eriksmartt.com/blog

Greasemonkey-away GMail popups

Along with adding Chat to Google Mail, the engineers seem to have gone a little pop-up crazy with the latest GMail updates. Those who’s accounts have chat activated know what I’m talking about — the pop-up’s on every person’s name are driving me mad! Thankfully I’m not the only one, and a solution has been found via a simple Greasemonkey script: “Solution to annoying GMail Talk popup“

mod_python on your phone

The Nokia Research Center just announced a Mobile Web Server project that has ported Apache and mod_python (using Python for S60) to the S60 platform. At ETech 2005, my Python in your Pocket presentation alluded to this idea that mobile application development could become a lot like web development in the future, as web servers, middleware, databases, and powerful rendering engines make their way onto mobile devices. I’m glad to see this project finally making a public announcement — it’s very cool work!

In somewhat related news, a friend sent this link as well: “The Mobile Wi-fi Access Point“. If you’re interested in patching together mobile and wi-fi networks, it’s worth a peek.

rewriting the web

I’ve been spending a little time lately brushing up my web-fu by tinkering with A-j-a-x and greasemonkey. The Ajax stuff is SO much nicer to use then the old school IFRAME hacks for dynamic content. It brings a little web-developer tear to my eye to remember the mountains of code I once wrote to make this work cross-platform back in the NN/IE 4.x days. Now it’s a method call and a callback. Beautiful.

Greasemonkey, on the other hand, is a whole different animal. I first heard about greasemonkey at ETech, which prompted a huge light-bulb to appear overhead. Unfortunately it wasn’t shining very bright, and it took a little while for the gears to crunch over why I’d want to modify the pages I was surfing (probably because I get most of my content via RSS feeds.) There’s the obvious task of stripping ad-banners and such, but that can be done with other tools already. The other problem is that I bounce back and forth between Firefox and Safari, and for the past couple months I’ve been on a Safari kick (which has no greasemonkey.)

So there I was debating switching back to Firefox to get greasemonkey when I had two thoughts: first, JavaScript wouldn’t be my language of choice for something like this, and second, there’s an obscure feature in PithHelmet (a Safari plugin/hack) that can already do this.

In the revision history notes for PithHelmet, there’s an entry on 2004-08-12 that reads “Machete allows you to clean up or remix web sites with small scripts.” Oh yeah. Once you figure out how to use the extremely obtuse user interface, you’ll find that PithHelmet has the ability to pipe incoming HTML to a shell script as stdin data, then route the stdout from the script back to the browser. The choice of which scripts to pipe to is decided based on pattern matching the URL.

To get started I picked something simple — nuking ‘target=”_blank”‘ attributes from hyperlinks. Why? Because I hate it when sites assume that I want to open a link in a new window, and this is a pretty simple pattern to match. The script looks something like this:

#!/usr/local/bin/python
import re, sys

# Compile a regex pattern to match 'target="_blank"' in hyperlinks
re_pattern = re.compile("(\<a )(.*?)(target[\ ]*=[\ ]*[\"\']_blank[\"\'])(.*?)(\%gt;)")

if __name__ == '__main__':
    # Loop over each line in stdin
    for line in sys.stdin.readlines():
        # Write the line back to stdout after dropping any 'target="_blank"' matches
        sys.stdout.write(re_pattern.sub(lambda mo:"%s%s%s%s" % (mo.group(1), mo.group(2), mo.group(4), mo.group(5)), line))

With the script saved somewhere convenient and chmod u+x‘d, I made a new rule in PithHelmet using “Regex URL Match” with the pattern: ^http:\/\/. And just like that… ‘target=”_blank”‘ was gone.

For more info and fodder on Greasemonkey, check out the following links:

• GreaseMonkey scripts
• Greasemonkey will blow up business models (as well as your mind)
• Book Burro - If there’s one script that clearly shows the power of remixing websites, this is it.
• Gmail Delete Button - I love this one. It’s a case where users are adding features to an interface to better match their needs. (Product designers take note when your customers are adding features to your products!)

PyMusique

Came across an interesting project called PyMusique that claims to be “the fair interface to the iTunes Music Store”. It probably won’t last long (ie., Apple’s pretty aggressive in shutting down projects like this), but the interesting detail to note is that the iTunes music store is actually selling non-DRM tracks — it’s iTunes that applies the DRM after the song is downloaded. Using PyMusique, you’re able to purchase tracks from iTMS (ie., actually pay for them and download them), but you skip the DRM encoding and end up with unlocked AAC files (which is probably what you wanted to buy in the first place.)

As always, redistributing music that you do not own the copyrights for is illegal, but the ability for consumers to choose how and where they listen to music they purchase is a welcome feature.

(via MacRumors.com)

ExxonMobil SpeedPass and Vehicle Immobilizers cracked

There’s a great academic paper up at http://rfidanalysis.org/ describing the successful attack on the RFID system used by ExxonMobil SpeedPass and millions of “Vehicle Immobilizer” systems (ie., vehicles who’s keys communicate with the car to prevent hot-wiring.) The attack took some smart people and custom computing, but was very inexpensive considering it’s potential for abuse.

The success of the attack is in part due to the weak, proprietary encryption algorithm developed by Texas Instruments 10 years ago. It relies on a 40-bit key, which is simply too small for critical security now.

The implications of this are very interesting, especially as businesses push to increase the use of RFID tags. Don’t get me wrong, I love RFID, but they way it’s being used here could stand a little more security thought. Take this scenario: a trouble youth packs a similar exploit system into a portable computer in her backpack. She could walk around supermarkets and shopping malls with a high-powered RFID reader in her bag, quietly collecting SpeedPass keys from the dongle’s in people’s pockets and purses. This is even easier then stealing credit card numbers, being a completely passive action. No more dumpster diving — just hang out around people and ping RFID chips! The cracked keys become black-market commodities, much like stolen credit card numbers or digital cable codes.

Mind you, using stolen RFID keys to buy fuel is just as dumb as using a stolen credit card. Modern gas stations have video cameras, and your license plate will be captured. In other words, it’s a cool hack… but don’t try this at home unless you’d like to see a little jail time.