At the moment I have not yet implemented any new features, I will keep this planned for the next major release, which is scheduled for June 2008.

• June 2008 – Version 0.9: editable patterns for protocols (file://, https://, call://, whatever …), some minor changes, fixing defects

Download version 0.8.0 here. Firefox 2 will update to 0.8.0 too and it should work as usual. For those of you who are using my extension I promise to release a version for FX 3 as soon as Mozilla will have released their foxy browser. At the moment they only accept versions up to Firefox 3 beta 2.

Technorati Tags: copyallurls, extension, firefox

• syncs bookmarks into browser menu,
• much faster loading of tag dialog window,
• sidebar search feature,
• tag manager …

I can really only recommend it!

Edited to add on 2007/04/14
It’s a great extension with many useful features, but after synchronization of my almost 7K bookmarks it is much slower than the old one. So I have to retract my recommendation until this thing get’s faster again. I cannot use it, sad but true.

This can be solved by deleting the file extensions.rdf in your account’s firefox profile directory.

Technorati Tags: opensuse, linux, 10.2, firefox, extensions

Finally I managed it to release a new version of my firefox extension CopyAllUrls.

  CopyAllUrls 0.7.1 Download (for MS Windows, Linux and Mac OS X)

In this version significant changes were made. Everything is more easy and more powerful.

Make a donation if you like CopyAllUrls!

New Features

• Ready for Firefox 2, tested with the lates FX2RC3 and FX1.5
• Templating system for copied urls, predefined templates for essential markups
• Hot-Keys for most functions (Copy, Paste, Options, Open Tabs)
• Moved menu entry from tools to edit
• Bug in dialog “Open Tabs” (was “Open URLs”) fixed
• New options dialog
• CAU is able to copy history of tabs
• Simple copy and paste possible with STRG+ALT+C, STRG+ALT+V
• Now you can paste (directly or by using the “Open Tabs” dialog) any text containing urls

CopyAllUrls 0.7.1 Downloads

Go to one of the following sites and download CopyAllUrls 0.7.1.

• CopyAllUrls 0.7.1 on Mozilla Add-Ons.
• Download CopyAllUrls 0.7.1 from Mozilla Add-Ons.
• What’s new in CopyAllUrls 0.7.1.
• Download CopyAllUrls 0.7.1.

Feedback, Comments and Bug Reports

Every feedback is welcome!
Please send a message to juergen@plasser.net and I will answer as soon as possible.

Some Background

Before Christmas I was working on some invites for a private beta of one of our ajax based wiki apps. And because I was very late getting things done, I wrote a python script that creates all instances and the invitation e-mails. And we all know, when you’re in hurry and there is some kind of stress it’s more likely to make mistakes. And I made a serious mistake: My script was executable for everyone, no restrictions, no authorization. You only needed the right url and were able to execute the script.

Feeling Secure

Nobody besides me knew the url of my script. That’s what I thought, but there was just another one: Alexa. The Searchstatus extension pinged alexa’s servers to receive the page rank with my “secret” url (we all know, security through obscurity does not work!). And about 12 hours later one of Alexa’s crawlers visited my server and jumped right onto my inivitation script. Nice! For some reasons I was so clever not to send the e-mails instantly. They all are sent in small junks asynchronously via a modified MaildropHost. This service was down (intentionally).

The Revelation

After the holidays, back in office, I saw some strange e-mails in the queue of MaildropHost, all sent on 24/Dec, 6:35. Here is the apache log entry from Alexa’s visit:

crawl31-public.alexa.com - - [24/Dec/2005:06:35:01 +0100] "GET/testing/createInvitations HTTP/1.0" 200 10946 "-" "ia_archiver"

Fortunately nothing happend and the script was executed in the testing folder, where I have tested it the day before. But I had luck and I really can imagine different and more serious scenarios (left as exercise to the reader).

Conclusions

There are some conclusion from this case:

1. Don’t ever work on the production server when testing (I did a dry-run on the production server first. And after all, final testing simply needs to take place on the production site too).
2. Delete any redundant script from the production site.
   
3. Never leave scripts open for execution, check multiple times from multiple sources.
   
4. Be (very, very) cautious with toolbars, page ranking tools, firefox extensions – if you are not sure about any tool and if it’s calling mama, just use tcpdump or ethereal and check the traffic.
   
5. Stop all services you don’t need regularly!

I really don’t know if Alexa always “comes back” this way, but I will be much more careful in future.

For now I have not updated the CAU mozdev page (copyallurls.mozdev.org).

Dive Into Greasemonkey ist frei als Download (in verschiedenen Formaten) verfügbar.