March 25, 2004

  • TIGHTENING SITE SECURITY


    Thanks for all your beta feedback on our upcoming javascript security measures!


    The vast majority of our beta security measures tightened our site security, without touching any existing scripts!  The exception: our elimination of the SetTimeOut function, which was used on three separate functions:



    • Blinky boxes on some pages
    • Cursor Clocks (those clocks that follow your cursor around)
    • Ad Hiding Scripts

    Because so many people were using SetTimeOut to hide ads, we had to take it out for non-premium members.    To anyone using the blinky boxes or the cursor clocks… we’re sorry.  Your pages won’t break – the boxes just won’t blink (sorry Sugarspun!), and the cursor clock won’t appear.  But your pages should work just fine   But we thought we’d give a day or so head’s up, so you can tweak your site.


    As to why we’re tightening site security, we wrote a bit about it earlier:



    Over the last few months, we’ve snuffed out some auto-subscribe scripts… and some auto-blogring scripts…  and some other scripts which try and track who visits your site.  But some members persist in looking for loopholes to install evil codes!  So, it’s time for one last effort.  We’ve closed off every loophole we can see, without impacting any of the good codes out there…


    Hopefully these changes will make the safe more secure and enjoyable.  And thanks to everyone who helped with testing!  These changes will go live in the next day.  If you’d like to see how our changes will impact your site, please check out your site here:


Comments (181)

  • woohoo first

    my site comes up good

  • Is it only non-premium sites with the blinky boxes? If so, I’m tired of mine anyways…

  • wait but now my ad will show–oh i have premium now.

  • John, is the guestbook fix gonna be rolled out as part of this update? That would be very nice…

  • Disregard that question. I see it does. Thank you!

  • good. i hated those clocks =O

  • *w00t* security is always a good thing… premium or not.. g00d g00d… :)

  • Right on. Cursor clocks suck.

  • the security is good, but is there still no option of changing the ad positioning? what happened to it being at the bottom. i liked that. i don`t mind having the ad up there, it`s just that having it at the top just, to me, looks a little funky. just my opinion..

  • ah!!! my blog roll from Bloglines doesn’t show up anymore. Hm… Any way to fix this?

  • yay for security

  • The script is as follows…

    Yeha, I’d hate to loose this function.

  • Blah! < script language=”javascript” type=”text/javascript” src=”http://rpc.bloglines.com/blogroll?id=edblog” > (ignore spaces)

  • am i the only one whos a little worried over the fact that we’re using beta software?  i mean, im a huge huge fan for tightning secutity, but using beta software basically underminds all thoes security measures… yeah, the sight will be safer, but our computers can be accessed really easily now, right?  If someone would wanna respond to this w. what they know.. that would be great?

  • I won’t miss the blinky boxes or the cursor clocks, that’s for sure! Could you disable all those annoying javascript thingies? They annoy the heck out of me sometimes >_____<

  • Image changing script died :( You stole my rupees again! Stop it, John!! I’m a poor college student in need of lots of rupees…

  • It showed an ad at the top of my site and I am a lifetime member. I hope that won’t happen when the changes take effect. Thatis one reason I became a subscriber, to get rid of the ads…

  • wow… after i checked mine… my xanga was crap! ahh… john dont destroy the blinking boxes! plz?

  • can ya help me with my xanga bug?? can’t upload pics from my computer… had to copy and paste the script html:( …i could copy and paste ONE pic!! per entry!! pleeeease help…!!

    thx

  • No problems at my site. Thanks for the fixes. Because of the funky codes at so many sites, I’ve stopped exploring Xanga sites. Most of those sites aren’t worth a visit anyway.

  • hooray for premium!!! bwahahaha

  • cursor clocks won’t be missed that’s for sure.  those were stupid and annoying anyways.

    but the blinky boxes?  what is the problem with blinky boxes?  they weren’t evil.

    and as for the ads, [i have premium now] but i was wondering if you could put them at the bottom?  it kind of disrupts the continuity of what you want to read and what you see and having the ad at the bottom doesn’t disrupt the way a xanga is formatted to look like.  much more clean to say.   i liked how it was the bottom when you guys were fooling around with it.

    that’s all.  thanks.

  • Thanks for taking such good care of Xanga team

    Kaziophia

  • thanks for the heads up, but fortunately for me, nothing changed. ^_^ i use safe and quick loading codes.. actually the only codes are CSS.. and a small music script, so i’m good to go! thanks! *thumbs up*

  • noooooooooo my chatterbox doesn’t work on the beta version =(

  • w00t

  • my chatter box doesnt work either!!!!!!

