Chrome users can use Greasemonkey, which is a Firefox extension that allows developers to customize web pages using javascript, to install any user script with a single click.

"Ever since the beginning of the Chromium project, friends and coworkers have been asking me to add support for user scripts in Google Chrome," says software engineer Aaron Boodman. "I’m happy to report that as of the last Google Chrome release, you can install any user script with a single click. So, now you can use emoticons on blogger. Or, you can browse Google Image Search with a fancy lightbox. In fact, there’s over 40,000 scripts on userscripts.org alone."

"Installation is quick and easy, just like installing an extension," adds Boodman. "That’s because under the covers, the user script is actually converted into an extension. This means that management tasks like disabling and uninstalling work just like they do with extensions."

Boodman notes that scripts have full access to private data on sites, so you would want to be careful about what you install, and use caution when trusting them. Not all of the scripts work with Chrome yet (Boodman estimates 15% – 25%).

According to data from NetMarketShare, Chrome made market share gains in January, taking share away from both IE and Firefox. The browser gained .6% for the month. 

Related Articles:

> Chrome Cruises By Safari

> Chrome Ad Campaign Nets Positive Results

> Digg Launches New Extensions for Firefox and Chrome

Google Apps Script starts in the spreadsheets of Google Docs. It lets you create sheets to read and change formulas, formats and cell contents, and lets you create custom functions so you can automate repetitive tasks.

"Google Apps Script provides the ability to automate a variety of tasks such as modifying Spreadsheets, creating Calendar appointments, checking stock prices, sending email, looking up Contacts and much, much more," says Google Apps Product Manager Evin Levey. More details can be found in the video below:

Google Apps Script provides interaction with different Google products and capabilities using JavaScript APIs. It lets you use standard JavaScript, Google’s online Web Script Editor, other desktop development tools, and provides for basic collaboration and sharing.

"Users write scripts in JavaScript using libraries designed to provide a powerful interface with Google products," says Google. "If you already are a JavaScript developer, a key difference is that scripts run on Google Servers instead of user browsers. As a result, direct operations on the client-side DOM are not supported, although some restricted functionality is provided. Your code executes server-side, and operates on the Google products you’ve coded for."

Execution and hosting of scripts takes place on the Google cloud, and basic support for event handling can run when users are offline.
 

Related Articles:

> Google Apps Goes Live In L.A.

> Google Apps Gets Google Groups

> L.A. Approves $7.25 Million Google Apps Contract

When asked about this, Matt said Googlebot had gotten smarter. He noted that Google began changing its messaging on the subject around 2007-2008 to stop mentioning javascript but to nofollow or do a redirect through a URL which is blocked through robots.txt.

Cutts noted that even on the onclick in javascript, the crawl and indexing team had submitted code so that it would respect a rel="nofollow". So you can put a rel="nofollow" attribute on a link that’s running in javascript, and more often than not, Google will make sure it doesn’t flow pagerank even if they’re executing the javascript.

Cutts did say, however, that if you want to be completely safe, to nofollow or link through things that are blocked.

Cutts revisited the topic in a recent upload to the Google Webmaster Central YouTube channel, in response to the following user question:

Now that Google can crawl JavaScript links, what is going to happen with all those paid links that were behind JavScript code? Will Google start penalizing them?

Matt reiterated that Google has gotten better at crawling javascript, and that URLs you put into javascript that you didn’t think would be crawled, might now possibly be crawled and indexed. He says the vast majority of people who do javascript links are ad networks and that Google handles these very well.

He then reiterated the use of nofollow, even within the javascript code, and the use of robots.txt to block out URls, and redirects.

"We find that the vast majority of paid links are typically not done with javascript," says Cutts. "They’re typically completely straight text links. so that’s where we’ve been spending the vast majority of our time."

Cutts says that Google is not currently penalizing paid javascript links, but they may start looking down the line. He says it hasn’t been a big issue at all in his experience though.

"If you’re selling text links, just make sure they don’t flow page rank and they don’t effect search engines," he says.

The better of two options might be a 2 PM to 5:30 PM session – see if your company will pay you to attend, and keep Friday evening to yourself, regardless.  But for everyone who’s going to be stuck at a desk or otherwise occupied, there’s also a 6 PM to 10 PM meeting.  Or, as Ben Lisbakken writes on the Google Code Blog, "You are welcome to stay for both."

Now, to move beyond scheduling and to the true meat of the matter.  Lisbakken states, "Google will be holding a developer hackathon to get you started on our JavaScript APIs.  We will be doing short introductions of the APIs and then breaking up into groups for coding and camaraderie.  There will be plenty of Google engineers present to ask questions and get help from."

