Feross.org

Introducing the HTML5 Hard Disk Filler™ API

2013-02-27T00:00:00-08:00

Creating stuff is hard. Breaking stuff is easy. Thus, I take frequent breaks from creating stuff in order to break stuff.

Behold my latest hackery: FillDisk.com. Fill up your hard disk with just a single click!

How to troll using HTML5 `localStorage`

The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). localStorage is awesome because it’s supported in all modern browsers (Chrome, Firefox 3.5+, Safari 4+, IE 8+, etc.).

The standard anticipated that sites might abuse this feature and advised that browsers limit the total amount of storage space that each origin could use. Quoting from the spec:

User agents should limit the total amount of space allowed for storage areas.

The current limits are:

2.5 MB per origin in Google Chrome
5 MB per origin in Mozilla Firefox and Opera
10 MB per origin in Internet Explorer

However, what if we get clever and make lots of subdomains like 1.filldisk.com, 2.filldisk.com, 3.filldisk.com, and so on? Should each subdomain get 5MB of space? The standard says no. Quoting the spec, again:

User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in a1.example.com, a2.example.com, a3.example.com, etc, circumventing the main example.com storage limit.

A mostly arbitrary limit of five megabytes per origin is recommended.

However, Chrome, Safari, and IE currently do not implement any such “affiliated site” storage limit. Thus, cleverly coded websites, like FillDisk.com, have effectively unlimited storage space on visitor’s computers.

Proof-of-concept demo

Of course, I had to make a nifty demo to show how this works. See FillDisk.com as a proof-of-concept. You can get the source code on GitHub.

Features:

Fills up the user’s hard disk on Chrome, Safari (iOS and desktop), and IE.
Fills up 1 GB every 16 seconds on my Macbook Pro Retina (with solid state drive)
Tested with Chrome 25, Safari 6, IE 10.
For 32-bit browsers, like Chrome, the entire browser may crash before the disk is filled.
Does not work on Firefox, since Firefox’s implementation of localStorage is smarter.
Includes a button to reclaim your disk space ;)

Let’s fix this

Here are the bug reports I filed with Google, Apple, Microsoft, and Opera:

Chromium bug report
Apple bug report (on an unoffical site, since Apple doesn’t acknowledge their bugs publicly. So lame.)
~~How do I file a bug on IE? Their bug report page is broken.~~ Microsoft bug report (requires login)
Opera bug report (bug ID: DSK-383073, it’s private) – fills to 75MB in my testing, which isn’t so bad.

You can help get this issue get fixed quickly (on Chrome at least) by visiting the bug report pages and chiming in (starring) so that Google prioritizes this issue.

Update (Mar 13, 2013)

In the news:

Ars Technica says this “could become a new form of Rick Roll”. Let’s hope not. :)
The Verge
BBC.co.uk

Answers to some common questions I’ve been getting:

How did you find this HTML5 weakness?

To be clear, this is not an issue with HTML5, so calling it an “HTML5 weakness” is not accurate. It’s a bug in the way that most browsers (Chrome, Internet Explorer, and Safari) have implemented the HTML5 Web Storage standard. It’s the fault of the browsers, not the HTML5 spec.

I usually don’t spend my time actively looking for security bugs – I just frequently run into them while programming. In the case of the localStorage bug, I found it while working on a project that utilizes localStorage. I was curious if there was some way to store more than 2.5-10 MB using the API, and using multiple site “origins” by creating tons of subdomains was the first thing that came to mind.
You mention Firefox uses localStorage and that it’s better but is there a reason for this?

Firefox simply places a 10 MB cap on the amount of space that any domain can store using localStorage. So, origins like 1.filldisk.com and 2.filldisk.com, etc. must all share 10MB of space. Making new subdomains doesn’t give you more space.
Have you had any followup since leaving the bug reports for Google, Opera, Apple and Microsoft?

903 people starred the Chromium bug report I created, making it the 9th most starred bug in all of Chromium. The Chrome devs have responded and are working on a fix, though it’s unclear when it will be ready. Apple has not responded, because, well, they’re Apple. Microsoft has responded that they “will be investigating this issue further”.

So, it seems that the issue will be fixed at some point, though it doesn’t appear to be a top priority for browser vendors at the moment.

Travels in Japan

2013-01-02T00:00:00-08:00

This blog post contains JavaScript and other dynamic content that will not display correctly in most RSS readers. I recommend reading this post directly in your web browser.

I visited Japan for two weeks with some friends. It was awesome! The food was delicious, the sights were exotic and beautiful, and the culture was fascinating and different.

Here’s a picture of me at the top of Mt. Fuji, the tallest mountain in Japan:

We started in Tokyo, and explored many different districts, each with its own unique vibe. We went to Shibuya (the entertainment district), Shinjuku (home to the busiest train station in the world), Asakusa (old Tokyo), Akihabara (the electronics and otaku district), Odaiba (futuristic architecture on a man-made island), and also visited the Hama Rikyu gardens, the Tokyo Tower, and it’s modern replacement the Tokyo Skytree.

After Tokyo, we climbed Mt. Fuji on a whim (the view at the top was so amazing – see pictures below). We also visited Hiroshima (the museum was excellent, but understandably a bit morose), and Kyoto where we visited several temples and shrines, as well as the International Manga Museum. Before we left Kyoto, we paddled a rowboat down the river which was surprisingly hard (we bumped into other river traffic more than once!), but lots of fun.

Lastly, we visited Rabbit Island, which is a small island near Hiroshima, that is overrun by tens of thousands of tame rabbits. It was quite a sight!

We arrived at dusk and there were at least ten times as many rabbits as during the daytime, since rabbits are crepuscular, meaning they are most active during the twilight hours.

Some things that make Japan unique

I wanted to share some of the obvious things that make Japan “different”:

Everyone plans stuff in advance. The Japanese customs agents were surprised and incredulous that we showed up in Japan at 10 PM without a hotel booked in advance for our first night. Travelers and locals who we met along the way were also surprised that we were “winging it”. The extra flexibility was awesome, and we only had trouble finding a hotel on one particular night in Kyoto because it was a holiday.
Old people are treated with much respect. When we were in Kyoto, it happened to be a holiday: “Respect for the Aged Day”.
Everyone takes their shoes off inside their homes.
Most hotels require you to leave your room key at the front desk when you go out (so you don’t lose it?)
Most hotels have a curfew (usually 11 or midnight)
People are REALLY quiet on trains.
People usually don’t walk and eat at the same time. It’s considered rude.
It’s illegal to smoke cigarettes outside on the sidewalk (to prevent cigarette butts from being everywhere on the street)
People shower BEFORE taking a bath. People bathe together in groups.
Most salarymen wear the same “uniform” (white collar shirt, black slacks)
Most students wear the same uniform (white polo shirt, black slacks/skirt)
Everyone was well-dressed. No one we saw in public looked like a bum – which is definitely not the case in the US.
I didn’t see a single homeless person in any of the cities we traveled to.
Everything tends to opens late (~11am) and close early (~5pm)
Many fast food restaurants have machines where you buy a ticket which you can exchange for food. So you basically pay a machine.
English is everywhere (lots on signs, subways, menus, and most people who work in hotels and restaurants know enough words that you can communicate with them).
Trains / buses are always on time (except for one private bus at Mt. Fuji which was 10 min late)
Anytime an elevator or door closes with an elevator attendant or conductor behind it, they do a small bow until the door is fully closed.
A few hotels we stayed at did not allow guests with tattoos because traditionally only yakuza (Japanese mafia) have inked their bodies. Kids are starting to get tattoos as fashion statements in recent years, but most bathhouses and hotels still ban it.
A pretty large number of people used umbrellas to protect their skin from the sun (probably like 10-20% of people who were outside, mostly women)

You probably noticed that lots of the items in this list are obvious, surface-level differences. In the future, I want to write a longer post about the subtler (and more important) things that make Japan unique.

For now, I’ll leave you with a huge pile of photos from our trip.

Photos from our travels!

You can use the arrow keys to navigate through the photos. There are descriptions on many of the photos with the “what” and “where”.

Last thing: If you’re planning a trip to Japan and have questions, feel free to send me an email and I’ll do my best to help you out.

Japan – Day 1

First day of our travels in Japan!

Japan – Day 2

Our second day in Japan. We visited Akihabara (the electronics district) in Tokyo. Then, we took a boat down the Sumida River to visit Odaiba (a modern commercial district with lots of american-style malls).

Japan – Day 3

Our third day in Japan! We visited Kamakura today (a very old city with dozens of shinto shrines and buddhist temples). We went to the biggest and most famous shrine in the city, Tsurugaoka Hachiman-gū, which was founded 1000 years ago. In the evening, we went to the beach and happened to meet some nice Japanese girls who spoke a little bit of English. Good day.

Japan – Day 4

Our fourth day in Japan! We visited an onsen (Japanese-style bath), the Tokyo Imperial Palace (briefly), Shibuya district (the entertainment, culture, and fashion district of Tokyo) (also briefly), and stayed the night in Shinjuku (a really busy city with lots of skyscrapers).

Japan – Days 5 and 6 [Climbing Mt. Fuji]

On our fifth day in Japan, we visited the Tsukiji Fish Market (the largest fish market in the world!) and decided to summit Mt. Fuji, even though we have like no climbing experience. We didn’t check the weather and didn’t really know if it would be feasible, but we figured we’d try nonetheless. After 7 hours of hiking and a short nap, we made it to the top of the mountain – 12,000+ feet high! The view from the top was amazing and totally worth the hike!

At the top of Mt. Fuji there was no running water or restrooms, but I could access Google, Facebook, email, and Spotify. I had perfect signal strength. This situation felt odd. :)

Japan – Days 7 and 8

Our Japan trip goes on! Today, we visited Fuji-Q, an awesome amusement park right next to Mt. Fuji. Then, we took the shinkansen (bullet train) to Kyoto, where we checked out some temples and walked the “Philosopher’s Trail”.

