development

[half walrus]

bc unless it’s got a good backend lang

[lethal kayak]

Java

:sofuckingfunny:

[half walrus]

mine would have to be node or likely php

not gonna deal with secure user accounts in java

[lethal kayak]

php, node, some type of python backend

[half walrus]

not doing logins in python either

too much room for error

[lethal kayak]

fair

[half walrus]

despite how much i love the language

[restive ether]

stfu

[lethal kayak]

idk php so i cant really say on that

but express + passport = really easy logins on node

[half walrus]

php sucks balls but it's established

[restive ether]

have you tried php8

[half walrus]

i have no idea which version of php i use

[restive ether]

8 just came out

dunno, haven’t used it but heard a lot of praises

[half walrus]

https://gist.github.com/KritantaDev/2f17d1b8531a8e47eacca41ddd65fb5b

this is what my servers use

whatever gets installed with this

[lethal kayak]

just run php --version

[gentle grove]

loss

[half walrus]

contributions to that script appreciated

could probably automate a few things

where is emy discord account

[gentle grove]

wait is ctrl-c sigint not sigterm

maybe that's why the one script I was making wouldn't trap right

[half walrus]

why

but yes

ctrl c is sig interrupt

keyboardinterrupt in python

ctrl d is EOF iirc

[primal perch]

.align 16

.quad    _ctor``` use this instaead

try both but this works regardless

if u want it working just copy paste

no just ssh in and remove it

ur gonna have a lot of crashing

because u ruined the stack pointer

br x8 doesnt return

well it returns from the original one

so then the stck is 16 bytes off

that shit below br x8 wont ever be executed

black screen means it worked bc its getting injected anyway

[faint timber]

I dream in arm

I dream in arm russian and english

[half walrus]

anyone have a header dump from ios 14

[upbeat wyvern]

the last pic is wrong, ldp should be #-16 too to match above

@primal perch

sorry @grave sparrow

you put some random values from stack into LR

LR and FP? I forget what the other one is

[faint timber]

time to open dyld_shared_cache via wine ida64

wish me luck

[upbeat wyvern]

@faint timber wine what are you a masochist?

just run it in a VM?

[faint timber]

cba

worked out of box

I could just reboot to windows

to do the same thing

[half walrus]

tell me you aren't opening the whole thing

the point of 7.5 is not having to do that

or

[upbeat wyvern]

how will you run it in WINE under windows? 🤔 maybe using the linux subsystem?

[half walrus]

https://github.com/KritantaDev/DyldExtractor use this

if you need dyld shit

[upbeat wyvern]

is yours actually working well?

[half walrus]

"depends"

[upbeat wyvern]

like does it extract the stuff from neighboring libraries?

[half walrus]

yes

[upbeat wyvern]

cool

[half walrus]

here let me drop you one it worked well on

[faint timber]

wait ida 7.5 fixed loading of cache?

[upbeat wyvern]

with 7.5 you can select just what you want

[half walrus]

define fix

^

however

[faint timber]

sick

[upbeat wyvern]

then right click some crap that's broke and tell it to load that section too

[half walrus]

you need to manually load in other libraries

yeah

its dumb honestly

what fw do you need

[upbeat wyvern]

yeah it should be able to have dyld+deps of only that lib

[half walrus]

the one on my github most likely works

[upbeat wyvern]

but dyld+deps gives you deps of all deps too

like fuck me

[faint timber]

it just loaded it didn't let me choose

wtf

[upbeat wyvern]

then what ida version are you using?

[half walrus]

7.5 or they wouldn't be using WINE

[faint timber]

7.5 sp3

[half walrus]

weird

what framework do you need

[faint timber]

just for fun

nothing needed

[half walrus]

well

[upbeat wyvern]

lol

[half walrus]

wonder if dscu couldn't load in

bc of wine

[upbeat wyvern]

because you opened a file that was already disassembled

[half walrus]

oh that too

[upbeat wyvern]

you have to load the shared cache, not an i64 file

[faint timber]

oh

[half walrus]

lol

[faint timber]

no

thats the binary

[upbeat wyvern]

no, it's not

look at your title bar

[half walrus]

if you've already opened it there's already an .i64

[faint timber]

fucker

lmao

[upbeat wyvern]

delete the .i64 file

and try again

[faint timber]

[upbeat wyvern]

it threw me off when I told it to open one thing and it opened another thing before too

sort of bad UI

[faint timber]

fixed

thanks my blind eyes

[half walrus]

here's two extracted frameworks @ sbingner

[half walrus]

output is better than IDAs rn

[half walrus]

dont load with dependencies

[faint timber]

why

[upbeat wyvern]

@half walrus very nice

[half walrus]

it'll load several hundred

it loads the entire dependency

[faint timber]

I wanted to try loading the entire cache

[half walrus]

don't

[faint timber]

I have 128gb of ram and a 16 core cpu

[half walrus]

i've already done that several times

it's a complete waste of time

IDA barely runs

[faint timber]

can you force ida to use ram and run multithreaded?

[upbeat wyvern]

yeah it's pointless

[half walrus]

https://iphonedevwiki.net/index.php/IDA_Pro#If_you_are_dead-set_on_using_the_arm64_shared_cache:

[upbeat wyvern]

you can totally do it but it's slow as frozen shit

[half walrus]

i wrote this section just for ppl like you

bc people constantly say they're gonna load the whole thing

[faint timber]

well I can just press save

[half walrus]

it takes over an hour to save

[upbeat wyvern]

just make a bunch of .i64 files for different things is easier

then it'll be fast

what an hour to save jesus

[faint timber]

yeh I just want to try it now that I have a beefy pc

[half walrus]

if you try to use quick search IDA crashes

you have to disable the sidebar on the left

[upbeat wyvern]

I've done it - it took like 2 days to disassemble but I could save it in like 1 min

and it didn't crash it was just crappy

probably macos IDA isn't as good as windows IDA 😛

[faint timber]

lol mac doesn't handle 16 core cpu usage properly

[half walrus]

and you have to find what you need by opening the 'segments' browser

and finding the framework

you cant search it

[upbeat wyvern]

ida doesn't use more than 1 core

so that doesn't matter

[half walrus]

yyep lol

good for having 12 IDAs open

[faint timber]

yeh at least I have 15 cores left to use my pc normally

[half walrus]

not good if you have anything to do

[upbeat wyvern]

you'd think but it'll use rediculous amounts of RAM

[half walrus]

