« first day (2013 days earlier)      last day (2953 days later) » 

9:00 PM
thanks
 
@ndugger that's just because domains suck
 
domains?
 
I think that's how it's called in js, no?
 
no
and even if there was such a thing, it wouldn't be the problem with eval
 
anyway, in Lua it's perfectly fine to load untrusted code
 
9:02 PM
That's an API for async errors
 
you just create a new Env for it w/o any of your variables or anything
 
You may mean "realms"
 
another point for Lua vs JS battle
 
@BartekBanachewicz you can do that with webworkers
 
leaking data is a problem, but far from the only reason not to load untrusted code
 
9:03 PM
Stay tuned for more
 
there's also the "you have no idea what it does" part
 
@Abhishrek sounds like an overkill
@ssube if you essentially limit it to a pure operation, it doesn't really matter
 
does it delete your hardware? attack some remote server? force your fans to high forever?
it's untrusted for a reason
 
@ssube that's only a problem if it has access to all of those APIs
 
@BartekBanachewicz sounds to me like a great sandbox cleverly implemented
 
9:04 PM
And you also have node's vm module
 
@Zirak right, that.
 
is Infinity considered a numerical value just like any Number?
 
@BartekBanachewicz sure, and you can take away some of them, but for the code to do anything useful, it still needs some form of I/O and basic ops that can still break
 
9:05 PM
that's not considering how loading code into the same process will undermine ASLR and other system-level protections
 
@ssube for the code to do anything useful, it still needs some form of I/O - well, no.
 
Lua or no, it's a bad idea
 
@ssube except your arguments against it don't make sense
 
His argument is that evaling user input is a no-no
 
@ssube we're talking about managed, interpreted code, what has ASLR to do with it
 
9:06 PM
no matter how small your sandbox, it can still be annoying
 
@Zirak yeah, in JS.
 
You're widening your attack surface considerably when doing so
@BartekBanachewicz no, in everything
 
Hey guys probably dumb question but why does it has 'delay ?'
 
@ssube because? Are we talking about JS specifically or what?
 
@BartekBanachewicz even if you've taken away all the good attack APIs, loading it into the same process means it can guess memory addresses effectively
 
9:07 PM
@ssube what?
 
Except that js is really the only place where you can have user's A input running on user B's computer.
 
@BartekBanachewicz the language doesn't really matter
 
@ssube so can I hear any concrete, non-js-specific arguments?
I completely don't buy the ASLR one
PoC or GTFO, to be blunt
 
you know how ASLR works, yeah?
 
9:07 PM
or are you just trolling again?
 
@BartekBanachewicz Ever heard of language level exploits? There was the leaked NSA one, Egotisticalgiraffe or something like it.
 
@ssube kindly explain how can a Lua program exploit the fact that it's loaded inside a process that has another VM in it
 
It was a vulnerability in E4X. Well user B is running user A's input, and even though you're in a sandbox, an vulnerability in his browser now gives user A control user B.
 
if you have memory access and you're in the same proc, the addresses are relative
 
@ssube Lua programs don't have memory access
Besides, they reside in a dynamically allocated memory, not on the stack
 
9:10 PM
waves hand in front of myself
 
@Zirak yeah, dully noted.
 
@Zirak it's not worth it
 
@ssube focus on your own argument
 
I have to go home and do useful things, so you have fun explaining simple attacks
 
@BartekBanachewicz can lua garuntee 0 expliots
on everyhardware
ever made ?
 
9:10 PM
@ssube sounds very handwavy to me
 
things their developers didn't even consider
etc etc
 
What now...?
 
I don't think that was too called for. It was a bit annoying, but he meant well. I think.
 
Agreed
I see kicks being used more and more just over disagreements
a bit concerning
 
wait, who kicked me?
 
9:12 PM
more and more of our disagreements end up with ad hominem
which is not a good thing
 
what is the difference between using new Array() and []
 
@Abhishrek no, obviously :)
 
@AjeetKljh no difference.
 
