IE8 Beta 1 is out.

Windows Internet Explorer 8 Beta 1 for Windows XP

We’ve decided that IE8 will, by default, interpret web content in the most standards compliant way it can. This decision is a change from what we’ve posted previously.

This is huge. And the correct decision. Bravo IE Team!

Why Change?

Microsoft recently published a set of Interoperability Principles. Thinking about IE8’s behavior with these principles in mind, interpreting web content in the most standards compliant way possible is a better thing to do.

We think that acting in accordance with principles is important, and IE8’s default is a demonstration of the interoperability principles in action. While we do not believe any current legal requirements would dictate which rendering mode a browser must use, this step clearly removes this question as a potential legal and regulatory issue. As stated above, we think it’s the better choice.

[sigh]

This statement hurts you. You should do this because its the right thing to do for the Web, not to remove "a potential legal and regulatory issue." or to in accordance with Interoperability Principles (which hopefully weren't discovered solely while writing a 2.6 billion dollar check to the EU).

I don't think the IE team wants to make a non-standards compliant browser. Or simply a Silverlight terminal. At least I hope not, and I'm willing to give you the benefit of the doubt (take note Sarah and Andrew). But don't tell us you are doing something because you have to, tell us you are doing something because it makes the web a better place. Doing the right thing consistently helps to reconcile 6 years of neglect far more than upbeat blog posts of questionable accuracy. I'm willing to give you a second look, but make it for the right reasons.

IE8 and Standards: Change for the *right* reasons

To use the tool, hackers must connect a Linux-based computer to a Firewire port on the target machine. The machine is then tricked into allowing the attacking computer to have read and write access to its memory.

With full access to the memory, the tool can then modify Windows' password protection code, which is stored there, and render it ineffective.

[sigh]. DMA as a malicious vector has been understood for some time now. I point you to the 4 year old presentation 0wned by an iPod.

Thus I'm not super impressed by a tool someone wrote in 2006 and sat on for 2 years that unlocks a windows PC over Firewire. Disabling a password is silly when the same vector also grants you the ability to inject malicious code directly into a process.

Way to use that M in DMA!

Ed Felton quoting Ross Anderson... ... oh god yes. [lights a cigarette] ...

Very few security papers are so so satisfying in that special special place...

Unless of course you added a Schneier/Alice/Bob three-way...

Felton + Anderson = Crazy Delicious

"There is a non-zero chance that the DOJ would fuck with you."

Jason Scott on the opinionated hordes.

I had forgotten, I guess, how easy it is for people to take a few quick glances at some data and shove their two-line thesis out the door. Or to then proceed to make even more conclusions based on this thesis. And then, how easily it is for this quarter-baked half-thesis to become an addendum to the original data, as if, you know, they deserved it.

I like nothing more than to browse people who have no idea who or what the hell I am, what I've done, what I'm doing, or any other data points, and then just make all these great conclusions about me. It's refreshing. They're neither friend nor foe. They're just observers, as so much of this medium turns us into

And of course, the original Penny Arcade Internet Fuckwad strip.

Internet Fuckwad Redux

DrawingSpace.prototype.drawLine = function(x0,y0,x1,y1) {

    var steep = Math.abs(y1 - y0) > Math.abs(x1 - x0);
    var tmp = 0;
 
    if(steep) {
        //swap(x0, y0)
        tmp = y0;
        y0 = x0;
        x0 = tmp;
        //swap(x1, y1)
        tmp = y1;
        y1 = x1;
        x1 = tmp;
    }
    if(x0 > x1) {
        //swap(x0, x1)
        tmp = x1;
        x1 = x0;
        x0 = tmp;
        //swap(y0, y1)
        tmp = y0;
        y0 = y1;
        y1 = tmp;    
    }
    
    var deltax = x1 - x0;
    var deltay = Math.abs(y1 - y0)
    var error = -(deltax + 1) / 2
    var ystep;
    
    var y = y0;
    if(y0 < y1) {
        ystep = 1;
    } else {
        ystep = -1;
    }
    
    for(var x = x0; x <=x1; x++) {
        if(steep) {
            this.buffer.setXY(y,x);
        } else {
            this.buffer.setXY(x,y);
        }
        error += deltay;
        if(error >=0) {
            y += ystep;
            error -=deltax;
        }
    }

}

Now why would you ever need an integer optimized line drawing algorithm in JavaScript? :-)

Bresenham's line algorithm

Today I used the phrase "John Terrill Approved" to win an argument. Yes, it was excellent.

Events can be set to trap when the image has finished loading and what the size of the image is. This creates a side channel for JavaScript to communicate with certain 3rd party hosts using the dimensions of the image. In practice, XBM images tend to work best because you can specify arbitrary lengths and widths up to a 15bit integer without actually needing an image of that size.

I knew I had talked about this publicly before! This was from Jan of 2007.

Good to know I'm not going crazy :-)

More image side channels

Surreal.

YouTube - Honda Element Ad (Crab & Pig)