« first day (1965 days earlier)      last day (2983 days later) » 

6:00 PM
1.3 mA sounds about right. That's just above the "slight sensation felt at hand(s)" threshold for direct current which is 0.6-1.0 mA
Does this mean if you licked a double-A battery, you wouldn't feel anything? Because it's only 1.5 V.
 
I would guess that you wouldn't. It's only 0.21mA.
 
Key takeaway
It's not the voltage that kills you - it's the current
 
@Fermiparadox The second comment says he broke out of the sandbox, so I suspect not.
 
The other problem would be that your tongue would need to be on both the negative and positive terminals, which is rather difficult with an AA.
 
Related reading for breaking eval:
http://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
http://nedbatchelder.com/blog/201302/looking_for_python_3_builtins.html
http://nedbatchelder.com/blog/201302/finding_python_3_builtins.html
http://www.floyd.ch/?p=584
http://blog.delroth.net/2013/03/escaping-a-python-sandbox-ndh-2013-quals-writeup/
 
6:02 PM
@Fermiparadox are you asking me ??
 
@Kevin Do you just have a "sandboxing is hard" folder of bookmarks?
 
Yes I do.
 
@MartijnPieters did you post a bug yet
 
@Kevin That's actually really cool. I'll have to read the rest of those. I loved the delroth one.
 
@SheenaWadhwa Not specifically you. My comment was not related to any previous conversation you might have been having. I just entered the room :P
 
6:07 PM
Okay
 
@paul23: so yes, you found a bug!
 
@paul23 congrats, I was wrong :d
(please take a screenshot of the line above, print and frame it)
@MartijnPieters hmm :D a bare string AFAIK is still not checked at all
 
@AnttiHaapala why do you think that?
A bare string is still considered a forward reference.
It'll just not be checked at import time.
 
it is not checked at all
 
by typing, you mean? No.
It is the subclass checks in Union[] that trigger these.
 
6:23 PM
@MartijnPieters actually I believe that evalling these at all in the constructor is wrong
they're forward references/strings for a reason...
 
@AnttiHaapala sure, but the code is trying to optimise away any subclasses.
That's fine, it should not break if the forward reference is not yet ready.
and given that the PEP shows that circular module references can be resolved by importing the module as a global, then using attribute access in a forward reference..
 
ah indeed.
 
means that catching any AttributeErrors when doing those subclass checks is perfectly acceptable.
 
of course they are
ah well now alex posted this in the bug tracker
 
@AnttiHaapala ? where?
 
6:31 PM
well I posted too
 
@Kevin So practically the answer is extremely dangerous. Should i comment with a bold This answer is dangerous to save some poor soul that happens to use it?
 
comments
 
Well honestly the only time you can take advantage of eval in a privilege escalation attack, is when the attacker is on a different computer than the one hosting the program.
 
Ah, you meant posted a comment.
 
If eval is inside babbys_first_calculator_project.py and run on the console, then evaluating arbitrary strings is no more dangerous than what the user can already do - which is to say, terminate the program with ctrl-C and enter "rm -rf /" themselves
 
6:35 PM
Adding another comment with bold shouting isn't going to do anything. If the user already got through all the other answers saying not to do it, they're on their own at this point.
 
Unless for some reason babbys_first_calculator_project.py has greater access rights than the person running it? Which I'm not sure is even possible. I am but a humble Windowsman and know nothing of such things.
 
Is there not a way to 'sticky bit' a python script?
In any case, it's easy to think of scenarios where the attacker's on a different computer.
 
I guess my point is, if the user is writing projects sophisticated enough to possibly expose this as a real vulnerability, they're probably 1) already aware of the danger; and 2) not reading this question
 
@Kevin The question mentions explicitly "but isn't there a better and - more importantly - safer method", which could mislead viewers into thinking that answer is safe. I get the impression that the OP might not be asking for a babbys_first_calculator_project.py-type of program.
 
did they run arbitrary code in eval?
 
6:42 PM
@AnttiHaapala What do you mean?
 
Well the question and answer are only running eval on string literals, not expressions that theoretically could have been manipulated by the end user. So strictly speaking they're not running arbitrary code.
 
if you can eval into eval("")
you can compile arbitrary bytecode into there... but ...
 
(this is the question in question, btw)
 
I am trying to think a way how to get builtins again
 
eval("(1).__class__.__bases__[0].__subclasses__()[81]('echo got through'.split())",{'builtins':None}) #escapes your sandbox — Perkins Aug 21 '14 at 23:21
 
6:44 PM
@Kevin If it were using expressions that theoretically have been manipulated by the end user, it wouldn't be a very good MCVE.
 
doesn't work for me
:P
wonder which subclass taht is...
 
Hmm, me neither actually...
 
__ builtins__ (without the whitespace) instead of buildins
just a guess:P
I m afraid to use it.
 
That just depends on your Python version.
 
Yeah, doesn't work in 3.4.3.
 
6:49 PM
@AnttiHaapala: also added an explanation as to why Bakuriu's suggestion 'works'. It only suppresses that exception, but is not a proper fix as it violates the PEP.
 
[i for i in (1).__class__.__bases__[0].__subclasses__() if i.__name__.endswith('BuiltinImporter')][0]().load_module('sys').modules['sys'].mod‌​ules['os'].system('echo "foo"')
python 3, shell execution
 
Why the extra .modules['sys']?
 
Hrnnnnnngh this makes me almost as excited as Dark Tower.
 
>>> [t for t in ().__class__.__base__.__subclasses__() if t.__name__ == 'Sized'][0].__len__.__globals__['__builtins__']["eval"]
<built-in function eval>
 
hmm
oh :D
@zondo good point
 
6:55 PM
@Ffisegydd I always imagined Wednesday as a Colonel Sanders type.
 
I'm more excited for AG in general.
 
hmm cannot edit any more
 
I always imagined Wednesday as having white hair and a broad, black hat.
 
I have not given Neil Gaiman enough of my money so I look forward to the opportunity.
 
With his eyes almost concealed by the shadows.
 
It appears that there are more answers in the question i mentioned that are wrong and dangerous (that is, suggest that eval() can be used in a safe way, or that sympy.simpify() is safe etc.).
 
@Fermiparadox that one was the only one saying "you can avoid people running shell commands using this"
 
Yes but the others are equally harmful. E.g. this suggests eval() can be used to safely as long as the input is a valid mathematical expression. Which is not true.
 
That answer bothered me because "You could use a regex for the validation" is false.
You can't write a regex that matches all valid math expressions and rejects everything else. You can't even write a regex that matches "1", "(1)", "((1))", "(((1)))"... and rejects everything else.
 
cabbage
 
7:11 PM
cbg
 
Or this which suggest that sympy.sympify() is safe. It's not safe.
 
actually, rbrb, lunch time
 
cabbage
Rhubarb
 
(... Unless you use fairly advanced features that are specific to Python and not part of the formal definition of regexes)
 
rbrb davidism o/
 
7:13 PM
(Oops, i misread the first of the sympify() answers i linked. It states that it is unsafe.)
 
this is an interesting spin on the old "you only need the first and last letter of a word" urban legend
 
That is an interesting read. It might take me a while to finish, though.
Okay. I finished it. I'm not sure that I understood everything, but I finished it.
 
@Kevin it is easier to read the "first and last letter" when it's not moving all the time :(
 
The page might have benefitted from a monospace font, yeah
 
Raeding Wrods With Jubmled Lettres There Is a Cost
someone has really written an article like that
"This reminds me of my PhD at Nottingham University (1976), which showed that randomising letters in the middle of words had little or no effect on the ability of skilled readers to understand the text. Indeed one rapid reader noticed only four or five errors in an A4 page of muddled text."
lol
 
7:26 PM
That study has not been verified as actually existing
Or rather, the Cambridge study that is usually attributed.
 
@Kevin are you one hdernud pneerct srue aubot taht?
 
Well, yeah. It says it right there: " Status: Undetermined. "
 
I am creating a desktop/mobile app in kivy. How can I add a google login to my kivy app?
 