!!tell AjeetKljh google what is the difference between using new Array() and []
 
9:13 PM
Well, there is a difference
Array(15) is an array of 15 things and [15] is an array of one thing which is the number 15
 
@BartekBanachewicz then it will never be totally safe to eval code straight from the user
 
@Abhishrek but then again technically it will also never be totally safe to accept any input from the user
now, this seems far fetched/slippery, so hear me out
 
enlighten me
 
You can eval safely from JS
You just eval into a frozen realm
 
Lua was designed not only as a small programming language; it was also aimed at data description and data storage
 
9:15 PM
Or if that's too stage 1 proposal for you, you can SES
 
7 mins ago, by Zirak
@BartekBanachewicz Ever heard of language level exploits? There was the leaked NSA one, Egotisticalgiraffe or something like it.
 
Treating code as data in that case was a principal use case for it
 
SES has a parametere constrained eval.
That'd work
 
Hence, evaling a Lua script embedded in a native program is, IMHO, on a similar level of safety as reading text from a file into memory.
 
@BenjaminGruenbaum where can i read more about frozen realms? I have been following SES
 
9:16 PM
@Zirak woah, that was an actual thing? I felt so silly googling that
 
Also, <advertorial> I have written a fully pure Lua VM that technically should pass Safe Haskell checks </advertorial>
 
someone could go even further and make a formally proven VM
at that point, I'd much rather use that than scanf
 
@BartekBanachewicz that's how secure-ecmascript works (SES).
It's formally proven.
 
9:17 PM
@BartekBanachewicz Well, evaling from user-input in js is the real problem here. And we argue that it's also a problem everywhere else, because it considerably widens your attack surface. Do we agree on this point?
Never mind if it's a worthwhile risk, just that it increases the attack surface.
 
@Zirak I think that hugely depends on the implementation of the particular "eval". The point I'm trying to make is that some memory operations might be inherently more unsafe than some expression evaluation.
a "programming language" is just data if you're writing a compiler
 
@BartekBanachewicz We'll get to that point, but to get there we have to agree on this data point: Letting someone run arbitrary user-input, no matter where or on what language, widens the attack surface.
Just because you increase the number of opcodes the user-input can run.
 
I'll agree to the opposite equivalent: reducing choices in user input narrows the attack surface.
 
You're being difficult
But anyway
 
9:21 PM
Well I think the difference is in '>' vs '>='
but in infosec you always assume the worst so
@Zirak when writing your own non-trivial input parsing, you're writing code and with each and every line of that code you're also introducing a possibility of a disastrous bug
letting the secure environment handle that for you allows your code to stay really minimal.
 
Let's say I found a vuln in your language parser/tokenizer/whatever. Let's say it gets me arbitrary read/write to the heap and stack. Since, at the end, the parser/tokenizer/whatever runs in some form of assembly, that means I get to run whatever assembly I want.
Am I wrong in this regard?
 
@Zirak well, yeah, just because you can change some memory in the process doesn't mean you can execute arbitrary code
there's DEP and stuff
 
But you're about to execute some code and that means the relevant pages have the execute bit
They actually have rwx
 
@Zirak which means you can't write to them
 
Which is an exploiter's dream
@BartekBanachewicz But you write to them
 
9:25 PM
@Zirak typically it's either w or rx
@Zirak well, assuming you have a JIT and you change what's going into it, yes
but that's like an extreme case I'd say.
 
We're derailing here. That wasn't the point.
The point was that I, user A, put some value in a db and that gives me ability to run random assembly on user B.
 
well, I think that you specifically need the code to go through jit
 
And given enough time and resources a determined user A will find a way to make it exploitable.
Just as we've seen that DNS was exploited not so long ago.
 
Hey how do I tell bower that one dependency depends on another dependency
 
9:27 PM
I mean a native program is fixed when it's loaded. You can't change its binary.
It can execute a given set of binary instructions in a given order.
 
Yeah...any RCE-related CVE published in the last decade managed to get code execution even through DEP and ASLR and all others.
I won't recap how, there're lots of resources about that.
 
eh, I guess it's enough to see how many holes does the JVM have
to defeat my point completely
 
But we saw that (a) allowing user input widens the attack surface and (b) the widened attack surface leads to potential RCEs
 
but you're always going to have some input.
 
So evaling another user's input on a user is a Bad Idea. Is it worthwhile? Maybe. But @ssube's point and mine was that it's always risky.
@BartekBanachewicz Of course. Except usually the input isn't being fed into a complex state-machine that is a PL.
 
9:31 PM
@Zirak there are less complex PLs and more complex ones.
 
