« first day (1399 days earlier)      last day (3771 days later) » 

18:00
@rlemon source?
@JanDvorak yeah it takes like 400 pidgeons just to fly me naked down the street for the ladies
I can link you to some ASCII porn if you're curious
@KendallFrey not that curious lol
the ascii character map / limits was a lazy quick attempt
it is padded with code so you can expand it yourself
18:00
@rlemon that's fucking sweet
@SterlingArcher idc, here it is anyway chris.com/ascii/index.php?art=people/naked%20ladies
needless to say, nsfw
thankyou
jokes on you, im at work
Yesterday I decides to make (yet another) text graphics library
18:02
   (.|.)
    ).(
   ( v )
    \|/
2
I took an ASCII pic of myself for you guys i.imgur.com/VdDe2EB.png
user1596138
^ same but HTML (stolen) southouse.tk/face.html
@taco Sexy af
@Jhawins double the blocks
18:03
thx
@FlorianMargaine lmaooo
would look better
#nofilter
That doesn't look like a very healthy figure
user1596138
@rlemon WUT
18:04
@NickDugger not everybody needs arms, ya know >=(
or a face
or feet
faces are optional
user1596138
As in resolution or you mean two full bock characters?
user2620028
Sometimes better without
slender gets around just fine without a face
18:04
Would you fuck slenderman?
l += '<p style="color: rgba(' + data[i] + ',' + data[i + 1] + ',' + data[i + 2] + ',' + data[i + 3] + ')">██</p>';
use two blocks instead of one
more squareish
Slenderwoman maybe
user2620028
Got to love urban dictionary's definition of paper bag
dat tentacle action
user1596138
@rlemon lol no... watch
18:05
lol jk
user1596138
Try now
user1596138
Could make it work and be better but I don't care to
damn
in any case -- that demo was fun to make
user1596138
If it makes any different I did go "oh yeah that'll work great!" and tried it before I said no :P
lol
18:07
I saw slenderman in a glass elevator at Dragoncon. He just stared straight ahead looking through the glass as the elevator went up 30 floors. Creepy.
tmi
...did it have tentacles? X:
user2620028
i think that was precisely the right amount of information
user2620028
lol Florians ascii art is a little messed up being forced into one line in the favorite messages
I think it works out nice. People think it's regex, but it's not :O
18:09
@AaronSiciliano You get all the good parts lined up in a row
it's like a sub
!!s/(.|.) ).( ( v ) \|/$1/
@Cereal Could not process input. Error: unmatched ) in regular expression on line 208
@Cereal Could not process input. Error: unmatched ) in regular expression on line 208
user2620028
Caprica just shut you down pretty hard there
is it bad that I don't really find this weird, but normal? medium.com/@daffl/javascript-the-weird-parts-8ff3da55798e
interesting read though, but I already knew most of all in there
18:11
What is with the fullscreen headers, what a horrible trend
@AaronSiciliano #burn
@SterlingArcher Yes, how many languages do you program in?
Random question: is there a way to ensure that globally used functions (example, parseInt()) haven't been tampered with by the end user?
@KendallFrey uhh, like 8 i think :P
JS is my primary language though
As primarily a C# programmer, those things seem really dumb to me
@SterlingArcher Yeah hold on
18:13
@SterlingArcher the inheritance propagation (this) is the only part of that list that I would consider "weird" (in that no other major language has that feature)
user2620028
:(
user1596138
@SterlingArcher iFrame?
user1596138
3
Q: Check if a global property/function has been overwritten in JavaScript

GOTO 0JavaScript makes it easy to overwrite properties and functions of the global object. I'd like to find a way to check if the original version of a global property has been replaced. Consider someone putting this in their HTML: <script type="text/javascript"> window.encodeURIComponent = eval; <...

@Jhawins no, like I know that you can re-assign a function, but I'm wondering if there is a way to tell if a default-function or prototype has been altered via the console or some injected scripting
but then I squash that by writing my own toString method
user1596138
@SterlingArcher Bro, click the link.
