4 ms·

The source file is a big mess, 4chan slang everywhere, twitter authentication code, rss reader code (WTF? Why?), random commented code, "nones" and "yeah" strin

The source file is a big mess, 4chan slang everywhere, twitter authentication code, rss reader code (WTF? Why?), random commented code, "nones" and "yeah" strings instead of booleans, random HTML scattered everywhere, I could go on. This just seems silly and insecure. Noone in their right mind would use this for any kind of serious secure communication. Personally I'd wait for someone to remove all the extraneous stuff, make a real protocol definition and make this modular (for example, split the web-interface from the server). Great idea though, and a nice proof-of-concept, I'd give them that. There might be a real need for something like this when governments shut down or block internet connectivity.

carlesfe 12y ago
If you watch the video you can see that the RSS code is used to receive RSS feeds (I guess for those people who don't have internet access) and the Twitter auth is used similarly to receive Twitter updates (e.g. they show :twittersearch=#syria) The video is quite interesting, it shows the proof of concept. I agree about the source code though, they have tried too hard being "lulz" at the expense of readability. This project is very, very interesting. Unfortunately it requires some investment in the radio equipment, but I can see in a few months some Arduino bundles with this code and the radio antenna...
- fredsted 12y ago
  I may have been too harsh in my original reply also; the author has some comments on github about a code review that was done: http://cl.ly/2A0b093d3i3N http://cl.ly/2A0b093d3i3N
pearjuice 12y ago
Just because the code doesn't confirm to your latest language standards and flavor-of-the-month Javascript-framework doesn't mean it is silly or insecure. In fact you even acknowledge this in the last paragraph. This sounds like a cheap stab at Perl.
- mahmud 12y ago
  No need to be defensive, this really is crappy code. It's just one big file of hot mess. Clearly, the author is better at home breaking software than making it. And it's fine. He or she also has certain amount of artistic leeway in expression, but not excuse from secure programming.
  - pearjuice 12y ago
    Have you ever looked at the Linux kernel source files? ViM? Just because the code is bad doesn't mean the application is bad.
    - mahmud 12y ago
      Have you? Linux is gorgeous! Plus this thing is meant to evade governments; you can't expect something this hideous to be audited, and used, and for others to trust their lives with.
      - teacup50 12y ago
        Wait, gorgeous? Since when?
    - adhipg 12y ago
      This honestly is not an example of very readable code: https://github.com/lulzlabs/AirChat/blob/master/airchat.pl#L595-L635 https://github.com/lulzlabs/AirChat/blob/master/airchat.pl#L...
      - ibisum 12y ago
        You lost me at .pl ..
      - jaseemabid 12y ago
        Why so many regular expressions everywhere? 0_o
Cakez0r 12y ago
The amount of evals in the code is troubling too... eval{$penis = $cgi->param('postfield')}; eval{$penispenis = $cgi->param('postfield')};
- arnsholt 12y ago
  That's a block eval, not a string eval. Block evals are the equivalent of a catch block in Java or the like, so this is perfectly safe (modulo correct exception checking and such, of course..
  - lepht 12y ago
    Although this isn't exactly a case of great eval use – the exceptions are effectively swallowed after printing (at least use warn?), and the $@ isn't being properly localized
rkachowski 12y ago
I'm viewing it as intentional, a childish meta "fuck you" towards the various government agents that they imagine will be forced to spend hours deciphering the code. It totally flies in the face of open collaboration however.

carlesfe 12y ago

If you watch the video you can see that the RSS code is used to receive RSS feeds (I guess for those people who don't have internet access) and the Twitter auth is used similarly to receive Twitter updates (e.g. they show :twittersearch=#syria) The video is quite interesting, it shows the proof of concept. I agree about the source code though, they have tried too hard being "lulz" at the expense of readability. This project is very, very interesting. Unfortunately it requires some investment in the radio equipment, but I can see in a few months some Arduino bundles with this code and the radio antenna...

fredsted 12y ago
I may have been too harsh in my original reply also; the author has some comments on github about a code review that was done: http://cl.ly/2A0b093d3i3N http://cl.ly/2A0b093d3i3N

pearjuice 12y ago

Just because the code doesn't confirm to your latest language standards and flavor-of-the-month Javascript-framework doesn't mean it is silly or insecure. In fact you even acknowledge this in the last paragraph. This sounds like a cheap stab at Perl.

mahmud 12y ago
No need to be defensive, this really is crappy code. It's just one big file of hot mess. Clearly, the author is better at home breaking software than making it. And it's fine. He or she also has certain amount of artistic leeway in expression, but not excuse from secure programming.
- pearjuice 12y ago
  Have you ever looked at the Linux kernel source files? ViM? Just because the code is bad doesn't mean the application is bad.
  - mahmud 12y ago
    Have you? Linux is gorgeous! Plus this thing is meant to evade governments; you can't expect something this hideous to be audited, and used, and for others to trust their lives with.
    - teacup50 12y ago
      Wait, gorgeous? Since when?
  - adhipg 12y ago
    This honestly is not an example of very readable code: https://github.com/lulzlabs/AirChat/blob/master/airchat.pl#L595-L635 https://github.com/lulzlabs/AirChat/blob/master/airchat.pl#L...
    - ibisum 12y ago
      You lost me at .pl ..
    - jaseemabid 12y ago
      Why so many regular expressions everywhere? 0_o

Cakez0r 12y ago

The amount of evals in the code is troubling too... eval{$penis = $cgi->param('postfield')}; eval{$penispenis = $cgi->param('postfield')};

arnsholt 12y ago
That's a block eval, not a string eval. Block evals are the equivalent of a catch block in Java or the like, so this is perfectly safe (modulo correct exception checking and such, of course..
- lepht 12y ago
  Although this isn't exactly a case of great eval use – the exceptions are effectively swallowed after printing (at least use warn?), and the $@ isn't being properly localized

rkachowski 12y ago

I'm viewing it as intentional, a childish meta "fuck you" towards the various government agents that they imagine will be forced to spend hours deciphering the code. It totally flies in the face of open collaboration however.