Doesn't matter
 
There are ones who are harder to sandbox and the ones that are easier
@Zirak it does. Reducing the complexity of the PL reduces the possibility for the user to break the sandbox, imho
 
Sandboxing also doesn't matter (pwn2own anybody?)
@BartekBanachewicz Now you're just making the calculation of "is it worthwhile"
If your PL is "increment" and "decrement" that may be fine and dandy
 
An argument between an expert and some who thinks they're an expert: a surprisingly decent combination of informative and entertaining.
@DanielKobe Bower doesn't support that
 
@Zirak exactly. So saying "evaling something that's a PL is always riskier than any alternative" is moot because it depends on what you're going to eval
 
9:33 PM
@BartekBanachewicz When did anybody say that "riskier than any alternative" part?
 
27 mins ago, by ssube
@BartekBanachewicz the language doesn't really matter
 
You can take his argument to the extreme but let's keep the conversation legible
 
I think we're converging to some middle ground anyway
 
So he was overstating and my "inc/dec" language probably isn't exploitable
Ten points to Gryffindor
 
We've reached critical mass for UI engineers to hit a holy war
 
9:35 PM
The end point is that user input is risky and just saying "sandbox!" doesn't make it safe
 
(proper use of d3 in react)
 
I do agree that making the user input more open than necessary opens a window for an attacker, and I do agree that using a big, full fledged PL for it opens a potential zillion of windows.
I disagree with the statement that doing it with a technology specialized for sandboxing is particularly "risky" considering what else you could do instead; if your user input is complex enough, your code would be "risky" as well.
 
It's indeed a trade-off you have to make. You'll run user input through some state machine either way.
 
Read the DNS CVE details, it's trippin balls. CVE-2015-7547
 
9:38 PM
I will.
> It allows for unsafe code to be securely included into a trusted code base by restricting what features of Haskell the code is allowed to access.
@Zirak "Multiple stack-based buffer overflows" oh well
BTW, I wonder if any of the WoW plugins actually broke the sandbox
 
@J0NNYZER0 no thanks
 
anyone know why chrome does not capture some keys on keypress vs keydown?
 
9:58 PM
how would you guys name private members with a property in TypeScript?
class MyClass {
    private myProperty: string;

	public get myProperty(): string
	{
		return this.myProperty;
	}
}
 
typescript lets you name a private and public member the same?
how does it know which one you mean by this.myProperty?
 
That's infinite recursion right there
 
@Luggage I don't think it does. I am asking what the proper pattern for this is
 
You just maximized your callstack
A+
 
if you mean casing, yes, i prefer camelCase for members and that's pretty much standard for JS
 
10:03 PM
@Luggage right, but what is the standard for having a property with the same name as your private member?
 
there isn't. one name, one member.
 
You just don't
 
JS coding standards say properties have camelCase, C# is PascalCase. so C# avoids that by having private members be camelCase and the corresponding property be PascalCase
 
if you mean.. how should you name your private members when you want them to be one-to-one with a public one.. maybe a leading _underscore..
 
I know that my code above is illegal :)
@Luggage underscores are against TS coding guidelines
 
10:04 PM
@Codeman That only works for names with multiple words
 
@Codeman wat
 
If you have guidelines for this situation, what are you asking? :)
 
I don't have a guideline for this situation
 
Wait, I'm wrong
But so are you so that's okay
 
coworker is using leading underscores for the private members, I say "don't use underscores", he says "ok, how do I use a property then?"
@Zirak I know I'm wrong. I'm asking what the proper style should be as the document does not cover this case
 
10:05 PM
There is no style guide. It's not a styling issue. You just don't do this.
 
since you can't use the same name, underscores seem fine to me. If you have a RULE against undersscores but no other guidelines for how to resolve this, then it's time to break the rules.
 
> Use camelCase for property names and local variables.

> Do not use "_" as a prefix for private properties.
you can also just name your property getMyProperty
 
It's a red flag indicating you're doing something wrong. So don't avoid fixing it, fix it.
Design it differently
 
answer this question. In other members of this class, do you want this.myProperty to refer to the public or private member?
 
@Luggage that's my question as well
 
10:08 PM
Why is there a need for the private property to have the same name as a public property? If there's a public property by the same name, in what way is it different from the private property? To me it sounds like one of the two aren't using a name that is descriptive enough.
 
does typescript make you do the full private property, getter setter dance that c# did back in 2005?
 
