« first day (2901 days earlier)      last day (2061 days later) » 

12:24 AM
@coldspeed for me, noob and n00b are roughly equivalent, though n00b is probably closer to the 1337 version of newbie, which is more equivalent to beginner.
I'd say it depends on the context
 
Never knew SO had chat rooms! it reminds me of Yahoo chat rooms back in the day and also some other program I don't remember now!
 
@NasrinShirali cabbage :) (check out our room rules to the top right --->)
ICQ? mIRC? Gaim? AIM? Westwood Online?
 
12:39 AM
"Chat is not a substitute for reading a tutorial or taking a class.", Ugh, I was here for a tutorial :-) I'm not sure I have to Google which one it was but it was around 15 years ago, and this chat room looks the same!
AOL I assume.
 
1:04 AM
@NasrinShirali We do have a short list of recommended tutorials sopython.com/wiki/What_tutorial_should_I_read%3F
 
1:22 AM
Thanks @PM2Ring, I was trying to make a joke though. :-)
 
1:33 AM
I used to frequent an mIRC for a pokemon MMO once
 
1:44 AM
@NasrinShirali I kinda guessed that, seeing the smilie. But I decided to link the tutorials anyway. ;)
 
 
4 hours later…
5:16 AM
@coldspeed lol stackoverflow.com/q/52481028/2336654 seems like de ja vu
 
sigh, that question had no code either
I hate this crappy double standard people have
 
 
1 hour later…
6:44 AM
@coldspeed are you sure it's double standards? I checked earlier and I only saw rep farmers there
Differing standards is more likely
 
@AndrasDeak The context is here, which is near identical to the earlier linked question in the sense that they're asking something similar without providing their own code. With pandas most of the times people don't post what they've tried because it's seldom helpful in constructing an answer. Yet one question is upvoted and the other has not just the question, but the answers downvoted too
So, yes,... I think that classifies as double standards in the community, unless I'm misunderstanding the meaning of the term "double standard"
 
Cabbage
@DSM I’m still going to be there earlier
 
7:06 AM
@coldspeed I see, I'll check it out later, thanks
 
Sep 20 at 20:45, by PM 2Ring
Folks aren't looking for "effort" because they think displays of struggle are some sort of magic pixie dust, able to turn a terrible, useless question into gold. They're looking for effort because the lack thereof is the most blatantly obvious hallmark of the thousands of terrible, terrible questions asked every day on Stack Overflow.
Sep 20 at 20:45, by PM 2Ring
From an old shog9 Q&A https://meta.stackexchange.com/a/210868/334566
 
The worst ones are the "I don't know how to get started" people who have an easy assignment that can easily be split into a bunch of even easier smaller problems
 
@PM2Ring Didn’t work out.
 
Assignment: Write a program that asks the user to input a number and then calculates the mass of the moon
OP: I don't know how to get started with this

Well, maybe start by taking user input?!
 
People don’t know how to separate problems into manageable subproblems. I think that’s one of the biggest challenges people have when learning to program.
 
7:22 AM
:) I'm sure the OP will be pleased to get his points back, and have that embarrassing question hidden from the general public.
 
> I am not getting to know, why this is not a good question. Could anyone tell me what's wrong with it.
That doesn’t exactly sound to me like they understand why the question wasn’t good though
 
@poke Sure! It's the central activity of programming, and it takes both aptitude and practice to do it. Learning syntax is a minor thing in comparison. And learning algorithms is good partly because it teaches you about problem solving, as well as teaching you neat ways to manipulate data.
@poke That's why I left my comment. The "unclear" close reason might be a bit confusing, though. I guess in this case it means "it's unclear how anyone could even ask this question". ;)
 
:D
 
8:24 AM
cbg
 
@roganjosh I think binary number kid is a little out of his depth.
 
No kidding
Checking against strings hopefully gives them a nudge in the right direction with what is wrong with their code, but you've pointed out an issue with the whole approach
 
Maybe he just hasn't been paying attention in class. And maybe the assignments so far have been easy enough to cargo-cult.
I love the 4 identical input calls.
 
