« first day (3083 days earlier)      last day (1848 days later) » 

6:00 PM
Say you want to give a promise 10 seconds to resolve and if it doesn't, move on with the function
 
the promise doesn't know it's being awaited
a promise never knows how it will be resolved.
so my gut says no
 
but I mean, on the calling function side
hmmm
 
ahh, I see what you mean.
 
I just came upon this note in the MDN that got me thinking:
> Note: It's possible for the returned promise to neither resolve nor reject, as the user is not required to make a choice at all and may simply ignore the request.
 
still don't think it's possible, but interesting
@forresthopkinsa which is what I was getting at with the "promises don't know how it will be resolved"
 
6:02 PM
Sure
 
a promise doesn't care either way
async function foo() {
  const foo = await(10000) bar() || 'oof';
}
so just to be clear.. you want something like this? (sans syntax)
like wait 10 seconds, then auto reject/cancel?
 
pretty much yeah
 
yea, I can see that being beneficial in some cases.
still don't think it's possible unless you do some crazy flow
 
might be easier with a generator
 
6:05 PM
I wonder if an unending promise with no then() would ever get garbage collected
yeah probably
 
tmk they do not
 
weird
They handle it kind of heavyhandedly with service workers
 
I haven't checked in a while. just remember being yelled at for doing it in node
 
haha gotcha
 
async function main() {

}

main(); // I was told this will never be gc'd
took them for their word
now, if you resolve it.. it should be
 
6:06 PM
if a service worker has a promise running even five minutes after the tab closes, the user agent will actually kill the process
hmmm that seems like an easy way to get memory leaks
ugh I really can't concentrate
it's one of those mornings
 
6:27 PM
@Jhawins I'm on Xbox.
 
is xbox slang for drugs?
 
I think it's slang for "not cool enough for a PS4 or gaming PC"
 
David's got it.
IE...cant play Rust.
 
Why would anyone want to play Rust
 
Don't feel too bad. Rust no longer runs on Linux... so I don't play it all that often either.
 
6:33 PM
PS4's controllers are terrible
 
@BenFortune why do sadists and masochist exist?
 
It's like minecraft meets pubg meets cancer
 
P$4 controller master race
@BenFortune ...I cannot argue that...
 
xbox won the ergonomics war of 2013
 
<platform I use> master race
 
6:34 PM
the 360 wired controller is amazing
I still use it from time to time
 
I use it for starwars battlefront on pc
 
maybe people like xbox controllers, but I personally feel better after using a dual shock
 
people still play swbf?
 
yeah, I still sometimes use my 360 controller for pc games
 
I use whatever controller my missus hasn't stolen for her pc
 
6:35 PM
I dunno how active it is, I usually jump on it after some "thin mints"
 
so often the ps4 - she likes the xbox one
 
hell yeah, every couple of months I spend a Saturday on a galactic conquest.
 
and I stare at the trees and ewoks
 
null != rr && (void 0 != rr.connection && (Lo = rr.connection),
    void 0 != rr.ports && (a = rr.ports),
    void 0 != rr.base_port && (b = rr.base_port));
 
the nvidia shield controller almost got it right
 
6:35 PM
what does this mean?
 
and the steam controller is all kinds of wrong
 
@cubesnyc true, or false.
50/50
 
what is void 0
 
I remember a comic where the steam controllers touch pads were actually portals to gaben's nipples
 
user8729657
6:37 PM
lol
 
"haptic feedback"
 
@cubesnyc void is a return type of nothing
 
wait no, haptic is non touch
what's the word
 
@DavidKamer what?
no
 
what is the point of this
 
6:37 PM
void evaluates the expression and returns undefined.
 
void <anything> returns undefined
 
always
void foo(); will always be undefined. but foo might have side effects.
@cubesnyc the point is you probably are looking at minifier output.
 
oh
ok
so a human didnt write that
 
@rlemon nothing is human speak for undefined/null (wasn't sure which it returned)
 
@cubesnyc very unlikely.
and if they did, they failed every code review ever
 
6:38 PM
I've seen a human write worse
 
ok thats the confusion
 
so I wouldn't be surprised
 
because that statement seems like it literally does nothing except assign a value to Lo
not sure what all the boolean comps are for
 
wait, is void a JS keyword? I thought that it was only in TS
 
yes
 
6:40 PM
well then
 
like lets say in that code one of the values is actually undefined
what happens?
 
