Simon Rumble’s blog

This track is a surprising little earworm. Starts off very MoR, like something Oasis would do if they were even duller. It gets better.

http://open.spotify.com/track/5cwN1htZyoWqZCc33f3RfE

Browser impose the Same origin policy on JavaScript running inside a web page. It means that your code cannot access a resource through XMLHttpRequest that belongs on another server, even when it's in the same domain. This is a good thing, and the way to get around it in production environments is to use some kind of proxy if you're trying to channel a trusted resource. I've done this on a couple of occasions so that my apps could access a web service that is physically located elsewhere.

When developing your code, however, this can be a real pain in the butt. You might want to access the production web service, or just want to play around and prove that what you want to do is possible. I've recently discovered a much easier solution than the others I've used before.

This little snippet of JavaScript causes a popup in the browser, but then allows you to make an XMLHttpRequest to any domain you like. Very handy for testing!

// This sneaky bit tries to disable the Same Origin Policy
if (navigator.userAgent.indexOf("Firefox") != -1) {
   try {
       netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
       } 
       catch (e) {
             alert("Permission UniversalBrowserRead denied -- not running Mozilla?");
             }
}

Tip of the hat to miek on this Stack Overflow question.

After my last post an anonymous email arrived with an even better mechanism to de-obfuscate Omniture's code, including the line-noise base s_code.

I currently have a real need to be able to understand how Omniture works for a particular implementation, and have requested a commented version. Apparently it's kept very tight and I might be able to "see" parts of it. Ridiculous when you can rather easily do this. I'll now probably blow half a day working out what all the single letter variables are.

Copy and paste the following into Firebug's console and run it.

//code to unobfuscate the s_code
var str = '<hr><pre>';
var strFunction;
var strFunctionName;
var i;
for(i in s) {
       x = s[i];
       if (typeof(x) == 'function')    {
               strFunctionName = i.toString();
               strFunction = x.toString();
               strFunction = strFunction.replace(/^function( ?anonymous)?/, 's_object_name.' + strFunctionName + ' = function');
               str += strFunction + '\r\n \r\n   // ------- ------- ------- ------- ------- -------  \r\n\r\n';
       }
}
document.write(str)

Thanks to our anonymous tipster!

My current job involves working extensively with Omniture products. The company has an annoying habit of secrecy, with documentation only available on request for many aspects of their products.

They also attempt to obfuscate their JavaScript, despite the fact that a determined viewer should be able to work it out eventually. I'm told this is so that people aren't tempted to play with the code. The obvious methods of deobfuscation are pretty tedious, and because Omniture don't use standard (minify et al) methods of obfuscation so it seems a little more difficult. Fortunately I lucked onto a better approach.

You'll need Firebug, and if you don't have that already you should anyway. Go to a page that already has the Omniture "plugin" (function) you want. Open the Firebug console and run alert(s.functionNameYouWant) and run it. You'll be shown a nicely-formatted anonymous function, which will be much easier to read than the line noise you'll see in the actual s_code.js file.

In my case I'm after Cross-Visit Participation, and that's used on the Omniture site itself (though an older version than the latest available from Omniture which has a very useful additional feature).

Update on 22nd March 2010

I discovered, while trying to reverse-engineer the s.Media() functions, that some plugins are loaded as "Modules" which presents a further layer to get through. But it's still pretty simple. Using this handy snippet you can decode the objects. So, for example, to get readable source for s.Media, do this in Firebug:

function concatObject(obj) {
  str='';
  for(prop in obj)
  {
    str+=prop + " value :"+ obj[prop]+"\n";
  }
  return(str);
}
alert(concatObject(s.Media));

Another update

I received a better way to do this, detailed in this post.

It's no secret I'm no fan of recruitment consultants. They're up there with estate agents in being leeches on society that provide no value while scraping off their percentage. Their inability to understand social norms is infuriating. The way they don't seem to understand that talking about your career over the phone in an open plan office isn't really convenient is just bizarre, though as a class they seem unable to carry out a conversation by email.

Jeremy Champion takes the audacity and rudeness to new heights. My LinkedIn profile is very explicit:

Telemarketers for conferences do NOT have permission to contact me. Recruitment consultants do NOT have permission to contact me.

You can't get much clearer than that. Which is what makes the note I just received from Jeremy Champion of Connect Digital, a recruiter, so infuriating.

Hi Simon- I read the note at the bottom of you page :)

Sure I am a recruiter, although am after some help please if yuou don't mind. A client of mine is looing for a Web Analytics Manager to head up a new team within a leading Search Agency. Any chance you might be able to refer anyone to me please.

So not only does he go against my extremely simple, explicit request, he admits to reading it and just plowing on ahead anyway. Jeremy, welcome to my recruiter blacklist. This list is for those who go above and beyond even their shoddy class in terms of ethics and rude behaviour.

Work is providing me a mobile, so I went to cancel my phone with Exetel. Unfortunately this is the UI you see. So first of all, you can helpfully cancel it in the past. But then the button is labelled "Cancel". So does that means clicking it will cancel my service, or cancel the request to disconnect?

The resulting page is even more confusing. Does that mean my "Cancel" was successful? Or do I now need to "Submit" to make it happen? Terribly confused.

Josephine's Cheese, given your site has no contact information, and doesn't even display the product I bought, I'll have to howl into the aether and assume you'll find it when I SEO your arse (given Google doesn't even see your image-only site, that won't be hard).

So I bought your "Traditional Goat's Cheese in Ash" last week. It was delicious. Unfortunately your packaging is abysmal. After very carefully peeling off the label, you're presented with this tube of squished cheese. If you take care from this point, and happen to have scissors or a sharp knife handy, you can just about get a single blob of cheese out ready to serve. More likely you'll end up with more like a tube of cheese toothpaste squirted out onto your serving location.

Great cheese. I won't buy it again in this packaging. Buy your competitors' products and learn.