Tavern on the Meta

Oh that's the firefox update. Shog changed the preference system around a bit maybe there was a side effect I didn't notice (because I reset mine manually a lot during dev).

But let me know if it ever happens again. Sorry about that.

Oh see I thought it was Shog but looks like we have the real culprit.

Elephant

Hack!

Jason C

@Elephant Can you do me a quick favor? Have you visited any other chat servers besides chat.mse since your prefs were reset?

Elephant

@JasonC no, I only chat here :/

Jason C

Did you visit any other chat servers before your prefs were reset?

Elephant

no either, I only chat here

Jason C

1:20 AM

Oh

Nevermind then. We're all MSE hermits.

Elephant

what's with the latest 3 programming questions on MSE...

user315433

Everything that matches ^Stack is understood as a kind of Stack Overflow.

user315433

Like StackSocial that we talked about recently.

user315433

Granted, Meta Stack Exchange does not quite match but nobody knows what "Meta" means, anyway.

Elephant

Thanks Oded...That was helpful. Because i was asked to sign up for Stack Exchange i thought it to be the same. — The Ultimate Wanderer 3 hours ago

probably insightful.. or not

user315433

1:35 AM

Computer Science Educators is approaching its Judgment Day... and is kind of slow, with 110 questions (101 excluding closed and downvoted).

Shog9

3:09 AM

@JasonC hey, I even tested it... Briefly... Eventually...

Jason C

I'm trying to make this other script FF compatible, too. It's driving me insane.

Surely this can't be standard boilerplate Greasemonkey stuff?

Shog9

@JasonC Are you trying to use the jQuery that's loaded onto the page again?

(because... well, actually...)

Jason C

Yeah. And I'm also experimenting with other FF techniques. I just tried doing the load/stores without intermediate events, storing internal functions in unsafeWindow.Whatever and calling them from the injected script, and FF gives me permission denied errors accessing properties of window.Whatever from the injected script. It's so obnoxious.

@Shog9 Yeah but trying to use GM_* complicates all that. That's the part that's killing me.

Use jQuery on page + GM_* functions. How is that not a common use case for GM?

Shog9

@JasonC yeah, that seems like something that'd be blocked - it crosses a privilege boundary.

There's no obvious way for you to know, in a function you define in privileged code, if it's being called from unprivileged code.

Jason C

I guess it makes sense, but, why not just make it more straightforward to use pre-loaded jquery from privileged code? Even stuff like window.$ = window.jQuery = unsafeWindow.jQuery appears to succeed but doesn't get it running.

Or maybe it does but GM doesn't show script errors on the console, which, come on.

Shog9

3:22 AM

@JasonC because that defeats the purpose of sandboxing in the first place

user202362

Is it possible to have a large green house, maybe 50 sqm - 100 sqm, then have a chicken coop inside and put maybe 2-3 chickens when the plant are at least 50cm tall? Is it a viable bio-system?

Shog9

If you don't use GM_ functions, you can completely sidestep this by setting @grant none; at that point your script needs no extra privileges and can be executed in the same context as the rest of the page.

Jason C

But it's jQuery, even a hard-coded exception for jQuery stuff would not upset anybody.

Shog9

Nothing stops code in a page from messing with the jQuery object (in fact, jQuery is designed to make this easy)

Jason C

Yeah, sure, but there's no reason it can't just be like a metadata thing, like @givemeaccesstojquery // Because I wrote this script and it doesn't matter at all if somebody else messes with the jQuery object, and that's up to me.

Shog9

3:25 AM

So, same problem as the DOM and even some built-in objects - if your code assumes they're un-messed-with, you can end up inadvertently opening up privileged access to code that shouldn't get it; it need only modify jQuery (or Object, or window.setTimeout, or...)

@JasonC well, that exists

@require ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js

bam - you have jQuery.

your own jQuery, loaded from the source you've specified, and available only in your sandbox

Jason C

Sure, but then you can't interact right with e.g. jQuery events and stuff on page objects because its a different instance.

Shog9

yeah, if you wanna interact with the jQuery on the page, you're best off just injecting script into the page.