This sounds like a good opportunity to collect business cards and email addresses.  And, if only because my lunchtime is just a few minutes away, we mustn’t forget about the aforementioned prizes and food.

RSVPs are required, but should be quick and easy to make.

(Hmm, my Firefox settings don’t allow replacing of the context menu via JavaScript, yet when I right-click such a shape I don’t get the FF-native menu… but only Google’s context menu. Does anyone know what’s happening?)

[Via the official Google Docs blog.]

Comments

This new test will put more pressure on the browsers to attempt to adhere to further standards with JavaScript. Hopefully they will all pass it soon with their push towards adopting web standards as they are written.

Hopefully we will be seeing IE8 and Firefox 3 released very soon. There are of course already versions of Firefox 3 available for download. However, not many of the extensions work on the beta browser yet. Until they do I don’t plan to fully switch over to Firefox 3. I would like to say that Firefox 3 renders pages incredibly fast and loads and runs very fast within Windows also. I’m awed by the new version.

Comments

First up, for those counting stats such as Darren Rowse, Robert Scoble and Techcrunch here are my numbers.

Google Reader is currently showing 3 different feeds that are all providing the same content, which you might think would be better served as a single number as appears in Feedburner.
Hopefully that will never, ever happen, as those split numbers are incredibly useful.

Why Are There Split Numbers?

It is vital to understand why split numbers occur to fully appreciate how useful this is.

There are 3 main ways people subscribe to your RSS feeds using Google Reader.

1. Using A Subscription Button

   My subscription buttons point to andybeard.eu/feed/ and this is the URL used by feed readers to collect my feed, even though that redirects to Feedburner using the Feedsmith plugin.

2. Autodiscovery

   This is that little orange icon that appears in your browser alongside the URL for RSS subscription. It is handled in different ways by various feed readers. Google Reader evaluates any redirect before you actually subscribe, thus you end up at feeds.feedburner.com/Exploring-Niche-Websites before making a decision. Historically speaking this isn’t a very good thing to happen, because as a feed publisher you "lose ownership" in some ways of those subscribers, as they are not subscribing to a page on your site that can be moved to somewhere else.

3. Javascript Bookmark

   This again uses the autodiscovery URL in the header of your blog, but for some reason, maybe my own oversight or mistake my autodiscovery URL is andybeard.eu/feed – notice this URL doesn’t have a trailing slash.

RSS Feed Subscription – Evaluation

This is where we gain a unique perspective on Feed Subscription

1. 580 people are subscribed to http://andybeard.eu/feed/ – those people used a subscription button to subscribe to my feed.
2. 196 people are subscribed to http://feeds.feedburner.com/Exploring-Niche-Websites – those are either very long-time subscribers from my time on blogspot, or they used RSS Autodiscovery to subscribe using Google Reader
3. 146 people are subscribed to http://andybeard.eu/feed – those people most likely used a javascript based subscription button in Firefox to subscribe to my feed.

Now if you are very smart, you could use this method to split test subscription methods, and rely on Feedburner for your aggregate data.

This isn’t an attempt to get on a list of SEO blogs or back-slapping.

In this post I am trying to highlight some unique information that no one has ever revealed before, and could be extremely useful.

This isn’t the same as tracking RSS subscriptions, in many ways it is better because the tracking only gives you a click on a button, and doesn’t give you anything from autodiscovery, losing half of the data.

I for one hope Google doesn’t "fix" this "problem" with aggregated feeds, because it could prove to be very useful.

Comments

Originally published at AndyBeard.EU

eBay’s platform extension gives its third-party developers a place to build and monetize new applications and put them anywhere from phones, blogs, televisions, Web sites and social networking platforms.

The new services include:

eBay Shopping Web Services: a suite of faster, more responsive APIs that makes searching on eBay up to 16 times faster and allows developers to easily create buying applications

eBay Bidding API: qualified developers can enable bidding on eBay from anywhere

eBay Client Alerts: lightweight, near real-time alerts about platform activity

New JavaScript and Flash Developer Centers: making it easier for JavaScript and Flash developers to access the eBay Web Services platform

New Production Call Plan: access to API calls in the production environment raised from 10,000 per month to 150,000 per month, allowing new developers to rapidly scale up their applications

"eBay’s developer community plays an important role as we pursue our mission to help people all over the world connect through commerce," said John Donahoe, president of eBay Marketplaces.

"The innovative applications being created by developers help entrepreneurial sellers use our platforms to grow their businesses, thereby expanding the economic opportunity to a wider audience than ever possible."

