5 ms·

What are they doing in the page source there? Storing a message in a cookie then refreshing the page to display it? The second time you visit the page, you'll

by jorisw 13y ago

What are they doing in the page source there? Storing a message in a cookie then refreshing the page to display it? The second time you visit the page, you'll get your cookie-stored statement. Almost seems like they want to be able to change their statement without previous visitors seeing the changes.

TophWells 13y ago
I don't see anything like that. Here's the page source for me: <html> <head> <title>MtGox.com</title> </head> <body> <img src="/img/mtgox_logo_mail.png"/> Dear MtGox Customers, In the event of recent news reports and the potential repercussions on MtGox's operations and the market, a decision was taken to close all transactions for the time being in order to protect the site and our users. We will be closely monitoring the situation and will react accordingly. Best regards, MtGox Team </body> </html>
- TophWells 13y ago
 Wait, I refreshed the page a few times, and once, I got: <html> <head> <title>MtGox.com</title> <script type="text/javascript"> var AKSB=AKSB||{};AKSB.q=[];AKSB.mark=function(b,a){AKSB.q.push(["mark",b,a||(new Date).getTime()])};AKSB.measure=function(b,a,c){AKSB.q.push(["measure",b,a,c||(new Date).getTime()])};AKSB.done=function(b){AKSB.q.push(["done",b])};AKSB.mark("firstbyte",(new Date).getTime()); AKSB.prof={custid:"223233",ustr:"",originlat:0,clientrtt:19,ghostip:"23.51.248.44",ipv6:false,pct:10,xhrtest:false,clientip:"130.223.174.194"}; (function(b){var a=document.createElement("iframe");a.src="javascript:false";(a.frameElement||a).style.cssText="width: 0; height: 0; border: 0; display: none";var c=document.getElementsByTagName("script"),c=c[c.length-1];c.parentNode.insertBefore(a,c);a=a.contentWindow.document;a.open().write("<body onload=\"var js = document.createElement('script');js.id = 'aksb-ifr';js.src = '"+b+"';document.body.appendChild(js);\">");a.close()})(("https:"===document.location.protocol?"https:":"http:")+"//aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js"); </script> </head> <body> <img src="/img/mtgox_logo_mail.png"/> Dear MtGox Customers, In light of recent news reports and the potential repercussions on MtGox's operations and the market, a decision was taken to close all transactions for the time being in order to protect the site and our users. We will be closely monitoring the situation and will react accordingly. Best regards, MtGox Team </body> </html> This is very odd behaviour.
 - sonoffett 13y ago
 Someone already mentioned in a previous thread that this is an anti-dos method.
 - kalleboo 13y ago
 AKSB = Akamai http://aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js http://aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js
- asogi 13y ago
 This is what I see: <html><head><title>MtGox.com loading</title></head><body>Please wait...<script>function xdec(data){var o="SOME_RANDOM_BASE_64_THAT_KEEPS_CHANGING";var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,dec="",tmp_arr=[];if(!data){return data}data+='';do{h1=o.indexOf(data.charAt(i++));h2=o.indexOf(data.charAt(i++));h3=o.indexOf(data.charAt(i++));h4=o.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){tmp_arr[ac++]=String.fromCharCode(o1)}else if(h4==64){tmp_arr[ac++]=String.fromCharCode(o1,o2)}else{tmp_arr[ac++]=String.fromCharCode(o1,o2,o3)}}while(i<data.length);dec=tmp_arr.join('');return dec};document.cookie=xdec('MORE_RANDOM_BASE_64_THAT_KEEPS_CHANGING').replace(String.fromCharCode(0),'').split('').reverse().join(''); location.href='/';</script></body></html>
 - saraid216 13y ago
 Please add two spaces before your gigantic layout-breaking text.
- jorisw 13y ago
 That's the result DOM source. Try doing a lynx or curl on the site. The entire statement is served through filling a cookie with JavaScript and reloading the site. Or so it was when I posted my earlier comment.
 - TophWells 13y ago
 You're right. Firefox's "View Source" button doesn't do what I thought it did. Curl gives a page with a "Please wait" message and a pile of Javascript. I learned something today.
ChristianBundy 13y ago
I don't see that either, here's the code I'm seeing: https://gist.github.com/christianbundy/9213200 https://gist.github.com/christianbundy/9213200
nav1 13y ago
The script is for a DDoS protection service (http://www.prolexic.com/ http://www.prolexic.com/). It only shows up the first time you load the page.

