caffeinewriter

While you might have access to the AST, obfuscated JS is still harder for humans to parse, and reverse engineer what the original function is doing.

For example:

    var _0x11f8=['\x6c\x6f\x67'];(function(_0x417d16,_0x4a5f0f){var _0x2d056f=function(_0x25076e){while(--_0x25076e){_0x417d16['push'](_0x417d16['shift']());}};var _0x26edf0=function(){var _0x522f05={'data':{'key':'cookie','value':'timeout'},'setCookie':function(_0x3d387a,_0x44e067,_0xfea505,_0x41ff72){_0x41ff72=_0x41ff72||{};var _0x47c6cd=_0x44e067+'='+_0xfea505;var _0x39897e=0x0;for(var _0x39897e=0x0,_0x329917=_0x3d387a['length'];_0x39897e<_0x329917;_0x39897e++){var _0x1c67fb=_0x3d387a[_0x39897e];_0x47c6cd+=';\x20'+_0x1c67fb;var _0x4c67f9=_0x3d387a[_0x1c67fb];_0x3d387a['push'](_0x4c67f9);_0x329917=_0x3d387a['length'];if(_0x4c67f9!==!![]){_0x47c6cd+='='+_0x4c67f9;}}_0x41ff72['cookie']=_0x47c6cd;},'removeCookie':function(){return'dev';},'getCookie':function(_0xc34cfd,_0x2e2a50){_0xc34cfd=_0xc34cfd||function(_0x3fc227){return _0x3fc227;};var _0x316ad0=_0xc34cfd(new RegExp('(?:^|;\x20)'+_0x2e2a50['replace'](/([.$?*|{}()[]\/+^])/g,'$1')+'=([^;]*)'));var _0x67e8e8=function(_0x595d8b,_0x29390a){_0x595d8b(++_0x29390a);};_0x67e8e8(_0x2d056f,_0x4a5f0f);return _0x316ad0?decodeURIComponent(_0x316ad0[0x1]):undefined;}};var _0x4341d3=function(){var _0x10361d=new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');return _0x10361d['test'](_0x522f05['removeCookie']['toString']());};_0x522f05['updateCookie']=_0x4341d3;var _0x44df89='';var _0x4a0249=_0x522f05['updateCookie']();if(!_0x4a0249){_0x522f05['setCookie'](['*'],'counter',0x1);}else if(_0x4a0249){_0x44df89=_0x522f05['getCookie'](null,'counter');}else{_0x522f05['removeCookie']();}};_0x26edf0();}(_0x11f8,0x126));var _0x2135=function(_0x32c6fa,_0x552733){_0x32c6fa=_0x32c6fa-0x0;var _0x18e137=_0x11f8[_0x32c6fa];return _0x18e137;};function _0x33f554(_0x101bb5,_0x53fcac,..._0x27ef18){var _0x36160c=function(){var _0xddce83=!![];return function(_0x3f37b8,_0x278fb0){var _0x3f096b=_0xddce83?function(){if(_0x278fb0){var _0x701868=_0x278fb0['apply'](_0x3f37b8,arguments);_0x278fb0=null;return _0x701868;}}:function(){};_0xddce83=![];return _0x3f096b;};}();var _0x4810be=_0x36160c(this,function(){var _0x31f51a=function(){return'\x64\x65\x76';},_0x28b288=function(){return'\x77\x69\x6e\x64\x6f\x77';};var _0x5848fd=function(){var _0x59a244=new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d');return!_0x59a244['\x74\x65\x73\x74'](_0x31f51a['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x46df82=function(){var _0x5b3a8d=new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b');return _0x5b3a8d['\x74\x65\x73\x74'](_0x28b288['\x74\x6f\x53\x74\x72\x69\x6e\x67']());};var _0x4b23f3=function(_0x5ac3b0){var _0x4153a0=~-0x1>>0x1+0xff%0x0;if(_0x5ac3b0['\x69\x6e\x64\x65\x78\x4f\x66']('\x69'===_0x4153a0)){_0x3d9fe5(_0x5ac3b0);}};var _0x3d9fe5=function(_0x467f75){var _0x4c33bb=~-0x4>>0x1+0xff%0x0;if(_0x467f75['\x69\x6e\x64\x65\x78\x4f\x66']((!![]+'')[0x3])!==_0x4c33bb){_0x4b23f3(_0x467f75);}};if(!_0x5848fd()){if(!_0x46df82()){_0x4b23f3('\x69\x6e\x64\u0435\x78\x4f\x66');}else{_0x4b23f3('\x69\x6e\x64\x65\x78\x4f\x66');}}else{_0x4b23f3('\x69\x6e\x64\u0435\x78\x4f\x66');}});_0x4810be();let _0xdbe94a=_0x101bb5/_0x53fcac;let _0x26ea56=_0x27ef18['\x72\x65\x64\x75\x63\x65']((_0xee94a6,_0x15b1b8)=>_0xee94a6*_0x15b1b8,_0xdbe94a);console[_0x2135('0x0')](_0x26ea56);}_0x33f554(0x1,0x2,0x3,0x4);

