4 ms·

Very early on in my journey learning to write software, I wrote a “guestbook” feature for my personal site (also in PHP). Prior to that, the only code I’d succe

Very early on in my journey learning to write software, I wrote a “guestbook” feature for my personal site (also in PHP). Prior to that, the only code I’d successfully written and actually shipped (beyond PHP templating of data I fully controlled, even if I didn’t understand it) read ID3 metadata from MP3s (my own music). Point is I had never written anything that handled user input. I was also proud of my accomplishment and shared it with my nearest tech community. It was, if I recall, less than an hour before someone had exploited the obvious XSS vulnerability. At the time I was aghast and felt like it was a cruel thing to do. And while I know better than that now… Here’s the thing: that tech community, even the whole internet, was a lot smaller then. The person who exploited my naive first program accepting user input claimed responsibility and explained why. The other people around were both knowledgeable enough and kind enough to help me understand that that person was a friendly who meant no harm. Folks trying to learn new things now won’t be in a community like that by default, and probably won’t know to look for it. And the people who take advantage of that are clearly more malicious and not friendlies. I don’t know what the takeaway from my “here’s the thing” is, for HN, but I do think we’d all be better off if we pay close attention to being welcoming/supportive for noobs, and also strive to make learning tech less of a risk when inevitably first steps go wrong.

graderjs 5y ago
Yes it definitely seems like it could be a form of hazing inspired by people advertising themselves as noobs, or just by opening up a service. I've posted many show HNs over the past 7 years and many provided some ways for people to do computation on the server (by design) but not some form of limiting that (by my inexperience). I know everyone's experience can be different, and I know that sometimes, and for me personally, other things that people do on ShowHNs are particularly hurtful--Like being cruel or dismissive...I mean you're bearing your soul right? Your work; a little embryonic thing you're contributing to the world... And some people seem like they just want to try to kill that--but for me, that's been different to the security "hazing" my posts received. I've been personally grateful for those security hazings, because it gave me opportunities to test and improve those projects. Seriously the best free security audit you could get. Sometimes it felt annoying .. because I thought I'd patch something but then I checked the server I found people found a way through or found a way to circumvent that. But I saw it as a challenge and I imagined it was like a way to redteam and anticipate and prevent things that would end up happening in the real world anyway so it was incredibly valuable actually in hardening the products I made. Good learning experience too. :) My favorite event to solve was people using my remote browser product to run cryptocurrency mining javascript. And overcoming that challenge was quite tricky at first, because cpulimit is more of a suggestion than a hard limit. And also because the cloud where I originally ran this (and most clouds have this rule too), disallowed using the compute resources for mining crypto so I almost got a strike on my account because other people were using this thing I had opened up to mine with. After discussing with the contact window everything was cool, but I still needed a way to block this. While there are CPU throttling apis I could use on a per tab basis via Chrome remote debugging protocol (and I may look into that more in future), there's also a chance that under high CPU load the debugging protocol becomes unresponsive and so you can't intervene via that route anyway. What I went with was just operating system process monitoring and cgroups (now v2 in the latest kernels which are unfortunately for now more limited) plus killing processes that violated too many monitoring intervals. A cool thing about Google Chrome is it's pretty robust to killing some of its processes off so you can kill off the processes of a couple of tabs that are involved in cryptocurrency mining but it doesn't kill the entire browser. The whole thing was a great way to learn more operating system internals as well as to discover the plethora of tools available for resource control in linux. Particularly impressive are the networking and bandwidth control options like iptables. So instead of dockerizing my apps I basically created these custom sandboxes by using operating system apis that's been incredibly effective at preventing abuse.
eyelidlessness 5y ago
And to g105b, I’m also sorry if I’ve implied any inappropriate noobness, it sounds like what you built was pretty cool. Please take whatever abuse you received in stride, and keep building cool stuff!
- g105b 5y ago
  hey, with web sockets I am a noob. I'm generally quite ok with internet security as a concept, but I was massively naive in my implementation here, and one very obvious vulnerability in my code was allowing to store anything the connection received, rather than forcing to just a single character. It tempted someone to upload binary content. After only a few minutes, the server was full of random binary data. Curious, I inspected the content, and after finding a massive dump of illegal content I thought it was best to turn off the server for a bit while I think about improvements to the code and wash my eyes out.
emj 5y ago
I had the same security support for my guestbook (took 24h). After fixing I came back 3 months later because of a physical letter¹, the guestbook was filled with very specific slander. Years later I found this https://www.penny-arcade.com/comic/2004/03/19 https://www.penny-arcade.com/comic/2004/03/19 and thought about how different we interpret peoples action when we know them and not. [1] When the Whois DB worked, and people thought about sending letters.

