<snip>

Mozilla Firefox URI filtering vulnerability

Mozilla Firefox does not filter input when sending certain URIs to registered protocol handlers. This may allow a remote, authenticated attacker to use Firefox as a vector for executing commands on a vulnerable system.
</snip>

In non-geeky words, if you are running Firefox 2.0.0.5 or below on Windows XP SP2 you are vulnerable for getting screwed up. Though its mentioned that you might be safe if you don’t have IE 7 installed however, why take chances. There is something you can do to be warned, if not becoming completely safe. You can enable warnings if you are trying to access an external URI. Just follow simple steps to get warned or completely shutdown accessing external URIs.

1. Go to about:config of your Firefox.
2. Search for “network.protocol-handler". You will get a bunch of which are configurations telling your Firefox how to handle various protocols.
3. So now here are your options and you need to decide whether you wish to completely shutdown access to external URIs or wish to get warned every time you access an external protocol.

• You decide to shutdown complete access to external protocols -
  Change default value of “network.protocol-handler.external-default" and network.protocol-handler.external.(protocol) to false for all protocols. For example, I made the following preference name “false” -
  network.protocol-handler.external-default
  network.protocol-handler.external.mailto
  network.protocol-handler.external.news
  network.protocol-handler.external.nntp
  network.protocol-handler.external.snews

or

• You decide to be warned every time you access external protocols -
  Change default value of “network.protocol-handler.warn-external-default" and network.protocol-handler.warn-external.(protocol) to false for all protocols. For example, I made the following preference name “false” -
  network.protocol-handler.warn-external-default
  network.protocol-handler.warn-external.mailto
  network.protocol-handler.warn-external.news
  network.protocol-handler.warn-external.nntp
  network.protocol-handler.warn-external.snews

Simple enough? Right? This is just a mechanism to prevent yourself from being vulnerable and in any case you should upgrade to higher version of Firefox as soon as it is available.

Further research -

http://www.kb.cert.org/vuls/id/403150
http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
http://xs-sniper.com/blog/remote-command-exec-firefox-2005/
http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries
https://bugzilla.mozilla.org/show_bug.cgi?id=389580
http://support.microsoft.com/kb/224816
http://en.wikipedia.org/wiki/Uniform_Resource_Identifier

Disclaimer: Though I have taken utmost care to post everything true to best of my knowledge and have tried them before posting it, but I can not and do not take responsibility of any harm done to your system in anyways. So try it at your risk!

P.S. – Above is an usual disclaimer for keeping me out of trouble from people who don’t take responsibilities for their actions and need a scapegoat every time they get screwed. A request to everyone, if you found it helpful please leave a comment.

Today – 11th July, 2007 – I completed two years of my professional life. Two years and my second job! When I look back and question myself – What did I learn in last two years? How much have I contributed? How much hard work did I put in? And how much history have I created? There is a mix of replies I get – from stressful time of crunch days to leisure days (read as months) I have seen them all. There have been days or weeks when I wasn’t productive at all (leave about writing any code) and there were days when I wrote thousands of line of PL/SQL in span of few days. Have been free for weeks and on other times, have completed weeks work in a day. Saw few point releases and many many patches. All this in last two years and last job. I guess thats what this software (geekyfreaky) world is about, rapidly changing technology … and thats what I love about it.

So now I am a 2 years old “software engineer”!

Mission for future – Work Hard, Have Fun, Create History!

As promised, this weekend I spend most of my time with Founders at Work: Stories of Startups’ Early Days. I would recommend this book to every budding entrepreneur and all newbies in this “geeky freaky” world. In fact, I would say that all startup founders should keep a personal copy of this book with them and read it whenever they are crestfallen. It surely will boost their moral and help them get over the slump period of their startup.

Okay … so here I go -

Review – Founders at Work: Stories of Startups’ Early Days

This book has anecdotes of various tech startups ranging from companies that started before, during and after the dot com bubble. Startups include extremely profitable enterprises like Apple, Adobe, Paypal, Hotmail.com to bankrupt declared businesses like Excite@Home, Software Arts. The book is a compilation of interviews of founders, co-founders or early employees of these startups. Without much jargan, hype or buzz words this book talks about what issues these people have faced in their initial days. These are generic issues which all startups face – be it problems related to intellectual property protection, funding, scalability, competitors, takeovers, aquisition etc. All startups go through these problems … some are lucky enough to get over it and emerge as a winners, other give up and fade away. Persistent determination is the key for success. My favorite parts in the book was where people answer to the question about their advice to someone thinking of starting a company? There are lots of different perspective to the same question. Some say that the key is to write a business plan, some suggest to make the solution simple and to reduce, some believe in having a understanding and capable co-founder. All in all … all these factors are really important and I would suggest to list down all these suggestions revisit those notes every month or so, just to be sure that you are not loosing focus. I am trying to put down some bullet points which I believe are my take away from this book. This is an ongoing work and over multiple iterations over this book I will keep adding/editing these points. I definitely don’t claim that this a comprehensive list. Any suggestions to improve this list are highly appreciated.