Thing is, if these people were responding to comments, I might consider putting together a detailed explanation of what's wrong and a nudge in the right direction. But so many of them just seem to drop a question and go play football or something
If they're not invested in their question, neither am I. I get that some people get called to meetings etc, it's happened to me, but in a lot of cases I think they just abandon the question or assume SO isn't as active as it is
 
8:44 AM
Kids these days have no attention span. :) If they don't get a response in a minute or so, they go & do something else. But I suspect some get overwhelmed by comments & get paralysed into inaction if they aren't sure how to respond.
 
You may actually be right with that
 
9:01 AM
@PM2Ring This makes me wonder.. are forums still a thing with the kids these days, or is it all internet interaction constrained to social media?
I have no clue
I have no clue
 
9:16 AM
Not fast enough on closing that question, I suspected a generic JSON answer would crop up :(
 
9:48 AM
@PM2Ring may I suggest instead? may be misunderstood to mean downvote-please
 
@roganjosh that answer is a) not helpful (how could it be, with that little info, it's all speculation at this point) and b) wrong. Two reasons to downvote it!
 
Yes sir :) My downvotes have recently overtaken my upvote count and I don't like it :/
 
10:17 AM
@coldspeed OK, so I've gotten around to reading that post too. My point is that "double standard people have" made it sound like it's specific to people involved in the question; demeaning one post and praising the other. Whereas it's merely a matter of different people having different attitudes, and the fate of a crap question is determined by who sees it
 
I am green hand, I want to know whether there is some script to handle my question — ahuxyy 2 hours ago
What is a “green hand”?
 
they mean a newbie, probably
in Hungarian we have "green ear" for a rookie, in Salad we have "green bean"
 
Ah ok Because they were asking about his code and this was an answer so I couldn’t see the connection
“I’m a newbie” “I searched everywhere”(when the answer is just there “this has been asked before but..” this are the questions I usually think will have problems
 
they usually do
 
The invalid JSON structure wasn't even present when I made the call for a close vote, it was just two lines of text
 
10:25 AM
@roganjosh why don't you like that? Downvotes are important, and unfortunately the nature of community-generated content is such that the crap outweighs the gems.
 
Yeah, I'm doing a lot of debugging recently so to relieve boredom I'm watching the question feed a lot which is putting me in contact with a lot of bad content. I guess it can't be helped.
 
As a moderator I get to see a disproportionate amount of the crap side of the balance, so naturally my dv / uv ratio is very much tilted in the dv direction, but for regular users that know how to use their votes properly I'd expect the ratio to tip to the dv side.
 
1209 up, 3485 down, though I'm a grump
 
@AndrasDeak I have a notebook where I keep weird ways to say things. I’ll add this now. Amazing and funny :-)
 
you can count on us
 
10:33 AM
I ask questions on Twitter and @MartijnPieters cannot vote me down there :-) I feel like a stalker for having done it, but I really thought I found a bug in SO
 
@NasrinShirali then I can't vote you up either!
 
@NasrinShirali you will see the same names cropping up again and again on close votes. I assure you, we're not out intent on downvoting and closing everything that is slightly off. If you put effort into the question and make it clear, you're likely to get a decent reception
 
Yes, I understand the situation and even though I’ve always been a reader, and have just recently created an account to engage, I get irritated when there are questions on home work. Questions asked as if they’re assignments for other to do. Questions that are asked and left orphaned... there are comments and answers but the person asking them has disappeared. There are codes that when I paste into IDE won’t run at all and the question is on other things.
However. I assume I have some kind of “vote-down phobia” it makes me lose self confidence some how :-)
 
10:53 AM
@MartijnPieters The OP on the json question replied. My understanding is that they are getting {'k': '[1000]'} but could be wrong
An answer: "num == 0 or 1 isn't valid Python syntax." People are really skewing my upvote/downvote ratios recently :P
 
@roganjosh won’t it always return true? In OPc it does :-) it’s something or true
 
Yes, it always returns True, but it's valid syntax. The question has been asked to death, it certainly doesn't need another answer that makes incorrect assertions
 
Yes, aha I missed the ending quotations and thought you were saying it isn’t a valid syntax:-))))
 
 
1 hour later…
12:19 PM
Cabbagee emptiness...
 
cbg
 
haha, I thought I was alone! :D
 
There's always someone watching, waiting.... deliberating
 
For some reason that song always comes into my head in those type of circumstances. I've never really understood the "deliberating" part
Probably because it's "commiserating" hahaha
 
12:22 PM
maybe?
 
