int2e

Here's 30 ideas: http://ycombinator.com/ideas.html

Every non-trivial app has vulnerabilities. One indication of a vuln is not "blatant incompetence"

I've responsibly reported my fair share of Twitter vulns over the years. In general Twitter fixed them quickly. (Except some CSRF/XSRF issue which was non-trivial and was when they had fewer resources.)

Dave Naylor was just irresponsibly publicizing something, which makes him somewhat of a jerk. Being a jerk is not necessarily a Bad Thing and of course we/I don't know the entire story here, but that's what it sounds like.

There are still lots of features I want to add, but any feedback is appreciated! :)

There are a few internationalization issues to fix, but the basics work.

Some of the rectangle sizes look wrong. Compare "Walmart Profits" to "OPEC Climate Change Fund". Compare Google to Facebook.

webpagetest actually renders the document and all referenced items. It's more similar to what firebug/yslow will tell you, and very useful for designing a site to load quickly.

Be careful not to confuse uniques with impressions.

Assuming 10 impressions per unique, that's still a very respectable CPM of $15.

Perhaps there are some interesting corner-cases where the browser will locally cache the JSON. Time to go play with it...

Yeah, XSSI has been well known for a while.

This article's argument against using custom headers is a bit bunk. If you're not properly disabling proxy caching for sensitive data, you're asking for trouble anyways. Disabling caching properly is a bit tricky, but there are some useful details here: http://code.google.com/p/browsersec/wiki/Part2#Document_cach...

I think they have value for branding.

Because the cost to register an account is just one captcha solution, squatting twitter names seems to becoming more common.

Any thoughts on how I should expand the tool? I can see it going two paths...

1) Add more social network sites and more features such as auto-registering your desired name once it's free.

2) Generalize it to notify you when the data on any web page changes. Perhaps leverage dapper.

Or of course option 3: ditch the couple hours of work on tweettaker and concentrate on my next project.

Every* web developer should be familiar with cross-site scripting (XSS) and how to prevent it. http://www.google.com/search?q=xss

* If you don't have a login system or any sensitive data, it might not matter much.

just received an email letting me know they've deactivated my account:

"Microsoft contracted with us, Intrepid Consultants, Inc, to conduct the TechNet Plus Pilot Study program research and manage the activities of the pilot study. Our records show that you have recently signed up for a free TechNet Plus subscription through a registration link that was made available without authorization on a public blog.

The registration link is part of a proprietary study and the party that shared the information was in violation of the terms and conditions to which they agreed to participate in the study. Membership to the Pilot study is limited and all members of the program are required to first meet survey requirements and then complete tasks and assignments over a two month period in order to qualify for and have access to the free TechNet Plus subscription. Since this was a privately conducted pilot study, at no time was it ever intended that a free TechNet Plus registration link would appear on a public internet site, which was done in violation of the terms to which participants agreed upon registering to participate in the pilot study.

We are very sorry for the inconvenience, but for this reason, we have deactivated your subscription, as well as all other subscriptions resulting from the unauthorized publication of the TechNet Plus Pilot Study program registration link on a public blog. Again, we apologize for any inconvenience.

Kind regards,

The Intrepid Consultants Team "

It's definitely a useful trick for only showing certain content to certain users. For example, I wrote a script so you only show Digg buttons to visitors that have been to digg.com: http://int2e.com/blog/improved-digg-integration-script/

How about just using hanging gets?

It looks like some newspaper replacements are doing a fine job watching the gov (and the gov's money): http://www.tmz.com/2009/03/01/tmz-story-forces-bank-to-retur...