Kouryou-chan's ballet had the first of two scheduled performances of the Nutcracker for the winter holiday, and Omaha and I somehow got shanghied into participating as human props for the party scene. They needed a bunch of adults-- it is a kids' dance studio, for the most part-- and about ten parents ponied up and said they'd do it. Omaha and I got the role of First Parents-- not the biggest roles, those are the families and the toymaker, Drosselmeyer, who's played by a fascinatingly charismatic man.

We arrived early, only to discover that about half of the stuff we needed had actually come with us. Most critically missing: Kouryou-chan's shoes. I ran back to the house, then back to the concert hall. Omaha was mostly dressed when I arrived, as was Kouryou-chan.

Dress rehearsal

The dress rehearsal was fun, and the other parents were delightful. We'd given up several Saturday mornings to practice this, including the "parents' dance" at the end, which is fairly easy and fairly formal, but still, getting everything done to the "8 measures in 4/4 time" was tricky. It was more than just standing around. We had to look like we were having fun, and chastising the boys when they became rambunctious, and fascinated with the mad scientist in our midst.

Omaha and I rocked our costumes. I think the cravat is me, don't you? I'm totally Fred.

The little old lady

Between the rehearsal and the performance, I ran out to Burger King. There was a canonical little old lady in front of me, and after I ordered she said, "That's an interesting outfit. Are you going to a party?"

In my best Jeremy Irons drawl, I said, "Ballet."

"Oooh."

Dinner and Prayer

I keep forgetting that the vast majority of the people at the ballet are Christians. At least twice we were invited to prayer circles that ended with "in Jesus' name, Amen," which the more I thought about it the odder it seemed.

We ate our Burger King relatively quickly, though, and then had a frenzied prep for the actual performance.

Don't Trip over the Wires!

We were on stage for 25 minutes. We herd our five (!) children out onto stage left, where we bow to the host family, then move upstage to the tree. We pretend to admire the tree, and greet the other guests coming in with delight. The women present gifts to the children. There's a dance of accepting the gifts, with the boys being "rambunctious" and the fathers herding them out.

A scene with the adults raising a toast, in which we freeze to have a brief "fantasy" scene of the hosts' daughter admiring a fairy. It's less than a minute long. Then the children resume playing/dancing.q

That dance ends with a confrontation between the hosts' son, Fritz, and the maid (played by one of the most delightful young women I've had the pleasure to meet), then I and another father shoo the boys backstage. Drosselmeyer enters, does a magic show for the children, then shows off his clockwork women. (I'm very disturbed by how many 19th century ballets, plays, and shows enjoyed "mechanizing" women.) The children admire the toys, and then Fritz and Clara fight over Drosselmeyer's gift of the nutcracker, which breaks. Drosselmeyer fixes it, and the dance of the lullaby, which included Kouryou-chan, began.

Omaha and I moved across the stage at this scene. Her back was bothering her a lot, and we ended stage up and right, on the settee. The settee had wires leading off-stage so it would be easy to clear mid-scene, and one of the wires got wrapped around Omaha's ankle. We got her free before the lullaby ended, which was good because then's the parents' dance.

It's a very simple dance: woman curtseys to four beats, man bows, then four steps in a circle, palms crossed, to the left, curtsey, bow, four steps right palms crossed, step forward left, step back, step forward right, step back, step right two, trailing toe heel rest, step left two, trailing toe heel rest, gallop stage right four, gallop stage left four, line up with other dancers and make a tunnel, and the maid runs through and clicks her heels, and the party's over. Then there's eight measures of four to get the children up and off stage.

Much to my surprise, I was never nervous. It was fine. I just did my part and, when it was over, walked off. I made a decent prop, all things considered. So did Omaha. Really, all of the adults, despite having a quarter of the rehearsal time of the children, did well.

Little boys can be very rude

As I was changing out of my costume, a bunch of small boys from the show were hanging out. One little boy said, "Do you shower?"

"Of course I shower," I said. "I did just before I came here."

"Then why does your face look like that?"

"Like what?"

"All dirty 'n stuff."

"I'm Italian."

"What does that mean?"

"It means my face looks like this."

It's a wrap.

After that, we stayed back in the dressing room and watched the show on the monitors. Omaha's back was bothering her a lot so we didn't move out to the main area. Kouryou-chan did the finale and there was much applause and we were exhausted so we all went home. And we'll do it again tomorrow.

Tags: kids, life
Current Mood: amused

That was one red telephone...





I kinda wish I knew how to do that trick where you leave just one part of the image in colour and make the rest black & white. It's cheesy, but it'd be interesting to see what this one looks like with just the phone red.

Tags: photos

So, it was a big Dr. Who weekend for us. Netflix dropped off the bonus materials for S4 of NewWho and the last of S2 of Sarah Jane Adventures, plus we watched a Tomb of the Cybermen on Netflix as well.

The Traughton adventure was fun, but somewhat primitive. Pre-Time-Lord and all, so some oddities on that front. He's all for convincing others that the Cybermen must be destroyed because they're evil, but he does show dislike of guns.

Also: Cybermen should not have visible panty lines. I cannot stress this point highly enough.

Sarah Jane ended on a sour note for me. The Temptation of Sarah Jane seemed like a complete rehash of Father's Day from NewWho S1, right down to the resolution. Been there, done that.

Looking to see if there was much critical commentary on that, I ended up finding out about The K9 Missions, filming in Brisbane, OZ to air next year (in places other than the US). It's being developed by the guy who created K9 (Bob Baker, who wrote all of the Wallace and Grommit movies for Aardman), and there are rights issues with the BBC, so it's not Who Canon, but it's interesting, and "Who compatible".


I also came across a site that details a number of abandoned stories: all the things that didn't get as far as Shada: rejected stories, stories that got lost when the production team changed or a cast member decided to leave (or stay), stories where the author wouldn't change it, or didn't know how to write for Television, or ones that were just too expensive. Stories which, were they to have been made, would have changed some fundamental things.

A few favorites fromthe lost stories...

• Century House The Tenth Doctor appears on a modern reality TV show so he can hunt a ghost.


• The Face of God One faces a giant face in space, which claims to be God, but isn't. Unlike the Trek people, who made this same story into Trek V, the Who people declined...


• The Final Game I'll just quote this one, I can't explain it...:

  The [Third] Doctor and the Master are revealed to be two aspects of the same person -- the Master representing the “id” (instinctual needs and desires) and the Doctor the “ego” (conscious perception of and adaptation to reality). The Master ultimately perishes in an explosion which saves the lives of the Doctor and others



• The Krikketmen

  Two million years ago, the inhabitants of the planet Krikkit built a race of androids called the Krikkitmen to wipe out all life in the universe. They were stopped by the Time Lords, who trapped Krikkit within a temporal prison. Now, however, a group of Krikkitmen which escaped the Time Lords' sentence are trying to reassemble the components of a key which can free Krikkit -- components of which happen to resemble elements of the Earth game of cricket, itself actually a reflection of the ancient war. The Doctor and Sarah stumble upon this plot when they see the Krikkitmen steal the Ashes during a test match at Lords.

  Yeah. By Douglas Adams. In 1976, 6 years before LtUaE came out.


• The Lost Legion, in which Sarah Jane is shot by aliens and dies, and doesn't bitch and moan her way back to Croyden.


• The Son of Doctor Who The First Doctor encounters his evil time-travelling son, to whom he bears an uncanny physical resemblance. This was Hartnell's idea. He wanted more juicy roles on the show.


• The Prison in Space The 1968 story about a planet where women are in charge and men downtrodden. The description is 47 kinds of WTF, but I'll end with the line that made me write this all up: "Jamie frees Zoe from her brainwashing by smacking her behind."

Yeah. I'll be over here in the corner. Boggling. There have been some embarrassing things on Dr. Who in the past 46 odd years. Some in the long ago, some last season. Apparently, we've been spared the worst.

