Rediffmail Bug. Anyone Interested?

The title may lure you to assume that I am going to talk about some security bug. Well, I am not… or I’d rather say I haven’t yet thought of any ways to exploit it. If you come up with something, do let us know.

Now back to the topic.
Almost all the huge players are now moving to the AJAX arena. They are in fact coming up with new technologies like Silverlight, Apollo, JavaFx. I am personally not a very big fan of AJAX, but then it doesn’t make any difference. I am, however, interested in these new athletes, particularly JavaFx.

One of the major concerns of any AJAX programmer, IMHO, should be to take care of a situation where the user DOES NOT HAVE or DOES NOT WISH to use Javascript. It should be a growing concern when we have plugins like NoScript (Oh! I Love it.) and we have reasons to use it. Apart from the security concerns, it blocks most of the stupid ads that I am not interested in.

Bottom line, there should be a minimal interface to fall back to (like the one GMail has). The rediffmail coders have done the same and provided a…. ummmm BackUpInterface thingy. However, they probably forgot that the *thingy* is there because the person’s browser DOES NOT SUPPORT Javascript.

My Story, My Words:
I used the NoScript plugin to forbid rediff.com domain, opened the site rediffmail.com, entered userid and password… and said… Khul Ja Sim Sim. 🙂

Bingo I was in and was able to read my mails without any fuss. Then I decided to delete some mails… wait a sec! What the heck!
I am not able to.
Move mails??? Nopes.
Compose? Okay.
Send?? Sorry.
Save Draft? Sorry.
Cancel??? Sorry. 🙁

I concluded that all that looks like a Button uses javascript. However, the links were, fortunately or unfortunately, working.
The Logout‘s like a link. So it’d obvoiusly work.
click.. click.. clickclickclick.
What the Heck!.
Logout operation calls some javascript function do_logout().

So basically, if I am an average internet user and do not have javascript, I’d log into my rediffmail account, read mails, try composing but won’t be able to send… and worse, I won’t be able to logout. Not understanding anything, I might close the browser window.
And what if I am at a cybercafe???

I am sure there is way to revive the session even if the browser window is closed (I remember reading of some similar old Yahoo! bug). If you’re interested, take on from here. 🙂

Now for the other people. I would really like to know how many people actually have a rediff aaccount and actually use it .
I have one too… and I login in… say a month.
I am not at all blaming rediffmail service (Okay! A little :D), I am just interested in the figures.

Samy: A hero or a villian!

First thing first. I hate these sites meant for so called “socializing”.
Sites like: Orkut, MySpace, etc. Ditto with games like SecondLife.
Heck Man.
Just get out of these places and get a life…. [Be more like Swen, the GBCD ;)]

Anyways. There is this guy who created a, so called, WORM for MySpace.
It was a beautifully written piece of code… all in javascript. What this worm did was, it added Samy as a hero in the profile of every person who visited Samy’s profile.
And that’s not all, it also added Samy as a hero to the visitors who visited ANY affected profile.
He gives a beautiful (and “for-dummies”) writeup:
Story in his own words
Technical details

It created a havoc. Lakhs of profiles were infected in a few hours. MySpace had to take down the site to “repair” it.
The code is so beautifully crafted that it made me smile.

Now, was this wrong?
To a certain extent, YES.

Was it a punishable crime?
mmm… Depends on the extent and type of punishment. [If my views matter… well it’s my blog, so it matters 😉 ]

The recent news is that Samy has been sentenced for three years of probation and 90 hours of community service. He cannot have access to internet during this period. [Though I am not able to understand what it means. He’ll anyways be using ATM etc.] However, this kind of “punishment” doesn’t make a sense to me.

If we really have to punish the “culprits”, why not punish MySpace too?
Why shouldn’t MySpace take the responsibility of the privacy of it’s users?
Why was MySpace stupid to allow DIV tags?
Why shouldn’t iexplorer and safari be sentenced for allowing javascript inside CSS?

These are questions that cannot be answered because the world belongs to the BIG-BAD-BOYS.
What this boy did not really harm anyone. He could have modified the code to steal private information, (the way your gmail book can be stolen).
Moreover, he published the code after MySpace had fixed the problem.
……. and yet he has been SENTENCED.

I am reminded of an incident that Lalit told me about.
There was this guy who informed the site administrator about some loophole in his site and was jailed.

“… but why?”
“Because you are not supposed to peek inside my house, even if the door is open.”
“… and what if I am one of those who have signed up to stay in your house? Isn’t my privacy your responsibility? Shouldn’t I be allowed to check the locks and doors?”
“No. I am a freaking BIG-BAD-BOY. You’ve no right to mess with me. If you even dare, be prepared to be jailed.”

Well…. That makes sense now.
So next time you find a loophole either sit silently or sell it.
That’s all I can conclude.