DNF on Profile

[+NanCycle]

I had added the number of my DNF logs to the top line of my profile; it has been there for many months, now all of a sudden it is gone. I've not changed the wording except to change the number of logs, and occasionally to adjust the vertical alignment. But it has completely disappeared. Anybody know why? If you had this on your profile, do you still have it?

 

<div class='stat' style='position:relative; top:-276px; left:480px; height:0px;'>

| 

<img style="vertical-align:sub" src='/images/icons/32/dnf.png' alt='' height="15" width="15" />

301 DNF Logs

</div>

[Rock Chalk]

Today's Release Notes post explains it.

[+tallglenn]

Thanks. Security is mostly superstition. I went to a lot of bother to get my DNF stats to display "just right". While I'm complaining, I'll add that editing my profile using 5 little half lines is a farce. I haven't updated it in almost a year. Thanks again.

[+NanCycle]

Today's Release Notes post explains it.

 

Thank you for the explanation--although I don't like it.

 

Well, at least I still have this--used to have it at the bottom of the Profile section, but just moved it to the top

 

I have posted 301 DNF logs on 285 caches. I went back and found 71 of these later; 85 have been archived.

[+frinklabs]

I gave up on the haxx0r method of displaying this stat, because odds were that these types of changes would zap it.

 

I would still like for it to be an official feature

 

Interestingly, the hack is conspicuously absent from the location of its first implementation.

[+The A-Team]

I gave up on the haxx0r method of displaying this stat, because odds were that these types of changes would zap it.

 

I would still like for it to be an official feature

 

Interestingly, the hack is conspicuously absent from the location of its first implementation.

I believe the "backend updates to the Geocaching Profile to increase security" were made to prevent just such haxxing.

[+Viajero Perdido]

Probably, the changes were made to prevent a more serious form of haxxing, something of unknown form (you can't predict everything), but of nefarious intent. Breaking into the server, disrupting service, that kind of thing. HTML has some new features, and it looks like the devs are trying them out. (And at this later point in the day, perhaps frantically.)

 

So I think harmless tricks like showing DNF counts or XXXing out links are just collateral damage from a larger-picture security effort. As are all the broken profiles (oops!) when it comes to formatting.

 

It's fascinating to watch their software development process from a safe distance.

Edited December 1, 2015 by Viajero Perdido

[+NanCycle]

While I'm complaining, I'll add that editing my profile using 5 little half lines is a farce.

 

Yeah, I'll add my complaint on this issue also. I used to be able to expand the edit box nicely, but no more. Can we get the "expander" back, please????

[Moun10Bike]

I am still able to expand my bio edit box in Chrome and Firefox. We made no changes to that page. What browser and version are you using?

[+on4bam]

While I'm complaining, I'll add that editing my profile using 5 little half lines is a farce.

 

Yeah, I'll add my complaint on this issue also. I used to be able to expand the edit box nicely, but no more. Can we get the "expander" back, please????

 

In Firefox I can just pull down the bottom end of the editing box and expand it to whatever size I want just like I could do before the change. It never worked in IE though (IE was used by GSAK to automatically upload my profile code).

[+noncentric]

I am still able to expand my bio edit box in Chrome and Firefox. We made no changes to that page. What browser and version are you using?

 

Expansion works in Firefox v42

Doesn't work in IE v11

[+Mudfrog]

I'm a bit confused. Why is it that we can have imported html (stats generated from the FindStatGen macro in gsak for instance) but not manually type in some simple html?

 

Was this change initiated for security or was it made for some other reason? I'm thinking the latter...

[+The A-Team]

I'm a bit confused. Why is it that we can have imported html (stats generated from the FindStatGen macro in gsak for instance) but not manually type in some simple html?

I wouldn't call it simple HTML. The DNF hack piggybacks on the Groundspeak CSS in such a way that it will display something well outside of the user-editable area. Some people were also using a similar method to cover up the Message Center link on their profile page. I don't blame Groundspeak for wanting to stop things like this and confine a user's modifications to the area they designated for such modifications.

 

There's nothing stopping you from using some truly simple HTML to add the DNF stat at the top of your user-editable area. I'm sure someone will post some HTML soon that everyone can copy-and-paste to their profile. It wouldn't have any funky browser alignment issues either.

[+kunarion]

I am still able to expand my bio edit box in Chrome and Firefox. We made no changes to that page. What browser and version are you using?

I see only five lines in IE 11.9.25 and Firefox 39.0. I had to uninstall Chrome (it was becoming a nuisance), so I haven't tested that lately. There is no obvious way to expand to more than five lines. How would I do that? The teeny box has always been a royal pain. [EDIT: NM, I see a reply about pulling the bottom of the box down, I'll try that].

