« first day (205 days earlier)      last day (4888 days later) » 

5:00 AM
Ah. Makes sense now.
You can write a <script src="http://www.dangrossman.info/wp-admin"> tag into YOUR document! That's not blocked, the request will happen. But since that URL returns HTML, not JavaScript, you can't get at the result from your code
It's the way JSONP works though, inject a <script> tag, except the URL you point at is a proxy that wraps the HTML in JSON and trigger a callback, so it is javascript nad you can get at the HTML through the javascript object it was wrapped in
@timstone Not exciting as you hoped, huh
I'm good, heh.
So JSONP can hack wordpress halfway?
JSONP requires cooperation on the part of the server.
Gotcha. I'm tired. Gnite.
5:07 AM
I can write <script src="http://blog.mosheberman.com/wp-admin/edit-post.php?action=delete&id=1"> into a webpage, and if you visit it while logged into your blog, and that URL actually deleted a post, it'd do so :P
There's no way to protect against that from the browser vendor point of view, you just have to rely on the app makers (WordPress) to defend against that kind of thing
Hence the reason that GET requests should never have side-effects, just return data.
I literally have no idea what this means. I have never seen this notification before, that icon before, or that "resource" name before.
@DanGrossman I think that's a reference to a client, or something like that. For example, one of my contacts in Pidgin has 3 separate resources listed. One is available and the other 2 are marked as away.
So, basically, something went down. :)
oh, must be from trillian
It seems to be an XMPP thing.
5:16 AM
i'm on google talk for support chat on my websites
Yup, that makes sense.
@DanGrossman, so I could use that to post or modify another wordpress blog if the admin is logged in?
No, since doing that requires a POST request, and a <script> tag only makes a GET request
Ah. Ok. Well PHP could make a post request.
But PHP isn't logged into the blog
5:26 AM
I thought jquery could do POST.
PHP will just get the wordpress login form as a response
jQuery can POST, but only to your own domain
Oh. Ok.
it's a cross-domain request, no AJAX, browser won't do it
So the ultimate trick is to convince te browser that I'm on a different domain.
If you could do that, you'd make good money
If you're black hat, by exploiting it, if you're white hat, because the browser vendors offer money for security vulnerabilities
There's no known way to convince the browser you're on a different domain than you are, that'd be a bug
5:29 AM
wonders how he's going to make 10 posts on the skeptics beta. Feels out of my element, even though it isn't.
I hear. Well if it's a browser problem, what's to stop me from writing a program in c to make requests?
A faux browser?
Since I don't care about the security of the sites I'm using. I want to break the rules. I just take Forefox or chrome and Break it. Then I can hack other sites... Omg
The problem is getting someone else to use your program to log in to some other website... if you can get someone else to willingly install your malicious software, just send them a keylogger and skip writing a browser
No, you can't use it to hack other sites, you can only hack your own sites, unless you get SOMEONE ELSE to use your broken firefox/chrome
Oh. Easy. Recompile and phish.
5:32 AM
Say you took the Firefox source, took out the cross-domain protection, and compiled it. What are you going to do with this broken browser to hack someone else?
Make a few fake ff landing pages ab trick people into using it.
Why trick them into downloading a broken browser you have to then get them to log into secure sites with then get them to visit your malicious site with? Just trick them into downloading a rootkit and steal their whole computer.
We haven't invented anything new here :P
True. Hang on a sec. What
What makes it that the server can I'd the request as coming from you and not me?
Most sites identify users with sessions, which are tied to browsers by a session identifier in a cookie
Say I send a post request spoofing your ip and all after you've logged in?
Ah I see
But if that's stolen all is compromised.
5:35 AM
Ok. So the web is mostly secure. Whew... :p
In computer science, session hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer (see HTTP cookie theft). TCP session hija...
So how do anonymous and co get access to sites?
@Moshe People are idiots.
I had an economics teacher who had a site whih was hacked.
5:37 AM
Probably through known vulnerabilities in open source software, routers running remote access without the passwords ever being changed, etc
They're not inventing novel new attacks
Someone just guessed his pwd?
Check out the site, look at the HTTP headers for the web server version, if it's not the very latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit
Now check if the site has a blog, a forum, or other open source software installed. Look at the meta generator tag or footer for the version number. If it's not the latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit
So hacking is overly demonized by the media. "Hackers are devious evoke twisted and out to make you burn in hell"
No, media, you are dumb.
hackers are mostly exploiting the fact that very few people keep their systems updated
Makes sense.
5:39 AM
Then check if the site looks like it was designed in php by someone's nephew.
If yes, try SQL injection :P
Now on a similar note to injections:
Userscripts just operate on static HTML, no?
Meaning I can inject a userscript after a device has been loaded, yes?
I don't want to say much about userscripts, I don't think every browser implements them the same and I don't know exactly what context they run in
"a device"?
@Tim a webpage scuse me.
> <!-- Thanks for looking at my source code. Unfortunately, there is nothing here. -->
5:42 AM
On iOS. Thinking about a userscript browser.
Hehe. Uh oh. I am under scrutiny.
damn, who do you host with
@DanG I gotta change that. Wordpress has poetry.
What about my host?
GoDaddy? Because they actually changed the setting so Apache doesn't broadcast its version number in responses
[root@www admin]# telnet mosheberman.com 80
Connected to mosheberman.com (
Escape character is '^]'.
GET / HTTP/1.1
Host: www.mosheberman.com

