tailgate

New version of InterfaceLIFT Downloader coming soon

2012-11-15T18:30:00.000-05:00

I've spent the past few months getting InterfaceLIFT Downloader to work better. One of things that the addon was pinged on was it's use of innerHTML and non-sanitized text. I thought I had fixed this a while back but apparently there were a few other parts of code that created the vulnerability.

0.5 was uploaded to Firefox Addons a while back. It was rejected. :-(

InterfaceLIFT Downloader was my first venture into the Firefox Addon world. While I consider myself a JavaScript expert, it turns out creating an Addon comes with it's own set of problems. First off, you actually have to care about security. Most of the JavaScript I wrote is for the web and since the browser ultimately decides what is safe and what isn't, I can do whatever I want. However, this is not the case with Addons. Addons give you unparalleled power and this power comes with a heavy responsibility.

I've put the finishing touches and will be Alpha testing it on my computer first before submitting it for review.

Also, I am working on a 1.0 version of this addon. My hope is to have it be a sidebar that can be displayed along side of the InterfaceLIFT website. Also, assuming that 0.5 gets approved, the addon will be branched to GitHub for easier maintenence. Tailgate is really for the one-off scripts (e.g. greasemonkey) and not for full-blown packages. The repository is already set up. Nothing there yet, but will be populated after 0.5 gets approved.

Just as I feared: the newest Autopoke doesn't work

2012-05-24T18:30:00.000-04:00

As I was getting ready to deploy the newest version of Facebook Autopoke, I decided to open it up to see if it still works. Just as I feared, it doesn't.

A very quick look at the source and it looks like that it will take quite a long time to figure out how to do automatically again.

Back in January, I decided to stop development on Facebook Autopoke because there were various copies of my script on userscripts. While a vast majority of them have been deleted and removed, it shifted my focus elsewhere. And with the ever-changing landscape of Facebook, it's becoming clear that the "Poke" feature is becoming antiquated. What I mean by this is that the "Poke" feature isn't a major button anymore. It's actually tucked away under the "Gears" menu.

I believe it's only a matter of time before Facebook does away with the whole poke thing. Originally, this script allowed me to beat friends in poke wars. And since I'm no longer poking anyone, this script was maintained only for others.

My personal philosophy in coding has been to code to make my life easier and then release the code to others to see if anyone else can benefit from it. Since I'm no longer using the script, I'm sure this announcement will cause you pain.

Effective immediately, all development on my Facebook Autopoke script will cease.

I will be releasing the latest changes to the Facebook Autopoke script this weekend so that if you want the latest code, you can get it. Be advised that it's set to "developer" mode so it produces a lot of noisy output. I want to thank users who have put up with me inconsistent build schedule and for all of the support over the five-ten years that this script has been in development. The userscript uid is 5200! This was one of the first scripts I ever wrote. Going back through each revisions show how much I had learned as a programmer and how much my style has evolved.

Normally, when I retire a program, I release the code under the more permissive MIT License. But because of the numerous violations, the code will stay under the GPL until further notice. If you would like to use a different license, please contact me.

Finally, you'll notice that tailgate is more than just for the Facebook Autopoke. Instead of creating a Google code project for individual script I write, I decided to create one repository for everything. The latest script that I have written is Give Me Paste Back.

Give Me Paste Back!

2012-05-05T20:22:00.002-04:00

As a web-developer and a programmer, there's a rule about never trusting user input. It's similar Murphy's law and why software companies spend lots of money beta testing. If there is a wrong way to enter data, a mindless user will find a way.

The rule of thumb to counter this is to programatically eliminate user error on the server-side. This means that if you're expecting a phone number in format "(555) 555-1212" and the user enters it as "555.555-1212", you either give an error or you process the data anyway after you fix the entry. Eliminating the user's ability to type a period does solve the aspect of not being able to type a period only. It does not eliminate a user from typing "555 55 5 - 1212".

I recently had this "discussion" with the good folks at @CreditKarma in 140-characters or less. They told me what I expected, but 140-characters isn't enough to tell why using JavaScript to turn off a browser feature is ultimately stupid and pointless.

Overall, JavaScript should be used to enhance the browsing experience. Eliminating paste, right-mouse-click, obfuscating image URLs are all things that cheapen the user experience because the browser does not do what the user expects. An user should not have to jump through digital hoops to be able to use a website in the way they would like.

