blog

Archive for May 2009

WebDU slides: Be Afraid. Be Very Afraid. Javascript security, XSS & CSRF

May 29th, 2009 by Mark

Last week I delivered a talk at the fantastic WebDU conference which focused on an area that I have been becoming increasingly concerned about over the last while – security in the browser. Unlike other areas of the web platform that have well defined and effective security mechanisms (SSL/TLS, firewalls, strong passwords, access control) the melting pot of HTML, CSS, Javascript that runs within the browser is increasingly being shown to be a weak link.

The talk, aimed at a technical audience, hopes to raise awareness of the issues and solutions and makes the points that we as web developers carry a lot of the responsibility for minimising the impact and extent of the problem.

As I’ve gone through the process of publishing this presentation online I’ve been concerned about the loss of context that comes with publishing the slides alone. I’m still waiting to hear whether the conference organisers will be publishing the audio (or if it was recorded), but I will post a link if and when it is [UPDATE: Geoff has posted the link to the audio below!].  In the meantime, there are some footnotes below to give extra context, I’ve also collected up all the links I used for reseach at http://delicious.com/markstanton/js-security and comments and questions are welcome.

  • Inpsiration for this talk came from a conversation with Doug Crockford after a presentation he gave at Web Directions South last year and from another presentation by Simon Willison I stumbled across a week or two later. Both of those presentations are worth checking out if you are working in this area. Google’s Browser Security Handbook is also essential reading.
  • MySpace pursued Samy for his actions and in 2007 Samy was found guilty and sentenced to 3 years probation and 90 days community service. While this was a spectacular example of a JS based attack I’m certainly not advocating this sort of thing.
  • Developers need to think about where all their data comes from, not just focus on form and url data. If you are syndicating feeds or pulling data from some back office system it should be treated with the same care & caution as online input.
  • The context switching idea is key and needs to be clearly understood. The “I only allow some HTML” is generally a sign you need to look more closely at what you are doing. You think you’re only allowing HTML, but are you really sure? http://ha.ckers.org/xss.html is a useful resource for testing to see if context can be switched. OWASP have a good explanation of what context switching is and how it works.
  • The demo is an over simplification. Part of the points I was trying to make here is that there is a level of trust between users and the sites they use – if a site is compromised this trust is open to abuse. The greater the level of trust the higher the risks.
  • The full GMail/CSRF/stolen domain story from the victims perspective is at http://www.davidairey.com/google-gmail-security-hijack/. Scary stuff.
  • The “don’t click” story is at http://softwareas.com/explaining-the-dont-click-clickjacking-tweetbomb. This is the only case of this type of attack that I am aware of.
  • The question mark after 100% safe on the EASPI slide referrers to the fact that developers would need to use it 100% correctly 100% of the time which is unlikely unless you have good unit testing practices in place.
  • Don’t look for one way to protect your site – protect it in as many ways as you can. The landscape is changing so what works today might not be 100% fail-safe next year. Start with the things that are easiest to implement in your environment and go from there.

2 Responses to “WebDU slides: Be Afraid. Be Very Afraid. Javascript security, XSS & CSRF”

  1. Geoff Bowers says:

    You can get many of the session recordings online via the webdu session podcast — including “Be Afraid, Be Very Afraid” :) Enjoy!
    http://www.webdu.com.au/mxsession/feeditunes

  2. Mark says:

    Thanks Geoff!

Commercial Identity in the Social Media Space

May 26th, 2009 by Peter

Last week, on my personal site, I published On Chatter, an essay about Twitter, Facebook, and the nature of the always-on stream of noise, which I’m calling Chatter. We thought that some of it would be relevant to readers of the Gruden blog, so I’m reproducing a couple of excerpts here.

Starting to Get Twitter

Admittedly, it took a long time (I first signed up in the second half of 2006), but Twitter has grown on me. It’s not quite right, and it’s still incredibly geeky, but it points to an always-online, always-chattering future for everyone.

While it’s geeky, it’s not necessarily techy, so there are a lot of different people on Twitter, every one of them using it slightly differently. Some are using it to broadcast, some are using it to chat, some are using it to keep in touch with a group of friends. Many do all that and more. I find myself using Twitter in two very different ways. On the one hand, I follow people for their links to news or cool new things online. I’ll ocassionally tweet in the same mode myself. But on the other hand, I follow people I know in the real world. This is, for the moment, a much smaller group of people, and their updates tend to get lost in the noise created by the first group. But it’s the mode I normally tweet in myself, and it’s by far the mode I’m most interested in.

Real People

The thing about ambient intimacy, is that it really only works with real people. Characters and personas you can get away with — we’re all putting on personas, all the time, both online and in the real world. But no-one wants to be intimate with a corporation. And a corporation can’t tweet about what it had for breakfast.