it does something weird in JS. It's not something you'll use commonly
 
If i'm reading it correctly.
it's just this
if( rr && rr.connection ) {
    Lo = rr.connection;
    if( rr.ports ) {
        a = rr.ports;
    }
    if( rr.base_port ) {
        b = rr.base_port;
    }
}
 
oh right
because its shorthand operator
or whatever
pretty slick
 
hello how can this function be translated into a loop?
`Array.prototype.map.call(x ,y => y.value);`
 
6:42 PM
@JoeDoe Welcome to the JavaScript chat! Please review the room rules. If you have a question, just post it, and if anyone's free and interested they'll help. If you want to report an abusive user or a problem in this room, visit our meta.
 
@JoeDoe map is a loop
 
i can not understand it as much as i understand for loops but when it comes to map i keep thinking i do not know what is it doing.
 
const newArr = [];
for( const { value } of x ) {
  newArr.push( value );
}
it's doing this.
 
@rlemon is he calling value on the index value?
(x ,y => y.value);
 
he's doing x.map(y=>y.value)
x is the array in question
 
6:44 PM
oh
I see it now
 
y is the value
 
@rlemon thanks
 
I didn't process the .call
 
i see now i understand how map works appreciated.
 
🚽
 
7:03 PM
{ column in datum
    ? typeof datum[ column ] === 'boolean'
        ? datum[ column ].toString().replace(/^./, (x: string) => x.toUpperCase())
        : datum[ column ]
    : '-'
}
I wrote this, and I'm not even sorry
 
ew
 
Yup. As usual. Figured out the answer to my issue and of course it was me being dumb! Yay!
 
7:43 PM
@here, need the angular7 screenshot module name, any clue??
 
could it be the two words with a - between
angular-screenshot
 
impossible. google doesn't give me that result.
 
"Okay google, do JavaScript"
 
Hey Stackoverflowers! Is there any reliable way to compress Base64? I tried LZ-String but that gives me gibberish - or maybe am I doing it wrong?
 
@DavidKamer reminds me of this which was hilarious
@JamesBaloyi zip it
 
7:53 PM
@KevinB, that is for v1, i need v7 module name
 
@JamesBaloyi why are you trying to compress base64? maybe there's a better encoding you could use (like BSON)
 
@rlemon I need to compress it... I know it sounds illogical, but it's important
 
okay well then good luck
 
@JBis I need to display it afterwards... so zipping won't do
 
8:28 PM
!!magic
 
(∩ ͡° ͜ʖ ͡°)⊃━☆゚. * ・ 。 ᵀᴴᴱ ᴳᴬᴹᴱ
 
8:50 PM
@JamesBaloyi unzip it
 
Let's keep it family friendly ;)
 
9:05 PM
How does base64 encode each character?
in 6 bits?
 
its base radix 64 isn't it
3 bytes, into four 6 bit blocks
 
Base64 is a group of similar binary-to-text encoding schemes that represent binary data in an ASCII string format by translating it into a radix-64 representation. The term Base64 originates from a specific MIME content transfer encoding. Each Base64 digit represents exactly 6 bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can therefore be represented by four 6-bit Base64 digits. == Design == The particular set of 64 characters chosen to represent the 64 place-values for the base varies between implementations. The general strategy is to choose 64 characters that are common to most...
"Each Base64 digit represents exactly 6 bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can therefore be represented by four 6-bit Base64 digits."
 
that's what I said! :p
 
9:58 PM
So turns out that a few major banks in Israel don't have HSTS on their sites. One of which, when the security journalist brought it to their attention, said that since they always upgrade HTTP requests to HTTPS, HSTS is not needed. 🤦‍♂️
 
wtf
mitm them and replace their home page with "this is why you enable hsts"
 
@forresthopkinsa No thanks. That would land in jail here.
 
ok next option: call a big newspaper and rile people up
 
I would wager that most people wouldn't understand enough to care
 
sure, if you go talking to them about HSTS and SSL
instead you say something about Hackers and Outrageous, Incompetent Cybersecurity and Bank Accounts In Danger
 