and

    function test(x, y, ...args) {
      let z = x / y;
      let ret = args.reduce((a, v) => (a * v), z);
      console.log(ret);
    }
    test(1, 2, 3, 4);

are functionally identical. (I used an off the shelf obfuscator)

No amount of obfuscation will stop a determined reverse engineer from pulling apart your code, but it can increase the cognitive load to the point where most people won't bother.

Also, just in case, nobody should ever run untrusted code, particularly not obfuscated untrusted code. Including the examples I posted above.

I appreciate all your transparency and engagement on this issue. It probably would have had the same outcome, yes, but potentially resolved much more quickly. Regardless, the fact that you're fixing it is music to my ears.

I mean, yes and no. Every business exists to make profit, but most companies thrive when their customers are happy, not miserable. Many (but not all) microtransactions in gaming, particularly in the more predatory free-to-play models, don't exist for the good of the product, but to offer a relief to the player as the game applies more pressure and pain to try and force the player to cave and spend money. Even the "just cosmetic" microtransactions lean hard on techniques to get the player to spend as much as possible. Both sides of this aren't universal, some businesses are very much "minimum effort, maximum profit" without much care for the quality of their product, and some games take great care to not fall into predatory monetization techniques, even with microtransactions, but speaking generally, it's something that seems rather unique to the game industry.

Good response from DO, but this line jumps out at me.

> Responses to account locks were not prioritized differently from a ticket management standpoint to be above less severe tickets.

That's arguably the biggest failure, IMO. The fact that an action which locks/terminates an account is not prioritized any different than a general ticket is pretty jaw-dropping, and I'm glad they're going to change that.

This isn't a new problem. Cloaking[1] has been around for a long time. Google[2], and Facebook[3] have been fighting this problem for years. Even Google hasn't had perfect luck with fighting off cloakers[4].

[1]: https://charlesngo.com/cloaking/ [2]: https://support.google.com/adspolicy/answer/6020954?hl=en#31... [3]: http://fortune.com/2017/08/09/facebook-cloaking-spam-adverti... [4]: https://wp.josh.com/2019/05/06/breaking-news-google-adwords-...

I'm https://takeoverthe.world/@caff :) Self-hosting Mastodon has been an adventure, for sure. However, relays have definitely helped with federation. :)

Basically, you have to go through the ICANN accreditation process, which is documented here:

https://www.icann.org/resources/pages/accreditation-2012-02-...

The cheaper, and easier way, if you're looking to start selling domains with a lower barrier to entry (but less control over how much you pay/how you sell your domains) is to find a white-label reseller registrar.

Here's an alternate mirror as well.

[link removed]

Edit: I'm removing my own copy, since I just realized I didn't set up a contact for that site, and I'd rather play it safe than sorry. Others have mirrored it, and one's on YouTube at present:

https://www.youtube.com/watch?v=E5gPdrlyc84

I feel like every language should have at least one "wat" style talk or article. Even for languages you adore, it's important to understand the quirks, shortcomings, and issues in a context that might seem absurd to an outside developer.