So there’s no easy answer for companies, no three-step process to monetise those eyeballs. No-one will own the æther. There’ll be money in plugging people into the æther, and in helping them filter it. But you’ll be working with a whole lot of other people, and other systems. And through it all, you’ll have to be yourself — be a real person.

At work we’re starting to get into the social media space a whole lot more. But when we looked at the idea closely, we realised, we don’t want to go into that space as Gruden. Most of us already have a presence, and an identity of our own, and Gruden is just a part of that identity. So we blog and tweet in our own spaces, and sometimes we blog in Gruden’s space, and sometimes we link or tweet each other, just like anyone else in our social space. It’s not about creating a new persona, it’s about being real people. And any company looking to get into this space needs to be ready for that — you don’t do this as a job, it’s just something you do as a person.

The essay explores more of the cultural impacts of these services. But what about the impacts on companies, and on marketing? Everyone seems to be aware that “social media” is something they should be doing, but no-one’s really sure of what that means, or how they’d go about taking their brand message into the social media space. The key, however, is to not think about social media the same way you think about your traditional media. There are half-way points, like Facebook’s Pages, designed for a traditional brand presence within Facebook. But if you’re going to embrace the social aspects, you need to be sending real people into the space. In some ways you’re loosening control over your company’s message, letting all your employees into the social media space. Some won’t want to identify their work, some will embrace it.

To take it further, let key outward-facing staff (be they marketers, public relations, sales, customer service) put some of their work hours into their social media presence. Obviously, such an investment requires some return, but the pay-offs are, initially, going to be difficult to measure. The key, in the short term, is in establishing a presence as a recognisable and real identity.

Steve Rubel is arguing that, while it’s clear that Facebook and Twitter will be replaced, they won’t be replaced by a new ‘hub’, but rather by the open web. The argument is that the web will become “one giant social network”. So you’ll no longer be able to setup your brand presence on the kids’ latest favourite website, but will instead need to focus on your identity, and really participate.

Marketers need to really embrace the fact that it’s peers and their data, rather than brand, that will become the primary way we make decisions. The greatest rewards will go to those who embrace and participate in as many communities as they possibly can in credible ways.

The social media space is still in its infancy. It’s an area in which we’re all experimenting. It takes such a dramatic rethink of the way we market a brand that it’s bound to ruffle a few feathers. We’ll look back on this period and wonder why it was so difficult. But this experimentation is only human; it’s what makes our presence all the more real.

So we’ll continue experimenting with our own presence. And we’ll encourage clients to start sending people into the social media space. Some are going to be more ready than others — we’re not suggesting everyone go create a Twitter account immediately. But as you start to look at what you or your employees are already doing with your personal presence, you’ll find it becomes easier to bring the company into the conversation.

One Response to “Commercial Identity in the Social Media Space”

  1. Mark says:

    Interesting reading on related ideas over at http://www.theappgap.com/on-trust-and-embracing-web20.html:

    “There is a direct connection between trust and personal interaction. Importantly, people trust people, not institutions.”

Big news for the Semantic Web

May 25th, 2009 by Peter

The last couple of weeks has seen some big announcements in the Semantic Web. Google announced a number of new features at Searchology 2009. And Wolfram|Alpha soft-launched a new alternative to the search engine, what they’re calling a computational knowledge engine.

These two represent two very different approaches to the semantic web. The web has traditionally been designed and written for humans. The semantic web represents an effort to design and write the web for machines. We can run a search, look at certain results in context, and determine that one particular string is an address, another is a phone number, another is a name. But a machine struggles to tell those apart. The “lower-case” semantic web attempts to introduce some structure to the human web in order to assist a machine’s interpretation. The strong “upper-case” Semantic Web introduces data specifically designed for machines, oft-times invisible to humans.

The Microformats effort attempts to extend the human web by encouraging the adoption of common semantic structures in order that a machine might also read this web. Google’s recent announcements included initial support for the hCard and hReview microformats, used to identify names and addresses (hCard) and reviews (hReview). Initially, Google are reading the hReview microformat to pull ratings for businesses and include that information in search results.

While it’s only in the initial stages, we’ve seen Google slowly extend search results with rich snippets in the past, and this is an indicator that they’re taking microformats seriously. This is a strong case for adding hCard (or other microformats) to your website — it’s not hard to imagine Google pulling address data and showing maps next to search results. This is something we’ll be adding to the Gruden website in the coming weeks, and we’ll include details of our implementation. In the meantime, Google’s webmaster documentation includes detailed examples to markup business and organisation data.

Another new Google feature sits between the lower-case and upper-case forms of the semantic web. Google Squared (link is to a YouTube video) lets you setup a grid for comparative search results. Eg, a search for Hotels might return different hotels down the page, with locations, prices, ratings across the page. In typical Google fashion, all this data is mined from the human web, but there’s an obvious attempt to impose machine-readable structure on the content.