Japan – Day 9

Today, we visited Western Kyoto and Arashiyama. We walked around Tenryuji Temple and paddled a row boat down the river. So much fun! Then, we came back to Kyoto and just chilled in the city. I randomly met some Australian girls who were staying in the same hotel. They were high schoolers in Japan for a field trip (or as they put it, an “excursion”). It was nice to meet some English-speakers!

Japan – Days 10 and 11

Japan trip is almost over! :( Today we checked out more of Kyoto (Nishihongan-ji Temple, the Imperial Palace, the International Manga Museum, and Nijō Castle). Then, we went to Otsu Beach, since we felt like swimming but it turned out we were misled — the beach was pretty uninviting despite what the city’s tourism website said. But, it was still a fun little trip to a REALLY rural part of Japan. The next day, we toured Hiroshima, saw the Hiroshima Peace Memorial Park, checked out the museum (which was a little depressing, but also really interesting).

Japan – Day 12 [Rabbit Island!]

Today we visited Okunoshima, aka Rabbit Island! The island was used as a poison gas factory during World War II and they tested the chemicals on rabbits. After the war ended, they dismantled the factory and set the rabbits free on the island. They multiplied like crazy and now there are hordes of tame rabbits all over the island. Whoever set the first rabbits free is a genius. This was so much fun! Later, we rode the bullet train back to Tokyo and checked out Shibuya for a few hours before calling it a night.

Japan – Day 13

Our last day in Japan! We ate breakfast at the Tsukiji Fish Market (one of the largest in the world). We ate fresh sushi, best that we had the whole trip. Then, we wandered around Shibuya for the rest of the day. Jake went shopping for hipster clothes. It was clear that nothing would fit me, since their “large” is like a small or medium here. The salespeople mostly ignored me :( Then, we flew back to SFO. Overall, awesome trip. Way better than I expected. I need to travel more.

Using the HTML5 Fullscreen API for Phishing Attacks

2012-10-08T00:00:00-07:00

This blog post contains JavaScript and other dynamic content that will not display correctly in most RSS readers. I recommend reading this post directly in your web browser.

Quick! Click this link to Bank Of America. There’s nothing fishy about it at all! I promise!

Go ahead — hover your mouse over the link to see where it goes. You’ll find that it’s a completely normal link to https://www.bankofamerica.com.

There is only one way to find out if I’m telling the truth — just click the link already!

[NOTE: The demo only works with a normal click on the link. No “Open in New Tab” or middle-click.]

What just happened?

Ok, I lied — the link was pretty fishy afterall. When you click on the link, you don’t actually navigate to https://www.bankofamerica.com. Instead, your browser automatically enters fullscreen mode and I load a fake version of Bank of America’s website (my demo uses a screenshot, but attackers would use a working website).

The fake Bank of America site is adorned with OS and browser UI that indicates you are actually on https://www.bankofamerica.com. Of course, these UI components are just screenshots too! However, they’re pretty convincing because they actually take into account the OS and browser you are using!

Also, note the green lock in the location bar, which indicates that TLS (i.e. HTTPS) is enabled.

The “Fullscreen API” explained

The Fullscreen API (see W3C docs and MDN docs) allows web developers show web content that fills up the user’s screen completely. You’ve seen this functionality in action whenever you watch a fullscreen video on YouTube (if you use their new HTML5 player, which you should do!) or look at a fullscreen photo on Facebook.

Note that most browsers have had user-triggerable full-screen functionality for some time now. The HTML5 Fullscreen API is distinct from this; it allows the web developer to access this same functionality, and importantly, the developer can trigger it programmatically.

This is nice because the developer can design a fullscreen button which looks like part of their site (a la YouTube and Facbeook). You can trigger fullscreen mode with this code:

elementToMakeFullscreen.requestFullScreen();

The main restriction that the API places on developers is that fullscreen must be triggered in reaction to a click or keypress. Presumably, this is so that sketchy sites can’t immediately put you into fullscreen when you land on their site.

// Assuming jQuery is available

// Fullscreen the HTML document on click
$('#fullscreen-button').on('click', function() {
  var doc = document.documentElement;
  if (doc.requestFullscreen) {
    doc.requestFullscreen();
  }
});

Note that in practice, you need to use the prefixed versions (mozRequestFullScreen() and webkitRequestFullScreen()) since the spec is still not final yet.

How the attack works

Create a link to a site that the user trusts:

Visit <a href="https://www.bankofamerica.com">Bank of America</a> for mediocre banking services.

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected.

However, when the user clicks the link, call event.preventDefault() to prevent the browser from actually navigating to the link. Instead, trigger fullscreen mode and insert fake OS and browser UI into the page, along with a fake version of the site to be phished.

$('html').on('click keypress', 'a', function(event) {

  // Prevent navigation to legit link
  event.preventDefault();
  event.stopPropagation();

  // Trigger fullscreen
  if (elementPrototype.requestFullscreen) {
    document.documentElement.requestFullscreen();
  } else if (elementPrototype.webkitRequestFullScreen) {
    document.documentElement.webkitRequestFullScreen(Element.ALLOW_KEYBOARD_INPUT);
  } else if (elementPrototype.mozRequestFullScreen) {
    document.documentElement.mozRequestFullScreen();
  } else {
    // fail silently
  }

  // Show fake OS and browser UI
  $('#menu, #browser').show();

  // Show fake target site
  $('#target-site').show();
});

It’s important that the fake OS and browser UI match the user’s system. So, if Chrome user on OS X clicks the link, we show a fake OS X menu bar and fake Chrome UI with a green padlock for HTTPS on Bank of America.

How I built this

I built a working demo, which I encourage you to check out. You activate it by simply clicking the link in the previous sentence. You’ll want to use Chrome, Firefox, or Safari for the demo to work.

To make the demo, I took screenshots of different OS and browser chromes (Chrome, Firefox, and Safari on each of Windows, OS X, and Ubuntu) and split the images so I could use them in a fluid layout (to handle aribitary screen resolutions). I make sure to preload all the screenshots in the background so that the UI will be ready when the user clicks the target link.

The demo also works if the user is already in fullscreen mode when they click the target link.

The demo’s source code is also available on GitHub.

Would this actually work in the wild?

It’s true that the OS and browser UI won’t be exactly perfect for every user’s system. Lots of people customize their OS and browser and some might notice that they’re looking at fake UI.

For example, the user’s browser bookmarks and running menu bar apps may be different from the screenshots. The clock time in the OS X menu bar will almost certainly be wrong. One could improve the demo by adding the correct time to the OS UI, but this really isn’t necessary.

On OS X, Chrome plays an annoying 1-second animation any time you go fullscreen, which might set off some alarm bells with experienced users.

Despite all these apparent shortcomings, this remains a very serious attack because of the phenomenon of change blindness.

[Change blindness] is the phenomenon where seemingly striking or obvious changes are not noticed. — Milan Verma on BBC

Check out this excellent video from the psychology study where “change blindness” was first proven outside the lab:

Read more about change blindness on Wikipedia.

Humans are terrible at spotting subtle changes

If this attack were used in the wild, I bet at least 10% of web users would get phished (probably many more).

Links are the bread and butter of the web. People click links all day long — people are pretty trained to think that clicking a link on the web is safe. Saavy users may check the link’s destination in the status bar before clicking, however, in this case it won’t do them any good.

Most browsers don’t do a good job of making it clear that the browser just entered fullscreen mode. Safari shows a quick half-second animation, then no indication at all that the browser is in fullscreen mode, making users susceptible to all kinds of phsishing attacks involving fake OS and browser UI.

Chrome and Firefox (especially recent versions) do a better job of putting their own UI on top of the fullscreened content, but in Chrome especially, it’s pretty subtle and easily missed.

I’m sure we can all think of friends or family that would be fooled by a trick like this. After all, enough people still respond to Nigerian scam emails that it’s profitible to continue sending them!

A quick note about “features vs. security” in software

In software engineering, functionality and security are at odds with each other. When you add a new feature to a complex system, it’s impossible to predict how the new feature will interact with each of the thousands of existing features, in all their myriad combinations.

When the fullscreen API was first drafted by Mozilla, they predicted attacks like this:

Browser vendors are well aware of the potential security issues with fullscreen. For example, a malicious site could show a full screen Windows or Mac login window and steal a password. That’s why they are disabling keyboard support by default and only enabling by explicitly asking. — John Dyer

At some point, Mozilla (as well as the other browser vendors) must have decided that keyboard support in fullscreen mode is useful enough to legit web developers that it’s worth taking a hit to security.

I’m not convinced that this was the right tradeoff to make. What do you think?

UPDATE (Oct 9, 2012, 12:00 AM): The Mozilla developer documentation says this:

Also, any alphanumeric keyboard input while in full-screen mode causes a warning message to appear; this is done to help guard against phishing attacks. The following keys are the only ones that don’t cause this warning message to appear (…) — MDN

However, this documentation is out-of-date. There were no warnings on keyboard input in Firefox or Chrome. I went fullscreen on a Facebook photo and was able to leave a comment without any issues. Safari, on the other hand, appears to prevent keyboard input.

UPDATE (Oct 9, 2012, 12:22 AM): Someone on Hacker News pointed out that Internet Explorer used to allow the creation of chromeless popup windows which could be augmented with fake OS or browser UI to create phishing attacks. This feature was removed in Internet Explorer in 2004.

UPDATE (Oct 18, 2012): Google, Mozilla, and Apple are discussing what (if anything) to do about the issue I demonstrated. I replied on the “public webapps” W3C mailing list with my thoughts.

Shoutout to Neal Wu!

How To Set Up Your Linode For Maximum Awesomeness

2012-10-05T00:00:00-07:00

So, you followed the advice in my Linode Hosting Review and decided to host your website with Linode. Excellent choice!

