Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Anime CLI?

github.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: What Anime CLI?

#21

Post by bawolff »

laumars wrote: post #10
kornbattery wrote: post #7

The message >NOTE: MAKE SURE THAT YOUR LINKS ENDS WITH .IMAGE_FORMAT AND DOESN'T HAVE ANY & CHARS AFTER BECAUSE THIS SYMBOL IS RESERVED BY GOLANG Makes me a bit uncomfortable with it. Shouldn't input sanitization be one of the first things to consider when doing user-facing applications?

The file names are ingested as a string so there is no way they’re being interpreted by the Go runtime (and in fact, Go being a AOT compiles language rather than a dynamic one means it wouldn’t be possible for file names to conflict like described in the readme). This suggests to me that the author is misunderstanding why ‘&’ causes POSIX shells to do weird things. I think what’s happening is the author tried a web U…

So in other words, OP's gut "Makes me a bit uncomfortable" is an understatement.

Re: What Anime CLI?

#22

Post by bawolff »

mlex wrote: post #11
kornbattery wrote: post #7

The message >NOTE: MAKE SURE THAT YOUR LINKS ENDS WITH .IMAGE_FORMAT AND DOESN'T HAVE ANY & CHARS AFTER BECAUSE THIS SYMBOL IS RESERVED BY GOLANG Makes me a bit uncomfortable with it. Shouldn't input sanitization be one of the first things to consider when doing user-facing applications?

I don't get this concern. What specifically are you worried about here, that a bad parameter will crash the program? The code is there in case you wanted to verify it's not doing anything nefarious. This looks like just a cute script/program the author wanted to share with HN, I don't think it's a big deal if they didn't fully productionize the thing and just wanted it to be seen.

It sounds like a shell injection vulnerability [i have not actually checked though]. Attack scenario is somewhat realistic ("friend" sends you an image in a manner that preserves filenames, you run command on file)

Being blatently vulnerable is not the same thing as being not production ready.

Re: What Anime CLI?

#23

Post by guessmyname »

laumars wrote: post #10
kornbattery wrote: post #7

The message >NOTE: MAKE SURE THAT YOUR LINKS ENDS WITH .IMAGE_FORMAT AND DOESN'T HAVE ANY & CHARS AFTER BECAUSE THIS SYMBOL IS RESERVED BY GOLANG Makes me a bit uncomfortable with it. Shouldn't input sanitization be one of the first things to consider when doing user-facing applications?

The file names are ingested as a string so there is no way they’re being interpreted by the Go runtime (and in fact, Go being a AOT compiles language rather than a dynamic one means it wouldn’t be possible for file names to conflict like described in the readme). This suggests to me that the author is misunderstanding why ‘&’ causes POSIX shells to do weird things. I think what’s happening is the author tried a web U…

> I think what’s happening is the author tried a web URI that had an ampersand in, Bash then background the process and the author panicked thinking the Go runtime was parsing the ampersand rather than his or her $SHELL.

Yes, this is exactly what happened.

The author says this is one of their first Go projects, which explains their misunderstanding. They still have a lot to learn, not only about Go but Bash as well.

That being said, I am happy to see new programmers learn new things, especially in one of my favourite programming languages.

Re: What Anime CLI?

#24

Post by Blikkentrekker »

irevenko wrote: post #2

Find the anime scene by image using your terminal This application is basically a wrapper around trace.moe

I was going to say that I find it oddly specific to limit such a search technology on an image on so-called “anime” only, and now I will say that of this “trace.moe”.

I don't understand why so many websites and services do this; it's really silly.

On 4chan, various trolls love to make topics that test the definition to see if they are removed by being very technical with it.

I also tried trace.moe on The Wonderful Adventures of Nils, which is one of the most commercially successful “anime” of all time and it produced no results. So as the title suggests, perhaps it's one of those websites that says “anime”, where it actually simply means “moe art”.

Re: What Anime CLI?

#25

Post by kuroguro »

laumars wrote: post #10
kornbattery wrote: post #7

The message >NOTE: MAKE SURE THAT YOUR LINKS ENDS WITH .IMAGE_FORMAT AND DOESN'T HAVE ANY & CHARS AFTER BECAUSE THIS SYMBOL IS RESERVED BY GOLANG Makes me a bit uncomfortable with it. Shouldn't input sanitization be one of the first things to consider when doing user-facing applications?