Jason C

It's the same problem I had with the topbar's jQuery instance in its iframe when I was trying to click the dropdowns.

Blech

Shog9

Hey, look on the bright side - while searching for more info on this, I came across a question on SO:

4

Q: How to call Greasemonkey's GM_ functions from code that must run in the target page scope?

I asked a question and got an answer here: How to call this YouTube function from Greasemonkey? That code works and adds a button to the page, which captures the video time. But, the key part must run in the target-page scope -- where Greasemonkey's GM_ functions are not available. I want to us...

...I tend to think custom events are a lot cleaner than parsing out JSON

Jason C

That I agree with.

Shog9

3:33 AM

(That said, I have a script I use to run SEDE queries from SO userscripts - it works by loading SEDE into an iframe and then loading itself into that iframe as well, using postMessage to get around cross-origin blocks. A whole API for SEDE, wrapped up in JSON passed via postMessage)

Jason C

SEDE's already kinda got an unintentional API though.

It's just the captcha gets in the way. But aside from that it's actually a decent API.

Shog9

the critical bit there is accessing it from a page on Stack Overflow

no CORS headers

Jason C

Ohh

The window events seem just as dangerous though.

→ 5 messages moved to Chimney

Shog9

3:54 AM

@JasonC how so?

Jason C

Can't any other script dispatch those same events?

Shog9

@JasonC sure - a carefully-crafted script could modify the preferences for your top-bar.

Jason C

Just like a carefully crafted script could execute the privileged code I could hypothetically expose in an unsafeWindow object and... omg... modify the preferences of my top-bar?

Shog9

@JasonC the danger there is, if you had access to GM_ functions more dangerous than the prefs a script could end up using those too

Jason C

Right, but here's the thing. I can hypothetically do this:

// ==UserScript==
// @name        Sandboxing Test
// @namespace   com.glorylol
// @description Sandboxing Test
// @include     *
// @version     1
// @grant       GM_getValue
// @grant       GM_setValue
// @grant       unsafeWindow
// ==/UserScript==

unsafeWindow.SandboxingTest = {
  load: (key, def) => GM_getValue(key, def),
  store: (key, val) => GM_setValue(key, val)
};

let script = document.createElement('script');
script.type = 'text/javascript';
script.textContent = `(${Injected.toString()})()`

But that doesn't work, because you get a permissions denied error when the injected script tries to run window.SandboxingTest.load/store.

And that makes no sense to me. Because there I'd have just as much control as I would by defining window events. Except it's way less of a PITA.

Shog9

4:02 AM

yeah, in this particular example there's probably no real danger

and... I could imagine a sandbox implementation that vetted exposed functions somehow to make that work

but apparently, that's not how this one works

Jason C

That's my point, though. Most of the scripts I write, there's no real danger. I should be able to say: Hey FF, there's no real danger. So let me execute privileged things from unprivileged contexts, because I know it doesn't matter in this particular script.

I'm not against the sandboxing. I'm just anti- FF making decisions for me and forcing life to be difficult.

And it's silly because everybody seems to work around it with window events or whatever, which provides exactly the same risks as that snippet above would, except it's a pain. So why not just make it not be a pain...

Shog9

Eh; I usually work around it by just using localstorage

Jason C

There's zero difference in terms of sandboxing between the snippet above (if it was allowed) and window events for load/store.

Yeah...

That works too although the cross-domain stuff is nice.

Plus, at least on ff, it's kinda neat I guess because the GM_* things are all in sqlite databases that you can browse. Although I guess that serves no real purpose. But it's fun.

Shog9

You can hack that too, if you want... But then you're back to posting messages somewhere to get around cross-origin blocks.

Most of these annoyances can be summarized as, "if folks didn't abuse this stuff, it'd all be a lot easier"

Jason C

I'm kind of a firm believer that if kludgy workarounds are a really common use case, then you might as well just back down on your original ideals and make it easy.