32gb

• macos memory management

never had issues w/ it

[faint timber]

im just watching youtube, editing plists and using discord

[half walrus]

cant beat macos on that

same reason they barely ever upgrade iphone ram

one of the few things they got right lol

[faint timber]

im sure theres a way to hack it to use more than one core

but thats beyond my knowledge

[half walrus]

w/ source

yes

[upbeat wyvern]

@faint timber yeah - run 2 copies and disassemble different things

boom 2 cores

[half walrus]

^ lol

otherwise glhf

i'm thinking

[faint timber]

cat $(file) / 2 > out1.bin

[half walrus]

you could get something like substrate running

[upbeat wyvern]

if your name is ilfak yes you could, and I have no idea why he has not

[half walrus]

and swap out the ida dylib on macos

well, not swap it out, too much there

but hook the symbols

[upbeat wyvern]

but that's not something you can hack in with binary editing

[half walrus]

yeah not with that

w/ hooking however

[upbeat wyvern]

unlss you're truly insane

[half walrus]

i'm starting to wonder if it's possible

most of the IDA logic here is in the dylib

[faint timber]

ida 7.0 took 30 minutes to decompile one for the obfuscated sep functions in checkra1n

[half walrus]

that's hikari lol

[faint timber]

yep

cfg flattened af

[upbeat wyvern]

I mean yes it's possible but... you'd have to understand the workflow and interconnections of everything

[faint timber]

good thing we have oss now

[half walrus]

it's all symbolicated tho so

it's about as possible as a very complex tweak, definitely not too far out

i'm not gonna do it but if someone cared enough it might just be possible

IDA also doesn't prevent you from modifying the library

no binary drm here whatsoever

but w/ dsc libraries

you can use hopper now if you need speed

• the extractor on my github

[faint timber]

no freezes yet fingers crossed

[half walrus]

are u loading the whole thing in anyways

[faint timber]

yes for the memes

[half walrus]

sigh

alright on

[faint timber]

lol

[half walrus]

jsyk

it's not loading yet

[faint timber]

ik

[half walrus]

it's enumerating

[faint timber]

1 core go brrr

7 threads

[half walrus]

tell me how it is tuesday

[faint timber]

will do

[half walrus]

should be close to done by then

[faint timber]

gonna get yelled at for using all the solar

[half walrus]

buy a server

do it on idat

bc you now can't reboot ur pc for 5 days

[faint timber]

I have a free server

website is on it

[half walrus]

then use idat to do it there

or on a digitalocean droplet

[faint timber]

will do that if I need to dissasmble cod

cod uses something worse than hikari

I wish python usb worked on my mac 😦

[half walrus]

@upbeat wyvern you know offhand if it's legal for me to host extracted binaries

not sure if that's dmca-able

thought about just running all of the ones that work through it and tossing them on a website

[faint timber]

yep, we can't even host website theos compiler

[half walrus]

huh

[faint timber]

apple gonna dmca us 😦

[half walrus]

what is 'website theos compiler'

[faint timber]

project proposed by the theos guys a couple years ago but never got off the ground

afaik

ida makes me sad

gpu is a very good resource

[upbeat wyvern]

@half walrus I'm pretty sure it's not technically legal

[half walrus]

they typically don't go after non-commercial stuff tho, right?

[upbeat wyvern]

apple absolutely could dmca you

but yeah no idea what they would do

[half walrus]

like i think they could probably dmca the sdks repo

[primal perch]

True but that’s not even the main issue

[upbeat wyvern]

no?

it's extracted tdb files isn't it?

[half walrus]

not all of them

i think?

[upbeat wyvern]

then yeah probably

but I think all the theos sdks are that

because that reason

[half walrus]

Guess I could just do it and see

worst that happens is a DMCA since not for profit

[upbeat wyvern]

@primal perch yeah I suppose blr would help 😛

probably true

if you have a good fair use case for it, you might be ok too but I don't know what that would be

but why do you want to host them?

[half walrus]

because nobody uses the extractor

[upbeat wyvern]

make it work on-device 😄

[half walrus]

it does

:)

[upbeat wyvern]

nice

then why doesn't anybody use it?

[half walrus]

part of my fork was adding that

good question

[upbeat wyvern]

you have it on bigboss or something?

[half walrus]

the reason I don't promote it as hard as i do my own projects is its a fork

original wasn't usable

but if i promote it like i do my own stuff the guy who wrote the main chunk wont get credit

i'll look like i'm stealing clout

[upbeat wyvern]

can you also link against them?

eh what you did is just as big imo

but he wouldn't care, PR it back to him?

[half walrus]

already did i think?

i think my stuff got merged in

took a month tho

is why

[upbeat wyvern]

how do you even promote stuff, twitter?

[half walrus]

same way i promote dragon

yell about it constantly

given i'm trying to do that more w/ this too

[upbeat wyvern]

what's dragon?

[half walrus]

[upbeat wyvern]

haha

[half walrus]

https://github.com/dragonbuild/dragon

[upbeat wyvern]

I was joking 😉

[half walrus]

good

go use it it's better theos

I'm trying to get the extractor added to hopper officially though 😛

given the output is already better than IDAs

cuz currently fixing hopper output is completely impossible

[half walrus]

might add to dragon except for this issue ^

[primal perch]

gn @developers and @designers

[upbeat wyvern]

....

that's a horrible reason not to integrate it

make it a submodule or something so it's obvious where it came from lol

[lime pivot]

seeing that windows pixel font on macOS makes me angry 😂

[faint timber]

lool

wish I could fix it

[lime pivot]

nope, actually I've specifically been careful about what's hosted there to limit it to only headers (refer to Google v. Oracle), tbds (symbol list that definitely isn't copyrightable), and runtimes intended for distribution anyway (there's one for WatchKit 1.x apps in earlier SDKs)