HTTP/1.1 200 OK
Date: Fri, 25 Feb 2011 05:42:38 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 2940
Content-Type: text/html
They're lookin' out for you! Mostly for themselves, but also for you!
5:44 AM
I don't want that statement recorded by Google either. :unsays:
They'll dispatch Joan Rivers on you.
NOO! I just got an email that my local Borders bookstore is closing!
Yeah, they're in bankruptcy.
5:47 AM
Well, everything is on sale, but I can't buy books now!
I like Borders, I like Barnes&Noble more
I would STORM the downstairs corner on the left and buy up computer books.
Open GL ES 2.0
Android Dev
Advanced iOS
Erm, the only one there I heard of that's in wide use is Ruby.
Well, I heard of All of em but Clojure
@TimStone - Any idea how userscript injections work?
I hate it when small local shops close because of the walmart phenomenon :(
5:49 AM
There's exactly one job listing for Clojure on careers.SO
They aren't injected into the page, they're sandboxed in a separate context. That's why we have to inject the script into the page ourselves.
The specific details are, as Dan mentioned, browser-specific.
Okay, well I want to make those details. ScriptFari
or GreaseFari
not decided yet
So what references are there?
@Reno - Hear hear
@Moshe There are already userscripts for iOS
GreasePocket et al
@DanGrossman GreasePocket is dead AFAIK
@DanGrossman What "et al" do you refer to?
I wonder if I can just make an HTTP request, inject the script and hand it off to a web view? Its insecure but works for starters.
@DanGrossman @TimStone thoughts?
5:58 AM
I don't know, I don't have an iDevice
I have no experience with iPhone development, I don't know what you can and can't do.
Does my process work in theory though?
Am I missing something obvious in terms of the process of getting the script into the page
load page ->inject script -> insert into browser
Yes, you can do that
Ok, going to test.
You'll want to inject a <base href> tag in there to point to the original domain/path so that images/css/etc still load
6:00 AM
@DanGrossman explain please?
The HTML you download includes <img src="logo.gif">
You now display this HTML on your domain, not the original domain
logo.gif doesn't exist on your domain, so it's a broken image
I question the triviality of "injecting the script", and it's certainly not the method that userscripts take, but if it works for you, go for it.
if there's a <base href="http://otherdomain.com"> tag, the browser will load logo.gif from their domain
6:01 AM
base, meaning in the target page
is confused
it specifies the base URL the browser should use when resolving relative URIs
And if there is no base, then what?
I have to get that myself...
then the actual current URL is the base
ok, so I've learned a lot here tonight,
1. Hacking aint easy, thankfully for us.
2. telnet is interesting when used on websites, and can yield some cool info
3. go to sleep earlier so you dont forget entire portions of conversations
6:03 AM
4. userscript injection must consider dependencies
re #2, I had to hand write the HTTP requests, just telneting to the server doesn't get any response
So you wrote them in what language and ran them how?
The HTTP protocol specifies the format of HTTP requests, I wrote them and pressed enter to send them, and your server responded with an HTTP response
This is what happens when you telnet to a web server on port 80
[root@www admin]# telnet mosheberman.com 80
Connected to mosheberman.com (
Escape character is '^]'.
You sent em from a browser bar?
