Tavern on the Meta

I'm good, heh.

So JSONP can hack wordpress halfway?

JSONP requires cooperation on the part of the server.

Ok.

Gotcha. I'm tired. Gnite.

5:07 AM

I can write <script src="http://blog.mosheberman.com/wp-admin/edit-post.php?action=delete&id=1"> into a webpage, and if you visit it while logged into your blog, and that URL actually deleted a post, it'd do so :P

There's no way to protect against that from the browser vendor point of view, you just have to rely on the app makers (WordPress) to defend against that kind of thing

Hence the reason that GET requests should never have side-effects, just return data.

I literally have no idea what this means. I have never seen this notification before, that icon before, or that "resource" name before.

@DanGrossman I think that's a reference to a client, or something like that. For example, one of my contacts in Pidgin has 3 separate resources listed. One is available and the other 2 are marked as away.

So, basically, something went down. :)

oh, must be from trillian

thanks

It seems to be an XMPP thing.

5:16 AM

i'm on google talk for support chat on my websites

Yup, that makes sense.

@DanGrossman, so I could use that to post or modify another wordpress blog if the admin is logged in?

No, since doing that requires a POST request, and a <script> tag only makes a GET request

Ah. Ok. Well PHP could make a post request.

But PHP isn't logged into the blog

5:26 AM

I thought jquery could do POST.

PHP will just get the wordpress login form as a response

jQuery can POST, but only to your own domain

Oh. Ok.

it's a cross-domain request, no AJAX, browser won't do it

So the ultimate trick is to convince te browser that I'm on a different domain.

If you could do that, you'd make good money

If you're black hat, by exploiting it, if you're white hat, because the browser vendors offer money for security vulnerabilities

There's no known way to convince the browser you're on a different domain than you are, that'd be a bug

mootinator

5:29 AM

wonders how he's going to make 10 posts on the skeptics beta. Feels out of my element, even though it isn't.

I hear. Well if it's a browser problem, what's to stop me from writing a program in c to make requests?

A faux browser?

Nothing

Since I don't care about the security of the sites I'm using. I want to break the rules. I just take Forefox or chrome and Break it. Then I can hack other sites... Omg

The problem is getting someone else to use your program to log in to some other website... if you can get someone else to willingly install your malicious software, just send them a keylogger and skip writing a browser

No, you can't use it to hack other sites, you can only hack your own sites, unless you get SOMEONE ELSE to use your broken firefox/chrome

?

Oh. Easy. Recompile and phish.

5:32 AM

Say you took the Firefox source, took out the cross-domain protection, and compiled it. What are you going to do with this broken browser to hack someone else?

Make a few fake ff landing pages ab trick people into using it.

Why trick them into downloading a broken browser you have to then get them to log into secure sites with then get them to visit your malicious site with? Just trick them into downloading a rootkit and steal their whole computer.

We haven't invented anything new here :P

True. Hang on a sec. What

What makes it that the server can I'd the request as coming from you and not me?

Most sites identify users with sessions, which are tied to browsers by a session identifier in a cookie

Say I send a post request spoofing your ip and all after you've logged in?

Ah I see

But if that's stolen all is compromised.

5:35 AM

Yes

Ok. So the web is mostly secure. Whew... :p

Session hijacking

In computer science, session hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer (see HTTP cookie theft). TCP session hija...

So how do anonymous and co get access to sites?

mootinator

@Moshe People are idiots.

I had an economics teacher who had a site whih was hacked.

5:37 AM

Probably through known vulnerabilities in open source software, routers running remote access without the passwords ever being changed, etc

They're not inventing novel new attacks

Someone just guessed his pwd?

Check out the site, look at the HTTP headers for the web server version, if it's not the very latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit

Now check if the site has a blog, a forum, or other open source software installed. Look at the meta generator tag or footer for the version number. If it's not the latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit

So hacking is overly demonized by the media. "Hackers are devious evoke twisted and out to make you burn in hell"
No, media, you are dumb.

hackers are mostly exploiting the fact that very few people keep their systems updated

Makes sense.

Ah.

mootinator

5:39 AM

Then check if the site looks like it was designed in php by someone's nephew.

If yes, try SQL injection :P

Now on a similar note to injections:

Userscripts just operate on static HTML, no?

Meaning I can inject a userscript after a device has been loaded, yes?

I don't want to say much about userscripts, I don't think every browser implements them the same and I don't know exactly what context they run in

"a device"?

@Tim a webpage scuse me.

>

5:42 AM

On iOS. Thinking about a userscript browser.

Hehe. Uh oh. I am under scrutiny.

damn, who do you host with

@DanG I gotta change that. Wordpress has poetry.

Why?

What about my host?