[half walrus]

yeah, but when i'm kind of dumb about that stuff it's kept me from getting on almost anyone's bad side here so, /shrug

[lime pivot]

this is half of why I'm not just accepting all the PRs adding more generated SDKs, as helpful as those people are

[half walrus]

probably going to get around to it still

just typically write my own implementations of stuff from scratch to avoid even having to think about that

[lime pivot]

I've been manually sifting through SDKs to remove anything that doesn't seem clear-cut, which is clearly absolutely not scalable

actually they could claim headers maybe since they're verbatim, like if they really wanted to claim an inline func like CGRectMake (terrible hypothetical but anyway) is complex enough to reasonably be protectable by copyright

[half walrus]

see now with extracted binaries i wonder how it'd play out

as they're extremely modified

wonder what the license on dsc frameworks even is

[lime pivot]

or maybe comments since that's prose, and it may have unique info Apple has never licensed for redistribution, blah blah stupid legal shit

still I think the optics of going that far is just silly

[half walrus]

see i don't think i've ever seen apple go after non-comercial

even with hackintosh stuff

[lime pivot]

no cases come to mind, and absolutely not anything in this community that I've ever heard of

[half walrus]

except in the explicit cases it's been a for-profit setup

iboot leak maybe

but that's a whole nother puppy

this is all symbolicated

[lime pivot]

yeah I mean, private IP leaking is extremely different from some binaries that were already distributed publicly anyway

I need to mention again how wild the Google "people also ask" box is

Is Bing powered by Google?

What is API PDF?

[half walrus]

i'd say it could be useful to them but they have uncompressed caches internally so

which are useless in IDA now lol, output is actually worse

[lime pivot]

uncompressed is better?

err

compressed is better?

[half walrus]

the dev caches i think just don't optimize the stubs

it's in dyld source

but because the format is different, IDA had issues with them

i'm thinking maybe it's useful for like

lldb?

[lime pivot]

ah so more like ida just doesn't know how to work with the format

[half walrus]

possibly

yeah, it made it usable in Hopper at least

iirc, it might've just crashed there too cant remember

https://iphonedevwiki.net/index.php/IDA_Pro#InternalUI_.development_cache

need to expand that with the stuff found in dyld source

i also need to fix this entire article lord

it's just a blog post on a wiki rn

[half walrus]

hot

@lime pivot you know of any non-limneos private header dumps?

[lime pivot]

https://git.io/iosrth

[half walrus]

bless

[lime pivot]

unfortunately he doesn't update them any more, and the way you dump them is bad

generated by RuntimeBrowser (which I put on chariz) which continues to be an incredible tool for getting clean headers

[half walrus]

coming along very nicely

[lime pivot]

he then… literally just runs the webserver and does a full wget mirror

[half walrus]

(all those are links and they work)

[lime pivot]

I really really need something that just acts exactly like github, but gives me a bit more freedom

[half walrus]

w/ header browsing?

bc that's exactly what i'm trying to do right now

[lime pivot]

or rather maybe I should say lets me do grep, including regex for extra points

http://androidxref.com/9.0.0_r3/

this is a website you can and should copy from

[half walrus]

wonder how that could be done with php

[lime pivot]

I use this heaps at work, it's fucking amazing

of course, it's full source search, not just headers

[half walrus]

trying to just do what limneos' site was supposed to be

in php

no hate to mass1ve's alternative

I also want wiki comments in the future so

because I need something like that myself and iphonedevwiki is too non-specific

[lime pivot]

well as a wise person once said,

[half walrus]

not writing account logic in python

[lime pivot]

I thought about doing a better header search tool a long time ago but I have enough going on as-is lmao

a few years of delving into Android via AndroidXRef/OpenGrok spoiled me

[half walrus]

being able to do this type of coding is

idk why php gets so much flack honestly

all of my code is in one file in a good way

it's like someone took javascript and gave it superpowers

[lime pivot]

http://localhost:8080/?framework='><script>alert(1)</script>

[half walrus]

given, I can do this purely clientside, see https://krit.me/, but this is easier

[lime pivot]

careful you gotta escape stuff

[half walrus]

is there a threat there

considering it can only affect client side

[lime pivot]

nah, can't do anything all that interesting exactly

no interesting cookies to steal

but it's still something you should just always handle regardless

[half walrus]

only thing you can do with that is inject javascript into your own browser

which already has a built in console

[lime pivot]

yea, but I can send you a link that gives me your cookie

or other bad thing related to this website

see: when saurik thought it was cool to have a GET request automatically charge your credit card

[half walrus]

LMAO

that's, extreme

I don't code for non-threats

probably not good practice but

DragonMake has an issue that lets you execute arbitrary python iirc

but trying to fix stuff like that is like

[lime pivot]

well I mean that one was just bad programming, you never ever carry out a task on a GET request

POST would have prevented it

[half walrus]

lol cydia won't check a repo if it doesn't first respond to a certain request regarding packages.bz2

not GET or POST

cant remember

[lime pivot]

yeah erm, that should probably be changed

it HEADs /Packages.bz2 and /Packages.gz

[half walrus]

yeah

that

fucked with me when i wrote a sanic.py repo

[lime pivot]

so you need /Packages.bz2 to always exist, even if it's just an empty file and you only serve /Packages.xz

[half walrus]

that auto-generated everything dynamically

so i had to write a section to respond to HEADs with 200

just for cydia bc it is a special cookie

[lime pivot]

don't get me started on how the apt downloader is dumb

[half walrus]

i don't really understand how a HEAD request is anything other than a waste of bandwidth

GET provides the exact same thing

[lime pivot]

I learned that my rate limits were actually cut in half because HEADs on downloads were just being treated the same as GETs on my end

[half walrus]

lol

[lime pivot]

well, no, not the same thing

HEAD is just the headers

or in my case I just go "yeah it totally exists 🙃" on HEAD now

[half walrus]

cuz the same error logic exists after the GET request

so

[lime pivot]

that results in the fun thing of APT sending the HEAD, then sending the GET even though the HEAD failed

resulting in the error output displaying the status code twice

[half walrus]

if (!filedoesn'texist)
{bad}
if (!filedoesn'texistbutiusedGET)
{bad}

is that just outdated code?