I mean it's worse now. If it was easy at least people would know what they were doing. When it's a stupid workaround everybody's just copying and pasting crap they barely understand off of SO and blogs. I'm not sure which is worse in the grander sense.

Shog9

4:09 AM

think about how the web worked in the early '00s, back when IE6 was hot shit: very few restrictions, lots of ways to poke through the tissue-paper walls that did exist.

Jason C

Sure, I know.

Shog9

I mean, JavaScript was slow as mud, but other than that it was pretty convenient

Jason C

But at some point when you're so deep in paranoid design you've got to accept that you've done a pretty good job and start to back down a little.

Just a little.

The "be careful when pasting, type 'enable pasting' to paste this code" or whatever thing in FF was similarly ridiculous, although at least it wasn't a showstopper.

Shog9

and there again, the only reason they did that was folks on Facebook apparently being quite happy to paste whatever someone messaged them to paste, and getting all sad when they didn't have an account anymore & all their friends were spammed.

Jason C

Right but do you know why folks on Facebook were quite happy to paste whatever someone messaged them to paste?

Because they've been using paranoid, overly-dumbed-down software for 20 years and don't have even the tiniest clue of wtf is going on, through no fault of their own.

It's like OS X giving you a choice between "millions of colors" and "billions of colors". Then when somebody says "24-bit" you get scared. And when you have to work in a sane context you don't know what you're doing. And then UI designers make the software even dumber, because the people are "dumber", but they're the ones that made the users dumber in the first place.

And holy crap I did literally nothing of importance today.

A perfect Saturday of hobby coding and online ranting. Excellent.

Shog9

4:17 AM

eh, that quickly becomes a "this wouldn't be necessary if the world were completely different" argument. Those are fun in political discussions ("net neutrality wouldn't be needed if we had real competition! cue week-long dissection of the many nested reasons why we don't") but ultimately pointless - you either gotta make do with what you got, or live with the consequences.

Jason C

I know, I know.

That's why my reaction is generally facepalming rather than legitimate anger.

Mostly it's just... tragically hilarious. If you step back, at least.

user202362

how to use DDMS to find a particular file on a external device?

Jason C

Well at least I've got a full understanding of the boilerplate FF code now. I've decided to put uuid's in the event names to avoid namespace collisions. That's the one new strategy I got out of all this.

@Telkitty Isn't there some file explorer thingy? I'm not very familiar with it.

Shog9

@Telkitty sounds plausible at a glance, but I'm not quite sure how big 50 sqm is; maybe it's a lot smaller than I think it is. You might have to compost with mealworms to supplement the diet. Or, ask on:

Y'all should get with the program & use sensible units of measure. How many rods on a side is 50 sqm?

(not quite 2, if Google is to be believed)

user202362

@JasonC it's like trying to find a file on mini OS without a search function

user202362

4:24 AM

currently browsing the mini OS

user202362

That is android

user202362

@Shog9 usually chickens are kept outside where veges are grown

user202362

in the same green house

user202362

but if plants are tall then the chance of chicken eating the veges will be minimum

user202362

@Shog9 mealworm? I was thinking more earthworm

Jason C

4:39 AM

Lol, this move tool is kinda dangerous.

With one click I can get rid of everything Shog has said + every reply to him.

Jason C

5:58 AM

@rene @hichris123 stackapps.com/questions/7439/chat-move-helper-bot-cleanup-tool

Let me know if it's useful, or if you have any requests or suggestions.

rene

6:18 AM

→ 2 messages moved to Chimney

@JasonC test succeeded

Journeyman Geek

\o/

Elephant

8:40 AM

This morning I had a nightmare of doing something that could break the whole network of SE, but I couldn't remember it...

I guess it's related to DMCA (yeah, the anime.se case is in limbo), but the nightmare was worse than that.

Shadow Wizard

9:32 AM

delv-plz 20K Sigma meta.stackexchange.com/questions/297060/… needs one more so either @Bart or @rene

@Elephant you can't have nightmare in the morning, same way you can have breakfast in the evening. ;)

Reminds me of the beginning of the Hitchhiker's Guide though, just opposite. You happen to float above the ground a bit? :D

Journeyman Geek

a daymare?

an annoying post-wake up horribilus?