  • My chatterbox is gone!!!! Nooo!!!! I’m gonna go sit in the corner and cry now. *tear*

  • Hey, I wrote some js to stop sitemeter from tracking my ip. Now it stopped. Is there anything I can do to make it work again? The gist of it is pulling a script off one of my sites to get the IP (since you have server side includes off).

    Thanks

  • Sorry nevermind, my webhost didn’t update dns properly:(

  • I hope the javascripts dont lag, cuz sometimes I have trouble loading java.

  • …

  • Did we also lose the chatterboxes? Mine won’t come up…

  • Sweet.  Awesome security measures.  Doesn’t affect anything on my site, and besides…those blinky boxes and cursor clocks get REALLY irritating when you’re browsing through other sites.

  • Oh hey, and I have a chatterbox and it was working perfectly on the beta.

  • greetings!!

    ma chatbox didn’t work in the beta version!! boo hoo!! wat am i gonna do?!

    HELP ME PLS!!

    peace from da gangsta.

  • neat

  • Those cursor clocks are just a pain in the … Well, you know what I mean.  Everybody may hate me, but I say good riddance.

  • co0l, thanks for working so hard to keep the xanga community operational and awesome.

  • Well, my ‘Sideblog’ (http://www.sideblog.com) was not an ‘evil code’, but has been exterminated with the beta rollout.  It’s in the javascript module.  Will there be anyway to restore that?

  • What does work in the ‘Javascript Module’?  Anything anymore?

  • Buzznet syndication no longer works either.

  • “Note: This JavaScript Module was designed exclusively for free newsfeeds, but our newsfeed partner has stopped supporting this. We are adapting this module to be more flexible and powerful in the future, as part of a complete revamp of our Look and Feel features. Stay tuned!”

    Is this what you call “more flexible and powerful” ?

  • Ok I agree the clock thingiez were annoying…but why are you taking the blinkie boxes away? I like those things…But YAY for security…
    *-*Jennie*-*

  • hehe, glad I have premium :)

  • looks good here

  • i enter some ppls xanga sites and a virus i get a notice saying that a virus has just been cleaned from my computer.  what’s the deal and are you aware of this problem?

  • Was I sposed to see some sort of change? All I saw was something where I could subscribe to yourusername or sign the guestbook :p ‘Course I don’t do a whole flippin’ lot on mine to start with, geek challenged right now : Anyhoo, I’m gonna go fry a few eggs and bacon and see how long it takes me to get well. Hasta la vista o/

  • i love to eat poop.

  • Eprops are evil

  • Thank you, John for the good news. :)

  • Props on the profile pic.  explodingdog.com, man that’s some great stuff…

  • don’t take away the clock thingy that follows the cursor around…its the only updated clock i have!!!!

  • Thanks for watching out for us!

  • thats so unfair.. i liked blinkboxes whatsits i saw on friends sites plz dont delete all the javascripts!! they r cool:( y is javascripts so… evil? y do some ppl dislike them:S

  • good stuff! thanks for making things safer. its kinda like xangland security. except you guys actually do your job.

  • Can you provide a list of source code that still works in the ‘Javascript Module’?  Nothing I try works.

    If nothing works at all, are you going to fix it or just eliminate the module altogether?  It’s stupid to provide it to us if nothing is going to work.

  • :(   i like my cursor clock.  oh well.

  • my countup script doesn’t work…………

    -Amy-

  • Yea, security rocks!  Go Xanga Team!

  • not wanting people to disable your banners is one thing, but dont use the “tightening security” BS to make it seem like you’re doing it to protect us. Lame, just because people are smarter than you and disable your dumb banners.

  • yay!! for you guys that work out the darn bugs for this thing   go xanga!!

  • Greetings, John. Just one more thing. I’m not sure if this have been brought up before but what about the issue about the forced ”copy & paste onto clipboard” script?  Like whenever you happen to go upon a blog entry, there’s a script implemented by that user that forces verbiage onto ur clipboard so basically it’s “copied” onto you and whenever you have something thatw as previously on there (such as work), it gets overriden.

  • Nice site.

  • after 9 months i still havent worked out how 2 use the old blog properly… now what do i do????

  • My site still looks OK I guess (it’s still on the boring side), so keep up the good work!!

    JB

  • i hate those annoying clock cursors, mostly the teenie boppers use those, how about a 18+ xanga site? Or just branching it off into the same xanga format, just have an 18+ section then the -17 down. I don’t know but its an idea to think about.