@SterlingArcher that's one of the fundamental problems with crypto in the browser
var parseInt = function() {
  this.toString = function() { return 'function parseInt() { [native code] }';
};
busted
user1596138
It explains the same thing @Meredith just said
Then check if toString is tampered
user1596138
18:16
^ bingo
function parseInt() { [native code] } is this a regular sort of console message?
ultimately I don't think it is possible to be 100% sure
@BenjaminGruenbaum care to chime in
you are usually good with these things
user1596138
Why would you need to?
@Meredith seeing as it's not a recursive call (toString would return itself), then the same trick would work there
user1596138
If a user wants to tamper with it, whatever. You shouldn't do anything that would let them access anything sensitive by tampering with a default function
18:17
Not that I would need to, I'm just curious and trying to think of ways to secure client side code by simply checking if things have been altered beyond native code
user1596138
lol nah give up
Not that I would ever try to secure JS like that, I'm just thinking outloud here
user1596138
By nature this is not a thing
@rlemon what about?
You can be reasonably certain that they didn't casually tamper with the function
user1596138
18:18
Unless there is a bug in the client
@BenjaminGruenbaum is it possible to be 100% sure a function hasn't been overwritten
a native function*
Yes, it is.
Don't worry, this related to nothing I'm working on. I do double validation, with heavy server security checks
how?
@SterlingArcher not possible...
18:19
By the way you can always alter the function that checks if a function has been tampered with
user1596138
Hahahaha
@rlemon Well, there are a bunch of ways to get a fresh copy of a function, there is SES (Secure ECMAScript) which overrides all functions in advance in ways that make them impossible to overwrite again, there are safe execution contexts like Caja and so on.
That is also true lol
> here's a llama, there's a llama, llama llama llama llam... FUCK
user1596138
18:19
iFrame
I really don't see it being possible. I'm interested in reading benjis' answer
my head
Of course, once someone has their code running on your PC (like a .exe or something) they win.
> Here are the secret rules of the internet: five minutes after you open a web browser for the first time, a kid in Russia has your social security number.
But you can check if like a plugin a user is using overwrites a function
Protects against stupidity, but not an attack
18:21
ugh. I keep hitting super+arrows for window management
windows has tainted me
I wonder if JS will ever be server secure
node
I mean client side JS that is secure from malicious tampering
@ircmaxell that's your opinion, but there are people who disagree with you and those people wrote PhDs on the subject.
user1596138
Client side JS won't ever be "secure" in the way server side code is. It's not meant to be.
18:22
@SterlingArcher am I speaking to myself here?
nothing client-side is secure
@SterlingArcher JS isn't the problem
@Jhawins ... -_-
user1596138
@BenjaminGruenbaum Evidence?
Go look into Caja
18:22
@BenjaminGruenbaum reading, sorry, trying to keep up lol
Go look into Secure ECMAScript
HTTP is where the attacks happen
These are solved problems.
client side === not secure. doesn't matter language
@BenjaminGruenbaum and other people who wrote PhDs on the subject that disagree with those
user1596138
18:22
3 mins ago, by Jhawins
iFrame
@BenjaminGruenbaum fact is, you don't control the platform.
@Jhawins what about it?
Basically what SES does is delete everything that can be tampered with.
@BenjaminGruenbaum you cannot prevent a Browser-In-The-Middle attack. So therefore, the client cannot possibly be completely secured..
@ircmaxell it's not any more or any less secure than every client. It's not any less secure than a windows .exe file.
@room -- pay attention here -- this is the type of argument (constructive) that we enjoy. EVERYTHING ELSE IS NOT WANTED!
2
re: last few weeks
18:23
@ircmaxell that's not a JS problem though, it's the problem with the nature of communication over an untrusted link.
yay i made on topic debate happen!
If the client is compromised you can't trust it... obviously.
@SterlingArcher they are enjoyable
at least I think so
user1596138
@BenjaminGruenbaum That's how it works basically
@BenjaminGruenbaum well, I wouldn't go that far...