But, if you’re new to the command line (perhaps you are familiar with CPanel or Plesk?) or you’ve never setup a server from scratch before, you may be wondering what dark magic vudu is required to get up and running.

Well, you’ve come to the right place!

The Command Line Is Hard (…at first)

I’ve set up at least five new servers with Linode and each time I complete the ritual, I learn new incantations that make the Linux angels sing. I’m pretty happy with my current recipe.

Setting up a new server can be confusing, so using a tutorial like this one is a good idea the first time you do it.

Tutorial: How To Set Up Your Linode

In this guide, I will demonstrate how to set up a fresh Ubuntu server from scratch, update everything, install essential software, lock down the server to make it more resilient against basic attacks and denial-of-service, improve server stability, setup automatic backups to another server, and finally install common software like Nginx, MySQL, Python, Node, etc.

A Note About This Guide

I originally compiled this guide as a .txt file of notes for myself, but decided to share it in case anyone finds it useful. If you’re looking for something straight from the horse’s mouth, Linode offers guides that cover how to set up a new server, but some of the info is out of date.

Let’s get started!

Provision a New Linode

First, you need to provision a new Linode. Using Linode’s web UI, it’s quite easy. Select your desired Linode size. If you’re unsure, choose the smallest size. You can always resize it later. Select “Ubuntu 12.04 LTS” as your OS. You’ll be asked to create a password for the root user.

After a few minutes, your server will be ready. Now, it’s time to connect to it!

Connecting to Your Server

First, open Terminal on your Mac. On Windows, you’ll want to use putty, since Windows doesn’t come with a proper terminal.

To connect to your server, type this into your terminal and hit Enter:

ssh root@<your server ip>

Of course, replace <your server ip> with your Linode’s actual IP address, which you can find on the “Remote Access” tab in the control panel.

This command launches the SSH program and asks it to connect to your server with the username root, which is the default Ubuntu user. You will be prompted for the root password you created earlier.

Basic Ubuntu Setup

To set up your new server, execute the following commands.

Set the hostname

Set the server hostname. Any name will do — just make it memorable. In this example, I chose “future”.

echo "future" > /etc/hostname
hostname -F /etc/hostname

Let’s verify that it was set correctly:

hostname

Set the fully-qualified domain name

Set the FQDN of the server by making sure the following text is in the /etc/hosts file:

    127.0.0.1          localhost.localdomain   localhost
    127.0.1.1          ubuntu
    <your server ip>   future.<your domain>.net       future

It is useful if you add an A record that points from some domain you control (in this case I used “future.<your domain>.net”) to your server IP address. This way, you can easily reference the IP address of your server when you SSH into it, like so:

ssh future.<your domain>.net

If you’re curious, you can read more about the /etc/hosts file.

Set the time

Set the server timezone:

dpkg-reconfigure tzdata

Verify that the date is correct:

date

Update the server

Check for updates and install:

aptitude update
aptitude upgrade

Basic Security Setup

Create a new user

The root user has a lot of power on your server. It has the power to read, write, and execute any file on the server. It’s not advisable to use root for day-to-day server tasks. For those tasks, use a user account with normal permissions.

Add a new user:

adduser <your username>

Add the user to the sudo group:

usermod -a -G sudo <your username>

This allows you to perform actions that require root priveledge by simply prepending the word sudo to the command. You may need to type your password to confirm your intentions.

exit
ssh <your username>@<your server ip>

Set up SSH keys

SSH keys allow you to login to your server without a password. For this reason, you’ll want to set this up on your primary computer (definitely not a public or shared computer!). SSH keys are very convenient and don’t make your server any less secure.

If you’ve already generated SSH keys before (maybe for your GitHub account?), then you can skip the next step.

Generate SSH keys

Generate SSH keys with the following command:

(NOTE: Be sure to run this on your local computer — not your server!)

ssh-keygen -t rsa -C "<your email address>"

When prompted, just accept the default locations for the keyfiles. Also, you’ll want to choose a nice, strong password for your key. If you’re on Mac, you can save the password in your keychain so you won’t have to type it in repeatedly.

Now you should have two keyfiles, one public and one private, in the ~/.ssh folder.

If you want more information about SSH keys, GitHub has a great guide.

Copy the public key to server

Now, copy your public key to the server. This tells the server that it should allow anyone with your private key to access the server. This is why we set a password on the private key earlier.

From your local machine, run:

scp ~/.ssh/id_rsa.pub <your username>@<your server ip>:

On your Linode, run:

mkdir .ssh
mv id_rsa.pub .ssh/authorized_keys
chown -R <your username>:<your username> .ssh
chmod 700 .ssh
chmod 600 .ssh/authorized_keys

Disable remote root login and change the SSH port

Since all Ubuntu servers have a root user and most servers run SSH on port 22 (the default), criminals often try to guess the root password using automated attacks that try many thousands of passwords in a very short time. This is a common attack that nearly all servers will face.

We can make things substantially more difficult for automated attackers by preventing the root user from logging in over SSH and changing our SSH port to something less obvious. This will prevent the vast majority of automatic attacks.

Disable remote root login and change SSH port:

sudo nano /etc/ssh/sshd_config

Set “Port” to “44444” and “PermitRootLogin” to “no”. Save the file and restart the SSH service:

sudo service ssh restart

In this example, we changed the port to 44444. So, now to connect to the server, we need to run:

ssh <your username>@future.<your domain>.net -p 44444

Update: Someone posted this useful note about choosing an SSH port on Hacker News:

Make sure your SSH port is below 1024 (but still not 22). Reason being if your Linode is ever compromised a bad user may be able to crash sshd and run their own rogue sshd as a non root user since your original port is configured >1024. (More info here)

Advanced Security Setup

Prevent repeated login attempts with Fail2Ban

Fail2Ban is a security tool to prevent dictionary attacks. It works by monitoring important services (like SSH) and blocking IP addresses which appear to be malicious (i.e. they are failing too many login attempts because they are guessing passwords).

Install Fail2Ban:

sudo aptitude install fail2ban

Configure Fail2Ban:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Set “enabled” to “true” in the [ssh-ddos] section. Also, set “port” to “44444” in the [ssh] and [ssh-ddos] sections. (Change the port number to match whatever you used as your SSH port).

Save the file and restart Fail2Ban to put the new rules into effect:

sudo service fail2ban restart

Add a firewall

We’ll add an iptables firewall to the server that blocks all incoming and outgoing connections except for ones that we manually approve. This way, only the services we choose can communicate with the internet.

The firewall has no rules yet. Check it out:

sudo iptables -L

Setup firewall rules in a new file:

sudo nano /etc/iptables.firewall.rules

The following firewall rules will allow HTTP (80), HTTPS (443), SSH (44444), ping, and some other ports for testing. All other ports will be blocked.

Paste the following into /etc/iptables.firewall.rules:

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allow ports for testing
-A INPUT -p tcp --dport 8080:8090 -j ACCEPT

#  Allow ports for MOSH (mobile shell)
-A INPUT -p udp --dport 60000:61000 -j ACCEPT

#  Allow SSH connections
#  The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 44444 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

Activate the firewall rules now:

sudo iptables-restore < /etc/iptables.firewall.rules

Verify that the rules were installed correctly:

sudo iptables -L

Activate the firewall rules on startup:

sudo nano /etc/network/if-pre-up.d/firewall

Paste this into the /etc/network/if-pre-up.d/firewall file:

#!/bin/sh
/sbin/iptables-restore < /etc/iptables.firewall.rules

Set the script permissions:

sudo chmod +x /etc/network/if-pre-up.d/firewall

Get an email anytime a user uses `sudo`

I like to get an email anytime someone uses sudo. This way, I have a “paper trail” of sorts, in case anything bad happens to my server. I use a Gmail filter to file these away and only look at them occasionally.

Create a new file for the sudo settings:

sudo nano /etc/sudoers.d/my_sudoers

Add this to the file:

Defaults    mail_always
Defaults    mailto="feross@feross.org"

Set permissions on the file:

sudo chmod 0440 /etc/sudoers.d/my_sudoers

This is isn’t mentioned anywhere on the web, as far as I know, but in order for the “mail on sudo use” feature to work, you need to install an MTA server. sendmail is a good choice:

sudo aptitude install sendmail

Now, you should get an email anytime someone uses sudo!

Improve Server Stability

VPS servers can easily run out of memory during traffic spikes.

For example, most people don’t change Apache’s default setting which allows 150 clients to connect simultaneously. This is way too large a number for a typical VPS server. Let’s do the math. Apache’s processes are typically ~25MB each. If our website gets a temporary traffic spike and 150 processes launch, we’ll need 3750MB of memory on our server. If we don’t have this much (and we don’t!), then the OS will grind to a halt as it swaps memory to disk to make room for new processes, but then immediately swaps the stuff on disk back into memory.

No useful work gets done once swapping happens. The server can be stuck in this state for hours, even after the traffic rush has subsided. During this time, very few web requests will get serviced.

It’s very important to configure your applications so memory swapping does not occur. If you use Apache, you should set MaxClients to something more reasonable like 20 or 30. There are many other optimizations to make, too. Linode has a Library article with optimizations for Apache, MySQL, and PHP.

Reboot server on out-of-memory condition

Still, in cases where something goes awry, it is good to automatically reboot your server when it runs out of memory. This will cause a minute or two of downtime, but it’s better than languishing in the swapping state for potentially hours or days.

You can leverage a couple kernel settings and Lassie to make this happen on Linode.

Adding the following two lines to your /etc/sysctl.conf will cause it to reboot after running out of memory:

vm.panic_on_oom=1
kernel.panic=10

The vm.panic_on_oom=1 line enables panic on OOM; the kernel.panic=10 line tells the kernel to reboot ten seconds after panicking.

Read more about rebooting when out of memory on Linode’s wiki.

Miscellaneous nice-to-haves

These next things are not required (in fact, nothing in this guide really is), but are nice to do.