10:05 PM
Banks are letting hackers access your money. Click here to find out more.
 
lol perfect
 
@forresthopkinsa The reason I know about this is because it was posted in a major newspaper.
 
oh hahaha looks like we're behind the curve here
 
@MadaraUchiha "anti-terrorism eavesdropping protocol"
honestly though, a sophisticated (not even really that sophisticated) attacker doesn't really need to do too much to perform a MIM attack even on https
 
@DavidKamer Sure, that's why HSTS is a thing
It minimized that attack vector to almost nil
 
10:16 PM
yeah, but I'm not sure there is a way for HSTS to prevent the type of attack I'm thinking of
 
@DavidKamer What's the type of attack you're thinking of?
 
something similar to the VPNFilter malware
 
well if you have root on the machine then you have a thousand vectors at your disposal
 
I don't want to go into too many details about it, bc in the US you can be liable/guilty for even teaching someone to hack from what I understand, and although you are more knowledgeable than me on most things, if you don't know how to do it it would still technically be teaching you or anyone in this room
 
@forresthopkinsa you = the attacker and the machine = the victim?
 
10:18 PM
right
 
@forresthopkinsa VPNFilter didn't take over host machines, just the router
"just" lol
 
@forresthopkinsa If you have root on the machine, you're wayyyyyyyyy past "vectors"
 
right that's why I was confused
 
@DavidKamer HSTS defends you in case of an infected router
At least assuming you've entered the clean site first before your router got infected.
 
@DavidKamer I don't know what that is but I don't know how it would defeat proper hsts
yeah assuming your computer already knows the site's fingerprint
 
10:20 PM
@MadaraUchiha that's what I'm assuming didn't happen tbf
 
ah alright
 
@DavidKamer It's also worth noting that the only way it might work is if you actually typed the address for the site under attack in the URL bar, and didn't add https
 
and how many people will "just clear the cache" when the site won't load
 
It's enough that you've Googled it once and entered through https for a poisoned router to not have any effect.
 
will clearing a cache clear away public certs?
 
10:22 PM
@MadaraUchiha no, I'm saying https isn't a VPN and it doesn't tunnel your traffic. You can pretty easily fake https out. Something I recently learned...
 
Clearing the cache doesn't clear hsts entries though @DavidKamer
 
@MadaraUchiha what does then?
 
You need to enter an internal chrome:// protocol page, find the domain, and clear it from there.
It's not a trivial thing.
(At least in Chrome, with other browsers, your mileage may vary)
 
that seems pretty dangerous
 
The use-case for clearing an HSTS entry is rather slim anyways
 
10:24 PM
Not saying it isn't warranted or anything like that, just seems like there could be a lot of problems if you're not careful when implementing it
 
I still think even non-hsts https is going to be sufficient, if the UA already has a valid cert for the site, and if the user doesn't know how to override https warnings
not sufficient for a bank site of course
but for most things I think you cover most cases even with those assumptions
 
@forresthopkinsa The vector HSTS protects you against is a poisoned DNS server
Say you have a site, https://example.com
 
ok but a poisoned DNS server will give you back an incorrect cert, won't it
 
And I want to attack your users
I open a free wifi spot or hack into a badly encrypted one, and poison the DNS
 
10:26 PM
hmm
 
Then, I send the following message to people: It seems like there was a problem with your Example account. Click here to reset your password http://example.com/password-reset
 
okay so you send them to http
 
The link appears valid (especially in clients like SO chat which hide the protocol example.com)
 
I'm pretty sure there is a way to spoof valid certs
 
And now the poisoned DNS directs them to my fake site that looks like yours and doesn't require HTTPS
 
10:27 PM
that's fair
 
This is what HSTS prevents.
 
wouldn't a https 301 complicate that though
maybe not ig
 
HSTS basically tells the browser "Know that this site uses HTTPS and will always use HTTPS. You are to always use HTTPS when entering this site, even when the user did not specify it"
 
If you had HSTS, clicking on the http://example.com link would have instantly made the browser go to https://example.com, and since I don't have a valid cert, the user would get an error.
 
