Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Edabit – Like Duolingo for Learning to Code

edabit.com

Post reply on HN
Print view View original

51–60 of 134 posts

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#51

Post by anonymousJim12 »

xtrapolate wrote: post #43
anonymousJim12 wrote: post #41

Earlier quoted context omitted.

It's obviously running in a container. I'm not sure your code really shows anything too concerning if they are taking precautions outside of the container to mitigate things like DDoS etc.

Getting an exorbitant bill from DigitalOcean after someone has abused your "containers" would not concern you then?

I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated.

What specifically are your concerns? What about what you've learned will create an exorbitant bill?

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#52

Post by WestCoastJustin »

xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

For anyone else who runs into this. You can restricted a set of capabilities each container can use. This, for example can deny mount operations, socket access, etc. You can do this via "docker run" --cap-add or --cap-drop [2]. This type of stuff is great for running docker-in-docker for these types of learning tools or Jenkins builds. You'll need to play around with it though to make sure it'll work for you.

For a real-world example check out http://play-with-docker.com as they are running docker-in-docker and all the backend code is at https://github.com/play-with-docker/play-with-docker. So, you can likely get ideas from what they are doing to lock down their env.

[1] https://docs.docker.com/engine/security/security/#linux-kern...

[2] https://docs.docker.com/engine/reference/run/#runtime-privil...

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#55

Post by djaychela »

I like this for what it is - so far, fairly simple things to do in Python. I'm a beginning programmer (been studying about a year), so I'm happy to spend a bit of time going through these and feel OK about passing the tests - certainly the other 'code golf' sites that have been mentioned elsewhere in this site have been a love/hate thing for me, with some really out-of-character difficult exercises leading to frustration and a complete stop.

One constructive suggestion - is it possible to add auto-indenting to the editor for Python? I hadn't realised how used to it I have become until it is missing here...

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#56

Post by zapzupnz »

i_am_nomad wrote: post #25
xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

And this also illustrates why Apple forbids any kind of iOS app that lets a user write and execute code.

Except that hasn't been true for years in certain circumstances, particularly where the value of an app running user-created code is educational in nature. See Pythonista, Codea, Swift Playgrounds, or hell, Shortcuts.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#57

Post by ocfx »

crispyambulance wrote: post #14
gammateam wrote: post #11

so you'll get a bunch of random things to memorize with no explanation of the concepts supporting them?

I think the key thing is that these are exercises. People learn by seeing examples and solving problems with gradually increasing difficultly. This appears to be an arena for doing just that. Concepts and theory are certainly critical, but one needs to practice in order to achieve mastery. The conceptual framework for all this stuff is covered in detail in other resources, anyway. After taking a cursory look around,…

There are a ton of apps already that do this. What is edabit bringing to the table that codewars or any of those other sites is not? IMO they are bringing nothing different to the table or it's too subtle to matter.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#58

Post by simias »

anonymousJim12 wrote: post #51
xtrapolate wrote: post #43

Earlier quoted context omitted.

Getting an exorbitant bill from DigitalOcean after someone has abused your "containers" would not concern you then?

I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?

You're right but the fact that he was able to curl a file from the outside does seem pretty bad. It means that you can effectively proxy traffic through the website and use it to target 3rd parties.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#60

Post by saagarjha »

zapzupnz wrote: post #56
i_am_nomad wrote: post #25

Earlier quoted context omitted.

And this also illustrates why Apple forbids any kind of iOS app that lets a user write and execute code.

Except that hasn't been true for years in certain circumstances, particularly where the value of an app running user-created code is educational in nature. See Pythonista, Codea, Swift Playgrounds, or hell, Shortcuts.

Shortcuts, and Swift Playgrounds even more so, have been granted private entitlements by Apple to function.
Post reply on HN