I need to gauge my mood today. This comment bugged me. I need to know if I'm being grumpy or is it worthy of being bugged.
Can you explain it? I have a column with values more than 10 places after the decimal point. I just want the initial 8 after decimal. — blackpanther05 7 mins ago
 
I don't see what there is to explain
 
Non-idiomatic phrasing in the first sentence suggests a language barrier... Talking about "places" in the context of floats revealing a fundamental misunderstanding of the internal representation of data types... Yeah, this is a "don't walk, run, away" for me
 
thank you... accelerating away now
 
12:39 PM
"Gee Kevin, you're putting a lot of stock into a single out-of-place word and a request that would be reasonable if it was phrased more like 'how do I display my data as...' rather than 'how do I make my data into...'. Can't you be a little more charitable?". Yes, yes I can.
Not going to be, though
 
Not everyone is a native speaker :-)
native 'English' speaker that is
 
Interesting, apparently ideone has url sanitization: in ideone.com/tXwghX, it replaced my yyyyyy.com string literal with y...content-available-to-author-only...y.com
 
We had a meeting with a group of my coworkers from India, there was this Finnish guy who said 'Your work was priceless!' for about 2 days everyone was grumpy and I asked them why. One of them said, he says "our work doesn't have any value" .... I explained and everyone was super happy.
This later became a joke at our office. So... I guess what I'm trying to say is that sometimes people might sound rude to you or they might not explain themselves very well, but they're just thinking in another language and typing in another one.
 
It's still perfectly visible in stdout though
Yes my jimmies are rustled that the OP ignored my comment and lavished praise upon the answerer that gave him a solution that's effectively equivalent to the code he already had
@NasrinShirali Precisely. With my meager pedagogical abilities, I can barely make myself understood to people when we both speak the same native language. So it makes sense for me to leave the problems of non-native speakers to someone more qualified.
 
12:57 PM
@Kevin closed
 
My crystal ball suggests that the segment of the url he's snipping out contains characters which are interpreted as regex control characters, which would cause the match to fail.
 
Would be a pretty big coincidence to find a valid regex pattern in a url though. I think it's probably more likely that the OP made some kind of mistake
 
I would compose an example but I'm not sure what characters are legal in a url path segment. Are dollar signs allowed? That would be an easy one.
>>> import re
>>> url = "https://yyyyyy.com/yyyyy/$xxxx/yyyyy/yyyyyy/yyyyy/pppp/kkkk"
>>> b = url.split('/')[-6] #which gives me the right part of the url to change
>>> print(re.search(b, url))
None
What characters are valid in a URL? [duplicate] says, "A-Z, a-z, 0-9, -, ., _, ~, :, /, ?, #, [, ], @, !, $, &, ', (, ), *, +, ,, ;, and =."
So, yes, $xxxx is a valid url segment
Or, hang on. Is it saying that these characters are allowed, or are not allowed? This is confusing.
 
Hmm, the most likely candidate out of that list is probably the question mark
 
How could "/" be allowed in a url segment when it is the delimiter for url segments?
But if this the list of disallowed characters, how can any url contain letters or digits?
 
1:05 PM
It says "valid in a url", not "valid in a url segment"
 
Oh, if the answer is saying "here are all the unreserved and reserved characters that can appear in a url", then that would make sense
Assuming that only unreserved characters can be in a url segment, then we have unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" available to us to create a regex pattern that fails to match the literal version of itself
Slim pickings, I'm afraid, since I don't think any of these have special meaning other than ".", which only makes patterns more likely to match, not less
 
@IljaEverilä way late seeing this, but thanks! Last awarded was 3.5 years ago.
 
@Kevin Am I missing something in your link on this question? I don't see how checking a file extension with .endswith() translates to finding the most recent file using startswith()
 
I interpreted that question as "how do I find the file in a directory that satisfies these requirements? 1) its name starts with a particular string; 2) it is the latest file among the files that satisfy #1"
But looking at the question again I may have been reading into it too far
 
Ah fair enough
 
1:16 PM
It's one of those "title asks one question, body asks a different question" posts that I love so much
 
They are fun, aren't they?
 
