Happy Birthday Google (12 years old) !! :-)

Today google celebrates its 12th birthday! Started in the year 1998 by two stanford guys in a garage, google has been the one thing that has transformed the whole world. Began as a search engine, today they work on almost all the cutting edge technology in the world (rather they invent most of the cutting edge technology).



Google has really become an integral part of almost all of our lives. Google co-founder Sergey Brin's dream when he initially thought about google was to "download the entire internet in his computer" and thats what they have achieved today!

As some rightly say, "when a noun becomes a verb, technology has really matured" and thats exactly what google is.

Happy Birthday Google !! May you make the life of more and more software engineers easy day by day !! :-)

Do you have a google moment to share ? Do it in the comments :-)

-Vignesh

Bom Sabado - The orkut virus !!

If you are still one among those who give a damn about orkut, then this might be one thing that your really care about. Today, orkut has been hit by a vulnerability that is really a security threat for your account.



The virus is called "Bom Sabado", meaning "Good Saturday" in portugese. This is yet another XSS attack, thereby making it the second XSS attack on a major website this week. Earlier this week, Twitter faced a similar attack. There is no official update from google yet on this issue.

What does it do?

When you open orkut and if you are affected by this virus (which could be possible if one of your friends are already affected), a piece of javascript will automatically run doing the following:

• Makes your browser hang for a moment


• Adds you to the attacker's communities (orkut equivalent of facebook fan pages) without your consent


• Sends a scrap (orkut equivalent of facebook wall) to all your friends without your consent, with the text "Bom Sabado" and a piece of code that will do the same set of actions when your friend log in to his/her account

How to prevent this?

• Unlike the twitter XSS attack, this is a severe one that steals your cookies and thereby impersonate your session. If you have logged in to orkut anytime today, clear your cookies and cache of your browser.


• To be safe, change your google account password and security question. To do this, go to https://www.google.com/accounts


• Do not visit orkut until google officially says that they have fixed it. For updates, keep looking here


• If your account seems to be behaving crazy or if its totally compromised, then see here for a solution.


• Delete your orkut account and join facebook !

I badly want to use orkut now!

If you badly want to use it now, then you can use this minor hack to do that. The virus seems to be loading the malicious javascript code from tptools.org and hence you can tweak this to point to something else in your hosts file.

Edit your hosts file (Windows - C:\windows\system32\drivers\etc\hosts; Linux - /etc/hosts) and add the following lines: 127.0.0.1 tptools.org
127.0.0.1 www.tptools.org
This tweak will make tptools.org will to resolve to your own system and hence the javascript will fail to load. Note that you are at your own risk, i am not responsible if your account gets compromised even after you make this tweak !!

I will try to update this post once there are some official responses from google.

-Vignesh

Random Thoughts !!

Today has been a really depressing day and i thought i will feel better if i write about something. Its really odd hours and i am wondering why i am sitting and typing something which, most likely, no one might even bother to read. But still, ever since i started writing my blog, it is one thing that i have been really obsessed with.

I know this post will not make any sense as i just wanted to get over time and scribble something. Here are some random thoughts that i have had about my blog ever since i have started writing it.

• I first started writing the blog inspired by one of my college senior varunkumar. You can visit his awesome blog here


• At the first thought, there were a few questions within me that will naturally arise to anyone who wants to start a blog. At first, i answered these questions myself as follows:
  
  
  
  • What will i write about ? - Some personal stuff and some technical stuff and hence i decided the description of this blog to be “From geekiest to craziest”
  
  
  • Who will read my blog ? - I thought of targetting my twitter/facebook followers initially and since then, i have been updating about my blog posts in facebook and twitter.
  
  
  • What do i get out of writing a blog ? - I did not know the answer for this initially. But now, i have figured out that every time you keep the last full stop on your post, you feel the immense pleasure of being able to convey something that people will really read ( and also that you have written something that google will really show in its search results !! )
  
  
  
  


• The name of my blog, as many might not understand it. “Je L’ai Dit” means “I Said It” in french. I have described about this in the “who am i” page of this blog. Anyways, its just a small denotion that whatever the content of my blog is, i am totally responsible for creating it.


• My blog is powered by wordpress and i use the theme InSense.