18:24
and I usually learn something new
You can still have stuff mess with it, extensions, plug ins, etc.
bitching about language/religion/politics is a waste of everyones time
@rlemon I like to think of it as debate vs. argument.
user1596138
Problem is, a user can actually change the browser at the local level.
because to compromise a program (without editing it) would require composmising the OS itself
18:24
constructive argument === debate in my eyes
it doesn't matter if client is compromised or not. you cant even trust the client
which is different than compromising the browser
> 4. All calls to eval are calls to the SES indirect eval function. SES does not have a direct eval operator.
@ircmaxell I get your perspective, you're playing it on the safe side, but in this case it's as safe if you run SES.
I don't understand direct vs indirect eval?
user1596138
18:25
What's to stop me from rebuilding from source and modifying core functionalities that you exploit to create "security"?
@SterlingArcher one tells you your fat, the other tells you you need to maybe start jogging. \
@ircmaxell not really, again - it's about as secure. You get a prompt which the user has to click, if they agree to it they're screwed.
While that makes sense, I don't quite get how that makes programmatic sense
@BenjaminGruenbaum still disagree. Because SES requires 2 things to be secure (browser and os), whereas a native executable only requires the OS to be secure
user1596138
Sure, most people can't or won't do that, I'm not saying I could. But if it's that doable by people who likely visit this room is it secure? No it's just difficult. That's why client side javascript cannot ever be secure.
18:26
SES doubles the attack surface
@rlemon you're*
@ircmaxell more like - 1000 vs 1010 things. The OS itself is a beast comprised of tons of little bits that can get compromised, moreover you have BIOS and then every single device driver since no one uses more than two protection rings in the kernel.
@BenjaminGruenbaum ok, I should have been more specific. Not the OS, the kernel (since only the kernel has access to the process's memory)
18:27
but thankyou. I often don't fuck that up
I can agree to "increases" but certainly not doubles. There is no reason to assume that the browser APIs are more or less prone to attacks than the APIs programmers use to produce their EXEs
@BenjaminGruenbaum still, it's a non-trivial increase in attack surface
@ircmaxell yeah, but you gain a safe execution context on the other hand, everything runs in the JS VM where APIs for executables are usually a lot wider and rely on more third party code in my experience.
from the perspective of a server, SES is exactly as secure as a native client: not secure at all. From the perspective of the client, native clients are slightly easier to protect than SES...
you can not verify security - even in compiled OS's - there has to be some level of trust
18:29
I hate how I have to look up every 4th word y'all say
you might write secure code - but then you are trusting that the compiler is secure
Not to mention you have to consider attacks on every operating system and so on. It really boils down to "Who can secure their code better? Me with the OS APIs or me with the browser where everything risky is abstracted by Google who spend thousands of dollars on contests getting people to attack it".
yes, I am a genius
and then you are trusting that the OS's compiler was secure
@ircmaxell I agree with the first part completely. Although once it authenticates it's as secure.
18:30
there is no 'secure'. there is trust
I put more trust into my TP than I do my OS
but then again. you kinda gotta trust your TP
You can store private data on the client side and authenticate it, you just can't send it to the server and have it trust it without validating it itself.
@BenjaminGruenbaum ummm... yeah... no...
if you trust your client - then you've already messed up
@BenjaminGruenbaum yes, if you just send it encrypted on the client side, and never decrypt it there, then yes, it's secure from that standpoint.
but if the client can decrypt it, it can be attacked...
18:31
no its not, because the client might have your keys
Also be careful of replay attacks
Control+F JavaScript.
@ircmaxell the client can trust itself, but the server can trust the client, we agree thus far.
i'm thinking one of those should have been can't
Multiple contexts of JavaScript can run together concurrently on the same browser and securely and make server requests.