Back to my other thing: stackoverflow.com/a/13500078/953482 indicates that a "reserved" character doesn't mean that character is illegal in all other contexts, and specifically gives an example url that contains dollar signs in a path segment. This is considered "unwise" but not forbidden.
So, yes, $xxxx is a valid url segment
A comment on that answer suggests the RFC defining all this might no longer be relevant, but now that I've come upon a position that reinforces my initial belief, I'm not feeling inclined to investigate further. How convenient for me!
 
\o cbg
 
cbg
 
1:32 PM
does that stand for Creepy Bald Guy?
 
@NasrinShirali sopython.com/salad
 
We're challenging the notion that words have to mean things
 
I am Peas Pears!
 
I hate how you don't get any rep notifications after you've lost a chunk of rep to a bounty. I want to see those +10s! I want to feel good about myself for earning internet points! :(
 
File a bug report. It's about as effective as a placebo, so maybe you'll feel better.
 
1:45 PM
Enough of the belittling of the desire to get internet points. Believe it or not, they mean something. One, I like seeing them like @AF does. Two, potential employers look at them. Three, I've gotten contracting offers and book offers because of them. Four, I've gotten more Linkedin connections/views/searches because of them. They are more than dumb silly points that I should feel less than because I like them
Sorry, back to our scheduled programming
 
Wait wait wait, slow down, you're overdoing it. If you're going to make them sound that useful, I might reconsider spending them all on bounties.
 
I have also mentioned reputation on my CV but in the very final section (top 2% for the year or whatever it was previously)
 
They really are important. Like I follow people who have high points cause I think of them as "successful" and "interesting" people.
 
For one potential contracting job, the guy said besides a portfolio of code (read: GitHub) the next most important thing was SO
 
and also they're important for reasons others have mentioned.
 
1:51 PM
I get cognitive dissonance when I try to believe "points matter" and "you should not feel inadequate in the presence of users with more points than you" at the same time, so I have to throw one overboard
 
Clearly there does not exist a 1-1 correspondence between high rep and good coder. But the correlation between rep and knowledge is high. Then you can read posts and see what care is taken to answer questions. You can see what the level of understanding is. It is a showcase.
And that doesn't mean that there aren't those with much knowledge or wisdom that don't care about the points so much
many people in this room could have much higher rep than they do if they obsessed about it like others do. And while they have my respect and probably the respect of others in their respective lives, they don't have as much visibility as they could
 
@piRSquared the counter argument to that is that I do somewhat care which is why I try not to answer very basic questions even if there's no dupe. I've become more relaxed on that now I can answer a wider spread of problems, but I'm not out to make a portfolio of basic stuff
 
@roganjosh and that is 100% valid. You can choose to point people in the direction you think is meaningful. You create the narrative. Points are not the only metric. But they are one.
 
I just want to point out that very basic questions aren't necessarily bad questions. That's all, carry on.
 
My highest voted Q/A is as basic as they come.
 
1:59 PM
@Kevin there are high rep users I view as low quality coders and vice versa. But even the low quality high rep user has a platform that gets attention
 
As is mine, which came before I started this policy :P
But it has 22K views so I just leave it
 
I would write ten more just like it if I could capture that lightning in a bottle again
 
my highest-voted qa is slightly long
 
I've seen two types of answers. Some provide you with an "answer" which is the solution, and some comment and guide you towards the answer giving hints. The other day a user asked a very basic question on replacing values in a list and also one on for loops, and while I thought they wanted hints there came answers using lambdas and list comprehensions...
 
Also, @roganjosh you can always take advantage that it has high views and probably shows up in searches to show how insightful you can be. Show that you care and have knowledge.
 
2:01 PM
my highest voted answer has a short question, but the answer is 14137 characters long
 
I mean when the question is basic wouldn't it be better to provide hints in comments instead of answers which are likely to be copy and pasted into someone's code or assignments
without them knowing what happened?
 
That is a matter of opinion. I've gone both directions.
 
an answer needs to be written into the box
... for those questions that should be retained...
 
