gHacks technology news » javascript

A Userscript For Better Userscripts.org Navigation

Martin — Thu, 05 Nov 2009 19:32:33 +0000

If you have been to userscripts.org before you might have noticed that the website holds an incredible amount of userscripts. You might have also noticed that it is extremely uncomfortable to browse and work with in general. Userscripts are JavaScript code snippets that change elements on a website while it is loaded in the web browser. The developer of the “Because it’s your userscripts.org” userscript must have come to the conclusion that a userscript would be the perfect way of improving the userscripts.org website.

And that’s what the developer did. The userscript changes several key elements on the website. Its main features are options to customize the script display on the website and the option to add scripts and authors to a blacklist so that they will no longer be displayed when browsing the website.

The default changes include an increase in the amount of scripts that are displayed per page (triple the default amount), and options to install or blacklist any script right from that page without visiting the script’s profile page first. A trashcan icon is also placed next to each userscript in the script table listings to add it to the blacklist.

The left side contains a link to the settings of the userscript which provide access to additional options. This includes removing rows of the table layout (Hide ‘Rating’ Column, Hide ‘Posts’ Column, Hide ‘Fans’ Column, Hide ‘Installs’ Column, Hide ‘Last Updated’ Column, Hide ‘Votes’ Column), add scripts based on title or description to the blacklist or to change various author and script related blacklisting settings.

Because it’s your userscripts.org can be downloaded from the userscripts website.

Tags: firefox, greasemonkey, javascript, userscripts

SiteFlow Bookmarklet Simplifies Website Navigation

Martin — Sun, 16 Aug 2009 12:09:51 +0000

Many websites on the Internet use pagination. This includes all major search engines like Google Search or Bing, blogs like Ghacks or websites that provide access to media like Youtube. Pagination is used to limit the time it takes to load a website and to well arrange it for the visitor.

The main problem with pagination is that it limits the amount of content on each page forcing the user to click on one of the buttons to be taken to the next or previous page of the website to access new content. Some extensions and scripts are available that automatically load the new content once the user reaches the end of the page.

Another alternative is provided by the SiteFlow bookmarklet. The bookmarklet recognizes the headlines of the active page (which would be the titles here at Ghacks for example) and displays them in an overlay on top. It offers previous and next buttons which will load previous or next pages of the website both in its interface but also on the screen.

A click on a headline will take the user right to the beginning of the article.

Keyboard shortcuts are available to perform the following operations:

Go to next page [right arrow key]
Go to previous page [left arrow key]
Return to first page [Shift Home]
Skip to last page [Shift End]
Jump to next headline [CTRL down arrow]
Jump to previous headline [CTRL up arrow]

The keyboard shortcuts to flip pages come in handy in many occasions as it only takes one key to perform the action. SiteFlow is compatible with many modern web browsers including Mozilla Firefox, Google Chrome, Opera and Safari.

Tags: blogs, bookmarklet, javascript, navigation, siteflow, web browser, websites

Another Critical Firefox Vulnerability Emerges

Martin — Sun, 19 Jul 2009 11:49:10 +0000

It has been only a few days ago that the Mozilla Firefox team released an update for Firefox 3.5 to Firefox 3.5.1 that would close a recently disclosed critical security vulnerability that allowed attackers to execute arbitrary code on the attacked computer system. Earlier today another Firefox vulnerability was disclosed to the public that affects the latest version of Firefox. The vulnerability can be remotely exploited and uses an stack based buffer overflow that is triggered by an overly long string of Unicode data. It can lead to remote code execution or to crashes, freezes or the allocation of a lot of computer memory.

A proof of concept has already been created that demonstrates the vulnerability. No patch has been made available yet. Firefox users are encouraged to disable JavaScript until a patch is issued to avoid leaving their computer system vulnerable for the attack.

Users working with security add-ons like NoScript might consider their Firefox installation safe without disabling JavaScript. It is however theoretically possible to compromise websites that are in the whitelist of the add-on (if the whitelist is used) which would make the system vulnerable to this kind of attack.

JavaScript can be disabled in the Firefox options in the content tab.

Tags: firefox 3.5, firefox security, firefox vulnerability, javascript, mozilla-firefox, web browser

Block NoScript From Opening Homepage After Update

Martin — Thu, 16 Jul 2009 12:14:28 +0000

The NoScript add-on for the Firefox web browser is without doubt one of the best ways to increase the web browser’s security as it disables JavaScript elements on all websites that are visited by the user initially. It is of course possible to enable these JavaScript elements if the website is considered safe but the initial blocking of the code increases security and prevents script attacks even if they are 0-day and have not been fixed yet.

The Firefox add-on gets updated quite regularly and one rather annoying trait is that it will open the NoScript website after each update. Most users do not care that much and close the tab in this situation. Some users might prefer a permanent solution so that the website will not be opened when the script updates.

This can be achieved in the Firefox preferences. To go there type in [about:config] in the address bar, confirm the “it’s dangerous” warning if it is your first time and filter for the parameter [noscript.first].

The parameter noscript.firstRunRedirection should be displayed with the default value true. This means that NoScript will open the website whenever the add-on gets updated. A double-click on the line will change the value to false which will prevent this from happening from now on.

It is possible to revert the changes with another double-click on the line.

Tags: block scripts, firefox, firefox-add on, javascript, mozilla, noscript, noscript add-on, noscript update

Load your advertisements after your content

Daniel Pataki — Sun, 05 Apr 2009 22:55:05 +0000

I didn’t have much use for loading ads after my content, since on most of my sites and those I worked on, they were near the end of the code anyway, but while working on a site today I ran into a problem. There is an ad at the top of the design which tends to load slowly. I have specific requirements that the site should be as fast as possible, so I had to devise a way of loading the ad last. I went through some methods I found online after things off the top of my head didn’t work, but none helped, so I came up with my own code for it.

I am not taking credit for this, so if you did this before me feel free to let us know, but I did arrive at it on my own. The methods you could try is the “defer” attribute, which defers loading to the end of the page load, however, this had no effect at all. You can also try a “window.onload”, but this didn’t help either. With any other function combinations the ad either loaded as usual or did some weird stuff.

In the end, I decided to load the ad at the bottom of the page, right before the “” tag, and then use javascript to “transfer” the contents to where I need it do be, while keeping the source hidden. This is achieved using the “document.getElementById” method, read on to take a look at a specific example.

So what we need to do is create a div at the bottom of our page, load the advertisement there, and transfer it to the place we want it to be. I will be using inline CSS and inline javascript, which should not be done in real “life”, the best practice is to have all your CSS in external stylsheets and you javascript called from files in the header (where possible). The bottom of our page would look like this:

So what is going on here? We have two divs, the first is “top_ad_loader”, which you can see right here. This div is hidden, but contains the ad code. When the code is being read, the javascript might take a while to load, but we’re right at the bottom, so all our content is displayed already. There is also another div, “top_ad”, which can not be seen here, it is somewhere way above this part of our code, somewhere near the “” tag.

There is javascript code right beneath the ad loader, the purpose of which is to transfer the loaded contents of the ad loader to te place where we want it to be. We “grab” the contents inside the ad loader using “document.getElementById(”top_ad_loader”).innerHTML“, and we want the contents of the actual ad block to equal this.

Once the page load gets to the ad it will slowly load it, when finished, parsing will continue, and our javascript will transfer the contents to the top.

If you have a page that loads a bit slowly, perhaps this method would be worth a try? Contents usually load faster than javascript, so if you place the javascript load last your content will load in 1-2 seconds (maybe much less), making the javascript load 1-2 seconds later. However, if a javascript at the beginning loads in 5 seconds, you need to wait that out just to start loading the content.

If you’d like to read some similar articles, take a look at Scriptastique, a blog all about web development and coding, with great tips on CSS, HTML, PHP, MySQL and Javascript and tutorials and screencasts coming soon! You can follow us on our RSS feed, or Twitter where we’re posting 3-4 short tips daily now!

Tags: advertising, delay javascript, javascript, loading time

Document Presentation For Websites

Martin — Wed, 18 Mar 2009 10:18:39 +0000

There is not really a standard out there for document presentation on websites. Many webmasters rely on widgets and scripts to display documents on their websites making it sometimes confusing for their visitors who have to deal with documents that they can only download and various interfaces for document presentations on the website itself.

Doc Shots tries to bring in more control to the webmaster by allowing them to present documents on their websites easily. The visitor be able to view a selected document right on the website in an overlay that is providing basic controls such as being able to download, print, search and zoom the document at hand. It feels like a document viewer on the web and resembles desktop document viewers enough to make it easy for visitors to use it.

Webmasters have to be registered users of the service before they can configure the service for their website. Registration is free on the other hand and not problematic or time consuming at all. The configuration of the document presentation script can be customized by setting the width and height of the overlay window. Other options include the display of related items and document storing policies.

Webmasters receive a JavaScript code in the end that they have to embed into their website to make use of the document presentation engine. The script will automatically recognize popular document formats such as .doc, .pdf, .ppt, .xls. Hoovering over document links or clicking on the documents will open the document presentation overlay on the same website.

The first viewer will experience a small delay while opening the document as the conversion is initiated at that time. It is therefor a good idea to be the first viewer so that regular visitors do not experience the delay. Visitors can still right-click the document and save it to their computer system directly.

Tags: document, document presentation, documents, javascript, script, view documents, webmasters, websites

loc.alize.us: Geotag photos the old way… with Google Maps

Joe — Thu, 12 Feb 2009 21:30:04 +0000

Generally, I geotag my photos using Flickr’s Organizr. Unfortunately, I often find Yahoo! Maps to be much worse than Google Maps and whilst recently tagging some photos of Northern France and Flanders, I simply found it intolerable (being unfamiliar with placenames etc). I began to reminisce about the days when geotagging was somewhat more complex and proceeded to search for the tool I used to use.

I stumbled across loc.alize.us. loc.alize.us is a bookmarklet and website which uses Google Maps for geotagging. It is remarkably simple to use and quite minimalist.

The bookmarklet works through going to one of your photos on Flickr, hitting the bookmarklet, searching for the location using Google Maps, clicking the location and pressing save. Pretty simple, if you ask me! I find this much quicker than Flickr’s service and Google Maps, in my opinion, is much better than Yahoo! Maps.

Their website allows users to explore geotagged photographs, much like the explore option on Flickr’s maps. Once again, the difference is primarily choice. It allows users to use Google Maps, which has much better satellite coverage for example, rather than Yahoo! Maps. Results, naturally, can be refined by user etc.

loc.alize.us allows its maps to be embedded into website. I question the practical uses of this, but it’s still a good idea. I believe Flickr lacks this.

loc.alize.us doesn’t offer anything important that Flickr doesn’t. The key difference is the mapping site it uses; and that’s one big difference!

Tags: bookmarklets, flickr, geodata, geotagging, geotags, google maps, javascript, online photo sharing, photography, photos, photosharing

Identify And Analyze Malicious Webpages

Martin — Sun, 19 Oct 2008 13:58:29 +0000

Malicious webpages make often use of a series of redirects and code obfuscation to make it difficulty for somebody to identify and analyze the threat. Malzilla is an open source software program for Windows that steps in and aids the researcher in identifying and analyzing JavaScript code on webpages.

The name stems from the fact that Malzilla is based on the Firefox JavaScript engine SpiderMonkey. It basically provides opportunities to load a webpage in the program using custom referrers, User-Agents, cookies and proxies.

The application will display the source code and the http header of the webpage in the interface. The user can view the webpage in text mode, hex view, cookie mode and using a links parser. Single or multiple scripts can be send to a script decoder.

Some of the interesting features:

JavaScript decoder
Decode Hex, USC2 and Base64
Link Parser
Clipboard Monitor
Hex Viewer
Note taking
IP Converter

Malzilla is not a tool for just anyone but it can be very helpful for analyzing webpages. It definitely eases the process of analysing and identifying webpages.

Tags: javascript, malicious websites, malware, malware analysis, malzilla, Security, security analysis, webpages

Test Your Browser’s JavaScript Performance

Martin — Fri, 17 Oct 2008 21:53:11 +0000

Cnet ran some tests on the JavaScript performance of selected browsers like the latest Firefox version, Firefox beta and Google Chrome builds. JavaScript performance was in the news since Google and the Mozilla Firefox development team announced improvements in JavaScript performance.

Cnet used the SunSpider JavaScript Benchmark to test browser performance of the browsers. There are other factors that have an impact on JavaScript performance like the processing power of the computer system.

The results were that the latest Firefox 3.1 beta with the new JavaScript engine TraceMonkey was the fastest with a score of 2,257, followed by Chrome with 2,904, Firefox 3 beta 1 without TraceMonkey with 4,233, Safari 3.1.2 with 6,351 and Internet Explorer 8 Beta 2 at the end with a score of 9,025.

Cnet failed to test any version of Opera and should probably have tested the latest nightly test of Safari instead. Here are the results that a Windows XP service pack 3 with a Intel 8400 Wolfdale processor and 4 Gigabytes of computer memory.

Firefox 3.1 Beta 1 without TraceMonkey- 1800
Firefox 3.1 Beta 1 with Tracemonkey 1817
Firefox 3.03 – 2139
Opera 9.6 – 2736

It’s a bit surprising that Firefox without TraceMonkey was faster than Firefox with it enabled. It could be due to the fact that the portable version of Firefox has been used to run the tests. But the interesting question is, how does your browser compare? You need to run at least two browsers to be able to tell how it compares to the other browser.

Keep in mind that JavaScript performance is not everything and that page loading time is dependent on additional factors.

Tags: firefox, google chrome, internet-explorer, javascript, JavaScript performance, performance, safari, sunspider test

Local Rodeo Protects Firefox From JavaScript Malware

Martin — Wed, 10 Sep 2008 14:06:17 +0000

Keeping up with all the different attack vectors is like the protagonist of Cervante’s famous novel Don Quixote. New threats are emerging on a daily basis while protections seem to remain stagnant at best. Users could opt for a radical solution by choosing to turn off scripts using NoScript and uninstalling scripting languages like Java and Flash content.

That would make most of the Internet unusable and produce some bad looking websites with reduced functionality while some would stop working completely.

Local Rodeo is a Firefox extension that protects Firefox against two types of JavaScript malware. The two types are Intranet Exploration and Anti DNS-Pinning.

Intranet Exploration (i.e. JavaScript portscanning and fingerprinting): The extension classifies all network locations to be either local or external, with local locations being part of the intranet. All http requests that have an external origin (i.e. were generated within the execution context of an external webpage) and a local target (i.e. an intranet resource) are canceled by LocalRodeo.

Anti DNS-Pinning: LocalRodeo detects this attack method by monitoring DNS answers. The switch of a given domain from external to local (or vice versa) is a clear indication of an anti-pinning attack. If such a switch is detected, all further requests from or to the malicious domain are prohibbited.

A detailed explanation of Anti DNS-Pinning can be found at the blog of Christian Matthies. The extension was updated to be compatible with Firefox 3 today.

Tags: anti-dns pinning, firefox, firefox malware, intranet exploration, javascript, javscript malware, localrodea

View Javascript Sources with JSView

Martin — Tue, 19 Aug 2008 13:05:26 +0000

Viewing the source code of a website is a standard function in all web browsers. A right-click usually opens a menu with the option to view the source code of the page. Source code only refers to html source code. There is no way to view Javascript or CSS source codes directly from those menus.

The Firefox add-on JSView adds that possibility to the Firefox browser. Installing the Firefox extension adds a new entry to the right-click menu which displays the amount of Javascript and CSS files that are referenced by the website.

Each file can be opened by selecting it. The source code of the selected file will be opened in the default source viewer of the browser.

The extension provides the option to view the source code of all Javascript or CSS files at once. The tool is especially useful for web designers.

Tags: css, firefox, firefox-add on, javascript, stylesheets, web designer

Male or Female? Your Browser’s History Might Tell

Martin — Mon, 28 Jul 2008 14:19:00 +0000

A website should not be able to read the the history of websites that a user visited previously. An ingenious CSS hack and some spicy Javascript is however enough to use a trial and error method to find out if a user has been to specific websites.

Some webmasters use this method to display the social bookmarking and news batches of websites that their visitors have been through which is very effective in gaining popularity on those websites.

Others came up with a script that is using this method to estimate if the visitor is male or female. The Javascript makes use of the Quantcast Top 10K websites and the male:female ratio that they provide plus a neat algorithm to compute the percentages for male and female likeliness.

Mine turned out 50/50 because I don’t use the history at all. Good luck and let me know what the script thinks about your gender..

The same principle could possible be used to display targeted advertisements. Have been to a lot of parenting websites lately? How about parenting ads? Like sports? How about an ESPN subscription? It’s a bit scary, don’t you think?

Tags: code, gender, history, javascript, quantcast

You better stop using Internet Explorer for now

Martin — Fri, 27 Jun 2008 08:02:27 +0000

A security vulnerability came to light recently that affects Internet Explorer 6, Internet Explorer 7 and even Internet Explorer 8 that can be used to record keystrokes of a user even if he is switching domains. That means that a specifically prepared website can launch some Javascript that records everything the user does afterwards including text input which naturally means usernames and passwords as well.

Sounds scary ? There is no fix for this vulnerability yet other than to disable Javascript or allow it only on trusted domains. Some researchers claim that other browsers are affected as well but have failed to deliver proof for those claims yet. It would not hurt however to use the Firefox add-on No Script for instance.

The vulnerability can be tested on this page if you visit it with Internet Explorer. It opens a new window and records the user input on that domain. There is an explanation from the same researcher available.

Tags: firefox, internet explorer exploit, internet-explorer, javascript, opera, vulnerability

Opera Dragonfly Alpha released

Martin — Tue, 06 May 2008 17:52:56 +0000

Opera Dragonfly Alpha has been released by the Opera developer team, rather silently so to speak. The Dragonfly feature is already build in Opera 9.5 beta 2 which can be downloaded from the Opera ftp site. Opera Dragonfly Alpha can be started in Opera by going into the Tools/Advanced/Developer Tools menu. Opera Dragonfly will be started in a separate window.

“The alpha release includes the initial implementation for the JavaScript Debugger, CSS Inspector, DOM Inspector, Command Line and the Error Console, as well as the Scope module, which allows Opera Dragonfly to communicate with the Opera browser.”

Developers get quick access to every open window in Opera this way. Tabs provide access to Scripts, DOM and the Console. It’s not yet on the same level as the Firebug extension for Firefox. What I really like in Firebug is the fact that I can click on elements in the website and that the CSS attributes of that element are then displayed.

The Opera team has released this alpha version mainly to receive feedback from the community to improve Opera Dragonfly. Feedback can be given at the Dragonfly Feedback Page.

Tags: developer tools, dom, dragonfly, firebug, javascript, opera, opera dragonfly

Control Javascript Events in Firefox

Martin — Sun, 06 Jan 2008 16:50:33 +0000

Firefox Mastery published a nice article about the Firefox add-on Controle de Scripts which lets the user control Javascript events in Firefox. Instead of just disabling Javascript (default Firefox without add-ons), or enabling it on a per-site basis (NoScript) you can configure and control specific Javascripts events.

The two tabs that the extension offers are named Permissions and Popups. The Permission tabs controls Javascript events that move, change, hide or close elements on your screen. You can for example deny Javascript the right to close Windows that were not opened by them or to hide the status bar or scroll bars.

The Popup tabs require knowledge of Javascript events or a Google search if you do not know Javascript. You can select the Javascript events that are allowed to trigger a popup. While we probably all know what the events click and dlbclick do we might have difficulties with mouseup or change.

A excellent Firefox add-on that should be implemented as standard in Firefox 3.

Tags: firefox, firefox-extensions, javascript, mozilla

gHacks technology news » javascript

A Userscript For Better Userscripts.org Navigation

Related posts

SiteFlow Bookmarklet Simplifies Website Navigation

Related posts

Another Critical Firefox Vulnerability Emerges

Related posts

Block NoScript From Opening Homepage After Update

Related posts

Load your advertisements after your content

Related posts

Document Presentation For Websites

Related posts

loc.alize.us: Geotag photos the old way… with Google Maps

Related posts

Identify And Analyze Malicious Webpages

Related posts

Test Your Browser’s JavaScript Performance

Related posts

Local Rodeo Protects Firefox From JavaScript Malware

Related posts

View Javascript Sources with JSView

Related posts

Male or Female? Your Browser’s History Might Tell

Related posts

You better stop using Internet Explorer for now

Related posts

Opera Dragonfly Alpha released

Related posts

Control Javascript Events in Firefox

Related posts