• My bad (or good) luck, google started denying adsense for sub-domains a week before is started my blog. Adsense terms now states that you can apply for adsense only with a top level domain and not a subdomain.


• As many might have not known, my blog has an alias URL http://www.jelaidit.co.in

As i said earlier, this post really does not makes much of sense, but it really has helped me to get my mind of out other things and given me a peace of mind. I really love my blog and i really love writing. Thanks to all you guys who have been keeping my blog going.

P.S.: I am not posting a status update on facebook/twitter about this post as it doesn't make sense.

-Vignesh

Twitter onMouseOver Saga - XSS and much more !!

There cannot be a better time for me to write about XSS as the famous twitter recently came across with an XSS vulnerability that was exploited by many all around the world by forcing users to redirect to some illegal site or post/retweet stuff without their consent, etc. What the hell was wrong with twitter ? Why did all this happen ? In this article, i have tried to answer these questions.



First let us be clear with the terminology. XSS stands for Cross Site Scripting (It is not called CSS because CSS already refers to Cascading Style Sheets). XSS is a way of injecting malicious code into a web page so that the users are troubled, user data is stolen, etc. If you don’t understand what that means, read along, you’ll understand it by the end of this article.

Before going into XSS, let me give a brief introduction about what Client Side Scripting is. Client side scripting (I don’t want to abbreviate this as it will again end up as CSS!) is nothing but a piece of code that gets executed within your web browser. When you open a website, the website is rendered as HTML along with some Client Side Scripts. For example, you click on a piece of text and a pop up appears saying “hello world”, then it is a simple script that has been run within your browser. An example of a client side scripting is JavaScript.

JavaScript can do things like redirecting the user to another website, accessing personal data (in the form of cookies, etc.) and much more. Twitter gets data from the user (in the form of status updates) and displays them in your timeline. Since client side scripts are nothing but pieces of code embedded along with HTML, the displaying part of twitter has to be clever enough to distinguish scripts and escape them (a simple example of escaping is to replace > with &gt; and < with &lt; as that will avoid the browser from misinterpreting data posted by user as an HTML tag - another simple example would be using printf(“\\n”) in C to literally print \n in the screen and not a new line).

Similarly, JavaScript code has to be escaped properly before being displayed or else there is a possibility that the browser will misinterpret the data posted by the user as JavaScript and start executing it which might cause potential damage. If the escaping is not done properly, then the attacker (usually the person who is always one step ahead of the developer) will be clever enough to exploit that display method to inject malicious JavaScript code to cause damage. Such an improper display mechanism is known as a XSS vulnerability and the attacks exploiting XSS vulnerabilities are known as XSS attacks. Twitter faced one such attack two days back.

Now to better understand how XSS attacks are performed, lets call our friends Alice, Bob and Oscar for help. So the following sequence of steps explain how an XSS attack is performed:

• Bob hosts a website (in this case www.twitter.com) where users are allowed to make posts


• Bob's website has an XSS vulnerability (in this case the javascript onMouseOver function vulnerability)


• Alice and Oscar are users of Bob's website and Alice can view updates posted by Oscar (in twitter lingo, Alice is following Oscar)


• Oscar spots the XSS vulnerability in Bob's website and decides to exploit it. So he makes a post that exploits the vulnerability (in our case redirect the user to some illegal website when he moves the mouse over the post)


• Alice eagerly opens Bob's website and is redirected to a totally unexpected website as she accidentally moved the mouse over Oscar's post (to be worse, while her mom is watching from behind ;-))


• There is also a possibility that Oscar can exploit the vulnerability and steal Alice's session information (cookies) and impersonate Alice


• Thus, Alice is screwed (as always) !!

It is really bad that a website in the scale of twitter had such a vulnerability. But after all, no product is perfect. An official blog post from twitter said that this bug was created as a result of fixing some other issue. I personally feel that a company like twitter cannot afford to give such a lame excuse for it could have caused many celebrities profiles to have posted spam tweets and much more damage. Nevertheless, sites like twitter, facebook, etc. are the primary target for attackers these days and hence security precautions always has to be the number one priority.

Read more about this on twitter's official blog here.