Set up reverse DNS

The reverse DNS system allows one to determine the domain name that lives at a given IP address. This is useful for network troubleshooting — (ping, traceroute, etc.), as well as email anti-spam measures (read more on Wikipedia).

It’s pretty easy to set up. From the Linode Manager, select your Linode, click on “Remote Access”, then click on “Reverse DNS” (under “Public IPs”). Type in your domain and that’s it!

Set up a private IP address

Private IPs are useful for communicating data on the Linode network, i.e. Linode to Linode. This is handy if you have multiple Linodes (say, one for your web server and one for your database). Private network traffic is more secure (only other Linode customers can see it, vs. the whole internet), faster (the traffic never has to leave the datacenter if both Linodes are in the same datacenter), and free (doesn’t count towards your monthly bandwidth quota).

I currently put my database server on it’s own Linode, so that I can scale it independently of my frontend servers and debug performance issues easier since the systems are isolated. This hasn’t been super-handy yet, but if one of my sites gets a huge traffic rush, I bet it will be immensely useful.

It’s easy to set up. On the Remote Access tab, click Add a Private IP.

Then, edit the file /etc/network/interfaces to contain:

# The loopback interface
auto lo
iface lo inet loopback

# Configuration for eth0 and aliases

# This line ensures that the interface will be brought up during boot.
auto eth0 eth0:0

# eth0 - This is the main IP address that will be used for most outbound connections.
# The address, netmask and gateway are all necessary.
iface eth0 inet static
 address 12.34.56.78
 netmask 255.255.255.0
 gateway 12.34.56.1

# eth0:0 - Private IPs have no gateway (they are not publicly routable) so all you need to
# specify is the address and netmask.
iface eth0:0 inet static
 address 192.168.133.234
 netmask 255.255.128.0

Of course, adjust the IP addresses to reflect your own addresses from the Remote acess tab.

Then, restart your Linode and remove DHCP since we’re using static networking now:

sudo aptitude remove isc-dhcp-client dhcp3-client dhcpcd

More info about this on Linode’s website: Linux Static IP Configuration

Configuring your applications and your database to route traffic over the local network is another issue, not covered here.

Install Useful Server Software

At this point, you have a pretty nice server setup. Congrats! But, your server still doesn’t do anything useful. Let’s install some software.

Install a compiler

A compiler is often required to install Python packages and other software, so let’s just install one up-front.

sudo aptitude install build-essential

Install MySQL

Install MySQL:

sudo aptitude install mysql-server libmysqlclient-dev

Set root password when prompt asks you.

Verify that MySQL is running.

sudo netstat -tap | grep mysql

For connecting to MySQL, instead of the usual PHPMyAdmin, I now use Sequel Pro, a free app for Mac.

Improve MySQL security

Before using MySQL in production, you’ll want to improve your MySQL installation security. Run:

mysql_secure_installation

This will help you set a password for the root account, remove anonymous-user accounts, and remove the test database.

Keep your MySQL tables in tip-top shape

Over time your MySQL tables will get fragmented and queries will take longer to complete. You can keep your tables in top shape by regularly running OPTIMIZE TABLE on all your tables. But, since you’ll never remember to do this regularly, we should set up a cron job to do this.

Open up your crontab file:

crontab -e

Then, add the following line:

@weekly mysqlcheck -o --user=root --password=<your password here> -A

Also, you can try manually running the above command to verify that it works correctly.

Backup your MySQL databases

The excellent automysqlbackup utility can automatically make daily, weekly, and monthly backups of your MySQL database.

Install it:

sudo aptitude install automysqlbackup

Now, let’s configure it. Open the configuration file:

sudo nano /etc/default/automysqlbackup

By default, your database backups get stored in /var/lib/automysqlbackup which isn’t very intuitive. I recommend changing it to a folder within your home directory. To do this, find the line that begins with BACKUPDIR= and change it to BACKUPDIR="/home/<your username>/backups/"

You also want to get an email if an error occurs, so you’ll know if automatic backups stop working for some reason. Find the line that begins with MAILADDR= and change it to MAILADDR="<your email address>".

Close and save the file. That’s it!

Install Python

Install Python environment:

sudo aptitude install python-pip python-dev
sudo pip install virtualenv

This creates a global “pip” command to install Python packages. Don’t use it, because packages will be installed globally. Instead, use virtualenv.

Create a new virtualenv Python environment with:

virtualenv --distribute <environment_name>

Switch to the new environment with:

cd <environment_name>
source bin/activate

Note that the name of your environment is added to your command prompt.

Install Python packages with “pip” inside of virtualenv:

pip search <package_name>
pip install <package_name>

This is the best Python workflow that I’ve found. Let me know if you know of a better way to manage Python packages and Python installations.

Install Nginx

sudo aptitude install nginx

Install Apache

sudo aptitude install apache2

Install PHP5

sudo aptitude install php5 libapache2-mod-php5 php5-mysql
sudo service apache2 restart

Install Node.js

sudo aptitude install python-software-properties
sudo add-apt-repository ppa:chris-lea/node.js
sudo aptitude update
sudo aptitude install nodejs npm nodejs-dev

Install MongoDB

Follow instructions on 10gen’s site: Install MongoDB on Ubuntu.

Install Redis

sudo aptitude install redis-server

Setup Automatic Backups

Backups are really important. Linode offers a paid backup service that’s really convenient if you accidentally destroy something and need to restore your Linode quickly. It’s $5 per month for the smallest Linode. I enable it on all my Linodes.

If you want even more peace of mind (or don’t want to pay for Linode’s backup service) you can roll your own simple backup solution using rsync.

You will need access to another Linux server (maybe another Linode?) or a home server. I just installed Ubuntu on an old desktop computer to use as a backup server.

We’re going to create a weekly cronjob that backs up our Linode’s home directory to a backup server. I keep all the files that I would want to backup in my home folder, so this works for me.

Open your crontab:

crontab -e

Add this line to the file:

@weekly rsync -r -a -e "ssh -l <your username on backup server> -p <ssh port number of backup server>" --delete /home/<your username> <hostname or ip address of backup server>:/path/to/some/directory/on/backup/server

I recommend running the above command manually to make sure you have it right before adding it to your crontab file.

That’s it!

Linode rocks!

If, after reading this, you want to sign up for Linode, use this link and I’ll get a couple weeks of free hosting. If you prefer not to, here’s the plain link: Linode.com

Happy hacking!

(View this post’s changelog on Github)

Thoughts on free will

2012-08-06T00:00:00-07:00

You cannot control the next thought that will pop into your head. Seriously, this is crazy.

Using functional magnetic resonance imaging (fMRI), it is possible to see your decisions before you realize that you’ve made them. Researchers asked people to press a button using their left or right index fingers while monitoring their real time brain activity using fMRI. The results were surprising:

The conscious decision to push the button was made about a second before the actual act, but the team discovered that a pattern of brain activity seemed to predict that decision by as many as seven seconds. Long before the subjects were even aware of making a choice, it seems, their brains had already decided. (from Nature)

These results are shocking. They imply that all decisions are out of our control, subject to the whims of the gray matter in our heads.

I spent a lot of time thinking about this (always a dangerous pastime, hehe). I came up with a programming metaphor that makes a pretty convincing argument against the existence of free will. I thought it was interesting enough to be worth sharing, so here we go:

The human mind is a self-modifying function

Every human mind is a function. We take as input the sensory experience of the world around us. And we produce as output the electric signals that control our body and let us take action.

Of course, we don’t control the parameters that we are invoked with. The world outside, the people we meet, the problems we face are all inputs that we (as functions) must consume; they are things that we must make decisions about — how do I react when my friend says hi? how do I react when I see a car driving directly at me? etc…

However, humans are not merely normal functions. We can change through learning. Thus, we are self-modifying functions — we have the ability to re-write ourselves based on the input we receive.

Learning

If we touch a stove and burn our hand, we use our knowledge of causation (i.e. touching the hot stove caused pain), past experiences with pain (pain is something to avoid), and learning strategies (how to process new information into a useful format for storage) to modify ourselves. Thus, the next time we are presented with a hot stove we won’t decide to touch it a second time.

Interestingly, this is not true for everyone. Some people will still touch the stove a second time and burn themselves. Why? Because their memory of past experiences, their learning tools, or something else in their mind isn’t working correctly. Their function is buggy and for whatever reason doesn’t have the mechanism to rewrite itself properly (i.e. learn).

So, continuing with the analogy of humans as self-modifying functions, we have, in some sense, the ability to change ourselves. But, in the end, it’s still the contents of the function body which determines how we react to the input we are given. The function body decides how to process the input, and thus, what we learn from the experience.

Thus, the tools you currently have in your brain are inherently limiting. You can turn inputs into permanent knowledge, but only using the tools and knowledge you have available to you now. So, the pseudo-code for your brain would be an event loop that looks like this:

var brain = function() { /* Your genes define your initial brain state */ };

while (true) {
  brain = brain( get_sensory_input() ); // Returns a new function that is different from before
  brain.act(); // Act based on your current brain state
}

You have no free will

When you think about it like this, you see that your current brain state determines your next brain state. Thus, your current brain state was determined by your previous brain state. Using induction, you can take this all the way back to earliest childhood.

Even if you try to improve or change yourself through learning, meditation, or introspection, you are still limited by the physiology of your brain. For example, even if you introspect really intensely, you can’t really ever free yourself of your inherent limitations. Even thoughts about thought itself (i.e. metacognition) are still thoughts, controlled by the physiology of your brain, your past experiences, your emotional state, etc. Metacognition and introspection create a convincing illusion of free will.

Thus, I claim that the cognitive “function” you were born with, combined with inputs from your environment, ultimately determines who you are today. Since you do not determine your own starting state, nor the inputs you receive, you aren’t really responsible for your current self, your achievements, or your faults. In the end, all mental processes are out of your control.

What are the implications of this?

None, really. This discussion isn’t particularly practical since there is no easy method to verify the validity of any of these claims. It’s just interesting to think about.

