Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Haha, I’m glad to see people enjoy this (author here)! If you like this sort of thing, some other terrible proof-of-concepts I’ve done:

A ruby dsl that’s indistinguishable from JavaScript. http://kevinkuchta.com/_site/2017/07/disguising-ruby-as-java...

^ and in talk form: http://confreaks.tv/videos/rubyconf2018-ruby-is-the-best-jav...

A url-shortener using AWS lambda - JUST lambda. No data store. http://kevinkuchta.com/_site/2018/03/lambda-only-url-shorten...



> Some people, when confronted with a problem, think "I know, I'll use AWS Lambda." Now they have thousands of concurrent problems.

You made my day.


Now, saner developers might tell you that Lambda is stateless and you can't use it to store data. You and I know those people just lack strength of character. Remember: if Lambda functions don't solve your problem, you're not using enough of them.


"Lambda is a very specific kind of hammer that's extremely good at hammering a very specific kind of nail."

Wise and funny, at the same time.


Hahahahahahahahahahah Mine too. Thanks for the chuckle


haha


Following the link in your readme to davywtf's twitter post, I saw this comment by dade:

>I remember last year, and probably the year before that, and probably the year before that still, people continually rediscover CSS keylogging. Glad to see something more interesting this time. Good work.

Following up on this, I found an article[0] claiming that it isn't really an issue since a pure CSS keylogger can only catch one character. It seems to me like your method of pseudo-refreshing the page by making old elements hidden and delivering new elements to replace them might be able to overcome this impediment, which would make your on-screen keyboard unnecessary; if I understand correctly, you could just keep capturing whatever the user types in a field, and deliver a new field that already has whatever they've typed already as the default value with autofocus on. Do I understand correctly? Is there something I'm missing, like autofocus not playing well with continuous chunks of data being delivered? I'm not saying you should put in the additional effort to do this for your beautiful-horrible-clusterfuck of a project, I'm just curious about the feasibility and thought you might already know the answer.

[0]: https://www.bram.us/2018/02/21/css-keylogger-and-why-you-sho...


> Following up on this, I found an article[0] claiming that it isn't really an issue since a pure CSS keylogger can only catch one character.

That reminds me of:

• Stealing Data With CSS: Attack and Defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-...

• CSS Exfil Vulnerability Tester https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...

• CSS Exfil Protection (Firefox) https://addons.mozilla.org/en-US/firefox/addon/css-exfil-pro...

• CSS Exfil Protection (Chrome) https://chrome.google.com/webstore/detail/css-exfil-protecti...

Never really got much coverage. It's not mitigated by uBlock or uMatrix (unless you deny all CSS).


When I saw this had 400+ upvotes, I kind of rolled my eyes and thought, Wow, HN will upvote the absolute worst idea if it’s an implausible-enough hack. But having actually read your explanation and FAQ, I have to admit every upvote is well earned, including mine. That is really concise and entertaining prose, and the feat is well done. Bravo.


Love this idea and your excellent explanation on git--then there was this gem (added the first ? and :):

"Why's your code suck?: Why do you suck?"


>A url-shortener using AWS lambda - JUST lambda

I expected a lambda, which compresses/decompresses the url. This would also work without storing anything.


I was guessing something diabolical like https://code.kryo.se/pingfs/


I love hacky things like this one.


Good god I need to buy you a beer, those were incredible. Let me know if you ever get to Toronto!


Just looked at your other projects. You're a terrorist. XD


A maybe more horrible idea, but also more fun, would be to deliver not an HTML that infinitely loads, but an mjpeg like webcam monitoring software does. Server-side rendering taken to the extreme.


Thank you for elegantly solving the “don’t click order twice!!!” problem:

Thankfully, our method of receiving data fixes that for us. Here's what happens:

We show an "a" button whose background image is like "img/a". When you press it, the server receives the image request for "a" The server then pushes an update to the client to hide the current button and replace it with one whose background images is "image/aa".


I love the crazy idea, but I’m upvoting for the FAQ alone, it’s hilarious and made me spit some coffee.


Enjoyed the hack and the FAQ.


Reading your comment is the first time I’ve ever pronounced FAQ in such a way as to rhyme with “hack” instead of as “fax/facts” or “Ef Ay Qu” or “teh Questions.”

I am happy to add “the hack FAQ” to my snack pack.


I always read FAQ as "eff-aye-que." Relatedly, I recently saw an HN comment with the line "an .edu," referring to the TLD, and at first took it as a grammatical error since I pronounced the "." as "dot" in my head rather than dropping it as the author intended. Then I realised I was pronouncing the whole thing as "an dot ee-dee-you," whereas I would naturally think of ".com" as "dot com." I'm not sure why, but I think one possibility is that the recent proliferation of .io domains has made me think of other less common TLDs as the sum of their constituent letters rather than as fragments of words. Another possibility is that less common TLDs need to be spelled out for people in normal parlance more frequently. Yet, I'm pretty sure I've been thinking of the recently added ".dev" TLDs as "dot dev," not "dot dee-ee-vee," perhaps specifically because I've never had to spell it out for somebody in speech? Or maybe because we use "dev" as a standalone word already, as in "dev house?" I dunno. It would be interesting to see a survey of how different people naturally pronounce acronyms and word-fragment-TLDs like this.


My pronunciations:

* FAQ is "fack", though I hear "eff-aye-que" often enough. * .edu is "dot ee dee you" not "dot ed-you", though I pronounce all of the other old-school domains as words. * .dev is definitely "dot dev", since "dev" is a word.

It may be apocryphal, but I remember reading somewhere that Tim Berners-Lee chose the name "World Wide Web" because the acronym was harder to say than the word itself.


> .edu is “dot ee dee you” not “dot ed-you”

I prefer ed-you, since it’s both shorter and matches the pronunciation of ‘education’. But when I’m feeling saucy, I pronounce .edu “dot eedoo”.


".io" sounds the same whether pronounced or spelled out. We usually pronounce TLD's - com, org, net, ly etc.


Same for Americans, but it’s ‘ee-oh’ for a lot of other languages. I like to say “dot yo” whenever I get the chance, and flash my best west side hand sign.


That was not intended. If I could edit my original comment I'd say it was a great hack and the humor in the FAQ is appreciated.


Killjoy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: