Social Icons

Pages

Showing posts with label Layered Security. Show all posts
Showing posts with label Layered Security. Show all posts

Monday, 9 December 2013

Problems Adding / Editing The HTML And Text Gadgets

We're seeing a few reports, in Blogger Help Forum: Something Is Broken, mentioning problems adding or updating the HTML and Text gadgets. The most common symptom is very simple.
When I try to update the gadget, all that I see is
javascript:void(0);
In this case, we have to first explain that "javascript:void(0);" is not the problem - it's simply a symptom of the problem.

Once we explore the problem itself, we see various possible causes.

The base cause for problems with the HTML / Text gadget is simple - the script which processes gadget updates provides no diagnostics when detecting errors.

If you were to update a post, or the template, with bad HTML, you'd see some error message, indicating that your changes are bad.

Both Post Editor and Template Editor provide some diagnostics, when errors are detected. With the HTML / Text Gadget, the script issues no error messages, it simply stops.

Instead of "javascript:void(0);" displaying for a fraction of a second, as the update is saved and the window closes, the blog owner is left looking at
javascript:void(0);
until he hits "Cancel" in confusion.

The HTML / Text gadget has been observed to have various problems, which prevent changes from being properly saved.
  • Bad HTML, when accidentally in HTML mode.
  • HTML / JavaScript code which contains line breaks in the wrong places.
  • Bad HTML code, when intentionally entering an HTML gadget.
  • Gadgets with blank titles.
  • Layered security, which blocks the gadget update scripts from running.
  • Trying to use a non supported browser version.


Blog owners who are not observant, when updating the gadget, may accidentally be in HTML mode. Rich text, containing HTML significant characters, will be a problem.

HTML / JavaScript code is sensitive to line breaks in the wrong places in the code. Blog owners, accidentally or intentionally inserting line breaks, can cause a problem.

HTML / JavaScript code, in general, is syntax sensitive. Bad code will always be a problem.

Gadgets with blank titles will cause a problem, when using some browsers. If a gadget with a blank title is specifically required, it may be possible to use a null title, instead.
<!-- -->

Inappropriate use of layered security may block cookies or scripts, and prevent the gadget from updating.

The gadget, like every other Blogger feature, must be updated to support newer browser versions. It will likewise be updated periodically, to remove support for older browser versions. Non supported browser versions will frequently cause problems.

Some of these error scenarios should be more clearly identified, by the script - but not all can be identified. Attempting to save a gadget with a blank title, for instance, should produce a stern warning
Blank titles are not accepted.
Unfortunately, HTML syntax errors generally can't be consistently diagnosed, with any detail.

The best solution here is for the blog owners to be aware that the gadget operates this way, when being updated. Some cautious effort must be made, when updating the gadget.

It's possible that problems updating the gadget, like many Blogger problems in general, can be best diagnosed using affinity testing, and / or differential testing.

>> Top

Friday, 13 September 2013

Making Blogger Run Properly, On Our Computers

One of the biggest problems with Blogger, right now, is how we allow Blogger to run, on our computers.

We protect our computers from threats - known and unknown - using layered security. Right now, some of us are protecting ourselves too carefully - and we are seeing the results, with problems in Blogger.

The Blogger application, which we use to maintain and publish our blogs, runs on our computers.

We get Blogger program code from the Blogger servers, and we run the Blogger code on our computers. The Blogger code includes two essential components - cookies (settings, which control how the programs run), and scripts (the programs themselves).

If we want to run the Blogger code on our computers, we have to let Blogger and Google load cookies, and run scripts, on our computers.

If we can trust Blogger to host our blogs - on their computers, we need to trust them to run their code - on our computers. We need to configure our cookie and script filters, on our computers and networks, to trust Blogger and Google.
  • In our browsers.
  • On our computers.
  • On our networks.
Cookie and script filters are found in many places - and all filters must be configured, properly. Click here for instructions on configuring your browser filters.

