Musings

User Experience

A few more blog-related notes.

1. Srijith has discovered a minor security flaw in MovableType’s handling of email notifications.

   Update 3/27/2004: At Ben Trott’s request, Srijith has pulled the details of the flaw from his web site (apparently, Ben claims never to have received Srijith’s vulnerability report). Reluctantly, I’ve decided to follow suit here at Musings. Supposedly, the fix is in MT 3.0. If that (or a standalone patch) is released in a timely fashion, I’ll be happy about my decision. Otherwise, I may have to revisit it…

   Update 3/27/2004: Oh, to heck with it! We’re not going to have another Comment-Throttling fiasco. “All will be well when MT 3.0 comes out.” is not a viable Security Policy. The exploit is out there, and MT users need to know about it in order to protect themselves.

   In brief, if a spammer (or other miscreant) leaves a comment of the form

   Innocent comment here.
   .
   Spam links here.

   (that’s a single period on a line by itself) only the upper part will be sent in the notification email(s), while the full comment will be posted to your blog. If you are using Sendmail, you should patch your MT installation.

   --- lib/MT/Mail.pm.orig Wed Mar 24 19:55:40 2004
   +++ lib/MT/Mail.pm      Wed Mar 24 19:58:06 2004
   @@ -85,7 +85,7 @@
        local $SIG{ALRM} = sub { CORE::exit() };
        return unless defined $pid;
        if (!$pid) {
   -        exec $sm_loc, "-t" or
   +        exec $sm_loc, "-oi", "-t" or
                return $class->error(MT->translate(
                    "Exec of sendmail failed: [_1]", "$!" ));
        }

2. My previous entry, as promised, uses SVG for figures. I’m curious as to how this works for various classes of users

   • Users with SVG-native builds of Mozilla
   • Users with the Adobe Plugin
   • Users with no SVG support in their browser (should fall back to a GIF image)

   Personally, I’m using the Adobe Plugin, and I find that scrolling past an SVG image, in Mozilla, is painfully slow. Safari doesn’t have this problem.

3. My Atom feed is now “official.” My RSS 0.91 feed is deprecated (though not dropped … yet).

4. Speaking of feeds and SVG figures, NetNewsWire is a little overzealous in dealing with the SVG figures in my full-content feeds (RSS 2.0 and Atom). I can see an Aggregator not wanting to deal with sorting out “good” <object> elements from “bad” ones, and instead just ignoring all <object> tags. But, just because you do that, why ignore the content of the <object> element? The content, in this case, is a GIF image, which is the fallback for those who can’t — or don’t wish to — deal with the SVG. NetNewsWire is perfectly happy displaying GIF images, but it doesn’t in this case, because the <img> element is ignored.

   I suppose I could strip out the <object> tags from my feed. But I don’t want to. Those whose client software (like NetNewsWire, ironically) is capable of handling an SVG figure ought to receive one.