nion's blog

Dear Opera developers...
even I find it hard to believe that your fraud protection is of a real use for anyond (besides the technical implementation: doing an http request for each unvisited site to http://sitecheck2.opera.com/?host=HOST really sucks) it might help some people.

BUT why on earth are you doing this for private ip ranges??? FAIL!

UPDATE: the documentation states that this is not done, however I only recognized this because I saw that it is exactly doing that in a packet dump and I can reproduce this:
192.168.1.212 - - [14/Sep/2008:21:22:09 +0200] "GET http://sitecheck2.opera.com/?host=192.168.1.4&hdn=1jefsNeoBNollcGHqAYxxA== HTTP/1.1" - - "-" "Opera/9.50 (X11; Linux i686; U; en)"

So either urlsnarf is buggy here (which I don't believe as the request should never go through a socket) or opera has a bug.

While some people think that Googles new open source webbrowser Chrome is a great example of code reuse I think the opposite is true. He found at least 25 open source libraries used by the browser. So far this is not a problem but what is a problem is that it embeds all of them in the upstream source tarball instead of depending on the system-wide copies. I know that it might be problematic if people have to install 25 libraries on their own (they could provide static builds though) but for distributors this is just a nightmare if security issues pop-up in one of the used libraries (famous libraries who had issues in the past: webkit, libpng, libjpeg, libxml, ...).

In this case the distributors can't just fix the security issue in the shared library and all applications using it are fixed, no they also have to fix all the copies in software like Chrome. Same if you installed Chrome from source, if a security issue pops out in one of the embedded libs you have to go and install a new Chrome version. Google also needs to additionally maintain upstream and security fixes in their embedded code copies but I guess they have enough manpower to do so.

I didn't yet look at the Chrome source code but I hope it has at least a way to link against the system-wide copies without patching the makefiles.

Say Hi to Squeeze, the Debian version that will be released after Lenny (and of course when it's ready)!