Tavern on the Meta

Moshe

5:00 AM

Ah. Makes sense now.

Dan Grossman

You can write a <script src="http://www.dangrossman.info/wp-admin"> tag into YOUR document! That's not blocked, the request will happen. But since that URL returns HTML, not JavaScript, you can't get at the result from your code

It's the way JSONP works though, inject a <script> tag, except the URL you point at is a proxy that wraps the HTML in JSON and trigger a callback, so it is javascript nad you can get at the HTML through the javascript object it was wrapped in

@timstone Not exciting as you hoped, huh

Tim Stone

I'm good, heh.

Moshe

So JSONP can hack wordpress halfway?

Tim Stone

JSONP requires cooperation on the part of the server.

Moshe

Ok.

Gotcha. I'm tired. Gnite.

Dan Grossman

5:07 AM

I can write <script src="http://blog.mosheberman.com/wp-admin/edit-post.php?action=delete&id=1"> into a webpage, and if you visit it while logged into your blog, and that URL actually deleted a post, it'd do so :P

There's no way to protect against that from the browser vendor point of view, you just have to rely on the app makers (WordPress) to defend against that kind of thing

George Marian

Hence the reason that GET requests should never have side-effects, just return data.

Dan Grossman

I literally have no idea what this means. I have never seen this notification before, that icon before, or that "resource" name before.

George Marian

@DanGrossman I think that's a reference to a client, or something like that. For example, one of my contacts in Pidgin has 3 separate resources listed. One is available and the other 2 are marked as away.

So, basically, something went down. :)

Dan Grossman

oh, must be from trillian

thanks

George Marian

It seems to be an XMPP thing.

Dan Grossman

5:16 AM

i'm on google talk for support chat on my websites

George Marian

Yup, that makes sense.

Moshe

@DanGrossman, so I could use that to post or modify another wordpress blog if the admin is logged in?

Dan Grossman

No, since doing that requires a POST request, and a <script> tag only makes a GET request

Moshe

Ah. Ok. Well PHP could make a post request.

Dan Grossman

But PHP isn't logged into the blog

Moshe

5:26 AM

I thought jquery could do POST.

Dan Grossman

PHP will just get the wordpress login form as a response

jQuery can POST, but only to your own domain

Moshe

Oh. Ok.

Dan Grossman

it's a cross-domain request, no AJAX, browser won't do it

Moshe

So the ultimate trick is to convince te browser that I'm on a different domain.

Dan Grossman

If you could do that, you'd make good money

If you're black hat, by exploiting it, if you're white hat, because the browser vendors offer money for security vulnerabilities

There's no known way to convince the browser you're on a different domain than you are, that'd be a bug

mootinator

5:29 AM

wonders how he's going to make 10 posts on the skeptics beta. Feels out of my element, even though it isn't.

Moshe

I hear. Well if it's a browser problem, what's to stop me from writing a program in c to make requests?

A faux browser?

Dan Grossman

Nothing

Moshe

Since I don't care about the security of the sites I'm using. I want to break the rules. I just take Forefox or chrome and Break it. Then I can hack other sites... Omg

Dan Grossman

The problem is getting someone else to use your program to log in to some other website... if you can get someone else to willingly install your malicious software, just send them a keylogger and skip writing a browser

No, you can't use it to hack other sites, you can only hack your own sites, unless you get SOMEONE ELSE to use your broken firefox/chrome

Moshe

?

Oh. Easy. Recompile and phish.

Dan Grossman

5:32 AM

Say you took the Firefox source, took out the cross-domain protection, and compiled it. What are you going to do with this broken browser to hack someone else?

Moshe

Make a few fake ff landing pages ab trick people into using it.

Dan Grossman

Why trick them into downloading a broken browser you have to then get them to log into secure sites with then get them to visit your malicious site with? Just trick them into downloading a rootkit and steal their whole computer.

We haven't invented anything new here :P

Moshe

True. Hang on a sec. What

What makes it that the server can I'd the request as coming from you and not me?

Dan Grossman

Most sites identify users with sessions, which are tied to browsers by a session identifier in a cookie

Moshe

Say I send a post request spoofing your ip and all after you've logged in?