I usually want to provide a reference. When I have less time, I give enough for the OP to figure it out. If I'm wrong in my assessment, I don't get voted up and I move on
 
@NasrinShirali this is what I usually do, often with a close vote but people don't like it and "comments are not for answers" is the SO line. Then again, there are so many flooding in, a comment can slow down others from posting an answer and give chance to get the 5 close votes
 
2:03 PM
I don't like answers that plop down code with no explanation. But I also don't like posts that give only vague hints, even if the question writer explicitly asked for only vague hints. Questions need to be useful to more than just the asker. Future readers may appreciate directness.
 
in cases where I definitely think questions should be closed.
 
I want answers structured like a mystery novel. Gather the clues, describe your deductions, then put forth the solution.
 
cheaters gonna cheat and learners gonna learn
yes, I'm writing a song
 
What I am doing now is to read on the things I want to learn, then come up with a project I know I'd use (like a file finder or something simple), then come to SO and search for questions and solve them as if I were in an interview and they were given to me to solve. This is my current learning process and I'm learning better with this.
 
@AnttiHaapala Dang that's long. I think your TL;DR might need a TL;DR
 
2:07 PM
So I think I'm using SO reversely now!
 
@NasrinShirali I never learned so quickly as when I started answering questions
 
@NasrinShirali there are two correct ways of using SO:
a) answering a question to find out more or just map your knowledge
b) googling a problem that you come across then reading the Q/A you find and upvoting/downvoting/commenting the posts
the incorrect way is: "I've got a problem, I need to ask about it on SO."
 
Agreed @AnttiHaapala, Well said.
 
@AnttiHaapala I upvoted the short version of your answer. I hope you didn't do anything bad in the remaining 80% of the answer, because I can't be bothered to read them :p
 
'morning cabbage
 
2:11 PM
cbg Wayne
 
aggh! I can't style my sphinx tables!
 
Do ya'll ever just see a really long answer and upvote it because it's probably right? Because it would take an enormous amount of energy to be wrong for four pages.
 
you will ask your question only as the last resort if you think it could be of interest to the general audience and pretty sure you cannot find a duplicate
 
I also follow people I find interesting on Twitter and other platforms ... Sometimes they have blogs and just share tips and hints. That's also a way you can benefit from SO
 
@piRSquared Just add !important after every line in your CSS. Works every time.
 
2:12 PM
Yeah - I was one of the top 10 contributors on the python tutor mailing list when I started learning Python - helping other people learn things is the best way to learn that I've found
 
Take the "I answered my own question while writing it" phenomena and multiply it by ten. It's legitimately difficult to have a basic misconception about something when you're 40,000 words into describing it
 
(-: done
 
I have written 1724 answers and 10 questions
 
because to explain a thing you have to actually understand how it works instead of just enough to copy/paste an answer
 
those are the only 10 questions I've come across and couldn't find an answer to and thought they could be useful to someone else
 
2:14 PM
I've asked 259 questions and answered 659
 
That's a lotta questions.
 
Yeah, that's what I was thinking lol
Then again, I did start using SO during like my second year of college?
So, I had a lot of questions that I didn't even know how to find the answers to then.
TFW you realize that Jon Skeet probably loses more reputation every day because "the user has been removed" than you usually earn.
10
lwn.net/Articles/754980 I love the title of that article
 
Yam university. speaking of which I have an exam and a job interview this week. Rhubarb
 
rbrb
 
Cabbage
 
2:24 PM
rbrb @NasrinShirali good luck on exam and interview
cbg @user3483203
 
2:34 PM
stackoverflow.com/questions/52500524/… too broad and attracting non-answers
 
morning cabbage
 
cbg @Code-Apprentice
 
cbg
One non-answer and one that only addresses the SQL side and gives an approach vulnerable to SQL injection. It keeps getting better :/
 
2:49 PM
@NasrinShirali good luck!
 
