You know, I just can't fucking leave well enough alone. This morning (e:paul) mailed me a short Surebert script to do logins, which works, yet I'm still hacking this HTTP auth problem. Stay The Course, right?

But I got it solved. 1: Never send 401 Unauthorized without a WWW-Authenticate header. It's not allowed, and you'll get what you deserve. RFC 2617 briefly mentions using 400 Bad Request to report miscellaneous failures to the browser, and sure enough, that resets Safari. 2: If the script detects a failure, send another request to the same URL using a bogus username. This will of course fail, resetting Firefox in the process [thanks (e:kookcity2000)]. I think that's a gruesome hack, but if it works it works.

Why do I care about HTTP authentication? Most importantly, I want to support authenticated, noninteractive web services [specifically an authenticated RSS feed]. Since this code will have to live in my server somewhere, I might as well get some mileage out of it. HTTP Digest is often overlooked but it's a nice middle ground between static hashes [which are plaintext-equivalent] and full-blown encryption [CPU load].

Source code available upon request.

- Z

Don't bother reading unless you give at least a quarter of a shit about XMLHttpRequest and HTTP authentication.

Here's a stupid geek trick. The correct login information for this is user="user", password="password". Give it the wrong password [it will say something like 401 Unauthorized, user="user", password="bogus"]. Then give it the right password and try again - it will keep sending the wrong password. This happens in both Firefox and IE; Safari has a slightly different bug.

Here's the sitch: I have an XMLHttpRequest going out to a password-protected resource. The credentials are supplied by the user and thus they are likely to be wrong some of the time. The script is designed to gracefully handle authentication failure - specifically, I want to avoid the crappy infinite HTTP authentication dialog box loop. I'd think that this issue would come up from time to time, but I guess it doesn't because this is really hairy:

XMLHttpRequest states "If authentication fails, user agents SHOULD prompt the users for credentials."

To work around this, Paul James suggests returning 401 Unauthorized without the mandatory WWW-Authenticate header. In theory, this tells the browser to stop trying and forget the password. The browser does, in fact, stop trying, but it also goes into a weird undefined state where it continues to issue the old [incorrect] password despite instruction to the contrary. [Safari instead puts up the dialog on the next request, even if credentials are provided.]

HTTP/1.1 states "If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity might include relevant diagnostic information." - ie, reissue the same challenge to indicate to the browser that it should give up. As near as I can tell, not a single browser has ever done that.

HTTP/1.1 also gives us 403 Forbidden: "Authorization will not help and the request SHOULD NOT be repeated." This response has the same bizarre effects as 401 without WWW-Authenticate.

I'm actually kind of an AJAX newb, so ... does anyone have any recommendations?

- Z

OK I admit it, I'm too cool for school. I don't like getting dressed up for Halloween. I think costume parties are lame. One year we sat at home with all the lights out so nobody would try to trickortreat us. And secretly I always thought that people who professed to like Halloween better than Christmas were just trying to fit in with the kids who don't fit in.

But this year it seems like there's a lot of fun stuff happening. Consider this, first off, a bump for "Nosferatu," below.

At the other end of the film spectrum, Regal Transit is going to be screening The Nightmare Before Christmas in 3-D this year. [I was initially surprised that they'd taken the expense of shooting in 3-D if they weren't going to distribute as 3-D ... but alas, this is yet another film digitally altered by ILM. Thank you George Lucas!]

::Download Flash Video::

[Woah, rerecompression. I hear Flash 9 is going to have native support for H.264?]

Is everyone familiar with fundamentalist Christian haunted houses? Alleyway Theatre bought a copy of the 'official' script and is presenting "Hell House Buffalo" upstairs of the costume store/bike shop at 745 Main. Todd Warfield (Reefer Madness), director: "I've changed very, very little of it. The challenge for us is to perform it sincerely." I've always been sort of morbidly curious of the spectacle, and now that I know the money is going to a good cause and I won't get evangelized at too much, I think we're going to go check it out. With local celebrities as Guest Satans, how can you go wrong?



- Z

On January 16, 1926, the brand-new Shea's theater opened to great fanfare with a screening of "The King on Main Street." The baroque-decorated movie theater, seating 4,000 and incorporating imported Czech crystal chandeliers, was erected at a cost of $3 million [approximately $30 million today].

