grack.com

Erik at Carwoo posted an interesting codebreaking challenge to the Carwoo blog earlier today.

This particular challenge piqued my curiosity. One of my hobbies is rooting Android phones and I enjoy all sorts reverse-engineering problems. More importantly, this one happened to match up with some downtime I had this afternoon.

I fired up Python and quickly got to work. At my day job, Gri.pe, we use Java. I love Java as a development language, but I find that Python’s interactive mode is best for quickly experimenting with data in unknown formats. There’s a great deal of power in the standard Python libraries and it’s well-suited for quick byte and bit manipulation.

I had a lot of great feedback on my AppEngine post the other day. We put our trust in the AppEngine team to keep things running smoothly while we work on our app and live the rest of our lives. Today is pretty quiet around the Gripe virtual offices (aka Skype channels): it’s Thanksgiving in US and I’m getting hit by a cold too hard to do much today besides write a short post.

We had a great surprise this morning. The View episode we were featured in was in re-runs this morning and we had a huge traffic spike. Nobody noticed until about 30 minutes in, since  everything was scaling automatically and the site was still serving up as quickly as ever:

There’s been a handful of articles critical of Google’s AppEngine that have bubbled up to the top of Hacker News lately. I’d like to throw our story into the ring as well, but as a story of a happy customer rather than a switcher.

Neal Stephenson’s latest interactive serial novel project, The Mongoliad, launched last night at midnight. Readers subscribe to the project to receive access to the new material as it becomes available and can interact with fellow readers in the forums. They can also contribute to the book world’s ’pedia, a wiki focused on events and characters within the story.

I had a chance to ask Neal some questions about the project:

MM: How has the format and the collaboration between yourself and the other authors of the Mongoliad affected the creative process you use for writing?

As you might have seen on Wired or Engadget, we were poking around on the pre-release EVO from Google I/O and managed to get root access to it before it had been shipped. You might remember my blurrycam video of the event:

We didn’t mention how we did it at the time, only that we exploited a serious vulnerability and recommended other users root their phones. Now that Sprint’s patch has been out in the wild for a while and everyone has updated, we’re releasing more details on what the security vulnerability is.

First quick impressions of Safari extensions:

UPDATE: Sprint’s OTA release last night fixes the serious vulnerability we reported to them. Kudos to them for moving so quickly. As an end-user, you’ll have to decide between being more secure with the OTA update or having root access to the device you own for now.

In the comments, Sean Doherty says:

UPDATE: Sprint just pushed an OTA update for these phones that may patch the root hole we’re using. Don’t install any OTA updates yet if you want root!

We (ozzeh, joshua, shadowmite and I) just put the teaser site together for the EVO root. More info coming soon!

Web: http://unrevoked.com, Twitter: @unrevoked

Painless root for your HTC EVO 4G.

No surprise here: lots of people are interested in the details of the root process. There’s four reasons why we aren’t releasing anything yet:

1. We’re still working on making the root ‘sticky’. The current root doesn’t persist beyond a reboot, meaning you need to root it every time you reboot the device.
2. We want to package up the rooter in an easy-to-install, one-click application so we’re not holding people’s hands through adb shell.
3. We don’t want to give HTC any details that they could use to fix the hole before the official release.
4. We want to make sure that when Froyo is released on this device, we can still get root on it.

UPDATE: We (ozzeh, joshua, shadowmite and I) just put the teaser site together for the EVO root. More info coming soon: http://unrevoked.com

I ended up with a Sprint HTC EVO 4G after Google I/O. It’s a pretty fantastic phone, even though it’s something of a kitchen sink. By a happy coincidence, I ended up reconnecting with some of my buddies from the old mobile hacking days who were looking to root it. With a few hours effort and a three person team (credit to ozzeh and Joshua Wise!), we managed to get the standard su tool installed.

UPDATE (July 7, 2010) Daniel Herding sent me a story about his adventures with Avira’s latest version. Looks like they’ve just paved over the problem.

We’ve been seeing a number of reports that our DotSpots Chrome extension is being reported as infected with the HTML/Crypted.Gen malware. There’s not a lot of information on Avira’s site about this malware, except that it’s a ‘trojan’ with ‘low damage potential’.