-Vignesh

Experience in Express Avenue Mall :-)

I came to express avenue mall with my friend santy for a second show movie at Escape Cinemas (Inidhu inidhu at screen weave - 10.00 PM show). I'm writing this post as we came a bit early to the mall, we entered the arena around half an hour early than the scheduled start of the movie. This is the first time I am seeing a cinema hall totally empty before a show. We clicked a few pics of the brand new escape theatre interiors.

A few quick facts that I've known/observed about Chennai's newest mall.

• Express Avenue mall claims that it is the biggest mall in southern Asia (though I'm not sure about how true is it as I've heard that ambiance mall in gurgaon is bigger).


• As with any other mall in chennai, all the shops are heftily overpriced and as a result whole of the weekend crowd bombards the relatively inexpensive food court (as food is costly almost everywhere in chennai these days) which creates a moor market like atmosphere in here.


• Almost all the adult girls come with a pair and many gangs of guys can be seen. So, if you are a single guy and you came here looking for girls, clearly your are in the wrong place.


• Weirdly, this place doesn't have much places to sit and spend time (even very limited sitting places available seem to be occupied always) and hence this is not a place to come when you're tired.


• If you are planning for a gathering here and its the first time you're visiting, then make sure to define a good meeting point, as even the mall security doesn't seem to know the gate numbers properly.


• Don't forget to note the area code and the color code of where you park your bike or else you are sure to spend a solid time searching it. And I think the same holds for cars too.

Overall, this is a good place to visit once in a while. Especially, it is good to visit here on a weekday to avoid the crowd. Chennai atlast has a mall that has international standards (really!!).

Visited Express Avenue Mall before ? Share your thoughts about it on comments.

P.S.: This is another post that is keyed in using swype. :-)

-Vignesh

Swype - The next generation of text inputs !! :-)

People following me in twitter, facebook or my blog would have known that i recently joined the android community with the purchase of my htc wildfire. Ever since I bought my phone, there is this one thing that I'm madly in love with. It is supposed to be the next generation of input system for touch screens. With a simple tagline "Why type when you can swype", it is really one of the most amazing technologies I have ever seen in my life.

When I first got my phone, being the first time of using a touch phone, I was really happy about the basic touch input that is built in with android as it had a really nice auto corrector and I just needed to key in the text very very approximately. But the moment I installed and started using swype I never turned back. In this article I will be sharing an overview about what swype is, how to get swype for various smartphones and a few alternatives to swype.

What is swype ?

Swype is the most recent innovative technology for text inputs in touch screen based systems. Just like we have the T9 input system for traditional mobile phones, swype is for mobile phones with touch screens. In T9, there are either 3 or 4 characters assigned to a single numeric key and to key in text, you just have to press the correct combination of numbers associated with those particular characters and voila you have the text you wanted keyed in very easily. If there are multiple words possible for a particular combination then you choose the right word you wanted by either pressing the "*" key (in traditional nokia phones), or by pressing the down arrow (in sony ericsson and irritating motorola) or by pressing the "0" key (in the unconventional samsung phones). Once gotten used to, you will feel that T9 is the best way to key in texts in a mobile phone. It is indeed true and people even type without seeing the screen like we do in computers.



Swype is a similar technology for touch screen mobiles. In swype, instead of tapping each and every character in the qwerty virtual keypad shown in the mobile, you just have to elegantly trace through the path of the word you intend to type. Similar to T9, if there are multiple words in the path you traced, swype offers you the list of possible words for you to drag it into the input. You can be very approximate in your path trace yet swype recognizes your word almost perfectly all the times. Though it might sound simple and not very appealing at first, on using it you will realize that almost 90% of the words you type in have unique paths and hence, unlike T9, you very rarely will come across the ambiguous word choosing pop up.



Who can enjoy swyping ?

• Android
  
  • Swype comes as a default input method along side touch input in many android devices.
  
  
  • If it doesn't come preloaded in your android device, then you can get the official swype beta from http://beta.swype.com. The official beta is closed now but you can download it through someone who has already registered with the beta was open (yes, it is legal to get any number of copies with a single registration! - and don't contact me as I didn't register when the beta was open).
  
  
  • If you didn't register for the official beta when it was open and don't know anyone who did, then this is the option for you. Download the apk file from some other source and install it in your device (which is what I've done in my phone). I am not posting any direct links here owing to legal reasons. It is available easily in 4shared.com. Find out the type of display your device has (VGA, QVGA, HVGA, etc.), download the appropriate version and install it.
  
