Greasemonkey Insecure

Update: There’s a neutered version available until this bug can be fixed. Thanks to maca for pointing this out in the comments. I should also add that the maintainers are doing a great job sorting this problem out.

Since I’ve spouted here about the virtues of the Greasemonkey extension for Firefox, I should probably point out that, as of right now, Greasemonkey is completely insecure. That is, if you have it installed you should uninstall or disable it. I’m not kidding. There’s already a proof-of-concept exploit that demonstrates that any page that you run a Greasemonkey script on (which usually means any page at all since Greasemonkey scripts execute on all pages by default) can access any file on your computer and send its contents to any server.

Uninstall Greasemonkey altogether. At this point, I don’t trust having it on my computer at all. I would think that whoever is in charge of addons.mozilla.org should immediately remove the Greasemonkey XPI and post a large warning in its place advising people to uninstall it.

— Mark Pilgrim

Flu

Well that was a particularly unpleasant weekend. Either I had the flu or I suffered a ludicrously strong negative reaction to watching The Royal Tenenbaums on Saturday.

Goodbye Dunstan

One of the side effects of using a news aggregator over the more traditional brute-force approach of checking hundreds of sites every day is that you tend not to notice when someone stops posting. That’s how it was when Dunstan Orchard‘s posting slowed to a trickle earlier this year and then stopped completely in March. I didn’t really notice until he posted his last hello and goodbye today, saying that

I’m going to stop posting to this site. I just don’t find the time to write for it anymore, and it’s rude to keep making people check for updates which never appear.

Dang. On the plus side, this cloud has some sort of shiny lining that, on closer inspection, appears to be silver. He has packaged the entire contents of the site, from the database to the server-side code to the HTML and CSS and all of the images, into a zip file for wannabe-Dunstans to download and pore over in geeky adoration.

I think I said it before, and I may well continue to say it long into the future, but Dunstan’s blog is quite simply the best-designed blog, possibly the best-designed website, I’ve ever seen. No-one I’ve heard of can come close to his combination of visual design, interface design, client-side scripting, and server-side programming. Just look at the site for a few minutes. Aside from the stunning visuals, there’s the colour-coded linking of related comments; the live search box, which shows results as you type; the three selectable sidebars; and, to (literally) top it all off, the scrolling panorama with up-to-date weather, moon, and daylight conditions. Just wow.

Pruning

I’ve known this day would come for years, but I never quite admitted it to myself. My iPod is full. I bought it two years ago and even then it was the smallest available, at only 10GB.

So now I have to sort through all of these gigabytes of mp3s looking for the ones that I don’t expect to want to listen to all that often. And you know what? Theres an awful lot of stuff on this thing that I just reflexively skip right past. I’ve culled over 200 tracks out of only about 2100, and I think I could lose about a hundred more if I needed more room. I had been allowing music to build up on my computer like a plaque, some of it so bad I just deleted it rather than remove it from my playlist.

I guess in a few months I’m going to have to come up with something more scalable than large-scale deletions. Maybe a way to rotate tracks, swapping my less frequently played music around at every update. Or maybe a new iPod. 60GB would last a while. How has anyone else solved this problem?

Commenting Fixed

Thanks to Jamie for telling me that commenting was broken on SoylentRed for the last week or so. I don’t think I would have noticed too quickly, since I don’t tend to comment until someone else does (obviously). It seems the bug was in some code that I wrote before I knew much about database programming, and it surfaced because I altered the entry database table slightly a little over a week ago.

If anyone would like to draw a lesson from this, it would be that you should not use select queries of the form select * from [...]. Always include the field names in the query, even if you’re requesting every field in the table. That way you can add or re-order fields without changing the code.

Anyway, it’s fixed now. As always, if you find any bugs please email me. There’s a contact link on every page.

Funny. Welcome. Crash

Just lost a long-ish post to that stupid Firefox flash crash bug. Here’s the gist of it: Funny. Welcome.

Okay, it may not be fair to be that brief. That first link is a video of some brilliant maths humour. Check it out if you’re in the 0.001% of people who might think it’s funny. The second link is to a new blog by a friend of mine. Joe was one of my (very few) classmates back in the old theoretical physics days.

The Hunger Barrier

There’s no nice way to say this: The world’s richest countries are deliberately, and as a matter of policy, promoting poverty and starvation in the world’s poorest countries.

That’s a quote from Tim Bray’s The Hunger Barrier, posted back in 2003. He goes on to describe the ridiculous lengths that governments go to to ensure that the poorest people of the world can’t get a break. They’re unable to trade because we just can’t bear to force our farmers to compete honestly.

Yesterday’s concert was performed for a purpose: to create and maintain awareness of world poverty. It’s only fair that, in exchange for such a great free concert, we hold up our side of the deal and make sure we know what’s going on. A good way to start is to read that article. Of the three main aims of the Live 8 organisers (increase aid, cancel debt, and make trade rules fair) guess which one isn’t going to happen? Let’s just hope that, eventually, we can make it happen.

Wish I Was There

I spent pretty much all of yesterday in my sitting room wishing (more than usual) that I was in London. Specifically at Live 8. Despite the cynics and the people who didn’t want to be there, I would have loved to see that concert live. Didn’t The Who just kick the big giant ass? If We Won’t Get Fooled Again was the only song played in the whole 10-hour gig it would have been worth it. And Pink Floyd, and R.E.M., and… Man I’m going to be griping to my grandkids about having missed this.

TODO

No, this isn’t another SoylentRed todo list. I have enough of thse already and I have no desire or time to work on Scatterbrain right now. What the title refers to is a tiny but surprisingly cool feature of kate, the KDE text editor I’m using for my current project.

I was rushing through trying to get some features written today in time for our review meeting tomorrow morning. Since I was in a hurry I wrote skeletons of much of the code and I left hooks and function prototypes all over the place with little notes reminding myself what to put there when I have more time.

Brilliantly, when you put the word "TODO" in uppercase inside a code comment kate will highlight it so that it’s easier to find later. Like I said, this is a tiny feature but it’s so cool I stopped typing when I saw it and showed to a few other interns in the lab. It works in kdevelop too. I wouldn’t be surprised if kwrite did this as well, but I can’t check since I have no KDE applications installed at home.