like i cant think of a situation in the past it'd make sense either

not like a GET request to a file that doesn't exists wastes any bandwidth

[lime pivot]

honestly? apt's methods system just sucks

consider that it was designed for two things in the Bad Old Days

1. reading the hardcoded APT repo on your Debian CD (you would get the entire distro on CDs and just install what you wanted)
2. downloading updates to the packages you got on the CD via your trusty local FTP mirror

[half walrus]

n all of ios jailbreak is built upon this

why saurik

[lime pivot]

HTTP slightly feels shoehorned in, HTTPS feels very shoehorned in

for http they wrote their own entire HTTP client, for https they used libcurl

[half walrus]

jesus

that's something i'd do

idek if i'd go that far

[lime pivot]

best part was https was a separate package, not even installed by default, until a few years ago

[half walrus]

do jb package managers support FTP?

[lime pivot]

oh hell yeah they would if you put them in sources.list

or cdrom or rsync

[half walrus]

oh neat

idk what the benefits would be but i might screw with that

maybe better for a bootstrap idk

[lime pivot]

like, nobody touched that code because literally zero people will ever hit that code

I vaguely know the insane bootstrapping system uncover used was based on cdrom

effectively the ipa is your Debian CD-ROM Elu base distribution

[half walrus]

love being an edge case

[tepid olive]

oh yeah I remember seeing that when fucking around with the packages in the IPA

[half walrus]

good ol "no reasonable person would expect you to fix this but i found an edge case that makes my repo crash your app"

@ zebra discord

[lime pivot]

also, occasionally, Debian/Ubuntu upgrades can get in a bad state where the cdrom source is never cleaned up, resulting in the most beautiful thing you can still repro to this very day, where it asks you to please insert your Ubuntu 20.10 Groovy Gorilla CD

[half walrus]

"if you create an entire python runtime in your depiction and simulate an entire fileystem in that runtime, and load several files into memory, depictions crash"

[lime pivot]

that's fucking amazing lmao

[half walrus]

funnily enough only happened on zebra

[lime pivot]

was it just annhilating all of zebra's allocated memory so watchdog said nuh uh

[half walrus]

see i'm not sure

it only broke the depiction

and only in zebra, not in any other place i viewed it

[lime pivot]

while working on a project for my job a month or two ago now I was initially loading full-quality images off of the S3 to display in the app

didn't think much of it, like yeah kinda slow but I'll make it load the thumbnails instead later

[half walrus]

i fixed it with this

[lime pivot]

yeah uh when not running under the debugger it can easily crash after loading only about 2 photos (not even of full iOS camera quality)

[half walrus]

aka, don't lazy load anything larger than 500b

given, it's still all loaded into the html bc that code is in cat

but something about storing file contents in the python runtime as well just broke zebra

I can still cat massive files repeatedly now in it after that fix

[lime pivot]

at least in Zebra you have the modern WebKit2 features like blob storage and webgl

[half walrus]

I need to add localstorage support

once i expand the filesystem emulation to its own file

[tepid olive]

please insert your unc0ver 5.3.1 CD

[half walrus]

i'm so like

[lime pivot]

this is of course not to say you should use blob storage and WebGL in a depiction

[half walrus]

legitimately happy about how that website turned out despite how cursed the entire thing is

full functional FS emulation entirely in python, and it works and scales properly

[lime pivot]

floppy ok? https://www.youtube.com/watch?v=iT1l8Dcjb1Y&vl=fr

[half walrus]

and if i can properly emulate file descriptors which is next, wew

which will actually be difficult due to the async nature of that

[lime pivot]

this is why we stan Android being based on Linux

[half walrus]

multithreading python in a tweak depiction 😛

because

god is dead

[lime pivot]

things you never thought should work, magically fucking work

[half walrus]

does it count as purely client side given the cursed nginx config though

[lime pivot]

man I forgot he literally runs a game in dosbox from the floppy

[lime pivot]

you also have access to WebWorkers in Zebra!

I shouldn't be telling you these things

[half walrus]

i was about to say

don't make this worse

i'm already looking at how easy it'd be to implement 'binaries' compiled in webasm

because someone happened to let me know that existed, unfortunately

already the only repo with depictions that have to 'boot'

[lime pivot]

me: trying to make depictions load everything in <1 sec

krit: trying to build an entire operating system inside her depictions

god dammit

[half walrus]

ironic given my usual obsession with making things fast

[lime pivot]

now I have to make my depictions run on Windows 95

[half walrus]

i do want to make things faster though, might have to use the webasm python implementation

brython is ok until you try to use the regex module

[half walrus]

while i'm trying to get my depictions to run Windows 95

[lime pivot]

the question is how I can make the win95 image do something different dynamically based on which page you're on

I think https://win95.ajf.me/win95.html can access the internet?!

[half walrus]

i don't think it'd surprise you to know that i considered that for my depictions

however

[narrow mason]

kirb and krit are two great similar names

[half walrus]

@nimble parcel's name is a reference to that if u were wondering @ jules

[narrow mason]

Oh yo

Pog

ok gn guys

[half walrus]

gn

[lime pivot]

I can imagine myself spending more time implementing carousels that are compatible with Internet Explorer 1.0 (likelihood of that is approximately zero) than actually working on useful chariz features

[half walrus]

i have never written IE compatible anything in my life

[lime pivot]

well I mean

IE5 - 8 were bad

[half walrus]

we considered it for https://old.reddit.com/r/Monstercat but

fuck that

[lime pivot]

IE1 - 3 are really nothing like the web we know it today at all

[half walrus]

and MS even said fuck it and just uses chromium now

w/ edge

[lime pivot]

IE…3? introduced JScript?