Specifically, pasting is something that most people do everyday. They expect every application, whether it's Microsoft Word or their favorite browser, to do what they've come to expect when pressing "Ctrl-V".

On the other hand, as a web-developer, I understand why folks like Credit Karma choose to prevent pasting via JavaScript. It's cheaper to write one line to stop pasting than it is to actually test user input. Testing user input would require more programming hours to test for each possibility. Furthermore, you run the risk that the user was stupid and accidentally fat-fingered something in one box and then pasted it in another. I will admit that I have done this.

This is NO excuse for disabling a critical feature of the browsers. However, if you simply MUST do this, consider the following:

What frustrated me the most is that there was no feedback as to why paste did not work. INFORM THE USER that paste has been disabled and offer a reason. They may not like it, but at least they know that the problem *isn't* between the monitor and keyboard.
PROVIDE A WAY TO PASTE ANYWAY. A switch, a preference...anything that says, "Hey, if you want to paste, we'll let you, but be sure you know what you're doing." Doing this will help people like me who get frustrated and then write Greasemonkey scripts fixing your mess.
No matter what client-side solution you create, a user will find a way to mess things up so BE PREPARED TO HELP THEM. Users make mistakes. Give them a way to fix these mistakes instead of forcing them with the digital equivalent of cattle prods. Guide them by giving them clear and concise instructions.
DO NOT RELY ON JAVASCRIPT TO FIX YOUR CARELESSNESS. Users expect their browser to behave in a specific way. Things like autocomplete are a great way to augment the user experience. However, forcing the user to wait while their browser counts down to 30 seconds is ridiculous when a crafty user can just read the source to get the final URL. Furthermore, blocking the word "DROP" via javascript doesn't mean that they won't type in "; DROP TABLE customers".
Finally, DO NOT "EDIT WAR". If people are downloading and using my script, it's because they are frustrated like me. Listen to your users. The frustration that we feel doesn't color your company well. Web Development is like electricity: we don't think about it until something goes wrong. And users will make sure you hear them loud and clear.

Bottom line: Do not negatively alter the user's browser behavior unless you have absolutely exhausted every other option. And if you have to, let the user know that you have done so. After all, you are a guest in the user's browser. (Technically, the user is the guest, but I digress.) Don't scruff the floors, drink all the milk and put the carton back in the fridge. Be a great guest so that the user will invite you back. Otherwise, you'll find yourself lower and lower on the user's favorites/bookmarks and less and less on their minds.

All of this aside, Credit Karma is a great service. They provide a way for you to get your credit score for free. Yes, actually free unlike FreeCreditReport.com. I do recommend them, even with their broken registration process.

So here it is: Give Me Paste Back now in version 0.2, tested specifically on Credit Karma. Download the script and then go to Credit Karma and sign up for an account.

Facebook Autopoke Update

2012-04-28T09:23:00.001-04:00

It's been a few months since my last post. After a few months, I finally got in touch with the folks at Greasemonkey. It looks like Jesse Andrew is no longer running things, which is great for him. He's got a lot on his plate and it's good to see him giving away some things.

But it did make making the DMCA takedown's a bit longer. There is only one script left that violates GPL. Since it's one script, I will be releasing the newest autopoke script sooner than anticipated.

Please note that the public version of the script will be an obfuscated version. This does accomplishes two things:

Makes it much easier to see who is actively copying my script without permission
Also allows those who have "pirated" scripts to know they may be using an outdated or insecure version.

By no means is this perfect, but it gives people like Tony White, who does nothing but copy scripts and claims them as his own, another hurdle to jump through.

If you are a developer and would like access to the "development" version, feel free to look through the Google Code project. I use mercurial so it should be easy to figure out which is which. (Sorry, no further clues will be given. You're a developer. It's easy to figure out.)

Speaking of Tony White, I'd like to take a brief moment to share a few thoughts about the GPL and litigation. First, I don't enjoy using a public forum to address a personal issue. But he has left me no choice since he has yet to respond to any of my messages. I have asked Tony White on four separate occasions to bring his scripts into compliance. I could understand a one-time mistake. Most people don't understand how the GPL works. However, after reviewing all of his scripts, the vast majority of them are copies of other people's work. He then removes the original author's name and substitutes his own.

