More shortly.

This is a totally, utterly, and completely developed by Robert Klein, his SourceForge page for it here.

Go play around with it.  You can even make your own WordSearch shapes.

Plus, it’s all online and is a horribly delicious time-waster.

I figured the best thing to do would be to pass down a token that the receiving end knew about, and have it encrypted with a Unix EPOCH timestamp.

NOTE: This isn’t true encryption.  It simply offsets the values of a string by XORing their values with the numbers from a truncated value from the timestamp.

This would make it relatively painless for time adjustments and I could still make it platform independent.   So, after looking at several different functions out there, I came up with his piece of Java code:

function encrypt(password)
{

 var the_res="";  //the result will be here
 var code = Math.round(new Date().getTime() / 600000)+''; // The EPOCH time to 10 minutes

 for(i=0;i<password.length;++i) {
     var pos = i % code.length;
     the_res+=String.fromCharCode(code.charCodeAt(pos)^password.charCodeAt(i));
 }

 return the_res;
}

It takes in a password (or token), and returns an XOR offset (or encrypted)  version of it with the timestamp as part of the equation. The timestamp has a granularity of 10 minutes, so this could be pared down if needed.

The same function, when passed an XOR (or encrypted) version of the password (or token), will return an unencrypted version of the word.  It’s usually a good idea to pass this through a Java escape() before sending it off in a URL.

The PHP version looks like this:

<?php

function encrypt($password) {

 $code = $code = (string)(int)((time() / 600) + .5);
 for($ii=0;$ii<strlen($password);$ii++) {

 $pos = $ii % strlen($code);
 $encrypted .= chr(ord($code[$pos])^ord($password[$ii]));
 }

 return $encrypted;

}

?>

The PHP version allows me to stick that on both a postback page and as a GET/POST/REQUEST variable at the beginning of a page so I can die() right away if I don’t like the token passed in.

It works exactly the same way as the Java code.  This let me take a PHP server and pass it down a code generated for a URL from a non-PHP host.  Even more frustrating is that I had to make it happen on one system in ONE line of code IN THE HREF ITSELF.  It was doable, and it was ugly.

It was also a huge no-no when it comes to security and will fail right off the bat in most browsers as it is considered a kind of Cross-Site Scripting.  Here’s the single HREF that had all the Java code smashed down into one, unreasonably sized chunk:

<a href="javascript:{var%20p='TOKENPASSWORD';var%20r='';var%20c=Math.round(new%20Date().getTime()/600000)+'';for(i=0;i<p.length;++i){var%20l=i%c.length;r+=String.fromCharCode(c.charCodeAt(l)^p.charCodeAt(i));}window.location.assign('http:%2F%2Fchatserver2Findex.php%3Foldform%3D1%26username%3DUSERNAMEHERE%26token%3D'%2Bescape(r));}" target="_blank">Log in as Regional User</a>

* WHEW * That’s quite a mouthful.

One thing to remember about WHY this code was required is the way that code is rendered on a web page largely facilitates how it will be used.  The Java code, although relatively fast, is inherently not very secure.  It can be viewed with any  “view source” and the HREF is no exception.  It is rendered AS a page is delivered to the client on the CLIENT side.

The PHP (and server-side ASP an Java JSP) is all rendered on the server, and will be taken care of on the host before the content is sent to the client.  The page I was working on made all it’s decisions on what to show the client based on what was posted to the page (token gotten via $_REQUEST).

Making the world a peaceful place, one token at a time.

Apparently, this is the way things are SUPPOSED to work.   This makes relative paths truly relative.

Naked pages are truly a blight.

For example, say I had a style sheet and it was referenced like:

    <link rel="stylesheet" type="text/css" href="./css/style.css">

It would be using a path relative to where the PHP or HTML document is gotten from (the “./” in front simply means “this directory, then that path”; if you used “../” it would mean “go to the parent directory, then that path”).

If someone accessed your page in the following method:

http://halytech.net/menumaker/index.php/

They would get a page devoid of any stylesheet love and be in a bleak wasteland of plain HTML.

Notice the brightly lit trailing backslash.  Now, instead of looking for the stylesheet in the subdirectory css, it’s now going to seek it out in a directory named:

index.php/css/

INDEX.PHP, being a file and not a directory, does not give the desired results.

I found the answer over at http://www.bananatools.com/

If you adjust your .htaccess file in the root of your web page, you can fix this with the follwing code:

# Custom Fix
# Only if url does not contain already a trailing slash "/" or a file  extension ".xxxxx" at the end
# trailing slash fix
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !(\.[a-zA-Z0-9]{1,5}|/)$
RewriteRule (.*)$ http://example.com/$1/ [R=301,L]

This, indeed, had the desired effect.

Go, go, gadget .htaccess!

I made yet another one that makes a random lunch menu based on real restaurant menus.

Just even more silliness.