GoDaddy? Because they actually changed the setting so Apache doesn't broadcast its version number in responses

[root@www admin]# telnet mosheberman.com 80
Trying 173.201.93.128...
Connected to mosheberman.com (173.201.93.128).
Escape character is '^]'.
GET / HTTP/1.1
Host: www.mosheberman.com

HTTP/1.1 200 OK
Date: Fri, 25 Feb 2011 05:42:38 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 2940
Content-Type: text/html

Ah.

They're lookin' out for you! Mostly for themselves, but also for you!

5:44 AM

Interesting.

.

I don't want that statement recorded by Google either. :unsays:

They'll dispatch Joan Rivers on you.

Eep.

NOO! I just got an email that my local Borders bookstore is closing!

Yeah, they're in bankruptcy.

5:47 AM

Well, everything is on sale, but I can't buy books now!

I like Borders, I like Barnes&Noble more

I would STORM the downstairs corner on the left and buy up computer books.

Open GL ES 2.0

C#

Android Dev

.NET

amazon.com/Seven-Languages-Weeks-Programming-Programmers/dp/…

Advanced iOS

Erm, the only one there I heard of that's in wide use is Ruby.

Well, I heard of All of em but Clojure

@TimStone - Any idea how userscript injections work?

I hate it when small local shops close because of the walmart phenomenon :(

5:49 AM

Complicatedly.

There's exactly one job listing for Clojure on careers.SO

They aren't injected into the page, they're sandboxed in a separate context. That's why we have to inject the script into the page ourselves.

The specific details are, as Dan mentioned, browser-specific.

Okay, well I want to make those details. ScriptFari

or GreaseFari

not decided yet

So what references are there?

@Reno - Hear hear

@Moshe There are already userscripts for iOS

GreasePocket et al

@DanGrossman GreasePocket is dead AFAIK

@DanGrossman What "et al" do you refer to?

I wonder if I can just make an HTTP request, inject the script and hand it off to a web view? Its insecure but works for starters.

@DanGrossman @TimStone thoughts?

5:58 AM

I don't know, I don't have an iDevice

I have no experience with iPhone development, I don't know what you can and can't do.

Does my process work in theory though?

Am I missing something obvious in terms of the process of getting the script into the page

load page ->inject script -> insert into browser

Yes, you can do that

Ok, going to test.

You'll want to inject a <base href> tag in there to point to the original domain/path so that images/css/etc still load

6:00 AM

@DanGrossman explain please?

The HTML you download includes <img src="logo.gif">

You now display this HTML on your domain, not the original domain

ok

logo.gif doesn't exist on your domain, so it's a broken image

I question the triviality of "injecting the script", and it's certainly not the method that userscripts take, but if it works for you, go for it.

if there's a <base href="http://otherdomain.com"> tag, the browser will load logo.gif from their domain

6:01 AM

base, meaning in the target page

is confused

w3.org/TR/html401/struct/links.html#h-12.4

it specifies the base URL the browser should use when resolving relative URIs

And if there is no base, then what?

I have to get that myself...

then the actual current URL is the base

ok, so I've learned a lot here tonight,

1. Hacking aint easy, thankfully for us.

2. telnet is interesting when used on websites, and can yield some cool info

3. go to sleep earlier so you dont forget entire portions of conversations

hehe

6:03 AM

4. userscript injection must consider dependencies

</list>

re #2, I had to hand write the HTTP requests, just telneting to the server doesn't get any response

So you wrote them in what language and ran them how?

The HTTP protocol specifies the format of HTTP requests, I wrote them and pressed enter to send them, and your server responded with an HTTP response

This is what happens when you telnet to a web server on port 80

[root@www admin]# telnet mosheberman.com 80
Trying 173.201.93.128...
Connected to mosheberman.com (173.201.93.128).
Escape character is '^]'.

You sent em from a browser bar?

Now it sits there waiting for you to send something

6:05 AM

seems not

i got that

I typed this very simple request into the window and hit enter twice, since HTTP requests are terminated by a blank line

GET / HTTP/1.1
Host: www.mosheberman.com

then your server responded to my request for / (the root of your domain) with some headers and its HTML

Which window?

A terminal or a browser

the terminal window where I ran telnet

ah ok

...

1 sec

cool!

telnet can take a while

6:08 AM

cool!

5. telnet is used from the terminal and can be used to graft custom HTTP requests

(which I assume can wreak havoc on insecure servers)

There's nothing inherently dangerous about it

Your browser is making the same connection and talking to your server in the same language

i was going to say

When you're bored

> telnet realmsofdespair.com 4000

What's the latest apache btw?

2.x series?

2.2.17 is the latest stable

6:10 AM

so if it says Apache 2.2 .... ?

@DanGrossman erm, connection refused?

