach has become more and more impractical. But there are other means to mess with the client side code.

DOM Inspector

If you use Firefox, you will notice there’s a utility called DOM Inspector that is included with it. As the name suggests, it allows you to see the DOM of the rendered HTML page. But, it also allows you to modify that DOM. You can modify the values of the properties of different DOM objects in the tree and even insert new objects.

Let’s try this technique on a product of one of the largest software companies, Google Calendar. I will use no other software than Firefox and DOM inspector.

Let’s go to the Settings screen. They have a setting for the “Custom View” property for the calendar.

Now I am a guy who wants to know what he would be doing in next 2 months but there is no option for that kind of view. Hmm, lets see if the DOM can help us. Firing the DOM Inspector, we see that the logic is quite simple.

The value of the ComboBox determines how the duration for which the custom view display the calendar. The value in the ComboBox is simply translated to the number of days. So I change the value to 42 (which is 6 weeks) and save my Settings. Et voilà, I get a custom view with 6 weeks Cool!

Using Visual Studio with IE

IE has a script debugger built in, but it is worthwhile to go in for Visual Studio as the debugger of choice. There’s a free version of the Visual Studio suite called the Express edition available which you can download and use.

Now to make it work…

1. Enable Script debugging in Internet Explorer.

   

2. Create a New Solution with an Empty Website (File > New > Web Site…)

   

3. Go to Property Pages for the new Website in Solution Explorer and enter the URL you want to debug. Don’t worry if you don’t know the URL, just enter any URL and fire the breakpoints only when you hit the required URL.

   

4. You might get a dialog asking you to include the web.config file. Answer Yes and continue. Now you will be surfing with the debugger attached to Internet Explorer. You can hit pause, set breakpoints and even skip those functions that don’t interest you

Using Venkman with Firefox

I would have loved it if Visual Studio also worked with Firefox. There’s a solution called Venkman. I won’t go through the complete detail of how to go about using it, you can read it up here.

I haven’t found a way to skip code (a la Visual Studio) using this yet.

You can change variable values by directly typing the JavaScript code for it.

The interface doesn’t have all the bells and whistles but should be able to get most of your work done.

In this post I take a look at some ridiculously simple security blunders committed by popular sites. These might not always be critical but provide an interesting insight into the design quality metrics followed at these companies.

While surfing the Net, whenever I see a website offering a cool service, my natural instinct is to find out how they are doing it. For example, Rediff used to have this ActiveX based multilingual mail composition feature, which they replaced with a JavaScript based one. Cool! So now I could work on Firefox and still send my mail in Hindi! How (naively?) were they doing this? Create an IFrame and put the entire composition feature in it. Hmmm, OK, but couldn’t someone just rip off the JS files and create, say, a multilingual composition plugin for WordPress using their code. Access to the .js files doesn’t even require a login to the Rediff servers and using them is as easy as pointing the URL to http://f1mail.rediff.com/quill/QuillPadWeb.html. I am not sure what their testing team (if they have one) thought of this, but this allows someone to use the cool text entry interface by just copying 4 files off the Rediff site.

The easiest way to thwart leechers is to deny access to the scripts unless you are logged on. That would take care of direct linking (protecting computational resources). But there’s no easy solution if someone just copies the files off the server and hosts them on his website (protecting intellectual resources). What do you do then? Probably obfuscate the code enough so that he never knows what file he has to copy. Yahoo mail does an excellent job of the obfuscation. Even their images are protected (in a loose way) by referring them through their MD5 hashes; enough to deter a casual hacker.

Another flaw is doing all (and I mean ALL) the validation at the client side using JavaScript. Client side validation is a nice way to reduce load at the server end. But sometimes, this solution is implemented without safeguards.

While designing any API, there is a golden rule that has to be followed…


All input is evil

Agreed, you have JS to check and ensure that the user input is correct. But what if I inject code through your web service using a simple script debugger like Visual Studio for IE and Venkman for Firefox. Even if I am not able to inject code, I will certainly be able to inject syntactically valid input data which is still invalid. To illustrate, imagine a banking service where the amount that can be withdrawn is checked against current balance using JavaScript. I could very well skip the function, overwrite the function which gets the current balance and a lot more. Unless the server is checking the validity of the transaction itself, I would be able to make any kind of transaction.

In my next post I will discuss, some techniques that can be misused to thwart JavaScript based validations. The purpose of the post will be to further educate software designers about the pitfalls of client side validation which is not backed by robust server side validation.

One of the gripes I had about this was that I had to install Firefox for every Operating System (OS) that was there on my computer. So on my home computer which had Windows ME, Windows XP and Ubuntu, I had to install Firefox separatelyfor each of them. I could understand this as they were separate OSes and required different binaries for themselves. But installing all the Extensions and Themes for each and every OS was just plain irritating.

Browsing through www.mozilla.org I saw an article on Profile management in Firefox. Profiles allow different users to have individual settings for a software on the same computer. But this is not what I wanted to do. I wanted to use the same profile across different installations of Firefox, on different OSes, in my machine.

So how I did this was -

1. This step can vary but I will outline the simplest solution. Linux can access your mounted FAT or NTFS drives easily. So we would create the profile folder on a Windows partition and instruct Linux to read data from there.

   For this, locate the profile in Windows and note down the name like xxxxxxxx.default. It will reside  

   • On Windows Vista/XP/2000, the path is usually %AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default\, where xxxxxxxx is a random string of 8 characters. Just browse to C:\Documents and Settings\[User Name]\Application Data\Mozilla\Firefox\Profiles\ on Windows XP/2000 or C:\users\[User Name]\AppData\Roaming\Mozilla\Firefox\Profiles\ on Windows Vista, and the rest should be obvious.
   • On Windows 95/98/Me, the path is usually C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\xxxxxxxx.default\

2. Now for each of the other OSes, open up profiles.ini in a text editor. The file is located in the application data folder for Firefox:

   • On Windows Vista/XP/2000, the path is %AppData%\Mozilla\Firefox\
   • On Windows 95/98/Me, the path is usually C:\WINDOWS\Application Data\Mozilla\Firefox\
   • On Linux, the path is ~/.mozilla/firefox/
3. Change IsRelative=1 to IsRelative=0.
4. Change Path=<something> to Path=C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\xxxxxxxx.default\ (assuming that the profile that you selected in step 1 was in this location).
5. For Linux, set the Path according to the location of the folder in the mounted drive (Assuming the local mount folder is /media/cdrive your path will be /media/cdrive/WINDOWS/Application Data/Mozilla/Firefox/Profiles/xxxxxxxx.default)
6. That’s it! Your Firefox Extensions, Themes, Settings, Cache and History will be shared across all the operating Systems.

No wonder, people expect to have the same kind of anonymity while surfing the web through their mobile devices too. The mobile operator does give you a shared IP address. Though surfing through mobile phones is still very painful in India (3KBps download speeds aren’t that great), mobile Internet access through GPRS is becoming cheaper every passing month; Airtel offers a HTTP only package for just Rs. 99 per month which would encourage more people to at least try mobile web surfing. But cheap access doesn’t translate into secure access.

I always used to wonder how various websites like Yahoo, Rediff et al could get access to mobile subscriber data and charge them for their products and services. So I created a small servlet at http://www.myjavaserver.com/servlet/proteus.SmallFiles.WmlHead [Server is dead now]. And the results turned out to be shocking. I accessed the page from my friend’s phone and this is what I saw (the number was not masked, it has been done so to protect his privacy.

Host : www.myjavaserver.com

X-Wap-Profile : "http://wap.sonyericsson.com/UAprof/W700iR101.xml"

Accept-Language : en

Accept : application/vnd.wap.xhtml+xml, application/vnd.wap.wmlc, application/xhtml+xml, image/gif, */*, text/vnd.wap.wml

User-Agent : SonyEricssonW700i/R1CA Browser/SEMC-Browser/4.2 Profile/MIDP-2.0 Configuration/CLDC-1.1

Accept-Charset : *

Accept-Encoding : deflate, gzip

TE : deflate, gzip

MSISDN : 9198xxxxxxxx

WAP-Connection : Stack-Type=HTTP

Cookie : $Version=0;User-Identity-Forward-msisdn=9198xxxxxxxx;​User-Identity-Forward-ppp-username=void​;Bearer-Type=w-TCP;​wtls-security-level=none;network-access-type=CSD;​nas-ip-address=10.151.1.18;apn=airtelfun.com;imsi=404490016894720;​Called-station-id=airtelfun.com;​accounting-session-id=3D5FF84246578127;​accounting-authentication-method=2;​sgsn-ip-address=125.19.6.40

