Current features list:
* adding elements ( with automatic elements’ balancement )
* adding bonds ( single, double, triple, wedges, … )
* adding text ( useful for notes, … )
* lot of prepackaged structures ( amino acids, cycles, … )
* selected points rotation
* importing 2D .mol format files
* exporting .png images
* integrated periodic table

Next features list:
* quick buttons
* code refactoring
* exporting in .mol, .png format files
* arrows

Enjoy it, and help us to improve!

WBus stands for Web Bus and it is a simple all purpose method to get two or more clients (browsers) communicating using a web page as the communication channel.

These months I have been kept busy with the development, testing and debugging of the new version of Involutive’s browsergame: WarWide.

Note: It is available only for Italian people, but in a few months and English version will come to the light!

WarWide is a free strategic war multiplayer browsergame set in the real world with thousands opposing players, each of them fighting as the emperor of a group of (truly existing) cities and having, as primary goal, the growth of his Empire conquering enemy lands and establishing alliances with governors of nearby territories.

Watch SCREENSHOT gallery!

Lots of buildings, technologies and military units are available to give lots of variants and huge longevity to the game.

Each feature of the game is built to be more faithful to realty as possible.

From previous version lots of chances have been done:

• Completely rewritten game engine
• Completely rewritten game interface, now using JQuery
• Ships and sailing navigation (previous version had only land military units)
• Paths and areas visualization on the interactive map
• Inventory items that gives bonus to armies and players
• Army tasks stack to improve strategic operations
• Improved speed of geographic algorithms

Technical details:

• Operative System: Gentoo Linux ( 2.6.x )
• Game engine: PHP 5 (game engine), C (geographical algorithms)
• User interface: HTML, Javascript and Ajax
• Database: MySQL
• Map interface : Openlayers

Enjoy it!

P.S: I would thank the whole italian WarWide community for their good job in debugging and hinting.

Yesterday I was talking with my friend Davide about the announce of Yahoo’s and Google’s CAPTCHAs cracked and another funny and foolish idea, something similar to Javascript online massive social password cracking, came into my mind.

Articles report that breaking algorithms have a success rate from 10% to 35%,with an average of 1 crack for 5 attempts… too slow!

There should be a method to improve the success rate and here I would like to discuss a nice scenario that I hope nobody would implement ;-)

Base idea:

  There are three base components to get this idea working:

• spam-bots : bots used to spam blogs, forums and websites.
  • they submit CAPTCHA decoding requests to a server (named capster)
• capster is divided in :
  • a server that handles CAPTCHA decoding requests’ queue (named cpqueue)
  • a website of social interest ( :-) explained later )
• unaware users : clients of the website
  • they decodes CAPTCHAs displayed in website’s pages

The success of this approach depends on the topic of the website… We need something that could never become boring… Yes, I know you’re thinking about it! Yeah! Sex!!

So let be pornography the topic of the website.

As explained in the diagram, spam-bots send CAPTCHA decoding requests to cpqueue (part of capster) which forwards them to the website and here unaware users resolve them.

Every 5-6 photos or 2 videos the unaware user have to enter the code of a CAPTCHA displayed on a page to continue browsing. An horde of sizzling surfers will be happy to decode CAPTCHAs to quickly proceed to the next step of strip tease :-D

Probably the wish to see something more will obfuscate the consciousness of what they’re doing!

With a bit of luck we can obtain a success rate of 100% ;-) 

I heard that there’s some Virus which implement a similar approach using popup strip teases, but malware has always to fight to survive on a computer so there’s the constant risk that the cracking farm will decline day by day and then.. arent’ we in the Web(2/3/4).0 era or not ?

Thanks to:
Davide Scola that gave me some hints
Motocarota that gives a better look to my thoughts

While my new wonderful Sony Vaio TZ was overheating and fans seemed to get my laptop flying I had this unhealthy thought: what about a javascript online massive social password cracking ? ( first definition was only javascript password cracking but I needed to add some cooler keyword to gain more audience :-D )

Yes, I know there’s a very useful tool called djohn , but I haven’t a cluster ( only two laptops ) nor a botnet. So… how could I setup a network of computers to distribute cracking task ?

Social networks seem to be very popular today and people have a lot of computer idle to waste !! :-) However this article will not focus on the philosophical or social facet but only on the technical feasibility study of a Javascript DES cypher implementation and its performance running on modern browsers ( Mozilla Firefox, Opera and Konqueror )

A simple first implementation came in my mind:

• DES and Triple DES encrypted password cracking
• Brute force/incremental method : all possible character combinations as passwords
• Password’s space divided in work packets by a web server that coordinates the effort among the clients ( browsers )

Other cracking methods, such as wordlist, are very much faster than brute force, but more complex, than password’s space subdivision, to coordinate via AJAX.
I had a quick look to JTR source to understand its cracking procedure, so I decided to port its Triple DES cipher implementation to javascript. Writing this article I found this one that seems to be a bit faster than mine.