If Blogger Engineering is to spend their time, developing and maintaining Blogger, we have to support their efforts. We have to setup our computers properly - so Blogger will run, properly.

>> Top

Sunday, 10 March 2013

What Are The Mysterious Turning Gears?

This is a question, occasionally seen in Blogger Help Forum: Something Is Broken.
I cannot view some blogs - all that I see are gears, turning endlessly. What is going on, here?

The gears are animation, displayed by Blogger, while a dynamic template and blog content loads on the computer being used. Generally, the gears will play for a few seconds, then the blog will be seen. For an example, check out my Musings blog.

Sometimes, all that you will see are the gears, endlessly turning - waiting for the templates and blog content to download.

The dynamic templates, used by some Blogger blogs, represent an innovative approach to providing web content.

Normal web content, provided in Blogger blogs which use Classic, Designer, and Layout class templates, consists of comments, gadgets, posts, and templates, arranged together in pages (dynamic and static).

Blogs which use Classic (HTML only) templates arranges everything when the blog is maintained. Blogs which use Designer / Layout templates (HTML / XML) arrange the content when the blog is maintained - then build the individual pages when the blog is read by each viewer, dynamically. For all 3 classes of templates, the content is served from Blogger / Google servers, in individual display pages.

The Dynamic class of Blogger templates take the concept of dynamic publishing to another level. Dynamic class templates load a significant amount of script code (the template) directly to each client computer. Instead of reading the pages of blog content from a Blogger / Google blog server, a dynamic template script, running on the client computer, reads the published blog feeds from a newsfeed server - then turns the feed content into a display.

A Dynamic template is a specialised Newsfeed Reader, similar to the dashboard Reading List, or to Google Reader.

By offloading a large amount of the publishing process to the client computer, and by using the blog comments and posts feeds, Blogger provides blogs which can be viewed in a number of different ways - selectable by each individual viewer, and at the convenience of the viewer. This selectability is not without cost, unfortunately.
  • The templates require a significant amount of script code.
  • The templates require the blog comments and posts newsfeeds.

For most blogs using a dynamic template, and being viewed on most computers, the "turning gears" icon plays briefly, while the template code, and the blog comments and posts newsfeeds, are downloaded. As soon as downloaded, the content is assembled into a display, and the viewer can view the blog. This does not happen, in all cases.
If the client computer has a slow Internet connection, the viewer may watch the turning gears for more than a few seconds. If the computer filters scripts aggressively, or if the blog does not publish a full newsfeed, the gears play, endlessly, while the computer waits for the scripts and newsfeeds to finish downloading. In the latter case, the viewer can only find another blog to view.

If you encounter one or two Blogger blogs playing the turning gears, endlessly, then you are experiencing the reality of dynamic templates - some blog owners do not realise that they have broken their blogs. If you encounter a large number of Blogger blogs doing this, then you might want to check the filters, on your computer - including, but not only, the browser cookie and script filters.

>> Top

Monday, 7 January 2013

We Are At The Mercy Of Every Anti-Malware Protection Program Imaginable

We see reports, from time to time, in Blogger Help Forum: Something Is Broken, about blogs which people can't read, from their computers.
One of my readers claims that I have a virus on my blog. He provided the following information:
AVG anti-virus detected the following threat on the site:
File Name: www.mydomain.com/favicon.ico

Threatname: Exploit Black Hole Exploit Kit
How do I fix this?

Similar to the many reports that we process here, about spurious spam classification, the above report is frequently determined to be a false positive. An anti-virus alert, even if a false positive, is generally not as simple to resolve as a spurious Blogger spam classification, though.

One of the frustrating problems with false malware alerts is that they come from so many different anti-malware products.

I've contributed my opinion about computers, and the suggestion that no two privately owned computers are identical, many times. One way which many computers vary is the complement of security software, which is chosen by each different computer owner.

