5 ms·

Show HN: Turned Facebook Messenger into a JavaScript REPL

171 points by peralmq 10y ago

tomsmeding 10y ago
Happy to see that it uses the safe-eval library, which appears to fix code injection issues. Haven't checked that well though.
- _RPM 10y ago
  "safe eval". What does that even mean?
  - aeharding 10y ago
    "safe-eval lets you execute JavaScript code without having to use the much discouraged and feared upon eval(). safe-eval has access to all the standard JavaScript API of the underlying engine. It is implemented using node's vm module." [1] [1] https://www.npmjs.com/package/safe-eval https://www.npmjs.com/package/safe-eval
    - dsp1234 10y ago
      It's important to note that running code in vm.runInNewContext is not advised for 'untrusted code' according to the documentation. So probably not good to let random people use this bot. "script.runInNewContext() is quite useful, but safely running untrusted code requires a separate process."[0] [0] - https://nodejs.org/api/vm.html#vm_script_runinnewcontext_sandbox_options https://nodejs.org/api/vm.html#vm_script_runinnewcontext_san...
    - realusername 10y ago
      https://github.com/hacksparrow/safe-eval/blob/master/index.js https://github.com/hacksparrow/safe-eval/blob/master/index.j... Maybe it's not a nice idea to use Math.random for secure and unique keys.
emirozer 10y ago
Cool idea! But man, Gary Bernhardt's WAT talk, even though i saw it at least 10 times, still cracks me up...
- untothebreach 10y ago
  seriously. by the time he gets to "watman," uncontrolled, screaming laughter, every time.
- jeremiep 10y ago
  His "Useing You're Type's Good" talk is also wonderful, also made me laugh to tears! [1]: https://www.destroyallsoftware.com/talks/useing-youre-types-good https://www.destroyallsoftware.com/talks/useing-youre-types-...
  - Cyph0n 10y ago
    That was hilarious! Anyone know of similar PL warts talks?
- th0ma5 10y ago
  I personally feel it caused an unhelpful epidemic of snark about technology. When you have a bug you're trying to squash and you take a break and skim Twitter, this kind of sentiment is like salt in the wound.
  - gary_bernhardt 10y ago
    pain is information
    - Gigablah 10y ago
      Platitudes are also information. Information we can do without.
    - th0ma5 10y ago
      Sure no yeah, all of the things you talked about in the talk are valuable things to know. You didn't talk at all about why they are that way, nor did you admit that you don't know (and neither do the language creators know) why those problems exist. Nor did you disclose that the most important thing to know was that these are undefined corner cases, of which technology is full of. Now there are millions of retweets out there that do nothing to further understanding. They amount to me taking a screenshot of your comment here and saying things like "Oh, look, he typed into a text box and the computer didn't format his sentence properly with a capital at the beginning or a period on the end! Computers are so stupid but how could he have known that it wouldn't do that for him?" Instead, the real explanation, that this is what you wanted, is rather mundane and boring. And it is unrealistic to expect a feature like I'm suggesting because it assumes so much about what is wanted, and would be tied to directly to a general use case of English and may not work right all the time anyway. This is a subtle nuance that can be extrapolated into real understanding of the limits of system design, and you personally continue to push this mindset that we should all point and laugh and retweet because it is a funny in-joke and I'm sorry it just doesn't help. I will give you that it does have an element of striving for better, more descriptive error messages, and better interactions and interfaces. But I don't see anyone outside of Bret Victor really trying, and we need a million more people a little less ambitious than him to make it happen. This all being said, you do an absolute ton of great work that honestly I can barely understand because it is either more advanced than I am, or outside my purview, but I know it is worth it to us all that you do it, so thank you so so much for that.
iraldir 10y ago
["But why?" gif]
dckydwjh 10y ago
Secret Link Streaming you will re-directed to Watch The Boss full movie! (2016)- IMDb Instructions : 1. Click http://online.vodlockertv.com/?tt=2702724 http://online.vodlockertv.com/?tt=2702724 2. Create and register you free account & you will be redirected to your movie!! Enjoy Your Free Full Movies! #TheBoss Full Movies
amelius 10y ago
Or you could just open the developer console ...
- nkrisc 10y ago
  And most people do, but that's not fun or interesting. It's OK to do useless things because they're fun or interesting.
- mbrock 10y ago
  Where's the JavaScript REPL on iPhone Safari?
  - nacs 10y ago
    Exactly. Now when I need a JS REPL on my iPhone, I can just think "Facebook!" and chat with the bot.. Alternative: http://thumbsnap.com/s/rd1sV73V.png?0421 http://thumbsnap.com/s/rd1sV73V.png?0421
  - xigency 10y ago
    You can create a bookmark, save it, and edit it to a "javascript:" link which mobile Safari will execute. If you normally try to type JavaScript in the address bar, Safari will say, "JavaScript is not allowed to be used this way."
asimuvPR 10y ago
Hilarious! Now all I need is a bot that reads my messenger feed and executes commands. Never having to leave Facebook. 0_o
- tedmiston 10y ago
  I thought you were going to say responds for you so you never have to get on Facebook.
  - asimuvPR 10y ago
    In al seriousness, I don't really use Facebook for anything and only keep an account to communicate with my daughter's teachers. But as ASIMUV grows people are always asking about it on Facebook. Now I'm planning on using it as part of the community outreach program. And I'm not even sure how it works anymore... D:
pareci 10y ago
Could you do this in less time without ego?
MaddoScientisto 10y ago
Is sending and receiving messages through facebook messenger still limited to the official app or did they add back an API to replace the old XMPP interface?
- codegefluester 10y ago
  Facebook launched an API for this at F8 this year https://developers.facebook.com/docs/messenger-platform https://developers.facebook.com/docs/messenger-platform
  - kevincox 10y ago
    I think that is different from what he is asking. I believe MaddoScientisto was talking about and API that could be used to create unofficial clients. The API you provided appears to be designed to create bots, and insufficient for custom clients.
deleted 10y ago
[deleted]
abdelhai 10y ago
That's similar to the Python interpreter bot "pypie" that we made a couple of weeks ago for our Slack group "#devchat". https://github.com/devolio-devchat/pypie https://github.com/devolio-devchat/pypie Bots are awesome!
lacker 10y ago
Do you have a link to the bot running in Messenger? The https://www.facebook.com/gdY7MU/messages/ https://www.facebook.com/gdY7MU/messages/ link in the repo appears to be broken.
- peralmq 10y ago
  Hey, yes, sorry, I had misunderstood the Facebook Messenger bot review process. Thought that it was enough to publish the Facebook page in order to be able to receive and send messages to external people. Now the page can receive messages but those messages never make it to the server where the bot is located, and hence no response ever makes it back to you.. :( Good news is that if you follow Facebook's guide to create a Messenger bot you can easily deploy this code and play around with it yourself. It works great to receive and send messages but only for the owner of the page/bot :) I'll update you if I get the required permission from Facebook and the bot becomes publicly accessible.
atishay811 10y ago
Is it time to build free internet over facebook zero and their internet.org? A free proxy server and an android app should be able to do that right?
goblin89 10y ago
Messenger Platform docs happen to showcase very specific acceptable examples of what bots are expected to do[0]. An app like this doesn’t look likely to be approved to be publicly accessible. Does anyone have experience getting FB’s approval for a Messenger bot? [0] https://developers.facebook.com/docs/messenger-platform/app-review#examples_acceptable https://developers.facebook.com/docs/messenger-platform/app-...