My goal is to not make money off of any of my scripts. They are freely available, both in speech and in beer. That is why I did not sue Userscripts or Tony White. However, claiming someone else's work as your own is simply despicable.

I cannot fight for other people's copyrights. But I can fight for my own.

Tony White has blocked private messages, either only from me or from everyone. Either way, here is the bottom line:

If Tony White is found to have a copy of my Facebook Autopoke script, I intend to file suit in Federal Court for injunctive and damage relief. I plan to ask the court for $1000 for each violation, which will include each copy that was downloaded. And since he was a repeat offender, I can triple any damages that are awarded.

That being said, I hope to release the newest version of the Facebook Autopoke within a month.

Obfuscated and "polymorphic" code coming!

2012-01-09T20:00:00.000-05:00

First, I know many of you are waiting desperately for the next revision of the Autopoke script. I will say that the newest version of the script does work (albeit in a limited capacity) and very reliable. So if that's all you care about, you can skip this post. But if you're interested in the release date, read on!

Here's the "TL;DR" version: 4.1 will be released when the GPL violations from copied scripts are cleared. This could be as much as 3 months from now.

Back in September, I found a user who was in violation of the GPL. Four out of his give scripts were removed via a DMCA notice. Since then, the same user has moved to copy someone else autopoke script. I've seen many of these users on userscripts. They take a wildly popular script, copy it, and then change the authorship to state that they wrote it. The common mistake these "authors" make is they fail to update the code. My guess is that they don't know how to program javascript and thus they are afraid to change anything.

The problem comes when there is a security vulnerability, as was the case in version 3.5 and 4.0 of my Autopoke script. The vulnerability is actually based on a browser vulnerability. But because these violators weren't updating the scripts, it meant that the users who installed their version of the script would continue using software that was unpatched. Furthermore, they would not be notified of the vulnerability and could not make an informed choice whether to continue to use the script or disable it completely.

I try to assume good faith whenever possible. It's impossible to determine someone's motives without talking to them. And since this particular user declined to communicate with me, I'm left with the impression that this user, at the very best, simply copies scripts without understanding completely what the scripts did.

Yesterday, I spent a few hours finding more GPL violators. These users seem to have the same MO: just copy the script.

Allow me to be clear so that there is no confusion: I completely support the open source movement. I HIGHLY ENCOURAGE the improvement of my code. There are a few scripts who have taken my code and translated it into different languages. This is completely acceptable. You do not need to ask me for permission to do this. I prefer that you let me know, simply so that I can inform you of any security problems the script may have and so that I can keep track of the statistics. I personally believe that the GPL is the best license since it requires attribution as well as continued use of the license in all derivatives. It is one of the reasons why I chose the GPL over the other licenses. I believe that the open source licenses must be actively defended.

If you copy the code and remove the copyright notification and replace your name as the author, then you are ruining it for everyone. Instead of improving my code, I have to spend the time to send you a letter. It takes time out of my schedule and makes things much more complicated than it has to be. If you fail to respond to my letter, you take time out the admins of userscripts since they need to respond to my DMCA letter and they need to disable your script, all while keeping lawyers on retainer.

If you are new to userscripts and still learning javascript, feel free to download my code and look at it. That's what open source is all about! If you have questions, don't be afraid to ask. But please, do not plagiarize and claim my work as your own.

My concern is not so much about copyright violations but about security vulnerabilities. This wouldn't be as much of a problem if the authors communicate with me. Seeing that they don't do this, it leaves me in a very uncomfortable position.

To make the script more secure, I will be obfuscating parts of it. This decision has nothing to do with the perceived edit war between myself and Facebook. The point of obfuscating is to limit the exposure of security vulnerabilities in my script when GPL violators copy the script verbatim. Since mose of these violators usually don't modify the script in general, I can safely say that the obfuscated code will be left untouched.

This, however, now limits those who use my code for completely legitimate purposes. First, I'm sorry to say that these violators ruined a good thing for you. Second, I'm going to make this as easy as possible. To received a clean version of the code, simply go to my google code page. I reckon that most of the GPL violators won't go through the trouble of finding the clean versions of the code. If you are familiar with git or mercurial, grabbing these should be easy. If, for some reason, this is difficult for you, please feel free to contact me and I'd be more than happy to provide with you with a copy. It will be under the same license so no worries on this side.