JavaScript But Java Is A Trademark So It's JScript

[half walrus]

lol

which came first

[lime pivot]

Netscape invented and shipped LiveScript/JavaScript

[half walrus]

bc if it was java, javascript was a horrible name to pick

[lime pivot]

somehow successfully licensed the Java name from Sun for reasons I still can't understand

[half walrus]

ah so it was

its like me making pythonscript and it's a compiled staticly typed language

[lime pivot]

like… the only "Java" thing about it was that you could vaguely make objects that kinda work like Java classes but not really

and that Brendan Eich had the genius idea to port java.util.Date, feature for feature, bug for bug

so you do new Date().getYear() and it returns some nonsense value

everyone knew that was dumb

[half walrus]

javascript is closer to async python with c syntax

[lime pivot]

he still did it anyway cause fuck you that's why

love to live in the year 121

[half walrus]

which is why using python for client side actually feels very natural

[lime pivot]

it's also said that JavaScript was written in 10 days

[half walrus]

would recommend if it didn't require a runtime

[lime pivot]

man I can't even build and ship a feature of my job's app in half that

[half walrus]

sounds impossible but then again

velox was written in 3, basically

[lime pivot]

hah, I mean

[half walrus]

shouldn't have been shipped on day 3

but

lol

[lime pivot]

😬

[half walrus]

H+ Pro for ios 13 was written in about 12 hours

if you dont include the 5 months of half-assing work on it

[lime pivot]

when it isn't your full time job and you're on an adrenaline high (or amphetamines it's ok I don't judge) you can smash shit out in no time

I have this with Chariz cause it just comes naturally like oh I totally need to work on this thing

but my job can be so gruelling and slow despite that I literally know what to do

[lime pivot]

my favorite part of this is when it very very slowly attempts to play the startup sound

[half walrus]

my insane ability to quickly build entire projects is offset by the fact i quickly build too many projects

[lime pivot]

hah, see, that's why it's good to have one super long-term project

like me

[half walrus]

gonna try and pound out as much of this header site as possible in one run bc i have so many things to work on rn it's never getting touched

yeah same here w/ u already know what

my workflow depends on it so if it breaks i have no choice

[tepid olive]

yeah use getFullYear 😛

I thought it would just say 21 btw

[lime pivot]

the goal isn't can I make a few thousand bucks, it's can I make a few thousand bucks and do that every week so I can employ people and make it better and strike some big business contracts and

[half walrus]

my goal rn is to

not have this

lol

[lime pivot]

sometimes I do feel like we're in the year 121 with how the US is going

[lime pivot]

eeeeeee

ow

[half walrus]

yyes

the fact that i'm not panicking about that should tell you enough

lol

[lime pivot]

does that… kinda affect your plans

[half walrus]

for getting out

yes

but i have backup plans on that bc i'm kind of used to it happening

hopefully out by may

when it's easier to get housing where i'm moving anyways

as for everything else i have a month to fix that

so we'll see

[lime pivot]

do they know yet?

[half walrus]

parents?

[lime pivot]

yeah

[half walrus]

nope

just going to keep it on the low and go ahead and hop on hrt for now

going to have to diy it (woo) bc insurance

thanks to someone you can probably guess for giving me instructions on how to do that lol

[valid venture]

this is meric’a

[half walrus]

was riding a very 'happy/confident' wave for a few days there, i think i mentioned, but i'm back in my usual mindset at this point, think things will end up fine w/ it

[lime pivot]

I'm sure it'll work out in the end

[half walrus]

i'm good at bullshitting my way through things despite the odds and somehow ending up better off, if anything

shouldn't be in as good of a spot as i am rn and yet

[valid venture]

adulting is bullshiting your way through

[half walrus]

given -$600 is

probably not the best spot

but it usually works out

h+ almost ready

not polished but 'ready'

[lime pivot]

I never really drew negative but before I got my job I did find myself realising I don't actually give that many fucks about my entire net worth being like $20 and a used macbook pro

[half walrus]

rarely let my liquid assets get very high

[lime pivot]

Chariz ready 👀

[half walrus]

usually immediately investing it back into my business

which

i need to open a credit line

[valid venture]

^ doing some coke & making 1k in the next 7 days is what I need right now

[lime pivot]

I probably would have cared a bit more if I had a car at that point

[half walrus]

because i'm literally treating my bank account like a credit line rn

[lime pivot]

I still don't have a car

or even a license

[half walrus]

i'm on the uppers where does the 1k come in

[lime pivot]

so guess I can live off savings for a good while

[valid venture]

doing uber/food delivery like everyone and their mamas these days

[half walrus]

how is coke gonna help with that

if anything weed 'd be better

[valid venture]

driving for 14 hours needs something to help stay awake

[half walrus]

caffeine

uppers are shit for that

[lime pivot]

uber drivers being potential covid superspreaders for shit pay makes me uneasy

[half walrus]

i still need a lot of caffeinated shit to pull me through all nighters, other stuff just keeps me mentally lucid for an extra 24 hours

lord the amount of chemicals in my body rn

[lime pivot]

more for them knowing having even just some money to survive a few more days is higher on their priority list than not getting covid

[half walrus]

god help my liver

bout to dump E on top of that

this poor body

least i don't drink

[lime pivot]

I learned my body actually really rejects most energy shit

accidentally skipped coffee one morning

realised it actually was for the better

no more headaches or dry af skin

more focused

idk how that even works

[half walrus]

never had that issue but it can happen yeah

i get headaches if i go a day or two w/o caffeine

recall a summer camp i went to long ago

banned caffeine

basically threw a ton of kids through withdrawal for a week

then at the end of the week let em have a soda

so many people got sick

[lime pivot]

that's a dumb rule

[half walrus]

myself included

[valid venture]

the amount of sugar probably has something to do with that

[half walrus]

yeah the next year since i was """friends""" with the cook they let me store some redbulls and grab coffee w/ the adults in the morning

[lime pivot]

I really can't be sympathetic to people who think they know better like no coffee it's bad for you anyway hnrrrrr

[half walrus]

not really friends but it was a church camp and the cook and i were the only people not from the church that was the main group

[half walrus]

tbf i can respect the sentiment lol

caffeine should be banned for <18 or at least <16

[valid venture]

nah the people who chung those monsters are the ones I’m thinking of

[half walrus]

addictive substance

but you can buy 300mg 16oz cans now at 12yo

used to be max 185 in stores

jumped to 300 over the past few years

been fun watching how high that's driven my tolerance

used to make me puke but now that's daily intake and then some

[lime pivot]

I can appreciate coffee is addictive because it does also taste good (as long as you don't buy nescafe) and you look forward to the taste every morning, but energy drinks man they all taste so bad

[half walrus]

mm

[lime pivot]

don't they want me to be addicted?????

