Context: CoderDojo is a kid's club for learning to code. Hence the quality.
If you’re trying to hack/deface a website, don’t submit a pull request
61–70 of 114 posts
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#62For anybody too lazy to read through them all, here are some gems: + Are you sure, like, really really sure, you want JavaScript 1.2? +var speed=1 please run jslint on your code before submitting a pull request There are so many errors that JSLint gives up on this code at 39%. +temp=document.body.scrollTop You really shouldn't declare a variable without using var - can lead to all sorts of scoping problems. Oh, good…
the javsacript version thing really cracks me up.. hhaha
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#63Earlier quoted context omitted.
In fact, I might go so far as to say that this was never intended to be merged. I'll assume whoever did this wants their message heard, and while it will never show up on CoderDojo, the hodgepodge of coding styles ensures that the "pull request" will go viral, thus possibly reaching a far greater number of people than it would have otherwise. /tinfoil
What message? I read through the thing and didn't see any message. There's some encoded arabic, but even if I could read arabic, I couldn't read it encoded.
The message that you should carefully read all pull requests?
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#64Earlier quoted context omitted.
Because it works even if you can't find a proper codepath to exploit. It might gain you anything you want: A quiet path to leak admin account info to a server of your choice. An attack vector into a system trusted by more than one person. You don't need to provide much information to get a github account, so the risk is not very much elevated.
>You don't need to provide much information to get a github account, so the risk is not very much elevated. 1. Unless you are extremely lucky, you have to gain someones trust by posting fixes that do not contain backdoors. This leaves a trail in terms of: coding style, word usage, editor settings (tabs vs spaces), and ip records/timestamps in github. It's not much but it is additional unnecessary exposure. 2. Since t…
Editor settings are not much of a record if you just follow the projects code guidelines. ip-records with github are more of a problem, but I guess you can fake those by using tor or any proxy. And to embed your malicious code over a series of innocent looking commits, have a look at the underhanded c contest: http://underhanded.xcott.com/ There are some true marvels, code that looks innocent as a baby but does malicious things.
So yes, owning a server might be easier in some respects, but owning a project might own you a server you'd never get access to - a machine that runs behind a firewall e.g.
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#65For anybody too lazy to read through them all, here are some gems: + Are you sure, like, really really sure, you want JavaScript 1.2? +var speed=1 please run jslint on your code before submitting a pull request There are so many errors that JSLint gives up on this code at 39%. +temp=document.body.scrollTop You really shouldn't declare a variable without using var - can lead to all sorts of scoping problems. Oh, good…
Actually, Solaris does have the daemon() function as of Solaris 11:
http://docs.oracle.com/cd/E19082-01/819-2243/6n4i098sj/index.htmlRe: If you’re trying to hack/deface a website, don’t submit a pull request
#66Earlier quoted context omitted.
What message? I read through the thing and didn't see any message. There's some encoded arabic, but even if I could read arabic, I couldn't read it encoded.
There is actually a message: "If there is no check on the freedom of your words, then let your hearts be open to the freedom of our actions" "The war continues until the last Zionist remains on the beloved land of Palestine" cough Shouldn't that be until there are no more Zionists in Palestine? Are they proposing to kill all Zionists until there is just one of them left, and then say "you're the last one here, you ca…
Are you really surprised that the author of that code would commit an off-by-one error?
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#67Earlier quoted context omitted.
I assumed that was because of changes in Skitch. Everyone I know used to take screenshots with Skitch, upload them and Skitch would copy the URL into your clipboard and you could post into Github. But since Evernote bought them they closed things down and they're basically useless now, so I figured that was why Github was motivated to add this feature.
Re: Skitch, there is a nice app I switched to lately: http://monosnap.com/
Cool, thanks for the suggestion. I had a little trouble creating an account, but I finally got it working. Installed the app and looked around it. Seems slightly less polished than Skitch, but it seems to do everything I need it to do. I'm using it, and just sent the link to my company's devteam.
You can change one setting and it will copy the direct link to the image into your clipboard - Perfect! That's exactly what I want it to do. :)
Thanks again, you made my day!
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#68Earlier quoted context omitted.
I assumed that was because of changes in Skitch. Everyone I know used to take screenshots with Skitch, upload them and Skitch would copy the URL into your clipboard and you could post into Github. But since Evernote bought them they closed things down and they're basically useless now, so I figured that was why Github was motivated to add this feature.
I know that so much. Skitch is so crippled now. It was my favorite fast and simple "here let me point it out and show you" tool for everything. I annotated everything with it. With evernote killing the ease of "let me show" half, whats the point of annotating things and taking screen shots? If there was ever an opportunity for a disruptive simple startup idea it would be to replicate what skitch did before evernote b…
Check out this monosnap.com thing that piranha posted in the next comment. It seems to do the basic stuff that I needed from Skitch.
Re: If you’re trying to hack/deface a website, don’t submit a pull request
#69Re: If you’re trying to hack/deface a website, don’t submit a pull request
#70This attempt is blatant and obvious, but what about a more serious attempt where you first establish some credibility with a couple of "good" PR that fix major problems and then add a tiny little backdoor that loads code from somewhere else. Distribute the relevant code over a couple of commits and you might just slip it in. With Githubs ease of merging and automatted testing by Travis, it's easy to forget that chang…
Something similar to this was attempted with the Linux kernel once: https://freedom-to-tinker.com/blog/felten/linux-backdoor-att... I say similar because it was not a trusted contributor going rogue but someone actually hacking the public CVS repo.
It is claimed that it also happened to the OpenBSD crypto code: marc.info/?l=openbsd-tech&m=129236621626462&w=2 (a bit of analysis on the story: https://threatpost.com/en_us/blogs/experts-openbsd-backdoor-... ).
Long story short. The FBI put on its payroll a well paid crypto analyst trusted with commit access to the OpenBSD code. Years after that, somebody claims that the analyst has put on the FBI payroll to implant an hidden weakness in the crypto code. Audit follows; nothing found in the code. FUD still remains.