Is there a good dupe for this stackoverflow.com/questions/52500885/…. I feel like it should just be "how to create a list", or "how to append to a list"
It's just already attracting a lot of low-effort answers
 
> As roganjosh points out in the comments, you shouldn't use fstrings if this will be exposed to the public or anyone who could use it maliciously. If you're going to be using it internally with a few fellow employees, you should be fine.
Not even once
 
If you're saying "f strings should never be used in a public-facing method, not even once", I disagree. If you're saying "actually, no, f strings are safe, and you should not say otherwise, not even once", I agree
 
I'm saying you shouldn't take user input as un-parameterized SQL input... ever.
I don't care what method you use
 
2:55 PM
but fstrings are not input :D
 
@WayneWerner I've never understood why anyone believes string formatting makes things easier. The lengths that I've seen some people go to to not do it properly and then actually create issues for themselves is staggering
 
I love string formatting, I use it all the time
 
Ok, I agree that SQL should not be created from ordinary string formatting approaches.
 
The f string is being used to inject user input directly into the query string
 
but never for user input to sql parameters
 
2:56 PM
It would be just as much a vulnerability if you used str.format or percent style formatting though
 
They actually forgot to put quotes around the variables in the LIKE statement, so that's another reason why you shouldn't manually create those statements
 
yes. It's not f-strings that are at fault
 
Today, two different parts of a system wasn't working, I asked the devs who worked on it if they have any ideas, they came to my workstation and witness the piece working... One of those days, I wonder if there's a term for this.
 
the f-string you cannot use itself so that user can input it
 
@MooingRawr heisenbug
 
2:57 PM
so I guess the successor of F-strings are G-strings?
 
TIL then thanks.
 
Jan 10 '17 at 17:39, by wim
Can't wait for the new g-strings in Python 3.7
 
Jan 10 '17 at 17:02, by Andras Deak
they missed the opportunity to call them g-strings
 
2:58 PM
Users can't get arbitrary code execution just from you putting their input() into your F-string. Unless you're doing something weird with eval, in which case you're doomed no matter how you're formatting its argument.
 
=O .... I hate it cuz now I'm made out to seem crazy
 
Why would f strings protect against SQL injection and not the other string formatting methods?
 
F strings do not have any special SQL injection protection.
 
So user input could still execute SQL commands
 
@roganjosh your comment said "don't use fstrings like ever" :D
 
3:02 PM
"You should not be using f strings to create SQL queries"?
 
it should be "do not place the user input into the query string yourself - let the dbapi worry about that for you"
 
@MooingRawr Not sure... but you are exactly right, there should be a term that describes a thing that hasn't worked suddenly working when trying to show the error to others.
 
Wayne gave a perfect word called heisenbug
 
                                     Arbitrary code execution  | Potential Sql injection attack from
                                     just from invoking it?    | using this to form a query?
                                   +---------------------------+------------------------------------+
                         F strings | No                        | Yes                                |
                                   +---------------------------+------------------------------------+
 
I guess I've just got so sick of seeing it all over SO. I would guesstimate that 90% of the SQL questions I open have at least 1 vulnerable answer
 
3:04 PM
Consult this handy chart
 
Yes that is perfect, just missed that comment
 
In computer programming jargon, a heisenbug is a software bug that seems to disappear or alter its behavior when one attempts to study it. The term is a pun on the name of Werner Heisenberg, the physicist who first asserted the observer effect of quantum mechanics, which states that the act of observing a system inevitably alters its state. In electronics the traditional term is probe effect, where attaching a test probe to a device changes its behavior. Similar terms, such as bohrbug, mandelbug, hindenbug, and schrödinbug (see the section on related terms) have been occasionally proposed for other...
 
@WayneWerner That is perfect
 
@Kevin you forgot: "arbitrary code execution by using user-provided format"
and columns N/A, Yes, No, N/A
 
@W.Dodge Congrats on being one of today's 10k :)
 
3:06 PM
He's on the same list as me :D
 
@WayneWerner 10K what?
 
@W.Dodge Lucky 10k
 
@W.Dodge congrats of being one of todays double lucky 10K's
 
gosh darn you kevin'd really quickly
 
3:08 PM
@AnttiHaapala Really? That's interesting.
 