[half walrus]

there's good ones

monster and redbull's 'default' flavors are

don't taste well

but i honestly like

there's swiss chocolate monster coffee

and it was a problem for me because it tasted so good and drank so easily i would drink wayyy too much way too quickly

[lime pivot]

oh man I figured out how to do the windows 95 thing I was thinking of

[half walrus]

so it's kinda like drinking straight vodka for me in the fact that i don't want it to taste good bc im not drinking it to enjoy it

[nimble parcel]

the US is prolly more likely to do that than ban 8 year olds from using AK47s unsupervised

[lime pivot]

I can pre-make a RAM image with a certain area designated as where to find the url that needs to be opened

[half walrus]

stop

[lime pivot]

read that with a quick C program on boot

[half walrus]

that's farther than i would go

[lime pivot]

lmaooo

[half walrus]

don't go farther than i would go

i already crossed a line when my depiction broke zebra lol

didn't file an issue because like

[lime pivot]

yeahhh

[half walrus]

i'm not sure if like

[nimble parcel]

but have you figured out how to do RCE in Sileo yet

[half walrus]

"i did something absolutely absurd but technically in scope and it broke" is something they want to deal with

[lime pivot]

I feel like this may be a bit of a heavy webpage

[half walrus]

do i wanna know

[lime pivot]

I can name one or two ways I've thought of

…but I won't

[nimble parcel]

possibly but im not even sure if it’s patched yet tbh

[half walrus]

that's the other reason i went with 'simulation' lol

despite my website being, my website

it's still lighter than google search

in terms of download speed

[nimble parcel]

i have so many questions

[lime pivot]

I remember when google.com was like the omen of tiny webpages that still look great and are functional

[nimble parcel]

such as

[nimble parcel]

what the fuck adam

[half walrus]

we were discussing https://krit.me/ and a VM came up

dont blame adam this is on me lol

not to mention i unironically looked at implementing that

[lime pivot]

now it's like it renders a homepage with a fake search box and buttons that then immediately jump to the results page that's magically already there loaded up for you, it has to preload results, it has to preload AMP sites

[half walrus]

in depictions

[lime pivot]

this went all the way to very silly things like not using </body></html> because it's not like any web browser is gonna blow up without them

and not using <head> because the extra bytes honestly do nothing useful

[nimble parcel]

so not one but two people thought “oh it’s a good idea to implement my website as a fucking emulator” damn

[lime pivot]

yep!

I mean

[half walrus]

see but i dont think adam was serious

[lime pivot]

you've seen https://kirb.me

[half walrus]

me however

oh yeah i take that back

i literally stole the idea from you

nevermind

well

[lime pivot]

I miss when I had the Linux 3.1 for Workgroups boot screen

[nimble parcel]

i commend the stubbornness effort tbh

[half walrus]

had it myself and you gave me the inspiration to actually do it

what's that written in

[lime pivot]

I'm not sure what you could call me if not stubborn

[half walrus]

because you should totally implement krit.me there lol

[nimble parcel]

actually I need to improve my website soon too so make that three

[lime pivot]

hahahaha

[half walrus]

just requires a live mirror of the emulated filesystem in <webroot>/fsmapping

with auto-index enabled on the webserver (in that dir)

and it should work

[lime pivot]

I think I did see someone's personal homepage actually implemented as a website in IE in win95

but it was bad

I can do better

I swear I can!!!

[valid venture]

does webasm work on iOS?

[half walrus]

it was absurdly painful in my case because /fsmapping/ is also webroot

[half walrus]

should?

google it

i think it does tho

[nimble parcel]

@lime pivot btw I’m gonna merge https://github.com/theos/theos/pull/538 rn if you don’t have any issues with it

[half walrus]

because i planned/plan on implementing it to an extent in krit.me

[lime pivot]

I have an absolutely terrible idea to redirect all "real" browsers to the emulator, allowing only IE3 and googlebot to access the actual content

[valid venture]

I was wondering how does a emu work and remembered webasm

[lime pivot]

I can't wait to see how many people curse me for that

"Windows 95 is an app downloaded from the internet"

[half walrus]

really wish browsers would add python support

it's

why not

[lime pivot]

you know @half walrus

[half walrus]

you can't say 'overhead' because, just look at chrome in a task manager rn

[nimble parcel]

aight here we go

[half walrus]

and its purely conditional logic anyways

and there's already a mainstream webasm python runtime implementation

[lime pivot]

back when Microsoft was on their insane rampage to destroy Netscape at all costs, one bonus "feature" was that any program could insert the right registry keys and become a scripting language in IE

so you actually could implement Python in IE6 on XP

[half walrus]

i see nothing wrong with that

except

rce

[nimble parcel]

i just had a thought

[half walrus]

but

use webasm

[lime pivot]

wen eta <script language="python2.7">

[nimble parcel]

is a cpu fan turing complete

[lime pivot]

yeah erm, I'm not sure why we didn't merge this… it seems to work?