Ah I see

But if that's stolen all is compromised.

Dan Grossman

5:35 AM

Yes

Moshe

Ok. So the web is mostly secure. Whew... :p

Dan Grossman

Session hijacking

In computer science, session hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer (see HTTP cookie theft). TCP session hija...

Moshe

So how do anonymous and co get access to sites?

mootinator

@Moshe People are idiots.

Moshe

I had an economics teacher who had a site whih was hacked.

Dan Grossman

5:37 AM

Probably through known vulnerabilities in open source software, routers running remote access without the passwords ever being changed, etc

They're not inventing novel new attacks

Moshe

Someone just guessed his pwd?

Dan Grossman

Check out the site, look at the HTTP headers for the web server version, if it's not the very latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit

Now check if the site has a blog, a forum, or other open source software installed. Look at the meta generator tag or footer for the version number. If it's not the latest version that means there are known vulnerabilities you can just look up in security bulletins then exploit

Moshe

So hacking is overly demonized by the media. "Hackers are devious evoke twisted and out to make you burn in hell"
No, media, you are dumb.

Dan Grossman

hackers are mostly exploiting the fact that very few people keep their systems updated

Moshe

Makes sense.

Ah.

mootinator

5:39 AM

Then check if the site looks like it was designed in php by someone's nephew.

If yes, try SQL injection :P

Moshe

Now on a similar note to injections:

Userscripts just operate on static HTML, no?

Meaning I can inject a userscript after a device has been loaded, yes?

Dan Grossman

I don't want to say much about userscripts, I don't think every browser implements them the same and I don't know exactly what context they run in

Tim Stone

"a device"?

Moshe

@Tim a webpage scuse me.

Dan Grossman

>

Moshe

5:42 AM

On iOS. Thinking about a userscript browser.

Hehe. Uh oh. I am under scrutiny.

Dan Grossman

damn, who do you host with

Moshe

@DanG I gotta change that. Wordpress has poetry.

Why?

What about my host?

Dan Grossman

GoDaddy? Because they actually changed the setting so Apache doesn't broadcast its version number in responses

[root@www admin]# telnet mosheberman.com 80
Trying 173.201.93.128...
Connected to mosheberman.com (173.201.93.128).
Escape character is '^]'.
GET / HTTP/1.1
Host: www.mosheberman.com

HTTP/1.1 200 OK
Date: Fri, 25 Feb 2011 05:42:38 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 2940
Content-Type: text/html

Moshe

Ah.

Dan Grossman

They're lookin' out for you! Mostly for themselves, but also for you!

Moshe

5:44 AM

Interesting.

.

Dan Grossman

I don't want that statement recorded by Google either. :unsays:

Tim Stone

They'll dispatch Joan Rivers on you.

Dan Grossman

Eep.

Moshe

NOO! I just got an email that my local Borders bookstore is closing!

Dan Grossman

Yeah, they're in bankruptcy.

Moshe

5:47 AM

Well, everything is on sale, but I can't buy books now!

Dan Grossman

I like Borders, I like Barnes&Noble more

Moshe

I would STORM the downstairs corner on the left and buy up computer books.

Open GL ES 2.0

C#

Android Dev

.NET

Dan Grossman

amazon.com/Seven-Languages-Weeks-Programming-Programmers/dp/…

Moshe

Advanced iOS

Erm, the only one there I heard of that's in wide use is Ruby.

Well, I heard of All of em but Clojure

@TimStone - Any idea how userscript injections work?

Reno

I hate it when small local shops close because of the walmart phenomenon :(

Tim Stone

5:49 AM

Complicatedly.

Dan Grossman

There's exactly one job listing for Clojure on careers.SO

Tim Stone

They aren't injected into the page, they're sandboxed in a separate context. That's why we have to inject the script into the page ourselves.

The specific details are, as Dan mentioned, browser-specific.

Moshe

Okay, well I want to make those details. ScriptFari

or GreaseFari

not decided yet

So what references are there?

