Greasemonkey Script Updates #

There have been some reports that my Gmail Macros Greasemonkey script no longer works. I started to look into fixing this, and figured that while I was at it, I should incorporate the improvements that others have made to the script back into the original one. Both posts about it have a growing number of comments, including patched versions with various tweaks. Additionally, there is a Google Group dedicated to Gmail power users that seems to have made even more changes. The script has been updated and now contains the following additional commands:

  • b: Remove label
  • z: Mark unread
  • o: Expand/collapse all messages in a conversation
  • shift-x + a/n/r/u/s/t: Select all/none/read/unread/starred/unstarred
  • h: Show help (reference for built-in and the script's keyboard shortcuts)

Thanks go to Karl, Anand and Michael (?) for these improvements. If I have missed anyone, please let me know.

On a related note, my Google Reader/Gmail integration script has spawned two variants, one by Rob Radez and another by Winston. They went for slightly deeper integrations, if you like the original you may like these too.

Using security holes to work around carrier lock-in #

I recently acquired a Samsung SCH-a990. The QVGA screen and Verizon's reasonably broad coverage for their EVDO network made it seem like a good choice, despite the carrier's tendency to cripple the phone's features (also, a decent camera seemed like a nice perk). Some of the crippling can be worked around, e.g. the lack of Bluetooth file transfer with a cheap MicroSD card, allowing pictures and songs to be moved around without incurring messaging costs.

Verizon HomepageUnfortunately, changing the homepage does not appear to be possible the way it was on my old v710. No one seems to have figured out how to edit the browser/WAP settings on this phone. Users are therefore stuck with the pre-set Verizon homepage (pictured to the left).

A limited amount of customization is allowed, in the form of bookmarks that can be added to the bottom of the page. The bookmarks appear to be pretty limited, allowing only 17 characters for the title, and the links cannot be bound to any access keys, requiring the user to scroll through all the other on-screen links to get to the bookmark ones.

In addition to setting these bookmarks on the phone, there is also a desktop-acessible website where the homepage can be customized. I decided to investigate if sloppy coding on Verizon's side could be used to work around the carrier lock-in.

Sure enough, it turned out that the bookmark editing form did not do any HTML sanitizing for the name field, and neither did the homepage output code. Better yet, the 17 character name limit was only enforced as a maxlength atttribute on the <input> node. By running the following snippet of JavaScript, it was possible to at least bind a bookmark to an access key:

var nameInput = document.forms.theform.tle;
nameInput.setAttribute("maxlength", 200);
nameInput.value='<a href="http://www.google.com/reader/m" accesskey="0">Reader</a>';

Encouraged by this, I tried to see if this hole could be used to hijack the homepage entirely. Unfortunately limitations of the OpenWave browser and the fact that these bookmarks were inserted below the built-in content meant that nothing else seemed to work. For the record, these are the things that I tried:

  • A <style> block that hid all of the images on the page (all of the built-in links appear to be created from images).
  • A <meta> tag to auto-refresh the page to my preferred start page.
  • Positioning the bookmark link absolutely so that it would be overlayed on top of the built-in content.
  • Modifying the item ID parameter in the edit form with those of the built-in links in case they could be edited too.

For now I'm at wits end.