Now it sits there waiting for you to send something
6:05 AM
seems not
i got that
I typed this very simple request into the window and hit enter twice, since HTTP requests are terminated by a blank line
GET / HTTP/1.1
Host: www.mosheberman.com
then your server responded to my request for / (the root of your domain) with some headers and its HTML
Which window?
A terminal or a browser
the terminal window where I ran telnet
ah ok
1 sec
telnet can take a while
6:08 AM
5. telnet is used from the terminal and can be used to graft custom HTTP requests
(which I assume can wreak havoc on insecure servers)
There's nothing inherently dangerous about it
Your browser is making the same connection and talking to your server in the same language
i was going to say
When you're bored
> telnet realmsofdespair.com 4000
What's the latest apache btw?
2.x series?
2.2.17 is the latest stable
6:10 AM
so if it says Apache 2.2 .... ?
@DanGrossman erm, connection refused?
Do you have a firewall blocking outbound connctions?
@DanGrossman I have a router, could that be it? The browser shows just fine.
I don't know, there's definitely a server there waiting on port 4000 :)
ah got it
I wonder how many people try naming themselves "HELP NAMING"
I was obsessed with that game in middle school
6:15 AM
6. if you get connection refused, type, type, again
7. Lists in chat rooms will always get interrupted by others at some point.
So does Apache 2.2 == Apache 2.2.17 or not?
do headers drop the minor version?
Not by default, there could be a setting to do so I'm not aware of
A fresh apache install would say Server:Apache/2.2.17
How does one find out what vulnurabilities are fixed in each version of Apache?
6:20 AM
8. dont ask too many questions, lest they be answered
9. Get to sleep before you get bad ideas.
closes all other tabs
goodnight man
@DanGrossman - I will need that PHP end of the scraper again tomorrow, please.
Thanks, good night.
@Dan Did I really get a star for that?
Wasn't me ;)
6:27 AM
Oh no, two stars.
goes off to SO teach outsourcees how to make iOS apps
@TimStone, you in?
Of course. :) What's up?
> There's definitely room for improvement, so this is something I'd be happy to discuss
I'm here now, if you want to discuss it now :)
Go to sleep? it is only 10:30 PM!!!
Ah. Is there any chance we can discuss tomorrow? :P
@DanGrossman is that suppose to show my time zone?
@TimStone Nope, week-end :) Sometime next week then.
it's just a clock
It's 6:30AM JonSkeet Time.
@Benjol Ah, fair enough. Alright, next week then. Sorry about that, I've committed myself to quite a few things tonight, so I want to wait until I can think more clearly about it.
6:36 AM
@TimStone No problem at all. That userscript has got me back into the 'mood' for some js-stuff. And I'm a bit more comfortable with jquery now too
Heheh :D
This room depresses me. No one ever talks about anything interesting..
Yes, I know interesting is relative..
Our hour long chat about hacking wasn't at all interesting?
If you followed along you got a bonus telnet address for a MUD
Telnet is like .. dead..
In what way? It's a utility, like ping or traceroute.
6:40 AM
anyway, I'm going to bed
@TylerChacha night Nippon
I find myself recommending ASIHTTPRequest to often. Is that a sign that it's awesome?
I'm half-black, half-white, and all SAMANTHA!
7:00 AM
How does that person have a 9 hour old account with 6 tweets and 5000 followers?
@MichaelMrozek accept pwns! ;-)
old twitter bug reopened? something else?
Q: Are Apple Human Interface Guidelines questions off-topic on SO?