  


• Windows mobile
  
  • Few devices with windows mobile comes with swype preinstalled. I am not familiar about other options of getting swype for windows mobile.
  
  



• Symbian
  
  • Swype has partnered with symbian and recently released a public beta for S60 5th edition based symbian phones (nokia 5800, 5230, 5233, N97, N97 Mini to name a few). You can download and install swype for symbian from Nokia Beta Labs. All the installation instructions are also briefed in that page.
  
  
  • One drawback i faced with swyping in symbian is that, most of the symbian devices have less sensitive resistive touch screens when compared to their capacitive counterparts in android devices. Although, it is convenient to swype with nails in the symbian devices which is not possible with the capacitive based android devices.
  
  

When is swyping easy ?

• When you are just done with a call and your phone is slightly wet out of your cheeks


• When have completely dry hands after a long rest of hands (e.g. after a sleep)

When is swyping not so easy ?

• When you have just washed your hands and wiped it dry using a kerchief/tissue


• When your hands are wet of course


• If your fingers are a little bit bigger, then you may have to switch orientation every time you key in text

Alternatives to swype

Every emerging technology is never unique these days. There are always multiple implementations of a single technology and swype is no exception. Here are a few alternatives if swype that I have tried out.

• Dasur SlideIT Keyboard
  
  
  • This is the best alternative for swype I have seen so far. I was using this before I could figure out swype installation in my device.
  
  
  • One feature that it had and swype lacks is shortcuts. You can store tiny shortcuts for frequently used lengthy words.
  
  
  • The dictionary is no where close to swype's preloaded dictionary of 60000 words. Although, many language packs are additionally available for free.
  
  
  • It is available for all major smartphone platforms (android, symbian, windows mobile and even for windows ce). It can be downloaded from the official market of your smartphone ( android market, ovi store, etc. ).
  
  
  • For more details visit here.



• T-Swipe Pro
  
  
  • This is a swype alternative that is available only for android devices as far as i have explored.
  
  
  • It is a stable piece of software that is terribly slow in recognizing what you swipe.
  
  
  • The trial version shows you irritating pop ups asking you to register for full version which is definitely not worth upgrading to.
  
  
  • If you badly want to swipe and both swype and slide it key board doesn't work in your device ( which is a very rare case ), then this may be your final destination. I am damn sure you need the patience of handling a tortoise to use this.

To conclude, Swype is definitely one of the major breakthroughs in mobile technology and I am pretty sure that soon enough, swype will be the de facto standard for text input in touch screens. Hoping to see more and more OEM installed swype devices soon.

Note:
This article has been composed entirely in a mobile device using the following input systems:

• This note is keyed in using the traditional touch input system for android


• The section about SlideIT Keyboard was keyed in using SlideIT Keyboard itself


• The section about T-Swipe Pro was keyed in using T-Swipe Pro itself


• The rest of this article was keyed in using none other than swype itself :-)

P.S.: Thanks to AK Notepad.

-Vignesh

SMS - Talk through mobile from facebook !! :-)

Various application layer protocols always impressed me. Especially HTTP, as my understanding about it has been pretty good. There has been one thing that i have been doing pretty good, site scrapping.

What is site scrapping? Defining it is very simple. It is the process of extracting some information from a website that has complex interface (with flash, ads, etc.) and using that information for our own purposes. Though scrapping many websites (especially government ones) may be illegal.

Here is one such application that i have developed. This application is purely a brain child of the HTTP i have understood. It provides an interface to the famous Free SMS Gateways in India 160by2 and way2sms through a facebook application. It has been one of the dead works that remained uncared for a long time. Now that i have a decent amount of online presence, i have refined it and trying to popularize it through my blog (should i call it blogvertise ?).

Using this application is simple. Register yourself at Way2SMS or at 160by2. Goto http://apps.facebook.com/smstalk. Add your account here and you are good to go. Though this application is not a big feat, it just provides a simple and clean interface (exposed as a facebook app) for the ad clustered interfaces of the famous free sms gateways in India.

Here are a few screenshots:






Share your opinions/suggestions in the application's wall here or in comments.

-Vignesh