  • haha no more banner hiding. i paid to get rid of mine, everyone else should have to as well.

  • When I click that link to see how my site is going to look, my entire skin is gone, I have no posts, NOTHING.  Am I missing something or is my site going to get wiped out?  Help!!!  Please?  Thank you.

  • Punk, you’ve caused me to want to venture out to other blogs without the need to stab myself in the eye when I get an epileptic fit from blinky boxes or at the site of a clock that reminds me how short my life is (or how much a xanga addict I am)

    Thanks!

  • ty

  • you do well with xanga…good job.

    ~Sarah1 =^_^=

  • how about something for people who don’t have xanga but want to leave comments?  Cant they resgister but not have to get full blown xanga accounts?  Becuase some of my friends do that, and they just don’t use their xanga accounts….. hmmm

    And about someones post on disabling the banner–  If you arent paying for xanga, it makes sense…  it’s not like u get mad popups like angelfire or anything.  It just says “Xanga Premium”  no big deal….

  • what are cursor clocks?

  • THIS IS SOOO RETARDED

  • Sounds good.  Now can you please help the Feds catch bin Laden? 

  • chode…just…chode

  • ((pouting))
    My Blogroll from Blogrolling.com doesn’t seem to show on the beta site.
    It’s not evil! I am a nice Xangan…really!
    ((adding a little lip quiver for effect))

  • awwww… where’s the clock cursor…

  • i hope i can put a javascript banner rotator on somewhere (i took it off cos it wasn’t working on mozilla browsers) but i plan on doing something about that (after easter)

  • yeah, cursor clocks suck. but what about the blinky boxes? i like my blinky box…

  • wowness. this is some crazy stuff…is everyone doin ok.

    now…so this does not effect the premium? mk…cool cool.

    what is the blinky box? and the clock..that follows your mouse? wowness….i have like not even herd about this stuff and here ya’ll are tlaking about it. and how it has dissapeard. WOW. but i have only had xanga since feb something. and is this saftey thing stopping people from trying to get your password and hacking into your xanga? cause..people keep gdoing that to me. and it is really peeing me off! well…thx.

    thx for lookin after xanga.

  • awww….no more blinky boxes….ugh

  • humm hello…i dont know if you will read this…but its worth a try…my site…it doesnt allow people to leave comments an props…why is that so???…can you help me…thanks so very much (=…oks b’byes

  • oh , BOO~! i LIKE my clock cursor~!!! >.<”

  • Thank god!  Some of those blinkies were getting a bit out of control!

  • Oh good I was never a fan of those cursor clocks. I thought those blinking boxes were all right- isnt it someone who used to be here wrote that one?

    Ive checked my site with that beta thingy and it works just fine!

    I use javascripts but the safe ones so nothing changed on my site

    Thank you for all your hard work!

    Btw how come we cant use any other tagboard and only chatterbox?

  • no~ i had to take off mai blinky boxes…. T.T

  • you people are freaking out without looking at this objectively. The elimination of the blink boxes is an unfortunate consequence of having to delete other malicious codes that violate privacy, because they share a certain component that enables them to work. Furthermore, you act as if your page is destroyed by the absence of blinking colored boxes. Use your imagination to be innovative with what you’ve got. Even furthermore, one person complained that this was a beta release, but technically, everything is a beta; we can never know every problem that may arise. But, it may more fair for xanga to have smaller trial runs on volunteer Xangans who are willing to submit their page for preliminary tests, but.. yeah. I’m just rambling now.

  • i dotn  want nothign to happent o mah script ok but thanks for the security i got alittle worried when i saw thiz on mah site but if it iz messed up i qiut xanag and i will neva buy premium :/

  • and dotn touch my blinkies i love my blinkies

  • what’s wrong with seeing who visits your page?  seems like the privacy of the page owner > privacey of the visitor IMO.

  • do premium members get effected by this? or no?

  • wonderful ;] question sirrrrrr… i’m a premium member and i’m thinking of moving my site is there anyway that the xanga team or whoever takes care of the site, move my premium membership too? orrrr?

  • I’m sad.  I’ll miss the text that scrolls across the bottom.  My layouts make more sense with it.

    *sad face*

  • Thank Goodness I got premium then…. =)

    LHHRS

    Kevyn

  • sounds great.

    -true dat.

  • noted! jimmy

  • sounds good to me!

  • I’ve already created and utilized a way around your new “security fix” on my other Xanga (NOT the one I’m posting from now which is premium). I think that since I pay Xanga every month for Premium, that payment should be enough for both of my usernames.