[half walrus]

krit.me supports <script type="text/python"> 😛

pycharm/webstorm however does not

[nimble parcel]

there’s a “turn on the fan if the heat is greater than a threshold” primitive which seems similar enough to subleq to make an OISC

[half walrus]

so i moved the python to client.py

[lime pivot]

this is where you spend several hours writing an IntelliJ plugin for that

[half walrus]

cat client.py on krit.me if you're curious

[nimble parcel]

merged

[half walrus]

i have a window with this open yes

it shouldn't be hard to edit existing stuff

[nimble parcel]

also automatically closed two issues in the process so that’s nice

[half walrus]

however, for some reason, nobody seems to want to help

lol

maybe bc that's a cursed thing

but so is electron

god is dead

@nimble parcel do you mind if i 'steal' some ui basics from supercharge for

[lime pivot]

weee

[half walrus]

header website

[nimble parcel]

I’m good with that but you might wanna ask Alessandro too since it’s his design

[lime pivot]

ok, I had a brainfart moment and realised I didn't actually need to be that crazy actually modifying the RAM of the machine before it boots

[half walrus]

gotcha

[lime pivot]

I can just mount a floppy disk with payload data

[half walrus]

hard to even call it stealing when it's just printing the superclass as the subtext but /shrug

[lime pivot]

I still want to modify the RAM cause it's fucking cool

[nimble parcel]

time to see how much stuff this breaks :p

[half walrus]

ok but

i cant believe i'm debating best practice here

[lime pivot]

you can't stop me bro

[half walrus]

but wouldn't you want to do it dynamically

one download instead of

a download for every subpage

[nimble parcel]

oh I don’t think you need to ask me if it’s just that haha

or alessandro

[lime pivot]

yeah, I should be able to have js download the RAM image to memory, overwrite my allocated memory area, and then boot that

[half walrus]

have the js dynamically patch the allocated memory

[lime pivot]

should be able to continue execution like the OS never even shut down

[nimble parcel]

i did a ton of the hooks UI myself since it got pretty technical to explain

[lime pivot]

yeah totally bro

[half walrus]

if you do this

make sure to do it in the most efficient way possible

[lime pivot]

don't you want JavaScript being a malicious hypervisor to Windows Ninety Five

[half walrus]

nothing better than doing something conceptually horrible in the "cleanest" way possible

[lime pivot]

man, this one dude wrote this entire operating system?!?!

[half walrus]

is your website open source btw

i know that's

[lime pivot]

I absolutely love that he left minesweeper open in the initial RAM image

[half walrus]

a dumb question but

[lime pivot]

my question is whether that means the first game is always going to be the same for everyone

[nimble parcel]

i was about to say

[half walrus]

if its on gh i wanna throw my stuff in it and see how far i can take it

[lime pivot]

I didn't open source because I didn't want dorks copying it cause they thought it was cool

(krit is not a dork krit has permission to copy it)

[nimble parcel]

should’ve started it so that people could do a competition deterministically

[half walrus]

anything web is inherently open source

[nimble parcel]

soviet national anthem plays

[lime pivot]

yeah I was like not gonna hide the code in any way, it does get optimised by mod_pagespeed and cloudflare but that's it

[half walrus]

bc u know i refuse to use literally anything i didn't write in anything with my name on it

to an extreme at times lol

[lime pivot]

just a "stay out of my shit" comment in the <head> I remember

man

I never learned how to play minesweeper

despite being one of 6 games on my first pc

[half walrus]

didn't miss much

watch me write a search function 200x faster than limneos' site in 5 minutes

idk how it's so slow there

[lime pivot]

remember when it was cool to credit the actual developers

[nimble parcel]

feel like you’re gonna have a bunch of 40-somethings cursing at you in #developer-backroom now

[lime pivot]

😂

[half walrus]

wont know bc i'm never getting advanced dev

[lime pivot]

just a Home Premium Developer

[half walrus]

(insert dog laughing emoji i lost it)

[lime pivot]

yeah that'll do

[nimble parcel]

clearly you’re not a developer because no orang name

[half walrus]

worth

[lime pivot]

I dig pink name tbh

[half walrus]

hideous colour

i have lost chat mod perms here

but worth

[nimble parcel]

i respect the principle

[lime pivot]

neat

I had that one coming

[nimble parcel]

can’t wait to have my perms revoked for that

[half walrus]

• now you can tell me apart from the rest of the k.* gang

[lime pivot]

I hate how, like, clean and consistent win95 is

everything just looks correct

[half walrus]

lol

bc they never rewrote UI since then

just tweaked it

[lime pivot]

not like win 10 where some days you need Settings, some days you need Control Panel, it may look like Windows 95, it may look like XP, it could look like Vista, it could even look like 3.1!

[half walrus]

yyup

and apple literally rewrites everything every 2 years

[nimble parcel]

just realised we’re also some of the only people in this channel with actual photos as our profile pictures

[half walrus]

glad to join the gang

[restive ether]

[lime pivot]

two of three of our pics have been edited by the One And Only Kritanta

[half walrus]

barely touched urs

[nimble parcel]

rip where’s my krit edit

[lime pivot]

well-known photoshop extraordinare

[half walrus]

send me high res but u didn't post a selfie taken from a bad angle so idk what to even do

[nimble parcel]

thinking of switching to this profile pic at some point

[half walrus]

@ kirb, face height or higher when u take photos, does far more than you'd expect lol

[lime pivot]

it's mandatory as part of the ^k(r|ab)i(r|t)b?$ social contract

[half walrus]

that's a really damn good photo

[nimble parcel]

haha ty

no u

[lime pivot]

krirb

[half walrus]

camera or portrait mode

[lime pivot]

kabit

[nimble parcel]

latter

[lime pivot]

supppp

[half walrus]

amazing that i cant tell

[nimble parcel]

damnit i should’ve used a fuzzer

[nimble parcel]

hi 😳

[half walrus]

mine is portrait mode but i had to run it through a shitload of stuff in PS lol

[lime pivot]

just like how krit should have used htmlentities() at the top of this conversation 😉

[half walrus]

focal length in portrait mode is not that good on the X

[lime pivot]

honestly it's bad in general

[half walrus]

?

[lime pivot]

I can't believe they pulled it off without the second lens on XR, same for Google on the Pixels before they decided they're all in on this camera stovetop design

[half walrus]

i'm really not gonna protect against client side self-induced XSS on a static website

[nimble parcel]

did you XSS his website because if you managed to im kinda ashamed that I couldn’t

[half walrus]

he's talking about the header site

[lime pivot]

but MOM 😢😢😢

[half walrus]

there's an XSS vuln in the URL params

that allows you to

inject javascript

into your own webpage

[lime pivot]

to steal your sooper sekrit cookie to do… nothing because the cookie doesn't exist yet

[half walrus]

i don't use cookies because i'm lazy ever

[nimble parcel]

is the input coming from the get params?