I came back, and my computer had shut down.  What the deuce?  No kids around, so they didn’t shut it down.  Windows Updates are set to have my prior approval first.  Possibly a productivity conspiracy!  No gaming for you!  You have more WORKISH things to do!

My beast of a PC isn’t the best in the world and is getting rather dated, so a fan dying on it wouldn’t be too out of the ordinary.

I restarted my PC, and checked the event viewer.  I found that my ATI card had kindly shut down my PC when it sensed that my video card was overheating.  I’ve been through probably three or four video cards on this PC so I panicked a little expecting to have to buy another one.

First order was to clean out the fans and check to make sure none of the fans had stopped operating.  Having a house filled with animals makes fans and other “hair-attraction-devices” most unhappy.  All fans were working as they were supposed to.

I knew that the ATI card had an overclock tab which let me look at the GPU usage and temperature.  I popped that up on the screen then ran WoW in windowed mode to see if there were any spikes.

I launched WoW and sat at the login screen for a moment.  GPU spiked to 99% usage!  The temperature exceeded almost 200 degrees Fahrenheit!

Holy Clock-cycles, Batman!

I logged in and EVEN the character select screen did the same darned thing.  After logging into the game the GPU settled down to 40-50% usage at about 160 degrees Fahrenheit.  Much more reasonable.  After thinking about it, I wondered if the title screen was somehow creaming my video card with unchecked FPS usage.

I changed my video settings to turn on VSYNC.  This is Vertical Sync, and will make sure your frames per second never exceed your monitors refresh rate.  It’s a one-to-one ratio, so most LCD monitors run at 60 hz which is 60 FPS.  This also reduces tearing but DOES limit your GPU to your screen limits.  For most people this isn’t terribly noticeable.

I kicked wow back up and observed favorable results.  My GPU usage was still high, but nowhere near the amazingly high values it was before.  This should save my PC some heartache and save me from buying new video cards on a regular basis.

At least until I buy a new beast.

Well I finally got around to the name generator and, although it is a simpler, much more limited version of the one over at OTHM dot net, it does the job nicely giving me names that are reasonably spiffy and gives me a quick way to check whether the names might be a little off-kilter.

Go on, give it a try:  http://halytech.net/wownames/index.php

The random URL generators were out there, but most are non-functional, so I did one up myself.  It’s called Happenstance and it takes a word (or series of words) you enter, and searches Google for those words.

Of the 64 results you can get with the Google API, I randomly grab a URL and give it to you.

Out of that URL web contents, I grab all the words I can, make a unique list of them, and grab some random words off of that (up to 6 or so).  I then let you hit a button and search for those words on Google, and the cycle repeats (bring up a URL, grab words, search).

It’s still a little buggy, but it seems to work.  At least it’s ditching out PDFs for the unwary and I have a Not Safe For Work button and a panic button if you cannot unsee what you have seen.

Go check it out here and let me know what you think!

They all get readily caught by GMail’s spam filter well enough, but I check there because I get valid e-mails going there sometimes.

A few are very well crafted, and some are just plain silly.  I’ll post the non-obvious web sites that the links go to after the pictures.

*WARNING: I WOULD STRONGLY ADVISE AGAINST VISITING ANY OF THESE WEB SITES AS THEY LARGELY CONTAIN MALICIOUS SOFTWARE INTENDED TO COMPROMISE YOUR COMPUTER AND SENSITIVE INFORMATION CONTAINED THEREIN.

After the break, the e-mail.

Now, the first one I received almost fooled me.  It looked very professional and, save for the SLIGHTLY mistyped link (which you can’t see unless you hover your mouse over it), it looked legit:

Now, almost every link in this e-mail is genuine.  The formatting looks valid, and even has a very normal tone about it.  The one link to log in to the web page to check your possibly compromised account goes to:

http://www.worldofwarcraeft.com/account/

Note the SLIGHT misspelled word.  If I hadn’t hovered over the link and checked it before clicking, I would have been phished in.

This next one still looks sorta legit but the formatting is all wonky and Gmail saw the mismatched e-mail address and brightly flagged it:

Note that, again, all the links look OK, but I’m sure the links go to some web site where nefarious things occur (Gmail prevents me from seeing what those links truly are).

There are many more that are just like those two, but this one was kind of funny:

Oh noes!  I’m being sold  or traded!  Blizzard slavery! AIEEEEE.

At least the Engrish in the phishing scams is getting better, but they gots a long ways to go.

So, basically, if you get an e-mail and EVEN IF YOU KNOW THE SOURCE, if it contains links, LOOK at the links by hovering over them with your mouse cursor, and check your status bar down below to ensure that the web site you are clicking on is the one you intended.

I am a firm believer in the spam workings at Google.  Their Gmail spam filter is top notch.  I’ve used many of them over the years, but it gets VERY FEW false positives and I never see crap in my in-box that I didn’t sign up for (and even if I did, when I mark that mail as spam, Gmail will helpfully try to unsubscribe you as well).

Legend of the Green Dragon can be had here.  Try it out.  Let me know what you think.