Thursday, July 20, 2006

sleep deprivation...

In the past 96 hours:
I should have slept about 32 hours.
I normally would have slept about 24 hours.
I've only slept about 13 hours.
Ugh.

Monday, July 17, 2006

Name your own price on dental products

  1. go to http://www.dentist.net

  2. find the product you want

  3. enter in address bar:
    javascript:void(document.onmousedown=ra)

  4. firefox web developer toolbar:
    Forms | Display Form Details
    Forms | Make Form Fields Writable

  5. edit text input named 'price'.
    click 'add to cart' button

  6. laugh






Of course, I would not really proceed through checkout with any cart created inappropriately, but it was fun to play with a little bit.

Ordinarily, I'd contact a company to let them know about a gaping security hole like this, but...
  1. I'm still bitter about them crippling my browser
  2. My blogs don't have very many readers
  3. I'm confident that they would catch even the slightest modified order parameters, because, "We are Fraud Smart and pursue fraudulent orders to the full extent of the law." (from checkout page)

Pointless, intentional browser crippling - why??

I was browsing an online store earlier, trying to find a certain orthodontic product that I didn't know the name of, when I finally found it.

There were no useful details about it on that site, though, so I just wanted to copy and paste the official product name into a google search. My efforts to do this simple task were denied, though, which confused and annoyed me.

I thought my Firefox may have been choking on the fact that I had a lot of windows and tabs open, but decided to view the source anyway. As it turns out, there was some javascript code (shown below) to intentionally [attempt to] prevent printing or text selection. WTF?!?


//Disable Printing
document.onselectstart=new Function('return false');
function ds(e){return false;}
function ra(){return true;}
document.onmousedown=ds;document.onclick=ra;


This was easy enough to defeat, though, by entering this in my location/address bar:
javascript:void(document.onmousedown=ra)

In IE, an additional step was required:
javascript:void(document.onselectstart=ra)

I'm not sure what they were trying to accomplish. All I wanted to do was research the product before buying it from them, but intentionally made that difficult for me, so I will not be purchasing anything from their store.