I don’t think that believing or disbelieving in free will should change your behavior. In fact, believing that you don’t have any free will could probably only change your behavior for the worse. Discovering the true nature of free will is important not for any practical reason, but for the same reason that discovering how any other part of reality works is important. It brings us closer to the truth, to understanding our lives and our place in the universe.

More on this subject

If you want to think about this stuff more, I highly recommend this talk: Sam Harris on “Free Will”. It is brilliant. Sam lays out all the main arguments against the existence of free will in a clear, persuasive manner.

Also, I recently watched a Google Tech Talk that contained a lot of great information on how brains in young children work. It’s called Think faster, focus better, and remember more. It only strengthens my belief in this self-modifying function hypothesis.

Lastly, the New York Times recently published this: Neuroscience and Moral Responsibility.

If you have any thoughts on this post, please leave a comment. I’m interested to hear what others think about this idea.

Update (Aug 12, 2012)

My friend Mikee Nguyen sent me this excellent, relevant clip from the film Waking Life:

Open sourcing several projects

2012-08-05T00:00:00-07:00

Today, I’m releasing the source code for a couple of my past projects.

The projects

Instant.fm, a music playlist sharing service. [github]
Fling, a way to send songs, videos, and urls from your phone to your desktop computer by flicking your wrist. [github]

I released the code for these projects a while ago but never posted about it:

CMSploit, a security scanner to find temporary config files that contain passwords on public websites. [github]
WireSheep, shows you each user on the network and all the HTTP requests they’re making. [github]
Selective Attention Test, a new version of the famous gorilla video. [github]

Your turn!

Release some of your own code! All the cool kids are doing it. Happy hacking!

1% of CMS-Powered Sites Expose Their Database Passwords

2011-11-17T00:00:00-08:00

Nearly 1% of websites built with a content management system (like WordPress or Joomla) are unknowingly exposing their database password to anyone who knows where to look.

TL;DR — Summary of the Problem

Using a text editor to modify content management system (CMS) configuration files (like wp-config.php) could expose your database password to the world. Several popular text editors like Vim and Emacs automatically create backup copies of the files you edit, giving them names like wp-config.php~ and #wp-config.php#. If the text editor crashes or the SSH connection drops during editing, then the temporary backup files may not be cleaned up correctly. This means that the CMS config file (which contains the database password) could accidentally be made public to anyone who knows where to look.

Most servers, including the ubiquitous Apache, will happily serve the plaintext of .php~ and .php# files without passing them through the PHP preprocessor first, since they don’t have the .php file extension. Thus, your sensitive database credentials are just one GET request away from being accessed by a malicious party.

I wrote an automatic program, which I call CMSploit, to test for the prevalence of this issue across the wider web. I tested the top 200,000 websites (as ranked by Quantcast) and found that 0.11% of websites are vulnerable. If we eliminate non-CMS sites, and just look at CMS-powered websites, then we find that 0.77% of websites running a CMS have publicly-visible config files.

Here is a presentation I gave to the Stanford ACM about CMSploit, including screenshots of sites whose passwords I obtained using my CMSploit tool. Or, if you want all the gory details, then keep reading.

CMS Configuration Files

Most content management systems (CMSs) store sensitive settings like the database hostname, database name, database username, and database password in a file that sits in the root of the web directory.

Here is what a typical config file looks like:

<?php

define('DB_NAME', 'my_secret_database'); /** Name of WordPress database */
define('DB_USER', 'secret_agent_1'); /** MySQL database username */
define('DB_PASSWORD', 'you_will_never_guess_this'); /** MySQL database password */
define('DB_HOST', 'localhost'); /** MySQL hostname */

?>

Here is a list of the various configuration files used by the most popular CMSs:

wp-config.php        # WordPress
config.php           # phpBB, ExpressionEngine
configuration.php    # Joomla
LocalSettings.php    # MediaWiki
mt-config.cgi        # Movable Type
settings.php         # Drupal

Despite the fact that these configuration files exist in a publicly accessible folder, the file contents are unviewable by a normal web user. Accessing the file directly does not work because the PHP interpreter handles all requests to .php files and wisely returns a blank page instead of the actual file contents. (Try accessing http://www.example.com/wp-config.php on your favorite WordPress blog to see what I mean. You should get a blank page back.)

As you can see, all the sensitive database information is located within <?php ?> tags. So, even if a malicious user were to access your config file directly, the PHP preprocessor would just run the PHP code, which defines some PHP global variables and then returns a blank page. Thus, no harm done, right?

Text Editors Make Temporary Files

Popular command line text editors like Vim, Emacs, Gedit, and Nano create several temporary backup files during the course of file editing. When you open a file for editing, a backup of the original file is saved. Depending on your text editor, in-progress file changes might also be saved to a swap file, so you can restore your unsaved changes in the event of a program crash, power outage, or connectivity issue.

If all goes well, when you’re done editing the file, the text editor deletes the temporary files so your filesystem doesn’t accumulate dozens of old temporary files. However, if your text editor crashes or you lose your connection, then the temporary files will still be on your filesystem.

Here are the temporary filenames used by the most popular text editors (assuming a file named wp-config.php):

wp-config.php~        # Vim, Gedit
#wp-config.php#       # Emacs
wp-config.php.save    # Nano
wp-config.php.swp     # Vim (swap file)
wp-config.php.swo     # Vim (swap file)

Putting Two and Two Together

If a CMS user edits a config file on their live site (as opposed to editing it offline and uploading it over FTP), then there may be temporary files which contain their database password floating around in publicly-accessible folders.

If someone requests one of these temp files, then most servers will return the plaintext, skipping the PHP parser completely — yikes! By default, Apache assumes that only files which have a .php file extension are PHP files. If the file extension is not .php, Apache happily serves up the plaintext of the file.

How prevalent is this problem?

After noticing this security issue on one of my websites, I became curious to find out how common it is across the wider web. So, I wrote a program to test the top websites and get a rough idea of the prevalence of this problem. I call it CMSploit. The program is pretty simple — it issues GET requests to a site to test for the presence of temporary backup files with common CMS config filenames.

Here were my results:

Tested the 216,391 most popular websites (according to Quantcast).
Found 230 config files visible in root of site.
Thus, 230 / 216391 = 0.11% of all websites are vulnerable.
Latest stats say that about 13.8% of the top 10,000 websites run CMSs. If we just focus on CMS-powered websites, then the percentage of vulnerable sites is much higher:
Thus, 230 / (216391 * 0.138) = 0.77% of websites running a CMS are vulnerable.

It’s shocking to think that 0.77% of websites (1 out of every 130) built with a CMS has its database password just sitting there in a public folder for all the world to see. Lots of these are popular, active websites. You would likely recognize many of them. Most of the sites were WordPress blogs, but there were a surprising number of e-commerce sites too, which is a little scary.

Responsible Disclosure

I contacted several of the highest profile sites to notify them of this security issue on their site. Most of them fixed the problem within a few days. All who replied to me were extremely grateful for bringing the issue to their attention. One of the companies even offered me a free license to their software.
I submitted a vulnerability report with US-CERT. Unfortunately, they replied with “This issue is not the type of vulnerability class we are inclined to coordinate or publish on.” I also plan to submit reports with Apache, PHP, WordPress, and Vim/Emacs.
After running the script and collecting my research statistics (published above), I securely wiped all the config files from my hard disk. I did not attempt to login with any of the database credentials I discovered. Therefore, it was not possible to determine what percentage of the database credentials were valid or what percentage of database servers were open to remote connections.

Lessons Learned

CMS users should never edit their config.php file (or other sensitive files) with a text editor that creates temporary backup files. The best policy is to avoid editing any sensitive files on a live website. Instead, copy the file locally, make your edits to it, and copy it back to the server.
It’s trivially easy to write a script to search for vulnerable sites. Bad people have probably been doing it for several years. In fact, this issue has even been discussed in other forums before. You should check your sites for wp-config.php~ and related files. Make sure your sites are not vulnerable.
Someone should fix this. It’s not completely clear where responsibility lies, though. Is it Apache’s fault? Or PHP? Or vim/emacs? Should WordPress and other CMSs do something about it? There are many ways to fix this problem. I don’t particularly care how it gets fixed, as long as the default configuration of Apache + PHP + vim/emacs + WordPress don’t have this problem, I’ll be satisfied. In the meantime, using this very common web stack we have a scenario where ~1% of sites expose their passwords. This is bad.
You should configure MySQL to deny remote connections to your database and connect to localhost instead. If you absolutely need remote access, then explicitly whitelist certain IPs and deny the rest. This way, if someone gets your database credentials, they’ll be unable to actually log in.
In the short term, you should proactively protect all your websites. If you run WordPress and Apache, you can block access to any file containing the string wp-config.php with a .htaccess rule like this:

<Files ~ "(^#.*#|~|\.sw[op])$">
Order allow,deny
Deny from all
</Files>

Modify the rule to suit your CMS and server environment.

Final Thoughts

Even though the discovery that 0.77% of CMS-powered websites have public database passwords is already shocking, I’m pretty confident that you could easily double or triple the number of vulnerable sites with a better, more thorough script, and lots more time.

The script I wrote only tests the root of each site for CMS config files. However, lots of sites run CMSs in subfolders and subdomains like /blog/, /wiki/, /forums/, blog.mydomain.com, etc. Testing these places would dramatically increase the number of vulnerable sites detected.

I will not publish the source code of this script, because of the potential for harm. However, if you are a security researcher and are interested in reviewing the source code, send me an email.

This DEFCON talk is relevant: Pillaging distributed version control system repos for fun and profit.

Discussion on reddit.

Update (Mar 8 2012)

There is now an Nmap script, inspired by CMSploit, that appears to do everything that my script does. (I’m not affiliated with Nmap or this particular script.)

Update (Aug 22 2012)

The code for CMSploit is now available on Github.

