« first day (1923 days earlier)      last day (3250 days later) » 

22:00
@SterlingArcher Fun fact: Lobsters don't die. Of old age, anyway.
I don't isEven
user1596138
@KendallFrey Don't they just keep molting and getting bigger
user1596138
22:03
Idea: Buy a lobster and raise it throughout your life
Idea: buy an ocelot
Babou
If it's not Babou you are simply an idiot
But get him some toys. Seriously.
It's Meowschwitz in there.
user1596138
@KendallFrey smithsonianmag.com/science-nature/… Random... But the truth is actually more sad lol
user1596138
Hah!
haha
@SterlingArcher That's a Cisco prefix
So I just discovered the Leeroy Jenkins source
user1596138
22:12
@rlemon you use Google Music right
00:50:56 fo lyfe
nerd
user1596138
I have 2 Chrome users, we will call them Josiah1 and Josiah2
When I log into GMusic with Josiah1 it's fast, no delays no stopping to buffer
When I log into GMusic with Josiah2 it's slow af, takes maybe 5sec to load the page and everything stops to buffer every 10secs :/ Same songs..
same computer?
user1596138
Yeah windows are side by side
22:14
@ssube 08:00:27!
@Zirak who is cadmus?
user1596138
It was like this at 11 but I figured maybe they were having issues. It's 4 now lol same thing. Oh well ig.
@ssube It's the virtualbox one
oh, gross
vbox is for noobs
I've been yearning to try qemu
22:16
yea, but VMware licenses are expensive, not transferable between OSes and don't have updates included
> OMG can I run a minecraft server for me and my sibling on a pentium with a 10mbit link?
Sure, you casual.
@Luggage sexy is free
sexy?
esxi
not me. This costs.
er.. isn't that a hypervisor?
yar
22:17
no joy. i need one for my work workstation. windows host.
@ssube Affordable family plan though!
workstation is only like $100
that shit is on sale all the time
ohh, i remember vmware fusion costing me more than that
@Zirak I mean yes but...
@Luggage mac markup? :D
hah, maybe.
22:19
oh, no, workstation is like $250 normally, they just cut it to $150 every few months
huh. Work provided my license, so...
$250 for vmware workstation pro
yea, i might get one from work if I ask.
but at $250, i expect updates and use on mac and windows
that's not much money for a company, if it means you can run the Unix on your workstation
workstation is windows + linux
doesn't run under mac, too slow
yea, no idea why vmware fusion is a separate product
that's why fusion is a thing, with the half-assed drivers
same engine. uses the same images
22:20
Or you can, like, use virtualbox
fusion is a million times slower than workstation
@Luggage why not virtualbox?
vmware fusion is the GOOD one on mac. virtualbox heats up the CPU with it's stupid
vbox is slow and doesn't work well with most NIC setups
totally breaks the VPN on this machine
just having it running prevents me from connecting to the office
22:21
vbox wears out my fan, which i normally don't even hear
My work's linux station runs Windows on a VM, I compile things in it. It works fine.
vmware adds a NIC and vrouter, so you can send VM traffic back around and through the VPN
vmware's graphics and IO drivers are also much faster
Yea. I think vmware is a solid product with a license cost that's just a BIT too high for needing to re-purchase.
yeah, vmware is so not sold to people. Only companies.
I can counter your anecdote with mine. I've used both virtualbox and vmware. I saw no penalty in virtualbox, aside from admittedly more awkward networking options.
22:24
fusion/player are their "here's something for consumer markets, now fuck off" token gesture
vmware does indeed have many more NIC stuff, but they're also sometimes a huge PITA
My anecdote?
fusion lack some features of workstation, but it's pretty complete.
Not yours, the "vmware is fast, virtualbox is slow".
vbox isn't as bad as qemu, but it's definitely slower than vmware/kvm/hyperv
but now that most "qemu" machines are kvm, that's gotten fuzzy
qemu is a fucking beast
22:26
qemu used to be able to run without root because it was a pure emulator
A co-worker of mine raises VMs in a heartbeat
now it's just a manager over kvm, which is the shit
(or something like that, I don't manage our hosts)
Dunno about that, only know that I'm jelly of him
set up openstack then
devstack or one of the other single-host dists
I don't work online
22:27
I bet you'd love screwing with OS, it's pretty sweet
Not in office hours, at least
put it in a VM
Ooohh that weird platform
I gave it one look, couldn't see past the enterprise talk, and forgot about it
it's a bunch of python to manage hypervisors
@SterlingArcher Well, um... I have no words
22:29
scripts and routing and storage and all sorts of nonsense
That doesn't sound like fun :(
it's a local AWS
At least to me, sysadmin makes me twitchy
compute and S3 and everything, with a dashboard
@ssube AWS doesn't sound like fun :(
22:30
but this is sysadmin via code.
sysadmin for programmers
> Use the butt to build the butt! Use your butt to launch new versions of OpenStack in about 5 minutes.
instead of screwing around with a hypervisor or spending $20k/host on vsphere, you just set up OS
and it gives you pretty network diagrams and graphs and buttons to make new machines
my builds tools are 25 nodes, all told, but recreating one from templates is just oldbox agent-services-1 && newbox agent-services-1 4x16x40 and poof, a new machine boots and configures itself
You're scaring me
as a dev turned sysadmin, I should.
i'm curious
22:33
the only thing worse is a dev who thinks they're a sysadmin :D
that's me.
the disadvantage of using virtual desktop is the responsiveness
And me. But I'm a terrible sysadmin
Please don't hack us
oh, I'm lousy at it
it's a hell job
22:34
that's half of why I use puppet. Templates everything and I just fill in the blanks.
!!bring me TP
@rlemon That didn't make much sense. Maybe you meant: bing, ping
@Zirak that's highly related to what I do ftr
@FlorianMargaine :(
22:37
@Zirak yeah, what do I do there?
I only see "Convert to outside collaborator" and "Remove from org"
oh yeah
Change your role
Or remove from org
yeah, just removed myself from the org
You can't change your role
I'll add you as a member
not necessary
Too late
22:39
meanie
@KendallFrey I don't know why but I kept losing it at "ball cam returned"
@SterlingArcher wow, you just finished?
you're a pretty slow reader ain'tcha
Why isn't @FlorianMargaine italic?
oh lol I had finished when I posted, I just went and chatted with the cute front desk girl after I logged my time
user1596138
I guess it never occurred to me that template strings would be nice for XSS
22:44
@jhawins yes
user1596138
Pretty narrow case for it... But if someone is really bad at javascript yet also using ES6, maybe.
how do they help with xss?
user1596138
@Luggage Help is a relative term ;P
user1596138
It's exploitable. Better way to word it I suppose. If someone lets user input generate a template string. cause you can call methods/variables etc from within
user1596138
22:46
Sort of a less obvious eval
how is that any different than before es6
@Luggage simpler life
ohh, i see. you didn't mea the good kind of 'help'
user1596138
@Mosho Umm template strings are ES6.
yeah but how do they make any difference with XSS
user1596138
22:46
@Luggage Nah the fuck with people kind
user1596138
They are exploitable for XSS, if the developer makes it that way.
same with string concatenation
user1596138
Exactly the same as eval.
^ @rlemon
user1596138
No lol
22:47
yes lol
how is it any different?
user1596138
String concatenation with eval yes.
you have three people asking how it is different :P at least give an example of how it is.
user1596138
Not the norm
user1596138
Ok fine
22:47
wouldn't you still need eval() for user input to be treated as a tempalte string?
user1596138
^ Actually I think Luggage just closed the book
@Loktar Yes, I maintain the actual node for movement, although I think if you simply preserve the IDs it would work too.
user1596138
But how can you exploit string concatenation?? No matter what the user inputs it's going to spit out a string, not execute code.
@Luggage why? (no really, why)
user1596138
@rlemon Please make an example of how you can exploit string concatenation.
22:49
let result = `Answer ${someUserInput}`; //how is this dangerous?
@jhawins I never said you could exploit template strings :D
he didn't say you could
that was your argument
user1596138
Oh you're doubting me? Hah! Just read MDN.
user1596138
It even warns you
22:50
lol, dude, slow down a bit. you said they were exploitable, we asked how, you never told us.. @Luggage made one point, I asked him to explain.
user1596138
You can do anything inside the brackets
user1596138
I guess I don
user1596138
t understand
but it still has to be executed in the vulnerable context
but how do you take a normal string and treat it like a template string?
22:50
same as any other code
will someone fucking explain the exploit to me!? jesus man, pulling teeth or what :P
> Template strings MUST NOT be constructed by untrusted users, because they have access to variables and functions.
user1596138
@Luggage The user input could be malicious code to send your session info to me or otherwise upload some data.
this is from MDN
but the example they give...
`${console.warn("this is",this)}`; // "this is" Window

