Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Edabit – Like Duolingo for Learning to Code

edabit.com

Post reply on HN
Print view View original

101–110 of 134 posts

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#101

Post by anonytrary »

olooney wrote: post #48
anonytrary wrote: post #24

I don't understand how this is different from Hackerrank/Leetcode or how it's similar to Duolingo. Can someone explain what the innovation is here over HackerRank or LeetCode?

The claim of similarity to Duolingo seems to be based on the "Practice" tab, which let's you re-solve problems you've already solved once. Duolingo and similar apps use spaced repetition[1] to reinforce lessons which is proven to help retain them permanently in long term memory. However Edabit doesn't seem to implement a very complete system so it probably won't be particularly effective. I also doubt space repetitio…

This is exactly what I was looking for, thanks!

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#103

Post by anonymousJim12 »

adrianmonk wrote: post #100
anonymousJim12 wrote: post #41

Earlier quoted context omitted.

It's obviously running in a container. I'm not sure your code really shows anything too concerning if they are taking precautions outside of the container to mitigate things like DDoS etc.

Breaking out of a container isn't the only security worry. They have a "Register" button at the top right where you can enter a username and password. If you have shell access to the box (no matter how virtual the box is), there's a good chance you can alter the site's code and capture the passwords people enter. And knowing that, in the real world, people do reuse passwords, this could easily lead to compromising ac…

Even if the containers were running on the same physical machine as the webapp you'd have to break out of the container your code is in first... If you know of a container breakout exploit then you should definitely publish it!

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#104

Post by dc_gregory »

leifmetcalf wrote: post #84
xtrapolate wrote: post #78

Earlier quoted context omitted.

> "How does the url http://redacted/ work?" I apologize for the confusion. I used an actual server there (ie. http://somename.com ) but chose to redact the actual URL from this post.

Ah, that explains it. The link actually works, though.

Not for me! Might want to ask your ISP whats going on?

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#105

Post by baby »

anonymousJim12 wrote: post #51
xtrapolate wrote: post #43

Earlier quoted context omitted.

Getting an exorbitant bill from DigitalOcean after someone has abused your "containers" would not concern you then?

I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?

For one you can now use this page to spam other services.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#106

Post by baby »

anonymousJim12 wrote: post #103
adrianmonk wrote: post #100

Earlier quoted context omitted.

Breaking out of a container isn't the only security worry. They have a "Register" button at the top right where you can enter a username and password. If you have shell access to the box (no matter how virtual the box is), there's a good chance you can alter the site's code and capture the passwords people enter. And knowing that, in the real world, people do reuse passwords, this could easily lead to compromising ac…

Even if the containers were running on the same physical machine as the webapp you'd have to break out of the container your code is in first... If you know of a container breakout exploit then you should definitely publish it!

a container is not about security, I don't think docker made any claim that you can't easily escape from a container.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#108

Post by MadcapJake »

pvg wrote: post #92
anonymousJim12 wrote: post #89

Earlier quoted context omitted.

remote code execution doesn't really mean much in an un-privileged container. They could be using cgroup limits, capability drops, MAC, seccomp, etc etc Now, I'm not saying that containers are super tight by default. It is entirely possible this particular container env is wide open, but I didn't really see anything too concerning from the parents analysis.

remote code execution doesn't really mean much in an un-privileged container. It means pretty much everything. Have you ever heard of someone reporting an RCE in a major service and it being treated as no big deal? They're invariably treated as catastrophic compromise because it is. The jump from RCE to privilege escalation, escape, etc is nothing compared to the actual RCE-ing.

when the platform is itself about RCE... I think you have to evaluate what specific dangerous code can be executed before you start lighting the torches.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#109

Post by tptacek »

pvg wrote: post #85
anonymousJim12 wrote: post #51

Earlier quoted context omitted.

I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?

Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What do you mean? It's an arbitrary RCE - a scenario that's generally treated as game over. What specifically are the concerns you don't have if that happens to a system of yours?

In a very carefully configured container regime, you might not be getting anything other than the access the API already had to run code submitted by users. You'd have RCE, but your code can only do the limited set of things permitted by the container; it might not have access to any meaningful filesystem, or to the network, or to the container engine.

It's very tricky to create and maintain those kinds of container systems, but there are services (for instance, the cloud CI providers) that do it.

On applications like these, where the premise is that you give them some kind of code and they evaluate it for you, escaping the "user interface" sandbox isn't game over; you'd have to finish the exercise of escalating to the container host or getting access to an internal network with internal APIs on it.

It's a little like getting SQL injection, but confined to some kind of SQL view. Chances are the application is doomed, but you still have to prove it.

Re: Show HN: Edabit – Like Duolingo for Learning to Code

#110

Post by yjhoney »

plumdot wrote: post #81
yjhoney wrote: post #76

Having taught people coding for awhile, I don't think the step-by-step teaching models work with coding. It creates an environment where students just think about the next step without internalizing what they learned. I've met students who have gone through freecodecamp's exercises and really struggle with using what they learned. Edabit seems too heavily on algorithms. I've seen many beginner students get quickly bu…

How do you teach? As an instructor at a school or tutoring on the side?

I work with my local library to hold coding office hours

(Should be very easy to set up, they really want to become more technically savvy but the only volunteers they could find is instructors trying to teach microsoft word)

I have my own curriculum that I've built over the years and the students ultimately end up building a product that they launch (hopefully). This year I got to teach 20 students and so far 14 have gotten full time jobs as software engineers. Fortunately, students who got jobs are all doing well at their jobs so its pretty easy to refer people in.

After the remaining 6 students get a full time job, I plan to open source my curriculum that students have helped polish over the years. You can find the gist of it at c0d3.com

Post reply on HN