The obfuscated code will display a nag screen when autopoking. The point of the nag screen is to inform the user that they may be using code that has security vulnerabilities and they should consider installing my version instead. The code will continue to work, but will prevent autopoking until the nag screen is satisfied. Users who are familiar with javascript can hack through the obfuscated code and disable the nag screen, if they so choose. But this hacking proves that they know what they are doing and they accept the responsibility that comes with it.

Yes, Virginia, autopoke works again

2011-12-20T15:00:00.000-05:00

Still working on the final touches:

Right now, this only works on the pokes app page, as suggested by Lord_Fandomar.

What's left is for me clean up the code and obfuscate parts of the code. I also plan to make this work on the main page, but it's not a high priority.

Survey Results: 70% prefer closed source

2011-12-09T08:02:00.001-05:00

Its not too late to voice your thoughts on closing the source. I've finally had a chance to review the results and out of about 200 people who took the survey, 70% would prefer that I close the code.

I've been wrestling with this issue for a while and still have not come to a decision. Here's what hangs in the balance:

Since the Autopoke scripts inception, it has been 100% open-source, using the GPL 2 and 3 licenses. The latest version of the script (4.0.1) exclusively uses GPL 3.
Closing the source would mean that other developers could not learn from the work. This includes both legitimate programmers who are porting the script to Google Chrome to Facebook programmers who may be trying to stop scripts like this from working.
Closing the source would not mean it's 100% secure against viewing. Real developers can parse through obfuscated code. It's harder, but not impossible. (In fact, I go through Facebook's obfuscated code to create this script.)
Obfuscated code would be hosted remotely, making it less secure. In order to properly shield the code from viewing, the code would be hosted on my personal site. This comes with risks such as me having the ability to know who you are. I would draft a very simple privacy policy (basically that I don't care who you are). But doing this would allow me to block facebook.com from connecting to the site.

Despite the large number of people who would prefer that I close the code, I still lean toward an open-source solution. I'm a firm believer that open-source is better since it allows everyone to learn and don't think that the benefits outweigh the problems.

I am still developing the Autopoke for the new version of the Facebook news feed. PLEASE be patient. I have a full-time job and I do other things besides computers. This time of year is very busy for me.

Getting tired of the edit wars? Autopoke is being considered for closed source

2011-10-17T15:30:00.000-04:00

Facebook may be changing their poke code in response to this script. While unconfirmed, it seems each iteration makes autopoking harder and harder. To thwart their efforts, I am considering closing the source and obfuscating the code. What do you think?

If you don't see the survey above, you may need to enable surveymonkey.com within your NoScript. Or you can simply take the survey on their website.

Yup, the new facebook broke the autopoke

2011-09-21T13:00:00.000-04:00

For those of you that just finished cursing the developers of Facebook for fixing something that wasn't broken, you will soon realize that the new design broke the autopoke.

No worries. Development has continued. Hoping to have a fix by the end of the month.

Thanks to Jesse for taking action!

2011-09-19T15:00:00.000-04:00

Thanks to Jesse for taking down the offending scripts!

All but one remain so for me the battle has been won. The author has the right to counter the take-down notice. He would have to prove that he did not violate the license, which will be difficult since I have screenshots and a diff showing otherwise.

Development on the Facebook Autopoke will continue this week. I'm hoping to release version 4.1 that will:

Correct the reload issue
Constantly monitor Facebook for pokes and automatically re-poke them
Allow users to take their poke wars with them
Easier integration with Chrome (Please note "easier". I'm still not developing for Chrome. Just making it easier for others if you want to modify my script)
Fix security problems

To be clear: do not be afraid to modify my code. The problem I had with Tony White was that he just copied the code and called it his own. Improvements upon my code are HIGHLY ENCOURAGED and do not require permission. Attribution is always appreciated. You should note that I still give props to the original creator of the autopoke script, even though my implementation no longer looks anything like his. (He doesn't work on his poke script anymore.)

Will be patching the innerHTML bug for most popular scripts

2011-09-12T20:00:00.000-04:00

I've recently learned that there is a security vulnerability with using the innerHTML method within JavaScript. I'm still researching this issue.

I'll be releasing patches for the most popular of my scripts sometime by the end of the month.

