(Thanks to Mere Mortal Software for the badge icon)

Needless to say this isn’t a security flaw and isn’t even new; see the O’Reilly Mac DevCenter Blog from over a year ago.

This isn’t a security problem because the video from the iSight camera never leaves your local machine. In fact the data is just display inside the web page and discarded. For proof of this you can use the network bandwidth monitor feature of Mac OS X’s Activity Monitor. Open a page with a “trick” iSight movie and watch the “Data Sent/sec” field: it should not increase due to the iSight video. Take a look at this video of mine: QuartzComposer.mp4, the data sent varies between 0 and 180 bytes per second. For contrast take a look at a similar video but this time using Flash webcam software to transmit video to stickam.com (you know, the shoes on head place): Stickam.mp4. This video shows that stickam.com is receiving around 30KB a second. Yes, I need a shave.

While this isn’t absolute proof that the iSight trick isn’t up to no good it is a good indicator that things are fine. There are other methods, for example using a healthily paranoid outgoing firewall like Little Snitch.

To put your mind at rest, here’s a quick screencast tutorial (iSightTrickScreencast.mp4, 3.3MB MP4) on how to create a QuickTime movie that will embed video from your iSight using Quartz Composer. Note at no point do I add any Quartz Composer nodes to transmit this video data anywhere. Try it yourself.

Here are the files created during the screencast: My Composition.qtz and My Composition.mov

You can use the following snippet of HTML to embed the video into a web page (code stolen from the O’Reilly Mac DevCenter Blog):

One interesting thing about this is that WebKit based browsers (e.g. Safari and OmniWeb amongst others) used to be able to display these kinds of Quartz Composer movies directly. Now when trying to load a iSight using Quartz Composer file in a browser you’ll see this error message: UnsafeComposition.png. You can try it yourself by opening the Quartz Composer file created for the webcast. Quartz Composer files that don’t use the iSight will load as seen here: BasicComposition.mp4. So what’s going on here? Well I think Apple is rightfully being extremely cautious. Quartz Composer files and specifically Quartz Composer based QuickTime movies have had security advisories issues against them: http://www.frsirt.com/english/advisories/2005/0531, http://docs.info.apple.com/article.html?artnum=301714 with more detailed information: http://remahl.se/david/vuln/018/ (currently Google cached due to problems with their server). However the information that could have been leaked is limited to small textual information (produced by other Quartz Composer nodes) and not the video data itself.

Update From crazy to ridiculous. Make is publishing a hopefully humorous article explaining how to build a shield for your iSight.

One of the most controversial “features” of the program is the fact that the main window actually smokes when a disc is being burnt. Poking inside the bundle of Disco.app I came across Smoke.framework with what looks like full headers included.

Ignoring the dangers of passive smoking for a moment I decided it would be fun to try and use the smoke effect in a test application.

And here’s a quick movie to illustrate the pretty smoke animation:

SecondHandSmoke.mp4

Now you too can add the smoke effect to your own applications. Download the public beta of Disco (version 1.0b3 according to the Finders “Get Info” window). Be quick. I’d imagine that the next release of Disco wont include headers for the framework. Move the application to your /Applications folder. Then download my test application here: SecondHandSmoke.zip.

You should be able to compile and run “SecondHandSmoke” (it will warn that it cannot find OSXHIGuidelines.pdf – but do like the Disco authors did and ignore that warning). If your hardware is capable enough you should be able to see the smoke effect rising from the top of the window. (It might take 10 to 20 seconds for the smoke to appear).

You can change the smoke parameters by using the smoke settings window (dialog? pane? view?) within Disco. Then just copy Disco’s prefs (com.discoapp.Disco.plist) to SecondHandSmoke’s prefs (com.example.SecondHandSmoke.plist).

Feel free to add smoke to your own applications, Brent – NNW users expect the main window to Smoke now. Dan, don’t feel left behind, Sandvox needs to smoke. All the cool kids are doing it. Peer pressure is a bitch.

Update Predictably the guys at DiscoApp have removed the headers from the framework. Of course they refrained from rev-ing the version number of the beta. So now there are two 1.0b3 versions of DiscoApp in the wild. 1.0b3 (with headers) and 1.0b3 (without). Bad developer. No cookie.