7:40 PM
Does anyone have an idea on how one might check a base64 encoded string (converted from an image) to see if it's blank (i.e. all white)?
I have a signature pad plugin that allows users to draw, but it's optional, and I need to do some logic based on whether or not they actually drew anything.
 
@Kevin that was a case of me recognizing the first and last message, but not the ones in between
 
:-P
@Nexion Take the string, base64decode it, and compare every character to chr(255)
 
@Kevin that wouldn't work, there would be headers and structure for the image format
 
Ok then. If there are headers and things, b64decode the string, save it to a file with the appropriate extension, and open it with PIL.
 
7:46 PM
@Nexion open it with pillow pillow.readthedocs.org/en/3.1.x/reference/… and use that to check if the pixels are white
 
Or use a StringIO if you don't want to involve the file system
 
@Nexion Wouldn't the easiest way be to keep the blank encode as a constant and compare value of the pad to the constant?
 
I found a better solution, I didn't realize the plugin had an isEmpty() function - I was already using Javascript to post the form so I'm just not including the field in the post if the pad is empty
 
Today's 'best' question (10k only, click the links at your own risk): stackoverflow.com/questions/35781333/…
ftr, I didn't click nor do I care to find out.
 
@MartijnPieters I clicked, it turns out you've won 1 million euros, you just need to send me your bank account info.
 
7:51 PM
@MartijnPieters Why locked?
 
@BhargavRao coz the OP didn't like the closure and tried to use the post as a forum to express their displeasure.
 
Oh Oh, I see the revision. That's bad.
 
how do I into reactive programming?
 
You must defeat the spectral wolf at the crossroads during the blood moon.
You will need a mirror (silver backed), a ribbon from a pure maiden (given freely), and your house's sigil (blessed and warded in the usual way)
 
I also recommend the head of an OOP dev. It's not needed, but man oh man does it help.
 
8:08 PM
shit
I should stop answering C questions
 
Antti segfaulted
6
 
@AnttiHaapala There is no undefined behaviour provided that arguments x and y have type int and double. — Vlad from Moscow 2 mins ago
I am getting downvoted there and that troll keeps editing that comment all the time
 
@davidism :D
 
Come back to us...
 
8:12 PM
the slow motion at the end is cool
 
@AnttiHaapala Step away from the C code.
 
@AnttiHaapala: oooooh, you called Vlad wrong.
 
Wait, who flagged that?
 
You have now lit the fuse. Retire to a safe distance!
 
8:13 PM
I flagged it. It was inappropriate. Do you disagree?
 
I saw the int and int version and now int and double. Probably really means int and float....... not worth the effort, IMHO
 
:D
well he admitted I was right
 
@zondo Don't flag, it is broad-casted to the the complete network and all the 10k users can see. When room owners are there, They'll take care. :-)
 
he was reading the code from the one answer
and I was going to delete
C is one of those programmign languages that seeking answers on stackoverflow will not do any good.
 
A bit broad, that statement, but I see your point.
 
8:16 PM
@AnttiHaapala You are writ about the second arguments. I though that the both parameters have type uint.:) In case when the second parameter has type float but the argument will be promoted to double then iindeed there is undefined behaviour. — Vlad from Moscow 4 mins ago
the accepted answer is still wrong :D
 
Hi all - I'm having some difficult rewriting code which used multiprocessing to proper asynchronous execution. I can't get anything as quick as multiprocessing (bad for HTTP get requests due to potential socket blocking) - stackoverflow.com/questions/35747235/… - I've tried requests-futures, tornado, Threads, asyncio
 
I don't know what any of that means but upvote for effort
 
^ Exactly and favorite too.
 
:)
 
I wonder if it would help to migrate away from CPython to an implementation that doesn't have a Global Interpreter Lock???
 
8:28 PM
Using concurrent futures with the ProcessingPoolExecutor rather than ThreadPoolExecuter seems to be fine with the GIL?
But then it's a no go with the other methods which spawn threads ...
 
