why is bro using media1.tenor.com
#👾-core-development
austere talon
chrome coral
📮?
austere talon
lc.ocr
rancid idol
fossil inlet
o not 0
fossil inlet
vencord users have no shame
charred monolithBOT
kindred tree
bro thinks vencord is wallpaper engine
chrome coral
a
charred monolithBOT
glass jasper
Was about to say litterbox but thats temporary uploading and would be pointless
austere talon
indeed
limber skiff
all it takes is 10 minutes to fix all the theme issues and people are complaining
elder plinth
can you use images hosted on discord? that seems like the easiest solution
fossil inlet
can you use images hosted on discord? that seems like the easiest solution
cdn links expire
elder plinth
the client should auto regenerate them if retrieved from within the client, no?
does that not work when used in this way I guess?
austere talon
no
fossil inlet
the client should auto regenerate them if retrieved from within the client, no?
im pretty that only works for links sent in chat
these are all just being fetched via the browser itself
elder plinth
yeah just tried it. makes sense
elder plinth
lol
limber skiff
oh that's an oversight <@354191516979429376> https://canary.discord.com/channels...
oh self hosted cloud sync...
oblique hound
oh that's an oversight <@354191516979429376> https://canary.discord.com/channels...
Thought so haha
austere talon
idk how to fix that honestly
oblique hound
I’ll just use the public one in the meantime
oblique hound
idk how to fix that honestly
You could require a specific path. Like "*/vc-cloudsync". if people are able to selfhost it, then they should be also able to configure a path on their reverse proxy
austere talon
we will sunset the feature of custom cloud sync server
oblique hound
Or that lol
charred monolithBOT
scenic brook
Code in work hours or code after midnight, no inbetween
austere talon
You could require a specific path. Like "*/vc-cloudsync". if people are able to ...
nah
I'll fix it dw
jagged reef
Average AWS free tier user
dusk blaze
we will sunset the feature of custom cloud sync server
insane 😭
i do that
or keep original idea of premium gating no CSP
opaque silo
or keep original idea of premium gating no CSP
donors all deserve to be hacked
odd heath
or keep original idea of premium gating no CSP
Honestly it could just be toggled by dev mode
hollow musk
like i said earlier, a toggle somewhere to disable it with a ton of warnings
austere talon
nah
odd heath
like i said earlier, a toggle somewhere to disable it with a ton of warnings
That's technically just creating potential for more scam
"to use this theme you must first click these 3 warnings!!!!"
So useless
hollow musk
or maybe just add the toggle if it is built from source?
odd heath
Honestly it could just be toggled by dev mode
^
hollow musk
damn i didnt see that part
odd heath
But yeah I doubt any malicious person would guide through a pnpm install atp just trick the victim into using a malicious installer
hollow musk
oh wait, i forgot, midnight uses wikipedia for the moon icon 
austere talon
"to use this theme you must first click these 3 warnings!!!!"
that's not really what csp is protecting you from
odd heath
oh wait, i forgot, midnight uses wikipedia for the moon icon <:husk:102653299392...
Just quickcss it away
austere talon
but yes blanket disable will never be added
odd heath
that's not really what csp is protecting you from
No it's not but if someone wanted to use a theme maliciousoy 
hollow musk
But yeah I doubt any malicious person would guide through a pnpm install atp jus...
yeah should be able to defer the majority of the users, and the minority should be suspicious
austere talon
it's not really to prevent you from malicious themes anyway
a good csp is very beneficial in many regards
unfortunately discords csp is not good in the first place so you miss out on a lot of potential security but hey it's better than nothing
odd heath
Fair
opaque silo
oh wait, i forgot, midnight uses wikipedia for the moon icon <:husk:102653299392...
is wikimedia not whitelisted
husk
odd heath
hollow musk
is wikimedia not whitelisted
doesnt seem like so
fossil inlet
is wikimedia not whitelisted
seems reasonable as something to whitelist tbh
opaque silo
@austere talon you are terrible and everything you touch turns to ash
austere talon
"wait you didn't whitelist hundreds of different niche domains of big websites that maybe 2 themes in existence use????"
charred monolithBOT
fossil inlet
fafa
desert cosmos
hello
fossil inlet
hiiii
desert cosmos
i woke up to my plugin exploding
fossil inlet
desert cosmos
but yes blanket disable will never be added
DisableCsp plugin coming soon
austere talon
nuh uh
fossil inlet
@austere talon you forgot companion csp 
fossil inlet
i will pr guhhhhhh
fossil inlet
crumbsniffer was using my fork
csp broke it
austere talon
connect-src 'self' ws:;
wtf is that
so fake
does discord not pass that already
arrpc works
show the csp error
austere talon
never
fossil inlet
insane
opaque silo
show the csp error
sadan is just insane
u made the change on built in companion
his fork just needed it too
fossil inlet
<@521819891141967883>
soon
opaque silo
the evil ".concat(b ? "0" : "1") vs the wonderful ${+!b}`
austere talon
explain
opaque silo
austere talon
tf is that
the concat isn't real discord code
it's their bundler
the source code is format string
opaque silo
¯_(ツ)_/¯
austere talon
no real person uses concat
opaque silo
insane bundler then
wary dew
H-h-h-h-h-h-h-h-h-h-h-h-hey vencord owner 🥹 Can you merge ❤️
austere talon
fym directly refer to image
non direct like won't even work
and I disagree with adding gofile
wary dew
non direct like won't even work
???