let a = 10;
console.warn(`${a+=20}`); // "30"
console.warn(a); // 30
@jhawins good luck sending session info these days tho
22:51
var userInput "${doEvil()}"; //now how to turn this normal string into a template string and make it execute?
(httpOnly cookies have become pretty common)
@Luggage I don't know of any way you can do that
user1596138
@rlemon Answer is ${userInput} // userInput contains doBadThings();
@jhawins it can be prevented by IFS
that explains nothing..
user1596138
22:52
How do I escape backticks in the chat
backslash?
either indent, or \
user1596138
If the user input contains a function call it will execute said function
don't escape if you are indenting to format code.
user1596138
Idk I don't get this lol. Must be a communication gap of some sort, probably my fault :P.
22:53
so it is a window into some scope you may not want the user?
user1596138
!!afk drone time
* IFC i mean
@jhawins so a string containing doBadThings() will be executed in this template string? e.g. var userInput = 'doBadThings()'; /* your template string */
idk, I always just filtered inputs because I was told too.
this will call doBadThings()?
22:53
never really understood modern xss
@FlorianMargaine I would highly doubt that
user1596138
@rlemon Yeah you can't just trust the user.... What if it's a message board and the user posts it and it's executed by all the other users. XSS...
@Mosho same...
user1596138
@FlorianMargaine Well no lol
@jhawins shitty message board code :P
22:54
phew
I know what you are saying, but I don't know HOW to execute a normal string as a template string. With babel, the template string is dealt with at transpile time. With real ES6.. i'm not sure.
user1596138
@rlemon Yeah.... Dude that's the whole point?
@jhawins I wasn't doubting you, understand I am actually confused by it all.
user1596138
9 mins ago, by jhawins
Pretty narrow case for it... But if someone is really bad at javascript yet also using ES6, maybe.
user1596138
Shitty message board code comes from that ^
22:55
even not using babel i can't come up with a way of converting user input to a template string without eval
user1596138
@KevinB Which is why I said @Luggage closed the book on this.
user1596138
7 mins ago, by Luggage
wouldn't you still need eval() for user input to be treated as a tempalte string?
Ohh, ok, I thought there was still doubt about my line of thinking.
> Never attribute to malice that which is adequately explained by stupidity.
22:56
^ see, I'm never malicious :D
oh and whoever thinks he's smart
this is a discussion on irc I just read
I still don't understand half of the words
so where's the vulnerability? or is MDN just being extra cautious. The only way i could see this happening would be if your backend is outputting js based on user input, but then you're open to far worse vulnerabilities than a template string.
and the end of it
what room is that?
lisp?
c?
yea, We (or I) think they are just being cautious, but I am left with the small doubt that there is a way.
23:00
@rlemon #sbcl
I'm reasonably sure they are using lisp to talk to a non-lisp library.
a Lisp compiler
and yes, they're using cffi which is a way for Lisp to call C functions
wait
you can call C functions from lisp ?
0
Q: ES2015 template strings security issue