Current Location: United States, Texas, Cedar Park
Current Mood: amused

Headline

Commentary.

Tags: meta
Current Mood: nothing too threatening
Current Music: A fringe electronica recording meant to demonstrate's my wide taste in music

And while I agree that Philip Roth’s The Humbling deserves first place, I have to hold a special place in my heart for Ten Storey Love Song:

Meanwhile, down in Vaginaland, Mr Condom’s beginning to feel a bit iffy. He’s overheating. For some reason, the shagging seems to be twice as fast this evening, and he grimaces as he gets flung willy-nilly in and out of the pink tunnel. He starts getting friction burns, hanging onto Bobby’s stiff penis for dear life, headbutting Georgie’s cervix at 180 beats per minute. ‘Help me!’ he yells in the darkness, feeling himself melting. The sex only seems to be getting faster though, and Mr Condom squeezes his eyes shut as Bobby groans and the friction starts getting unbearable and Mr Condom thinks he’s going to be sick and the searing pain the searing pain and Bobby groans again and suddenly squirts a gallon of white molten lava from his Jap’s eye, exploding through Mr Condom’s heavy reservoir end and Mr Condom screams and screams and vomits ice cream into Georgie’s vagina. Shivering and spasming, Bobby suddenly feels the endorphins kick in and he falls onto the carpet with a happy bump.

This entry was automatically cross-posted from Elf's writing journal, Pendorwright.com. Feel free to comment on either LiveJournal or Pendorwright.

Tags: reading, writing

( You are about to view content that may not be appropriate for minors. )

Current Mood: cold

Well, that's more like it!  A true Florida beach day: mid 80s, humid, breezeless.  The kids had a grand time with the usual beach-y activities (swimming, shell collecting, sand castle building), while I avoiding getting sunburned ducking in and out of the shady picnic area.

Unfortunately there's just not that much photographically interesting on a beach.

Oh, except this wild big bird (I think a blue heron) hanging out on the beach between the sun bathers.


 .  .  .  .

Tags: beach, florida, photo, travel
Current Location: Sarasota, FL

Every so often I get it into my head to take A Vacation. You know, like a *real* vacation: you go somewhere warm for a week, probably with a beach, and just kinda hang out. I especially get it into my head after weeks like last week.

I've never managed to actually do it. But I have two weeks of unofficially-carried-over time off burning a hole in my pocket...

Requirements:
- accessible without a car
- warm
- not overly touristy
- fun for a lone traveller
- in the New World (anywhere else is further than I want to fly)

Nice-to-haves:
- inexpensive
- near or in an interesting city to explore
- eco-friendlier

From searching for "yoga" on tripadvisor.com and reading reviews, I've found a couple of places that might fit the bill: Ak'bol Yoga Retreat & Eco Resort in Belize, and Horizon Ocean View Hotel & Yoga Center in Costa Rica. Ak'bol certainly wins the price war, with single rooms with a shared bath for $35/night. On the other hand, Horizon's rooms ($100/night, private bath) have a kitchen, which can make almost that much of a difference. On the third hand, Horizon is harder to get to and you have to pay extra for the yoga classes...although, actually, the Ak'bol site is not clear on whether the classes are included or not. Hm.

Two questions for the peanut gallery: any suggestions on where to go or what to do? And anyone maybe up for coming with me? I'd be looking at sometime in February, at the earliest.

Tags: travel, yoga

Fuck this. I can't take it anymore. Any Denver types have a spare couch or bed? I pay rent.

EDIT: The downside is, I've got to take my cat with me wherever I go. I suspect Mom would take it out on her otherwise.

EDIT 2: Crisis temporarily averted. Still accepting offers.

comments on Dreamwidth. You can comment there using OpenID, or here.