Shadow Wizard

morningmare is better ;)

This DMCA is.... terrible. I can't understand even a bit of it. :(

So good chance those who do understand it well enough can indeed take down any website with user submitted contents. :/

Journeyman Geek

lol

they don't need to understand it well

Elephant

@JourneymanGeek that question is weird. The link should only disable CMD. I don't understand why OP can't open RegEdit or Group Policy from Run dialog....

Journeyman Geek

they just need to get money from companies to spam companies...

@Elephant yup

Shadow Wizard

9:40 AM

@JourneymanGeek just flood the site with DMCA requests?

Journeyman Geek

but cripes, back ups are good

@ShadowWizard that's CLEARLY what these guys do.

Automated keyword based DMCA requests

Elephant

9:52 AM

@JNat any update on Anime.SE DMCA case?

Journeyman Geek

10:04 AM

0_0

rene

11:01 AM

@ShadowWizard Yannis got it ...

rene

12:07 PM

I have raised a flag on Stack Overflow to get a username/password redacted. Given it is a slow Sunday, if you have a moment, can you please handle that flag if no SO mod got to it yet.

Shadow Wizard

12:29 PM

@rene Yan who?! ;)

Didn't know he's still around.... really blast from the past... :D

@rene better ping someone, no?

Jason C

NOBODY MOVE THE SMOKEY MESSAGES LET ME DO IT OMG STACKAPPS PHOTO OP TIME WOO HOO

Journeyman Geek

lol

I'm not an RO. I cannae do nuffin.

rene

Maybe, yes. @Oded can you handle my latest custom redact flag on SO or ping an SO mod to do so.

Moves transcript

I'm afk

Elephant

> STACKAPPS PHOTO

I don't even.

Jason C

→ 16 messages moved to Chimney

hee hee that's so satisfying

Elephant

12:41 PM

Just now.. I was invited to the Chimney!

Jason C

Wait what?

By me?

Shadow Wizard

@JasonC yup. When moving messages, it cause auto invitation to the target room.

(but no ping or notification, so it "works" only if user is online in chat.)

Jason C

Eh

Elephant

same case

Now I know how often Smokey has been invited to there...

or.. can deleted post be moved?

Jason C

@Elephant Well, you only get the invite if the room is public, rather than gallery mode, and up until last night, chimney was gallery mode.

Should I make it be gallery or public for this test?

Elephant

12:47 PM

ah, I see..

how about public first?

Jason C

→ 1 message moved to Chimney

Elephant

still invited... apparently only gallery mode works

Jason C

→ 1 message moved to Chimney

Elephant

okay, no invitation

apparently, on the first test, my comment was just moved, but not deleted first?

Jason C

It doesn't get deleted when you move it.

Elephant

12:54 PM

Now, if you delete it first, then move it, what will happen?

Jason C

It should stay deleted

I can't delete your messages

→ 1 message moved to Chimney

Elephant

Okay, I thought RO can delete comment if it's considered inappropriate. Perhaps it needs to be flagged first.

Jason C

Yeah RO's don't have that kind of power, only mods and CMs. It needs to go through flagging otherwise.

Elephant

Oh well, at least gallery mode works.

Jason C

Lol, my poor cat; my old cat was a hairball pro, they just popped right out. This one, she has a hairball like once every 6 months, and when she does, it's the most traumatic experience ever for her.

And also they're like half the size of her body.

Shadow Wizard

1:03 PM

@Elephant RO can see deleted messages, and delete using AJAX, there's no UI for this.

@JasonC they have. Write something in the Den or sandbox and I'll delete it.

(2 minutes limit applies though)

Jason C

Really??