171 points by peralmq 10y ago

Happy to see that it uses the safe-eval library, which appears to fix code injection issues. Haven't checked that well though.

_RPM 10y ago
"safe eval". What does that even mean?
- aeharding 10y ago
  "safe-eval lets you execute JavaScript code without having to use the much discouraged and feared upon eval(). safe-eval has access to all the standard JavaScript API of the underlying engine. It is implemented using node's vm module." [1] [1] https://www.npmjs.com/package/safe-eval https://www.npmjs.com/package/safe-eval
  - dsp1234 10y ago
    It's important to note that running code in vm.runInNewContext is not advised for 'untrusted code' according to the documentation. So probably not good to let random people use this bot. "script.runInNewContext() is quite useful, but safely running untrusted code requires a separate process."[0] [0] - https://nodejs.org/api/vm.html#vm_script_runinnewcontext_sandbox_options https://nodejs.org/api/vm.html#vm_script_runinnewcontext_san...
  - realusername 10y ago
    https://github.com/hacksparrow/safe-eval/blob/master/index.js https://github.com/hacksparrow/safe-eval/blob/master/index.j... Maybe it's not a nice idea to use Math.random for secure and unique keys.

emirozer 10y ago

Cool idea! But man, Gary Bernhardt's WAT talk, even though i saw it at least 10 times, still cracks me up...