The file names are ingested as a string so there is no way they’re being interpreted by the Go runtime (and in fact, Go being a AOT compiles language rather than a dynamic one means it wouldn’t be possible for file names to conflict like described in the readme). This suggests to me that the author is misunderstanding why ‘&’ causes POSIX shells to do weird things. I think what’s happening is the author tried a web U…

No, I think the author doesn't understand how to urlencode parameters as the image URL is passed to the API like so:

curl -s https://trace.moe/api/search?url=https://foobar/baz.jpg

And in the project the URL is simply appended:

https://github.com/irevenko/what-anime-cli/blob/main/cli/lin...

The API provides both GET and POST methods of passing the image file or URL and the author has somehow mangled them both into one as well :)

https://soruly.github.io/trace.moe/#/

Re: What Anime CLI?

#26

Post by Xi_Bprime »

Blikkentrekker wrote: post #24
irevenko wrote: post #2

Find the anime scene by image using your terminal This application is basically a wrapper around trace.moe

I was going to say that I find it oddly specific to limit such a search technology on an image on so-called “anime” only, and now I will say that of this “ trace.moe ”. I don't understand why so many websites and services do this; it's really silly. On 4chan , various trolls love to make topics that test the definition to see if they are removed by being very technical with it. I also tried trace.moe on The Wonderful…

Is it really silly though? The author of trace.moe has to label and store each anime episode somewhere, and use CPU power provided for free to search through these indexes. Adding regular TV series and movies to this dataset could really dirty what gets returned when the service is just about letting someone find out what anime some screenshot is from.

The FAQ says they've indexed most of post-2000 anime and very little of 80s and 90s anime. It mentions you can even use a similar drawing of the scene to get a match, due to the method they're using!

Re: What Anime CLI?

#27

Post by soruly »

Hamuko wrote: post #5
hokumguru wrote: post #3

This is insane tech

I'm surprised that trace.moe only needs 430 GB of data to work as well as it does.

By default, it only requires the colorLayout database to work (which is just 133GB). You can see my presentation here: https://github.com/soruly/slides/blob/master/2020-12-trace.m...

Re: What Anime CLI?

#28

Post by soruly »

xcambar wrote: post #4
hokumguru wrote: post #3

This is insane tech

I used to think that about Shazam. I had no reasonable idea about how it worked, so much so it really felt like magic (there's a quote to be put here, which I can't find the author here. HN help me). My 2c of an advice: uncover the magic, learn the innerworkings of such methods. It is a much stronger and more powerful feeling than the "wow" effect you're having right now.

This presentation briefly describes how it works https://go-talks.appspot.com/github.com/soruly/slides/2018-0...

Re: What Anime CLI?

#29

Post by Blikkentrekker »

Xi_Bprime wrote: post #26
Blikkentrekker wrote: post #24

Earlier quoted context omitted.

I was going to say that I find it oddly specific to limit such a search technology on an image on so-called “anime” only, and now I will say that of this “ trace.moe ”. I don't understand why so many websites and services do this; it's really silly. On 4chan , various trolls love to make topics that test the definition to see if they are removed by being very technical with it. I also tried trace.moe on The Wonderful…

Is it really silly though? The author of trace.moe has to label and store each anime episode somewhere, and use CPU power provided for free to search through these indexes. Adding regular TV series and movies to this dataset could really dirty what gets returned when the service is just about letting someone find out what anime some screenshot is from. The FAQ says they've indexed most of post-2000 anime and very lit…

> Is it really silly though? The author of trace.moe has to label and store each anime episode somewhere, and use CPU power provided for free to search through these indexes. Adding regular TV series and movies to this dataset could really dirty what gets returned when the service is just about letting someone find out what anime some screenshot is from.

I simply quæstion the sanity of delimiting the search to animated works from a single country, and as I pointed out since it can't find something from Nils, it isn't really about that.

> The FAQ says they've indexed most of post-2000 anime and very little of 80s and 90s anime. It mentions you can even use a similar drawing of the scene to get a match, due to the method they're using!

It also couldn't find anything from The Spirits Within and Advent Children, so it's really not about “animation from Japan” but about specific art styles, it seems.

Post reply on HN