by jorisw 13y ago

TophWells 13y ago

I don't see anything like that. Here's the page source for me: <html> <head> <title>MtGox.com</title> </head> <body> <img src="/img/mtgox_logo_mail.png"/> Dear MtGox Customers, In the event of recent news reports and the potential repercussions on MtGox's operations and the market, a decision was taken to close all transactions for the time being in order to protect the site and our users. We will be closely monitoring the situation and will react accordingly. Best regards, MtGox Team </body> </html>

TophWells 13y ago
Wait, I refreshed the page a few times, and once, I got: <html> <head> <title>MtGox.com</title> <script type="text/javascript"> var AKSB=AKSB||{};AKSB.q=[];AKSB.mark=function(b,a){AKSB.q.push(["mark",b,a||(new Date).getTime()])};AKSB.measure=function(b,a,c){AKSB.q.push(["measure",b,a,c||(new Date).getTime()])};AKSB.done=function(b){AKSB.q.push(["done",b])};AKSB.mark("firstbyte",(new Date).getTime()); AKSB.prof={custid:"223233",ustr:"",originlat:0,clientrtt:19,ghostip:"23.51.248.44",ipv6:false,pct:10,xhrtest:false,clientip:"130.223.174.194"}; (function(b){var a=document.createElement("iframe");a.src="javascript:false";(a.frameElement||a).style.cssText="width: 0; height: 0; border: 0; display: none";var c=document.getElementsByTagName("script"),c=c[c.length-1];c.parentNode.insertBefore(a,c);a=a.contentWindow.document;a.open().write("<body onload=\"var js = document.createElement('script');js.id = 'aksb-ifr';js.src = '"+b+"';document.body.appendChild(js);\">");a.close()})(("https:"===document.location.protocol?"https:":"http:")+"//aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js"); </script> </head> <body> <img src="/img/mtgox_logo_mail.png"/> Dear MtGox Customers, In light of recent news reports and the potential repercussions on MtGox's operations and the market, a decision was taken to close all transactions for the time being in order to protect the site and our users. We will be closely monitoring the situation and will react accordingly. Best regards, MtGox Team </body> </html> This is very odd behaviour.
- sonoffett 13y ago
 Someone already mentioned in a previous thread that this is an anti-dos method.
- kalleboo 13y ago
 AKSB = Akamai http://aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js http://aksb-a.akamaihd.net/146060/aksb-a/aksb.min.js
asogi 13y ago
This is what I see: <html><head><title>MtGox.com loading</title></head><body>Please wait...<script>function xdec(data){var o="SOME_RANDOM_BASE_64_THAT_KEEPS_CHANGING";var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,dec="",tmp_arr=[];if(!data){return data}data+='';do{h1=o.indexOf(data.charAt(i++));h2=o.indexOf(data.charAt(i++));h3=o.indexOf(data.charAt(i++));h4=o.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){tmp_arr[ac++]=String.fromCharCode(o1)}else if(h4==64){tmp_arr[ac++]=String.fromCharCode(o1,o2)}else{tmp_arr[ac++]=String.fromCharCode(o1,o2,o3)}}while(i<data.length);dec=tmp_arr.join('');return dec};document.cookie=xdec('MORE_RANDOM_BASE_64_THAT_KEEPS_CHANGING').replace(String.fromCharCode(0),'').split('').reverse().join(''); location.href='/';</script></body></html>
- saraid216 13y ago
 Please add two spaces before your gigantic layout-breaking text.
jorisw 13y ago
That's the result DOM source. Try doing a lynx or curl on the site. The entire statement is served through filling a cookie with JavaScript and reloading the site. Or so it was when I posted my earlier comment.
- TophWells 13y ago
  You're right. Firefox's "View Source" button doesn't do what I thought it did. Curl gives a page with a "Please wait" message and a pile of Javascript. I learned something today.

ChristianBundy 13y ago

I don't see that either, here's the code I'm seeing: https://gist.github.com/christianbundy/9213200 https://gist.github.com/christianbundy/9213200

nav1 13y ago

The script is for a DDoS protection service (http://www.prolexic.com/ http://www.prolexic.com/). It only shows up the first time you load the page.