@mptevsion cpython only ever runs on 1 thread.
so with 1 cpython process you'd max out about at 1/NCPUs
@mptevsion for spawning new threads, it can be that your only option is to run a separate program as subprocess
 
@AnttiHaapala I think what was strange for me was that the Multiprocessing library seemed to do a great job (and a much better one) than any of the concurrency techniques I tried. I take it that is because with any of the asynchronous functions I'm limited by 1/n(cpus) ?
@AnttiHaapala Perhaps I was unfair to dismiss it for http requests?
 
GIL s*cks
 
socks?
 
hello, I was wondering if anyone here had experience with socket module?
 
8:37 PM
No, I don't. If you ask your question, somebody might come up who does.
 
ok thanks.
 
I was thinking that perhaps I placed my callback functions (process json output) in the wrong place and they were bottle-necking something
 
I made a connection with socket.connect((host,port)) and send information with s.sendall(bytes(user, "utf-8")). To be able to read it, I did: s.shutdown(socket.SHUT_WR). Everything worked as perfect, but when I ever try to send something back it prints an error
I am aware that it is because the connection is now closed (since I shutdowned it)
I would like to be able to send and receive information without having to connect back to the server with s.connect (I would like to still be connected)
 
Perhaps you could find some way to read data from the connection without calling shutdown.
 
well, you can't
 
8:41 PM
why?
 
you close the tcp socket, it is closed forever
 
You don't need to shut a socket down to read it.
 
Which is why I was wondering if there was an alternative to s.shutdown? So I can read it
 
you can read it all the time
but it can return just part of data.
 
8:42 PM
because, lets say I erase that perticular line: s.shutdown(socket.SHUT_WR), I will wait forever without seing anything printed
 
I'm trying to use my computer, but it's really hard because I tell it to shut down first
 
is that a movie or a game?
 
It's a game. It's by Cyan. It will be amazing.
 
Your question will be directly answered by the python sockets documentation; we don't have it memorized. So it's just a question of who's going to read it: Us or You?
 
8:46 PM
 
Our resident sockets expert is afk, probably busy reading sockets documentation.
 
@davidism wow, didn't know you liked games
 
Our resident "asking questions about sockets" expert, you mean ;-)
 
I'm reading the documentation right now
It is still wierd that I cannot read without shutdown the connection
 
@RobertGrant I "occasionally" like games. You never noticed?
 
8:48 PM
I suggest using recv(). That's what I usually use to read incoming data.
 
Would be interesting to see if someone comes up with a way: stackoverflow.com/questions/16178519/…
 
data = s.recv(1024)
thats what I am using
 
@davidism I want more music like that.
 
I don't think it can be done in 2.7..
 
No :) To be totally honest, you loom largest in my mind as a correct Flask syntax emitter
I should probably allow people more than one dimension
 
8:48 PM
@davidism Wow, that looks awesome. It reminds me of Firewatch.
And it's scheduled to come out right around my birthday. :D
 
Oh that's annoying - I used the toilet but shut the lid down first
 
@BobEbert so the data never arrives?
 
It's the biggest Kickstarter backing I've ever made: $250.
 
never
 
Wow. I've never backed anything on Kickstarter.
 
8:49 PM
except if I do a shutdown first
 
perhaps you need to setopt TCP_NODELAY
 
@davidism wow.
 
though ... it should work without...
 
I once backed something for $320.
 
I bought Pillars of Eternity; that's about it
 
8:50 PM
I can show you my script with a screenshot if It may help?
 
And it was worth every damn cent.
 
@Ffisegydd was it a horse?
 
It was not.
 
@BobEbert why not a pastebin?
 
idk how to do it :P
 
8:51 PM
I'm currently on 8 kickstarts
 
also, where are you receiving from?
 
Was it...that space fighting game? Roberts Space Industries or whatever
 
my ftp server from a vm
 
8:52 PM
Wow, okay
Davidism likes games and Fizzy pays over $300 for handbags
 
@BobEbert python already has an docs.python.org/3/library/ftplib.html
 
o.o
 
@Ffisegydd That does look really nice. I've been looking at Tom Bihn's stuff recently. Very similar aesthetic.
 
I'm not judging, I'm just surprised
 
8:52 PM
It was more than just a handbag...
 
:D The answer I was expecting was that it isn't a handbag, but that was much better :)
 
Well at least I'm not paying £4,000 a year on my furthering my genetic legacy.
 
Okay so what're my options branching out of that....errr what, it also has makeup in?
 
@AnttiHaapala Actually it is not a ftp server haha, sorry
 
I haven't kickstarted anything in a while. There was a ton of great stuff 2-4 years ago, but I don't hear about it nearly as much now.
 
8:54 PM
£4k will buy a lot of skinny straps
 
I think in the end I got the messenger bag, the smaller bag, some camera straps, and a camera clip.
It's easily the best bag I've ever seen though. I use it everyday for work and at weekends for my photography.
 
Oh, so you got a handbag collection.
 
@BobEbert so I think that server only reacts to shutdown then...
or you're not terminating the message properly
 
Don't even get me started on you Frap.
 
Also, on the subject of kickstarter, www.reddit.com/r/shittykickstarters is always entertaining.
 
8:56 PM
I'm kidding, I mean I wouldn't pay that for a bag, but it does look cool
 
@Ffisegydd heh, the promo video in San Fransisco? I'll be in the brown building directly behind the bridge in 2 weeks time.
Coz, that's Mozilla HQ and the next Mercurial sprint is there.
 
I got to go to Surrey the other week...yay...
 
@MorganThrapp Kickstarter Nonstarters and Indienogo youtube.com/playlist?list=PLo4M1tlpv9rtbiNA41CWgwIJZSTjozVyp
 
@davidism Heh, I'll have to check that out when I'm not at work.
 
Hehehehe, I found a way.
Wheeeee.
 
9:06 PM
@RobertGrant "correct Flask syntax emitter" is pretty good :-)
I'm ok with that.
 
@MartijnPieters I'm scared, but I really want to see how you would possibly do that.
 
@MorganThrapp posted.
I tested this on a small project. No idea what the consequences might be.
 
@QuestionC the Myst soundtracks are great, Myst 4 has some of my favorites.
 
Oh wow. Yeah, that's certainly something.
@davidism I never played anything past Riven. Are the other 2 worth playing?
 
There's 4 others and yes. Exile, Revelations, End of Ages, and Uru.
 
9:11 PM
Oh woah, I thought there were only 4 total games.
 
I didn't like End of Ages as much, they were experimenting with doing 3d instead of pre-rendered.
 
@MorganThrapp: downside: this now applies to all Python new-style classes imported from there on out.
 
Uru has persistent world multiplayer that's still active.
 
@davidism That's interesting.
Ooo, and it's free as in beer and software.
 
That's cool
 
9:13 PM
It works on Wine really well too. I've been wanting to play online, maybe we'll need to set up a room hub at some point.
 
Do I need to have played the the others to enjoy Uru? Or will Myst and Riven be enough.
Yeah, I'll probably give it a shot tonight while the GF is at rehearsal.
 
Don't think I've ever played Myst or any of them.
 
Doooooo it.
We can meet up on weekends and frolic round the Cotswolds.
We can chase cheese down Cooper's Hill and suffer horrific injuries.
 
@MorganThrapp not really, although Uru is the heaviest on reading journals for back story, so it helps to be invested in the story already.
 
9:18 PM
Chase cheese? :p
 
It's pretty brutal.
They literally have ambulances waiting at the bottom to take people to hospital with broken legs etc.
 
@davidism I barely remember the story at all. :P I'll go back and read the plot for Myst and Riven.
 
So is it like a race down a really steep hill?
 
Yeah. While chasing a cheese.
If you youtube it, you'll see examples.
 
It's a bit like the impossibly-steep charge down the hill at the end of the Two Towers film. Except with people instead of horses, and cheese instead of orcs
 
9:34 PM
I couldn't have said it better myself.
 