I completely understand the decision to not stand their ground. Going up against Slack means going up against a multi-billion dollar company, and potentially all the legal firepower that entails. Even if every monetary cost were covered, there's still the time and opportunity cost of dealing with legal headaches.

Arguably he shouldn't have had to, since the arbitration clause appeared in the Terms of Service after he made his pledge. I have my own opinions about arbitration but that's neither here nor there when what you agreed to did not dictate that you must resolve disputes through arbitration.

I was just thinking about this. Instead of versioning with an `Accept` header, or with a URL version, why not version off of an upgradable API key?

What? No.

> The statute applies to "confidential communications" -- i.e., conversations in which one of the parties has an objectively reasonable expectation that no one is listening in or overhearing the conversation. See Flanagan v. Flanagan, 41 P.3d 575, 576-77, 578-82 (Cal. 2002). A California appellate court has ruled that this statute applies to the use of hidden video cameras to record conversations as well. See California v. Gibbons, 215 Cal. App. 3d 1204 (Cal Ct. App. 1989).

If there's a reasonable expectation of privacy, all parties must consent to the recording.

I follow them as well :) Their work with containers, and their general commentary make for fascinating reading.

There's Codenvy[0], whose beta is built upon Eclipse's new Che[1], which can also be self-hosted.

[0]: https://codenvy.com/

[1]: http://www.eclipse.org/che/

I've been meaning to read Kill Decision for quite some time. Daniel Suarez has some really unique perspectives using near-future fiction. Daemon and Freedom™ were fascinating glimpses into the potential of the future of modern day technology.

I'd love to see a blog post on some of the nitty-gritty details on this. Even if there's no known root cause, it'd be fascinating to see your analysis on this.

Awesome! It wasn't readily apparent that delivery is handled by a third party before signing up. I've used Instacart before, so it's cool that it's just an integration, but I wasn't sure if it was an addon I was missing somewhere that had to be added to my subscription before I checked out.

This is the first startup in a while I've been excited to spend money on. It looks great, and it looks like it already has a very mature feature set. The one thing I didn't see was the pricing on the delivery options. Is that live yet? Or is that a future feature?

Submitted it to Hybrid Analysis, and this particular attachment appears to be benign, and is in fact an e-ticket for American Airlines. Doesn't seem to contain any embedded malware readily apparent in the analysis.

https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96...

Or why not some enterprising job seeker? That'd be one thing to put on the resume. "Contributed fixes to thousands of Github repositories."

Mostly off-topic, but if you haven't heard it before, you'd probably enjoy giving Criminal[0] a listen.

  [0]: http://thisiscriminal.com/

Or even Min[0] which was on here a few months back.

  [0]: https://news.ycombinator.com/item?id=11484770

Just because the bubble hasn't burst yet, doesn't mean we're not actually in a bubble. That line of reasoning irks me a bit, but still, it is laughable how the imminent bursting of the bubble has been predicted for nearly a decade.

Perhaps Browserify would be something that would work in this use case. Awesome job!

In addition, it might be cool to have in-line substitution of data. For example, in your analytics notebook[0], I noticed you referenced the number in text afterwards, but if Kajero was pulling from a live data source, it'd be neat to do something like this:

    Predictably, most came from the US ({{data.analytics[0]}}). There were also a lot ({{data.analytics[1]}}) from the UK - this is probably mainly due to it being posted on my Facebook page, with these hits being from friends rather than internet randoms.

[0]: http://www.joelotter.com/kajero/?id=3dfe6ba41741626a95b3a717...

Yikes.

I'm really hesitant to even consider this without it being run through the Diehard Tests[0], since from my understanding, "True Randomness" should be cryptographically secure should this be used in a CSPRNG.

[0]: https://en.wikipedia.org/wiki/Diehard_tests

This is definitely something that's needed, by myself, and many other developers. Determining module compatibility across versions is always a pain. Great tool!

Found an archive of it:

http://archive.is/5G7y7

Probably will have to pop open the JSBins as live ones to have them properly function.

Well that's disappointing (not at all on your part, but on the part of the current format), but completely understandable considering how freeform YC seems to have encouraged these applications to be.