graderjs 5y ago

Yes it definitely seems like it could be a form of hazing inspired by people advertising themselves as noobs, or just by opening up a service. I've posted many show HNs over the past 7 years and many provided some ways for people to do computation on the server (by design) but not some form of limiting that (by my inexperience). I know everyone's experience can be different, and I know that sometimes, and for me personally, other things that people do on ShowHNs are particularly hurtful--Like being cruel or dismissive...I mean you're bearing your soul right? Your work; a little embryonic thing you're contributing to the world... And some people seem like they just want to try to kill that--but for me, that's been different to the security "hazing" my posts received. I've been personally grateful for those security hazings, because it gave me opportunities to test and improve those projects. Seriously the best free security audit you could get. Sometimes it felt annoying .. because I thought I'd patch something but then I checked the server I found people found a way through or found a way to circumvent that. But I saw it as a challenge and I imagined it was like a way to redteam and anticipate and prevent things that would end up happening in the real world anyway so it was incredibly valuable actually in hardening the products I made. Good learning experience too. :) My favorite event to solve was people using my remote browser product to run cryptocurrency mining javascript. And overcoming that challenge was quite tricky at first, because cpulimit is more of a suggestion than a hard limit. And also because the cloud where I originally ran this (and most clouds have this rule too), disallowed using the compute resources for mining crypto so I almost got a strike on my account because other people were using this thing I had opened up to mine with. After discussing with the contact window everything was cool, but I still needed a way to block this. While there are CPU throttling apis I could use on a per tab basis via Chrome remote debugging protocol (and I may look into that more in future), there's also a chance that under high CPU load the debugging protocol becomes unresponsive and so you can't intervene via that route anyway. What I went with was just operating system process monitoring and cgroups (now v2 in the latest kernels which are unfortunately for now more limited) plus killing processes that violated too many monitoring intervals. A cool thing about Google Chrome is it's pretty robust to killing some of its processes off so you can kill off the processes of a couple of tabs that are involved in cryptocurrency mining but it doesn't kill the entire browser. The whole thing was a great way to learn more operating system internals as well as to discover the plethora of tools available for resource control in linux. Particularly impressive are the networking and bandwidth control options like iptables. So instead of dockerizing my apps I basically created these custom sandboxes by using operating system apis that's been incredibly effective at preventing abuse.

eyelidlessness 5y ago

And to g105b, I’m also sorry if I’ve implied any inappropriate noobness, it sounds like what you built was pretty cool. Please take whatever abuse you received in stride, and keep building cool stuff!

g105b 5y ago
hey, with web sockets I am a noob. I'm generally quite ok with internet security as a concept, but I was massively naive in my implementation here, and one very obvious vulnerability in my code was allowing to store anything the connection received, rather than forcing to just a single character. It tempted someone to upload binary content. After only a few minutes, the server was full of random binary data. Curious, I inspected the content, and after finding a massive dump of illegal content I thought it was best to turn off the server for a bit while I think about improvements to the code and wash my eyes out.

emj 5y ago

I had the same security support for my guestbook (took 24h). After fixing I came back 3 months later because of a physical letter¹, the guestbook was filled with very specific slander. Years later I found this https://www.penny-arcade.com/comic/2004/03/19 https://www.penny-arcade.com/comic/2004/03/19 and thought about how different we interpret peoples action when we know them and not. [1] When the Whois DB worked, and people thought about sending letters.