Vimeo highly vulnerable to CSRF attacks – now fixed
I recently found, that vimeo.com had a cross-domain policy, that allowed anyone to connect, which was an open invitation for CSRF attacks. I alerted them to the issue, and it has now been fixed.
My life with ActionScript, JavaScript and their families
I recently found, that vimeo.com had a cross-domain policy, that allowed anyone to connect, which was an open invitation for CSRF attacks. I alerted them to the issue, and it has now been fixed.
The twenty-eighth idea for my 365 social ideas is about the open web and about “forcing” classic websites to export their data. Imagine sites with lots of useful information, that is frequently updated, but is hidden away behind forms, in PDF’s or in hard-to-scrape tables. Then imagine a website, where you could provide this address, and give it some guidance as to how to input data in forms and how to interpret the results. And then imagine, that this website would act as a proxy with this interaction described as a simple, queryable API and then behind the scenes would fetch data from the original website.
Comment » | API, January 2010 Ideas, Online Rights, Security
The twenty-sixth idea for my 365 social ideas is a new brand of charting service: A service designed for infographics, but with sharing, collaboration and synergy as an added side-effect.
The twenty-fifth idea for my 365 social ideas is a small simple idea: use Facebook notes or images combined with tags to display results of games. For instance, imagine a chess game, post the result of the game as a note on the game’s page with the final board, all moves made during the game and both players tagged. Or simply post the final board as an image and tag both players as well.
The eighteenth idea for my 365 social ideas is a social web principle, but it is not new in any way. It is just another voice in the choir of web enthusiasts screaming for open data. However, most people scream at public institutions all over the world to open up their data for their citizens to play around with. I would however like to extend this plea to corporations as well: if you have data, don’t know what to do with it and are allowed to share it, then please share it. Trust me, you’ll end up the winner in the long run, eventhough you’re giving assets away for free.
The fifteenth idea for my 365 social ideas is about bringing classic games to Twitter in a quite simple, straight-forward way. The same mechanic can be used for simple games like Rock-Paper-Scissor or more complex turn-based board games like Monopoly, Chess or similar.
The thirteenth idea for my 365 social ideas is about adding social connectivity to console games. But not straightforwardly, as in asking the developer of the Assassins Creed 3 to automatically tweet when you get a trophy on your PS3 (this will probably come soon, but is pretty boring). No, it should be possible to do some form of ping/trackback system, in which all games can “ping” your progress to any gaming progress ping recipients. And what happens with this ping is then out of the hands of the actual game. One obvious game progress ping recipient is a twitter bridge, that will tweet it as explained, but by building such a general system, it can be used for anything anyone else can think of, because you simply build a new website, that can receive pings and ask users to enter the url of your website in your game console’s settings.
The twelfth idea for my 365 social ideas is about Google Wave: Create a wave actor (a robot), that will create a nice, static, easily-printable, exportable view of the wave in it’s current state. Swell Waves are perfect, stable waves – and Swell Wave is thus a stable (but static) version of Google Wave
The eleventh idea for my 365 social ideas is another mobile application: An application relaying current position of users to services requiring them. The business model is, that lot’s of websites, competitions and campaigns would like to be able to track their users somehow for some purpose, but if it is just a small campaign or just a funny little gimmick, no-one would bother first making 5 different mobile applications for the different mobile platforms. So instead, they urge their user to download this Coordinate Proxy application from their respective app store, which is free, and then they enter the campaign name (and maybe password if closed) and now they can start relaying information about where they are to the service provider.
The tenth idea for my 365 social ideas is a site for mashing up Youtube-videos, playing with them across media etc. It could be done as simple as a website with a youtube player and a search field (with results). Then, when you have a video, that you like, you drag it onto your timeline, say maybe from 00:15 to 2:25 of video X, and 00:34 to 00:46 of video Y, and then you have created a new video 2 minutes and 22 seconds long.
2 comments » | API, January 2010 Ideas, Mashup, Online Rights