Other eBay companies also made announcements that extend their platform. They include:

PayPal introduced a new suite of APIs, including Mobile Checkout, which allows developers to integrate any mobile website with the PayPal checkout process.

Skype Extras: Skype Extras are plug-ins written by independent third-party developers that let users expand Skype functionality and enrich their Skype conversations

Shopping.com announced plans for a re-architected API that will be available in Q3 2007, which will have a new easy-to-use interface, detailed documentation, and tools for faster implementations.

First Jikto hits the web, and now this. JavaScript hijacking vulnerabilities in a number of popular web application frameworks, including ones from Google, Microsoft, and Yahoo, could be a threat until their libraries receive fixes.

Fortify Software posted an advisory about the JavaScript issue. Their description of the problem resembles what Jikto can accomplish. Here’s the Fortify summary:

The attack works by using a <script> tag to circumvent the Same Origin Policy enforced by Web browsers.

This is Hoffman’s discussion of Jikto, a JavaScript based web scanner that has the potential to silently install on a web browser and probe websites for cross-site scripting vulnerabilities:

As my Shmoocon presentation slides discuss, Jikto bypasses the "Same Origin Policy" by using a proxy website like the-cloak, proxydrop, Google Translate, etc.

Part of Hoffman’s source code for Jikto has been released on the Internet. Fortify took aim at several frameworks in their analysis of the possibility for a JavaScript threat to exploit them:

We analyzed 12 popular Ajax frameworks, including 4 server-integrated toolkits – Direct Web Remoting (DWR), Microsoft ASP.NET Ajax (a.k.a. Atlas), xajax and Google Web Toolkit (GWT) — and 8 purely client-side libraries — Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Yahoo! UI, Rico, and MochiKit. We determined that among them only DWR 2.0 implements mechanisms for preventing JavaScript Hijacking.

JavaScript transports data, making it possible that an unauthorized application could read the data going to a legitimate site. If that data includes confidential information, then a hijack can bring that data to another party.

The concept was demonstrated quite painfully to Google early in 2006. Jeremiah Grossman detailed a GMail flaw that could reveal someone’s GMail contact information. Google fixed that problem shortly thereafter.

Frameworks will be updated to resist JavaScript hijacking attempts. Ajax developers will want to verify their applications can resist potential break-ins and be aware of the ramifications of the problem:

The loophole in the Same Origin Policy is that it allows JavaScript from any website to be included and executed in the context of any other website. Even though a malicious site cannot directly examine any data loaded from a vulnerable site on the client, it can still take advantage of this loophole by setting up an environment that allows it to witness the execution of the JavaScript and any relevant side effects it may have. Since many Web 2.0 applications use JavaScript as a data transport mechanism, they are often vulnerable while traditional Web applications are not.

The same could be the case for CheckBox or DropDownList etc. but then you need to set the AutoPostback property to true.

It all works very much the same way from a user’s point of view – click or select and the page performs a postback.

However, in some cases you want to be able to do a postback from a custom JavaScript function that emulates the click of an e.g. LinkButton.

That is very simple to do so, but did you know that you also can send custom information via such a postback?

Example

The following LinkButton calls the server-side event handler OnSaveClick.

<asp:LinkButton runat="Server" ID="btnSave" Text="Save" OnClick="OnSaveClick" />

This is pretty much standard and no tricks have been used so far. Now we need the JavaScript method that forces the LinkButton to do a postback that calls the server-side method OnSaveClick.

<script type="text/javascript">

</script>

Notice that the function takes a parameter that it sends to the __doPostBack function. All we need to do now is to call the SaveWithParamter function from JavaScript.

SaveWithParameter("Hello world!");

Now the page performs a postback and we can now access the “Hello world!” string that we sent as a parameter from within the OnSaveClick event handler.

protected void OnSaveClick(object sender, EventArgs e)

}

What we just did was to perform a postback from a custom JavaScript function and send a parameter to the server-side event handler. It sounds a lot harder than it is, right?

In ASP.NET 2.0 you have to set the EnableEventValidation=”false” attribute in the page declaration or in web.config to make it work.

Comments

Tag:

Reddit | Furl

Bookmark WebProNews:

Mads Kristensen currently works as a Senior Developer at Traceworks located
in Copenhagen, Denmark. Mads graduated from Copenhagen Technical Academy with a multimedia degree in
2003, but has been a professional developer since 2000. His main focus is on ASP.NET but is responsible for Winforms, Windows- and
web services in his daily work as well. A true .NET developer with great passion for the simple solution.

http://www.madskristensen.dk/