10:28 PM
I guess a 301 wouldn't help at all for an arbitrary url
 
> And now the poisoned DNS directs them to my fake site that looks like yours and doesn't require HTTPS
you still have to overcome the ignorance of the user here
 
"valid cert"
 
@DavidKamer I can't prove that example.com is my domain (because it's not), I won't get a cert for it.
@jAndy And that's supposed to be difficult?
 
But you don't have to if you have control over the name sever/DNS, would you?
 
No, I'm just pointing out, that the most important part of that attack is that eventually you have to redirect to another domain
 
10:30 PM
@jAndy Why? if I have control over the DNS, I can pretend to be the real domain for as long as you're asking me.
 
you can issue your own certs, or cert replay attacks I would assume
 
@DavidKamer But you don't trust my signature
 
I don't think one simply replays https
 
I would need to install myself as a CA on your machine/device, and that's impossible to do without physical access.
 
I redirect you, using my DNS God powers, to a spoofed response that says it is trusted
 
10:32 PM
@DavidKamer That's not how digital signing works.
 
but the CA is local
 
@forresthopkinsa I mostly agree with that
 
@DavidKamer no
 
You don't have the private key that matches the public key that was signed by DigiCert or whomever.
 
Oh, and I'm not saying you would manipulate the page
I'm just saying to decrypt it and serve it like normal
 
10:32 PM
Even if you took the certificate from the real example.com, you wouldn't have the private key to prove your identity.
 
*reencrypting it
 
you can't decrypt it in the middle without the key
 
@MadaraUchiha then the most critical part would be: how do you just "poison" a DNS server?
sounds like the average day job
 
@jAndy I have control over the wifi network you're connected to, since you're sitting at my cafe, I can setup my own DNS server
 
yeah that part is trivial
 
10:33 PM
wait what
 
I'm saying that you serve a fake public key at the correct domain
 
ah, I didn't read from the get go then
 
@jAndy that's easy. Especially if its your own network.
 
@DavidKamer Again, you can't do that, since no one trusted would sign it for you.
 
well lol... it's quite a stretch to assume somebody will join your "free wifi" network
 
10:34 PM
And I don't trust your signature.
 
@jAndy are you being sarcastic lol
 
@jAndy Have you ever been at a train station before?
 
@MadaraUchiha wait, do browsers have the trusted keys installed or do they get them from the signers
 
@DavidKamer Thats the entire idea of, private public keys, and trusted certificates.
 
All I need to do is make a hotspot with an SSID that looks official
 
10:35 PM
I can sign a certificate for @forresthopkinsa for google.com right now.
 
@DavidKamer Your machine has a closed list of trusted certificate authorities
 
Yeah, but nobody in his right mind would do anything "password" related on an open unknown network. Chances are higher to just find money on the street if this is eventually about money
that's.. my hope at least
 
But no one is gonna trust it. Since I am not a reliable CA.
 
Every single certificate you get on the web which produces a good TLS connection is signed by one of them.
 
10:35 PM
unfortunately you're completely wrong
 
> Yeah, but nobody in his right mind would do anything "password" related on an open unknown network.
 
@MadaraUchiha yep, yep, but how does my browser get that list?
 
ohh you sweet summer child.
 
@DavidKamer Depends on the browser and on the OS
 
@rlemon ESPN. Entire site is http. Cookies too. Millions use for brackets.
 
10:36 PM
I wish you were right but pretty much anyone who doesn't work with tech would have zero problem opening their bank site on a random public network
 
But say, Chrome on Windows, Windows has a certificate agent which provides an API to Chrome, which Chrome then uses to verify the signature.
 
@JBis these are things I understand. I just don't know exactly how a browser determines trusted vs non-trusted
 
I know there are people who do idiotic things like this, but then again, there are also people who don't lock the car or appartment
 
@JBis I think you're trying to convince the wrong person
 
@DavidKamer Certificate store. Built in by OS. You can add trusted sources or delete. Corps do this all the time to spy on their workers.
 