@Reno - Hear hear

Dan Grossman

@Moshe There are already userscripts for iOS

GreasePocket et al

Moshe

@DanGrossman GreasePocket is dead AFAIK

@DanGrossman What "et al" do you refer to?

I wonder if I can just make an HTTP request, inject the script and hand it off to a web view? Its insecure but works for starters.

@DanGrossman @TimStone thoughts?

Dan Grossman

5:58 AM

I don't know, I don't have an iDevice

Tim Stone

I have no experience with iPhone development, I don't know what you can and can't do.

Moshe

Does my process work in theory though?

Am I missing something obvious in terms of the process of getting the script into the page

load page ->inject script -> insert into browser

Dan Grossman

Yes, you can do that

Moshe

Ok, going to test.

Dan Grossman

You'll want to inject a <base href> tag in there to point to the original domain/path so that images/css/etc still load

Moshe

6:00 AM

@DanGrossman explain please?

Dan Grossman

The HTML you download includes <img src="logo.gif">

You now display this HTML on your domain, not the original domain

Moshe

ok

Dan Grossman

logo.gif doesn't exist on your domain, so it's a broken image

Tim Stone

I question the triviality of "injecting the script", and it's certainly not the method that userscripts take, but if it works for you, go for it.

Dan Grossman

if there's a <base href="http://otherdomain.com"> tag, the browser will load logo.gif from their domain

Moshe

6:01 AM

base, meaning in the target page

is confused

Dan Grossman

w3.org/TR/html401/struct/links.html#h-12.4

it specifies the base URL the browser should use when resolving relative URIs

Moshe

And if there is no base, then what?

I have to get that myself...

Dan Grossman

then the actual current URL is the base

Moshe

ok, so I've learned a lot here tonight,

1. Hacking aint easy, thankfully for us.

2. telnet is interesting when used on websites, and can yield some cool info

3. go to sleep earlier so you dont forget entire portions of conversations

Dan Grossman

hehe

Moshe

6:03 AM

4. userscript injection must consider dependencies

</list>

Dan Grossman

re #2, I had to hand write the HTTP requests, just telneting to the server doesn't get any response

Moshe

So you wrote them in what language and ran them how?

Dan Grossman

The HTTP protocol specifies the format of HTTP requests, I wrote them and pressed enter to send them, and your server responded with an HTTP response

This is what happens when you telnet to a web server on port 80

[root@www admin]# telnet mosheberman.com 80
Trying 173.201.93.128...
Connected to mosheberman.com (173.201.93.128).
Escape character is '^]'.

Moshe

You sent em from a browser bar?

Dan Grossman

Now it sits there waiting for you to send something

Moshe

6:05 AM

seems not

i got that

Dan Grossman

I typed this very simple request into the window and hit enter twice, since HTTP requests are terminated by a blank line

GET / HTTP/1.1
Host: www.mosheberman.com

then your server responded to my request for / (the root of your domain) with some headers and its HTML

Moshe

Which window?

A terminal or a browser

Dan Grossman

the terminal window where I ran telnet

Moshe

ah ok

...

1 sec

cool!

telnet can take a while

Dan Grossman

Moshe

6:08 AM

cool!

5. telnet is used from the terminal and can be used to graft custom HTTP requests

(which I assume can wreak havoc on insecure servers)

Dan Grossman

There's nothing inherently dangerous about it

Your browser is making the same connection and talking to your server in the same language

Moshe

i was going to say

Dan Grossman

When you're bored

> telnet realmsofdespair.com 4000

Moshe

What's the latest apache btw?

2.x series?

Dan Grossman

2.2.17 is the latest stable

Moshe

6:10 AM

so if it says Apache 2.2 .... ?

@DanGrossman erm, connection refused?

Dan Grossman

Do you have a firewall blocking outbound connctions?

Moshe

@DanGrossman I have a router, could that be it? The browser shows just fine.

Dan Grossman

I don't know, there's definitely a server there waiting on port 4000 :)

Moshe

ah got it

I wonder how many people try naming themselves "HELP NAMING"

heh

Dan Grossman

I was obsessed with that game in middle school

Moshe

6:15 AM

6. if you get connection refused, type, type, again

7. Lists in chat rooms will always get interrupted by others at some point.

So does Apache 2.2 == Apache 2.2.17 or not?

do headers drop the minor version?