At any time, any different anti-malware product may decide that some component of your blog is unsafe.
  • Maybe, a single file mentioned in your blog code (as above, "favicon.ico") is suspect.
  • Maybe, content hosted by "blogspot.com" is unsafe.
  • The code may be an accessory that we added, intentionally.
  • The code may be content in another blog - hosted by your blog in a bloglist, a linklist, or maybe in the Reading List on your dashboard.
In either case, you (or your reader) won't be allowed to view the blog - or may be allowed to view the blog, but given a stern warning which very few chose to accept.

Like many problems with layered security, any malware detection can come from
  • A native browser filter.
  • A filter in a browser add-on.
  • A filter installed on the computer.
  • A filter in a network appliance.

Listen to your computer. some time. Your anti-virus protection may update automatically - and may audibly announce the update. On a typical day, I hear the Avast client on my several computers announce an update, several times - and I am not (contrary to some misconceptions) seated in front of my computer on a 24 x 7 basis.

Avast (my personally and professionally recommended choice, to many people) is only one of dozens of various anti-malware products which receives automatic updates, when the host computer is online. Any one of these products may be updated, at any time -and somebody's access to your blog (or my blog) becomes blocked.

If you get a message from one of your would be readers
I can't view your blog!
this could be someone reporting that your blog just went offline, for one reason or another - or it can be someone just discovering that the anti-malware program, on his computer, has decided that BlogSpot hosted content is unsafe. In either case, there is not a lot that you can do, except wait it out - and concentrate on the readers who can access your blog.

>> Top

Thursday, 27 December 2012

Would Be Blog Owners Report Inability To Create A Blog

We are currently seeing frustration, in Blogger Help Forum: Something Is Broken, about new blog creation.

Would be new blog owners have various concerns
I can't create a blog - the "Create" button is grey (inoperative)!
or
It keeps saying
Verifying availability
when I enter a blog name!!
or even
It said
This blog address is available.
until I hit "Create blog!" - then it changed to
Sorry, this blog address is not available.

Each of these problem reports - and others - may come from people who don't read the instructions, for using the wizard. Alternately, some folks may be complaining about yet one more case of over done layered security.

The most obvious problems, in the blog creation process, come from people who don't understand how to use the "Create a blog" wizard.

Not every would be blog owner understands that 3 things must be done, to make the "Create blog!" button operative - and all 4 must be done, before the blog is actually created.
  1. Enter a Title for the blog.
  2. Enter an acceptable and available Name for the blog.
  3. Select a Template for the blog.
  4. Hit "Create blog!", with "This blog address is available." displayed.

When you choose a Name (aka "address" or "URL"), enter your choice properly.
  • Only enter the "xxxxxxx" part of "xxxxxxx.blogspot.com".
  • Only use lower case alphabetic characters ("a" - "z"), numeric characters ("0" - "9"), and dashes ("-").
  • Do not use a trailing dash (You cannot publish "xxxxxxx- . blogspot . com").

Besides the syntax issues when entering a blog name (URL), there is the unfortunate issue of competition in the creation process. Blog owners who are anxiously creating a new blog, based upon a current event - maybe a popular movie star, or an important political campaign - will be dismayed to see
Sorry, this blog address is not available.

If you are competing in real time, with other would be blog owners, for the name of your choice - and you take too long between Steps #1 - #3, and Step #4 - you may still see
Sorry, this blog address is not available.

Many people want to setup a blog, based on that blog name. Some may see the bad news, repeatedly, leading to one frequently seen complaint.
All the good addresses are taken!
And sometimes, to a more imaginative suggestion.
How do I get Blogger to re issue me the dormant address?
The latter question is one of futility.

Finally, the anxious blog owner may see
Checking address availability
for some time - possibly forever - if an overly ambitious cookie / script filter, or an intrusive security add-on is installed in the browser. In this case, the magical advice to
Clear cache and cookies!
or
Try a different browser!!
will be effective - though absent any attempt to diagnose the problem, one may not ever know what actual underlying problem may have caused the plaintive cry
I can't create my blog!