  • YAY!!

    thank you XANGA

  • i dont get it

  • whatever

  • what is this exactly? lol

  • wat in the heck is a blinky watever?? can sum1 come to my site n tell me??? … im so lost =(

  • my chatterbox works but my blinking text script doesn’t. or animated text. what ever it’s called.

  • If you don’t understand what they are talking about, then you don’t have to worry about it.  Only people who know what they are doing have things like cursor clocks and blinky boxes.

  • aah~ do u have to destroy the blinking boxes? *sob* they’re so pretty…

  • why is everything on myne moved to the right on the beta version?

  • yay for security; boo for blinky clock thingies.  those suck majorly.  thanks.

  • KOOL!

  • well, hyperpnay, if you think its ugly, then pay to get rid of it. advertisements are what keep xanga free, and without the ad banners, do you realize that you would HAVE to have the money to pay for xanga, without the premium services? ads are what keeps xanga free, and if you dont like them, would you rather have popups?

  • My site is the best!

  • how come my jokes thing doesn’t come up when i go to that site?  i mean…do i just have to get a new one, or is it evil in some way that i don’t know about?  newayz…thanks for replying

  • um…I’m hoping that there’s not a problem with my site now, just clicked on the link and came to a base yourusername site…that’s not supposted to happen I assume?

  • thanks so much!
    everytime i go to a site with blinkie boxes or those annoying cursor clocks it freezes up my comp. i hated that.

    thanks again.

  • i liked my spinning cursor, darn

  • tienes un biligrafo?

  • don’t use this after i chacked what my xanga would look like i hate it!!! and i’m very proud of my site the way it is and all the time i’ve spent making it look so nice! i can’t believe your doing this! don’t please!!! i’ve worked to hard

  • ahhhhhhhhhhh

  • I guess that to get better site security we’ll have to sacrifice a few things, no biggie.

  • but Y???? y don’t let blink boxes wrk????? is da BEST!!!!! meanies….

  • I don’t like it. My background won’t show because of these changes :( Please help.

  • what? Chatterbox wont work >< I don’t wanna pay for premium!!!!!!!!!!!

  • setTimeout codes rule! all you should do is make it so it cant read

  • Woo. I will still be spiteful towards Xanga. I’ll find something, just you wait.

  • i guess i don’t use anything that’s affected, but thanks for looking out for security.

  • it doesnt work for me :(

    i dont know why..

  • way to go john. i hate them blinky boxes

  • Yea it work much faster

  • dude i like my blinky box its like back and white an stuff noooooooo!!!!!!!!!

    ….. ok i guess ill live…

  • can you help me fix my xanga bugs?

    thanks

  • wat happen to the chatter box and stuff will that be taken out too?

  • I didn’t even know you could put your own JavaScript. I’ll definitely be interested to check out if I can have an auto-detect script to switch CSS files for Mac/PC. That would be sweet as my page displays all wrong on Mac browsers :(

  • ?

  • thank god for getting ris of those curser clocks. they were so unbelievably annoying.

  • Can you add something to disable background images? they bother me:)

  • i have this code on ma xanga dat js dims the ad but doesnt really hides it will the code still be taken away?? i mean like the code lets u see the ad but its jd a little darker

  • Haha! I laugh at all of you non-preminum members! Get a life!

  • keep up da goot work

  • =( my beautiful falling hearts wont move nemore..annd my blinky boxes..gone

  • can you guys fix the blogring bug thing too? when I had Premium I had these blogrings..and I was leader of one..and when my Premium expired and I renewed it I got taken out of my own blogring, even tho it still lists me as leader! :( Now it doesn’t even show up on my list..

  • stop making xanga suck.

     

     

    thanks.

  • crap!! i like my blinky box… awwwww!!!

  • i very disliek xanga now…
    y u ppl have to make a script to blk the ad removal?
    it’s pretti crappy wit a SHITTY ad on the top of ur xanga…aiii…
    i was gonna buy premium…but now…
    i dun think so…since u guyz dun even respect ur users.

  • xanga’s messin w/ its versatility in website designing. Next thing you knoe, it’s just gonna be an ugly thing with words on it, the only reason i’m still using it is because of the xanga community, this blogring and eProps thing is awesome. I dont knoe if to hate or like xanga, how perplexing. :x

  • if u want to leave the ad on…then make it look good.
    it’s fucking newb ad rite now.
    look how to make good banners.
    ever thought of taking art class in high skool?
    well mebbe u didn’t but the AD sux my ballz.
    realli ugli… plz make a new one if ur gonna keep it there…
    well i won’t cuz i’m gonna get scripts to hide it neways cuz it’s gonna b so ugli.
    alrite thx gg gtfo.

