Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Null

popey.com

Post reply on HN
Print view View original

81–90 of 196 posts

Re: Null

#81

Post by will0 »

scoutt wrote: post #77
xyst wrote: post #11

People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",

I can get why testing for "Jimmy Clitheroe" and "Horniman Museum" , but can't make a reason for "Linda Callahan" .

Perhaps it's 'allah'?

Re: Null

#82

Post by capableweb »

bhrgunatha wrote: post #23
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

A favourite technique of one of my colleague's was just to mash the keyboard randomly to see if the app breaks. It's very crude and not at all foolproof. For the lack of sophistication it's shockingly effective at highlighting a huge amount of assumptions we make about how software is / can be used.

This even has a name, "monkey testing". Basically some software that pretends to be a monkey in front of a computer and mashes random buttons and keys to make the application behave badly. Usually you only care about the application not breaking in monkey tests. Can be used similarly to "fuzzing" but for UIs as well, see Gremlins.js: https://marmelab.com/blog/2020/06/02/gremlins-2.html

Re: Null

#83

Post by pjc50 »

msh wrote: post #28
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

If I pour water in my gastank and it gives me the private social media posts of a million people, that might be a problem for more than just me.

Re: Null

#84

Post by rakoo »

msh wrote: post #28
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

If you look at the bugs in the article, they're not that foolish. They're basically perfectly valid things to be able to do: entering text in a text field, or pressing buttons to do things. There is a specific set of valid input for your gas tank, but anything that is text should be accepted for text input.

The analogy would be something like that:

- if I throw spaghetti on my windshield, my car shouldn't break down

- if I hold the wiper's stick to the position that runs it once (instead of putting it in the position to continually run) my car shouldn't break down

Re: Null

#85

Post by Cyykratahk »

m463 wrote: post #57
xyst wrote: post #11

People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",

what a great github repo. I enjoyed: # Strings that may occur on IRC clients that make security products freak out DCC SEND STARTKEYLOGGER 0 0 0 and everything under: # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some tests.

The text was flagged as malicious because of its presence in the repo github.com/wireghoul/htshells [3]. However, the whole point of the word in the htshells repo is that it's an invalid command that breaks Apache, so it could have been almost any random string.

[1] https://github.com/search?q=arglebargleglopglyf&type=issues

[2] https://mume.org/help/arglebargle

[3] https://github.com/wireghoul/htshells/blob/master/dos/apache...

Re: Null

#86

Post by jerrre »

jack_riminton wrote: post #64

I know finding bugs is undeniably a good thing but I can't help but feel someone as obviously bright as this should be making more things It's like the people who spent a lot of their time finding ever more pedantic inaccuracies and continuity errors in films. The mute LED on your thinkpad sometimes goes out of sync? fascinating

Not everyone feels it's their moral right to be as productive/effective as possible.

Re: Null

#87

Post by jack_riminton »

raziel2p wrote: post #74
jack_riminton wrote: post #64

I know finding bugs is undeniably a good thing but I can't help but feel someone as obviously bright as this should be making more things It's like the people who spent a lot of their time finding ever more pedantic inaccuracies and continuity errors in films. The mute LED on your thinkpad sometimes goes out of sync? fascinating

What gives you the impression the author doesn't also make things?

I know they do

But it just reminds me of this: https://youtu.be/2Z8pgV74_Hw?t=148

Re: Null

#88

Post by ChrisMarshallNY »

That’s a fun article!

I’m big on Quality. Comes from 27 years, working for a corporation that is pretty much synonymous with the word.

“Abuse testing” is very important, and almost impossible to automate. A good monkey tester will have a “sense” of where to go, as this chap indicates.

I worked with an enormous team of people like this, and they would regularly find things like sync bugs (he talks about one). Those take a lot of work (and RSI risk) to find.

Re: Null

#89

Post by gfxgirl »

msh wrote: post #28
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

maybe not relevant here but my first thought to your question out of context is scale. My house can be easy entered by anyone determined to enter it. They can bust the door down, break the windows, crash a vehicle into it. And yet, almost no one is actually trying to get into my house. Conversely, 1000s of people and possibly hundreds of thousands of bots are trying to break into any software they can that is exposed on the internet (or possibly exposed in other ways like I have no idea if every app on my PC/Mac/Phone/Tablet is scanning my network for devices with known exploits)

So, the security of my house (at least where I live) does not have to be so resilient but the security of much of my software does.

https://www.youtube.com/watch?v=VPBH1eW28mo

Re: Null

#90

Post by chowells »

capableweb wrote: post #82
bhrgunatha wrote: post #23

Earlier quoted context omitted.

A favourite technique of one of my colleague's was just to mash the keyboard randomly to see if the app breaks. It's very crude and not at all foolproof. For the lack of sophistication it's shockingly effective at highlighting a huge amount of assumptions we make about how software is / can be used.

This even has a name, "monkey testing". Basically some software that pretends to be a monkey in front of a computer and mashes random buttons and keys to make the application behave badly. Usually you only care about the application not breaking in monkey tests. Can be used similarly to "fuzzing" but for UIs as well, see Gremlins.js: https://marmelab.com/blog/2020/06/02/gremlins-2.html

You could use a fish, too: https://www.dexerto.com/pokemon/pokemon-fans-pet-fish-discov...
Post reply on HN