Fighting GPL violators

2011-09-07T18:00:00.000-04:00

Being a strong believer in open-source, it gives me no pleasure to find people who violate open source licenses. Abiding by these licenses are fairly easy and I take a very liberal view of the rights that they protect.

Back in June, I discovered several userscripts that were copies of my Facebook Autopoke script. While I normally wouldn't have a problem with this, the fact that this user simply copied the script and just pasted his name on it made me pretty angry. It's one thing to use my script as a bases of a better script. Even if it's part of a larger work. But copying the script and just slapping your name on it not only violates the GPL legally, it violates it spiritually.

The GPL was created to foster sharing of thoughts and ideas without fear of stepping on someone's toes. What this user did was took my hard word and claimed it as his own.

Now, I contacted the Tony White back in May and never received a reply. So, I contacted Userscripts.org and informed them that I had revoked his license, persuant to section 8 of the GPL. The script is still up today.

So until I have this resolved, all work on the autopoke script will cease. If you have any questions, feel free to ask them here in the comments.

Fixing Autopoke issue

2011-07-29T13:58:00.000-04:00

Yes, I'm completely aware of the issue where the script just says, "Lock confirmed; preparing to poke..."

This is an on-going issue with the script unable to capture when the page is fully "ready." I'm in the process of incorporating code from jQuery that will make this detection a bit easier. I don't want to import the entire library since I'll only be using a part of it.

Thanks for your patience.

Facebook Autopoke 4.0 Release Party!

2011-06-06T15:58:00.000-04:00

It's been over seven months since the last release of the Facebook Autopoke script. I wrote in the last release that the script would NOT be updated until the release of 4.0.

Welcome to the Facebook Autopoke 4.0 RELEASE PARTY!!!

That's right! The Facebook Autopoke script is now available! You may want to completely uninstall the current version you have now.

I'm disappointed that the fundraiser for the LAST Well didn't work out. But, I would like to encourage you to make a donation anyway via their official website. I won't be tracking your donation but I would like to encourage your to let them know that you are donating because of this script.

If you haven't already, wander over to the official tailgate wiki and take a look at all the new features.

Fundraiser has been cancelled

2011-06-02T20:13:00.000-04:00

Due to unforeseen events, the fundraiser for the LAST Well has been cancelled. The Facebook Autopoke script is undergoing a final integrity check and will be released Monday evening.

I'll be updating the wiki portion of tailgate over the next few days so please check it for details on how everything works. As always, please submit bug reports on tailgate and NOT on userscripts.org.

Donation API issues

2011-05-25T12:00:00.000-04:00

I know everyone is waiting on the release of Autopoke 4.0. The LAST Well is having issues with their credit card merchant. As soon as this is resolved, I'll give you guys directions on how to donate.

Sorry for the delay.

Final Features for Facebook Autopoke 4.0

2011-05-09T17:00:00.000-04:00

As I finalize the code for 4.0, I'm going through the wishlist of features and deciding their fate. Will they be included, will they not. Unfortunately, there is one major feature that will NOT be included: automatic reload of the script.

While testing, I did program the script to automatically pull the main Facebook page. For some unknown reason, Facebook continues to show people who have already been poked in this pull. I initially thought this was due to a caching issue but have since determined that this is not the case. Since the problem is on Facebook's side, I've decided to remove this feature. Since this is how the Autopoke currently works, I don't see this as a step back. Keeping the feature in the final build creates unnecessary traffic. The code is still contained in the RCS (revision control software) so it's not lost and can be added back in at any time.

I've done my best to make the script as flexible as possible. The script no longer requires the English language and should work on any language, be it fake (e.g. pirate) or real (e.g. German). It is able to do this by relying on the underlying ajaxify library. Should Facebook ever stop using this or start using a different library, the script will have to be rewritten.

Over the next few days, I will be removing much of the extra code that makes debugging possible. I'll also be adding an error reporting tool that will allow you to copy and paste it's output into a bug report.

Here's something to get you ready for the next version of Autopoke

2011-05-08T14:10:00.000-04:00

Click to embiggen.

Facebook Autopoke 4.0 is almost ready!!

2011-05-05T08:09:00.000-04:00

I'm working with The LAST Well to put together an interface so people can donate. Hoping to have it available by the end of next week!

Stay tuned!

Poke tracking added

2011-04-11T22:00:00.000-04:00

Good afternoon everyone!