[half walrus]

yep

[nimble parcel]

it doesn’t have to be self xss then does it

just embed an iframe

[half walrus]

you can take control of the client side webpage using it

[nimble parcel]

if you have anything else on that domain an attacker could control that too tho

[half walrus]

'attacker'

it gives you the same control inspect element gives you

[nimble parcel]

i like to feel like im doing important things sometimes

[half walrus]

failing to see scope here

[nimble parcel]

what’s the website’s URL?

[half walrus]

it's a localhost website rn

[lime pivot]

although "please click this link then paste this in the js console" is somewhat less exciting than "please click this link, uh, yeah no particular reason, just click it pls"

[nimble parcel]

if you host it on a krit.me subdomain someone could steal any sessions/cookies across *.krit.me

[half walrus]

which i am far too lazy to add to any of my websites

[nimble parcel]

again just direct them to your website and load the header site as an iframe

[lime pivot]

if I hosted this on chariz.com it could be the direct gateway to stealing cookies for piracy

[half walrus]

even the logins for this are going to be discord oauth2

however

[nimble parcel]

ah that’s your point too

[lime pivot]

because every attack on a store hosting digital content is gonna be about piracy

[half walrus]

if one of you wants to send me the code to fix this feel free

it's worth nothing

[lime pivot]

something tells me this is kinda not the best use of my CPU

[half walrus]

what you guys mentioned cant be hit rn

[lime pivot]

just gotta wrap any params you feed out to html from user input in htmlentities("blah")

[half walrus]

it's not going to reach the echo code if it cant find the file/fw

so

[nimble parcel]

that could still be bad since someone could steal the oauth token

[lime pivot]

why not bro

[half walrus]

bc it already validates existience and nullifies if it it's not there so it can redirect to homepages

[nimble parcel]

the refresh token not being present locally means it probably wouldn’t last long but long enough for an attacker to do whatever they wanted with it

[half walrus]

so unless there's a file/dir with the exact name of the class or framework it wont reach echo

so this isn't even a vuln actually

[lime pivot]

linda!!!

[half walrus]

anyone here write php

i'd throw this on gh while i work on it but nobody else writes php here

[nimble parcel]

im ashamed to say sometimes

[lime pivot]

I love how he's not shocked, he just instantly calls his wife over

[nimble parcel]

ikr it’s a beautiful gif

[half walrus]

lol ykw

gonna point cloudflare at my PC

what could go wrong

actually does cloudflare proxy serve non-web requests

[lime pivot]

go one better

[half walrus]

bc that's a problem if so

[lime pivot]

point it at a spare iPhone running nginx and php

[nimble parcel]

on certain ports I think

[half walrus]

my local network is

[lime pivot]

yes, it does

[half walrus]

not ready for that

[nimble parcel]

for example port 8443 iirc

[half walrus]

specifically 22

[lime pivot]

I very much dislike that cloudflare does that

[nimble parcel]

don’t think so

[lime pivot]

they call it A Feature and if you don't want it, pay them $200/month for the port whitelist feature

they do proxy port 22

[nimble parcel]

oh they do?

[half walrus]

yup i'm ok

they dont

[digital vale]

Can anyone help me in dm to find a button coordinate inside a game?

[half walrus]

or that would work

[lime pivot]

because they assume you could be boned otherwise if you're a noob

[half walrus]

i mean that's kinda the major point of the proxy in the first place

otherwise why proxy it

[nimble parcel]

https://support.cloudflare.com/hc/en-us/articles/200169156-Identifying-network-ports-compatible-with-Cloudflare-s-proxy

[digital vale]

Any1

[lime pivot]

ah, so they don't forward them any more

what are these 20xx ports…?

[nimble parcel]

I assume connections to any other ports are simply dropped but I’m not sure

[half walrus]

congrats

i broke cloudflare

i can't sign in now

[lime pivot]

wtf

[digital vale]

Or another question

I’ve a connection problem with openVPN

[lime pivot]

the problem with Macs is I quit the windows 95 thing like 5 minutes ago and the fan is still screaming

[half walrus]

have to use incognito

[tepid olive]

is there a catch to 1.1.1.1? literally the best somewhat vpn i've used

[half walrus]

that support website screwed my cookies or something

[lime pivot]

From a technical perspective, WARP is a VPN. But it is designed for a very different audience than a traditional VPN. WARP is not designed to allow you to access geo-restricted content when you're traveling. It will not hide your IP address from the websites you visit.Sep 25, 2019

I love how they word it as "access geo-restricted content when you're traveling"

yes… that's exactly why I happen to be the proud owner of a license to a US VPN

for when I'm travelling

[half walrus]

http://hdev.krit.me:8080/?framework=IOSurface dab

[tepid olive]

isn't it still gonna use another IP

[half walrus]

feel free to watch me work on this in real time

[lime pivot]

check https://checkip.dyndns.org to find out

compare off vpn vs on vpn

[half walrus]

http://hdev.krit.me:8080/?framework=IOSurface&class=IOSurfaceObjC

already have syntax highlighting

[lime pivot]

but I'm not clear on why they say it's a VPN but it doesn't mask your IP

[half walrus]

did embedded scrolling

instead of full-page

bc

idk

[lime pivot]

just note that'll suck on mobile

[half walrus]

yeah wondered about that

[lime pivot]

I found out the hard way after refactoring chariz dashboard thinking I was such a genius

[half walrus]

let me check actually

i usually write css in a way that doesn't require a media rule

[lime pivot]

safari's stupid bars don't know they need to disappear if you're scrolling something other than the main <body>

[half walrus]

it's actually great on mobile

[tepid olive]

yeah it does hide ip

[half walrus]

partially because the mainpage is overflow hidden

[tepid olive]

won't send screenshots but it does change

[lime pivot]

in the end I did just change it to only do the inner scrolling div in @media (max-width: 500px) or whatever my breakpoint is

[half walrus]

but i like how it feels on mobile

oop there it is

[lime pivot]

still can say my dashboard is more mobile-friendly than Apple's even after they redid half of theirs last year

[half walrus]

fuckin mobile safari

[lime pivot]

ikr

[half walrus]

overflow hidden on the body means