SCRIPT_URL : /servlet/proteus.SmallFiles.WmlHead

SCRIPT_URI : http://www.myjavaserver.com/servlet/proteus.SmallFiles.WmlHead

Remote Address : 203.145.131.158

Remote Host : 203.145.131.158

Server Name : www.myjavaserver.com

Protocol : HTTP/1.1>

This is from Airtel network in Andhra Pradesh, India. As one can see it is transmitting your mobile number in plain text as well as your mobile operator information to each and every website you visit. It also has your IMSI number which, about which Wikipedia says "In order to avoid the subscriber being identified and tracked by eavesdroppers on the radio interface, the IMSI is sent as rarely as possible and a randomly generated TMSI is sent instead.". This is potentially a great way for spammers to send you spam SMSs or track your surfing habits. They can put in a 0 X 0 pixel image on web pages and track you without you having to visit their site. Though much of this is what they can do through normal browsers on computers, here they can personally identify you through your phone number. You can visit the link given above to verify what headers you ISP is attaching to your outbound requests over GPRS. It is a WML page so even the oldest browsers should be able to open it.

It would be futile to even talk to your Customer Care guys about this, write to your ISP about this and ask them WHY they are exposing you to dangers which involve endangering your privacy. As a defence against this, you can use an anonymizing proxy like Opera Mini which will hide your information, but prevention is better than cure!

Source for the Java Servlet is available here .

Remember you need to access the URL with your Mobile phones , accessing through your normal browser will display the header information of your PC Browser. Also you need a GPRS connection that allows you to surf external sites and not just those of your service provider’s.


For the curious, I have also added a Java Servlet that displays the headers sent by your PC browsers here. The source for this one is available here.

XAML has this great concept of look-less controls. When we see a normal Win32 control like say a checkbox, we always assume that it will be a square box along with some text written to the left of it. Taking an example from our old friend WordPad, we would always expect a checkbox to look like

Pretty boring, if you would ask a kid (or even a teenager!). Even though it makes the control much more usable (which is a very important thing BTW), it doesn’t look cool. So how does WPF help us here?

For starters, when you define a control, WPF doesn’t force to you to define the look of the control along with the functionality. Here comes the concept of a look-less control; a control whose behaviour is defined but whose look is not defined. For instance, we might define the behavior of the check box (it has a bool or a bool? property called IsChecked, it has a check mark to the left of the content, etc… but leave it to the author to define the look for it. So we might have something like

How to go about doing this? This is all done by redefining the ControlTemplate for the checkbox. ControlTemplate is basically what it says, it is a Template for the Control and decides how the control will look like. To achieve such a look we define the Style of the Checkbox as

