Trying Google's Native Client

From Google Blogoscoped:

Google has released something to the open source world they call the Native Client. It is meant as a way for website developers to execute rich code faster within the browser... by having it run “natively” on the computer. This could help any program needing fast graphics; a web-based photo editor might be one of the use cases of this, Google explains. Right now, as a developer you’re usually picking Flash or Java for that purpose. Google describes their efforts:

Following the guide in Ubuntu worked remarkably well. The result:

Nice, Quake in a browser. Note that this won't work with any program, you'll need:

• A Firefox plugin.
• The Native Client runtime.
• Special gcc compilation tools to compile your program to make it work with Native Client.

Still, this is a great idea, I'm curious which applications or tools (or games) this will spawn.

Gmail

What's up with Google the last few days? First, a glitch was reported about users getting their mails deleted. This glitch is now (luckily) fixed.

Then that hack about your contact list getting stolen, try logging into Gmail and go to one of the following links:

http://docs.google.com/data/contacts?out=js&show=ALL&psort=Affinity&callback=google&max=99999

http://video.google.com/data/contacts?out=js&max=500&psort=Affinity&callback=getContacts

All your contacts in JSON format! Accessible to any website which uses this as a src in a script-tag.

Solutions? Referrer-checking (not that good: can be spoofed). Better: using unique keys in each request. They probably used a combination of solutions.

It seems to be already fixed now, the only thing it returns for me now is:
google ({ Success: false, Errors: []})

But the XML output is still accessible though: http://docs.google.com/data/contacts?out=xml&show=ALL&psort=Affinity&callback=google&max=999999.

I tried hacking up a little piece of code, but alas: loading the XML into the frame and then trying to do a frames['the_frame'].document.getElementsByTagName('Email'); does not work. Both Firefox and IE prevent stealing content from frames across domains.

Maybe we should use an XMLHTTPRequest solution, then? Also doesn't work in Firefox, even when trying to netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead"); it will fail. Internet Explorer (tested in 7) will bitch about ActiveX objects being used.

So is this still a security issue? I would say no. Locally (trusted zone): Firefox doesn't allow the described actions, and IE at least warns the user. When surfing on the Internet (untrusted zone): the objects were blocked by default (my IE and Firefox were set up in such a way that when I tried to run this script from the web: they would block the cross-domain XMLHTTPRequest by default without asking). Maybe IE6 is a bit more unsecure.

For the people who want to try it out: example html here (use IE, allow Blocked ActiveX content for it to work).

Another sad message: Gmail's storage has stopped increasing... Mine has also stopped at 2800MB... Why?

There is a little bit of good news too: the calculator works again...

A Linkdump

Here are some links I found to be interesting the past few days:

• Google acquires YouTube. This didn't exactly came as a surprise.
• "Insults - they just don't make them as they used to" - via Reluctant Nomad, a great post with - indeed - some great "insults". For example:
  "He uses statistics as a drunken man uses lamp-posts...for support rather than illumination." -- Andrew Lang
• "How to create professional HDR images" - via Backing Winds.
• No silver bullet, by Brooks. I had to read this last year in an "informatics" class and saw it mentioned on Delicious. It still is a good read.
• 10 Windows Explorer alternatives compared and reviewed. I know that a lot of people I know love Total Commander.
• Hacking Web 2.0 applications with Firefox.
• Lifehacker special: Practice your personal Kaizen.
• The 7 worst fonts. I fully agree. Especially with number one.
• Kevin Tiell photographs pinball games.
• Social bookmarking icons. So that's where you found them! A great list.
• Have some fun with these Unicode block elements. Or even better: use this.
• A Javascript web spider...
• 3 easy steps to avoid Javascript memory leaks.
• Adventures in Javascript testing.
• Lazarus review. (Also: an Ubuntu .deb of Lazarus in multi/uni-verse would be really nice... pretty please?)
• How the immune system avoids attacking itself.
• Software startup myths debunked.
• Samsung is doing very well these days and is about to release a 10 Megapixel phone.
• Free classical music.
• The top 100 NES games - ever.
• A woman drawn from inside out. A well-done animation.
• 10 techniques to get more comments on your blog.
• What happens if you stop smoking now?
• Warhammer RPG article (in German).
• Original Transformers movie, with original adverts too.
• Google Docs & Spreadsheets launches, completing the integration between Writely and Spreadsheets. A few days before, I was wondering when this would happen.

Enjoy, I'm out. Stay tuned for more posts.

Google Code Search (And Other) Fun

Google Code Search has been providing bloggers with a lot of searching-fun. Most talked about? Winzip key generation code. There are also a lot of passwords floating around. Just as potential buffer overflows. Some geek jokes and a lot of things which need to be fixed or need to be done.

On a side note: be sure to watch the South Park World Of Warcraft episode ;).