you can embed imgur links using imgur.com instead of i.imgur.com
wary dew
and I disagree with adding gofile
how come?
granite wharf
prime dew
Why would you use reddit...? Posts can be deleted, subreddits closed, accounts stolen and emptied
charred monolithBOT
dusk blaze
H-h-h-h-h-h-h-h-h-h-h-h-hey vencord owner 🥹 Can you merge ❤️
i don't think playing the game of adding random shady filehosts because 2 themes use it is a good idea
wary dew
i don't think playing the game of adding random shady filehosts because 2 themes...
How is gofile a shady file host 💔
Seriously what is the point in this stupid csp shit
Oh no imma get ip logged
💔
brazen bone
Csp does not exist to protect you from malicious themes
It's one of many layers of defense to protect you from unexpected threats
wary dew
It's one of many layers of defense to protect you from unexpected threats
What unexpected threats am I gonna get from css
brazen bone
Nothing
scenic brook
It blocks domains for the entire app, not just css
brazen bone
Css is not dangerous
prime dew
What unexpected threats am I gonna get from css
My snippets 
wary dew
Yeah but someone can easily just upload the script to github and call it a day
brazen bone
(Though it can burn your cpu to pieces if you're stupid)
gritty canyon
What unexpected threats am I gonna get from css
BREAKING NEWS: New widespread XSS attack on discord only affects Vencord because they are too fucking stupid to set up CSP correctly
brazen bone
Yeah but someone can easily just upload the script to github and call it a day
If someone manages to execute arbitrary code via a github link, you have worse problems than your discord being hacked
still maple
Also fun fact guys, if you don't like CSP, just remove it by reverting the commit on your fork <3
brazen bone
But yes, permitting GH is also somewhat dangerous
still maple
Problem solved
brazen bone
It's just that vencord couldn't work without it so it's a compromise
gritty canyon
BREAKING NEWS: New widespread XSS attack on discord only affects Vencord because...
Oh sorry, that was from an alternate universe where vencord didnt actually bother to set up CSP! glad we did!
wary dew
BREAKING NEWS: New widespread XSS attack on discord only affects Vencord because...
And this hasn't happened at all on any other mod because why. Also, the browser version of discord already has csp enabled. The discord app also doesn't have cookies to other websites. This literally solves nothing lmao
brazen bone
If yo shit is broken by csp, fix yo shit
wary dew
If yo shit is broken by csp, fix yo shit
Nooo wym someone wants to host their own images 
sorry..
Fuck is that emoji
brazen bone
Connecting to arbitrary untrusted websites is a bad idea
gritty canyon
i fucking hate discord
gritty canyon
And this hasn't happened at all on any other mod because why. Also, the browser ...
because no widespread XSS attack has been found yet that is specifically mitigated by CSP ¯_(ツ)_/¯
brazen bone
i fucking hate discord
Don't we all
wary dew
Connecting to arbitrary untrusted websites is a bad idea
Then let the user disable copy
Csp
Dont force keep it enabled
brazen bone
Are you offended by "warning: do not swim with piranhas" signs as well?
wary dew
Are you offended by "warning: do not swim with piranhas" signs as well?
No? 😭
I just think its stupid that its not an option the user can disable
It should be on by default
brazen bone
Then why are you offended by this particular "do not swim with piranhas" sign
gritty canyon
if you know how to clone the source, remove csp you can do that!
if you dont, you shouldnt! as shrimple as that
wary dew
Then why are you offended by this particular "do not swim with piranhas" sign
Theres a difference between a discord mod and death
What is your point here
brazen bone
Yeah you'll only get your account hacked rather than your leg being bitten off
still maple
if you know how to clone the source, remove csp you can do that!
if you dont, yo...
Literally what i'm saying
wary dew
Yeah you'll only get your account hacked rather than your leg being bitten off
Again, you can literally load stuff directly from github
gritty canyon
What is your point here
that adding a specific option exposes people to danger and if this gets abused by a malicious attacker later on vencord & other client mods will be blamed
gritty canyon
that adding a specific option exposes people to danger and if this gets abused b...
having the knowledge to dig through code and remove csp means you should know how dangerous disabling csp is
this is exactly the same thought behind userplugins
still maple
having the knowledge to dig through code and remove csp means you should know ho...
