Earlier quoted context omitted.
I tried to draw an eel, and when I was done I realized that all I'd done was draw a very orange, toothed penis.
is this a reference to the new South Park episode? (sorry)
I don't think so, he said "long" lol
181–190 of 247 posts
Earlier quoted context omitted.
I tried to draw an eel, and when I was done I realized that all I'd done was draw a very orange, toothed penis.
is this a reference to the new South Park episode? (sorry)
I don't think so, he said "long" lol
The leaderboard is fascinating. Some people are clearly putting a lot of time into this, while the rest of us are trying to sneak phallic shapes past your CNN. 1. https://drawafish.com/rank.html?userId=1753510318634_cdeh6a4...
Ok there's some sort of bot war going on with the leaderboard, right? The Palestine fish has 370,000 votes total (both up & down), which seems like a lot. Does HN really drive that kind of traffic??
Somewhat interesting thing with my 9yo. She's a pretty good artist, she can draw various characters and objects pretty well. With this she clearly just wanted to do the standard stick fish shape, but it turns out she only knows how to do it facing left. Facing left, looks typical, facing right, almost a figure 8. So after like 6 attempts being judged by the computer she's getting frustrated, and I'm like how about th…
I waited for my fish. But it never came. Made me sad.
[flagged]
All other submissions have score approximately equal to number of likes.
Is the first submission legit or the result of hackers?
> exercise in vibe-coding The code shows it... Your escaping routine seems OK, but you really __should not__ be building HTML and JS(!) using raw string interpolation. Or letting the client decide whether the submission needs moderation.
To be fair, everything on the client is raw string interpolation. It's only secure if you comprehensively vet everything once it's on the server.
When you set element.textContent = someUserGeneratedContent, the browser guarantees that the user-generated content will never be parsed as HTML.
response.write("" + sanitize(someUserGeneratedContent) + "") has no such guarantee.