<Style x:Key="{x:Type CheckBox}" TargetType="{x:Type CheckBox}">
    <Setter Property="SnapsToDevicePixels" Value="true"/>
    <Setter Property="OverridesDefaultStyle" Value="true"/>
    <Setter Property="Template">
      <Setter.Value>
        <ControlTemplate TargetType="{x:Type CheckBox}">
          <WrapPanel Orientation="Horizontal">
            <Border x:Name="Border"
              CornerRadius="0” >
              <Image Name="CheckMark"
                      Height="{Binding ElementName=MyContent, Path=ActualHeight}" Source="happy.gif">
                <Image.BitmapEffect>
                  <OuterGlowBitmapEffect GlowColor="Blue" GlowSize="2” Noise=".1” Opacity="0.8"/>
                </Image.BitmapEffect>
              </Image>
            </Border>
            <ContentPresenter Margin="4,0,0,0" Name="MyContent"
              VerticalAlignment="Center"
              HorizontalAlignment="Left"
              RecognizesAccessKey="True"/>
          </WrapPanel>
          <ControlTemplate.Triggers>
            <Trigger Property="IsChecked" Value="{x:Null}">
              <Setter TargetName="CheckMark" Property="Source" Value="unsure.gif" />
              <Setter Property="BitmapEffect" TargetName="CheckMark">
                <Setter.Value>
                  <OuterGlowBitmapEffect GlowColor="Black" GlowSize="2" Noise=".1"
                  Opacity="0.8" />
                </Setter.Value>
              </Setter>
            </Trigger>
            <Trigger Property="IsChecked" Value="false">
              <Setter TargetName="CheckMark" Property="Source" Value="sad.gif" />
              <Setter Property="BitmapEffect" TargetName="CheckMark" Value="{x:Null}"/>
            </Trigger>
            <Trigger Property="IsMouseOver" Value="true">
              <Setter Property="BitmapEffect" TargetName="CheckMark">
                <Setter.Value>
                  <OuterGlowBitmapEffect GlowColor="Red" GlowSize="2" Noise=".1"
                  Opacity="0.8" />
                </Setter.Value>
              </Setter>
            </Trigger>
            <Trigger Property="IsPressed" Value="true">
              <Setter Property="BitmapEffect" TargetName="CheckMark">
                <Setter.Value>
                  <OuterGlowBitmapEffect GlowColor="Yellow" GlowSize="2" Noise=".1"
                  Opacity="0.8" />
                </Setter.Value>
              </Setter>
            </Trigger>
            <Trigger Property="IsEnabled" Value="false">
              <Setter TargetName="Border" Property="Background" Value="{StaticResource DisabledBackgroundBrush}" />
              <Setter TargetName="Border" Property="BorderBrush" Value="{StaticResource DisabledBorderBrush}" />
              <Setter Property="Foreground" Value="{StaticResource DisabledForegroundBrush}"/>
            </Trigger>
          </ControlTemplate.Triggers>
        </ControlTemplate>
      </Setter.Value>
    </Setter>
  </Style>

Let’s dissect this monster to see how it works

The first line

<Style x:Key="{x:Type CheckBox}" TargetType="{x:Type CheckBox}">

means that this is a Style being defined for Type CheckBox in the namespace referred to by x which is http://schemas.microsoft.com/winfx/2006/xaml in my case.

Moving on, the core part of the Style is in defining the ControlTemplarte.

 <ControlTemplate TargetType="{x:Type CheckBox}">

Note that I could have defined the ControlTemplate for the CheckBox using CheckBox.ControlTemplate but have chosen to implement it using a Style as it is quite common to do so.

It is in this ControlTemplate that I define the look of the CheckBox. Here I say that it should be a WrapPanel which should contain a Border which has an Image and a ContentPresenter in it. You can read more about the ContentPresenter in MSDN, it is just a UIElement which can contain and display any other object. The Image has a binding to the Height of the ContentPresenter so that it resizes automatically to the Height of the content, else you might have a case when you have text with FontSize 36 points but you checkmark is just 10 pixels high. That’s it! That’s the definition of our customized CheckBox; could it be any easier?

I added some Triggers to change the Image in the CheckBox depending on its state. I have added an image when IsChecked is null to account for a Tri State CheckBox. I also added some BitmapEffects for a Glow (just to make it more pretty!)

Go through the code, it isn’t very hard to understand or comprehend. Now whenever you wish your CheckBox to use this style, simply use it as

<CheckBox Margin="8” Style="myCheckBoxStyle">
    <TextBlock FontSize="20">Happy or Sad?</TextBlock>
</CheckBox>

If you find this article useful, do comment and let me know

We start from the basics of the problem to solve it (college taught me something didn’t it ) How does Yahoo know i am not using Windows XP ? Answer is your user agent , the browser communicates your user agent to any site you access. Any workaround?

In Opera : No easy way, but in Firefox one can edit the useragent easily and that’s what’s going to help us.

Step 1 : Backup Everything , Although the step doesn’t involve anything risky AFAIK, I still tell you to backup and release myself from liability. In this case just remember the key value that you are going to edit or even better make it blank!

Step 2 : Type about:config in your address bar

Step 3 : Right Click on any entry, Select new string and enter string name as ‘general.useragent.override’.

Step 4 : Take Your Pick Mozilla Firefox versions from http://en.wikipedia.org/wiki/User_agent#Browsers or just use

 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0.1

You might want to replace the version at the end to suit your version of Firefox.