Live data from Hacker News

Show HN: Lightsaber Battle – May the Fourth Be with You

lightsabercursor.com

31–39 of 39 posts

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#32

This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#34

This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.

To avoid XSS, try physical lightsabers: https://www.youtube.com/watch?v=NyLSZee1uN8&t=202s

I've been part of a dueling club before the pandemic, it was a very fun way of keeping in shape.

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#36

This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

Ok, you took it to the next level. This is amazing

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#37

This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

Toying with #name-input and setName() was quite fun; I wish I was there to see this part happen! What `onerror` did you end up using to make it recursive?

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#38
post #37

Earlier quoted context omitted.

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

Toying with #name-input and setName() was quite fun; I wish I was there to see this part happen! What `onerror` did you end up using to make it recursive?

This was the injected JS code:

    document.getElementById('name-input').value = document.getElementById('yay').outerHTML; setName(); console.log('yay')
The `` tag I used was wrapped around a `div` element that had the `yay` id. I used `onload` instead of `onerror`, with an image link from Wikipedia.

Re: Show HN: Lightsaber Battle – May the Fourth Be with You

#39

Earlier quoted context omitted.

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

Ok, you took it to the next level. This is amazing

You might find this interesting, if you didn't know about it already: https://en.wikipedia.org/wiki/Samy_(computer_worm) . In 2005 someone wrote an XSS worm in MySpace that made everyone follow a single person. It worked by injecting itself in the victim's profile description. It quickly reached more than a million people.
Post reply on HN