MosheI've seen questions like this one that have no coding implications per se, but revolve around Apple's HIG and as such can only be answered by developers. Are these off topic or not? Why?

@MichaelMrozek It's Jon Stewart, that's how.
@DanGrossman, your google-fu is good, can you find anything for this guy?
Q: Is there a website like jsfiddle for mysql and for other database

experimentXIt would have helped understanding a lot if there is a website like jsfiddle for databases

He wants to upload a database, then share queries on it with someone
I don't know of something like that
oh he is from nepal :)
thats a first for me
7:17 AM
@DanGrossman So true.
Why are you still awake? :P
@DanGrossman Answering and editing questions asked by the iOS coders overseas who get paid less than minimum wage to write apps.
You know, if we didn't help them, they'd be stuck and jobs would slowly begin to stay here in the States. :P
@DanGrossman - Okay, good night.
For real
@Moshe they get paid 2$ an hour compared to 55 in the states :o
i think 7.25 is the minimum wage in the usa
@Reno Point is that many (BUT not all) of them are actually inferior coders. Those that aren't migrate elsewhere (US & elsewhere).
7:24 AM
no wonder everyone wants to outsource.
@Reno b'lieve that is correct
@Reno People don't know the dark secret of outsourcing. SO users are actually writing the code for free by answering questions!
Yeah most of them arent inferior, I never said that, its only that we (stackoverflow) have to deal with the dumbass ones ._.
i know right .. circle of life
alright then good night :)
I don't know about you, but the new careers site's new logo looks to me like wireless signal bars
7:39 AM
@YiJiang, a bit, yes, I dunno what it's supposed to represent - salary rising? :)
It's the SO logo bars growing in size, so clearly it represents a stack overflow in progress
7:57 AM
when is stackoverflow going to overflow already
Imgur is reporting this right now:
503 Service Unavailable
No server is available to handle this request.
8:15 AM
> Thanks to your support, Imgur has been growing rapidly for quite some time. Sometimes it's even hard to keep up with all the traffic! Unfortunately, a side effect of all this growth is that sometimes we must take the site down in order to push out upgrades and other improvements the service. This happens very rarely, but it does happen, such as right now.
Why did I elect to come home from school early today anyway? There's a construction site outside that's ridiculously noisy and it's really messing up my concentration
then you should, they wont hear you over the noise anyway :)
@Reno I can shout really loud...
Anyway, I want to come back home to sleep >_< If I'd known it would be this bad I would be napping in the library instead
8:35 AM
@YiJiang, if you care to look at my userscript and tell me everything that's wrong with my code, I'm keen to learn :)
@Benjol Sure, as always. It's on StackApps I presume?
@YiJiang yup
Be gentle :) You can comment there, or here, or fork my code and correct it :)
I posted a bit on CodeReview already, nobody answered so far :(
@Benjol link?
with_jquery(function ($) {
  $(function () {
Not needed in this case because GM scripts are always executed after document ready
@LoïcWolff to which, script or code review?
8:44 AM
@Benjol let's say both, I can't find either :)
@YiJiang, I filched that from the chat script - or in any case the version I had to hand
in my defense, I didn't have my first coffee ;)
Q: Pro-forma comments for review [educating users before flagging]

Benjol About This script adds a little 'auto' link next to all comments boxes. Clicking on the link opens the dialog box below, which allows you to select some pre-fabricated comments which might be helpful for educating users before flagging their posts. Note that the dialog only inserts the tex...