I spent today adding the ability to track the number of pokes between the user and their target. Of course, this count is completely localized, so if you use the script on multiple computers, it will keep different numbers on each computer. Not sure if this value is carried over if you use Mozilla Firefox Sync and not going to test this. Portability is not going to be a feature for the 4.0 release. It may be in the future.

A couple of things worth noting about this feature:

There is always a trade-off between information and space. While there is no limit imposed by Greasemonkey, the amount of data that can be stored within the browser should be minimized. While developing the schema, I debated how much information should be tracked: last poke datetime, initial poke datetime, name, count. Realizing that people prefer speed over information, I've decided to only keep the count. This makes it very efficient.

I'm sure there are those of you that would like to know when your friend last poked you and when you last poked him. The fact is that the more information you store, the slower your browser as a whole will be. The information is stored in your RAM. Firefox has a fairly large footprint as it is. So if you want more of this information and are willing to sacrifice speed (and possibly a crash), you will have to edit the script.

I will not expand on the pokewar tracking feature beyond the number of pokes. I believe the cost will not outweigh the benefits. If you want me to code this specifically for you, you will have to purchase a license (which will not be cheap).

At this time, the number of pokes will only show for current wars. If you want to see a list of everyone you've poked, you will have to open the about:config panel. This feature may be added in the future, thus will not be in the 4.0 release.

Major Milestone Achieved!

2011-04-07T14:00:00.000-04:00

Quick stats:

377 lines of code
15 KB
About 50 total programming hours spanned over three weeks

I am pleased to announce that the autopoke script has reached an important milestone: it has completed it's first set of pokes! Until now, the majority of the programming concentrated on how to actually detect pokes without loading the entire page. Then, work began on detecting pokes across all languages, which meant hacking the code of Facebook. Finally, the poke functions were re-written from the ground-up.

Here are the technical changes made thus far:

Uses XMLHttpRequest instead of GM_XMLHttpRequest: Makes use of the fast Javascript engine instead of passing to Greasemonkey. This change should make it easier for non-Firefox users to install the script. But remember that it is not officially supported.
Makes asynchronous requests: Fixes a bug that users of slow computers from properly auto-poking. A copy of the front page is used instead of the DOM itself. It allows for faster processing and allows users to be poked even before the page finishes loading.
New status/error messages: These messages are far more informative and allows the user to see why a poke failed. Debug variable can still be set to see the "console".
Makes use of XML 1.0 standards: Facebook is XML 1.0 compliant. The script makes use of this to retrieve important information to pass to the poke function. (If you want to see this in action, set debug to 3 or higher.)

And here are a list of features that will be added over the next couple of weeks:

Tracking number of pokes in current war: Obviously, this won't include pokes that have already occurred
Check Facebook for pokes automatically
Prettify error messages so that they can be copied and pasted into bug reports
Comments within the code

And finally, I am working with The Last Well, a 501(c)(3) non-profit organization that building wells in Liberia, to receive donations for it's mission.

Facebook changes their poke engine...again

2011-04-04T16:30:00.000-04:00

This seems to happen about 2-3 times a year. Facebook will change the way that pokes are processed both via the browser and on the backend. While there is no proof that Facebook is doing this purposefully to disable the autopoke script, it does break the script and produces error 1.1. This error code means that the autopoke script received a response from Facebook that wasn't expected and could not process the poke any further.

As I've stated before, I do not plan on releasing fixes to autopoke 3.5. I'm actively developing 4.0 to replace 3.5, which will include an adaptive regular expression to be able to execute the pokes without having a perfect match. However, this is proving harder than I initially realized.

(Note, another user fixed 3.5 and has released it on userscripts.org.)

There are about eight different places that Facebook can change that could break the script. I won't run through them all here, but needless to say, it is impossible to predict and anticipate these changes. For example, prior to this last update, the ID that was assigned to the poke DIV element was named pagelet_netego_pokes. Facebook has renamed the DIV element to pagelet_pokes.

Facebook uses ajaxify to load a large majority of it's modules (e.g. pokes, birthdays, stories, photos, etc). This means most of these elements load in the background. Instead of waiting for these elements to completely load, the 4.0 script now downloads a copy of your homepage to evaluate. This fixes a HUGE bug where pokes were not being processed because the elements do not completely load.