I got up to pee at 5:42am and I noticed that currently playing on the TV (I fell asleep with the History Channel playing in the background) was some show that was mentioning Thomas Cranmer and the Catholic Church and all of a sudden my ears perked up and I hit the "guide" button on my DirectTV console. It's a 2 hours documentary on the Protestant Reformation. Well, you know I'm just creaming my knickers with that, and on a lark I hit the "record" button and my DVR was able to "record" it back to it's beginning at 5am because it had already been on that channel! How awesome is that???

It's little shit like this that makes me a very happy woman. So now I'm awake and watching the show from the beginning.

Tags: awesome, geekery, history, religion, tv
Current Location: 93436
Current Mood: calm
Current Music: the aforementioned show on the Protestant Reformation

Extremely drunk guy, boarding a bus: "I just have a little too much holiday spirit. Yeah."

About five minutes later:
Bus driver, announcing a stop: "Harrison."
Extremely drunk guy, not using his indoor voice: "GEORGE?"

comments on Dreamwidth. You can comment there using OpenID, or here.

Tags: funny, qotd

It's 1 in the morning and I should really be in bed, but OMG OMG OMG this is making being awake totally worth it right now.

William Shatner reads excerpts of Sarah Palin's autobiography on The Tonight Show. Palin returns the favor.

This transcends all politics, and goes straight into "OMG HILARIOUS" mode. And the look on Shatner's face when Palin says "a bit from Shatner's biography..." *wheeze* *cough* *splutter*

comments on Dreamwidth. You can comment there using OpenID, or here.

Tags: bad nebby, funny, geekitude, links, video

Gorgeous weather, though not really suitable for swimming.  Still, good time on the beach. 

Really really ready to come home.

Boys enjoy harassing seagulls (or whatever these birds are).




 .  .  .  .

Tags: florida, photos, travel
Current Location: Sarasota, FL

It's been raining like hell for two days. This was my street a little while ago.

Tags: new orleans

I've been practicing my design and illustration skills again, and I don't think that Flickr is really the ideal place to put up the work, so I have a question for anyone here who's both here and there: what do you think of using DeviantArt for your illos? I've had a DA account for years, but I've never used it. Should I bring it to life? Or would that just be one more thing to keep track of?

Tags: life
Current Mood: amused

If you're not involved in the Evolution Wars and you're not quite as much of a political junkie as I am, this won't mean much to you.

John Boehner is the minority leader in the house, the lead Republican. He's developed a reputation recently for speaking too much and thinking too little, often accompanied by mockery of his tragically Oompa-loompa spray on tan. President Obama once said, "John Boehner and I have something in common, we are both men of color, although John's is not a color found in nature."

Boehner has supported the teabaggers, opposed the stimulus (he's even said that the stimulus made life more painful in the short term), and claimed that he's never met an American who wants the public option (although some of his constituents have tried to reach him and tell him they exist). He's lead nay-sayer of the "do everything to derail Democratic legislation," the head of the Party of No.

Back in 2002, Rick Santorum (remember him?) introduced an amendment to the No Child Left Behind bill that would "protect teachers who chose to discuss the controversies around biological origins." The amendment failed, although commentary intended to guide the courts should the law become controversial remains in the conference committee report.

What surprised me was to learn that what killed the amendment was a letter introduced into the House and Senate opposing it from hundreds of scientists and educators. The Senate version was introduced by Ted Kennedy (no surprise there), but the House version was introduced by... John Boehner?

This is especially weird since Boehner later went on to join Rick Santorum and Judd Gregg in telling the Discovery Institute that, although it didn't become law, the "conference committee report" was sufficient to cover the DI's backside should it decide to back school districts that chose to "teach the controversy."

Yeah, that went well in Dover.

Tags: politics
Current Mood: amused

Support your local authors. :-)

This is a book by a friend of mine. I thoroughly enjoyed the story, though I'm not usually big into scifi.

http://www.lulu.com/content/paperback-book/duplicate/6691465

Damn fine reading. No really. Buy one in time to make it a stocking stuffer. ;-)

Once a year I watch a gridiron football game. I don't like the game itself. But I like the purity of this one. And I feel like on some level I want to honor the people who are there.