Also no need to place the template HTML in the with_jquery section
Q: Date span and time period to pretty string

BenjolI have two javascript functions, one to turn a datespan into a 'pretty' string, the other to turn a time period into a pretty string. Similar context to Stack Exchange user profile (Member for: 1 year, 2 months. Last seen: yesterday) I don't like this code at all, but I don't want to make it t...

8:45 AM
Just split it out to keep the code inside that function clean
@Loic, oh, someone did answer, weird that I didn't get notified...
No, wait, don't do that
@Benjol it's daily, not live
@LoïcWolff, nope, the inbox is 'live', of that I'm sure
God I'm a moron... you can't do that because the with_jquery section is ran in the browser space, while defining the other stuff in the script in the script itself would be sandboxed and thus not available
8:46 AM
@Benjol right. I was thinking of the mail notification
        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')
Can be chained, and fadeTo can also be used
@YiJiang, can you explain how chaining works in jquery? How do I know which object I'm getting out the end of each function call?
@Benjol If the function is not a getter (for instance, attr('something') or css('property')), then the object returned is always a jQuery object ready for another function to be run against
@YiJiang, the same object that was on the leftside? so as long as I'm doing things on popup, it passes me popup back? Ok, that makes sense
@Benjol As long as the function you're calling is not a traversal or manipulation function, yes
      popup.find('.popup-actions-see').mousedown(function () {
        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')
      popup.find('.popup-actions-see').mouseup(function () {
        popup.css('opacity', '1.0')
        popup.find('.popup-active-pane').css('opacity', '1.0')
Can be replaced with a single hover function
8:51 AM
Good idea
9:05 AM
Is there a good way to get stuff out of the scripts tab in chrome developer tools? I've just got a wall of text
@Benjol What do you mean by that?
Click right here, Inspect Element, Click on Scripts, select master-chat.js in the drop down. It's all wodged together, and very difficult to select bits
I guess I can do ctrl-A Ctrl-C...
9:46 AM
I'm curious, what's a 'hard drive'? I thought it's always 'hard disk drive', but is the former an acceptable/common term?
@YiJiang yes
Oh, I'd never knew that, hmmm...
well well well
what do we have here
10:28 AM
tut tut tut
what a terrible joke
(this is my contribution for the day. hope you enjoy)
10:49 AM
terrible joke is terrible
Have a nice laptop free weekend!
11:09 AM
Hi! :)
11:57 AM
the second bullet here:
Q: Can we improve the automatic titling of links to internal URLs?

Matthew LeingangIn an answer to this question: Can we have some linking etiquette and guidelines? I suggested that if a link is made to a related page on the TeX SE, the link text should be the document/question title. This provides much more information about the target link than "this question" or "here". Mu...

should be working on meta now
please test
You actually added that huh? Alright. :P
Oh wow.
Indeed it is, very nice @balpha
12:10 PM
    // ==UserScript==
    // @name         Upvote all posts
    // @description  Automagically upvote all posts. It can't be done with comments, because they have an one vote per 5 min limit.
    // @author       Nyuszika7H
    // @include      stackoverflow.com/questions*
    // @include      meta.stackoverflow.com/questions*
    // @include      superuser.com/questions*
    // @include      meta.superuser.com/questions*
    // @include      serverfault.com/questions*
12:21 PM
Mmmm.. strawberries
Good morning!
Man, these things are even more expensive than avocados
These beauties have to be flown in from Korea, gosh they are expensive... and good. Mmmhmmmm...
@TimStone about strawberries, or user scripts? :)
12:27 PM
Well, that second part too, but I was getting annoyed with this server more specifically.
@TimStone You need strawberries!
Perhaps :P
What do you do when a twitter user name you need is 'squatted'?
in JavaScript on Stack Overflow Chat, 5 mins ago, by Ivo Wetzel
http://twitter.com/#!/JSGarden >_>
Not really squatted, just that some inactive user from a year ago happened to choose the same name as that website :P
Break their shins!
12:42 PM
People always creating more work for me mutters

« first day (205 days earlier)      last day (4888 days later) »