Jason C

1:43 PM

→ 23 messages moved to Chimney

Jason C

2:00 PM

→ 4 messages moved to Chimney

Journeyman Geek

hm

1

Q: Cross-site question association

We have already working association mechanism between StackOveflow in Russian and StackOverlow in English. Something like this Text translation: This question has answers on StackOverflow in Russian. [link to associated question]. More about this. My suggestion: I suggest to extend the sam...

feature-request site-crossover cross-pollination

this seems new

Jason C

I like it

user315433

2:15 PM

Urban Legend or Best Practice: Teaching XSLT in the Age of Stack Overflow -- the article begins on page 89 of this PDF, it's the last one.

user315433

> People asking on stack overflow are rank beginners, the folks answering are not much better. - Gibson @xmllondon -- Deborah A. Lapeyre at 5:03 AM - 11 Jun 2017

user315433

(This is from the talk based on said article)

rene

@JasonC socvr.org/…

Jason C

@rene Btw, stackapps.com/questions/7442/ro-chat-message-delete-option, apparently that's possible, decided to put it out in the wild.

rene

2:33 PM

Oh, cool. That is a bug though ... open for abuse

Jason C

Yeah...

I'm on the fence about reporting it. Not because I don't want to "expose" it, but because I can't decide if it's actually a bug or not.

Shadow gave a decent argument that it gives ROs the ability to quietly deal with immediate problems for a very short time before having to resort to the flagging system.

On the other hand there appears to be no UI for it.

rene

Just wait for the first report on Meta where an RO deleted an message of a user ...

We can try it here on @Telkitty and then blame the SE Troll script ...

Shadow Wizard

@rene nope. Not a bug. Useful way for room owners to clean a mess before having to involve moderators.

Jason C

Well I figured exposing an easy UI to everybody was a good compromise. If it's a non-issue, then yay, easy feature. If it's an issue, it'll be brought to the forefront. Like exposing an exploit.

Shadow Wizard

Now that it's out in the open it might be over-used/abused, and be removed though.

Jason C

2:37 PM

Yeah

But I think putting it in the open is the right thing to do.

Sorry if it bummed you out, lol.

Shadow Wizard

Hope it won't suffer same fate as chat translation by Feeds.

Then any AJAX request to delete will be responded with "That's why we can't have nice things".

@JasonC nah, never really used that feature, lol

Just know it exists.

Like a muscle that is rarely used.

rene

Ok, name all other you things you know exist and I don't ....

Shadow Wizard

Aliens

rene

What, srsly? Cool!

Shadow Wizard

of course

And they helped Trump be elected, not Russia. :D

Jason C

2:40 PM

@rene I have a small pimple on my right butt cheek. It exists.

Shadow Wizard

Plot twist: Trump is an alien!

@JasonC pic or it never happened.

holding finger over flag button

Jason C

Hell no. I've never seen that part of my body with my own two eyes and I don't intend to look at it indirectly, either.

Shadow Wizard

@JasonC selfie is easy.

Jason C

I NEED AN ADULT

Shadow Wizard

and you still won't really see it with own two eyes :D

@JasonC why? To change diapers? :P

Jason C

2:42 PM

No, to protect me from online pervs demanding semi-nude pics.

Shadow Wizard

My 4.5 y/o son asked few days ago if he can wear diapers, and if he can, will we let him change himself. lol

Of course, natural reaction to seeing his baby sister changed every day.

Jason C

Lol

HAHAHA ABUSE!

Shadow Wizard

flagging

Jason C

On second thought, maybe I should file a bug report, lol.

Shadow Wizard

calling Shog

crying

rene

2:45 PM

flags room

Jason C

#FlagThePlanet

Shadow Wizard

#flagDemAll

Jason C

I should go outside.

I will go outside. This is so happening.

I am now going outside.

Shadow Wizard

watching how @Jason fights himself, lose, and stay inside

BTW @Jason with 10k on MSE you can have some use of this spam! meta.stackexchange.com/questions/253020

oops wrong spam lol

Jason C

I am outside.

rene

2:53 PM

I'm inside, at my Dad's house

Elephant

I'm beside someone.

user315433

I'm beside myself.

Elephant

!?

Shadow Wizard

3:09 PM

I'm outside myself.

@rene who is your dad?

!!/whois @rene's dad

SmokeDetector

@ShadowWizard That is not a user level I can check. I know about admin, code_admin

Shadow Wizard

rofl

Jason C

I am no longer outside.