The guy that use cursor : nah i just told it to remove CSP and everything is fine
wary dew
Maybe, get this, the user should know what they're installing 😱
brazen bone
Yes
still maple
Maybe, get this, the user should know what they're installing 😱
Indeed
brazen bone
User can install a vulnerable custom build if they want
But most users don't want vulnerabilities I think
gritty canyon
Maybe, get this, the user should know what they're installing 😱
now snap back to reality & most people dont
most people dont know what the funny switches do in your settings & most people dont know what csp actually is
& the users will still blame vencord when something goes wrong
wary dew
now snap back to reality & most people dont
most people dont know what the funny...
So what if they blame vencord? Not like anythings going to change. That's like blaming windows for letting you install a virus
brazen bone
Because you are asking for vencord to add a "allow vulnerability" switch
gritty canyon
So what if they blame vencord? Not like anythings going to change. That's like b...
vencords reputation gets fucked and people will stop using vencord
brazen bone
And yes, windows allows you to install viruses
It does its darnedest to prevent viruses from installing themselves by receiving a malicious chat message, though
wary dew
Discord has context isolation on in electron. There is no benefit to this especially when they can again, put the script on github.
still maple
Windows literally use many popups to prevent you from installing shit on your own machine
Sometimes even blocking legit stuff
wary dew
Windows literally use many popups to prevent you from installing shit on your ow...
No they dont bro😭
wary dew
Sometimes even blocking legit stuff
That's windows defender not windows
still maple
And it's annoying
But it's F great so i don't have to fix my grandpa computer every fucking day
still maple
That's windows defender not windows
Exactly the same
Vencord now ship with Vencord Defender
If you are not happy, clone the code and remove it and that's it
wary dew
Exactly the same
I can uninstall and disable windows defender
Windows defender is a separate app shlawg🥹
still maple
I can uninstall and disable windows defender
By actually digging deep and forcing Windows, same shit here
Get the code, change it and you good
brazen bone
I can uninstall and disable windows defender
Yes and you will make every security-aware person on the earth cringe if you do so despite the dozen warnings you get
scenic brook
You can build Vencord yourself and disable csp
Write yourself a userplugin to add specific ones you want dynamically if you want, it's just not supported officially
wary dew
This will only make this situation worse. People will go to shady repos where csp is disabled and God knows what is in there.
This is a literal perfect attack vector
gritty canyon
do you genuinely think people without any knowledge of csp will see "failed to fetch" or "unsupported domain" or whatever and google "vencord without csp" & download vencord from an unofficial source instead of the theme developer just changing their theme to use a valid url 😭
still maple
This will only make this situation worse. People will go to shady repos where cs...
CSP here exist to make sure that Ven isn't liable for you getting hacked
If you want that responsability release Kodacord without CSP, but stop complaining
dusk blaze
fun fact a theme can log your (first 3 digits of) user ID or whatever you're typing ask @inland fable he's done like 900 of these POCs
the resource itself is irrelevant
the resource host is
dusk blaze
This will only make this situation worse. People will go to shady repos where cs...
your average idiot uses themes with sane resources
only like two people will link hsdxd gifs from tenor (real world example)
wary dew
your average idiot uses themes with sane resources
Damn bro let it go 
Im tired and dont wanna argue anymore
austere talon
because no widespread XSS attack has been found yet that is specifically mitigat...
discord own csp is so crap it doesn't even prevent XSS
discord moment
still maple
fun fact a theme can log your (first 3 digits of) user ID or whatever you're typ...
Wot how ?
I'd actually like to understand how the F it could even do that
austere talon
discord own csp is so crap it doesn't even prevent XSS
so no it can't stop XSS unfortunately because of discord
if discord used a better csp I would also make sure it's XSS safe
grave mangoBOT
dnr-rules.json: Lines 7-10
"responseHeaders": [{
"header": "content-security-policy",
"operation": "remove"
}]
Lmao
austere talon
lol i don't think there's any better way to do this in tauri
the vencord extension also just removes the header
peak
kindred tree
should probably show an example... like even for simple shit it adds random stuff sometimes
I've also seen times where it's just a word and it adds like a million words of context to explain it better, instead of just translating it
deepl is very inconsistent from my experience and the accuracy is also sometimes lacking
brazen bone
If you translate a single word, translating that word as detailed as possible is a good thing
desert cosmos
open pr
close pr
desert cosmos
@austere talon you LOVE those prs right
i read "updated github actions workflows" and thought it was a spam pr
long stream
>open pr
>close pr
just another case of someone opening a pr on the wrong repo xd
charred monolithBOT
charred monolithBOT
fossil inlet
Well, I would never use pastebin. I think that it's good that you can make something without creating an account on it.
charred monolithBOT
idle fossil
we need someone to blame when someone complains about lag in #🏥-vencord-support-🏥
desert cosmos
just blame nin0
austere talon
we need someone to blame when someone complains about lag in <#10265158800808427...
themes
gritty canyon
we need someone to blame when someone complains about lag in <#10265158800808427...
blame @austere talon for lagging the token
grave mangoBOT
https://github.com/Vendicated/Vencord/blob/6140b9581496a1102839cbefbd2fa1b41a6f4...
components.ts: Line 51
// token lagger real
frozen spindle
fun fact a theme can log your (first 3 digits of) user ID or whatever you're typ...
Who caaaaaares oh no the theem is logging how old your discord account is with no other identity
Absolutely 
update
dusk blaze
Who caaaaaares oh no the theem is logging how old your discord account is with n...
are you being sarcastic I can't easily tell
frozen spindle
Yes
jolly egret
keylogger theme
frozen spindle
Absolute meme of a change
frozen spindle
glass jasper
Github gist is crazy
charred monolithBOT
okay so turns out i was a little lazy and tried reproducing it incorrectly.
this bug still occurs limit of the slice thingy whatever but it still occurs even on the visual refresh which is now the main ui.
the changes are still accurate and work for the visual refresh, not outdated, see changes below:
austere talon
alt tab while holding delete
how
why
who tf is holding delete while alt tabbing 😭
that never happened to me in my entire life
but good catch
kindred tree
who tf is holding delete while alt tabbing 😭
makes me wonder if that’s why my ctrl/shift keys sometimes stick… but it’s probably unrelated
that’s also a discord issue for me rather than a vencord issue
fallen vale
oops :3
austere talon
oops
frozen spindle
🎊 🔥 
charred monolithBOT
hollow musk
why is editing a pull request worth a webhook
opaque silo
updating this should be added to the publish workflow
opaque silo
wait I'm sure theres an actual dynamic shield thing
austere talon
it's not really useful tho
redundant information
and the version number is meaningless
opaque silo
opaque silo
it's not really useful tho
easy quick glance ig but there's other places on the ui for that
austere talon
yes
the version number isn't relevant
and for the hash just look at the latest hash
opaque silo
austere talon
austere talon
opaque silo
make the logo the vencord pink colour
austere talon
the horror
opaque silo
🤥
austere talon
you love
opaque silo
ew why all black
grave vaporBOT
ew why all black
[ <:e:1263720914583949393> Removed by @crumbsniffer ]
opaque silo
?
austere talon
[ :e: Removed by <@&1062536788184404069>rumbsniffer ]
opaque silo
??
ur being mean
apologize rn or I'm not pring the mono microphone
steromic is real
austere talon
sorry my little chud
opaque silo
dont call me a chud ur the chud
austere talon
opaque silo
soo flip floppy
opaque silo
@austere talon i might be doing it wrong but i cant repro the single ear microphone thing
opaque silo
<@343383572805058560> i might be doing it wrong but i cant repro the single ear ...
ill pr the change cause disabling the plugin did fix it for him soo idk
austere talon
<@343383572805058560> i might be doing it wrong but i cant repro the single ear ...
make sure ur receiver actually can hear stereo from u
try streaming this https://www.youtube.com/watch?v=YwNs1Z0qRY0
opaque silo
well the guy said it was the microphone doing it
not the stream
stereo stream def works tho
charred monolithBOT
austere talon
well the guy said it was the microphone doing it
yes ik but
make sure stereo actually works on the receiver
not all clients can receive stereo
that's why I told you to test it with streaming to make sure it actually works xD
austere talon
not a fan of .{0,8}
opaque silo
.concat(b ? "0" : "1")
austere talon
ulgy
austere talon
it's ulgy
dusk blaze
imagine a Rust crate where you like define a plugin then plugin.exportTo("src/index.ts") then we'd have blazing fast plugins
opaque silo
did you get a lobotomy
opaque silo
actually horror
austere talon
nuh uh
opaque silo
pure evil
austere talon
dude ${+$1} is horrifying
opaque silo
its wonderful
opaque silo
stop b eing so mean to me
austere talon
it's out of love
opaque silo
does this make you happy
austere talon
EVIL
i already pushed to ur pr
look u can't even tell it isn't official discord code
opaque silo
im going to barf
austere talon
why
opaque silo
you sicken me
dusk blaze
@austere talon intentionally makes patches unreadable to keep a monopoly on vencord development
austere talon
wtf is dtx anyway
opaque silo
wtf is dtx anyway
sound thingy
austere talon
opaque silo
match: /"(minptime=10;useinbandfec=1;usedtx=)".concat\((\i).{0,8}\)/,
replace: "`$1${+!$2};stereo=${+$2};sprop-stereo=${+$2}`"
@austere talon im pushing
austere talon
Discontinuous Transmission (DTX), where parts of the
encoded signal that correspond to periods of silence in the input
speech or audio signal are not transmitted to the receiver. A
receiver can distinguish between DTX and packet loss by looking for
gaps in the sequence number, as described by Section 4.1
austere talon
```ts
match: /"(minptime=10;useinbandfec=1;usedtx=)".concat\...
no this is evil
austere talon
STEREO MIC PLUGIN REAL???
opaque silo
unironically it is real
austere talon
```ts
match: /"(minptime=10;useinbandfec=1;usedtx=)".concat\...