Looking back through the archive.org history of grack.com, I realized that I’ve used three off-the-shelf products to blog over the last decade: CityDesk, Typo (a Ruby blog engine) and Wordpress.

My favorite of the three was CityDesk. It was a very simple CMS with a decent custom scripting engine. Its big disadvantages were 1) that its data was stored in a Microsoft Access database 2) its data was basically a big binary blob that didn’t work well at all with source control, 3) I couldn’t push stuff into it from the command-line (ie: various testing snippets that I like to save) and 4) the scripting language was too limited at times to do what I wanted.

I’ve been searching for a complete EBNF for XML 1.1 without much success. I found one for XML 1.0, but I was hoping to avoid manually patching it for the XML 1.1 changes.

In the end, I decided that it would be easiest to just parse the EBNF directly out of the specification. Here it is, for reference:

I was surprised a few days ago with a new layout for Google News on one of the machines I use. I haven’t seen it reported anywhere yet. I came across it tonight while testing and grabbed a few screen captures in case it disappears.

The biggest change is that each story now has a bordered box around it and the stars introduced recently have been moved to the right-hand side of the story. Each story has a drop-down menu associated with it, but the only option in there is “Email”. This drop-down has the class “share-icons” - possibly a new location for a “share in reader/buzz” option.

Looking through the DOM, it appears that this is called the new “blended” story style.

There’s a comparison that I was pointed at today showing the difference between a number of different modern encoders. The Theora 1.1 demo on that page looked particularly bad, so I decided to investigate.

I downloaded and compiled the latest versions of libogg, libvorbis and libtheora from xiph.org. I ran the encoder example (as the other test did), but discovered that it does support two-pass encoding, contrary to what was stated on the other test’s page. I ran a few different two-pass encodes (including one with soft rates), but didn’t get a lot of variability between results. Overall, however, my newly re-encoded version is significantly better than the one on the other page.

IE6 has been getting a bad rap lately. France and Germany are both warning their citizens not to use it. The recent intrusions at Google were purported to be caused by holes in IE6. Even Microsoft is warning users to steer clear of it.

To get an idea of who’s given up on testing against this ancient browser, I’ve been running around browsing with IE6 in a VM. From what I’ve seen so far, it’s not getting a lot of love.

I’m pretty happy about this: as more and more sites break in IE6, it drives more people to browsers that don’t suck like Chrome or Firefox. It’s the last part of the browser death spiral: completely busted on the new and exciting sites.

We’re in the process of launching our new publisher integration feature at DotSpots and needed to gain an understanding of how browsers deal with “third-party cookies”, or cookies that are set on domains that differ from the top-level domain.

Each of the major browsers, Firefox, Chrome, Safari, Opera and Internet Explorer have their own quirks about how cookies are accepted, which vary wildly depending on whether they were set by a top-level page, or a page in a third-party iframe.

It looks like the Chrome team has finally re-enabled extensions on Mac again (hat-tip to MG Siegler) in the latest dev channel build. You can’t update from the “About Google Chrome” screen yet, but you can grab the latest build and install it directly.

Even better, they are now allowing Mac users to install extensions directly from extension pages (warning: shameless self-promotion link).

Extensions are working well. They’ve turned on the browser action menus, so the various extensions that I’ve installed all work properly.

Bookmark sync is enabled as well, but I haven’t seen where the bookmarks are supposed to show up in Google Docs.

I previously discussed using window.name as a transport last year, but there wasn’t enough information and theory in the previous post to implement your own transport. I’ll fill in the gaps a bit more here to help developers looking to implement this themselves. You can also see the implementation we’re using at DotSpots in the gwt-rpc-plus project: Cross­Domain­Frame­Transport.java and Cross­Domain­Frame­Transport­Request.java.

The process of making a window.name request is described below. Note that you can inspect the HTML and HTTP traffic on my blog to see how our DotSpots plugin performs the cross-domain requests.

The last ten years have been a wild ride for this planet, but I’m sure the next ten are going to be even more exciting. I’d like to offer my predictions of what we’ll see around now, ten years in the future.