Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Goatse to Stop App Theft

joshcsimmons.com

Post reply on HN
Print view View original

201–210 of 464 posts

Re: Using Goatse to Stop App Theft

#201

Post by gregsadetsky »

cengizIO wrote: post #194
gregsadetsky wrote: post #135

Earlier quoted context omitted.

100%. poc: https://joshcsimmons.com/post/eNqzKU4uyiwosUvJTy7NTc0r0UtPLX...

Very clever. For those wondering, this won't gunzip since it's compressed using zlib. you must do a chain like this: URL Decode -> Base64 Decode -> Zlib Inflate.

right on! I used https://bugdays.com/gzip-base64 to go back and forth.

base64 generates slashes, so the site (and I) run encodeURIComponent in the devtools on the resulting base64 to make sure it's completely url-safe.

---

the poc "payload" is

eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc%2FPLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg%3D

which uri-component-decodes to:

eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc/PLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg=

which un-base64+gzip's to (using the site I posted above):

  document.getElementsByClassName('light')[0].remove()

  # this is bad

Re: Using Goatse to Stop App Theft

#202

Post by attilakun »

Somebody is doing something similar to my Chrome extension. They stole the (minified) code, slapped their own logo on top of it and started selling it. I filed a DMCA takedown request at Google and they removed the extension. Then the guy reuploaded the extension again with a slightly different UI. But I can still see that the underlying code is all mine!

Re: Using Goatse to Stop App Theft

#203

Post by realharo »

There is a similar kind of anti-scraping technique, where you serve fake data that looks very realistic, but a part of it is modified in some way that renders it useless.

Of course the challenge there is good bot detection to not accidentally serve fake data to a legitimate user.

Re: Using Goatse to Stop App Theft

#204

Post by bitwize »

I had a dream once, in about 2000 or so, that I was touring a "smart home" that featured display panels on the walls, cabinet faces, etc. that could be reconfigured to display whatever you wish: flowers in the spring, foliage in the fall... a complete change of décor at the touch of a button.

While I was touring it, the smart home was hacked. And suddenly... goatse. In every room, on every surface, that same gaping orifice.

I woke up sure of one thing: Smart homes... not even once.

Re: Using Goatse to Stop App Theft

#205

Post by wepple »

I wonder if there is a way to host known (ideally known-but-disabled) malware, and get the parent frame site on browser blocklists, without getting the sqword domain blocked?

Probably not, but that would be even better than a goatse troll.. actually hit them where it hurts; their ad revenue.

Re: Using Goatse to Stop App Theft

#206

Post by tempodox »

b800h wrote: post #141

I am absolutely not a lawyer, but I wouldn't do something like this for fear of falling afoul of anti-obscenity laws. For instance, the UK has a cyberflashing law which allots a two year custodial sentence for sending a graphic image (by any means) with intent to cause distress.

So stealing the app is OK but doing something about it is illegal? Sounds like the law all right.

Re: Using Goatse to Stop App Theft

#207

Post by ryandrake »

> This made me angrier than it should have - not because Sqword is a cash cow - we don't run ads on the site and don't make money from it, it's just for fun, but because it was a passion project with friends, something pure and intentionally free to play WITHOUT ads.

If the site is for fun and doesn't make money, then how is what these aggregators are doing considered "theft"? Theft of credit for making the app, I guess? I dunno--I'm surprised the article OP is so bent out of shape if it's just a fun throwaway project. I wouldn't care but maybe that's just me.

Re: Using Goatse to Stop App Theft

#208

Post by jjice »

nonrandomstring wrote: post #61

Once, out of the kindness of my foolish heart, I ran a server with a lot of great sound effects for all and sundry to download. Eventually the bandwidth was getting hammered by a huge number of leechers seemingly from some apps that had simply hard-linked to the resources. After replacing said resources [0] they soon ceased but not without a slew of abusive and entitled emails demanding I restore the SFX. Oh fun time…

Oh I love stories like this - great retort! It reminds me of that time that some app (or apps) was hammering an image of a butterfly from Wikimedia because it was part of some sample code that was never removed. I couldn't find the story but it was a fun but upsetting source of abuse from unknowing devs.

Edit: It was a picture of a flower. I replied with some links.

Re: Using Goatse to Stop App Theft

#209

Post by drcode »

ryandrake wrote: post #207

> This made me angrier than it should have - not because Sqword is a cash cow - we don't run ads on the site and don't make money from it, it's just for fun, but because it was a passion project with friends, something pure and intentionally free to play WITHOUT ads. If the site is for fun and doesn't make money, then how is what these aggregators are doing considered "theft"? Theft of credit for making the app, I gu…

Likewise, there's no reason for the aggregators to get bent out of shape over the Goatse
Post reply on HN