This post was written in 2010. It's preserved here for historical purposes — the technical details may no longer be accurate.
🔍
2026 retrospective
The jailbreakme.com exploit was patched in iOS 4.0.2 back in August 2010. Apple has since added ASLR, PAC, PPL, and Lockdown Mode – the “visit a website, own the phone” attack surface is drastically harder to exploit today, though not impossible (see NSO Group’s zero-clicks). The broader point about walled gardens and disclosure incentives remains relevant.
As most of you already know, there are two open, critical
vulnerabilities in iPhone
OS versions from 3.x up. The first one resides in the Compact Font Format
component of the PDF renderer and the second one an error in the kernel,
allowing attackers to bypass the sandbox (SeatBelt) inside which applications
are run on the iPhone.
The two vulnerabilities were discovered by @comex,
@chpwn and other people.
Only a few weeks later the .lnk design
flaw on windows (guys, you’re using
LoadLibraryW to load a damn icon!), these iPhone OS vulnerabilities are even
more interesting, because of the way the release is being handled by the
community and the vendor.
I spent 3 hours last night trying to find detailed information about the bug,
and except confused (and propagandistic) blog posts the only bit of
information is in this tweet,
and in the actual pdf exploit running on
jailbreakme.com. Where are the security lists
posts? Where is the CVE? Even the CERT still doesn’t say anything about this
vulnerability.
There’s something terribly wrong going on: the
cat-and-mouse-game that is making
the iphone-dev team researchers not disclose any
of the vulnerabilities they find has become very dangerous for end users: an
exploit that allows remote code execution and jail escape without no
interaction whatsoever by the user, carried via something that’s used to
consider “safe” (a PDF file) is what is called a critical hole; while the
exploit that uses it is called a 0-day. It’s the first time in my life I see
a 0-day packaged and distributed explicitly via a web site.
This post was written in 2010. It's preserved here for historical purposes — the technical details may no longer be accurate.
🔍
2026 retrospective
Ruby 1.9 reached end-of-life in 2015 and Ruby 3.x changed the marshal format further. The erlang-ruby-marshal repo on GitHub is archived and unmaintained. If you need Erlang-Ruby interop today, consider using JSON, MessagePack, or Protocol Buffers instead.
In a nutshell, it adds support for unmarshaling 1.9 strings, and implements the
last missing type (TYPE_LINK) that was missing from the code. Tests still
lack, can someone help ? :-)
Added TYPE_LINK, needed because of how ruby 1.9 marshals strings.
In 1.9, Ruby marshals the string encoding in the binary output, and
uses an Ivar construct (TYPE_IVAR) to wrap the string and adds an
"encoding" instance variable (notice: without a leading @) whose
value is the encoding itself.
While the Ivar code worked correctly, the values of the encodings
are actually *strings*, that are being reused via the TYPE_LINK
construct, that wasn't implemented.
So, the get() and put() primitives are being used to store not
only tuples {id, sym} for symbols, but now store either
{{symbol, ID}, sym}
OR
{{value, ID}, val}
for the other types that use TYPE_LINK.
By reading the ruby marshal.c source code, it looks like that MANY
data types save their values in the arg->data hashtable, but by
inspecting the binary marshal output of, e.g, an array of floats,
links aren't used.
Thus, in this unmarshaler, links are considered, for now, only for
strings and regexes.
This post was written in 2010. It's preserved here for historical purposes — the technical details may no longer be accurate.
🔍
2026 retrospective
CouchDB 0.11 is ancient history — CouchDB 3.x has been the current line since 2020, and the Erlang library layout changed completely. This specific fix is unlikely to apply to any modern installation.
If your CouchDB 0.11 gives you the “Invalid UTF-8 JSON” error on every POST
or PUT you issue to it, make sure that in your
$prefix/usr/lib/couchdb/erlang/lib there aren’t leftovers from previous
installations.
On our dev server, I found there two directories
(“couch-0.10” and “mochiweb-r97”) from the old 0.10 setup that were causing
this issue.
This applies if you upgraded from source, as you’ve probably done, because there
aren’t too many packages of CouchDB 0.11 as of April 2010 :-).
This post was written in 2009. It's preserved here for historical purposes — the technical details may no longer be accurate.
🔍
2026 retrospective
HTML5 Canvas won. Flash was officially killed by Adobe in December 2020. This little speedometer still renders perfectly in every modern browser — but nobody hand-rolls gauge widgets anymore. D3.js, Chart.js, or even pure CSS can do this with a fraction of the effort. Still, 52 stars and 17 forks on GitHub — not bad for a weekend project from 2009. And my friend who wrote the original? He was basically Claude before Claude was a thing — shipping production code at machine speed while the rest of us were still reading the docs.