Shadow Wizard

whoa, is this a secret command? :D

Jason C

I should make a PR to alias "your daddy" to "admin" there.

Shadow Wizard

3:11 PM

lol

buh

rene

@ShadowWizard a sunflower

user202362

3:40 PM

@rene TIL there are SE troll script, script specially written for trolls ... I am touched ...

Jason C

3:57 PM

→ 157 messages moved to Chimney

YES!

Totally crushed hichris' record. (Man he's not even pingable here any more).

That was incredibly satisfying.

Read it and weep, hichris

← 1 message moved from Chimney

Elephant

yesterday, by rene

Prepares for complete transcript to be gone due to broken RegEx

Jason C

Hm, I should make the autoselect script exclude messages less than a certain age, to keep context for recent smokey conversations / unflagged spam.

I wish the chat messages included actual timestamps somewhere.

Elephant

Hm, why I suddenly feel our existence is threatened here. One misclick and our existence is gone :)

@JasonC you need this userscript though

(I thought I have this discussion before when you're scraping the chat message)

Jason C

Oh yeah I've seen that I haven't tried it yet but it looks freakin' cool.

Also TIL you can apparently make really nice looking home pages on github

rene

6:26 PM

@JasonC that is why the archiver script used in SOCVR checks the post via an API call to see if the post is still live. If not (or in case of SOCVR if the post is closed) the cv-pls is moved to the graveyard.

Jason C

That's a good idea.

Problem is I made this to be kind of general instead of super smokey-specific. I'd have to change my philosophy about it a little if I wanted to add that.

rene

Yeah, I see that

If you need inspiration: github.com/SO-Close-Vote-Reviewers/UserScripts/blob/master/…

user315433

The elementary OS review queue is kind of slow... I have a pending NAA flag since May 30, and it's on a blatant non-answer... :(

user315433

At least spam doesn't last due to Smokey.

rene

do they even have users with access to the queues?

Yeah, a couple ...

user315433

6:34 PM

They do... it only takes 1K on a beta. But do they review? elementaryos.stackexchange.com/review/low-quality-posts/stats

user315433

And it takes 6 of them to get rid of a post.

rene

First non-mod seems to do that: elementaryos.stackexchange.com/users/578/…

user315433

On SO it only takes 4 recommend-delete reviews. And apparently it works okay.

user315433

So... extend to the rest of network?

rene

Yeah, assuming beyond SO there are also sane reviewers

Elephant

7:00 PM

@Guero probably rolling limit for beta site depending on eligible reviewer: 3 to 6. But I think SE doesn't really like rolling limit.

rene

7:43 PM

Can I get hold of a datadump of 2010?

Or maybe more precise: Can I know what the data model looked like (including column types) for the dump?

Don't really find what I need here: meta.stackexchange.com/posts/2678/revisions?page=3

Oded

8:03 PM

34

A: All Stack Exchange data dumps

Release BitTorrent Infohash and Download Link2009 May ea45080eab61ab465f647e6366f775bf25f69a61 2009 June 68d22f0f856ca5056e009ac53597a66c0cb03068 2009 July 2dca38c1c9724462ad4cedb42a1569805ab80f0c 2009 August d348861b6d72c280f299e03fe9f9e8f3258eff19 2009 …rerel...

No guarantees about seeders though.

rene

I'll give that a try, thanks

rene

8:23 PM

The seeders are the problem. There are non/not many

Jason C

9:41 PM

Which one of those looks better?

I'm giving the option for all three (as well as no icons at all) I'm just trying to decide on a default.

John

The middle one looks the best in my opinion.

Jason C

I've been gravitating towards that one, too.

Yeah, I think that one's gonna be the winner of the default award.

user315433

10:25 PM

There is a fairly obscure math term "strong n-mean" that I wanted to learn about. Google interprets it as "strong 'n mean" ... so the results are not what I wanted.

2

Jason C

Haha, awesome.

Warrior queen, strong n-mean.

Transcript for