Thanks to John Hiesey for reading a draft of this.

Linode VPS Hosting Review

2011-11-14T00:00:00-08:00

People keep asking me to share how I handled the viral traffic rush to YouTube Instant — 1 million visitors in 10 days — and which VPS hosting provider I recommend.

The answer to both questions is Linode, so here is my review of Linode hosting.

Linode = Awesome Hosting

I’ve been using Linode to host my websites for the past 2+ years and I’m thoroughly impressed by the service. I can’t recommend them enough — it is easily the best web hosting service I’ve used to date.

If you’re coming from the shared hosting world, then let me tell you: a virtual private server (VPS) is a whole new world. A VPS means freedom, power, and total flexibility. You get access to everything from root, the kernel, and on up. All managed from the command line and, occasionally, the simple Linode control panel. Your Linode is completely and totally your machine.

Linode uses the Xen hypervisor for virtualization which means that your CPU, memory, and disk resources are really yours. You get a guaranteed portion of the server resources. If another user has a really popular site, your sites will not be affected. However, if there are extra unused resources, then your websites will automatically burst above your limits to make use of the extra CPU cycles or disk time, if you require them.

A couple things to keep in mind about Linode:

Your Linode comes with a vanilla installation of Linux. You get to pick which Linux flavor to install on your server (I chose Ubuntu), but you have to configure the whole thing from the command line. Which brings us to…
Your Linode comes with no traditional control panel to help you set up your domains or help you configure virtual hosting. That means no CPanel or Plesk. Just the command line.

You will need to install Apache, MySQL, set up iptables firewall rules, disable remote root access, and configure Apache virtual hosts (to serve multiple sites with one IP address) etc. on your own. At first, this scared me a bit, but it’s actually not bad at all. It took me about a day to learn how to do everything I wanted to do and there are plenty of excellent tutorials online. The Linode Library and Slicehost Articles should have all you need to get going.

Some things that surprised me:

I get stuff done much more quickly on the command line then I ever did using control panels and lame, poorly designed graphical tools.
The command line is extremely empowering. If you’ve never had to use the command line for much before, it can be intimidating. At first, it’s difficult to understand the appeal of the command line, especially if you’re a designer or a programming noob. But, trust me, the command line is the way to go. The sooner you get comfortable using it, the happier you’ll be. I’m telling you, it’s a whole new world.

Another advantage of using the command line is that you no longer need to buy hosting that offers a bloated control panel package like CPanel or Plesk. Because of this, Linode prices are dirt cheap: $20/month to get started.

Some things that make Linode awesome:

About once a year, Linode upgrades the storage and RAM for all users at no extra cost. For example: when I first joined Linode in 2009, I hosted all my sites on their cheapest plan — 360MB ram, 16GB storage, 200GB transfer — for $20/month. Since then, they’ve upgraded this so the same server now comes with 512MB ram and 24GB storage — neat!
Unlike most shared hosting providers, Linode does not oversell their hosting. At a cheap shared host, if you get even close to using all the bandwidth and storage that you paid for, you’d get shut down for “misusing resources” and “unfairly affecting other users on the server”. With Linode, your resources are actually yours — Linode doesn’t oversell.

Hosting Viral Websites with Linode

If you’re considering a Linode, I recommend you start out with the smallest one and upgrade if/when you need to.

I currently host all my sites on the “Linode 768” plan — 768MB ram, 30GB storage, and 300GB transfer. When one of my sites goes viral, like YouTube Instant did or EmuSpin did, I just migrate to a bigger Linode.

For example, as YouTube Instant picked up steam, I upgraded the server several times, eventually ending up at the “Linode 4GB” plan — 4GB ram, 160GB storage, and 1600GB transfer. Migrating plans takes about 15 minutes, and your sites will be inaccessible during that time.

If I had more time, I would have switched from Apache to Nginx so that each new visitor wouldn’t spawn a whole new 20MB process. As you’ll quickly find out, the scarcest resource in a VPS hosting environment is RAM. Nginx — and other high concurrency, low memory servers — are a lifesaver here.

Linode rocks!

If you want to sign up, use my referral link and I’ll get a couple weeks of free hosting. If you prefer not to, here’s the plain link: Linode.com

Happy hacking!

Content, not Chrome

2011-11-01T00:00:00-07:00

Autoupdate is one of Google Chrome’s killer features. Per this post:

Delving back into project history long before we launched publicly in 2008, the autoupdate project was one of the very first we started working on. The idea was to give people a blank window with an autoupdater. If they installed that, over time the blank window would grow into a browser. And today, some five years after our autoupdater started updating a mostly blank window that could barely load webpages, it is now an engine for delivering an incredibly sophisticated web technology platform onto our users' computers, which in turn allows web app developers to build amazing new online experiences. I have never seen such an effective platform update mechanism before.

How cool is that??! :)

Invisibility is a key part of one of Chrome’s four “S"s – simplicity. We seek not to bother the user with information that is irrelevant. As important as it might seem to engineers for our users to weigh fully a variety of considerations relating to our software, in reality they have better things to be doing. They’re trying to find a restaurant, check an email, post a facebook update, and then get the hell away from the computer. Every time the user agent steps in between the user and their task, we slow them down and diminish their enjoyment. Content, not Chrome.

What an awesome way to think about design.

HOW TO: Spy on the Webcams of Your Website Visitors

2011-10-18T00:00:00-07:00

I discovered a vulnerability in Adobe Flash that allows any website to turn on your webcam and microphone without your knowledge or consent to spy on you.

It works in all versions of Adobe Flash that I tested. I’ve confirmed that it works in the Firefox and Safari for Mac browsers. Use one of those if you check out the live demo. There’s a weird CSS opacity bug in most other browsers (Chrome for Mac and most browsers on Windows/Linux).

Video demo of the attack

Source code: Github. Video demo: YouTube

Updates about the vulnerabilty

10/19/2011: CNET says that Adobe is working on a fix and it could be ready by end of week. Adobe also emailed me and said “our product team is wrapping up their investigation and is now working on a fix, which should not require a Flash Player update”.
10/20/2011: Whoa, this story is everywhere! News stories have been published in CNET, Wired.com, The Register, Ars Technica, Gizmodo, PC World, Yahoo! News, ZDNet (and another ZDNet), The Inquirer, Computer World, and The H Security. Lastly, this is an interesting opinion piece: “The Sins of the Flash”
10/20/2011: Adobe says they just posted a fix to the Settings Manager that should resolve the issue. I just tested it out, and indeed the issue appears to be fixed now. Congrats, Adobe, for the quick fix!
12/21/2011: This attack made it into Jeremiah Grossman’s list of top web hacking techniques of 2011. It’s #26.
1/10/2012: Another similar clickjacking attack was just discovered. Adobe has fixed it.
5/9/2012: FOX News in Cleveland just ran a story about this.

Read on for the original blog post.

Clickjacking + Adobe Flash = Sad Times!

This attack works by using a neat variation of the normal clickjacking technique that spammers and other bad people are using in the wild right now. For the uninitiated:

Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

— Wikipedia

Combine clickjacking with the Adobe Flash Player Setting Manager page and you have a recipe for some sad times.

Background

I took a computer security class (Stanford’s CS 155) last quarter and really enjoyed this research paper on framebusting and clickjacking. After reading it, I checked out a few popular sites to see if it was possible to clickjack them. After a couple hours, I had no success.

But, then I stumbled upon this blog post entitled “Malicious camera spying using ClickJacking" where the author shows how to clickjack the Adobe Flash Settings Manager page to enable users' webcams. He accomplishes this by putting the whole settings page into an iframe and making it invisible. Then, unsuspecting users play a little game and unwittingly enable their webcams. Adobe quickly added framebusting code to the Settings Manager page (why wasn’t it there in the first place?), and the attack stopped working.

But alas, the same attack is actually still possible.

How my attack works

Instead of iframing the whole settings page (which contains the framebusting code), I just iframe the settings SWF file. This let me bypass the framebusting JavaScript code, since we don’t load the whole page — just the remote .SWF file. I was really surprised to find out that this actually works!

I’ve seen a bunch of clickjacking attacks in the wild, but I’ve never seen any attacks where the attacker iframes a SWF file from a remote domain to clickjack it — let alone a .SWF file as important as one that controls access to your webcam and mic!

The problem here is the Flash Player Setting Manager, this inheritance from Macromedia might be the Flash Player security Achilles heel.

— Guy Aharonovsky

This is a screenshot of what the Settings Manager .SWF file looks like:

Live Demo

I built a quick proof-of-concept demo to show how it works.

Important point: The demo is only guaranteed to work in Firefox and Safari for Mac. Right now, it doesn’t work in most other browsers since you can’t change the opacity or the z-index of an iframed swf file. However, I discovered a workaround that involves multiple iframes, but haven’t implemented it yet since it’s a bit complicated. But, I’m pretty sure that it’s possible to make it work everywhere, given enough time.

Important point 2: The vulnerability has been fixed by Adobe, so the demo does not work anymore.

View the demo. The code is also available on Github.

I should also mention that my demo builds heavily off of the ideas and work done by the dude who runs this blog, Guy Aharonovsky.

Also: If you’re a bit leery about running the demo… I promise I’m not saving the webcam video. I just display it back to you so you can see that it works. However, if an attacker used this technique, they would almost certainly NOT show you any sign that your cam is on. You’re only hope of finding out that something’s up is your webcam indicator light (if you have one).

Why release this?

I reported this vulnerability to Adobe a few weeks ago through the Stanford Security Lab. It’s been a few weeks and I haven’t heard anything from Adobe yet. I think it’s worth sharing it with the world now, so that Adobe pays attention and fixes it more quickly.

Although every browser and OS is theoretically susceptible to this attack, the process to activate the webcam requires multiple highly targeted clicks, which is difficult for an attacker to pull off. I’m not sure how useful this technique would actually be in the wild, but I hope that Adobe fixes it soon so we don’t have to find out.