18:32
no - server cannot trust the client
everthing from the client has to be verified
@BenjaminGruenbaum no, the server doesn't trust the client. It can cryptographically verify that the data it sent to the client wasn't manipulated when it gets it back, assuming the keys are only on the server side
shit I can't even track ips --- during last years 12 days someone from the HTML room had their ip spoofed to 127.0.0.1
and I have no idea how they did it
@ircmaxell that was supposed to be a "can't" :D I think that much is obvious. The server validates the client
and they wouldn't tell me
18:33
As for the multiple contexts bit - erights.org/talks/thesis/markm-thesis.pdf
It's a great read @ircmaxell regardless of the debate
@BenjaminGruenbaum Ah, in that case we agree
@rlemon pardon my networking ignorance, but what's the significance of 127.0.0.1?
user1596138
@rlemon lol
@SterlingArcher localhost
user1596138
@SterlingArcher basically localhost
user1596138
18:34
but with numbers
oh whoa, that is impressive
Of course we agree that you have to verify stuff sent from the client since someone can just make a connection and pretend to the be client :D
also, by "client can trust itself", I think that only applies when you call the client the "person", not the software (since software can't reliably detect rootkits, etc)
Anyway, standup comedy
> There's no place like 127.0.0.1
18:34
How would one spoof an IP anyways? Proxy?
@ircmaxell the server can't detect rootkits either :)
Anyway, gotta go, got a show to catch, talk to you all later. That thesis is a great read by the way
!!afk standup
@Jhawins I was seriously bugging for ~5 minutes when I checked the logs and saw that
God I feel like a retard when I read y'alls debates lol
@BenjaminGruenbaum no argument, but also less likely :-)
Can never understand
18:35
@SterlingArcher Same
user1596138
Did you never find out how to do it?
nope
re:security, how would you verify client data for a socket.io chat? @lightswitch05
lost interest shortly after
user1596138
The computer is fine with sending that spoofed address out, where it gets lost is in the router.
18:35
@SterlingArcher want us to start talking compiler implementations?
I like reading them, but I can't contribute and they make me feel like I don't deserve my pay
Talk about whatever, lol I'm just trying to soak up all this good knowledge!
user1596138
jk
I can't right click anymore. Hm
@Cereal possible reproduction of my bug? meta.stackoverflow.com/questions/268780/…
18:36
@Cereal Paralysis is very serious, and you should see a doctor.
@ircmaxell he needs something more at his speed. like phrasing.
I can paste!
I pasted your mum
Oh, @BenjaminGruenbaum when you're back, I've started a refactor to eliminate all branches from my compiler. Basically, I'm implementing all blocks as functions, which are single-execution-path (and a tail-call, which can be recursive, or a function-call-jump-table), then during compile time, inline it all back togehter into a single function
PHP compiler?
18:37
jQuery compiler?
compiler compiler?
I think of you first as a PHP guy, should I?? :P I know you branch into a lot of areas (@ircmaxell)
Speaking of compilers
How would you guys feel if you could compile javascript and just send the compiled code to the browser instead of the source
@rlemon the first language it's supporting is PHP. But it's a toolchain, so should be able to support arbitrary languages, providing that you provide a typing system for that language
@Meredith what would be the benefits of sending compiled code?
18:39
I would feel like I'm using CoffeeScript
@Meredith look into Dart
@ircmaxell cool
I should really try to get smarter
Actually, what would be the benefit of compiling JS anyways? Not too sure what that would accomplish
But now I'm curious
@SterlingArcher It'd be faster
@SterlingArcher v8 compiles js
18:39
Not much faster because v8 is ridiculously fast
@ircmaxell that's a good way to get your eye gouged out
@rlemon yet again, sorry for this, but what happens when you compile JS?
@rlemon yes and no
Is it like minification or compression or something to make it run faster, or nah?
@SterlingArcher it turns into machine code
v8 uses a JIT compiler
18:40
translated into bytecode
better??
a JIT compiler is a compiler, but a good machine code AOT compiler will usually be much faster and more complete, since it can do more aggressive optimizations
Not really =/ Beyond top level code I don't know what happens under the hood
Another thing college skipped over
Funny, I've heard lots of talk about how the JIT compiler can do better optimizations
I started teaching myself what goes on under the hood.. but then I moved on to something else.