Had you ever benchmarked John The Ripper on your machine? Here are results of the 3DES on my Sony Vaio TZ ( Intel Core 2 – ULV U7600 1.20ghz ) :

~# john –test

Benchmarking: Traditional DES [128/128 BS SSE2]… DONE
Many salts: 1019K c/s real, 1019K c/s virtual
Only one salt: 815539 c/s real, 839032 c/s virtual

Wow! 1019K cracks per second!!

How many days do we need, at most, to crack a weak 8 bytes ASCII password with a brute force attack? ( Note: read about password strength )

• assuming to know that it is 8 byte ASCII password
• 64^8 : are the permutations with repetitions
• 64^8 / ( 1019 * 10^3 ) = 276226669 secs = 3197 days needed to cover all the key space

Having a wide set of computers, a lan with some good machine, the cracking time will fly down quickly.

Ok, these are the results of a C compiled Triple DES. An xyssl library based solution gave me a proof of the validity of JTR results.

Clearly we all know that interpreted languages are slower than compiled ones… so I was expecting that an interpreted implementation of the algorithm could be 30, 50, 100 times slower …

No! it’s from 2000 to 4000 times slower !!!

Here are my browsers’ tests ( on Gentoo with an Intel Core 2 – ULV U7600 1.20ghz ) :

• Mozilla Firefox 2.0.12 : ~250 cracks per second
• Mozilla Firefox 3.0 beta3 : ~250 cracks per second ( … I was expecting better results than 2.0 version … )
• Konqueror 4.0 : ~500 cracks per second ( I love it !! )
• Opera 9.25 : ~370 cracks per second
• Safar 3 : results should be similar to Konqueror, because both use Webkit
• Internet Explorer : data unavailable

Test Javascript 3DES performances on your browser and please comment this post to report them (including your hardware, CPU at least)

Then I tested mcrypt PHP implementation ( with the code below ) and results weren’t better : ~1000 cracks per second.

$ts_start = gettimeofday();while(1) {
  $ts_end = gettimeofday();
  if(($ts_end["sec"] - $ts_start["sec"] == 1) && $ts_end["usec"] > $ts_start["usec"]) break;
  @mcrypt_encrypt(MCRYPT_3DES, "cialfklweflkwnelfkw", "Prova", MCRYPT_MODE_ECB);
  $cnt++;
}
echo "Cracks per second: ".$cnt++;

Another test to compare web browser is a simple addition. The C compiled version performs up to 100000000 additions per second and here are results of the Javascript implementation on browsers :

• Firefox 2.0.12 : ~33000 additions per second
• Firefox 3.0 beta3 : ~96000 additions per second ( fortunately, here it’s faster than 2.0.x )
• Konqueror 4.0 : ~130000 additions per second
• Opera 9.25 : 153000 ( good! )

Conclusion…

Performances of Javascript engines are still not good enough and I think this could be a very hard limit to Web2.0 that should be overtaken as soon as possible.

Url: http://ardoino.com/game-be-quick-or-be-dead/
Play now!!

The plot is based on comics written by Motocarota : a powerful wizard has to kill much kobolds as possible casting fireballs against them.

To shot fireballs to enemies you have to write its name in the textbox below the game area and press enter… a nice way to test your typewriting ability, isn’t it?.

I used only few hours to create the game. At the beginning I opted to use 2D CANVAS tag as rendering system (supported by Mozilla Firefox, Opera and Safari) and explorer-canvas for VML, Vector Markup Language (supported by Internet Explorer).

In a few minutes, bored by IE7 incomptaibility with standards, I decided to try Dojo that should have a wide crossbrowser compatibility, dojo.gfx library included. This framework supports Canvas, SVG and VML giving simple API for 2D drawing.

In a few time I had the game engine and once obtained spirtes Be Quick or Be Dead was complete.

The only disavantage of Dojo usage in BQOBD development was the first time loading slowness, but Firefox cache has worked fine for next page accesses.

Creation and drawing on the 2D surface is very simple :

• ctx = dojox.gfx.createSurface creates a 2D surface
• images, text, rectangles, … are objects that can be drawed on that surface (i.e. img = ctx.createImage(); )
• shapes could be modified on the fly by setShape method (i.e. img.setShape(newShape); )

Play now!!

PHP Wget Sitemap Generator class takes advantage of wget to get a local mirror of the target site and then generates the url list for the sitemap via local directory listing.
Wget is highly configurable so read the man page of best options to use (replace exec function argument).

The code:

Version: 0.2

<?php

// PHP Wget Sitemap generator v0.2
// (c) 2008 by Paolo Ardoino < paolo.ardoino@gmail.com >

class PHPWgetSitemap {
    public $opts = array("sitemap_file" => "sitemap.xml", "website_url" => "");
    public $siteamp = array();

    function __construct() {
        echo "PHP Wget Sitemap generator v0.2\t(c) 2008 by Paolo Ardoino < paolo.ardoino@gmail.com >\n";
    }

    function setSitemapFile($sitemap_file) {
        $this->opts["sitemap_file"] = $sitemap_file;
    }

    function setWebsiteUrl($website_url) {
        $this->opts["website_url"] = $website_url;
    }

    function mirror() {
        if($this->opts["website_url"] != "") {
            echo "Wget: fetching ‘".$this->opts["website_url"]."’ website\n";
            exec("wget -m ".$this->opts["website_url"]." 2> wget.log");
        }
    }

    function generate() {
        if($this->opts["website_url"] != "") {
            $website_dir = substr($this->opts["website_url"], 7);
            if($website_dir != "") {
                echo "PHPWgetSitemap: scanning ‘".$website_dir."’ for sitemap generation\n";
                $this->sitemap = $this->_scan($website_dir);
                $this->ssave();
            }
        }
    }

    function _scan($dir) {
        $sitemap = array();
        $FILES_EXCLUDE = array(".", "..", "index.php", "index.html", "index.htm");
       
        if($dir != "") {
            if (is_dir($dir)) {
                if ($handle = opendir($dir)) {
                    chdir($dir);
                    $sitemap[] = $dir."/";
                    while (false !== ($file = readdir($handle))) {
                        if (!in_array($file, $FILES_EXCLUDE)) {
                            if(is_dir($file)) {
                                $arr = $this->_scan($file);
                                foreach ($arr as $value) {
                                    $sitemap[] = $dir."/".$value;
                                }
                            } else {
                                $sitemap[] = $dir."/".$file;
                            }
                        }
                     }
                    chdir("../");
                }
                closedir($handle);
            }
        }
        return $sitemap;
    }

    function ssave() {
        $sitemap_file = $this->opts["sitemap_file"];
        if($sitemap_file != "") {
            if($fp = fopen($sitemap_file, "w+")) {
                $out = ‘<?xml version="1.0" encoding="UTF-8"?>
                    <urlset
                    xmlns="http://www.google.com/schemas/sitemap/0.84"
                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    xsi:schemaLocation="http://www.google.com/schemas/sitemap/0.84
                    http://www.google.com/schemas/sitemap/0.84/sitemap.xsd">’;
                for($i = 0, $y = sizeof($this->sitemap); $i < $y; $i++) {
                    $out .= "<url>\n\t<loc>http://".$this->sitemap[$i]."</loc>\n\t<priority>0.500</priority>\n</url>\n";
                }
                $out .= ‘</urlset>’;
                fputs($fp, $out);
                fclose($fp);
                echo "Sitemap has been written to ‘".$sitemap_file."’.\n";
            } else {
                echo "Error: cannot save ‘".$sitemap_file."’ file.\n";
            }
        }
    }
   
}

$n = new PHPWgetSitemap();
$n->setWebsiteUrl("http://ardoino.com");
$n->mirror();
$n->generate();
?>
 

Download this code: phpwgetsitemap.txt

Disclaimer : this is only a hack and you should not use this idea in your site because search engines may not like it :P … but hack is always a good thing ;)

Google bot indexes relevant content of each page of your website, and so each word used in your texts could be a valid keyword to be found in search engine’s results. This simply means that producing more relevant content chances to be found grow.

Your site’s language is only your main language? What would happen if you translate your pages in more than one language? Simple, you’ll get more daily visitors!

Using Google language tools you could translate all site’s content ( using an automated script I suggest ;) ) … but as we know that translations are imperfect and often cryptic for common humans.

So… where’s the hack?

Simple ! A simple script at the top of pages that performs this controls:

• if useragent connecting to a page is Googlebot ( or other search engine spider bot ), we display translated text ( with Google Translator )
• otherwise main language content will be displayed

So, search engines will index pages in your main languageand in all languages generated by Google Translatorand your website will appear in search engine results for a bigger set of keywords but when a visitor try to access to a page containing imperfect and no good translations he will be redirected to the page in the main language.

Create a simple test site on a free hosting service to believe ;)