That game is Army-Navy.

In the world of intercollegiate sports, this is a complete exception. These are not illiterate brats on scholarships. They're people who signed up to serve our country in the military. And they play sports as a sideline to their education. Not as a professional athlete in all but name, but in the highest tradition of amateur athletics.

The Cadets and Midshipmen will march onto the field and into their seats. Young, strong, intelligent, and idealistic men and women all. One side will be united in triumph and one in disappointment. And within a few very short years, many of them will be gone. Many will be dead, others maimed beyond all recognition, and most of their souls will be hardened by war.

They are probably not people I would have as friends or who would like me or approve of me. They will fight in just causes and will in all likelihood be misused in unjust ones. But they are acting in the highest ideals of service. And all that beautiful promise will all too soon be gone.

GO ARMY!

On the one hand, you have Jeff Atwood’s Coding Horror, a blog about programming read by thousands if not hundreds of thousands of people. And by the same guy, blog.stackoverflow.com. His backup strategy was to make copies of both blogs but leave them on his hosting site, and trust that when the ISP said they had it backed up, they really had it backed up. Of course, the ISP had some sort of hardware failure, and when they went to restore their backups, they found that they didn’t work. He’s now trying to reconstruct his articles (but of course not the comments, and some very few of the images that went along with them) from Google’s cache, the Wayback Machine, and the web caches of his readers.

On the other hand, you have this blog, which is about nothing in particular and read by probably 15 people tops. My backup strategy is this:

1. Daily database dumps, copied to another file system on a different physical volume on the same box. That’s there mostly to quickly respond if I accidentally delete the database or an upgrade goes bad or something. If my blog got more traffic and more comments, I’d do those dumps more frequently.
2. Another backup and a tar file just before I do an upgrade.
3. Daily rsyncs back to my Linux server at home. I keep a week’s worth of those.
4. Daily copies of that local copy to removable hard drives. I keep a month’s worth of those.
5. Every week or so, I move one of those removable hard drives to a physically remote location.

And I did this when my blog was hosted on a VPS that the ISP claimed had some sort of backups and now when my blog is hosted on a 1u box that I bought on eBay and stuck in a local colo facility. As far as I’m concerned, you’re not backed up until the backup in your pocket.

Oh yeah, did I mention that some of those Coding Horror blog entries that went missing were about backups and how important they are?

I’m sorry, but the idiocy of this just leaves me shaking my head in wonder about why anybody ever believed anything he ever said about computers. On the other hand, it also makes me glad that I don’t have a huge audience hanging on my every word, because someday I might get something wrong (hey, I know, not likely, right?), and schadenfreude’s a bitch.

Originally posted at Rants and Revelations

Tags: geekery, rant

Sheer brilliance
Originally uploaded by mzrowan

There's a little plot of open earth in there.

( You are about to view content that may only be appropriate for adults. )

Current Mood: tired

Low point: Biting into a Pecan Sandie, noting it tasted stale, checking out the box and finding it was 3 years expired (but purchased only moments prior)

High point: Getting a 2 hour nap while my mom took the boys for a hair cut!

Weird point: did you know that vultures are the pigeons of the southeast???

 .

 .  .  .

Tags: florida, travel
Current Location: Sarasota, FL

Þorfinnr Karlsefni. He explored Markland, which is relevant to my research.

I have one date — 1347, describing, briefly, a trading expedition to Markland.

Pray, good sir, when did they discover Markland? It's described in the Grœnlendinga saga but I cannot find a date. Even a year. Even a friggin' decade.

The Grœnlendinga saga and Eiríks saga rauða are giving me the headache from hell. I've learnt some very, very, very sketchy and uncertain and minimal Icelandic, enough so I can identify familial relationships and names, but I know nothing of their calendar system during the time of the sagas.

I am an annoyed panda.