However there is - as everywhere in England - a massive castle nearby
That's the thing people don't get about London property prices - a flat may cost £1m, but it will have around 50 rooms and will have once been used as a staging ground for the crusades
 
Bloody Welsh, needing loads of castles to keep them at bay.
 
That is crazy
And I feel that you shouldn't be letting your sadly behind-the-times BigCorp defence maps online
 
Hi i was installing Virtual env and there was warning. Do I need to worry?
The directory '/Users/abhimanyuaryan/Library/Caches/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
 
9:40 PM
Well that third posting explains why you just posted that twice
@Ffisegydd that's awesome
Really interesting
 
@Ffisegydd :-D
 
But, that map omits Scotland. Is that map hiding something?
 
BigCorp knows something we don't
 
9:43 PM
@AbhimanyuAryan did you do what the warning says?
you should probably start there
 
@davidism I think I should have used sudo with pip. That's what the warning says
?
 
@IntrepidBrit needs to come to England before the Zorin protocol is activated and nuclear explosions along England's Northern border cause Scotland to fall into the sea. That's what I read into the map.
 
@AbhimanyuAryan no, you should probably never be using sudo pip. Use virtualenvs.
 
@AbhimanyuAryan actually, it doesn't.
 
Yeah, you need to read it a little more carefully.
 
9:45 PM
I'm disappointed now.
 
and?
 
9:57 PM
Hello, I'm back with a new question
is anyone good with threading?
 
@BobEbert please read the room rules - don't ask to ask.
 
ok, I am trying to start 2 threads at the same time with the 2 lines: thread.start_new_thread(ftp_thread())
thread.start_new_thread(netcat())
except it only starts the first one
 
you're using the low level thread controls? Why not just use threading?
 
Seems easier since I do not need to create a class
and I am not familiar with classes
 
it's the exact opposite
 
10:01 PM
Lol
 
straight from the docs on thread:
> The threading module provides an easier to use and higher-level threading API built on top of this module.
Also, if you're not familiar with classes, why are you trying to tackle multithreading? Might be good to sit down and work out the basics of Python first.
 
Do you use queue() with threading?
 
if you want
 
Rhubarb all, going to sleep.
 
rbrb
 
10:07 PM
@BobEbert I'd seriously suggest you spend some of your own time looking through tutorials and such before coming to ask questions here. All you do when you ask such questions while admitting that you lack some basic knowledge is infuriate people.
This makes them much less likely to help you.
 
Understood
 
Wow, today is a good day for games: vimeo.com/157583742
Trailer for Thimbleweed Park, made by the creators of Monkey Island.
 
10:38 PM
@MartijnPieters Thanks for the reply to my question about typing :). I'll check it tomorrow when I have more blood in my alcohol.
 
I really hate having to perform audits on the humanity of internet personas when reading online reviews.
 
Why does 'del' not require parenthesis. It's the first time I think i've come across a function that doesn't have to wrap it's target in (). or maybe i've been doing things wrong the whole time?
 
Eduardo 5-star has only reviewed this one restauraunt, meaningless.
Nyesha 1-star only gives 1-star reviews. Including a hospital review, oh dear.
Antonio 5-star hates the Post Office, meaningless.
 
Perform audits? Or write online reviews?
 
@clickhere del isn't a function, it's a statement
 
10:46 PM
@clickhere Well you still haven't come across a function that doesn't require parenthesis - it's a statement
sniped :(
 
Mohammed 5-star. There's my man. This guy seems to have reviewed literally every fast food restaurant he has ever been to. You can trust Moe, he's dedicated to the craft.
 
Now as to why it's a statement instead of a function - that would actually be quite interesting to hear.
 
ah interesting, i'm not familiar with statements
 
Do you use "if" ever?
 
ah ok, I guess I am familiar
 
10:48 PM
simple and compound statements
 
@RobertGrant I mean check the veracity of reviewers. A lot of reviews are fake.
 
thanks guys!
 
11:19 PM
Hello, I have a DLL written in C++ (with classes). Can anyone help me find out ways to integrate it into my python code?
 
Write a thin C wrapper, then call C from Python using ctypes
 

« first day (1965 days earlier)      last day (2983 days later) »