10:37 PM
@JBis bingo
 
@jAndy when I say everyone who doesn't work with tech, I really mean everyone who doesn't understand what SSL is
 
@forresthopkinsa So everyone who doesn't work in tech + some that do
 
@jAndy Consider a scenario where you've logged into to a site (https and everything), but most of the site is HTTP and it uses cookies
 
now, how does the computer know what a trusted certificate is? I assume it installs them on some schedule or something like that over the network?
 
yeah I realize that "working with tech" is pretty ambiguous
 
10:38 PM
there's a reason why browsers started to step in and tell people
 
nurses work with tech
 
I can now steal your cookies (and thus, session) if you're browsing through a network I control.
 
@forresthopkinsa "IOT ML Guru" comes to mind lmao
 
@DavidKamer Stuff is pushed out by updates every so often. If you go on a really old computer, your gonna get bunch of cert errors cause it won't trust new CAs.
 
Defending side needs to win all of the time in all of the places. Attacking side needs to win one time in one place.
 
10:39 PM
no questions ask. If somebody is dumb enough to do any sensible data stuff in an open, unknown, unsecured network, of course you can clean him out
but I just doubt that there are money many humans in 2019 who actually would do that
 
"money humans" lmao
you should have left it
 
@jAndy you really overestimate people, my man
 
@rlemon I think browsers should have big prompt when logging in to http sites. "YOU ARE BEING A FUCKING IDIOT. ARE YOU SURE YOU WANT TO CONTINUE?" "No." "Definitely Not" "Continue...stupidity is incurable"
 
@jAndy I think you misunderstand. It's because that 90% of our traffic is through about 10 websites, and all of them happen to use HTTPS, two of them happen to control the biggest DNS servers, and some are trusted CAs themselves, that most people are relatively "secure".
 
why should they know there's any risk? No one's told them.
 
10:41 PM
@JBis Asus just sent malware to 1 million computers through updates unknowingly
 
hundreds of millions of people still trust facebook. people are stupid
never underestimate their stupidity
 
@rlemon I think it's in the billions now
 
We will never be able to cure stupidity. No matter how much we try if the user is dumb enough there's nothing we can do.
 
I don't even think it's a question of stupidity.
SQL Injection is stupidity.
 
^ agreed. Stupidity != ignorance
 
10:42 PM
Not understanding the attack vector that HSTS solves? It's a bit more nieche than that.
 
@MadaraUchiha what do I misunderstand? You can reroute my data or spoof my server communication with any website just like that?
 
@MadaraUchiha This HSTS thing reminds me of Cert pinning. Very cool technology.
 
this was a beautiful conversation, but I have to go.
!!afk food
 
and they say this room is dead
> 8 hours later...
 
anyway....
 
10:45 PM
@jAndy Sorta, kinda
 
How can I do negative substring like with substr?
 
With HSTS, the attack vector still exists, but it's much less exploitable and plausible
 
Hmm guys, what status code would be the best when user input fails due to modification on the database from another user between user viewing the data and giving its input? -- IE a user tries to "buys" something, but the seller just unlisted the item while he presses the "buy" button.
 
@paul23 200
XD
 
Without HSTS, the vector I described above will work every time.
With HSTS, it will only work if it's the very first time you enter the website I'm attacking on that device
 
10:47 PM
@MadaraUchiha I'd really up to an experiment of this
 
@JBis ...
 
@MadaraUchiha Yeah but there is so many stuff like that you can do now.
@paul23 409
409 Conflict
This response is sent when a request conflicts with the current state of the server.
 
Pressing "f5" (to retrieve the item again) would result in a 403 though.
 
@MadaraUchiha I found a bug a little bit ago where someone could "force" a phishing page to popup with the apple/icloud domain where iOS/macOS would suggest autofilling the users saved iCloud/Apple ID password. Uses similar idea.
@paul23 well it shouldn't. That should be maybe a 404. If the item isn't found anymore.
 
Well the "item" is still visible to (say) those with certain rights, (owner) but that gets into the details of the webserver.
 
10:54 PM
Well the user shouldn't know that
 
@JBis That sounds like a turbo bug-bounty level discovery
 
If the owner decides to delete their account and the product along with it. It shouldn't change status code. Thats a security issue (not a big one obv).
 
@JBis That would mean nearly each 403 (from a GET request) should actually be a 404? Making the whole idea of status code responses kind of useless?
Since they could know it anyways, as names need to be unique they could know it by testing names when entering new items and looking at "illegal names".
 

« first day (3083 days earlier)      last day (1848 days later) »