MoshoHere's a quote from MDN: Template strings MUST NOT be constructed by untrusted users, because they have access to variables and functions. Can anyone give an example of an exploit that takes advantage of this?

@KarelG yeah
23:02
most languages have some FFI features to talk to other languages
@FlorianMargaine fuckin right. I was on the mark on both then :D (I'm taking it, back off!)
should that not be for security SX mosho ?
or whatever your environment's equivalent of a 'normal DLL' is.
didn't knew that. I have experimented with C and Haskell FFI recently
@rlemon yup you're awesome man
23:03
if you take enough shots, a few are bound to go in.
interesting. Some operations are faster in haskell, so i combined that with my C data logger
@KarelG as @Luggage said, many platforms allow that
python, java, c#, etc
many =/= all
building in Toronto
23:04
@KarelG possibly
zooms out
Any language that real work is done in.
@KarelG if a language is compiled, chances are it has cffi
look at this clown
0
A: ES2015 template strings security issue

yaycmykSomething like `${eval('do something bad')}`

without some clarifications :|
23:06
he posted it as a comment, I said it doesn't have anything to do with template strings, and he edited the comment and posted it as an answer
It's not only a wrong answer, but would be a bad answer even if correct.
@SterlingArcher OMG
var greeting = `Welcome, ${0}`(username)
wtf is that
anyone here working with kendo ui?
23:21
TypeError: ("Welcome, " + 0) is not a function
anyone?
really stuck with something
@Luggage well yeah lol
so if it's as bogus as it seems, should I just delete it from MDN?
they made poor @jhawins make a fool of himself
:DDDDD
so I think that guy is right, but just acting incredulous isn't enough..
honestly it's ludicrous
but being on MDN makes me doubt
probably because of my self esteem issues
It's like saying "Concatenations using the + operator must not be constructed by untrusted users, because they have access to variables and functions." with the example "" + console.warn("this is",this) + ""Bergi 1 min ago
and that's all there is to it
mosho
that template string isn't so dangerous unless you're an idiot developer
@KarelG the point is that it has nothing to do with template strings
it calls toString() on anything returned from a part of the template.. I wonder if that can be exploited some how..
let x = { toString() { return "bob"; } };
`${x}` // "bob"
23:37
@rlemon brofist
wait, didn't you vote me out of RO
retracts brofist
yeah, but you have to inject it someway
yea, i'm not sure how that can be exploited.
36 mins ago, by rlemon
if you take enough shots, a few are bound to go in.
@Luggage '' + x // "bob"
@FlorianMargaine #rlemonLifeHacks
23:54
Does anyone know if making edits to MDN should be instant?
I made an edit and I haven't seen my change take effect
there's a banner at the top telling you "it's rebuilding, wait a while"

« first day (1923 days earlier)      last day (3250 days later) »