are u deliberately trying to make this as cursed as possible 😭
opaque silo
austere talon
chud behaviour
austere talon
despicable
austere talon
it hurts my feelings
dms
opaque silo
stay away from me
opaque silo
are u deliberately trying to make this as cursed as possible 😭
look how wonderful it is
austere talon
esbuild wrote this code
opaque silo
i train chatgpt to write like that
i pr vencord a massive refactor to make everything clean and concise
austere talon
esbuild wrote this code
opaque silo
actually horror
dusk blaze
!0 means to return true if the value is falsy, and 0 is falsy
austere talon
???? why is it inverting them
cause it's converting the numbers to boolean
!0 = true
!1 = false
shorter
dusk blaze
i do this for true !!!0
austere talon
js gore @opaque silo
austere talon
es team: guys let's add a new typeof value that comes after u in the alphabet
the evil minify optimisation: YOU SHALL EXPLODE
it's so funny that bundlers rely on the fact that undefined is the last type in the alphabet
and minifies to >"u"
austere talon
es team: guys let's add a new `typeof` value that comes after u in the alphabet
...
working on ES spec must be so pain
trying to add a new method to some stdlib object? well think again because insane websites write their own methods to stdlib objects and you just broke amazon
that's why some methods have weird names in js
opaque silo
breaking amazon sounds like a good idea
opaque silo
that's why some methods have weird names in js
official spec gets insane names while obscure libraires get normal
austere talon
iirc array.flat() was supposed to be called array.flatten() but that conflicted with a very popular library that would define its own array.flatten and it broke popular sites
so they named it flat instead
i read that in some google blog
chatgpt found it
austere talon
https://developer.chrome.com/blog/smooshgate
the horrors of javascript
The proposal author jokingly suggested renaming flatten to smoosh to avoid the compatibility issue. The joke was not clear to everyone, some people started to incorrectly believe that the new name had already been decided, and things escalated quickly.
lmao
opaque silo
why are they freaking out about a method being called smoosh
webdevs hate fun
oh my god...
@austere talon YOU HATE FUN
austere talon
https://developer.chrome.com/blog/smooshgate
and this is why libraries should never ever pollute globals
(unless it's a 100% standards compliant polyfill)
austere talon
why are they freaking out about a method being called smoosh
ironic cause the library that caused this entire dilemma was called MooTools
🐮
charred monolithBOT
median rapids
is this a new dc change
austere talon
is this a new dc change
nah
Discord web's encoder always uses mono
even for stream audio
that patch makes it stereo
but I fucked up and it also applies to voice, not just video
that commit fixes it so it only makes video stereo
it was causing issues for some users where their voice would only be on the left side lmao
probably because feeding mono audio into stereo encoder
so it would use the mono audio as the first (left) channel
woeful sable
btw can you replace the CustomCommands plugin with something else? pretty sure it’s gone
charred monolithBOT
jolly egret
btw can you replace the `CustomCommands` plugin with something else? pretty sure...
So is PronounDB
limber skiff
vendicated patch
median rapids
that patch makes it stereo
yeah isn't stereo in streams new??
swear all clients always sent mono
opaque silo
yeah its fairly new
fossil inlet
@austere talon do your quick reply changes fix https://github.com/Vendicated/Vencord/issues/3289
austere talon
that issue isnt real
it always handled blocked messages correctly 😭
oh
you mean without NoBlockedMessages
no it only skips it if it's hidden due to NoBlockedMessages
does discord not expand the blocked message when you create a reply?
fossil inlet
No
austere talon
insane
you will pr fix
just make it expand ig
the changes mainly address skips when a message is deleted / created
austere talon
the changes mainly address skips when a message is deleted / created
previously when you replied to smth then people sent 5 new messages
then when you pressed down it would actually go down 5 messages instead of 1
that's what the change fixes
fossil inlet
Ah
fossil inlet
you crashed my browser
Good
It’s working
austere talon
oh my god i wrote this and then accidentally closed my browser I am so grateful that Github automatically saves your draft
charred monolithBOT
dusk blaze
@austere talon has been destroyed
charred monolithBOT
austere talon
surprised this hasn't been brought up more
themes with spaces have always been broken
dusk blaze
themes with spaces have always been broken
i haven't seen a file with a space in the name since ages
fossil inlet
me wondering why nothing is working
the perfidious malformed patch
fossil inlet
what the hell
happens whenever i reload a dev build with watch enabeld
bro didn't even test it (tbh i didnt even know that this wasn't the case either 
)
(me when broken code works better )
charred monolithBOT
fossil inlet
why are file names in camelCase and plugins in PascalCase
Components in Pascal, everything else in camel I think
fossil inlet
just make everything camel case
Upstream issue with jsx
fossil inlet
guhhhh what am i doing wrong here
@limber skiff i'm probably doing something obviously wrong here
this code used to work, broke when i tried it recently
fossil inlet
thanks
austere talon
i will see if I can make Discord's csp actually safe
aka removing unsafe-inline
@limber skiff I wonder if it would be feasible to eval with a script tag
so we can also remove unsafe-eval
actually i think discord depends on unsafe-eval nvm
austere talon
aka removing unsafe-inline
but I will still try this
fossil inlet
aka removing unsafe-inline
Doesn't dev companion need that
austere talon
why would it?
fossil inlet
why would it?
