How many toolbars can you add to IE7?

Funny idea. Find out why someone would want to do this.

Web 2.0 Attacks

A good article on the ways to attack a Web 2.0 application, thanks to the growing number of technologies used in "rich internet applications" (html, flash, applets, javascript, etc):

1. Cross-site scripting in AJAX. A pre-AJAX browser exploit, but AJAX makes it easier to hide such an attack.
   
2. XML poisoning. A denial-of-service attack that tries to exploit weaknesses in server-side XML parsers. Do something nasty like apply a recursive payload to an XML block.
3. Malicious AJAX execution. Some javascript that sits in the background, captures info from a server (e.g. the user has signed into their on-line bank account) and sends that info to a identity theft server. All done silently.
4. RSS / Atom feed injection. RSS is becoming a popular distribution mechanism. Since most people view feeds in their browser it becomes very easy to slip some malicious javascript into a feed.
5. WSDL scanning and enumeration. Looking at the exposed method interfaces of a web service a malicious person may be able to guess at ways to atack the interface. e.g. if you see a "debug" or "override" parameter you might be tempted to see what it does.
6. Client side validation in AJAX. For those people who define validation on the client side but are too lazy to do the equivalent validation on the server side, don't be surprised if someone breaks your application by making a malicious call directly to the server.
7. Web services routing issues. WS-Routing allows SOAP messages to travel in specific sequence from various different nodes on the Internet. Often encrypted messages traverse these nodes. A compromise of any of the intermediate nodes results in possible access to the SOAP messages traveling between two end points.
8. Parameter manipulation with SOAP. Try manipulating the values of the SOAP messages to do things like SQL-injection attacks.
   
9. XPATH injection in SOAP messages. ditto to the point above.
10. RIA thick client binary manipulation. An attacker can reverse engineer the binary file (e.g. flash .swf files) and decompile the code.

Update: DLG asked what are some guidelines to protecting against such attacks? Some of my thoughts are:

• AJAX calls only work cross-site if using iframes. As with javascript the browsers should pop us a security alert asking if cross-site AJAX calls should be allowed on the page.
• XML Poisoning / Parameter manipulation / XPATH injection. You should unit test a number of such attacks to see what happens. You may need to work with your vendor to fix any issues in the XML stack they provide.
• WSDL scanning. A code review should find any methods that should not be exposed to clients. What could make this tricker, however, is that many of the SOAP standards now use a document-centric approach, where the WSDL is a thin wrapper around an XML "blob" payload.
  

Chin up Rover!

It will probably never be a big selling item, but I liked the cute Doggy Car Window Head/Chin Rest I saw in the Newport stores while doing the tourist thing on the weekend. It's a ruff life. Woof!

Clippy gets ported to Linux

Clippy the Microsoft Office Assistant has inspired a Linux clone called Vigor. Need help with the evil six editor (VI)? No problem!

Fixing those AJAX Javascript memory leaks

One thing I've noticed with a number of the recent wave of AJAX applications is that they leak memory. For example, editing googlepages grinds my 512MB computer to a halt in 20 minutes of so.

Jack Slocum has a few tips on avoiding javascript leaks, including using the LeakMonitor Firefox extension, and points out leaks in common AJAX libraries like prototype.

Sarbanes-Oxley squashes IPOs?

Interesting story I saw on Power Lunch while working out at the gym. IPOs are down in Q3 in the US, but steady or up in overseas markets like Europe. The reason? Many business people are finding Sarbanes-Oxley requirements too onerous for listing on the Nasdaq and are preferring to take a company private or list on a UK exchange instead.

The future of Web 3.0: Thick clients?

The New York Times has launched Times Reader, a .NET thick client that provides a more faithful rendering of Times stories than can be achieved with a browser (so they claim), such as:

• the same font and column structure you see in the printed paper; and
  
• no scrolling necessary -- just use the arrow keys on your keyboard to turn the page

Can you do this with a browser? Depends on the browser :) The standard bodies have done there job with the CSS 3 Multi-Column Layout spec. Some clever people have created javascript hacks that display multi-coulmns for pure text. And the Mozilla dudes have preliminary support for multi-column content in the current production version of Firefox 1.5.

So which browser doesn't support multi-column layouts in a meaningful way? You guesses it, Internet Explorer. And font support tends to be operating system related. So why don't the NY Times push Microsoft to make Internet Explorer standards compliant instead of building thick clients that will only run on Windows?

(Lack of CSS support, including the upcoming IE 7, is still the biggest gripe I hear when talking to web design professionals.)

On a related note, what will our interface to the internet look like post-Web 2.0? Will it be thick clients instead of a browser? I guess I'm used to a browser, but the thought of having to learn a different UI to navigate each "web site" I access is frightening. Some of the Finetix UI experts I've discussed this with can only see AJAX + CSS in the near and medium term.