The Great Widget Falsification

For the past week, Singapore's internet space has been abuzz with the entire war between blogger Xiaxue and various Gushcloud bloggers. To go into the whys and wherefores would take up way too much of my valuable time; plus it's not really what I want to talk about today.

Some Background

An entity known as SMRT Feedback  - not, to my knowledge, associated with Gushcloud - has accused Xiaxue of falsifying her web-counter.

I quote:

Firstly, the stats counter has been rigged to increase +1 per second. Any web developer will be able to tell you that, based on the JavaScript coding that was used to deliver that function.

This accusation was followed rapidly by a defence by ThemissingA. In the blogpost is this:

This is the coding on Xiaxue’s blog. If anyone else would like to see for themselves, you can go to her page, right-click, and select “view page source” (confirmed for Chrome, not sure how to do this on other browsers). This is the section that contains her counter. Notice that the widget’s source is blogger.com. So, using this information, I deduce that the counter is more than likely a tool supplied by blogger.com. Anyways, I set up my own blog to see how it’s done.

This was preceded and followed by screenshots of the blogger viewing the source. And the source looked fairly harmless without actually going into the JavaScript behind the widget.

And he concluded with this:

1. Xiaxue did not create the coding for her counter. It was supplied to her by blogger.com, which is owned by Google Inc.
2. Blogger.com (and, by extension, Google) supplies this widget to ALL of its bloggers.
3. If the counter is rigged, that rests entirely on the shoulders of GOOGLE, NOT XIAXUE. It also means that ANYONE using blogger (which, if I’m not wrong, comprises of the majority of Singapore’s blogging community) is also at fault for “rigging” their counters.

ThemissingA claims that since the source of the page doesn't show any funny business at the HTML level, Xiaxue must be innocent. He's totally missing the point. And, given that he set up a blog just to defend Xiaxue, possibly his marbles.

Let's assume that the widget's code is untouched. Yes that's a fairly big assumption as these go, but bear with me. It is still possible to manipulate it without directly interfering with the widget.

Challenge accepted!

This isn't a web tutorial, so I'm not going to delve into the code. I'm just going to give you an idea of what I attempted. First, I created a web-counter for this blog using Google's gadget creation interface. Next, I created a HTML/JavaScript gadget, input some innocuous text message followed by a JavaScript segment.

Preparing some hacky goodness

See the code I put in there? Here's the entire chunk.

<script>

setInterval(function () {
var totalcountbox=document.getElementById("Stats1_totalCount");
var totalcount=totalcountbox.innerHTML;
for (i=1;i<=10;i++)
{
totalcount=totalcount.replace("<span class=\"digit stage-0\">","");
totalcount=totalcount.replace("<span class=\"blind-plate\">","");
totalcount=totalcount.replace("<strong>","");
totalcount=totalcount.replace("</strong>","");
totalcount=totalcount.replace("</span>","");
}

if (totalcount!="")
{
totalcount=parseInt(totalcount)+1;
totalcount=totalcount+"";

var newcount="";
for (i=0;i<totalcount.length;i++)
{
newcount=newcount+"<span class=\"digit stage-0\"><strong>"+totalcount.charAt(i)+"</strong><span class=\"blind-plate\"></span></span>";
}
totalcountbox.innerHTML=newcount;
}
}, 60000);
</script>

I refreshed my blog, and viola! I had a web-counter that increased by 1 every minute.

What does this prove?

No, it doesn't prove Xiaxue's guilt. It just puts a huge dent in ThemissingA's defence. Looking at the HTML source tells you nothing.

Disclaimer

Xiaxue fans who are preparing to lynch me for this, you can un-bunch your knickers. I never said she was guilty. I only said it was possible. And I wasn't even trying particularly hard. This is just a surface-level hack and won't stand up to scrutiny after refreshing the page. The code was clunky and cobbled together in 15 minutes. I'm sure any programmer worth his salt can do better, given time.

So what?

Precisely. Let's assume (again with the assumptions!) that Xiaxue is indeed guilty of falsifying her web-counter. So what? Do people actually believe web-counters nowadays, given that I've just demonstrated how ridiculously easy it is to manipulate them? The 90s called, dude. They want their cutesy vanity widgets back.

Now how's that for a counter-argument?
T___T