  • thanks for making xanga a “mobetta” site.

  • Dude like chatter box and blink box will go

    ……………flat line……………………

     this is sooooooooo unfair 

  • fading the making it more theme base wont hurt

    do

    WHY THE BLINK BOXES

    like the falling obj wont work either!!!!!!!!!!

  • isn’t there a way to only disable that for non premium members? I liked my cursor clock… I use mozilla so it didn’t work for me and it pissed off everyone else :P And the blink boxes… damn, I got hit twice with this one…

    but really though, isn’t there a way to only disable that script for non premium members?

  • As long as xxreader works, I’m pretty sure I’ll be happy.

    Oh, and the useragent script I’m eventually gonna throw down. That would be nice, too. (Of course, you should be able to read my mind and know how that’s gonna work. *snort* It’s all document.write, so I’m not really worried).

    And, while we’re at it, let’s disable the “disable right-click”. Any “web designer” who uses this and thinks it will protect their work? Send ‘em my way. I would be more than happy to set them straight…

  • YALL SUCK!! I CANT BELIEVE YOURE TAKING AWAY THE BLINKY BOXES!! ITS WHAT MADE MY SITE FUN!!! DAMN YOU BASTARDS TO HELL!!!!

  • why are we getting rid of the blinky boxes? those arent evil. they’re cool.

  • My site is the best thatks for tightening security…. event hough i dunno what it does im just doin this to advertise my xanga

  • I HATE YOU BASTARDS YOU CAN GO TO HELL. I HOPE YOU DIE. taking away the blinkboxes. thats fucking bullshit. i agree w/ daredm on the whole making the ad look good. because it just looks like shit & we would keep it on there if they would fucking make it look 1/2 way good. not gay n white n shit. it just throws off the whole color scheme on all our sites!! BASTARDS!! & the whole taking away of the blinkboxes is SO un-necessary. how is THAT a security issue!?!?!?! Uhh yall r gay. go to hell bitchez!

  • oh, shut up lilstarlet26….get over it.
    I’m glad they did what they did.
    the clocks were annoying.

  • Hate those clocks!! Hooray, my site untouched! :)

    Merry Part and Blessed Be

  • yay im cool

  • Please dont take away the Blinky Boxes!! Its a simple way to SnAzzE up a boring xanga and it will cause alot of us trouble changing them…and how were the blinky boxes a threat to securuty anyways???? Cursor clocks as well???

  • no, sir.  Sheldon Levine is an homage to the man…nay, the machine himself.  david mamet is amazing.  no wonder so much amazing talent was recruited for the movie of glen garry.  the leads were definitely not weak.  thanks foryour kind words. :D

  • lol ello!! thank u

  • its about time someone took action on those damned clocks!!!!!!!!!!

  • this is stupid and full of shit !

  • Um… I just posted a pic from quizzilla on my site, and it showed up and everything for a couple days, but now it’s gone… does it have anything to do with the new changes?

  • mai xanga isnt the way i want it no mor theres lots of things missing…… mor then the blinking thing

  • well it changed the clock code so it wouldnt work, but i removed it. ( sigh… if it becomes enabled again, plz tell us… )

  • thnx thnx thnxx!!!! fo this information!!!!  then my problem on my xanga must be the status bar code..  -_-;;

  • yea go john

  • It’s a shame that the blink boxes had to go. They made my site look alive.

  • Thanks for informing me!!

  • ^_^

  • thank god.
    now all that java madness is over
    blinkies are insane.

  • none of my codes are working!!! my titles arent working and the things at the bottom or top wont work either.. none of my codes are working!! please tell me what to do! koralex90@hotmail.com

    my marquees arent working either..

  • also when i do preview the save changes yes, or no box is covered by the xanga ad. i dunno what i should do.. i have to scroll down all the way just to press yes or no.. please fix that.

  • dudeeeeee

  • :D

  • Keep Xanga safe for everyone! =)

  • Another thing that is really annoying that you might wanna think about…those friggin wizard things that pop up when you go onto someones site and it talks to you. That kills me every time.

  • I want to join beta testing I love to do that I do it all the time for sony etc.

  • awsome :) loving my new site, with all these cool new features!

Post a Comment

Leave a Reply

Your email address will not be published. Required fields are marked *