Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Graphing when your Facebook friends are awake

defaultnamehere.tumblr.com

Post reply on HN
Print view View original

171–180 of 200 posts

Re: Graphing when your Facebook friends are awake

#171

Post by simonw »

BinaryIdiot wrote: post #60

> If you reload the page you’ll see approximately fifty-bajillion network requests go off as Facebook desperately tries to load all the junk that it needs to display facebook.com. I like this part. As a developer I've often looked at the network usage of large websites / web applications and it's always surprising to me just how...unoptimized it is as far as network connections go. I mean Facebook loads decently enou…

"I mean Facebook loads decently enough and all I'm just surprised the first load isn't condensed into a small, handful of network calls to save on latency."

Actually it is: https://www.facebook.com/notes/facebook-engineering/bigpipe-...

Re: Graphing when your Facebook friends are awake

#172

Post by notliketherest »

swampthinker wrote: post #29
542458 wrote: post #3

Some people might take issue with it, but the writing for this had me in stitches. I very much agree with the author on graphing libraries - there are a few good simple ones, but as soon as you want anything unusual you have to jump to these big, hard to configure monstrosities. More than once I've just given up and written my own server-side generator.

What's striking about this writing style is that (as a junior dev) it's a lot easier to understand what he's doing. By sticking to jokes and a simple style, I never felt confused or lost in lingo.

Do yourself and your career a favor and never refer to yourself as a junior dev ever again.

Re: Graphing when your Facebook friends are awake

#173

Post by nothrabannosir »

ascorbic wrote: post #156
nothrabannosir wrote: post #113

Earlier quoted context omitted.

Good point. Minor nitpick: I believe this is called CSRF, not XSS? But Im just repeating stackoverflow comments at this point.

No, CSRF (cross-site request forgery) is where a page tricks your browser into making requests to another domain in which you're already authenticated, in order to perform some kind of action. e.g. an img or script with a src " http://example.com/message.php?message=you+are+hax0red&s... . You can sometimes perform similar tricks with self-submitting hidden forms, or XHR. Quite easy to mitigate using nonces and re…

But.. that's exactly what while(1); and friends in json responses protect you against? someone overriding the Array constructor function and including your JSON resource from a ? So this is, in fact, CSRF?

Re: Graphing when your Facebook friends are awake

#175

Post by buremba »

k-mcgrady wrote: post #150
mcintyre1994 wrote: post #148

Earlier quoted context omitted.

There's a subset of my Facebook friends, mostly older/family who are slow to reply to messages on Facebook and only use Facebook in 'down time' or whatever but are available by text all day. Since they got smartphones years ago, by text has meant by Whatsapp.

The way I was looking at it was people will get messages on WhatsApp but won't reply immediately. Same on Facebook. But people will also visit Facebook.com when ignoring messages so you still get online status info even if they aren't specifically using the chat. If you could look at WhatsApp and Facebook and combine the data you'd probably get a really accurate overview.

Yep, I thought the same thing.

Re: Graphing when your Facebook friends are awake

#176

Post by buremba »

cavDXF wrote: post #155
buremba wrote: post #30

It would be real creepy if someone does the same thing for Whatsapp, you can even predict who's talking to each other much better than Facebook. It's a bit harder to collect data from web.whatsapp.com because it's using Websockets but let me know if someone develop such tool and publish it on Github. :)

You mean something like this? https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/wikis/ho...

Yep, I searched on Github but couldn't found. Using Gitlab makes sense considering Github is strict about legal issues.

Re: Graphing when your Facebook friends are awake

#178

Post by jfroma »

test1235 wrote: post #142
seba_dos1 wrote: post #127

Earlier quoted context omitted.

It's called PhantomJS :P

What? You don't already have it installed?

Note: you can use apt-get install npm and npm to install phantomjs which is not a node.js program but for some reason is on npm, or you can just rent an entire AWS region to compile phantomjs from sources in your preferred linux distribution.

Re: Graphing when your Facebook friends are awake

#179

Post by sytse »

buremba wrote: post #176
cavDXF wrote: post #155

Earlier quoted context omitted.

You mean something like this? https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/wikis/ho...

Yep, I searched on Github but couldn't found. Using Gitlab makes sense considering Github is strict about legal issues.

Just so you know, at GitLab we will not hesitate to take down content that we think is illegal or has other issues. At this point I think that WhatsSpy is acceptable but we reserve the right to change our mind.

Re: Graphing when your Facebook friends are awake

#180

Post by ascorbic »

nothrabannosir wrote: post #173
ascorbic wrote: post #156

Earlier quoted context omitted.

No, CSRF (cross-site request forgery) is where a page tricks your browser into making requests to another domain in which you're already authenticated, in order to perform some kind of action. e.g. an img or script with a src " http://example.com/message.php?message=you+are+hax0red&s... . You can sometimes perform similar tricks with self-submitting hidden forms, or XHR. Quite easy to mitigate using nonces and re…

But.. that's exactly what while(1); and friends in json responses protect you against? someone overriding the Array constructor function and including your JSON resource from a ? So this is, in fact, CSRF?

No, CSRF isn't about pulling scripts etc from another site, it's tricking the browser into making malicious HTTP requests. So, it's not trying to grab facebook .com/someinterestingdata.json, it's trying to trick your browser into performing actions on the target domain by making it perform GET or POST requests such as sending Facebook spam. It doesn't matter what the response is, it's just interested in the action. A while(1) won't do much if it's inside an img tag or hidden iframe rather than a script tag.
Post reply on HN