>> Top

Sunday, 23 December 2012

Some Blog Owners Reporting The Template Designer Changes Do Not Update On Their Blogs

For several weeks, we're been seeing various reports in Blogger Help Forum: Something Is Broken, mentioning problems with template updates, being made using the Template Designer wizard.

The reports are not so widespread to indicate a complete malfunction - but neither can we dismiss the problem, as being unique to one browser, one template type, or one particular update pattern.

It's likely that we are looking at a number of problems, aggregated and compounded, into one common symptom.
I cannot Save changes in Template Designer.
With a problem report like this, some examining of the details may be appropriate.

The Template Designer wizard, which is a component in the Blogger Dashboard, is a complex and sophisticated collection of menus and utilities, which runs on the blog owners computers.

Like most Blogger code, the Template Designer is subject to the effects of other programs, and various security settings - which may be installed or set on each individual computer, with or without the understanding of the blog owner and / or computer owner. In some cases, the blog owner and computer owner may be different people.

If you are seeing a problem with the Template Designer, when trying to update the layout on your blog, there are several tests which you can make, which may help to isolate the problem.
  • Try making the same updates, using another computer.
  • Try making the same updates, using another browser on your current computer.
  • Try setting up a new blog, with the same template, and make the same updates to the new blog.
If you're able to make one or more of the above alternate updates, that will help to eliminate some, or many, alternate suspects, as the cause of your problem. If other people are reporting this problem, their results from the above tests may or may not correspond with yours - because their base problem may differ from yours.

Right now, we're seeing seven different causes of these problems.
  1. Changes made by Blogger Engineering, to support new browser versions and browser updates, and to provide new template features.
  2. Changes inherent in new browser versions, made by the browser vendors.
  3. Third party browser add-ons, installed by the owners of the various computers.
  4. Security settings, inherent in new browser versions and third party add-ons.
  5. The cumulative effects of various template tweaks, both made using "Edit HTML" and the Template Designer itself.
  6. Unrealistic expectations of blog owners, about effects of Template Designer settings, against all templates provided by Blogger.
  7. Unrealistic expectations of blog owners, about effects of Template Designer settings, against templates not provided by Blogger.
Of these possible causes, only #1 (and possibly #2 and #6) are the sole responsibility of Blogger Engineering. The blog owners (and computer owners) must assume some partial responsibility for #2 - and sole responsibility for #3, #4, and #5. The blog owner, and the developer of any custom, third party template, must jointly assume responsibility for #7.

Recently, Blogger Support acknowledged the problem, in part.
Some users have reported that the Apply to Blog button in the Template Designer is non-functional for some Dynamic View templates.
We also have a Rollup Discussion, in Blogger Help Forum: Something Is Broken, where individual details are being provided by various blog owners.

Right now, we're starting to suspect that some "problems" are actually caused by the blog owners, who are simply not aware that not all changes made, using the Template Designer (or the Layout or Template "Edit HTML" wizards), are designed to update all templates used in viewing our blogs.

>> Top

Sunday, 2 December 2012

Stats And The "Don't track your own pageviews" Option On Mobile Computers

As mobile computing becomes more popular, we're starting to see questions about use of the Blogger dashboard on mobile computers (iPhone / iPod, PDA, smart phone), in Blogger Help Forum: Something Is Broken. Most recently, we're seeing people trying to use Stats, and the "Don't track my own pageviews" option, with Blogger on mobile computers.

Problems with Stats and the "Don't track ..." option are not unknown, in the past. We've helped many blog owners with this setting, which is sensitive to cookie and script filtering in general - and to "third party cookies" in particular. "Third party cookies" may be filtered in any of several places, any which will interfere with "Don't track ...".

The "Don't track ..." option, when seen as a problem with "full size" computers (desktop, laptop / notebook), may involve any of various "layered security" settings. In general "full size" computers use a somewhat standard software infrastructure. While any of several operating systems (Apple / Macintosh, Chrome, Linux, Microsoft Windows), and various browsers (Chrome, Firefox, Internet Explorer, Opera, Safari) make use of Blogger an occasional challenge on "full size" computers, there is some common features between the various operating systems and browsers.