:/ I should get back into it
@SterlingArcher You should write yourself a bootloader/operating system
18:42
I can't even canvas yet, how would I OS?
@SterlingArcher They're not related ;;
It was a difficulty scale, not a relation scale
I took an intro to c++ course, didn't go or do any homework and got a b-. Operating systems should be cake!
@rlemon in very specific cases, yes
anyone use centOS6
I can't seem to figure out how to upgrade my openssl
18:43
like when doing string operations, it can allocate the correct size buffer
@SterlingArcher ok, then try assembly code
I built from source, but it wasn't happy
assembly is pretty basic
visual basic or skill basic?
:P
I knew someone would take that wrong
18:43
I've heard very good things about GoLang
assembly is not pretty
@SterlingArcher
check it out
but overall, no, gcc compiled C with -O3 will usually blow the doors off of a JIT compiler runtime
ahh makes more sense now
@rlemon golang? Hm, ill look it up
18:44
@KendallFrey @ircmaxell's last ping was meant for you
yes it was
@ircmaxell Coming from a .NET POV, you can't make as many AOT optimizations because it needs to be more cross-machine
@Loktar today is vacation day for everyone e in France
ngen can be a good solution to that
@KendallFrey well, and also the languages are too dynamic for an AOT compiler to make really good decisions
which is why not everything is AOT, and not everything is JIT...
18:46
@ircmaxell not on long term processes
@FlorianMargaine seriously?!
Disregard what I said
Anyone have any common reasons a cursor would flash in a browser? Doesn't matter what tab I'm on. It's just.. flashing
document.getElementById('mybutton').addEventListener('click',
  function() {
   this.innerHTML = 'Button clicked';
});
Suddenly I don't want to read this blog anymore...
18:48
:-)
Is... is there something wrong with that..? >.>
innerHTML is being used improperly
it should be textContent
@rlemon did me a solid by drilling that into my head
That seems a little pedantic
Oh, I thought it said innerText
Which I'm sure someone would tell me is also bad
it's just silly
!!caniuse textContent
18:50
ie8 doesn't support textContent, and FF doesn't support innerText
fuck ie8
I wish
18:51
while(node.hasChildNodes()) { node.removeChild(node.firstChild) }
node.appendChild(document.createTextNode('Bananas'));
There's nothing found for textContent, innerText, or innerHTML
yea caniuse isn't always perfect
Excuse me as I search my project for usage of innerText
People always say don't worry about micro-optimization, but I feel like if you don't write your code to be as optimum as it can, what's the point? Faster CPUs will come out, but bigger, poorly written code will still take tolls
Since I have to support ie8 and FF, I had to give in, and use innerHTML
18:52
@SterlingArcher If I'm writing a script that taxes a modern cpu, sure
I feel the same. it isn't the performance that bugs me, it is that someone took a shortcut where they could have done it in better more concise ways
that leads to bad habits, and then you shoot yourself in the foot one day
If you have to support legacy browsers, that's where I use jQuery.
So textContent being unsupported in IE8 means nothing to me, since if I'm worried about IE8, I'm using jQuery for compatibility across the board
That's when it's worth it (to me) to use jQ
Still not worth it
@NickDugger How long have you been using js
var textKey = 'textContent' in document.createElement('div') ? 'textContent' : 'innerText';

foo[textKey] = 'Bananas';
18:55
@Cereal not long enough to make an informed decision
Nick is biased, but he admits to being novice and not knowing what he's talking about
but he's still going to bitch
Indeed
we've just accepted it
@SterlingArcher yeah
today is public holiday
so who wants to help me update openssl on centos6??
I see the excitement in everyones eyes
18:56
@FlorianMargaine public holiday for federal employees or literally everybody?
I would assume a lot of people still work?
Like policia or food places?
I just thought of it that police have to work during statutory holidays.
Wait, I don't think I support ie8, I don't need to fix this

« first day (1399 days earlier)      last day (3771 days later) »