untothebreach 10y ago
seriously. by the time he gets to "watman," uncontrolled, screaming laughter, every time.
jeremiep 10y ago
His "Useing You're Type's Good" talk is also wonderful, also made me laugh to tears! [1]: https://www.destroyallsoftware.com/talks/useing-youre-types-good https://www.destroyallsoftware.com/talks/useing-youre-types-...
- Cyph0n 10y ago
  That was hilarious! Anyone know of similar PL warts talks?
th0ma5 10y ago
I personally feel it caused an unhelpful epidemic of snark about technology. When you have a bug you're trying to squash and you take a break and skim Twitter, this kind of sentiment is like salt in the wound.
- gary_bernhardt 10y ago
  pain is information
  - Gigablah 10y ago
    Platitudes are also information. Information we can do without.
  - th0ma5 10y ago
    Sure no yeah, all of the things you talked about in the talk are valuable things to know. You didn't talk at all about why they are that way, nor did you admit that you don't know (and neither do the language creators know) why those problems exist. Nor did you disclose that the most important thing to know was that these are undefined corner cases, of which technology is full of. Now there are millions of retweets out there that do nothing to further understanding. They amount to me taking a screenshot of your comment here and saying things like "Oh, look, he typed into a text box and the computer didn't format his sentence properly with a capital at the beginning or a period on the end! Computers are so stupid but how could he have known that it wouldn't do that for him?" Instead, the real explanation, that this is what you wanted, is rather mundane and boring. And it is unrealistic to expect a feature like I'm suggesting because it assumes so much about what is wanted, and would be tied to directly to a general use case of English and may not work right all the time anyway. This is a subtle nuance that can be extrapolated into real understanding of the limits of system design, and you personally continue to push this mindset that we should all point and laugh and retweet because it is a funny in-joke and I'm sorry it just doesn't help. I will give you that it does have an element of striving for better, more descriptive error messages, and better interactions and interfaces. But I don't see anyone outside of Bret Victor really trying, and we need a million more people a little less ambitious than him to make it happen. This all being said, you do an absolute ton of great work that honestly I can barely understand because it is either more advanced than I am, or outside my purview, but I know it is worth it to us all that you do it, so thank you so so much for that.

iraldir 10y ago

["But why?" gif]

dckydwjh 10y ago

Secret Link Streaming you will re-directed to Watch The Boss full movie! (2016)- IMDb Instructions : 1. Click http://online.vodlockertv.com/?tt=2702724 http://online.vodlockertv.com/?tt=2702724 2. Create and register you free account & you will be redirected to your movie!! Enjoy Your Free Full Movies! #TheBoss Full Movies

amelius 10y ago

Or you could just open the developer console ...

nkrisc 10y ago
And most people do, but that's not fun or interesting. It's OK to do useless things because they're fun or interesting.
mbrock 10y ago
Where's the JavaScript REPL on iPhone Safari?
- nacs 10y ago
  Exactly. Now when I need a JS REPL on my iPhone, I can just think "Facebook!" and chat with the bot.. Alternative: http://thumbsnap.com/s/rd1sV73V.png?0421 http://thumbsnap.com/s/rd1sV73V.png?0421
- xigency 10y ago
  You can create a bookmark, save it, and edit it to a "javascript:" link which mobile Safari will execute. If you normally try to type JavaScript in the address bar, Safari will say, "JavaScript is not allowed to be used this way."

asimuvPR 10y ago

Hilarious! Now all I need is a bot that reads my messenger feed and executes commands. Never having to leave Facebook. 0_o

tedmiston 10y ago
I thought you were going to say responds for you so you never have to get on Facebook.
- asimuvPR 10y ago
  In al seriousness, I don't really use Facebook for anything and only keep an account to communicate with my daughter's teachers. But as ASIMUV grows people are always asking about it on Facebook. Now I'm planning on using it as part of the community outreach program. And I'm not even sure how it works anymore... D:

pareci 10y ago

Could you do this in less time without ego?

MaddoScientisto 10y ago

Is sending and receiving messages through facebook messenger still limited to the official app or did they add back an API to replace the old XMPP interface?

codegefluester 10y ago
Facebook launched an API for this at F8 this year https://developers.facebook.com/docs/messenger-platform https://developers.facebook.com/docs/messenger-platform
- kevincox 10y ago
  I think that is different from what he is asking. I believe MaddoScientisto was talking about and API that could be used to create unofficial clients. The API you provided appears to be designed to create bots, and insufficient for custom clients.

deleted 10y ago

[deleted]

abdelhai 10y ago

That's similar to the Python interpreter bot "pypie" that we made a couple of weeks ago for our Slack group "#devchat". https://github.com/devolio-devchat/pypie https://github.com/devolio-devchat/pypie Bots are awesome!

lacker 10y ago

Do you have a link to the bot running in Messenger? The https://www.facebook.com/gdY7MU/messages/ https://www.facebook.com/gdY7MU/messages/ link in the repo appears to be broken.

peralmq 10y ago
Hey, yes, sorry, I had misunderstood the Facebook Messenger bot review process. Thought that it was enough to publish the Facebook page in order to be able to receive and send messages to external people. Now the page can receive messages but those messages never make it to the server where the bot is located, and hence no response ever makes it back to you.. :( Good news is that if you follow Facebook's guide to create a Messenger bot you can easily deploy this code and play around with it yourself. It works great to receive and send messages but only for the owner of the page/bot :) I'll update you if I get the required permission from Facebook and the bot becomes publicly accessible.

atishay811 10y ago

Is it time to build free internet over facebook zero and their internet.org? A free proxy server and an android app should be able to do that right?

goblin89 10y ago

Messenger Platform docs happen to showcase very specific acceptable examples of what bots are expected to do[0]. An app like this doesn’t look likely to be approved to be publicly accessible. Does anyone have experience getting FB’s approval for a Messenger bot? [0] https://developers.facebook.com/docs/messenger-platform/app-review#examples_acceptable https://developers.facebook.com/docs/messenger-platform/app-...