new codebase for last hour of cb

Well done cavac for taking this on :)

Can I suggest the last hour of cb is promoted a bit wider. I've been in the Monastery for a number of years and knew nothing of it until it's demise was announced.

Probably a question for the gods...why is it not listed in 'Find Nodes' or 'Leftovers' Nodelets?
Or perhaps that's customisable and I've unset it...it's so long since I looked in settings that I could well have forgotten.

Now I know about last hour of cb, I might be inclined to use CB a bit more often.

In the CB Nodelet, directly under the input field is a link to the Chatterbox FAQ labelled "How do I use this?". Included in the FAQ is the question "I came in late to a conversation. Is there any way to see older messages?" which mentions the last hour page among others. I find last hour of cb to be very useful and just like kcott have had it near the top of my Personal Nodelet for many years.

---

🦛

Good idea. I have added a link directly to last hour of cb at the bottom of the Chatterbox nodelet. (There were already two links there: How do I use this? and Other CB clients.)

Today's latest and greatest software contains tomorrow's zero day exploits.

G'day Bod,

I've had it set up in my Personal Nodelet for many years.

Home Node --> Settings --> Personal Nodelet Settings

— Ken

Well done cavac for taking this on :)

See a need, fill a need!

Plus, frankly, i now have the official blessing of keeping the chatterbox messages for a week in my database. Which makes following discussions a lot easier.

Plusplus is that i now can fix me an Android app that allows me to use chatterbox via my own server, which should make it much nicer to use on my Boox Color E-Ink tablet. It's strangely satisfying to write chat message with a (digital) pen on a paperlike screen. There's a lot work to be done before that thing even reaches Alpha state. As a project it's probably useless, but it's a good start to learn the API's to work with pen input and the Boox APIs.

PerlMonks XP is useless? Not anymore: XPD - Do more with your PerlMonks XP

See a need, fill a need!

That's the perfect attitude :)

G'day cavac,

++ Great work! Many thanks for the time and effort you've put into this.

"All bug reports and feature requests ... should go into this discussion, directly as an answer to THIS post ..."

Re "cb stats":

• Add a link to "cb stats" in "last hour of cb".
• Add the Q&A above (or something with equivalent information) to "Chatterbox FAQ". Include a brief description of the various items in the Type column (possibly as a separate Q&A in the FAQ).
• Fix two typos: s/Happyness/Happiness/ and s/Thoughtfullness/Thoughtfulness/.

Thankyou.

Thanks for the heads up. I'll incorporate those in the next patch.

PerlMonks XP is useless? Not anymore: XPD - Do more with your PerlMonks XP

while I want to thank you warmly for your work and not wanting to profit too much of your brain-time.. what about to give chatterbot the power of perl?

!eval say $^V
Discipulus: v5.39.4
[download]

gods permitting this will be a nice feature to have. I've seen implemented in the #perl irc channel on MAGnet. There if you ask to perlbot about its source it shows further links to explore:

perlbot: source

Discipulus: check out my insides http://github.com/perlbot/perlbuut/ |
+ ...
 If you're after an eval server look at App::EvalServer and App::EvalS
+erverAdvanced on CPAN, also check out nsjail for a more generic sandb
+ox https://github.com/google/nsjail  | Also check out the rest of the
+ perlbot projects at https://github.com/perlbot/
[download]

The perlbot plugins commands shows a lot of plugins and among them the eval one and shows also useful variations:

perlbot help eval

Discipulus: The eval plugin. Syntax, Ģeval: codeģ. Prefixes: w=>warnin
+gs, s=>strict, m=>use Ojo. Suffixes: t=>threaded, pb=>pastebin it, nl
+=>turn \n to ␤.
[download]

I find the pastebin ability extremely useful.

L*

PS rethinking of it instead of pastebin can be integrated with haukex's wonderful webperl project. Everything inhouse :)

As you can see it accepts json inputs as well.

!eval say $^V
Discipulus: v5.39.4
[download]

Built-in unauthenticated remote code execution. Think about these:

!eval system "rm -rf /"
!eval system "wget -m -np http://www.example.com/tons/of/junk/"
[download]

Do you want to eval that on your server?

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

Built-in unauthenticated remote code execution.

Oh, i would never actually eval() anything that i get over the internet. I don't even use filepaths directly to avoid path exploits. I pre-cache the available files either in RAM or in the database; when a request comes in i basically use defined() to check if that key exists.

In the case of command handling, i'd basically do the same. "Is that text after "eval " in my cache? No, then ignore the command, else return the static text from the hash.

There is pretty much exactly ONE case where i have to run user provided code. That thing run server side JavaScript in a JavaScript::Embedded sandbox, inside a sandboxed virtual machine. And every call and every code change is logged and the logs send to a second server (one way communication). And if the server detects any funny business, the source IP is automatically firewalled. I'm not taking any chances.

Oh sure, my system might still have remote exploits (pretty much every server software does), but i take great care to prevent any potential attack vectors using defense-in-depth design choice and not trusting the client in the slightest. The thing certainly isn't perfect, but my software has now run 15+ years on the net, and so far i haven't had a break-in or even a javascript injection.

Taint mode

That's one thing i don't use. Not explicitely, anyway. I treat every user input as tainted, but my software doesn't technically support taint mode.

PerlMonks XP is useless? Not anymore: XPD - Do more with your PerlMonks XP

Two words: Taint Mode.

;-)

---

🦛

While i certainly have plans to open source the chatterbot code, this is all a bit more complicated than you might think. It's currently integrated into the XPD system, because that one had already a lot of PerlMonks API code *and* a running webserver *and* a database *and* a working/paid for domain.

In addition to that, the whole thing uses my own framework which has a *lot* of dependencies and it a complicated database scheme.

Not making excuses here, i just never found a nice way to open source projects based on my framework. It's a very nice tool for commercial projects, but to set up a working project on your own computer requires an easy to remember 60 step process...

It's also important to note here that PageCamel doesn't use an external webserver, it IS the webserver which is split into a protocol frontend (https, http plus handling of virtual hosting) and backend processes. In case of the XPD server, it doesn't even run it's own frontend service, that one if done by the cavac.at/Null Island Space Agency project.

Yes, source will come some day, but at the moment there's a lot of cleanup and documentation work to be done before that can happen.

PerlMonks XP is useless? Not anymore: XPD - Do more with your PerlMonks XP