Isn't unsafe inline eval
austere talon
no
fossil inlet
Oh
austere talon
unsafe-inline is
<script>alert(1)</script>
Oh
austere talon
and also ```html
<img onerror="virus()" src="fake">
So like preventing HTML injection
austere talon
unsafe-eval is eval(), Function(), etc
unsafe-inline is the biggest security problem
limber skiff
<@235834946571337729> I wonder if it would be feasible to eval with a script tag
eval soo useful tho
brazen bone
For what exactly
limber skiff
stealing tokens
austere talon
eval soo useful tho
yeah but maybe we can emulate it with script tags trol
anyway i think discord depends on eval lmao
limber skiff
script tag with nonce?
limber skiff
what prevents anything from doing the same then
austere talon
https://content-security-policy.com/strict-dynamic/
with this only the root script needs a nonce
limber skiff
ah I see
austere talon
what prevents anything from doing the same then
basically strict-dynamic means
any script that passed csp (via nonce or hash) may create explicit child scripts without nonce and they will be allowed
but those scripts can't be parser inserted
austere talon
but those scripts can't be parser inserted
<script nonce="awa">
// Legal
const script = document.createElement("script");
script.src = "...";
document.body.append(script);
// Illegal
const div = document.createElement("div");
div.innerHTML = "<script>..."
so it's the best of both worlds
ease of use of unsafe-inline, safety of strict csp
it's fire
doesnt seem like anything even needs unsafe-inline...
i will try just removing unsafe-inline
fossil inlet
@austere talon you should review https://github.com/Vendicated/Vencord/pull/2938
fossil inlet
do we really need to duplicate so much code 😭
Prob not
austere talon
also test for compatibility with mentionavatars plox
scenic brook
In my PR I added a function that just returns the prefix, first part and second part to be used in the different render functions, could probably just steal that
fossil inlet
does vencord not have classnames
austere talon
whar?
brazen bone
Probably means classnames(className, { foo: true, "has-bees": bees != 0 }) for classname props
scenic brook
It has classes that does that I think
elder plinth
<@343383572805058560> you should review https://github.com/Vendicated/Vencord/pu...
is this a good time to say I just finished getting my PR for this up to date too lol. it doesn't have suffocate's emoji fix though 🤔
ah man I didn't realize discord-types was an external package
it needs to be updated for my pr .-.
scenic brook
I think vee made it easier for it to be updated last time it was needed so probably not a huge ask
scenic brook
Maybe I'm thinking of something else
elder plinth
idk this github only has 17 stars so I feel like im in the wrong place
only thing that shows up on google other than discord-api-types though which has a loooot more activity but doesnt seem to be the one?
scenic brook
Oh I was thinking about standalone-electron-types, my bad
You'll just have to type it yourself, I don't think there's really any maintained typings for discord because it just changes all the time
The api types are different
austere talon
Probably means `classnames(className, { foo: true, "has-bees": bees != 0 })` for...
there is classNameFactory that works like that
fossil inlet
github for it hasnt been updated for 2 years
no, it's been abandoned
elder plinth
the github for discord-types doesnt look like it's taking prs rn. what to do 🤔
I just put a // @ts-expect-error: line and it worked lol. is that fine or how should I handle this
odd heath
fossil inlet
I just put a `// @ts-expect-error:` line and it worked lol. is that fine or how ...
(foo as any)
@fossil inlet
elder plinth
(foo as any)
did you add anything more to your pr update that it didnt have originally cause part of mine was including yours
fossil inlet
did you add anything more to your pr update that it didnt have originally cause ...
Just some Refactoring
elder plinth
Just some Refactoring
oh you did update the unknown user patch which I accidentally removed earlier. yoink 
well I spent like the last 6 hours updating those prs so time to sleep 💤
editor's note: gradients are the devil
jolly egret
somebody pressed send before it was done
opaque silo
GITHUB INSANE
do not blame others for your own shortcomings
fossil inlet
do not blame others for your own shortcomings
me when i can send a message while things are still uploading
github bad ux...
elder plinth
:)
austere talon
insanity how did 3 million webpack finds break
odd heath
insanity how did 3 million webpack finds break
Wdym
limber skiff
insanity how did 3 million webpack finds break
lmao wtf was that
austere talon
so good #1337479880849362994 message
opaque silo
so good https://discord.com/channels/1015060230222131221/1337479880849362994/138...
sorry i bit the wires a bit
still maple
fun fact a theme can log your (first 3 digits of) user ID or whatever you're typ...
@inland fable could you send some of those POCs because i would actually really like how you can even achieve that with CSS, i really wonder about what tech could be used in an expected way (or was designed in a way that somehow can lead to that kind of thing)
inland fable
inland fable
<@843448897737064448> could you send some of those POCs because i would actually...
Here
4 first digits i think
NOt sure if the classes are updated
inland fable
altho not what you type, powerful
eh repeat but with every letter and the chat input
still maple
wait what
charred monolithBOT
jagged reef
Happy birthday to https://github.com/Vendicated/Vencord/pull/2570
opaque silo
am I insane or could this simply be every 2 digit number combo and it'd send every digit of the id then you could reconstruct the possible ids on the backend
inland fable
am I insane or could this simply be every 2 digit number combo and it'd send eve...
erm wdym
there's no wildcard character or anything
you can match x first or x last (or both)
it does get unbearable laggy at some point too
inland fable
am I insane or could this simply be every 2 digit number combo and it'd send eve...
oh I see
maybe it'd match from avatar hash too like that
but maybe not a problem maybe you're right
opaque silo
like you select for [src^="https://cdn.discordapp.com/avatars/][src*=10] so on
if the id is 10234 the selectors for 10 02 23 34 would match
then you can reconstruct based on IP on the server
opaque silo
then you can reconstruct based on IP on the server
could also maybe do the same trick for other identifiers to cross reference and narrow down the reconstructed possibilities
scenic brook
Surely you wouldn't know the order of the two digit combinations though
They'd just be in the order of the rules wouldn't they?
opaque silo
well if you get 10 02 23 34 rules returned they can only fit together one way
scenic brook
Sure but something like 430184 = 01 30 43 18 84
Could be 184301
I just woke up so that might be wrong but you get the idea
opaque silo
could also match for /1
so you know the starting digit
same for the end
I'm sure there's a bazillion ways to narrow down the order
anyway CSP stops this now I think
actually no because *.github.io is white listed
lol
dusk blaze
actually no because *.github.io is white listed
static site who cares
jolly egret
aight
charred monolithBOT
charred monolithBOT
austere talon
explode
charred monolithBOT
desert cosmos
i love commit messages
scenic brook
Me when "misc changes"
opaque silo
vencord will use conventional commits inshallah
jolly egret
doesn't matter when it all gets squashed on merge
austere talon
vencord will use conventional commits inshallah
it's feature branch buddy
still maple
Me when "misc changes"
i have a solution for you
feel free to copy my strategy
charred monolithBOT
austere talon
@placid hinge can you test Vendicated/Vencord#3476 with your custom cloud sync server? just with your existing config
austere talon
HOLY SHIT TRUE
limber skiff
lmaooo
charred monolithBOT
limber skiff
actually I think you should do the other too
austere talon
nah the code is right
limber skiff
not because of the reason it explained
but its more clear
it shows what the expected url is
limber skiff
I know
austere talon
oh wait
limber skiff
using !url.startsWith("https://i.imgur.com/") its more clear
austere talon
it will disable anything but i.imgur.com
austere talon
like if you try to load banana.com
limber skiff
yeye
limber skiff
I thought that code was specific to imgur
austere talon
it didnt know it can be anything
actually solid suggestions
time to make copilot review all prs
surreal fiber
vencord 2 coming soon, fully vibecoded
austere talon
true again...
why are there so many keys
am i okay
(it's cause i refactored a lot of times, all of these used to be the top level element at one point)
charred monolithBOT
austere talon
it likes my code now 😊
austere talon
NEVERMIND
even this is true 😭 but i am aware and decided earlier that i would just not support those cases
austere talon
ai 😭
fossil inlet
does it work tho
wise ledge
do we really need to duplicate so much code 😭
The return in the catch is returning a string and not a fragment, and this is true in the current revision...not sure if that matters or not
fossil inlet
The `return` in the catch is returning a string and not a fragment, and this is ...
idk why you're replying to that ancient thing but i did clean it up a bit
wise ledge
actually nvm they're all strings when disregarding the errorboundary my badddddd
wise ledge
idk why you're replying to that ancient thing but i did clean it up a bit
idk
i was scrolling to find something lollll
fossil inlet
The `return` in the catch is returning a string and not a fragment, and this is ...
this is what i do now
fossil inlet
wise ledge
conclusion, I am ultra dumb
fossil inlet
was referring to #👾-core-development message
desert cosmos
"might get taken down"
charred monolithBOT
scenic brook
So many people seem to think this is specifically meant to stop unwanted css
I get that themes are what's mostly affected but still
charred monolithBOT
Previously a plugin with settings that have hidden set to true would still show the plugin cog icon instead of the info icon.
This PR adds a check to make sure there is a visible setting before showing the cog icon.
Before:
After:
gritty canyon
no reason to reuse it because its only used in exactly 2 places, if it was actually used more than twice id think about reusing it but that just makes the pr more complicated than it needs to be
gritty canyon
nice ai
hollow musk
helper functions
gritty canyon
np
desert cosmos
why do people add themselves to the very top of the devs constant
scenic brook
600 lines too far to scroll
gritty canyon
why do people add themselves to the very top of the devs constant
That’s what the ai does
still maple
why do people add themselves to the very top of the devs constant
because it's easier
elder plinth
because I'm more important than V
still maple
because I'm more important than V
more important than who ?
desert cosmos
🐝
odd heath
because it's easier
Ah yes I love being too egoistic to either scroll or collapse -> focus line after - > uncollapse
still maple
Ah yes I love being too egoistic to either scroll or collapse -> focus line afte...
it's not egoism, it's lazyness
austere talon
you are indeed blind :P
austere talon
old code
austere talon
eh I wanna use enums less
theres little need
ts union types do essentially the same thing as a const enum
austere talon
how else
charred monolithBOT
austere talon
jumpscare
austere talon
lmfao
austere talon
useExternalStore I forgot what's called
idk seems like more work for 0 gain?
austere talon
are u saying not to add the extra notification?
kindred tree
so.. would it be better to fetch the language list on plugin startup, or should I keep it hardcoded in a constant and instead just add the comment so it can be easily updated later? @austere talon
I feel like the latter would be preferred for fast startups no?
austere talon
fetch it on demand
kindred tree
and then what if the api doesn't respond the second you hit it to fetch the languages..?
wouldn't that break everything
austere talon
wdym
limber skiff
are u saying not to add the extra notification?
ye im saying it's fine if the user declines to not say anything
kindred tree
if you fetch the languages when the plugin starts, but the api doesn't respond so you don't have a languages list
wouldn't that fuck with something
or am I misunderstanding the "fetch it on demand"
kindred tree
check the http status code and if it fails...?
idk what the desired way to handle that would be
austere talon
idk what the desired way to handle that would be
the desired way is to handle exceptions gracefully
like rn if you have it configured to use deepl but your token isnt valid, it will fall back to google
limber skiff
vtest dev2
nimble pendantBOT
vtest dev2
Now testing! 
nimble pendantBOT
vtest dev2
nimble pendantBOT
vtest dev2
Seems like everything is working fine (for now) 
limber skiff
why no workie
I think they have duplicate code and changed the location
of course
limber skiff
vtest dev2
nimble pendantBOT
vtest dev2
Now testing!
nimble pendantBOT
vtest dev2
nimble pendantBOT
vtest dev2
Seems like everything is working fine (for now)
prime dew
<@343383572805058560> time to remove another plugin
how was it like before?
besides the obvious answer "with a gif", of course
glass jasper
<@343383572805058560> time to remove another plugin
What of instead of removing the plugin, you make a plugin that adds the gif back*(customize ofc)* 
charred monolithBOT
austere talon
should have been removed before already
the only reason i didnt was cause u cant do it with css
prime dew
What of instead of removing the plugin, you make a plugin that adds the gif back...
insert it can be done with css gif
prime dew
the only reason i didnt was cause u cant do it with css
because the popout window does not have unique enough classes or for some other reasons? because I just recreated it from scratch and it seems to work quite well
austere talon
well yeah from scratch
prime dew
I'll send the code on #🎨-theme-development, it's not that difficult tbh
charred monolithBOT
austere talon
i added restart prompt @limber skiff
should the cloud sync one also do it?
yeah i shall
charred monolithBOT
austere talon
could make it a util but eh
better to duplicate a few lines of code than have 3 billion niche utils
charred monolithBOT
austere talon
should we merge the whitelist pr
gritty canyon
can you check my latest pr its a two (2) line code change
limber skiff
fossil inlet
tbh more of a github issue
limber skiff
alright
austere talon
😭
austere talon
can you check my latest pr its a two (2) line code change
the main reason I didn't do that was cause of the time complexity
the plugin page already has ever so slight lag when first loading
the more checks we add (and checking every plugin's settings is like 500 checks probably) the slower it will get
austere talon
you could figure out how to use discord lazy scroller but meh
austere talon
nah
The HTTP Content-Security-Policy (CSP) media-src directive specifies valid sources for loading media using the <audio> and <video> elements.
we dont need that
limber skiff
we dont need that
alr
limber skiff
this one you can just make it inside the component function
charred monolithBOT
charred monolithBOT
austere talon
undefined && thing
opaque silo
ternary would be wonderful here
limber skiff
sometimes code like that isn't so obvious
limber skiff
ternary would be wonderful here
it's fine
austere talon
(esbuild will do that anyway)
limber skiff
austere talon
(esbuild will do that anyway)
function Mn(t, e, r) {
try {
let n = new URL(e).hostname,
i = Ke[n] ?? L.store.customCspRules[n];
return i ? r.every((o) => i.includes(o)) : !1;
} catch {
return !1;
}
}
this is what esbuild turns it into (formatted with prettier)
opaque silo
the bundler is the hubris of man
austere talon
you write ugly code just like your soul
eh i like the pattern of
const thing = ...;
if (!thing) return;
doSomethingWith(thing);
it's clean and logical
opaque silo
okay but in that case youre just returning a single line do something with thing
doesnt matter anyway and your mind is corrupt 🥰
jolly egret
gotta love removing a line in a suggestion