Clickjacking and Facebook

english — Tags: , , , , — @ 00:29

Sometimes it amuses me how stupid and innocent we (humans) are. Detecting a scam when getting an email or receiving a call saying you won X amount of dollars is easy to tell. But when a friend is saying something is more complicated to detect the trick. Because it’s your friend saying it and you somehow trust him/her. Right?

Tonight I noticed the following link on my Facebook wall:

Clickjacking

Yes the first thing you notice is the butt of what it looks like a “schoolgirl”. It looks fishy after you see that lots of your friends liked that link. Is a really good meme or a trick. Anyway after googling victorialinn@live.com (the email included in the source code of the page) I found an interesting analysis of all this. It is so fascinating. Take your time to read that blog. Is really interesting.

Disclaimer: I would lie to you by saying I didn’t click it. I did it indeed. Naughty Mario I shouldn’t had clicked it. But hey I’m a man!! The photo was depicting a schoolgirl. I had to click it!! :)

Shorten URL: http://bit.ly/ik6GEzshorten url

Comparing Ruby and C#: Equality

Beauty

While reading The Ruby Programming Language I wrote a couple of notes about the language comparing it to C#. This is the first post of the series talking about those notes.

C# and Ruby share a similar syntax to compare equality in objects. Both use the operator equals (==) and, at least, one method to compare. Ruby uses equal? and eql?, C# uses Equals. Also, both support overriding the equals (==) operator to provide a different logic in case that’s required. The methods’ name are different but they work pretty much the same.

Understanding the difference between both languages is really simple. If you already know the difference between reference types and values types you are pretty much all set.

Ruby

Method equal?

Method used to test reference equality in two objects. For example:

#!/usr/bin/env ruby

a = 0
b = 0.0
c = b
d = e = 0

# "false" pointer c points to b, and b and a
# are different types.w
puts "c.equal?(a) #{c.equal?(a)}"
# "false" b and a are different types
puts "b.equal?(a) #{b.equal?(a)}"
# "true" Same type, same value.
puts "d.equal?(e) #{d.equal?(e)}"

Method eql?

Synonym of equal?, not strict type conversion. Notice Hash classes uses this method for creating the hash, so if two values are the same the hash method should return the same value.

#!/usr/bin/env ruby

a = 0
b = 0.0
c = b
d = e = 0

# "false" Pointer c points to b, and b and a are different types
puts "c.eql?(a) #{c.eql?(a)}"
# "false" Different types
puts "b.eql?(a) #{b.eql?(a)}"
# "true" Same type, same value.
puts "d.eql?(e) #{d.eql?(e)}"

Operator equals (==)

By default, in Object class, it’s a synonym of equal?. Tests reference equality.

#!/usr/bin/env ruby

a = 0
b = 0.0
c = b
d = e = 0

# "true" Even when pointer c points to b, and b and a
# are different types, the value is the same
puts "c == a #{c == a}"
# "true" Type is casted to allow comparing them
puts "b == a #{b == a}"
# "true" Same type, same value.
puts "d == e #{d == e}"

C#

Before explaining the equality options, notice one important difference between Ruby and C#.

First, Ruby is a dynamic typed language. When declaring variables there’s no meaning of variable type, all variables can be used to identify instances of different types depending on the situation. For example, we can define a variable x to act as a string, and then use the same variable x to act as an integer, this doesn’t mean we are converting the string to integer, this means we are using the same pointer (variable x) for two different types, string and integer, pointing to two different addresses in memory. For example:

#!/usr/bin/env ruby

a = "I'm string"
# Output: "a Value: 'I'm string' Class: 'String'"
puts "a Value: '#{a}' Class: '#{a.class}'"

# Output: "a Value: '10.0' Class: 'Float'"
a = 10.0
puts "a Value: '#{a}' Class: '#{a.class}'"

C# is a static typed language, all variables must indicate their type before instantiating an object. For example, when declaring a variable x of type string, you will be able to create an instance of string, only, there’s no way to “reuse” x as an integer in the same scope. Try to compile the following example, it will fail:

public class RubyAndCSharp {

	public static void Main (string []args) {
		string x = "I'm string";
		System.Console.WriteLine ("a Value: '{0}' Class: '{1}'", x, x.GetType ());

		x = 10.0; // It will fail here: "error CS0029: Cannot implicitly convert type `double' to `string'"
		System.Console.WriteLine ("a Value: '{0}' Class: '{1}'", x, x.GetType ());
	}
}

Second, memory management. Both languages manage memory automatically: by default all memory is created and released automatically, there is no need to explicitly release or allocate memory, unless the programmer wants to do so. However, in C# there’s a “difference” between types. There are two type categories: Value Type and Reference Type. The difference, related to memory use, is the way they work and the addresses in memory they use. Declaring value types automatically allocates memory, declaring reference types declares a pointer and the memory is allocated when the object pointed by the variable is instantiated. The Value Types are allocated in the stack and the Reference Types are allocated in the heap.

This difference is really important. Comparing two instances of objects with different “category”, one value type and one reference type, does not work, it just fails. Is like comparing an apple to an orange. Is comparing a value stored in the stack to a value stored in the heap. We can’t compare them without writing any extra code.

And this extra code means using the base class object as the pointer for different types, because both types, value type and reference type, are subclasses of object, in one way or another. Let’s try to compile the following example:

public class RubyAndCSharp {

	public static void Main (string []args) {
		object x = "I'm string";
		// Output: "a Value: 'I'm string' Class: 'System.String'"
		System.Console.WriteLine ("a Value: '{0}' Class: '{1}'", x, x.GetType ());

		x = 10.0;
		// Output: "a Value: '10' Class: 'System.Double'"
		System.Console.WriteLine ("a Value: '{0}' Class: '{1}'", x, x.GetType ());
	}
}

After this short (or long?) explanation we are ready to see talk about the methods.

Method Object.Equals()

Is used to test reference equality in reference types and bitwise equality in value types. For example:

public class RubyAndCSharp {

	class MyClass {
		public string Name { get; set; }
		public override string ToString () { return Name; }
	}

	public static void Main (string []args) {
		// object.Equals in Reference Types uses address memory
		MyClass myClass0 = new MyClass () { Name = "test" };
		MyClass myClass1 = myClass0;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, object.Equals (myClass0, myClass1));

		// Let's try again. This will return false. myClass1 and myClass2 are different instances
		myClass1 = new MyClass () { Name = "test" };

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, object.Equals (myClass0, myClass1));

		// It doesn't matter myInt0 and myInt1 are different variables, equality will be true.
		int myInt0 = 1;
		int myInt1 = 1;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myInt0, myInt1, object.Equals (myInt0, myInt1));
	}
}

Operator equals (==)

Is, basically, a synonym of object.Equals, same rules apply.

public class RubyAndCSharp {

	class MyClass {
		public string Name { get; set; }
		public override string ToString () { return Name; }
	}

	public static void Main (string []args) {
		// == in Reference Types uses address memory
		MyClass myClass0 = new MyClass () { Name = "test" };
		MyClass myClass1 = myClass0;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, myClass0 == myClass1);

		// Let's try again. This will return false. myClass1 and myClass2 are different instances
		myClass1 = new MyClass () { Name = "test" };

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, myClass0 == myClass1);

		// It doesn't matter myInt0 and myInt1 are different variables
		int myInt0 = 1;
		int myInt1 = 1;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myInt0, myInt1, myInt0 == myInt1);
	}
}

Operator Object.ReferenceEquals()

Pretty straightforward, tests reference:

public class RubyAndCSharp {

	class MyClass {
		public string Name { get; set; }
		public override string ToString () { return Name; }
	}

	public static void Main (string []args) {
		// Object.ReferenceEquals in Reference Types uses address memory
		MyClass myClass0 = new MyClass () { Name = "test" };
		MyClass myClass1 = myClass0;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, System.Object.ReferenceEquals (myClass0, myClass1));

		// Let's try again. This will return false. myClass1 and myClass2 are different instances
		myClass1 = new MyClass () { Name = "test" };

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myClass0, myClass1, System.Object.ReferenceEquals (myClass0, myClass1));

		// This will also return false.
		int myInt0 = 1;
		int myInt1 = 1;

		System.Console.WriteLine ("object.Equals('{0}','{1}') = {2}", myInt0, myInt1, System.Object.ReferenceEquals (myInt0, myInt1));
	}
}

Colophon

Sometimes you will have to use an object reference to refer to both types, value and reference, if you are planning to compare their value you have to use the static method object.Equals(a,b). Using the operator equals (==) will always return false, because of the boxing/unboxing:

public class RubyAndCSharp {

	public static void Main (string []args) {
		string str0 = "hola";
		string str1 = "hola";

		object obj0 = str0;
		object obj1 = str1;

		System.Console.WriteLine ("Equals: {0}, Using ==: {1}, object.Equals {2}",
		                          obj0.Equals (obj1), // True
		                          obj0 == obj1, // True
		                          object.Equals (obj0, obj1)); // True

		bool bool0 = true;
		bool bool1 = true;

		obj0 = bool0;
		obj1 = bool1;

		System.Console.WriteLine ("Equals: {0}, ==: {1}, object.Equals {2}",
		                          obj0.Equals (obj1), // True
		                          obj0 == obj1, // False
		                          object.Equals (obj0, obj1)); // True

	}
}

Updated 2010-03-17: Thanks to sukru for noticing the error in the examples.

Updated 2010-03-18: Fixed typos, thanks to yoeri and doza noticing them.

Shorten URL: http://bit.ly/9Mvvgzshorten url

Accessibility in Moonlight

An important milestone happened on Friday, February 26: Mono Accessibility 2.0 was released. It’s important because all applications running on Moonlight 2.0, or greater, will be accessible from now on.

Accessibility?

If you are not familiar with this word, Accessibility, it might mean nothing to you and, probably, you will need a more formal definition:

Accessibility is a general term used to describe the degree to which a product, device, service, or environment is accessible by as many people as possible. Accessibility can be viewed as the ability to access and possible benefit of some system or entity. Accessibility is often used to focus on people with disabilities and their right of access to entities, often through use of assistive technology.” Wikipedia

You have interacted with Accessibility in real life, even if this is your first time reading this word. Have you seen those tiny bumps on the floor when taking the subway? Wheelchairs ramps or the dots on elevator buttons? Have you heard that noise, like beeping, when crossing the street? Have you noticed the audio jack in some ATMs?

These are real life examples of Accessibility. Accessibility in software is similar, it’s basically the degree of interaction between your software and people with temporal or permanent disabilities. People who can only use the keyboard or the mouse, people with low vision, blind people or people with hearing disabilities. All of them will be able to interact and use your application only if it’s accessible. That’s why Accessibility is important.

Accessibility and Moonlight

Microsoft Silverlight is web application framework for building media experiences and rich interactive applications for the Web. Moonlight is an open source implementation of Silverlight. Besides providing a rich experience for the web, applications running on Moonlight are now available for people with disabilities, allowing them to interact and use these applications. The interaction between these new applications and existent Accessibility Technologies (ATs), such as screen readers, is the same. All existent ATs are reused, it’s like interacting with any other desktop application. ATs in GNOME should work right now without any change and, if any change is required, it will help to provide a better integration with this framework.

Implementation

Moonlight Atk Bridge

Refer to Accessibility Architecture for a detailed explanation of the complete architecture.

In both Accessibility implementations, Silverlight and Moonlight, Microsoft UI Automation is used for interacting and exposing data of UI elements of the application. These data are used by ATs to access and manipulate those UI elements. Properties such as visibility, sensitivity or interaction, are exposed by Automation Peers (also known as Automation Providers), along with Automation Patterns to indicate the type of interaction in the control, for example: accepting selection or allowing clicking. There’s always a relation one to one, one Automation Peer and one Control. The properties are available to ATs through the information exposed by the UIA/Atk Bridge module. This module is loaded by the Moonlight application to interact with ATs. It keeps a tree of Atk objects to represent every UI Automation element in the Moonlight application.

The interaction between ATs and Moonlight applications is like this:

  1. An AT requests information about the Moonlight control in Firefox.
  2. Firefox asks Moonlight this information.
  3. Moonlight uses the A11yHelper to load the UIA/Atk bridge module and returns the root accessible, it represents the control’s Automation Peer: WindowAutomationPeer.
  4. From now on, new AutomationPeers will be mapped, one-to-one, to an Atk.Object. All data requested by an AT will be accessed through the associated Atk.Object, and this one will return information contained in the AutomationPeer.

If you are curious you can checkout the sources to see the final implementation:

  • Moonlight: important bits located in class/System.Windows/System.Windows.Automation.Peers/ and class/System.Windows/Mono/A11yHelper.cs.
  • Moonlight UIA/Atk Bridge: implementation located in MoonAtkBridge/.

How do I install it?

Before installing, make sure Assistive Technologies is enabled, then add the Mono UIA repository (see Downloading) and follow the instructions (taken from Installing):

  1. Install the updated xulrunner package from the above repositories. (This is required until Firefox 3.7 because of bug #480317)
  2. Install Novell Moonlight with Accessibility Support for 32 bit or 64 bit.
  3. Install Novell Moonlight Accessibility Extensions
  4. Restart Firefox
  5. Enjoy!

Useful links

Shorten URL: http://bit.ly/9vR5QPshorten url
This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.
(c) 2004-2012 Mario Carrion | powered by WordPress with Barecity