*column, not columns
 
relevant tangent - I've noticed a not-insignificant amount of positivity in my life since adopting the "you're one of today's lucky 10k" approach
 
I know you can access the items and attributes of a str.format argument from inside the format string, but I don't think you can call callables that way
 
actually I am not sure how to do the arbitrary code execution
 
3:11 PM
Much of my day-to-day joy is a direct result of being one of the lucky 10K for any given day. Learning something new never gets old
 
e.g. "{0.find}".format("foo") gives you '<built-in method find of str object at 0x02D953E0>', but "{0.find('x')}".format("foo") crashes with AttributeError: 'str' object has no attribute 'find('x')'
 
@Kevin you can call callables in your f-string though I don't think you can arbitrarily call callables via injection
 
f"{dothing(untrusted_input)}" is exactly as dangerous as str(dothing(untrusted_input))
 
yes
also as dangerous as '{}'.format(dothing(untrusted_input))
 
3:14 PM
well...
I take it back...
however what I believe is that ... the format could be used to expose sensitive information :D
load the django settings module and then ...
 
Now, if you have an object which deletes your hard drive if you try to access its baz property, then you definitely shouldn't do untrusted_input.format(hard_drive_deleter), because the untrusted input might be "{0.baz}"
 
that's vastly different than f'{dothing(untrusted_input)}', though.
 
@AnttiHaapala I can believe that.
 
closer to eval(untrusted_input), though not quite there
 
cbg-ning guys
not specifically related to python, more to jira
 
3:17 PM
    >>> secret = 'ultrasecret'
    >>> class MyClass:
    ...     def __str__(self):
    ...         return 42
    >>> '{.__class__.__str__.__globals__[secret]}'.format(MyClass())
    'ultrasecret'
 
has anyone work with it?
 
@AndyK yes
or if it is in another module,
 
@AnttiHaapala that should be ok
I would like to know
if you have ever tried anytime timeline with Jira?
 
I'm looking to get one but it seems to be unavailable by default
thanks Antti
 
3:19 PM
>>> '{.__class__.__str__.__globals__[sys].modules[__main__].secret}'.format(MyClass())
or go through globals into a module that does that ... and then ...
 
@AnttiHaapala You ruined the puzzle I was just about to post :/
 
@AnttiHaapala I've clarified my initial comment to the OP :)
 
ofc you can get module contents rather easily: "{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'secret': 'ultra', 'MyClass': <class '__main__.MyClass'>, 'builtins': <module 'builtins' (built-in)>, 'sys': <module 'sys' (built-in)>}"
 
3:32 PM
>>> print("{0[0]}".format({0:23}))
23
>>> print("{0[foo]}".format({'foo':23}))
23
>>> print("{0[0]}".format({'0':23}))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
KeyError: 0
>>> print("{0['0']}".format({'0':23}))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
KeyError: "'0'"
Seems as though you can't use str.format's indexing capabilities if the key is a string that looks like an integer.
 
Hmm, I was right, apparently I can't design simple tests :P Unfortunately that means my actual issue is still unexplained :/
 
rb folks
 
3:52 PM
Wondering what the worst thing is that you could do with a format string... You can basically call any __getitem__, __getattr__ or __format__ method you want, but none of those usually do anything dangerous
 
I was wondering the same thing.
It's not inconceivable that you could somehow get arbitrary code execution if one of the format arguments is an object that does way more than it should with its __getitem__ arguments, but it's hard to justify designing such a class to begin with
 
Okay, so one question. If I see an incorrect answer to a question, do I flag it?
 
Even classes that do extra fancy stuff with their indexing, such as numpy arrays, probably don't come anywhere near this vulnerability
 
@NasrinShirali downvote it
 
stackoverflow.com/a/47103491/7277561 This is an incorrect answer so I just wrote a comment then flagged it
I cannot. Also, I somehow feel really bad about down voting people.
 
3:55 PM
No, you should not flag answers simply for being incorrect
 
There is not a flag for "incorrect answer". That is what voting is for. If it blatantly doesn't try to answer the question, flag it, otherwise DV and move on
 
Ok so I made a mistake now, I flagged and then under "Others" I wrote why I was flagging it
It clearly does try to answer the question but has a mistake and gets it wrong.
 
So you flagged as "needs moderator attention"?
 
The downvote privilege is unlocked at 125 rep. There's not much you can do to discourage wrong answers until then
 
Yes @user3483203 .
 