Key take aways from the book -

1. Write down your idea – No matter how insane your idea might look, remember to write down all that comes to your mind. It serves three purposes, firstly, it helps you remember any awesome ideas that may later forget. Secondly, it helps you to eliminate redundant ideas pretty quickly. If you right them down then you will be able to weigh pros and cons of your plan. Thirdly, you can share your idea with your co-founders/friends/venture capitalists/mentors in a better manner.
2. Work with people of high intellect – Its always important to work with people of high intellect, but for a startup its as important as having a sound business plan. As quoted somewhere in the book, a bunch of smart guys can turn your good idea into a great one but group of morons can turn a brilliant idea to a foolish looking business. So always keep the bar high for hiring, hire the best ones only. No compromises on that one should be allowed. The next person you hire in your company should be smarter than you!
3. User satisfaction is must – Always strive for giving the user a best possible experience. Even after the job is done, iterate, re-iterate and re-re-iterate upon your ideas and ask yourself can it be done in a better possible way? Be it response time of you application, which means you need to optimize your code even further. Be it the down time, which means addressing scalability and availability issues. Be it the overall look and feel, which probably means hiring some creative designers as well. Think before you take your idea to public, will you use your product? And what had been your reaction if this was someone else’s product and you would be using it. In short, analyze it critically.
4. Last and the most important one … Don’t give up! This one is easier said than done. But there would be numerous phases where one might feel lost, broken or even completely clueless but these happened with all those startups mentioned in the book and numerous others. You may or may not end up being successful and rich but I guess thats the point, the whole idea with starting a company is to have fun and experience what others like me are missing.

Ah God … I miss not creating a dent in the universe! Now I think, the only way for me to buy a Honda CBR1000RR before getting old is to take a chance and implement some ideas which I have in mind {now on paper }. Lets see what destiny has in store for me.

Appears like my blog is not a complete waste of time … someone commented at least! So after some days of silence I am back. I once read/heard that best way to get your deadlines right is to publicly commit to them. So here I am … and here are my targets for the weekend -

1. Post about Firefox extension updates.
2. Complete “Founders At Work  – Stories of Startups Early Days by Jessica Livingston” and write a review of this book.

Keep targets simple and achievable, another key to achieving them
So here is your blogger, ms, signing out for now … See you soon.

P.S. – I noticed that I use ellipses a lot. Infact two of my blog title end with it. So before someone else points it out, I must tell you that I am trying to get over it … err … I mean … I am trying. Still trying …

Though the list of things I wish is never ending but looking at all this hoopla about the iPhone … I wish I have a chance to get one. There is a lot of buzz and some ranting too. Some people complain about AT&T being the only service provider, battery being sealed or not having extensible memory. Atleast they have a service provider in US … think about countries other than US … specially Japan, Korea etc, who are always the ones to use the latest techy devices first! And who cares about the battery being sealed till the time it doesn’t drain away quickly. And dude get it replace at the Apple Store whenever u think it has died out. And last complain being not having a extensible memory … which other phone has 4Gb or 8Gb memory capacity? I don’t say that these are not “nice to have” features but u can’t crib about them. It’s like saying I don’t like iPhone cause its not in my favorite color Ok .. ok … that was too much.

Anyways lets wait and what when iPhone comes in GSM compatible model and then probably I will have to ask someone to get it for me! Btw enjoy the video-

There are n-number of Firefox extensions that make the browser “cool” and “geeky”. And similarly there are numerous java editors and highlighters, each claiming to be better than the others. However, I haven’t seen an extension for Firefox which would highlight java code.

Very often, in our daily work and elsewhere we browse java code using the browser. It would be nice to have an extension which could turn on/off java highlight easily. Currently I am working on java highlight only which should be extended to any other language by editing a simple xml file and changing the keywords. I will try and keep all developments/hurdles posted in this place.

If someone have already came across such a extension, do let me know. It will definitely save a lot of my time!

Let me start before I loose my tempo to write … thing which has happened quite a lot of time in the past! But this time I am too much inspired to write and will not give up easily. I have tried blogger, msn spaces etc. but sooner or later I loose focus and tend to ignore my blog and then slowly I start disliking the idea of me writing. On occasions I even thought blogging is such of waste of time … though most of my leisure time goes reading what other people write!!! Anyways … getting inspired from a random blog I was reading, I decided to try out wordpress.

So the first big question was “What should I name my blog?”. Again going by the past experience, I decided not to choose my name as the name of the blog. Gave a thought about all possible weird but fun sounding name. Finally it was a name which a friend of mine thought a few year back. All credits to him! I hope he won’t be offended using his idea.

Secondly, about the theme.  Tough decision, I must say. Black being the obvious choice, I chose a theme with an tingle of chaos theory (much related to chaotic ideas that keep striking my mind). I thought I would make the header image look geeky … so i edited photos from apple.com and microsoft.com. Again I hope that Mr. Jobs or Mr. Gates will not be offended by this minuscule act of mine. Though I guess this should act as a free publicity for Leopard (http://www.apple.com/macosx/leopard/) and Surface (http://www.microsoft.com/surface/) … !! As if they need publicity from my blog   But seriously never underestimate the power of The Long Tail. However, tiny an attempt may be, they result may be huge if its effects are aggregated. Btw the book ‘The Long Tail’ is on my to read list.

Coming back to the original topic … ladies and gentlemen today I start a new blogging innings for myself :: 18th June, 2007 :: 01:28 hrs