For the kind soul who asked — my research is on the French and English colonisation of l'Acadie / Nova Scotia, as they passed back and forth several times depending on treaty obligations in wars fought in irrelevant places. It's a fascinating study of English vs. French management of literally the same lands, with the same First Nations peoples, & c.

That isn't Icelandic, but I'm just trying to establish a date for first European contact, which was definitely with the Vikings (and more importantly, exposed the First Nations to Europeans for the first time, which they remembered, as I can show in my Wampanoag Confederacy source documents), and I cannot find it.

I am closing my scholarly research databases, I am closing my timeline done painfully and painstakingly in Excel, I am closing EndNote X3 (thanks be upon the thesis gods that chose to give us benevolent bibliographic software) and I am going to lie with a cool compress on my forehead and try to stop shaking with frustration.

There will be 250 pages wrested from me by 16 March, 2010 so I can have a rough draft. There will be, there must be, there shall be. But, like childbirth, it will be painful and I will be having thoughts of regret, and not incidentally, strong drugs, throughout.

Still trying to decide on Edinburgh. I really need some stuff that's too delicate (correspondence, mostly) to scan or microfilm. On the other hand, I so can't afford it it's ridiculous. Though I can if I stay in hostels, I can afford it, just barely, on my grant. Oh, and not eat.

Below, beneath a cut, is a fascinating piece, "Frodo Baggins, A.B.D." and highly recommended reading for all researchers in acadame.

( Frodo Baggins, A.B.D. by Susie J. Lee )

For those who have not read the books or seen the films, the significant parts of the story centre around a long journey made by a hobbit named Frodo Baggins. He travels across a land called Middle-earth to throw a ring into the middle of a volcano called Mount Doom -- an action that, for doctoral students, is known as "filing the dissertation."

Like many a dissertator, Frodo's terrible and treacherous mission has a dual nature. He cannot, and does not, accomplish the goal without the help of others, but ultimately, he must bear the great load alone.

( Frodo is accompanied on the journey by his hobbit friends Sam, Merry, and Pippin. )

Frodo, on the other hand, has made the decision that he wants to go all the way. His most important companion is Sam, who is the equivalent of Frodo's "partner".

Sam is not a Ph.D. student, and more than anyone else, he has the terrible burden of being the one closest to the ring bearer. Sam's own fate is tied to that of the ring yet he is helpless to determine his future in a direct manner. He cannot make Frodo finish; he can only try to make it easier for Frodo to do so. He is the long-suffering hero whom every ring bearer thanks at the beginning or end of the acknowledgments of the dissertation — the one about whom everyone writes "I couldn't have done it without you."

On their way to file the dissertation, Sam and Frodo separate one time. The separation is the result of a deception spun by a fallen soul named Gollum — a.k.a., the doctoral candidate who will never finish.

( Gollum lived with the ring for many years and it destroyed his life, mind, and well-being. )

For example, he is stabbed three times during the course of his journey by disgusting and horrible creatures. He is hounded by terrifying beings called the Ringwraiths. Those attacks are the equivalent of the dissertator's endless financial struggles. ( Each loss of funds prevents him from paying enormous photocopying costs, expenses for travel to archives, bills for books and supplies, health insurance, and campus fees. )

Gandalf is instrumental in running interference for Frodo and making sure that he can complete his mission. He writes recommendations for grants and letters of introduction to libraries. He critiques drafts, locates possible sources of money, and feeds his student whenever possible. Most important, he offers intellectual guidance and moral support. Gandalf has his own challenges, however. In the Mines of Moria, he faces down a horrifying demon called the Balrog — meaning he must also teach, research, publish, and serve on committees.

( Frodo's “fellowship” also includes family, friends, dissertation groups… )

Frodo and Sam have finally arrived at Mount Doom, which means that Frodo finally has the full draft. But he looks terrible; he has been defeated emotionally and spiritually by the burden of carrying the ring. He has reached the end of his long journey, but will he file?