Wolfram|Alpha has been compared to Google, but really is a radically different approach, and for a very different end. Wolfram call it a “computational knowledge engine”. It works with strongly structured data — it’s designed to give answers, not a list of results a human then needs to mine. Some example searches are:

And then there are the classic unanswerable questions (via Amnesia blog):

Flash game development 101

May 20th, 2009 by Anthony

mario_449x600

As part of the ongoing Gruden China training program, talented members of the interactive team – Peng, Haixia and Wenjie – are brushing up their Flex & Flash skills. This time around, I decided to move away from the training status quo and proposed a simple Flash game for development.

This initiative turned out to attract some interest from another Grudenite outside the interactive team, as Ronaldo from the tenders team joined the training crew. Equipped only with a basic understanding of game mechanics, a passion for playing games, and the good ol’ FlashDevelop IDE, they came up with a plan of attack.

The game-play concept was simple and addictive; treasures dropping from the sky from varying directions. Each kind of treasure boasts different score points. Some bestows the player with a special ability, some strip it away and causes negative repercussions. The player’s goal is to catch as many treasures as possible to achieve the highest score.

Since the training team will be developing the game from scratch, it’s important that each development phase is managed effectively, broken down into the following stages;

  1. Main game loop & character motion logic
  2. Obstacle collision detection
  3. Sprites and animation
  4. Item factory & motion logic

This is my first experience of creating a Flash game. The experience of localisation projects really assisted my understanding, but wasn’t comparable with dedicated training. By finishing the training phase 1 and 2, I have learnt that Math and Physics are the basics of any game.
- Peng, Gruden China Office

The graphics assets are sprites from the ultimate platform game, Mario Brothers. Currently the team has completed the first phase of development and the resulting prototypes are playable showcases of character motion. We’ll be blogging their progress and eventually posting the games live on the Gruden blog, so stay tuned for more game development updates the flash training team. To check out some of the phase one demo’s, please click on a name below and use your arrow keys to move the character.

Or, you can view the full page in our training site

2 Responses to “Flash game development 101”

  1. teeps says:

    Nice work…when is the next one coming out?

    Btw, if y velocity exceeds the height of a tile, collision detection doesn’t stop mario from falling through the world.

  2. copet80 says:

    Thanks teeps! We’re still trying to find time to continue it in the midst of production works. As soon as there’s an update I’ll post a new blog post again. Thanks for checking it out :)

    P.S.: yes the collision detection still needs some major work as it’s very simplistic at the moment. I guess it needs some quick math intersection calculation, probably a dumbed-down version of those used in projecting bullet hits in FPS games.

Monitoring your message on Twitter

May 11th, 2009 by Philippa

twitter-bird

Following on from my previous blog post relating to viral marketing and web 2.0, I began researching the various tools which provide useful analytics for viral marketing campaigns. Your message might be out there, but who’s receiving it? Who’s passing it on? Who’s remixing the message? Who’s lost interest in what you have to say altogether?

Re-tweeted from @TrendTracker was an interesting blog post relating to 27 key tools which enable users to find and manage followers on Twitter. These tools enable Tweeters to effectively report on their Twitter statistics, and provide a mechanism for connecting with like-minded Tweeters with similar interests.

While some analytics tools listed were inactive, a few of the more useful tools listed include:

  • TwitterFriends: TwitterFriends helps you to find the users that are meaningful for you and keep in touch with them. Those could be users you are talking to on a regular basis or who are feeding you great links all the time.
  • Twellow: This tool helps to “cut through the clutter” to find other Twitter users in a specific industry using this service.

The preferred Analytics tool of the Grudenites at this point in time is Twitter Analyzer, which seems to provide the most comprehensive statistics on our Twitter account out there at the moment.

An alternative way to track mentions of your brand within Twitter is to use http://search.twitter.com to create an RSS feed of search results for your brand, then hook it up with your feed reader of choice (iGoogle, Outlook 2007, etc).

These tools provide the “value-add” to your social marketing campaigns. Too often, the “set-and-forget” approach is utilised in the online space, frustrating consumers and users who are genuinely interested in interacting with your brand. Utilising social networking analytics tools can provide detailed and accurate statistical reporting on viral campaigns, brand accounts, and brand messages; in turn, facilitating highly focused, targeted and successful campaigns.

Analysing your messages this way puts you well ahead of the game. Many marketers are still under the impression that social marketing is a new-age buzz word and doesn’t deserve the same level of attention as conventional advertising, public relations and marketing campaigns. The Social Media Tsunami by JD Gershbein highlights the very reason that this is a dangerous attitude for marketers to have. Ready or not, social media is changing lives and redirecting popular notions about people, places, products, services and all aspects of lifestyle in between.

