Archive for July, 2008

GPS serendipity: Florence Avenue, Sebastopol

Monday, July 14th, 2008

img_0601.jpgI drove from Oakland up to the O’Reilly Foo camp last Friday. The O’Reilly offices are just outside Sebastopol, CA. I stopped at an ATM and my GPS unit got totally confused. So I took a few turns at random and wound up on Florence Avenue. I drove a couple of hundred meters and started seeing big colorful structures out the front of many houses. They were so good I stopped, got out my camera, and took a whole bunch of pictures.

I talked to a man washing his car in his driveway. He told me that “Patrick” had created all the figures, and installed them on the front lawns. I got the impression that it was all free. Soon after I found the house that was unmistakably Patrick’s and seeing a man loading things into a pickup truck I went up and asked if he was Patrick. It was him and we had a friendly talk (mainly me telling him he was amazing). He gave me a calendar of his work.

Click on the thumbnails below to see bigger versions. There’s even a FC Barcelona structure. As I found out later, lots of people (of course) have seen these sculptures. When I got to Foo, there was one (image above) outside the O’Reilly office. Google for Patrick Amiot or Florence Avenue, Sebastopol and you’ll find much more. And Patrick has his own web site.


Minor mischief: create redirect loops from predictable short URLs

Tuesday, July 1st, 2008

redirect loopI was checking out the new URL shortening service from Betaworks.

I started wondering how random the URLs from these URL-shortening services could be. I wrote a tiny script the other day to turn URLs given on the command line into short URLs via

import urllib, sys
for arg in sys.argv[1:]:
    print urllib.urlopen(
        ‘’ + arg).read()

I ran it a couple of times to see what URLs it generated. Note that you have to use a new URL each time, as it’s smart enough not to give out a new short URL for one it has seen before. I got the sequence,,,,…

That’s an invitation to some minor mischief, because you can guess the next URL in the sequence before it’s actually assigned to redirect somewhere.

We can ask for a short URL that redirects to our predicted next URL. Then we ask for a short URL that redirects to the URL that gives us. If we do this fast enough, will not yet have assigned the predicted next URL and we’ll get it. So the URL will end up redirecting to the URL and vice versa. In ugly Python (and with a bug/shortcoming in the nextIsgd function):

import urllib, random

def bitly(url):
    return urllib.urlopen(
        ‘’ + url).read()

def isgd(url):
    return urllib.urlopen(
        ‘’ + url).read()

def nextIsgd(url):
    last = url[-1]
    if last == ‘z’:
        next = ‘A’
        next = chr(ord(last) + 1)
    return url[:-1] + next

def randomURI():
    return ‘’ % \
           .join(map(str, random.sample(xrange(100000), 3)))

isgdURL = isgd(randomURI())
print ‘Last URL:’, isgdURL

nextIsgdURL = nextIsgd(isgdURL)
print ‘Next URL will be:’, nextIsgdURL

# Ask for a URL that redirects to nextIsgdURL
bitlyURL = bitly(nextIsgdURL)
print ‘Step 1: now redirects %s to %s’ % (
    bitlyURL, nextIsgdURL)

# Ask for a URL that redirects to that url
isgdURL2 = isgd(bitlyURL)
print ‘Step 2: now redirects %s to %s’ % (
    isgdURL2, bitlyURL)

if nextIsgdURL == isgdURL2:
    print ‘Success’
    print ‘Epic FAIL’

This worked first time, giving:

Step 1: now redirects to
Step 2: now redirects to

In general it’s not a good idea to use predictable numbers like this, which hardly bears saying as just about every responsible programmer knows that already. wont shorten a link, as tinyurl is on their blacklist. So they obviously know what they’re doing. The service is brand new and presumably not on the radar yet.

And finally, what happens when you visit one of the deadly looping redirect URLs in your browser? You’d hope that after all these years the browser would detect the redirect loop and break it at some point. And that’s what happened with Firefox 3, producing the image above.

If you want to give it a try, and point to each other. Do I need to add that I’m not responsible if your browser explodes in your face?