Studio moh

e-mail Dylan
dylan@studiomoh.com
Or Call
831-295-3824

Hacking Porn Sites

…it’s fun, easy, and always makes me happy.

I don’t do any malicious hacking (that’s bad, guys), I just download everything. Real quick. Woosh.

I justify hacking as training me against the worst possible scenario for my own sites…and how I can develop more secure code.

…sigh, it’s just a reminder that you can never trust anything from the end-user; headers, cookies, form-input…anything can be turned into a code-injection point.

RE: Nintendo’s Wii does photos

Click for movies of the Wii in action

I’m really digging the thumbnail-resizing effect… Kinda like what Microsoft MAX image viewer, or their new AJAX image search.

Why I hate MySpace

Making your own CSS styles is a nice (albiet butchered and terrible implemented) touch in MySpace.

In a normal web design workflow, you have something like this:

.modules {
background-color: #fff;
padding: 15px;
}

.modules p {
color: #aaa;
line-height: 150%;
}

In MySpace’s world, it’s more like this:


table table table table td, table table table table tbody td {
background-color: transparent !important;
padding: 15px !important;
}

table table table table td font, table table table table tbody td font {
color: aaaaaa !important;
line-height: 150% !important;
}

Ugh. Stab me in the eyes as hard and fast as you can, MySpace.

jQuery 1.2

The new jQuery release has me super excited. With features like partial loading and remote JSON (oh god, finally!) and simultaneous animations.

I’m absolutely ecstatic.

Practical XSS

I was playing around with my API for FAP and made a very simple, 7kb, browser-based mass upload tool. Permissions and authentication are verified with JSON on the client side and files are uploaded using a plain POST request. Easy enough.

The problem came when I was trying to get my script to POST to the API. Asynchronous cross domain requests aren’t permitted in most browsers. It’s a serious security risk.

My solution: the iframe.

By targeting all POST requests to an invisible iframe the cross domain issue is no longer a problem.

You can even check progress with the onload() event.

First post

Just making sure this thing works. I didn’t want to deal with WordPress or some other bloated blog solution, so I quickly wrote my own. 12 killobytes of features include:

  • Threaded comments
  • RSS feeds
  • A simple folksonomy
  • Thorough HTML sanitization

Just something simple for my humble little website where I can blab about code, design and function.

Update: My 12kB blog was a poetic script, but there are features WordPress offers that I’m just too lazy to code myself. OpenID, Kizmit, ping-comments—totally worth the bloat of WP.