One Response to “Monitoring your message on Twitter”

  1. Bart Jawien says:

    nice article guys.

Viral marketing: a lot like swine flu

May 8th, 2009 by Philippa

This morning I was reading a blog post by Dan Zarrella, a social media and viral marketing blogger I often turn to for words of wisdom in relation to web 2.0.  His recent blog post, 7 viral marketing lessons learned from the swine flu virus, was no exception. Full of interesting euphamisms for the concept of viral marketing, he presented a logical and topical argument which would enrich any marketer trying to make their brand’s mark in the social media space.

The name viral marketing stems from the theory that ideas spread like viruses, making epidemiological metaphors and models useful when attempting to understand the spread of memes. Since the goal of any viral marketer is to create a pandemic with their campaign, we can learn a lot from the early spread of Swine Flu.

He essentially seperated viral marketing into seven components, consisting of:

  1. Seed selection
  2. Knowledge gaps
  3. Addition vs replacement
  4. Novelty
  5. Communal recreation
  6. Infectious period length
  7. Endemic vs Epidemic

Some of the gems of the article included Dan’s comments on adding value to an existing message through social media, rather than trying to present a new message:

Each of us has a mental framework of ideas built on each other that we use to view and understand the world around us. When we are exposed to a new meme that contradicts an existing portion of our framework, it is very difficult for the new idea to replace the old idea.

and his take on the “infectious” period of social marketing campaigns:

the case of most viral and social marketing campaigns, the infectious period exists as an event rather than a period of time. An “infected” person will blog or Tweet about something. The goal for viral marketers looking to exploit the infectious period should then be to increase the number of infectious events each individual will undertake.

A good example of the latter was the recent city-wide blackouts in the Sydney CBD. Rather than consulting news sources or Energy Australia, Grudenites immediately jumped on Twitter as “infected” (or “affected”) people, and in turn, relied on other “infected” parties for information on the situation. Within minutes, an entire network of “infected” people were all a’twitter. Shame that this was negative PR for Energy Australia, rather than positive.

This blog post should be used by marketers as somewhat of a template for their social marketing campaign. A few key questions for marketers to ask themselves before embarking on a social media tirade include: Where’s the novelty factor? How many people does this “infect”? Are we introducing a new message or adding value to our existing brand message?

Most importantly, however, is the question: Are we prepared for remixing of the message by target audiences? After all, that’s what viral marketing  is all about: a user’s interaction with your brand.

One Response to “Viral marketing: a lot like swine flu”

  1. Flu Mask says:

    Wow, I never even noticed those similarities before.

    Good thing nobody’s looking for a cure for viral marketing!

Infinite (code)monkeys?

May 6th, 2009 by Joanne

If the theory goes that infinite monkeys given typewriters and infinite time can type a Shakespeare play, what would happen if you put 6 digital professionals together, under a microscope for 24 hours?

On the 12th and 13th May the FullCodePress teams at this years CeBIT conference aim to find out.

Australia and New Zealand each have a team of 6, who will battle it out to build a not for profit website from scratch in 24 hours. Under harsh spotlights on a stage in the CeBIT conference hall, each team will be working through the night to build a fully functional, standards based website for the judges to review on May 13th.

If you are interested in following these geek Olympics they will be tweeting and blogging their way through the experience or go check them out in person at CeBIT.

Reinventing the internet: 7 minds with 7 minutes

May 5th, 2009 by Philippa

reinventtheinternet

If you’ve been following Gruden on Twitter in recent weeks, you’ll have noticed we’ve been spruiking for the live online Videoegg event, 7 Minutes to Reinvent the Internet.

It’s all about the future of the internet and the digital marketplace; finding new ways to make the digital media work harder for brand advertisers. It’s not about more light-weight panel banter, but real ideas from serious thinkers that don’t mind sticking their necks out a bit.

Videoegg have gathered a diverse group of thought leaders representing a range of perspectives: new comers and veterans, offline and online, strategy, creative and media, to give seven creative thinkers just seven minutes to talk about the future.

As I’ve discussed on the Gruden blog in previous posts, Marketers need to be looking at improving their digital strategy to connect effectively with their audiences, rather than taking the set and forget approach. This is a great opportunity to learn more about the capabilities of digital for brand advertisers, and how to use the online space effectively and with relevance.

There is a catch, however. The Southern Hemisphere disadvantage strikes again. The event is being streamed online live from New York at 1.30pm tomorrow (May 6th)… That translates to 3.30am (Sydney time) on Thursday 7th May. Some eager Grudenites will be sitting up to watch the live event, but for the sane among you, we’ll be posting a link to a screencast on Thursday.