Do you have a firewall blocking outbound connctions?

@DanGrossman I have a router, could that be it? The browser shows just fine.

I don't know, there's definitely a server there waiting on port 4000 :)

ah got it

I wonder how many people try naming themselves "HELP NAMING"

heh

I was obsessed with that game in middle school

6:15 AM

6. if you get connection refused, type, type, again

7. Lists in chat rooms will always get interrupted by others at some point.

So does Apache 2.2 == Apache 2.2.17 or not?

do headers drop the minor version?

Not by default, there could be a setting to do so I'm not aware of

A fresh apache install would say Server:Apache/2.2.17

iTired™

How does one find out what vulnurabilities are fixed in each version of Apache?

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4110

cve.mitre.org

and the release notes from apache

6:20 AM

nice

8. dont ask too many questions, lest they be answered

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5752

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1863

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3303

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3304

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4465

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5000

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6388

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6420

etc

scary

Yes

9. Get to sleep before you get bad ideas.

4

closes all other tabs

heh

goodnight man

Night.

@DanGrossman - I will need that PHP end of the scraper again tomorrow, please.

Thanks, good night.

@Dan Did I really get a star for that?

Ugh.

Wasn't me ;)

6:27 AM

?

Oh no, two stars.

Whatever

goes off to SO teach outsourcees how to make iOS apps

@TimStone, you in?

Of course. :) What's up?

> There's definitely room for improvement, so this is something I'd be happy to discuss

I'm here now, if you want to discuss it now :)

Go to sleep? it is only 10:30 PM!!!

Ah. Is there any chance we can discuss tomorrow? :P

6:34 AM

@DanGrossman is that suppose to show my time zone?

no

@TimStone Nope, week-end :) Sometime next week then.

it's just a clock

It's 6:30AM JonSkeet Time.

@Benjol Ah, fair enough. Alright, next week then. Sorry about that, I've committed myself to quite a few things tonight, so I want to wait until I can think more clearly about it.

6:36 AM

@TimStone No problem at all. That userscript has got me back into the 'mood' for some js-stuff. And I'm a bit more comfortable with jquery now too

Heheh :D

This room depresses me. No one ever talks about anything interesting..

Yes, I know interesting is relative..

Our hour long chat about hacking wasn't at all interesting?

If you followed along you got a bonus telnet address for a MUD

Telnet is like .. dead..

In what way? It's a utility, like ping or traceroute.

6:40 AM

anyway, I'm going to bed

night

@TylerChacha night Nippon

I find myself recommending ASIHTTPRequest to often. Is that a sign that it's awesome?

I'm half-black, half-white, and all SAMANTHA!

Tweeted by GayObama on February 24, 2011 at 9:52 PM

Michael Mrozek

7:00 AM

How does that person have a 9 hour old account with 6 tweets and 5000 followers?

Q: Are Apple Human Interface Guidelines questions off-topic on SO?

@MichaelMrozek accept pwns! ;-)

old twitter bug reopened? something else?

0

I've seen questions like this one that have no coding implications per se, but revolve around Apple's HIG and as such can only be answered by developers. Are these off topic or not? Why?

discussion

@MichaelMrozek It's Jon Stewart, that's how.

Q: Is there a website like jsfiddle for mysql and for other database

@DanGrossman, your google-fu is good, can you find anything for this guy?

0

It would have helped understanding a lot if there is a website like jsfiddle for databases

website

He wants to upload a database, then share queries on it with someone

I don't know of something like that

oh he is from nepal :)

thats a first for me

7:17 AM

@DanGrossman So true.

Why are you still awake? :P

@DanGrossman Answering and editing questions asked by the iOS coders overseas who get paid less than minimum wage to write apps.

You know, if we didn't help them, they'd be stuck and jobs would slowly begin to stay here in the States. :P

@DanGrossman - Okay, good night.

For real

@Moshe they get paid 2$ an hour compared to 55 in the states :o

i think 7.25 is the minimum wage in the usa

@Reno Point is that many (BUT not all) of them are actually inferior coders. Those that aren't migrate elsewhere (US & elsewhere).

7:24 AM

no wonder everyone wants to outsource.

@Reno b'lieve that is correct

@Reno People don't know the dark secret of outsourcing. SO users are actually writing the code for free by answering questions!