Of course removing the headers does nothing to stop you from using class-dump to generate your own headers (and pretty cool headers they are – look at all those CIFilter subclasses). I’ve just uploaded an amended project that includes a class-dumped header. You’ll need to install Disco 1.0b3 (sans headers) into /Applications as before.

Update 2 Just had a nice AIM conversation with Austin Sarner, one of the authors of Disco, and he seems to be quite amused by this little hack. Although I really don’t like the use of the smoke effect in Disco, I completely support their attempts to innovate.

Update 3 I took 15 minutes to hack the Smoke framework into a SIMBL plugin so that any application can have the smoke effect (why wait for developers to innovate?). I’m not distributing this project as it requires a modification of the Smoke framework itself, but here’s a movie: HolySmokesMovie.mp4

Update 4 Reduce size of movie to 640×480 to keep people with smaller screens happy.

Update 5 My code no longer works. For an updated description of how to get the smoke working see: dev.lipidity.com

I just won Ironcoder. I now join the esteemed ranks previous winners: Lucas Eckels, Gus Mueller and Mark Dalyrmple.

A big thank-you to Mark for hosting and judging Ironcoder. As we’ve learnt over the previous contests, judging Ironcoder is a tough and time consuming job (although Lucas had it easy). And coming up with interesting APIs and themes isn’t easy either. Now I have been “rewarded” with this task for the next Ironcoder.

I’ll post more about my winning entry “spacecam” later. I was actually quite surprised I won after seeing some of the other entries, all of which were rather cool.

Ironcoder started off as pet project of the #macsb irc channel (itself an offshoot of the “Mac Small Business Mailing List“). And as such many of the usual suspects from #macsb are amongst the entrants. However I get a big kick out of all the Ironcoder entries that were from people I’ve never heard of and have never seen in irc.

Jeff Smykil from Ars Technica has taken an interest in Ironcoder and has posted an article on Friday announcing it. It is good to see outside interest in Ironcoder and I hope this trend continues.

If Cory decides not to accept the donation for the procedure I will find a suitable charity to donate the proceeds towards.

I’ve guesstimated, the cost to be $1000 for a single tattoo, based on information found on faqs.org, but if anyone knows how much the removal will cost in the L.A. area please let me know.

In the slight chance this campaign raises enough money but Cory refuses to part with his Apple Logo I will donate the money to a worthy charity. Suggestions welcome in comments.

Links: Dropcash campaign

Update: So far the campaign has collected $0 / $1000. At this rate we’ll have that procedure funded in no time! Just hang on Cory, we’re here for you.

More linke: http://zacwhite.com/blog/?p=36

Things that make the install process suck include:

• Uses an installer but only installs an Application that could have easily been installed by hand via a drag & drop install
• Uses an installer, but the installer forces you to install to /Applications when you’d prefer to install to another location.
• Uses a third party Installer that cannot be opened via Pacifist or installed using the command line “installer” command
• Uses a own custom Installer (see above – but worse)
• Software dials home and/or doesn’t inform the the user that it dials home and/or dialing home cannot be switched off in the application’s preferences
• Software is packaged in a disk image that has been redundantly encoded and/or compressed in another archive (e.g. .dmg.zip/.dmg.hqx)
• Installer refuses to run if any other applications are running and/or automatically quits other applications
• Installer forces you to reboot (come on guys this is Mac OS X not Windows)
• Software is badly versioned (e.g. you download version 1.1 of a program but the Info.plist file says it is version 1.0)
• Software includes a version number in its filename (or the name of the enclosing directory)

disclabel

by Smile On My Mac

Why? 1) Uses an installer but only seems to install an Application. 2) Cannot install anywhere other than /Applications. 3) Uses a non-standard installer (Filestorm).

Mail Factory

by Belight Software

Why? 1) Uses an installer to install items that the application could install itself when ran. 2) Cannot install anywhere other than /Applications.

Business Card Composer

by Belight Software

Why? 1) Uses an installer to install items that the application could install itself when ran. 2) Cannot install anywhere other than /Applications.

Komodo

by ActiveState

Why? 1) Version 3.5.2 of Komodo is mislabled as Version 3.5

QuickSilver

by Blacktree, Inc.

Why? 1) Application filename contains garbage unicode characters (“Qu?c?s????????” pretty huh?) in an attempt to look cool. (QuickSilver is one of the few apps that doesn’t need to try to look cool, it already is)