The <canvas> element is the new shiny thing. Safari and Firefox support it, Chrome just shipped, and Internet Explorer… well, let’s not talk about Internet Explorer. Flash is how you do anything graphical on the web. A friend of mine — one of the most brilliant engineers I know, the kind of person who implements a filesystem overnight and a kernel in a week — shares with me a speedometer gauge widget he wrote as public domain code. It’s cool, but a bit crude. So I take it, refactor the whole thing into proper object-oriented JavaScript, add theming support, work around Firefox’s quirks, and write documentation.
This post was written in 2009. It's preserved here for historical purposes — the technical details may no longer be accurate.
From the stage of Web 2.0 Expo 2008 in San Francisco, Clay
Shirky talks about the social revolution carried by
web 2.0 into contemporary society, from TV to Wikipedia and World of Warcraft.
And twitter still had to be globally recognized, in 2008.
This post was written in 2009. It's preserved here for historical purposes — the technical details may no longer be accurate.
🔍
2026 retrospective
Rails 3.0 shipped in 2010 and the Merb merge was a success. Today Rails is at version 8.x, having integrated everything envisioned here (modularity, stable APIs, engines as first-class citizens) and much more. Lighthouse is gone, therubymine.com no longer exists, and many links in this article are dead — but the core ideas still hold.
Almost every web developer knows or has at least heard of Ruby on Rails, a full-stack framework for building web applications using the Ruby programming language.
The sad conclusion: “humans are such herd animals”
The good conclusion: “virality has always existed, it’s not an invention
of Web2.0. Social networking is just a powerful tool for everyone that wants to
change the world”
The mean conclusion: “how much does it take to get people from their
computers to the real world after a virtual ‘heads up’ by some ‘dancing man’?”
Take the whole social environment, utterly unprepared to the media \(r)evolution happening in the last years, and let the hackers observe and talk/write about it. Bring in the lawyers, and let them recognize that “Houston! We’ve got a problem!”, whilst also they define it via lawspeak. Ask questions, and participate to interesting debates.
Now, deliver the 2007 big brother award to the Google Representative, let the sun dive in the hills, add a noticeable amount of Tuscany red wine, and get ready for the next day. Let the paranoia flow, while the hackers show how you can be traced and found via the cellular network and spied via wifi-networked cameras placed there for your safety.
Of course kill 222 ; pppd call dsl-provider doesn’t work. YUCK. Let’s put a router in front of it.. configure, portforward, and start over.. then fdisk /dev/hdc to recreate partitions structure on the new hard disk, mkfs.xfs on all the new partitions, mount /dev/hdcX /target, pax -r -w -p e /{bin,boot,dev,etc,home,initrd,lib,media,root,sbin,srv,tmp,usr,var} /target… wait a lot for the copy to complete because of damaged sectors on the source hard disk, chroot /target, vi /etc/lilo.conf and substitute boot=/dev/hda with boot=/dev/hdc, run lilo -v while in the chroot verify /etc/fstab, and finally shutdown to remove the faulty disk, and boot again.. restoring lilo.conf. yay!
This post was written in 2009. It's preserved here for historical purposes — the technical details may no longer be accurate.
«Women! The knife grinder is here!» – Apart from funny jokes ;) the italian Apple Store together with Girl Geek Dinners Roma organized on May 16, 2009, a workshop about mobile lifestyle (focusing on the iPhone, of course).
Let’s start from the beginning: what are the Girl Geek Dinners? Linda explained to the audience (nearly 20 people) that a geek is a person passionate about technology in a broader sense: the GGD is a group devoted to aggregate women interested about the internet, new medias and technologic lifestyles. Women are often underestimated in geek communities, and this embarassing clichè generated a lot ofdiscussion in the past, and it’s still unsolved (in my opinion).
The GGD italian group was born in 2007 in Milan, and then arrived to Rome in 2008, and is also present in Bologna and in the Marche and Emilia-Romagna states.
So, the GGD group tries to generate a “critical mass” of geek women, to abolish a stereotype that “computer programmers / power users” are only men: in GGD events boys listen and girls talk, then they blog, exchange vCards (and PGP keys, I’d guess ;) and in general try to harness women power and skills in the field of the computer industry. Networking and a dive into social media is the most efficient way nowadays to reach a great audience, and to build rapidly the aforementioned critical mass: that’s why the GGDs event was focused on social mobile applications and general productivity ones. Presented by two official Apple Trainers (Simona and Riccardo), the workshop started @11.30 AM and lasted nearly one hour.