Even though the script doesn't use the DIV element, it still relies on the ID, which is used within ajaxify to actually load the poke node. Unfortunately, this is something that cannot be changed due to the mere fact that Facebook can change this div to something completely random.

Facebook has already done this to many of their elements. If you view the source of the Facebook frontpage, you'll notice many of the linked script names are Df69GCI-zBW.js, 4gR9cTpQYHa.js, etc. I assume this is done so that the files can only be used once can the source cannot be downloaded conveniently. Those who know what they are doing (like yours truly) can download these files without much hassle.

The poke link detection is based on the fact that the poke engine (e.g. the actual webpage that processes all pokes) has the word "poke" in it. Originally, the link detection was based on the link text having the word "poke" in it. This was changed to allow non-English speakers to use the script. If Facebook changes things again so that these IDs are randomized, the script will have to fail-back to searching for the work "poke" within the link text, breaking the script for non-English users.

Another change that Facebook has made is how pokes are processed. This used to be a POST form, which meant encoding the form parameters. But now, it looks like Facebook is changing this to GET. (FWIW, this used to be how Facebook did things back in the day.) Unfortunately, this is something that the script cannot anticipate and must be hard-coded.

As development on 4.0 continues, I will attempt to make the script as adaptive as possible. But please understand that it is impossible to anticipate everything. Hopefully, it will be more resilient than it's predecessors.

Facebook autopoke development update

2011-03-21T17:00:00.000-04:00

Over the weekend, I've been slaving away to find a better way to search for the poke div box. After some hacking, I found that facebook uses something called ajaxify. The problem with this plugin is that greasemonkey cannot interact with it, which sucks because facebook loads the pokes using ajax. I've known this for a while, but it wasn't until recently that I found the mechanism that it uses.

While I have yet to hear from anyone from facebook concerning my script, it does seem that facebook is trying to block automated requests to poke someone. I don't know if this is intentional or a side-effect of other changes they are making. What is clear is that every so often, the code changes.

One of the features I'm hoping to add to the autopoke script is the ability to "fix itself" should facebook change their code. While this is not 100% possible, the script can be flexible enough to notice changes to facebook's main page and hopefully, figure out the solution. This feature may not be ready by the release of 4.0, but I'm hoping to work on it.

Another feature I'm actively working on is better internationalization. Currently, the script only works with English, specifically by design. I'm working on this so that it will work for any language.

Finally, some important news:

Initially, the autopoke script was born out of a need to fix someone else's autopoke script. I continued working on it, making it better until my script became more popular than original script. It came to the point that I no longer had any of the original code (as of version 2.0).

Development of this script takes a lot of time. In fact, the development of 4.0 has so far taken 20 total programming hours. There have been a little less than 100,000 installs of the script, which doesn't necessarily mean 100,000 users. But judging by the sheer number of people who complain when it doesn't work, it's still a lot of people.

I am a firm believer in open-source and source-code freedom. I also believe people should be compensated for their work. Whether that's a hardy "thank you" or a monetary contribution, I believe it encourages development and lets the author know that he is appreciated. With this in mind, I will be establishing a new release structure for this script.

I've decided to something similar to what Stephen King did in 2000: The script will be released once a certain amount of money has been raised. 100% of the money will go toward a non-profit organization that will be decided when the script is ready for release. I don't have a dollar amount figured yet or how the logistics will work. As soon as I figure this out, I'll post here.

As a result of this, will not be pushing the updates to Google code. Changes and source will become available after the release.

Development on Facebook Autopoke 4.0 to start next week

2011-03-07T19:00:00.001-05:00

A long awaited update to my most popular greasemonkey script will begin sometime next week. The following changes will be made my autopoke script:

a complete rewrite of the script from the ground up!
use xml_httprequest instead of GM_xml_httprequest to save time and overhead
better poke detection
poke war count
localization for any facebook language
better use of xpath and other tools that have been introduced

I know that this script is being used on other browsers (e.g. Opera, Google Chrome, etc) but please realize that I can only focus on one browser: Firefox. You are more than welcome to port the script to your own flavor of browser.

Release date is unknown at this time, but I'm hoping for September 2011.

zagg replacement utility uploaded

2011-03-07T19:00:00.000-05:00

I released a script that goes through each order that you have with zagg and shows only orders where a replacement can be made.

Have at it.