 

Edited December 2, 2015 by kunarion

[+kunarion]

I am still able to expand my bio edit box in Chrome and Firefox. We made no changes to that page. What browser and version are you using?

 

Expansion works in Firefox v42

Doesn't work in IE v11

Yes, there it is, plain as day in Firefox (not IE). I wonder why I never noticed it before?

 

[+Gill & Tony]

Today's Release Notes post explains it.

I'm a bit confused. Why would adding DNF counts be a security issue?

[+NanCycle]

I am still able to expand my bio edit box in Chrome and Firefox. We made no changes to that page. What browser and version are you using?

 

Hah! That's interesting. I had previously used Chrome when I could do it; recently I got a new computer and started using IE (Edge); I just tried it in Chrome again and sure enough it's still there. Thanks for the clarification.

[cezanne]

The DNF hack piggybacks on the Groundspeak CSS in such a way that it will display something well outside of the user-editable area. Some people were also using a similar method to cover up the Message Center link on their profile page. I don't blame Groundspeak for wanting to stop things like this and confine a user's modifications to the area they designated for such modifications.

 

I blame them for not offering the feature to display the DNF count up there where people want to have it (without using any tricks). Adding it there where you suggest it is worthless for me (BTW: I did not use the trick to display the DNF count because I was too lazy for the updates) and many others - the message would have been for other cachers with respect to the role of DNFs for some cachers, not to have the DNF count somewhere.

 

As covering up the message center link is regarded, there is a good reason for doing that too and again Groundspeak could easily have avoided it. It would have been much nicer if Groundspeak had been willing to switch the order of the two commands and to not use "send message" for the new message centre when this was previously was used for sending mails. Many cachers are tired to get messages via the message centre from cachers who would not care to use e-mail and always have used e-mail before but just click on the first link. The changes to link the two systems are by far not far reaching enough. All the e-mails coming in from the message centre have a Groundspeak subject and as sender a Groundspeak address and not the adress of the sender which makes it impossible to store and organize the messages in a systematic kmanner in e-mail folders. That's also why the reviewers still

ask for e-mails and not for being contacted via the message centre.

 

Moreover, there is no security reason at all to reduce the width of the profile box. Now almost half of the window is white.

Edited December 3, 2015 by cezanne

[+thebruce0]

As far as security is concerned, some script allowances in the profile html allowed essentially any script to run even dynamically loaded from off-site, and gain access to the entire gc.com visible page template currently being viewed. Malicious profile html code could alter properties of links, urls, objects, pretty much anything outside the bounds of the custom profile content, masking as gc.com template design (this was the idea used to add the 'DNF' count and covering other links on the page, though not malicious ideas themselves). Segmenting the custom content area into a secure subframe while still allowing scripts to execute removes that aspect of malicious code (unfortunately also removes non-malicious code that people used for visual customization).

Essentially, still be aware that dynamic custom profile content may be abused, but at least now it's partitioned off into its own sandbox.

Edited December 3, 2015 by thebruce0

[+tomturtle]

Is there anyway you can increase the size of the profile box just a little bit so the find stat generated stats fit in? That is a common application and I'm sure would help out lots of people. There is plenty of room on the page. As someone previously mentioned, much of the page is just plain white.

[jholly]

Is there anyway you can increase the size of the profile box just a little bit so the find stat generated stats fit in? That is a common application and I'm sure would help out lots of people. There is plenty of room on the page. As someone previously mentioned, much of the page is just plain white.

Things fit fine on my profile. Your problem is probably the extra stuff you included. See.

 

If you want your GC profile to look correct you must keep within the 750px width of the iFrame. FSG does its best to enforce this, but I can't control any extra text or the html you put inside Notes sections.

 

A recent update to the macro fixed some of the problems. Try the new version.

Edited December 4, 2015 by jholly

[+tomturtle]

Is there anyway you can increase the size of the profile box just a little bit so the find stat generated stats fit in? That is a common application and I'm sure would help out lots of people. There is plenty of room on the page. As someone previously mentioned, much of the page is just plain white.

Things fit fine on my profile. Your problem is probably the extra stuff you included. See.

 

If you want your GC profile to look correct you must keep within the 750px width of the iFrame. FSG does its best to enforce this, but I can't control any extra text or the html you put inside Notes sections.

 

A recent update to the macro fixed some of the problems. Try the new version.

 

I doubt if it is the things other than the Find stats that I have on my profile, since Find stats at this point is the only thing that appears to be too wide. I am using an older version, so I will have to try the new version when I have time to get it set up.