Apparently it was a simple as them not validating any input on their posts/comments as reported here. This is a similar technique used back when MySpace incurred a similar fate (Sammy will always be my hero.).

It also seems the creators knew about this months ago but decided it wasn’t a priority, bummer.

Here is the actual post of reddit where users figured it out. There haven’t been any malicious hack attempts as of yet, but if they don’t fix it soon you can bet there will be.

“Fortify said that the “pervasive and critical vulnerability” is present in 11 of the 12 most popular AJAX frameworks, and therefore in many Web 2.0 applications. It allows an attacker to pose as the application’s user and intercept data sent via JavaScript commands, by using the script tag to circumvent the ‘same origin policy’ imposed by web browsers.”

“JavaScript Hijacking appears to be a ubiquitous problem,” said Fortify. It claimed that only Direct Web Remoting (DWR) 2.0, a project which dynamically generates Java classes on the server from JavaScript, is immune to the attack, but said that fixes are available or feasible for other AJAX frameworks.

I’ve never heard of Direct Web Remoting before, but hey, maybe there is something to be learned here. The article doesn’t talk specifically about Prototype or Scriptaculous but I’m sure they among the bunch.

Here is the Yahoo! story: Web 2.0 apps vulnerable to attack

Many basically say Apollo = Flash Player + Acrobat Reader * HTML/JS . A very cool project indeed with MUCH potential. This can be use in applications such as web mail and collaboration apps that can be used off-line and sync with their online counterparts with ease. (Think of Basecamp or Gmail that you can use also when you’re not online.)

Find out and download it at the Adobe Labs

Check out the Apollo Wiki Docs

Dekoh: Competition
There are also competition as this looks like it is going to be a very popular market soon. One of them is called Dekoh which has a slightly different approach and is fully Java based. Here is a detailed comparison between Apollo and Dekoh

Joyent Slingshot
Another potential competitor in the space is Joyent with its new Slingshot platform. Though slingshot is a bit different as it is focused on Rails apps.

They’ve made it easy to take an existing rails app and have it run in its own contained runtime on a users desktop. They use their own proprietary technology but it looks really cool and seems like an excellent opportunity to take many of the great Rails apps out there off-line with you.

You setup an AMI image or can choose from several already available that have various open source server stacks (such as Apache, MySQL etc) pre-installed. Once uploaded to their compute cloud, these servers can be brought up and act just like a regular linux VPS or dedicated server would. Just like the S3 service, since it comes from Amazon it comes with the scalability, stability and reliability we’ve known Amazon to have.

And just what does “Elastic” mean?:

“Amazon EC2 enables you to increase or decrease capacity within minutes, not hours or days. You can commission one, hundreds or even thousands of server instances simultaneously. Of course, because this is all controlled with web service APIs, your application can automatically scale itself up and down depending on its needs.”

So what exactly are you getting from them?:

“You have complete control of your instances. You have root access to each one, and you can interact with them as you would any machine. Each instance predictably provides the equivalent of a system with a 1.7Ghz Xeon CPU, 1.75GB of RAM, 160GB of local disk, and 250Mb/s of network bandwidth.”

The pricing is pretty good as well.

* Pay only for what you use.
* $0.10 per instance-hour consumed (or part of an hour consumed).
* $0.20 per GB of data transferred outside of Amazon (i.e., Internet traffic).
* $0.15 per GB-Month of Amazon S3 storage used for your images (charged by Amazon S3).

$0.10 cents per hour, roughly $70 per month for a server with 99.99% uptime with resources roughly equivalent to almost 2Ghz and almost 2GB RAM. Another great thing is that if you setup your servers to work with the S3 storage service, any bandwidth transfered between the EC2 server and S3 is free.

These two services tethered together are quite the dynamic duo. As some have pointed out, now all they need is a grid distributed SQL type data storage engine to interface with S3 and EC2 and people can make entire web apps simply built upon these services. I know this is definitely a viable option to switch to for SugarStats a little while down the line or even perhaps when we launch.

This just start to really open up opportunities for new services and companies needing these types of resources. Need to scale your web service? No need to buy another managed dedicated box, if you’re app’s software is configured to do so, just throw up another image and you’ve got almost instant scalability. At this time, you can setup up to 20 image virtual servers and need to contact Amazon for more. Check out the Amazon EC2 Elastic Compute Cloud.

So the news is as follows:

* It will be back up and operational within the next few days, perhaps this afternoon.
* It will be MIRRORED in many places across Europe including Holland and the UK. There will be atleast 4 mirrors.
* There are actually rumors at the moment that the final call for the raid had eminiated from the white house.
* TBP reaction to the MPAA: “YEAH YEAH YEAH … Whatever”

So you can look forward to TPB coming back online soon. If any more news shows up I will update. Yista Roving Reporter, Signing Out…

Its pretty funny how everyone was all ass hurt over the name, now they are all over it because they see how cool it is. Change is good and I guess Nintendo is right, “Playing is Believing”. Check out the video: The Nintendo Wii E3 Wait Line The video is even laced with a nice D&B track.

reboot is a community event for the practical visionaries who are at the intersection of digital technology and change all around us… 2 days. 400 people. A journey into the interconnectedness of creation, participation, values, openness, decentralization, collaboration, complexity, technology, p2p, humanities, connectedness and many more areas. Applied towards us as individuals, citizens, teachers, culture workers, entrepreneurs, creators and change makers.

It’s going on from June 1st – June 3rd in Copenhagen Denmark. For more info, check out http://reboot.dk/. It should be a great trip—if you’re going, definitely drop me a line at marston at marstononline.com .

This is absolutely great news, especially since I’m sure my next workspace comp will be a 20″ iMac, though now what I really want is intel native booting of XP from within OS X. I’m sure VirtualPC can’t be THAT far behind… we’ll see.

For more info visit Onmac.net. Though the forums seem to be down due to massive traffic.

“RIM has paid NTP $612.5 million in a “full and final settlement of all claims,

“TripleHead2Go is not a graphics card but an external box that harnesses your system’s existing graphics solution (including SLI™) for rendering of all 2D, 3D and video, and adds multi-monitor support. TripleHead2Go appears to your system as an ultra-widescreen 3840×1024* monitor and simply connects to your computer via a standard analog VGA monitor cable. Using Matrox patent-pending technology, TripleHead2Go then splits the 3840 x 1024 Microsoft® Windows® desktop into three separate 1280 x 1024 screens of information, and displays across three independent 1280 x 1024 monitors. There is no image distortion and no scaling to the original raw pixels generated from the existing graphics accelerator.”