Barklund.org

365 Social Ideas is now the Month of Ideas

Barklund — Fri, 26 Feb 2010 15:32:37 +0000

An idea per day was simply too much for me, I must admit now being almost a month behind after only two months. Thus I change the concept into a Month of Ideas and the first such was then January 2010.

I will now update the previous entries to reflect this change and restructure the current content.

The next Month of Ideas will be either April or May 2010 – and I will start now collecting ideas for this just keeping them hidden until I am confident, that I can complete the task for the given month. But at least I tried and have actually produced a wealth of cool things in my opinion – I hoped you have enjoyed it as well.

Introducing 365 Social Ideas

Vimeo highly vulnerable to CSRF attacks – now fixed

Barklund — Fri, 12 Feb 2010 00:33:36 +0000

I recently found, that vimeo.com had a cross-domain policy, that allowed anyone to connect, which was an open invitation for CSRF attacks. I alerted them to the issue, and it has now been fixed.

As has been said over and over, allow-all cross-domain policy files should never be used on domains, where users log on. This leaves the site open for CSRF attacks from flash clients on different domains, that can load pages from the target domain utilizing the user’s automated log-in and thus the flash load’s the pages, like the user himself would. This not only allows the flash file to (without the user knowing it) load all his private information from the target site, but potentially also post data to the site, which could include updating the user’s password, email, profile or in worse circumstances add/remove content or even make purchases, if the target site has any feature like that.

This has been done against large sites like Facebook, MySpace, Adobe and Youtube – the latter was ironically documented via a video on Vimeo by Jeremiah Grossman.

In Vimeo’s case, you can “only” upload videos, but an attacker could actually perform any action on the user’s behalf, that the user himself could – including changing the user’s bio, add/remove videos, comment on/like other videos etc. I made a small, seemingly innocent page, that included a hidden flash element, which first loaded the user’s info from vimeo.com/settings/personal and then re-posted this info back to the same page adding an extra line to the bio – namely “You have been bwned”, as it can seen on my vimeo profile.

Someone at vimeo has clearly seen this demo, (Julia Quinn has indeed) and now the cross-domain policy only allows *.vimeo.com (the new file is served with a Last-Modified timestamp of Thu, 11 Feb 2010 23:32:05 GMT, so the change is only an hour old). The strange thing is, that if you go back via the Wayback Machine from archive.org, you can see, that they had much better security back in 2007 and 2008 (html render fails, but view source), so I have no idea how such a relaxed policy suddenly appeared on their site. Google’s cache still show the allow-all policy as it dates back to January 20th (again, view source to see contents).

I found this while playing around attempting to load videos from Vimeo directly in a custom FLV-player on a different host than vimeo.com and found that this was actually possible, as all videos from their site are hosted from av.vimeo.com and this has an allow-all cross-domain policy. And this makes sense, as this domain is only used for serving videos and nothing else – no cookies or authentication info shared to this domain.

I haven’t heard from Vimeo yet – neither stating that they are looking at the issue nor that it has been fixed. I only post this after now seeing, that it has been fixed.

NYT Article Trend Charts – January 2010 Ideas

Barklund — Fri, 29 Jan 2010 08:00:47 +0000

The twenty-nineth idea for my 365 social ideas is a classic mashup: CatScanner, a charting application and the New York Times Article Search. The charting application could very likely be the previously mentioned Infographic Charting Service for better results (it could actually be built into this service) or it could be build stand-alone using any classic charting API like Google Charts.

Creating cool charts displaying the frequency of articles about Obama vs. McCain or comparing the articles about Obama in his first year vs. previous presidents NYT coverage in their first year are common and quite easy to do. But as previously explained about Twitter Trends, you cannot find what you don’t know you’re looking for. Let’s say we want to see how many articles are posted in NYT about Democrats vs. Republicans. Well, you could search for popular names from both parties, or you could hope that the writers have tagged their articles correctly.

But we can do better than that, as the Wikipedia category system will give us names of most politicians from both parties. Thus we can use these lists to create large queries about all Democrats vs. all Republicans and receive these numbers correctly.

Why?

This is a classic mashup displaying the power of combining commercial content (NYT articles) with crowd-sourced information (Wikipedia CatScanner) with generalized tools (charting API’s like Google Charts) with little effort for huge results. And this puts cretaing complicated charts back in the hands of everyone, not just the few who are good at both API’s and PhotoShop.

What’s next?

Do with this idea whatever you like – expand, implement, trash or forget. Just remember, that if you use it in anyway make sure to attribute me according to the Creative Commons Attribution 3.0 License, that all these 365 Social Ideas are published under.

Turn (Closed) Content Into an API – January 2010 Ideas

Barklund — Thu, 28 Jan 2010 08:00:56 +0000

The twenty-eighth idea for my 365 social ideas is about the open web and about “forcing” classic websites to export their data. Imagine sites with lots of useful information, that is frequently updated, but is hidden away behind forms, in PDF’s or in hard-to-scrape tables. Then imagine a website, where you could provide this address, and give it some guidance as to how to input data in forms and how to interpret the results. And then imagine, that this website would act as a proxy with this interaction described as a simple, queryable API and then behind the scenes would fetch data from the original website.

There are of course a lot of legal issues, and such a service should probably obey robots.txt. And there should be a very clear opt-out possibility for websites that have been targeted in user-contributed additions – maybe even moderation before the services are publicly available. It should not be seen as an attack vector, as a proxy method for illegal purposes or anything like that, but simply as a way of “helping” free information to be used freely.

Why?

A lot of data on the web is hidden in the so-called “deep web” behind forms or in inaccessible parts of websites. With a service like the above-mentioned, this would suddenly not only become visible and indexable, but even queryable.

What’s next?

Browser Snapshot Sharing – January 2010 Ideas

Barklund — Wed, 27 Jan 2010 08:00:54 +0000

The twenty-seventh idea for my 365 social ideas is an idea which has spun off my “investigation” of the SnapABug service: create a bookmarklet, that when clicked let’s you mark a section of the current webpage you are viewing (in it’s current state etc.) and then snapshots this and uploads the image to your image sharing service of choice – popular choices being flickr or more shoot-from-the-hip style services like tinypic.

Why?

Sharing snapshots of what you see currently is difficult. It is a lot easier on a Mac than on Windows, though Windows 7 has made it easier, but sharing it on the web still requires that you go to some website, browse for the image locally and upload in order to obtain a shareable url. If you had a simple bookmarklet as explained above, this process would be much easier.

What’s next?

Infographic Charting Service – January 2010 Ideas

Barklund — Tue, 26 Jan 2010 08:00:28 +0000

The twenty-sixth idea for my 365 social ideas is a new brand of charting service: A service designed for infographics, but with sharing, collaboration and synergy as an added side-effect.

The idea is to create a site enabling users to create infographics of the simplest kind initially, but then expand this to even more complex ones. For starters, it could allow users to create tables of data defining row and column labels and then selecting icons, colors and values for cells and having this displayed as larger and smaller icons according to the values – like this chart of the “deadliest drugs”. And allowing people to color-code maps of countries, cities or states according to some data would be quite simple to do as well – like this map of the origins and relationships of European languages.

But more important than simply creating cool visualizations, each infographic has an input page. This page can only be edited by the original creator of the infographic, but it includes direct links to sources of information used. The site should use a simple url structure (inspired by bit.ly), where the short-code would give the actual image, but with a + added (like http://bit.ly/365ideas+) it would be a link to the page describing all this background data.

And now comes the collaborative part: While only the creator can edit the data for the published infographic, anyone can copy the data to branch it as their own new infographic. These relationships will then also be displayed on the about page, as in “this is a spin-off of X and has Y spin-offs of its own”. Somewhat like the very nice ActionScript-programming website wonderfl. Here you can e.g. see that this creation of 250,000 particles is a spin-off from another simulation and has itself spun off into new simulations.

In time, this could be extended heavily and should of course have a public API for creating infographics easily and freely. New types of infographics could be added along with more complex editors allowing you to play around with the data as you see fit. It should be free to do and should not require complex knowledge of Illustrator or Photoshop.

This idea about letting others built on your own ideas could actually be implemented by many sites. The new Firefox 3.6 has “personas”, which is a very light theme engine – that most importantly does not require restart! But why didn’t the developers add a very fast and quick branching mechanism? If you found a cool persona, but didn’t like the color of the top-bar – just branch it, change the top-bar color and publish as a new persona (with credit where credit is due of course linking back to the original).

Why?

Simply: Infographics to the people! I’m not suggesting, that the creators of the coolest infographics aren’t brilliant. But they’re in the business because they both know how to find the data, how to present it and how to use the programs needed to create them. Let’s take the software knowledge part out of the equation and allow anyone with ideas and info to visualize it. And let’s do it openly and collaborate, not just publish a PNG and kill innovation.

What’s next?

Facebook Notes and Images for Competition Results – January 2010 Ideas

Barklund — Mon, 25 Jan 2010 08:00:43 +0000

The twenty-fifth idea for my 365 social ideas is a small simple idea: use Facebook notes or images combined with tags to display results of games. For instance, imagine a chess game, post the result of the game as a note on the game’s page with the final board, all moves made during the game and both players tagged. Or simply post the final board as an image and tag both players as well.

It is a very simple idea, but the idea is to use profile tagging in a new way to indicate relationships to the displayed information in a way, that the users actually feel related to this. The great thing about using tagging is, that it can be done without the user has to accept it and it will be auto-posted to his friends’ news feeds. But given that it can be done without asking the user, it should only be done if it is actually relevant for the user and not done just to get a viral effect and annoy users.

Why?

It is a new way to use the Facebook platform for viral effects. It’s quite simple and does not require a lot of programming as it uses simple, existing features.

What’s next?

Private Comment Sharing – January 2010 Ideas

Barklund — Sun, 24 Jan 2010 08:00:43 +0000

The twenty-fourth idea for my 365 social ideas is an idea for websites dealing in larger commodities like furniture, cars or even houses: Add private comments to the pages, that can be easily shared with friends and family, as this type of purchase is not something you do instantly, but spend time deciding.

When you consider buying a car, you don’t make the decision instantly. You look at it on the web several times, you discuss it with friends and family etc. But imagine that the dealer website added a private comments box, that would initially be empty, but as soon as you started adding comments, you could share this version of the page, with your comments, to everyone else. A bit like the wish list concept from Amazon, but giving others the opportunity to weigh in on your decision if you gave them the link. Then all comments about whether or not to buy this car, pros and cons, other possibilities etc. would be in one place, and not spread around in emails discussing this potential requisition.

This could easily be used by e.g. Amazon, ebay or similar companies. It should just be clearly visible, that this is private comments, that neither the dealer nor the seller will ever see. It is only for your own benefit to keep the discussion in one place between you and friends and family.

Why?

If you control the discussion, it is more likely that the user returns to your site, to keep the discussion going. It is a facilitator of making educated requisitions, but it ensures that this discussion takes place on your website.

What’s next?

Google Docs Application – January 2010 Ideas

Barklund — Sat, 23 Jan 2010 08:00:10 +0000

The twenty-third idea for my 365 social ideas is a very simple one: Wrap a Safari browser in a Mac OS X application that opens on Google Docs as the first (and only) website you can see.

I for one bashed Waveboard, when it came out, because it was simply Apple Safari wrapped in a Mac OS X application. But, recently I tried it again, as it had added Growl support, which means I was easily alerted to when new info was available in any of my waves – this made it feel much more like a mail application, because it was its own program on my MacBook, that I could switch program to and be notified about even though using billions of tabs in my “regular” browsing experience.

So, my suggestion is simply to anyone out there (I reckon it might actually be infinitely simple): do this with Google Docs and if possible, add similar Growl integration as has been done with the Waveboard application, then Google Docs would actually start to seem like a “real” program in itself.

Why?

Because I need it. I might be alone, but I doubt it. And I am pretty sure this is very simple, but it would be really useful.

What’s next?

Social Traffic Analyzer – January 2010 Ideas

Barklund — Fri, 22 Jan 2010 08:00:12 +0000

The twenty-second idea for my 365 social ideas is not really a clear-cut idea – yet. But I feel a need for a new website traffic analyzing service. Google Analytics is definitely the mostly used and best free service. But they have many shortcomings, and I definitely would like to see a new player enter this playing field. And while where add it, there are some new trends and actions, that current has a huge influence on current traffic trends, that you cannot track fully: social media traffic.

I do not know how to integrate all these things, but a good traffic analyzer should know not only who links to you but also who is sharing links to your services through which channels. It should report which channels generate the most traffic, but also who pushes the links to these channels etc. If someone e.g. tweets/diggs/reddits about your service/website a lot, it should be reflected.

About the short-comings of Google Analytics, my main concern is, that when experimenting with how you can track new things, there is a 1-4 hour delay on page tracks and up to 3 days delay on custom variables tracking (in my experience). A good provider really ought to have a development option available, that only allow limited traffic but provide almost-instant analysis of this data.

Why?

This is one of the simplest of Google’s services, and thus we really need a contender. With the availability of cheap clouds, it should be quite easy to set up, though it would require some funding to provide it to people for free. Google Analytics does not innovate that much – not in the social media tracking area at least. They are more interested in developing new things in the “how can I make people buy more crap from me” category for web shop owners.