Think Different

2011-10-09T00:00:00-07:00

One of my favorite quotes:

Almost everything—all external expectations, all pride, all fear of embarrassment or failure—these things just fall away in the face of death, leaving only what is truly important. Remembering that you are going to die is the best way I know to avoid the trap of thinking you have something to lose. You are already naked. There is no reason not to follow your heart.

— Steve Jobs

One of my favorite ads:

Really gets the blood pumping, huh?

Interesting story about this video. Steve Jobs narrated the very first version of this Think Different commercial “Here’s to the Crazy Ones” (shown above). Sadly, this version never aired. Richard Dreyfuss did the voiceover in the version that aired.

Human Assumptions and Prejudices

2011-10-08T00:00:00-07:00

An excerpt from Orson Scott Card’s Xenocide, where two aliens of different species are conversing.

< You spoke a moment ago as if you believed that human beings had actually acheived intelligence.>

< Clearly they have.>

< Self-delusion. Even at their best, they never, as individuals, rise above the level of manual laborers. Who among them has the time to become intelligent?>

< Not one.>

< They never know anything. They don’t have enough years in their little lives to come to an understanding of anything at all. And yet they think they understand. From earliest childhood, they delude themselves into thinking they comprehend the world, while all that’s really going on is that they’ve got some primitive assumptions and prejudices. As they get older they learn a more elevated vocabulary in which to express their mindless pseudo-knowledge and bully other people into accepting their prejudices as if they were truth, but it all amounts to the same thing. Individually, human beings are all dolts.>

< While collectively…>

< Collectively, they’re a collection of dolts. But in all their scurrying around and pretending to be wise, throwing out idiotic half-understood theories about this and that, one or two of them will come up with some idea that is just a little bit closer to the truth than what was already known. And in a sort of fumbling trial and error, about half the time the truth actually rises to the top and becomes accepted by people who still don’t understand it, who simply adopt it as a new prejudice to be trusted blindly until the next dolt accidentally comes up with an improvement.>

< So you’re saying that no one is ever individually intelligent, and groups are even stupider than individuals – and yet by keeping so many fools engaged in pretending to be intelligent, they still come up with some of the same results that an intelligent species would come up with.>

< Exactly.>

< If they’re so stupid and we’re so intelligent, why do we only have one hive, which thrives here because a human being carried us? And why have you been so utterly dependent on them for every technical and scientific advance you make?>

< Maybe intelligence isn’t all it’s cracked up to be.>

< Maybe we’re the fools, for thinking we know things. Maybe humans are the only ones who can deal with the fact that nothing can ever be known at all.>

YouTube Instant Shortlisted for Best API Use in .Net Magazine Awards

2011-10-04T00:00:00-07:00

YouTube Instant made it onto the shortlist for Best API Use in the .Net Awards. It’s right there with Instagram and Gowalla!

I want to thank all the people who voted for me — I feel so honored and humbled by all the attention. I’ll do my best to keep making cool stuff that delights people.

Also, I want to thank the good people at .Net Magazine for putting on this awesome award series to recognize so many of the creative people who work in web design and development.

Update

Instagram won the award. Congrats to the Instagram team and all the other participants!

Age of Empires II and Longevity

2011-09-14T00:00:00-07:00

Age of Empires II is a real-time strategy game developed by Ensemble Studios and published by Microsoft in 1999. After it came out, it was the standard by which all other RTS games were measured for many years. Some say it still is.

What’s so crazy about this game is that people still play it at LAN parties, over 12 years after it came out. Talk about longevity! Of course, they’re now playing it on Windows 7, instead of Windows 2000.

It’s hard to believe it, but Age of Empires II was originally released for Windows 98 and 2000 — it came out a whole two years before Windows XP existed! Its requirements were a 166 MHz processor, 32 MB memory, and 200 MB disk space. It’s hard to believe that a video game — or any program for that matter — could possibly run with just 32 MB memory! How times have changed…

And four OS releases later, it still runs nearly flawlessly on Windows 7. If Microsoft excels at any aspect of OS development it’s definitely backwards compatibility.

How I Learned to Program Computers

2011-09-13T00:00:00-07:00

I’ve been asked this question a lot lately, especially after I built YouTube Instant. So, here’s the answer, once and for all, for those who are interested.

In short:

I learned how to program by building lots of websites.

The full story:

I learned how to program by working on lots of different website projects starting from a pretty young age. What follows is a full account of all the major websites I’ve built, back to the very first site I made when I was 11 years old. What I hope the reader takes away from this full retelling is the importance of doing lots of side projects if you want to learn to program well.

The best way to learn a new skill is to practice, practice, practice. All the best programmers that I know sincerely enjoy programming — it’s something that makes them absurdly happy to do. And, so they do it a lot. Often, an unhealthy amount. Learning how to program — and how to do it well — doesn’t take superhuman ability. It just takes a willingness to get your hands dirty and build stuff.

It doesn’t matter what you build, as long as you pick something and start. The good programmers who I know each had a different reason for initially learning how to program. Some learned so they could make video games. Some learned so they could solve their own computer problems, or work more productively. Some learned so they could build products that make people happy. Some (the true hackers) learned programming as part of a larger goal of learning how computers work at a really deep level; they want to understand the machine. Some programmers just do it because they enjoy solving difficult problems.

The single factor that unifies all these types of “good programmers” is that they all got obsessed with programming at some point in their lives, and subsequently spent a long time programming. Lots and lots of side projects.

So, without further ado, here is the story of how I learned to program:

My first website

When I was like 11 or 12 years old, I decided I wanted to make a website for myself. I can’t remember exactly why I wanted a website, I just remember that I did. So, I searched the Internet for free information about how web pages, web browsers, and HTML worked. A lot of the information I found was out-of-date, plain wrong, or advocated bad practices (like making separate websites for Internet Explorer and Netscape), but it was really interesting and I learned a lot of neat stuff.

Despite the shoddy information I found online, I was able to make a simple website, which I called “Feross’s Website”. I built it with Microsoft Frontpage, which had really cool side-by-side WYSIWYG and HTML editors. I could make changes using familiar commands like Bold, Italics, etc. and see how that affected the HTML code in realtime. A great way to learn.

Here are some screenshots of my first site. It’s no longer online.

You can’t see it in the above screenshot, but almost every element on the site blinked, flashed, moved, or made sound. I put a different MIDI song on every page of the site. They all played automatically and there was no way to stop the music, unless you muted your speakers. Ah, good old web design from the early 00’s :D

As I got older, I tried to make my site better by redesigning it. I used free website templates that I found online and modified their images in Microsoft Paint.

Even though I built heavily on existing templates, I think this was a pretty good way to learn how HTML and web browsers worked. “Feross’s Website” didn’t have a purpose other than to collect a few movies I made as a kid, so it got boring after a while.

My first real project

In 9th grade (14 years old), my friends and I were pretty obsessed with watching flash movies and videos on websites like Newgrounds and eBaumsWorld (this was before 2005, so YouTube didn’t exist yet). I spent lots of time on these sites so I knew about all the best videos and games. I thought it would be really cool to make a website that collected all my favorite flash animations, videos, and games from around the Web in one place. That’s where I got the idea for FreeTheFlash.com. Here is what it looked like:

I used all the HTML I learned from working on “Feross’s Website” and also got my hands on a copy of Macromedia (now Adobe) Dreamweaver, which allowed me to use templates for the repetitive parts of the site.

After a while, I realized that I should make the site dynamic (I remember hearing that buzzword a lot), which basically meant that the site would be powered by a programming language like PHP, instead of just static HTML. So, I bought a book called PHP and MySQL for Dynamic Websites for $20 from Amazon and redesigned the site to use PHP and MySQL. I also gave it a fresh coat of paint:

I continued to work on FreeTheFlash for 2 years in high school. It was pretty successful for my first attempt at a “real” website — it had 600,000 visitors and 3 million page views in 2006. FreeTheFlash taught me how awesome it feels to make a product, stick it out there, and watch lots of people using it. It made me want to build a lot more websites.

My second website

In high school, I took pretty good notes for a few of my AP classes. So, in 11th grade, I decided to put my notes online for other students to use, if they didn’t feel like reading the textbook. I made a site called StudyNotes which I built with PHP and a content management system called Joomla. I also experimented around with Drupal, but found it to be too complicated.

That same year, I also made a website for my school’s Key Club chapter. It’s archived here.

During this period, I spent a large amount of my free time reading WebmasterWorld, a forum for website publishers and SEO experts to speculate about the Google algorithm, discuss AdSense tricks, and debug website design issues.

Lots of studying and reading

After I got to Stanford, I took lots of great computer science classes like CS106X and CS107, and I also started section leading the CS106 classes.

I spent almost all my time outside of class reading about design, programming, browsers, and JavaScript. Like 4-5 hours a day.

What did I read? Lots of different stuff. But, mostly blogs by first-class designers and programmers who I admire a lot. Real badasses. For a sampling of some of these blogs, take a look at the Respect Rollcall in the sidebar of this blog. NOTE: Changed blog design and removed this list. It’s on Gist for posterity.

A viral hit

Then, in the summer of 2010, while interning at Facebook, I built YouTube Instant to settle a bet with a friend. It’s a video site that lets you search YouTube in real-time. The site went on to get 1 million visitors within 10 days of launch, and the YouTube CEO also tweeted me a job offer. Read about the media frenzy here.

I know that YouTube Instant’s success was mostly due to chance good timing and a little luck. Read None of Us Knows What We’re Doing for some more of my thoughts about that.

The beat goes on

I noticed that lots of people were using YouTube Instant to listen to music videos, and that got me thinking about other cool ways to use the YouTube API. So, my friend Jake Becker and I decided to spend the first 3 months of 2011 building Instant.fm, a really easy way to share music playlists with your friends. We both learned a ton of new stuff during this project.