@KevinB because the private var needs to store the value for a lazily initialized public property
 
private myPropertyResolved: string;
public get myProperty(): string { }
 
hmmm
that works
 
naming things is much easier when you know a use. :)
 
10:12 PM
mmhrm
I'm actually trying to avoid the issue altogether
 
avoiding things is the best.
 
he's got a promise as a class member, I said "don't do that, just use the promise and throw it away" but for some reason he doesn't understand that
I think having a promise as a class member just seems like bad design
fulfill a promise with a value, don't use the promise to hold the value
 
it is, unless, maybe the class represents a 'result' or some other short-lived object
even then..
 
this is a ViewModel
 
promises are (should only be) return values from functions and only get 'used' or returned. never stored for later use.
heavy stuff, this..
 
10:23 PM
@MadaraUchiha do you get github notification on comments on closed issues? (cc @BenjaminGruenbaum)
or any of the owners
 
are you watching at the repo level?
 
no I made a comment on issue 11 in moderation
but it is closed
but I want people to read it
 
ohh. misread the question. anyone subscribed to the specific issue, or watching the repo still get notifications.
 
cool
 
probably
 
10:28 PM
@rlemon that shit is so weird. What's their problem.
 
@Luggage I agree. there's some weird shit going on
 
Hello
is there a way in angularjs to make sure all directive has been loaded before having jquery or other javascript run?
 
... ello ... ello ... llo ... o ...
 
@JoeSaad I believe you're looking for a debouncer
 
@JoeSaad smells like an antipattern
 
10:34 PM
what's a debouncer?
or antipattern?
 
oh dear
 
i'm having the jquery not seeing the directive i believe.. some race is going on and jquery is running before directive is finished loading
 
put that code inside your own directive?
 
I wouldn't use jquery and angular together. They do not get along.
 
umm, i thought angular USED jquery
 
10:37 PM
nope
jqLite
 
but yes.. mixing traditional jQuery dom manipulation and angular is probably bad, if it can be avoided.
but what do I know? I don't use angular.
 
@Luggage you're right, it does. I am warning against using jquery in your own angular code as a lot of the stuff jquery does (events, etc) conflicts with how angular handles things
 
agreed.
 
I'm not saying you can't, it just makes certain things that are really nice that just work in angular not work as cleanly and easily
 
aha I see this gif every few years, never gets old. i.imgur.com/nhGoztc.gif
 
10:47 PM
lol, never seen it actually
 
@JoeSaad IIRC, we've explained many Angular antipatterns to you in the past
 
I wrote a book about overreacting. If it doesn't sell well I'm going to kill myself
3
 
@Codeman have you read it, it could help you not over reacting
 
@happy fuck everything about you
:P
 
:p
that is a big mission; so much thing to fuck
fucking that much could be regarded as a job, a career orientation, a mantra, a philosophy... you could, you could write a book about it
 
10:57 PM
are you calling me fat?
 
@Codeman not fat, no, no fat. If you were a box, I would say it is a box that both can contain a lot of thing and also look very slim
 
uhhhh
riiiiight
 
a box so nice you wouldn't want to put stuff in it, nope. So elegant you kick out the wife and kids to let it stand near the tv, better, in front of it. But you put nothing inside, nope, the box is too elegant to receive any shit but by the size of it it seem a lot came in recently, all that while looking very slim, very nice.
 
@SomeKittens i'm working in a place which uses different languages.. so some are even using dojotoolkit, others are using ember, otehrs are using vanilla and that's why i want to make sure the angular directive is loaded before any of their scripts run
 
those aren't languages...
 
11:06 PM
...dojo... vomits
Trailer for a new Netflix series gets sent out company wide.
"Warning: The following trailer contains strong language and adult content"
....soooooo SFW or NSFW?
 
Yes.
mandatory viewing.. just not here.
we won't tolerate this type of filth in the office
is it blocked by the company content filter? :)
 
we don't have a content filter
 
11:21 PM
ours just blocks job-posting sites. (joke)
 
Ours just blocks HBO
 
heh
 
in my last jobs blocked spotify ports...so i quit
 
@EmmanuelLópez Welcome to the JavaScript chat! Please review the room rules. Pleasedon't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
 
Grate
 
11:34 PM
ok i found the solution
in main directive's controller i'll use $timeout to call all other functions that need to get called after that directive is finished loading
 
11:59 PM
time to go apply the GoF design patterns to Factorio, somehow
 

« first day (2013 days earlier)      last day (2953 days later) »