1. Wow! What a surprise and honor to see our site posted here. Thanks for the great write up.

Yes, the concept is quite simple. However the technical challenges were quite the opposite. We're going to continue focusing our efforts on making the application simple and easy to use. We hope to hear everyone's feedback so that we can continue improving the experience.

Posted at 4:39PM on Jul 21st 2005 by Jameson Hsu

2. I wonder how possible could this feature to be hacked and removed? Could anybody share your experience?

Posted at 11:36AM on Jul 25th 2005 by Jason Chiang

3. hacking this would be dependent on braking the allowDomain function in actionscript, possibly via a domain access block in the site's htaccess file... of course i'm not exactly sure htaccess could block a file on its own domain from access a file on someone else's because i think it is usually used in the reverse.

allowDomain on livedocs:
http://livedocs.macromedia.com/flash/mx2004/main_7_2/00001750.html

Posted at 11:45AM on Jul 25th 2005 by Mike Schleifstein

4. In order to remove it, you'd have to disassemble the Flash movie, find and remove the code, and reassemble it.

htaccess and allowDomain are totally irrelevant.

Posted at 5:47PM on Jul 25th 2005 by Bob Ippolito

5. actually using the method of opening the flash file to remove the code, if you only remove the allowdomain line from the mochibot code the function would no longer work because Flash player's security setup will not allow a movie to load a file from another domain that has not been defined via the allow domain method. of course it would be a whole lot of work to rip out the one line just to steal a small flash game... i really can't see a site going through all this trouble if they aren't even willing to go through the trouble of creating their own work in the first place

Posted at 5:58PM on Jul 25th 2005 by Mike Schleifstein

6. I think you should read the security documentation again. allowDomain performs a different purpose: it allows a domain to access the properties of all movie clips. The (in)security model (to quote myself) does nothing to prevent movies from being loaded, it only makes a lame attempt to restrict what they may do when loaded.

While disabling the allowDomain may prevent MochiBot from working correctly, it won't be for the reason you've stated. It's still going to end up doing the loadMovieNum and code from mochibot.com will run (which does mean it could be detected, just not necessarily as easily).

The allowDomain is also only relevant when publishing for Flash 6 or later, because Flash 5 doesn't have the System class.

Anyhow, it's three lines of code. If you can disable one of those lines, you can surely disable the other two.. so it's not very interesting point to make either way.

Posted at 7:13PM on Jul 25th 2005 by Bob Ippolito

7. I wonder how possible could this feature to be hacked and removed? Could anybody share your experience?

Posted at 4:56AM on Jul 26th 2005 by jchiang