HN Explorer

30 comments

[ 5.8 ms ] story [ 78.0 ms ] thread
anonfunction
Since I made this, I'm glad some people like it (and not surprised some don't) but I'd love to answer some technical questions or hear any bugs / issues / security holes you hackers might have found. Cheers!
johnernaut
JavaScript in the body of the message box executes 0.o very cool none-the-less.
anonfunction
Only for you, it gets filtered before going over the wire. Have fun :)
octatone2
Should still be sanitizing user input, there's no reason to be passing the message as an html variable in handlebars {{{message}}} :/

You trust your server-side sanitization that much?

sk00byd00
Do you trust the client side at all?
octatone2
I trust handlebars with all my user inputs.
C1D
It feels like I'm being spammed, there isn't enough time to read the messages and its also getting flooded by people with the usernames flood and flooder.
anonfunction
Ya, I tried to implement rate limiting and failed, this was last night at 3am, so let me try again. If you code you might be able to beat me to it: https://github.com/Mashape/worldchat
C1D
I'm going out but when I get home I will see what I can do :) EDIT: I think using websockets + node.js would be a better idea.
[deleted]
(comment deleted)
shared4you
I choose the "German" flag. Does it mean that I should type in German or others' messages are translated to German? It's not at all clear from the wording: "Choose your username and language to start chatting with the world"... What if I want to type in English but read others' messages in German?
ne0phyte
Both? It probably means that you write in German and other messages are translated to your language (German).

That's the only thing that would make sense.

anonfunction
This is correct. Basically whatever flag you choose is what determines the "From" translation language on your outgoing messages and the "To" language for incoming.
anonfunction
Sorry to confuse you, the UX is kinda wonky. Whatever flag you choose is what determines your language for both outgoing and incoming messages. So if you choose German, that is what will determine the "From" language to translate on your outgoing messages and the "To" language for incoming.
scottshea
This is not a feature request by any means. I suspect that this and autocorrect would combine for some seriously funny international humor.
octatone2
{{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ...

also, rate limit the users, this is thing is managing to crash chrome!

anonfunction
Working on it, any tips to keep entity encoding in handlebars without the triple stash?
octatone2
Don't encode entities on the server side if you are using handlebars, it will do that for you (that's the point of using {{}} it will make all user input "safe").
Sephr
Don't encode entities, just use the DOM (append text nodes).
canthonytucci
TIL Frühstücksfleisch is german for "SPAM"

good job shutting that fellow down. Very cool little app.

edit:

well...maybe some kind of rate limit might help.

obviouslygreen
I built a proof of concept for something like this for someone quite a while ago... what he had that you desperately need is channels. This is entirely useless with any amount of people (particularly when spammers can't be controlled, which is just how the net is). Excellent idea, but it needs some concept of segmentation to be useful.
ecto
I got through with this

  ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
vfl0
Due to the massive amounts of spamming going on right now I think there should be some sort of chat room system on there which allows you to create a room and send the link.

Or you could even follow a similar idea to Omegle by pairing two people together but make it so it pairs two people who speak in different languages?

[deleted]
(comment deleted)