Dan Grossman

Not by default, there could be a setting to do so I'm not aware of

A fresh apache install would say Server:Apache/2.2.17

Moshe

iTired™

Dan Grossman

Moshe

How does one find out what vulnurabilities are fixed in each version of Apache?

Dan Grossman

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4110

cve.mitre.org

and the release notes from apache

Moshe

6:20 AM

nice

8. dont ask too many questions, lest they be answered

Dan Grossman

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5752

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1863

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3303

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3304

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4465

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5000

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6388

web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6420

etc

scary

Moshe

Yes

9. Get to sleep before you get bad ideas.

4

closes all other tabs

Dan Grossman

heh

goodnight man

Moshe

Night.

@DanGrossman - I will need that PHP end of the scraper again tomorrow, please.

Thanks, good night.

@Dan Did I really get a star for that?

Ugh.

Dan Grossman

Wasn't me ;)

Moshe

6:27 AM

?

Oh no, two stars.

Whatever

goes off to SO teach outsourcees how to make iOS apps

Benjol

@TimStone, you in?

Tim Stone

Of course. :) What's up?

Benjol

> There's definitely room for improvement, so this is something I'd be happy to discuss

I'm here now, if you want to discuss it now :)

Tyler Chacha

Go to sleep? it is only 10:30 PM!!!

Tim Stone

Ah. Is there any chance we can discuss tomorrow? :P

Dan Grossman

6:34 AM

Tyler Chacha

@DanGrossman is that suppose to show my time zone?

Dan Grossman

no

Benjol

@TimStone Nope, week-end :) Sometime next week then.

Dan Grossman

it's just a clock

It's 6:30AM JonSkeet Time.

Tim Stone

@Benjol Ah, fair enough. Alright, next week then. Sorry about that, I've committed myself to quite a few things tonight, so I want to wait until I can think more clearly about it.

Benjol

6:36 AM

@TimStone No problem at all. That userscript has got me back into the 'mood' for some js-stuff. And I'm a bit more comfortable with jquery now too

Tim Stone

Heheh :D

Tyler Chacha

This room depresses me. No one ever talks about anything interesting..

Yes, I know interesting is relative..

Dan Grossman

Our hour long chat about hacking wasn't at all interesting?

If you followed along you got a bonus telnet address for a MUD

Tyler Chacha

Telnet is like .. dead..

Dan Grossman

In what way? It's a utility, like ping or traceroute.

Tyler Chacha

6:40 AM

anyway, I'm going to bed

night

Moshe

@TylerChacha night Nippon

I find myself recommending ASIHTTPRequest to often. Is that a sign that it's awesome?

Dan Grossman

I'm half-black, half-white, and all SAMANTHA!

Tweeted by GayObama on February 24, 2011 at 9:52 PM

Michael Mrozek

7:00 AM

How does that person have a 9 hour old account with 6 tweets and 5000 followers?

Moshe

@MichaelMrozek accept pwns! ;-)

old twitter bug reopened? something else?

0

Q: Are Apple Human Interface Guidelines questions off-topic on SO?

I've seen questions like this one that have no coding implications per se, but revolve around Apple's HIG and as such can only be answered by developers. Are these off topic or not? Why?

discussion

Dan Grossman

@MichaelMrozek It's Jon Stewart, that's how.

Benjol

@DanGrossman, your google-fu is good, can you find anything for this guy?

0

Q: Is there a website like jsfiddle for mysql and for other database

It would have helped understanding a lot if there is a website like jsfiddle for databases

website

He wants to upload a database, then share queries on it with someone

Dan Grossman

I don't know of something like that

Reno

oh he is from nepal :)

thats a first for me

Dan Grossman

7:17 AM

Moshe

@DanGrossman So true.

Dan Grossman

Why are you still awake? :P

Moshe

@DanGrossman Answering and editing questions asked by the iOS coders overseas who get paid less than minimum wage to write apps.

