Fire Island Blog

Following some discussion over at Mashable, we’ve set up a petition to encourage MySpace to consider a “Certified Safe Widget Developer” program. It may be a long-shot (I once waited 22 days for them to respond to a support request), but surely we have to try?

Please forward it to everyone in the community that you know and encourage them to sign. If we can rally enough people behind this we may get MySpace to make some concessions to a really important sub-economy that has emerged out of all this Web 2.0 malarkey.

Also, is anyone interested in collaborating on building a community site to raise awareness about the issue and to aggregate discussion and action towards overcoming it? After all, there’s strength in numbers…

UPDATE:

We’ve also set up a pledge at PledgeBank to raise interest in collaborating on the campaign site.

Peter Cashmore at Mashable is reporting that Cooqy has managed to bypass the recent MySpace Flash link blocking fix. Cooqy provides a Flash interface for searching and browsing eBay auctions and it would appear that their MySpace profile carries Flash widgets that (on my PowerBook at least, with Flash Player 9 installed) can successfully open new browser windows.

I’ve taken a quick squizz at the code and it seems that MySpace has not inserted the crucial allowNetworking=internal attribute into Cooqy’s widget embed code. Check it out:

<embed src="http://www.cooqy.com/cooqyMain.lzx?lzt=swf&debug=false&lzr=swf8" quality="high" scale="noscale" salign="lt"  width="500" height="600" bgcolor="#ffffff" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="server=http://www.cooqy.com&title=<i>Cooqy</i>"/>


So what’s different about Cooqy’s code and why has MySpace interpreted it differently? Well for a start they’re using Open Laszlo to power their site and to serve the widgets, just take a look at the src attribute above. Another thing that’s different is the string they’re inserting with the flashvars attribute.

It’s the flashvars line that seems to be causing getURL() actions to work, even when Flash Player 9 is installed. On closer inspection it seems to be the extra italic tags inserted into the flashvars attribute that causes the MySpace code parser to fail and to not insert that crucial allowNetworking=internal attribute. I’ve posted an example on my own MySpace profile and those extra italic tags do the trick. I too have a Flash widget (sort of) that can open new browser windows.

Try it yourself, does it work?

UPDATE:
MySpace have closed this loophole now

Well, this is a bit of a blow for any company building widgets targeted at MySpace users. In order to prevent the spread of Flash based adware worms, MySpace are inserting code into Flash objects that stops external links working. The latest version of Flash Player 9 is required for this ‘fix’ to actually work and you can bet ya life that MySpace are actively encouraging users to upgrade, indeed MySpace’s own video service now requires Flash Player 9.

I’ve just tried it myself and sure enough, Flash objects that have a simple getURL action written into them, which opens a site in new window, now fail to work when they are embedded in a MySpace profile. MySpace are actually inserting an extra parameter into the HTML code that users embed into their profile, namely allowNetworking=internal which prevents the Flash object from any communication with the browser, the chief use of which is usually to open a hyperlink to a third-party website. Now, obviously these techniques can be used for nefarious means and MySpace wouldn’t be doing their job if they didn’t protect their users from malicious attack. But in doing so they have crippled a great many legitimate, honest service providers.

This is potentially pretty catastrophic for any company that is using MySpace as a way to spread the word about their product or service. We hope that Fantasy Festivals will fall into this category in the future, once we have built our Flash posters.

There’s more detail at Techcrunch… MySpace security measure disables viral spread of widgets.