3:57 PM
It's also buried waaay down on an old question, it's not going to do much damage if it is wrong
 
@Kevin One could use __getitem__ to add keys to a defaultdict or a Counter, but... that's probably not very dangerous
 
Yep, the attacker has succeeded in altering process memory... In a very innocuous boring way
 
Also, I actually disagree that it's incorrect/not useful. Using a whitespace character as the newline parameter in Python 3 will throw that error @NasrinShirali
 
Yes, but it is incorrect with regards to the question asked. @user3483203
 
Have you tested his alternative? From a glance at it it should work.
 
4:02 PM
C:\Users\Kevin\Desktop>type test.py
class BadIdea:
    def __getitem__(self, key):
        eval(key)

input("Enter a format string: ").format(BadIdea())

C:\Users\Kevin\Desktop>test.py
Enter a format string: {0[print("pwned")]}
pwned
Lesson: don't do things that are bad ideas
7
 
trolololol
 
@roganjosh something I learned the hard way: To the German eye nothing is trivial :-))) I was in a discussion for about 30 minutes just because I said "Trees accept the language" and every single German friend of mine was like "WAS sagst du?" then I realized the smallest details matter SO MUCH to them. My CV got revisited 15 times and each time they had an issue with a dot at the end or no dots :-))) I love their mentality and am trying to stick with it :-P
 
eval not strictly necessary here, you could probably do something nasty with getattr (although the setup is even more contrived)
 
I'm also wondering if you can somehow abuse nested format specifiers (like '{0:{0}}'), but I don't think you can
 
My gut says maybe
 
4:08 PM
Your gut is pretty good at not being wrong (:
 
Pleased to see that youtube.com/watch?v=fpaQpyU_QiM still has an equal number of upvotes and downvotes. The only example of selfless cooperation on the whole Internet.
 
4:34 PM
hello
 
cbg idjaw
 
btw I hope you weren't upset about that loss
it meant nothing.
they sat out all their key players on both sides
 
? not at all, it's pre season, we played our AHL team to see who wants the lost few spots on our main roaster.
I was happy to see who we had in the pipeline and who was willing to dig pucks out of the corners.
 
at first I was a bit surprised. But then I saw the rosters.
:P
 
I felt bad for Spark but not his fault, I love how some of the "fans" were complaining about paying to see a trash team, like you are in pre season what did you expect our top lines ?
 
4:39 PM
lol
yeah....you can't complain in pre-season.
these are the same people that probably complain about free beer not being tasty enough or some crap like that
you're getting 400 dollar seats at like 50 bucks or something. hush
I don't know the exact prices. But they are at a crazy gap like that
 
Dude nosebleeds seats for opening night is 600+....
All the Buffalo games that we have at Buffalo are sold out in Dec and March....
 
wait...leafs tickets are that much more brutal than habs tickets?
I'm genuinely shocked.
 
I wanted to see if I got get a pair of tickets to go see with my buddy in Dec when I take my month off, couldnt bring myself to spend 600+ for one
 
did it skyrocket when they started doing better? Or was it always like this
 
it was 300 when we got Matthews
 
4:43 PM
haha
lol
 
when we got 91, and Vegas has us as the favourites to win it went up and up.
Every ticket is bought and trying to be resold lol
 
yeah. I mean hey, it's a smart money move.
 
the only time you can get a sub 200 is when the game is happening and the resellers wants to dump the tickets
 
yeah. same here.
 
I told my boss, which he understands, if we win the cup, I'm downtown partying.
 
4:45 PM
it should be a city-wide holiday
I want the sharks to just get the cup already so I can just start rooting for another team already in the playoffs 😛
 
lol... my co worker was surprised I called it right for karlsson going to the sharks
 
My friend was having a fit because someone showed a picture of a sens moving truck in jersey
the day karlsson was announced
lol
 
=O I was surprised about Pacioretty to Vegas though.
it made sense but I didn't believe it would come true lol
 
My jupyter notebook presentation went well. Here's my notes: I used the IPython.display.HTML to show a few iframes with documentation (which I took them on a tour of), then I alternated code and (markdown formatted) display text, it seemed to go rather well. I used the %%time "magic" to time the difference between two different approaches. Good stuff, 10/10 would do it again.
 

« first day (2901 days earlier)      last day (2061 days later) »