You know, if we didn't help them, they'd be stuck and jobs would slowly begin to stay here in the States. :P

@DanGrossman - Okay, good night.

For real

Reno

@Moshe they get paid 2$ an hour compared to 55 in the states :o

i think 7.25 is the minimum wage in the usa

Moshe

@Reno Point is that many (BUT not all) of them are actually inferior coders. Those that aren't migrate elsewhere (US & elsewhere).

Reno

7:24 AM

no wonder everyone wants to outsource.

Moshe

@Reno b'lieve that is correct

@Reno People don't know the dark secret of outsourcing. SO users are actually writing the code for free by answering questions!

Reno

Yeah most of them arent inferior, I never said that, its only that we (stackoverflow) have to deal with the dumbass ones ._.

i know right .. circle of life

alright then good night :)

Moshe

Night

Yi Jiang

I don't know about you, but the new careers site's new logo looks to me like wireless signal bars

Benjol

7:39 AM

@YiJiang, a bit, yes, I dunno what it's supposed to represent - salary rising? :)

Dan Grossman

It's the SO logo bars growing in size, so clearly it represents a stack overflow in progress

Reno

7:57 AM

when is stackoverflow going to overflow already

Yi Jiang

Imgur is reporting this right now:

503 Service Unavailable
No server is available to handle this request.

Dan Grossman

8:15 AM

> Thanks to your support, Imgur has been growing rapidly for quite some time. Sometimes it's even hard to keep up with all the traffic! Unfortunately, a side effect of all this growth is that sometimes we must take the site down in order to push out upgrades and other improvements the service. This happens very rarely, but it does happen, such as right now.

Yi Jiang

Why did I elect to come home from school early today anyway? There's a construction site outside that's ridiculously noisy and it's really messing up my concentration

I *!@$% WANT TO SWEAR AT THEM!

Reno

then you should, they wont hear you over the noise anyway :)

Yi Jiang

@Reno I can shout really loud...

Anyway, I want to come back home to sleep >_< If I'd known it would be this bad I would be napping in the library instead

Benjol

8:35 AM

@YiJiang, if you care to look at my userscript and tell me everything that's wrong with my code, I'm keen to learn :)

Yi Jiang

@Benjol Sure, as always. It's on StackApps I presume?

Benjol

@YiJiang yup

Be gentle :) You can comment there, or here, or fork my code and correct it :)

I posted a bit on CodeReview already, nobody answered so far :(

Loïc Wolff

@Benjol link?

Yi Jiang

with_jquery(function ($) {
  $(function () {

Not needed in this case because GM scripts are always executed after document ready

Benjol

@LoïcWolff to which, script or code review?

Loïc Wolff

8:44 AM

@Benjol let's say both, I can't find either :)

Benjol

@YiJiang, I filched that from the chat script - or in any case the version I had to hand

Loïc Wolff

in my defense, I didn't have my first coffee ;)

Benjol

7

Q: Pro-forma comments for review [educating users before flagging]

About This script adds a little 'auto' link next to all comments boxes. Clicking on the link opens the dialog box below, which allows you to select some pre-fabricated comments which might be helpful for educating users before flagging their posts. Note that the dialog only inserts the tex...

script review

Yi Jiang

Also no need to place the template HTML in the with_jquery section

Benjol

1

Q: Date span and time period to pretty string

I have two javascript functions, one to turn a datespan into a 'pretty' string, the other to turn a time period into a pretty string. Similar context to Stack Exchange user profile (Member for: 1 year, 2 months. Last seen: yesterday) I don't like this code at all, but I don't want to make it t...

javascript refactoring

Yi Jiang

8:45 AM

Just split it out to keep the code inside that function clean

Benjol

@Loic, oh, someone did answer, weird that I didn't get notified...