Some things we mastered during this project:

jQuery
CSS (and Modernizr and YepNope for cross-browser issues)
Python
Tornado (web framework/server)
Git (version control) & GitHub
Last.fm API
YouTube API
Working on a team

And some other things we learned how to use, too:

Nginx (web server)
Supervisor (to daemonize Tornado)
SQLAlchemy (ORM)
Apache Ant (to build and deploy the site after a push)

Read more about all the tech we learned in Instant.fm Tech Stack.

TL;DR — Just start building stuff!

The point of this long expose on everything I’ve built since age 11 is that if you want to learn programming, then you need to start building stuff! Right now. No more excuses.

Doing something is the fastest way to learn it.

Reading a programming language book from front to back is boring and you’ll quit before you finish it. But, if you have a project in mind, you can learn what you need to know as you go along, which is more effective both in terms of speed and mastery of the content.

Computer science classes

Taking CS courses at a university is another great way to learn programming. Most good CS curriculums emphasize learning the important concepts and paradigms in the field of CS, as opposed to teaching a specific programming language. This can be an eye-opening experience for self-taught programmers who’ve never had any formal education.

I remember sitting in my first-ever CS class at Stanford (a class taught in C++) thinking “How on EARTH can they have variables that don’t start with dollar signs?” Up until that point, I’d only ever programmed in PHP! :) It took a while for me to drop the habit of $putting $dollar $signs before every variable name!

Work at a software company

Another way to get much better at programming is to work at a software company like Facebook or Quora, which I did over the last two summers. You’ll learn how to program from people way better than you, how to read and understand other people’s code, and how to work on large projects with a team.

Still — more than anything else — the very best way to learn programming is to do side projects. Have I repeated this enough times, yet? :)

How to learn programming:

Do side projects.
Buy and read programming books.
Do side projects.
Take computer science classes.
Do side projects.
Read programming blogs.
Do side projects.

That’s the best advice I got.

Happy hacking!

This was originally posted as an answer to “How did Feross Aboukhadijeh learn to program?” on Quora.

Learning a lesson the hard way

2011-09-13T00:00:00-07:00

The media has been good to me for the most part. But these stories are just stupid:

Misquoted

All these news stories take a funny anecdote that I shared with New York Magazine and distort it into pageview-generating, linkbaiting, tweet fodder. I’ve come to expect bad journalism from most of the tech press, so I’m not really surprised that they would do something like this. What upsets me the most, is that most readers will undoubtedly take away the wrong message from the story.

Here is the full quote:

Zuckerberg doesn’t code much for Facebook anymore, the same way that Steve Jobs never hand-coded software for the iPhone. But, as the Groups team was adding the finishing touches to its product, Zuckerberg said he wanted to write a few lines. “Everybody was like, Ohhhh, Zuck’s gonna write code,” says Feross. Someone set up an easy bug for him to fix—adding a link to a picture, or something—and he went to work. Five minutes passed. Twenty minutes. An hour. “It took him like two hours to do something that would take one of us who’s an engineer like five minutes,” says Feross. It was like a retired slugger coming back for one last at-bat, for old time’s sake, and finding he’d lost more of his game than he’d reckoned. Still, he got props from Feross & Co. for getting his hands dirty.

It’s moments like these that growing tech companies struggle to hang on to. When Zuckerberg gets in the trenches with the grunts, it sends a message: Programming is the core of their world.

My intention in sharing this story was to give an example of how Facebook’s company culture is awesome. Facebook is a company where the CEO frequently sits in the same room as engineers — and even interns — to work out problems, critique designs, and discuss product issues. The company is extremely flat. Everyone can talk to everyone. Even interns regularly get to talk with Zuck. It’s an extremely fun and exhilarating environment.

Employees even make bets, joke, or play pranks on the CEO, hence the “Ohhhh, Zuck’s gonna write code” comment that someone made. Facebook is extremely fun. It’s one of the best company cultures I’ve ever seen (in my short career).

These news outlets are doing their readers a disservice by twisting this quote out of context.

Lesson learned: I need to be more careful about what I say to the media. Even though they’ve been really good to me, they’re not always going to be on my side. Glad I learned this lesson now, rather than later.

In the news again...

2011-09-12T00:00:00-07:00

Over one year after I built YouTube Instant, my little 3 hour project is still getting talked about in the national press.

To me, it’s a giant lesson about the power of programming for the Web. It’s also proof that engaging with the media through blogging, Twitter, and Quora can create a meaningful public discussion and even help you shape a news story.

New York Magazine – “Bubble Boys”

September 11, 2012. Out in Silicon Valley, the last bastion of full employment, the Steve Jobs and Mark Zuckerbergs of the future are staying up all night writing code in dorms. Read the article.

CNN News – “Hiring Spree in Silicon Valley”

May 18, 2011. Companies are waging fierce competition to hire the best talent. CNN’s Dan Simon reports. Watch the video:

Older news stories

And, for completeness, here are a few older news stories that I haven’t blogged about yet.

Sacramento Magazine – 2010 Person of the Year

January 2011. When Internet behemoth Google rolled out its “instant search” tool in early September, Feross Aboukhadijeh, 20, of El Dorado Hills set himself a goal: to create the same sort of function for YouTube and complete it within the hour. Read the story.

All Things Digital – “Instant.fm Launches”

April 22, 2011. The idea is simple: drag a playlist from someplace, iTunes included, and Instant.fm queues up YouTube videos of the songs in the list, playing them in the playlist’s order. [Read the story][http://allthingsd.com/20110422/early-adopter-from-the-hacker-who-brought-you-youtube-instant-instant-fm-launches-today/] or watch the video:

And a few more…

That’s all for now!

Announcing SpoofMAC - Spoof your MAC address in Mac OS X

2011-09-01T00:00:00-07:00

The quickest way to spoof your MAC address is to download SpoofMAC directly from GitHub.

What is SpoofMAC?

Something I’ve needed to do from time to time is spoof my computer’s MAC address. This is useful for debugging network issues or temporarily getting onto the Stanford Wi-Fi network when my physical MAC address changes, such as when Apple replaced my logic board (motherboard).

For the uninitiated, a Media Access Control address (MAC address) is “a unique identifier assigned to network interfaces for communications on the physical network segment”. You can read more on Wikipedia.

Despite the fact that all network devices (laptops, iPhones, routers, etc.) have physical MAC addresses burned into the hardware, you can actually change (or spoof) your MAC address completely in software, and other network devices will only see your spoofed address.

My Solution

So, I made a Python script that lets you change your MAC address in one command. Check it out and download it from Github. Improvements welcome!

That’s it!

Let me know in the comments if you find this useful.

Update (March 18, 2013)

Since uploading this to GitHub, SpoofMAC has received many useful code contributions. It now supports Windows and Linux, MAC address randomization, and more. I <3 open source!

2011 .Net Magazine Awards

2011-08-02T00:00:00-07:00

I’m really elated to find myself nominated for this year’s .Net Magazine Awards.

I’m humbled by the way YouTube Instant took off so quickly after I built it and I’m extremely thankful to the hundreds of thousands of good people who tweeted, liked, stumbled and otherwise shared my little hack and helped turn it into a worldwide sensation for a few weeks.

Thanks to the good people at .Net Magazine for putting on this awesome award series to recognize so many of the creative people who work in web design and development. Here are the nomination categories:

#3 Best API Use: YouTube Instant
#12 Brilliant Newcomer Award: Feross Aboukhadijeh

Visit the .Net Awards site to vote & view all the nominees.

Update

YouTube Instant made it onto the shortlist for Best API Use!

Stanford Open Source Workshop

2011-05-23T00:00:00-07:00

Here’s an awesome video from the open source hacking event that my club, the Stanford ACM, organized this quarter.

I love Mozilla. We’re definitely doing this again.

Feross.org

Introducing the HTML5 Hard Disk Filler™ API

How to troll using HTML5 localStorage

Proof-of-concept demo

Features:

Let’s fix this

Update (Mar 13, 2013)

Travels in Japan

Some things that make Japan unique

Photos from our travels!

Japan – Day 1

Japan – Day 2

Japan – Day 3

Japan – Day 4

Japan – Days 5 and 6 [Climbing Mt. Fuji]

Japan – Days 7 and 8

Japan – Day 9

Japan – Days 10 and 11

Japan – Day 12 [Rabbit Island!]

Japan – Day 13

Using the HTML5 Fullscreen API for Phishing Attacks

What just happened?

The “Fullscreen API” explained

How the attack works

How I built this

Would this actually work in the wild?

Humans are terrible at spotting subtle changes

A quick note about “features vs. security” in software

How To Set Up Your Linode For Maximum Awesomeness

The Command Line Is Hard (…at first)

Tutorial: How To Set Up Your Linode

A Note About This Guide

Provision a New Linode

Connecting to Your Server

Basic Ubuntu Setup

Set the hostname

Set the fully-qualified domain name

Set the time

Update the server

Basic Security Setup

Create a new user

Set up SSH keys

Generate SSH keys

Copy the public key to server

Disable remote root login and change the SSH port

Advanced Security Setup

Prevent repeated login attempts with Fail2Ban

Add a firewall

Get an email anytime a user uses sudo

Improve Server Stability

Reboot server on out-of-memory condition

Miscellaneous nice-to-haves

Set up reverse DNS

Set up a private IP address

Install Useful Server Software

Install a compiler

Install MySQL

Improve MySQL security

Keep your MySQL tables in tip-top shape

Backup your MySQL databases

Install Python

Install Nginx

Install Apache

Install PHP5

Install Node.js

Install MongoDB

Install Redis

Setup Automatic Backups

Linode rocks!

Thoughts on free will

The human mind is a self-modifying function

Learning

You have no free will

What are the implications of this?

More on this subject

Update (Aug 12, 2012)

Open sourcing several projects

The projects

Your turn!

1% of CMS-Powered Sites Expose Their Database Passwords

How to troll using HTML5 `localStorage`

Get an email anytime a user uses `sudo`