yasmar.net

Fun with Google July 10, 2007

So according to Google, the correct way to indicate that a page has moved is to serve a HTTP 301 response. Great but what about those of us using ISP storage?!?!?

I’ve noticed two things that I’ve taken steps to try and fix. The first is that the old blog comes up in search results but the new blog doesn’t. I have updated all the old blog pages to point to the equivalent page on the new blog. I can’t do a 301 but with the links in place the new blog should get seen by Google. I’ll retire the old blog eventually but I wanted to give it some time so that people can update bookmarks and such.

The second thing I’ve noticed is that adding in all the feed links means the feed .xml files are coming up in Google results. Yuck. I’ve added rel=’nofollow’ to all of the feed links to hopefully prevent this. I don’t have access to robots.txt on either of my blog sites so I can’t fix it using robots.txt (again, the “correct” way is not possible).

Given the time it takes to update Google’s cache I’d say the old blog will have to stay up for at least a few more weeks. Luckily I haven’t changed ISPs so there’s no hurry to do that but it’s still annoying to me that I can’t fix it properly.

Update 17 July 2007

That’s… interesting.

With just my redirection bits stuck into my old pages Google has shifted over to my new location on blogspot. It’s as if I had included 301s except that I didn’t.

So if you want to move a page in Google and you can’t put up a HTTP 301 page, put content like this on instead.

This goes in the header, it redirects automatically (for most people anyway).

<meta http-equiv="refresh" content="5;url=NEW_URL">

This goes in the body. It gives people a real link to click if the redirect doesn’t work.

You will be redirected to <a href="NEW_URL">NEW_URL</a> in 5 seconds…

At least… that’s what I used. Ensure that you do this for every page and ensure that NEW_URL is set correctly. I used a quickly hacked-together perl script to tweak all my HTML files to have this.

A note on contacting me July 10, 2007

My blog used to have my email address on every page but it was down the bottom and I think most people missed it.

Since I enabled comment moderation, leaving a comment is equivalent to emailing me and as long as I don’t publish the page the message remains private.

I’ve tweaked the text that appears on the comment page and even created a page specifically to indicate private comments (then linked to it from the sidebar).

So if you want to contact me, don’t try to figure out what my email address is, just use the “contact me” link in the sidebar.

How I overcame chronic onychophagia July 10, 2007

That’s the medical term for nail biting. In my case, extreme nail biting. The picture on Wikipedia is tame compared to what happened to my fingers. The only thing that would ever stop me is sheer pain. Raw, bleeding fingers so sore that I could barely touch things. According to Wikipedia the triggers for nail biting are nervousness, stress, hunger and boredom. I’m pretty sure that I’ve bit my nails due to all of those.

So… it’s been 3 weeks now since I last bit my nails. How did I do it?

I’ll start with the background because it’s important (and helps explains why this isn’t a generic solution for other people).

When I was young I had an accident on a skateboard and chipped my front tooth. It’s just a small chip but it looks odd so I got a porcelain filling for it.

Some years ago the filling fell out. I can’t remember clearly but I think it was because I was biting my nails. Anyway, at the time I didn’t get it put back in because I figured it would just fall out again.

A few years ago I got the filling put back in for Bree (who didn’t like me with a chipped tooth). She had never liked me biting my nails and I knew she’d be pissed if I broke it again.

3 weeks ago, something bad happened. I have been under extra pressure at work which was causing me to get really extreme. By this I mean that I had to have several band aids on each hand to stop bleeding. On Saturday morning I was chomping away and heard that crack. Sure enough, the filling had come off. I sheepishly showed Bree and she wasn’t happy but also didn’t want the chip to hang around so I got into the dentist that afternoon to have a new one put in. At $200.00 (before private health insurance) it’s not the kind of cost you want to incur on a regular basis and thanks to some unexpected bills and stuff it was enough to strain our finances for that month.

So I promised to try and stop biting…. but it didn’t work.

I was driving to work on Monday. I hit delays which is pretty typical for my morning commute. So there I was sitting in traffic when I heard that crack… I wasn’t even aware I had my fingers in my mouth! My brand new filling was now out. I knew Bree would be pissed. I was so scared I delayed going to work and stopped at a chemist to pick up a big pack of gum and that yuck tasting nail polish stuff. I couldn’t get in to the Dentist until Tuesday afternoon but I was lucky because Bree works Monday and Tuesday so she wouldn’t be home to see me.

That’s the point at which I was cured. Seriously, the thought of biting my nails is no longer appealing at all. I’ve been chewing gum and wearing the nail polish but I don’t think they’re actually doing anything.

So I went down on Tuesday afternoon to the Dentist. He was so nice and sympathetic to my plight that he did the procedure for the private health insurance refund only. That meant there’d be no trail of evidence for Bree to find. Of course, I knew Bree would find out eventually but I wanted to delay it as much as possible.

As you can probably guess, Bree knows now. I suspect the lack of a bill helped to prevent her from going nuts, as did the fact that I haven’t bitten my nails in weeks.

So yeah… it worked for me but unless you’ve got a chipped tooth and a wife you don’t want to piss off you might have a problem reproducing my result.

After 3 weeks my fingers are almost normal now. I’m not sure that I’ll ever be able to tolerate “long” nails (that means more than a millimetre of white bit) but at least now I’ll wait till I get home and use my nail clippers.

According to the nail polish stuff I should wait until I’ve been clear for 3 months to be declared cured but as I’ve said, I don’t think it’s doing anything. I mean… it gets on the food I eat which is annoying but my fingers just aren’t getting to my mouth so the thing it’s designed to stop (unconscious biting) isn’t even happening.