Yi Jiang

No, wait, don't do that

Loïc Wolff

@Benjol it's daily, not live

Benjol

@LoïcWolff, nope, the inbox is 'live', of that I'm sure

Yi Jiang

God I'm a moron... you can't do that because the with_jquery section is ran in the browser space, while defining the other stuff in the script in the script itself would be sandboxed and thus not available

Loïc Wolff

8:46 AM

@Benjol right. I was thinking of the mail notification

Yi Jiang

        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')

Can be chained, and fadeTo can also be used

Benjol

@YiJiang, can you explain how chaining works in jquery? How do I know which object I'm getting out the end of each function call?

Yi Jiang

@Benjol If the function is not a getter (for instance, attr('something') or css('property')), then the object returned is always a jQuery object ready for another function to be run against

Benjol

@YiJiang, the same object that was on the leftside? so as long as I'm doing things on popup, it passes me popup back? Ok, that makes sense

Yi Jiang

@Benjol As long as the function you're calling is not a traversal or manipulation function, yes

      popup.find('.popup-actions-see').mousedown(function () {
        popup.css('opacity', '0.4')
        popup.find('.popup-active-pane').css('opacity', '0.0')
      });
      popup.find('.popup-actions-see').mouseup(function () {
        popup.css('opacity', '1.0')
        popup.find('.popup-active-pane').css('opacity', '1.0')
      });

Can be replaced with a single hover function

Benjol

8:51 AM

Good idea

Benjol

9:05 AM

Is there a good way to get stuff out of the scripts tab in chrome developer tools? I've just got a wall of text

Yi Jiang

@Benjol What do you mean by that?

Benjol

Click right here, Inspect Element, Click on Scripts, select master-chat.js in the drop down. It's all wodged together, and very difficult to select bits

I guess I can do ctrl-A Ctrl-C...

Yi Jiang

9:46 AM

I'm curious, what's a 'hard drive'? I thought it's always 'hard disk drive', but is the former an acceptable/common term?

Benjol

@YiJiang yes

Yi Jiang

Oh, I'd never knew that, hmmm...

Yi Jiang

10:09 AM

in JavaScript on Stack Overflow Chat, 15 hours ago, by Nathan

Reno

well well well

what do we have here

oracle certified professional

10:28 AM

tut tut tut

what a terrible joke

(this is my contribution for the day. hope you enjoy)

Reno

10:49 AM

terrible joke is terrible

Have a nice laptop free weekend!

user153011

11:09 AM

Hi! :)

balpha

11:57 AM

the second bullet here:

8

Q: Can we improve the automatic titling of links to internal URLs?

In an answer to this question: Can we have some linking etiquette and guidelines? I suggested that if a link is made to a related page on the TeX SE, the link text should be the document/question title. This provides much more information about the target link than "this question" or "here". Mu...

feature-request hyperlinks

should be working on meta now

please test

Tim Stone

You actually added that huh? Alright. :P

Oh wow.

Indeed it is, very nice @balpha

user153011

12:10 PM

    // ==UserScript==
    // @name         Upvote all posts
    // @description  Automagically upvote all posts. It can't be done with comments, because they have an one vote per 5 min limit.
    // @author       Nyuszika7H
    // @include      stackoverflow.com/questions*
    // @include      meta.stackoverflow.com/questions*
    // @include      superuser.com/questions*
    // @include      meta.superuser.com/questions*
    // @include      serverfault.com/questions*

Yi Jiang

12:21 PM

Mmmm.. strawberries

badp

Good morning!

Yi Jiang

Man, these things are even more expensive than avocados

Tim Stone

sighs

Yi Jiang

These beauties have to be flown in from Korea, gosh they are expensive... and good. Mmmhmmmm...

Benjol

@TimStone about strawberries, or user scripts? :)

Tim Stone

12:27 PM

Well, that second part too, but I was getting annoyed with this server more specifically.

Yi Jiang

@TimStone You need strawberries!

Tim Stone

Perhaps :P

Yi Jiang

What do you do when a twitter user name you need is 'squatted'?

in JavaScript on Stack Overflow Chat, 5 mins ago, by Ivo Wetzel

http://twitter.com/#!/JSGarden >_>

Not really squatted, just that some inactive user from a year ago happened to choose the same name as that website :P

Tim Stone

Break their shins!

Tim Stone

12:42 PM

People always creating more work for me mutters

Transcript for