With the various "operating systems" and browsers on mobile computers, we're seeing more discrepancies in features offered. In particular, not all "mobile computers" have explicit settings to allow / disallow "third party cookies" - or even cookies and scripts, in general. If these settings are not present, it's likely that these computers do not support such details as "third party cookies".

Without the availability of "third party cookies", Blogger can't support the "Don't track ..." option. Here, I'll note that this option is specific to each individual browser, on each individual computer. One must set the option - and browse the specific Blogger blog - using the same browser, for the option to work. This is not an option that can be set on a per user basis, and apply to all browsers used by a specific user.

>> Top

Thursday, 22 November 2012

Use A Well Protected Browser, To Block Redirecting From Misbehaving Code And Gadgets

Regularly, in Blogger Help Forum: Something Is Broken, we advise people about problem code or gadgets in their blogs.

Generally, this follows reports by blog owners, that their readers are being redirected to unexpected and unwanted blogs and websites, from their blogs. Sometimes, we get the reply
I can't remove the code. Every time I login to Blogger, I am redirected, just as my readers are being treated!

When we see the latter complaint, we recognise yet one more blog owner who does not know how to properly protect himself, from malicious code and websites. Most people, who know about Layered Security, know that proper browser security is an essential complement to a properly chosen and maintained anti malware filter.

Many people, who care about browser based security, use Firefox with NoScript.

This combination provides Unix level security, "deny by default, permit by exception". Simply install NoScript as an add-on, to Firefox, to get started. Alternately, you may use Chrome with ScriptSafe, or Opera with NotScripts.

When using your browser with a script filter, there will be specific Blogger / Google websites which you should trust, and others which you should not trust.

Every time you surf to a different website - and decide that the owners of the website, which you are now viewing, have your best interests in mind - configure NoScript to allow that website, to display properly on your computer. When you find that a trusted host website does not display properly, examine the NoScript taskbar and the list of websites used by the host website. Look at the NoScript Options menu, carefully. Allow specific websites which you trust, and Forbid all other websites which you do not trust.

Deciding which websites to trust, based on their presence in the NoScript Options menu, will be a learning experience for a while. For some host website pages, which use a large number of unfamiliar websites, you may have to carefully select to "Temporarily allow all this page" - or you can "Temporarily allow" each single website, one by one, until the host website page displays properly.

When you decide to (permanently) "Allow" any website, that website will be "Allowed" on all other host websites where you may surf. Conversely, any website which you never select to "Allow" - such as the problem website which is providing the misbehaving code - will never execute on your computer again. This will prevent redirection on your computer, allow you to safely use the Blogger dashboard, and edit or remove any dodgy code which may be part of your blog.

After removing any dodgy code from your blog, always clear cache and restart Firefox, to test the effects of your editing.

>> Top

Friday, 12 October 2012

Blogger Blogs Lack The Navbar, Though Not Removed By The Owner

Recently, a few Blogger blog owners are looking at their blogs and wondering
Where is my Navbar?
or
Why don't I have a "Sign In" ("Sign Out") link, at the top of the page?


When investigating further, they may discover that none of the blogs, that they view, shows the Navbar. And, they did not intentionally make any template changes, to their blog, to hide the navbar.

Many of these people, later investigating the problem in Blogger Help, learn that their browser, or another anti malware product, is blocking the navbar as suspicious code. This is another example of improperly configured layered security, planned to protect our computers.

If you are observing the lack of the navbar on your computer, and you request help in Blogger Help, please help us to help you better, and provide details.
  • What browser (name and version - and precision matters) are you using?
  • What add-ons are installed, in the browser (completeness matters)?
  • What anti malware product(s) do you use, on your computer (again, completeness matters)?
If we can get an idea of what components are involved in this problem, maybe we can isolate the problem, itself. Please, be complete - and be precise.

>> Top