At the volcano, Sam yells to Frodo to throw in the ring. But by this time, the strain and burden of carrying the ring for so long has damaged Frodo's mind; he doesn't want to let go. He looks at Sam with a crazed look and says, "The ring is mine!" which, translated, means that he can't or won't finish; he has more research to do, more editing; the dissertation is just not good enough; he must reformat the page numbers.

He has taken the step toward becoming Gollum. He will remain A.B.D. forever. Sam cries pitifully. His life is ruined, too.

( All of a sudden, Gollum appears and wrestles Frodo to the ground. )

Tags: may god have mercy on my soul, the lord of the rings, thesis, wellesley college
Current Location: 236, Allston Street, Cambridge, Massachusetts
Current Mood: frustrated
Current Music: gnashing of teeth, pulling of hair, frustrated crying jag

I had a job interview today, and one of the “challenges” with which I was presented was this: “We own several sites. We would like our user to be able to log into the central site as a subscriber, and then all the other sites will know what permissions that user has.”

The sites are cooperative, so getting content onto each one to support this idea isn’t difficult. Also, all of the sites belong to the same user, so getting a regular framework that you can deploy to all of them isn’t difficult either.

The scenario we want to support is this. We have two websites, the remote authentication server framework. Let’s call it “rasf.com” (which, sadly, does not go to rec.arts.sf.written), and let’s call the site that wants authentication “brandx.com.” (Sadly, this is a parked site that leads to a stock photography reseller.) The idea is that you’re a subscriber to rasf.com. You visit brandx.com, and Brand-X initially has no idea who you are. We want Brand-X to be able to say, “Hey, Rasf, who is this guy?” and have Rasf come back “Oh, he’s John Smith, he’s a legit user, and here are some details.”

The trick involves public key cryptography.  Both Rasf and Brand-X have public and private keys.  To understand the scenario, you must appreciate that much of the heavy lifting is done away from both sites on the browser.  The problem is that, on the browser, any windows opened between Rasf and Brand-X cannot communicate with each other; this is known as the sandbox, and it keeps malicious sites from using iframes or Ajax to either inject malware Javascript into the victim page or allow the nefarious iframe from ripping data (like username and password keystrokes) from the victim page.  We want to violate the sandbox, but how?

Assumption: You’ve visited Rasf recently, and have a cookie from Rasf saying “Yes, I, Joe Smith, and a valid user of Rasf and affiliated sites!”

You access a page from Brand-X.    Secretly, Brand-X creates a one-pixel-wide iframe and set the iframe’s src attribute to the “authenticate this user” page on Rasf, including in the request its public key as an argument.   After the iframe loads, the loaded page from Rasf now has the session information on the browser, and it has Brand-X’s public key.  The session information includes the Rasf cookie.    So now, Rasf knows two things: it knows who you are, and it knows that Brand-X wants to know who you are.

How does that who you are information get back to Brand-X?  Here’s where the cooperation comes from.  The iframe from Rasf, using the onload() event, creates yet another iframe, this time calling back to a specified page (the cross-domain receiver page) on Brand-X’s site, and that URL is loaded with your user ID, a cross-domain session key, and other information, all signed with the Rasf private key (so the Brand-X site can unpack with Rasf’s known public key).

Now, because both the containing page and the iframe two layers in are in the same domain, they’re in the same sandbox, and can communicate with one another via javascript.  The innermost iframe communicates with the cookies of the outermost page, the calls reload: all this information has now been pushed back to the Brand-X server, which can now use the signed cross-domain session key to make back-end requests of Rasf’s web services API and say, “Okay, now that I know he’s user 12345, and I have a session key validating this conversation, what else can you tell me about him?”

There are lots of other details here.  What if he’s not logged in to Rasf at all?  Well, enlarge the 1-pixel iframe to a size big enough to show a log-in within the Rasf domain, get his username and password, authenticate and proceed as before.

This is a generic description of what Facebook Connect does, and it’s how you can do it as well.

This entry was automatically cross-posted from Elf's technical journal, ElfSternberg.com

Tags: javascript, programming, web development

Parkinson's disease sucks.

just sayin'