Using Conditional IE tags in Blogger Templates July 5, 2007

For some reason I can’t figure out, the “Search this blog” function in Blogger is implemented using ActiveX (at least when you use IE to view a blog). If like me, you care about security and have disabled ActiveX this poses an obvious problem. I whipped up a 2 line form that lets you search without having ActiveX enabled and made it conditionally show only in IE.

The problem is, it didn’t show up at all!

I have conditional comments to load up IE-specific CSS fixes… so why didn’t the same tags work in the body? I looked again and noticed that the content didn’t even show up in the page source… it looked like Blogger was removing the comment (instead of letting the browser do it). I had already encountered a problem with Blogger and conditional tags so it didn’t surprise me that something odd was happening.

So there’s 3 thing you need to know about conditional tags in Blogger templates.

The first is that downlevel-revealed tags (<![if !IE]>HTML<![endif]>) don’t work at all. Blogger chokes on these because I guess they aren’t valid XML.

The second is that comments, including downlevel-hidden tags (<!–[if IE]>HTML<![endif]–>), are removed by Blogger if they are inside widgets. Since HTML is only allowed outside of sections and inside widgets that means you need to arrange the conditional content to live in one of these areas.

For me it was easy. I’ve got a positioning div for the sidebar on the right. I have a section that holds the widgets that make up the content of the sidebar. I had originally put the search box inside the first widget but that means Blogger removes the content. Moving the content above the section (but still in the positioning div) makes it appear at the top of the sidebar.

Now if I’d wanted it in the middle of your sidebar… that can be done but you have to close the section and create another one after the conditional stuff. For me that’s a problem because sections have to have unique IDs and my CSS styles the sidebar based on id rather than class. Mind you, that’s just a tweak to the CSS to fix. I tested it out and it works. It makes the GUI layout tool a bit strange to look at but then I only use that to edit widget settings, my template is all hand-crafted.

The third thing you need to know is that blogger magic doesn’t work inside conditional comments. Outside of sections they’re not stripped from the output but the Blogger engine doesn’t look inside them. I’m constructing the search form’s action field using the expr: notation but since that doesn’t work with conditional comments I’ve had to change it to just be inside a div that’s display:none for all except IE. I suppose I could have hard-coded the blog URL in there but I don’t like doing things like that.

Why user scripts are a bad thing July 4, 2007

So Heritage uses a substitution cipher to protect the password. I thought they used a hard-coded substitution key… perhaps they did originally (back when I first looked at the code) but they don’t any more. Of course, since my current method of defeating the onscreen keyboard relies on having access to the JavaScript engine I hadn’t noticed this (the variable has the same name, just a different value). Not counting user scripts (and JS engine exploits) that probably makes the Heritage system as secure as it’s reasonable to make it.

It seems there was a big hole found in Greasemonkey where it let remote sites take hijack the Greasemonkey bits to do bad things. They re-architected it to prevent this from happening but I don’t think Creammonkey/Trixie/Konqmonkey did this. Mind you, these systems were always more basic than Greasemonkey so perhaps it’s not as issue there. What I don’t seem to see though is any sort of protection for web sites from user scripts. These extensions are punching a hole through a security barrier and allowing arbitrary code to run. However, how do you know that the user really installed the script and that a trojan didn’t just put it there or modify the file on disk?!?!?

An example of the evil things that could be done by an evil user script:
1) redirect from the login page to http://myevilsite/username/password and go through the server logs to pick up usernames and passwords.
2) override the values the user entered when registering a new BPAY/inter-bank payee (so that all future payments go to Mr. Evil instead of the intended recipient).

Using this would mean that stealing the password is useless but it doesn’t stop the other bad things a user script can do. I suppose at this point you have to just kind of assume that user scripts won’t do evil things.

We need a dish washer July 4, 2007

With the kids eating our food we now go through all of our dishes every day. Gone are the days when I could leave the dishes for a day or two. I think we need a dish washer. I asked Bree and she agreed so now we’re looking for one.

There’s a catch though. We don’t actually have room for a dish washer so we’re going to need one that can be moved into place, run and then put back away. It’ll sit in the corner when not in use but that’s too far away to remain permanently connected. It’ll need to plug into the sink so we’ll need to get some plumbing work done.

I reckon it looks like most (but not all) dishwashers are suitable for standalone use. Some need a kit to adjust their weight so they don’t fall over. We’ll want it on wheels too.

The plan is to head over to somewhere like Harvey Norman to see what machines will suit (online research doesn’t seem to lead anywhere) and then see what we like the look of.

An interesting phone call… July 2, 2007

I had an interesting phone call this afternoon. It seems that Heritage has taken notice of my little hack. I spoke with a guy called John (who’s the General Manager of Technology) who asked me politely to take down the links so I have removed them.

There were a few reasons for the request, the most significant being that using my hack could remove the protection offered to you under the EFT Code of Conduct. The point is that the onscreen keyboard prevents keyloggers from recording your password and by allowing you to enter your password using your keyboard you could expose your password to a keylogger. If your account is compromised as a result then you might not be covered by the EFT Code of Conduct because you were (at least partially) responsible for the compromise by bypassing the “security” provided by the onscreen keyboard.

If you know what security is and understand what the implications of bypassing the keyboard are, drop me a line and I’ll send you the script. However, if you’re not sure if your computer is secure or has been compromised just stick with the onscreen keyboard.