Yeah most of them arent inferior, I never said that, its only that we (stackoverflow) have to deal with the dumbass ones ._.

i know right .. circle of life

alright then good night :)

Night

I don't know about you, but the new careers site's new logo looks to me like wireless signal bars

7:39 AM

@YiJiang, a bit, yes, I dunno what it's supposed to represent - salary rising? :)

It's the SO logo bars growing in size, so clearly it represents a stack overflow in progress

7:57 AM

when is stackoverflow going to overflow already

Imgur is reporting this right now:

503 Service Unavailable
No server is available to handle this request.

8:15 AM

> Thanks to your support, Imgur has been growing rapidly for quite some time. Sometimes it's even hard to keep up with all the traffic! Unfortunately, a side effect of all this growth is that sometimes we must take the site down in order to push out upgrades and other improvements the service. This happens very rarely, but it does happen, such as right now.

Why did I elect to come home from school early today anyway? There's a construction site outside that's ridiculously noisy and it's really messing up my concentration

I *!@$% WANT TO SWEAR AT THEM!

then you should, they wont hear you over the noise anyway :)

@Reno I can shout really loud...

Anyway, I want to come back home to sleep >_< If I'd known it would be this bad I would be napping in the library instead

8:35 AM

@YiJiang, if you care to look at my userscript and tell me everything that's wrong with my code, I'm keen to learn :)

@Benjol Sure, as always. It's on StackApps I presume?

@YiJiang yup

Be gentle :) You can comment there, or here, or fork my code and correct it :)

I posted a bit on CodeReview already, nobody answered so far :(

@Benjol link?

with_jquery(function ($) {
  $(function () {

Not needed in this case because GM scripts are always executed after document ready

@LoïcWolff to which, script or code review?

8:44 AM

@Benjol let's say both, I can't find either :)

@YiJiang, I filched that from the chat script - or in any case the version I had to hand

in my defense, I didn't have my first coffee ;)

Q: Pro-forma comments for review [educating users before flagging]

7

About This script adds a little 'auto' link next to all comments boxes. Clicking on the link opens the dialog box below, which allows you to select some pre-fabricated comments which might be helpful for educating users before flagging their posts. Note that the dialog only inserts the tex...

script review

Also no need to place the template HTML in the with_jquery section

Q: Date span and time period to pretty string

1

I have two javascript functions, one to turn a datespan into a 'pretty' string, the other to turn a time period into a pretty string. Similar context to Stack Exchange user profile (Member for: 1 year, 2 months. Last seen: yesterday) I don't like this code at all, but I don't want to make it t...

javascript refactoring

8:45 AM

Just split it out to keep the code inside that function clean

@Loic, oh, someone did answer, weird that I didn't get notified...

No, wait, don't do that

@Benjol it's daily, not live

@LoïcWolff, nope, the inbox is 'live', of that I'm sure

God I'm a moron... you can't do that because the with_jquery section is ran in the browser space, while defining the other stuff in the script in the script itself would be sandboxed and thus not available

8:46 AM

@Benjol right. I was thinking of the mail notification

        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')

Can be chained, and fadeTo can also be used

@YiJiang, can you explain how chaining works in jquery? How do I know which object I'm getting out the end of each function call?

@Benjol If the function is not a getter (for instance, attr('something') or css('property')), then the object returned is always a jQuery object ready for another function to be run against

@YiJiang, the same object that was on the leftside? so as long as I'm doing things on popup, it passes me popup back? Ok, that makes sense

@Benjol As long as the function you're calling is not a traversal or manipulation function, yes

      popup.find('.popup-actions-see').mousedown(function () {
        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')
      });
      popup.find('.popup-actions-see').mouseup(function () {
        popup.css('opacity', '1.0')
        popup.find('.popup-active-pane').css('opacity', '1.0')
      });

Can be replaced with a single hover function

8:51 AM

Good idea

9:05 AM

Is there a good way to get stuff out of the scripts tab in chrome developer tools? I've just got a wall of text

@Benjol What do you mean by that?

Click right here, Inspect Element, Click on Scripts, select master-chat.js in the drop down. It's all wodged together, and very difficult to select bits

I guess I can do ctrl-A Ctrl-C...

9:46 AM

I'm curious, what's a 'hard drive'? I thought it's always 'hard disk drive', but is the former an acceptable/common term?

@YiJiang yes

Oh, I'd never knew that, hmmm...

10:09 AM

in JavaScript on Stack Overflow Chat, 15 hours ago, by Nathan

oracle certified professional

well well well

what do we have here

10:28 AM

tut tut tut

what a terrible joke

(this is my contribution for the day. hope you enjoy)

Q: Can we improve the automatic titling of links to internal URLs?

10:49 AM

terrible joke is terrible

Have a nice laptop free weekend!

Nyuszika7H

11:09 AM

Hi! :)

balpha

11:57 AM

the second bullet here:

8

In an answer to this question: Can we have some linking etiquette and guidelines? I suggested that if a link is made to a related page on the TeX SE, the link text should be the document/question title. This provides much more information about the target link than "this question" or "here". Mu...

feature-request hyperlinks

should be working on meta now

please test