Five months later, the German silent film 'Nosferatu, eine Symphonie des Grauens [a Symphony of Horror]' made its American debut. Nosferatu paved new ground, being one of the first German Expressionist films and the first [albeit unauthorized] screen adaptation of Dracula. It's still pretty fucking creepy.

On Tue 30 Oct at 7:30p, Shea's will once again screen Nosferatu, with a musical accompaniment by the Devil Music Ensemble [admission $15.50]. I am going and so should you. That goes double for the non-(e:peeps) who read this, and triple for the Buffalo n00bz who have never been to Shea's.



Let me know who's in [non-peeps can email me], I'll run down to the box office & pick up tix.

- Z

There's no way I'm the only person here who thinks this is super funny.

[(e:dragonlady7)'s previous place of employment made a database system for nursing homes. They released an update and started getting complaints from their clients that they couldn't enter Irish patients. It took them a little while to figure out that the backend was tripping over O'Malley.]

- Z

- Z

The future perfect tense (WIKIPEDIA - Future perfect tense) is used when, at a certain time in the future, you will be able to look back in the past and say that the event happened. It's a somewhat esoteric construction, but it does come up occasionally: by this time next year, i will have made a million dollars.

The Copenhagen interpretation of quantum mechanics (WIKIPEDIA - Schrodinger's cat) states that all of the possible outcomes of an experiment - even if contradictory - are true until the outcome is observed. This is a purely theoretical thought experiment, since it can only be validated by observation and it's not possible to observe an experiment before it has been observed. Thank you, Bohr and Heisenberg, for being such jackoffs.

Which brings me to the point I was trying to make: health insurance. We signed up for Healthy NY and our coverage took effect 1 August. We were shuffling around finances at the time, and missed our first bill. We received a notice postmarked 10 September saying that they'd cancelled our coverage effective 1 Sept, and if we wanted to continue coverage we'd have to pay for coverage received and prepay one month's worth. I sent the payment off, but upon further inspection I thought, damn this is a lot of money. Instead of the two months' payment I had expected [August, the payment we missed, and October, the prepayment], it was for three months. So I called.

Me: Am I covered?
Univera: ...no.
Z: OK, I sent my payment 27 Sept. How long will that take to process?
U: Couple days, don't worry about it. Any other questions?
Z: Yeah, so I [explain the situation]. August and October I understand, but where does this third month come in?
U: That's for September.
Z: OK, but I got a letter saying that I wasn't covered in September.
U: Because you didn't pay.
Z: Right. So what am I paying for?
U: August, September and October.
Z: What about this letter I got?
U: When your payment goes through, you will have been covered for September.
Z: Woah, hold on. When I was told I didn't have insurance I canceled my doctors appointments. [Not true but it could be.]
U: We would have covered them.
Z: But you dropped my coverage.
U: We would have covered them once the payment went through.
Z: OK. So let's say I broke my leg today.
U: You are not covered, but once your payment goes through you will have been covered.
Z: So am I covered today or not?
U: You are not covered for today. But once your payment goes through you will have been covered for today.
Z: I don't understand. Was I covered in September or not?
U: You are not yet covered for September, but once we receive your payment you will have been covered.
Z: So this letter I got ... was I actually dropped or not?

And I basically just talked in circles for fifteen minutes with two separate customer service representatives until we reached an agreement: that I am completely incapable of understanding my own health insurance coverage.



- Z

Thank you, Wikiquote, for providing this afternoon's waste of time!

- Z

"Cat and Girl" is a different kind of awesome.

- Z

Two very confused bloggers arrived promptly at 6pm. 'Are we in the right place?' Two tables sat reserved and unused in the corner of someone else's event. Middle-aged Cheektowagans, many of whom had never heard the word 'blog' before, eyed the empty chairs. 'Can we take these?' 'You'll have to find the person in charge.' 'Who's that?' Who indeed?

Roll call: Mr. and Mrs. Punaro were there, and also seemed to be the only people who knew what was going on. We were told Michael Rebmann was 'here somewhere, I think ...'

Meanwhile (e:strip) managed to send a full delegation on short notice [(e:dragonlady7) (e:james) (e:jim) (e:libertad) (e:metalpeter) (e:mike) (e:paul) (e:terry) (e:zobar)] and then hauled our asses out to Youngstown for another (e:strip) event [+ (e:theecarey) (e:vincent)]. I filed a motion with (e:paul) to change motto to '(e:strip) - the blogging community that organizes events ... and then goes to them.'

- Z

_______________
xpost: