Show HN: This website moves your mouse cursor

Wow. One time in highschool I ran Rainmeter (a harmless HUD program: https://www.rainmeter.net/) from my flash drive on a school computer to show a friend. The next day I got called up to IT because they apparently had software listening for any foreign executables (but not actually blocking them?), and policy was to suspend me from school computers for two weeks. I was taking a CS course at the time, so for two weeks I just had to sit there in class doing nothing.

When the IT guy talked to me, he even said he'd seen Rainmeter in a magazine and tried it out at home and thought it was pretty cool. But the admins had watched Hackers too many times, it seems, and thought it appropriate to treat me like a delinquent :P

Edit: Looks like Rainmeter is still alive and kicking! Maybe I'll give it a revisit

did something similar, with delphi, using winapi but also used opportunity to learn network sockets so the daemon was controlled using telnet. and instead of deploying it to the lab I was just showing it to those who were interested, so didn’t run into problems with teachers :)

Ps. cd opening was there too :)

I received a similar summons to the principal's office for using the "netmsg" DOS command to send a single character, the letter q. I had intended to only message my friend in the same room but it went to every computer in the school.

This sounds super similar to a prank I pulled in high school.

At school, it was sort of a cat-and-mouse game between the students and the sysadmin. Kids would find new ways of evading the school blocks (different proxies, someone getting a bypass login, etc so they could access myspace) that the admin would then catch a couple weeks later and close. A lot of these proxies were distributed on the fileserver that was shared between students.

One day, I wrote a small piece of software in my programming class (in VB6!!) that would wait a random length of time, and then open and close the CD tray. I wrote a short batch script that would copy that file to startup and then open the current popular proxy software. I then changed the icon on that script and placed it where people expected to find the proxy software, giving them reason to run my script.

Students then unknowingly disseminated my software all over the school, and the next day (after PCs were rebooted overnight) the software would take effect and randomly open/close the CD trays of computers all over the school.

They ended up tracing it back to me (windows user permissions/ownership, probably) and I was promptly banned from computers at school through the end of the year and for most of the next.

Floppy drive bootloader.

If you left the floppy disk in, I took over the boot-process and displayed "Uploading Virus" in a loop. Which of course, didn't do anything.

A few weeks later, all the floppy-drives were removed from the library's computers, lol

My high school claim to fame was a VB.NET application I wrote during class that would connect directly to my server to download flash games since online flash games were constant cat and mouse. I had hotkeys so you could hide the whole thing from screen and taskbar on a whim. My flash repository was still getting hits for years after I graduated, though that tapered off a little while ago.

Hah, I had a similar experience. Got kicked out of one class, changed to a keyboarding class because I could already type fast. Easy A, right? Well, the computers didn't work very well and I'd fix them, and leave a signature where I'd been. Teach was a little flabbergasted when I'd be sitting at a "broken" computer but no matter.

Don't tell, but I knew how to pop into windows and play games, and the machines were networked so I had everybody's classwork sitting right there. They can't catch you cheating when the assignment is to copy the same damned text. Teach lost me on day 1 when I did 65wpm on the 5wpm test, all like "no, you can't skip ahead, you've demonstrated can type at 5wpm, now you need to take the 10wpm test"

But then they taught us how to use macros in a word processor. I don't know how or why, but the computers had a shared namespace for these macros. We were only supposed to use them, but I figured out how to make and edit them. Told a friend about it. The friend promptly changed the macro the class was meant to use. With recursion. And that was Trouble. Who gets the blame? Kid with their name on all the autoexec.bat files, that's who.

Shortly after I got back from suspension, I talked to the IT guy, and became his unofficial TA, and fixed computers during that class period.

> Problem was, there was only one person in the entire school they felt was capable of such nonsense

I found myself sitting in the vice principals office, as a kid, all alone with his password under his keyboard. I thought long and hard about going to the local library, dialing up to the school network (modem days) and changing a bunch of grades of students to improve my GPA. That reason you called out is the only reason I did not. All eyes would be on me.

So I resorted to just mild pranks

- took a virus from my library and submitted it with homework

- found someone trying to install sub seven on my girlfriends computer. I reverse subseven’d him and socially engineered him to give me his address. Used mapquest and showed up at his house

- made a fake virus that pretended to run format c: on my moms computer. My mom had the principals office call me out of class in 6th grade. I remember laughing my ass off that I got called out of class for that prank

- in college I wrote a program that would split up audio files into variable lengths up to 1 second and send them to a list of servers (sun ultra 60s) then run auplay to play the audio of the files out of the speaker. The controller would keep track of which system had which part and would plAy the audio in sequence across the various systems. The sun servers were lab computers with users on the console. Imagine their surprise when Mega TeamFortress sounds start playing in surround sound out of all of the systems around them.

- scotch tape over the very end of Ethernet cables on desktops (fun!)

- vb or c# program that “jiggles” the mouse pointer. I made a coworker throw out three mice because of it

- redirecting a coworkers network drop to a spare Linux computer in my office running tc introducing random latency

- control-alt-down on windows computers

- random times in cronjobs that runs shutdown or randomly kill shell process on unix boxes/accounts that were left unlocked

There’s probably more, but whew I haven’t pulled a prank in over a decade!

This is hilarious. I have another somewhat related story.

Back in 7th grade I stumbled upon the "net send" command. So, bored in the back of class one day, I sent a few messages and saw them pop up simultaneously on all the computers. I thought it was pretty funny. I didn't sent anything vulgar. Just something like, "yo", and "it's Evan" (yes, I put my name).

Well, turns out I sent those messages to every computer in the district. Three elementary schools, one middle school, one high school, and the administration building.

Maybe 10m later someone from the IT team came and asked who had computer #XX. Obviously was me. Principal claimed I hacked into all the computers and said he'd call me back in for an appropriate punishment.

Nothing ever amounted to it. Never got called back in so I had no repercussions.

Haha, this sounds almost exactly like my Delphi story - just I didn't target the mouse.

Instead, I did target each keyboard's keys which - when being pressed - would play a sound using internal speakers. Deployed it on all devices in the room and once class started, we had a lovely concert going on.

Got kicked out of the room immediately.

Ah, and netsend was fun also :D

Setting the cursor position is still available in the Windows API, it is the basis of how most RPA tools work.

This story made my day

This sounds very familiar. In my final year at school I was given privileges to 'monitor' the school's computer lab over lunchtimes. What that amounted to was really just reminding the other students to save and leave before the afternoon lessons started.

I thought better and that I could automate this task by writing a small background task in VB (4 or 6, I can't remember which year/version) which would listen for commands on UDP.

One such command would initiate an immediate shutdown. Without prompting the user to save open documents.

Only once I issued that command to the entire lab.

I didn't take long for everyone to find out who did it since my own machine was still logged in and working.

The next day I removed the process from the machines lest I get myself in any real trouble.

- pushed in my USB drive with autorun to copy files ( it was related to a dare)

- someone was a bully. He talked about nfs 2. Sub7 him and deleted his saved games of it( a website catched his IP in logs, also msn could see the ip connected during a file transfer at the time - unrelated). I laughed silently, when he complained at school.

- distributed the twilight and crazy bytes CD/dvds at school. They compression was amazing! ( I know it deleted assets too)

My desktop contained 3 cd writers to burn things. Later on 3 dvd-writers.

- Didn't fiddle with hardware too much. But i remember doing modem bonding for double speed. I quickly stopped because my parents found out ( 2 phone lines occupied) and because of the high price... 5,6 kb. * 2 felt insane. It was a normal model though and seems a bit weird, telling it. Did anyone do this too? ( Don't remember it very well)

- chat logs of msn were amazingly simple and nice at the time! Xml with dtd. I still use it for a lot of things for templating client data and even generating html from it. Most useful thing from then, that i still use.

We had Windows machines in around 94. They booted to some kind of menu where you could do various things I don't recall...and boot Windows. There was a problem with my friends machine one day and I saw the IT admin type a ludicrous single character username and password to get into this boot menu.

So I used it to have a look around and change the startup message to insult a friend. Then I told him how...and he told everybody. Next day all of the machines had obscene messages, and someone was caught doing it, they said my friend told them, and he told them that I told him. Thanks buddy.

I remember being terrified as I told the deputy head how I 'cracked the code', but I think I just got a detention.

On Windows 95/98 there was an API call that hid your process from the taskmanager (intended for services, IIRC). Used that trick on my "fun" Delphi programs.

That’s a good story. In middle school I got similarly called to the principal’s office and threatened, but literally all I did was send messages (and nothing particularly menacing or inappropriate) to other computers using the Novell client software that was installed on every PC at school. You had a lot more fun!

When I was 12, I found out about `shutdown /i`, which opens up a GUI where you can enter target IP addresses. Obviously I had to try it out in class. Each computer room in school had its own IP range, so it was easy to target all PCs in the current room. At the end of the class, I shut down all PCs - it worked!

I told a friend how I did it - of course he had to tell the others in class.. so the war began and everybody shut down their neighbors PCs!

We then invented "defense scripts" in batch, which basically ran `shutdown /a` in an infinite loop to cancel any shutdown requests.

In the end, the administrator disabled the shutdown command - the official reason was potential harm we could do concerning A-levels.

Good times.

Reminds me of the time I naively did "net send *" to send messages to a coworker such as "What's up dog?" at a US Air Force base hospital (I was summer hire working in the warehouse). My coworker got a kick out of it, but apparently every computer in the entire hospital was on the same domain and two frantic IT NCOs came bursting into the warehouse trying to figure out who was sending the messages. Apparently the group commander's computer was getting them too...

The network space on my university campus was flat and unfirewalled - one big /16 on which every device had more or less unfettered access to every other device.

Sometime in my senior year, I read that there was a PJL command that could set the ready message on networked HP printers.

Naturally, I wrote a script that walked the entire /16 and would attempt to set the ready text to "Low Toner". My girlfriend convinced me not to run it, so I changed it to "Low Mayonnaise" and ran that instead.

For the next few weeks, seeing "Low Mayonnaise" on printers was a pretty common sight. It disappeared on its own as printers were reset, or error conditions triggered, but it did feel pretty satisfying.

I got only suspended for two weeks because I pressed E in the grub menu and booted linux with a root shell. I told my teacher that their installations are basicially not secured at all and he didnt understand anything what I tried to explain and send me to the school manager which accused me of hacking the school network.

I cannot imagine this taking place in this day and age. The principal would have you marched out of the school escorted by police and charged you with a federal crime or something.

You lucky young folk! In MY day the Apple IIe didn’t have CD, mouse or network! Pranks were pretty limited...

Hah, I did something sorta similar in my freshman year of high school - I noticed that emails sent to the whole school were sent to mailing lists (in gmail's terminology - not sure what this kind of address is in actual email standards) called "allYYYY.student.school.org", where YYYY is the graduation year of a grade and student.school.org is the domain all our student emails were at. I hadn't seen that kind of email address/mailing list address before, so I wondered whether it was just a legit email address as well. It turned out it was (it was for a google group in the domain also called "allYYYY" IIRC) so when I sent an email with subject line "Hello" and body "?" to allYYYY(at)student.school.org to see if it would give me a mailer daemon response, that got sent to all ~800 people in my grade, some of whom promptly started replying to all. Eventually a couple kids started sending edgy memes, so I was called into my dean's office and asked to forward them the whole thread so that they would know they weren't missing out on anything "dangerous" (I think the main one they were concerned about was a picture of someone shooting a gun with the caption "I would literally die if a guy did this to me"). Then they locked down the capabilities on the google group, so no more unapproved email campaigns :(

That’s great. I have similar stories.

I burned some CDs with an autorun executable written in VB6 that would play a certain Rick Astley number at maximum volume until the user logged off. Left them lying around with various enticing labels. The result was as predicted. Unfortunately, as in your case, I failed to realize that the list of students likely to do such a thing was a very short one indeed.

Later on in my school clown career, I reconfigured the printers to add a giant “CONFIDENTIAL” watermark across every page. This was the day before an important coursework deadline. That one did not go as planned: clients that had cached the malicious settings kept sending them back to the print server, and it couldn’t be fixed until everyone went home for the day.

> At the time, the Windows API was essentially completely open to mess with, and I had discovered a bunch of weird things, like the fact that setting (!) the mouse cursor position was even possible

It's still possible, I did that a couple months back while making Cyberpunk 2077 hacking mini-game autosolver

Huge congrats to the principal and council. This is not what I expect to see from schools usually (a big part of my family works in edu) and this is exactly what they should have done. Even better they should have asked you to give some lessons and start actively be part of the course. But this would require the program to be a little more profound than text editing and office automation.

This is my favorite HN comment in a long while, maybe ever. You sir are a gentleman and a scholar!

Back in the day, my highschool had two classrooms with computers, but they were not connected to the internet. For that, there were two (for a school of ~1800) computers in the library that you could reserve for a 15m block. They both had a 14k4 modem to dial in.

Interestingly, all of these computers were wired to a LAN. It didn't take long for me to install a proxy server on one of the library machines, allowing me and my friends to use the internet in the computer classrooms.

At some point the system administrator (who was also a German teacher) saw us browsing the web. Instead of getting mad, he just laughed and offer to pay me a bit of money to properly set this up for everybody.

Good times!

I brought Sub7 into my high school in the early 2000s and just used it to mess with some friends. Harmless stuff like opening Notepad and typing into it.

Well someone else discovered it and did a bunch of damage to a bunch of machines and got into trouble, but I got off clean as a whistle. Sticking to gray hat kept me outta trouble.

I taught some friends how to code in high school and they went to do some prank like yours.

Of course they called me out of all the students and basically just told me "we don't care who did it, just remove it".

Another time someone downloaded pr0n on their account and pretended someone framed him; I was then confronted by the school bullies on why would I do such a thing.

I hate when people use meta game to find suspects

Oh, the fun we've had in computer classes in school... Out high school was math-oriented, so there's a bunch of 14 year olds who spend 6 hours a week proving theorems and lemmas – and learning a local dialect of Lisp made by our school stuff. Obviously, there were a long of shenanigans, trojans, and DOS attacks, but the best part was when my classmate got so annoyed by his PC restarting for the third time just as he logged in and opened his IDE third time in a row, he physically attacked a classmate who he thought was responsible. (He wasn't, it was me, from another classroom). After that, our whole class was downgraded to DOS as collective punishment.

Not a crime IMO, but a little prank, and the principle understood it. It was pleasurable to read btw!

The one that got me in trouble was

    net send * "i know where you live"

on my school's network. If anything, I did them a favor. They didn't see it that way though.

> At the time, the Windows API was essentially completely open to mess with

Not entirely unlike this April morning in 2021.

> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white)

I've already seen sites that change the cursor's appearance, so I wasn't particularly "shocked" by that (I'm on a Mac).

However, what should improve the illusion would be to not move the cursor outside of the view area.

> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white)

You're right, it would make the illusion better. I developed this on Ubuntu where the default cursor is black, and I did consider doing this. Eventually decided to just use the default white cursor from Windows because it has better contrast on the dark color scheme. I guess I could set up 3 different color schemes for 3 different cursors for Mac, Linux, Windows, but it may be a bit too much work. I think most people who notice the cursor is different will just think "oh, this website uses a custom cursor", they won't necessarily realize that it's just an image.

But you should still panic a little bit because this technique can be used for https://en.wikipedia.org/wiki/Clickjacking

I mean it was obvious by looking at the inspector if you have firefox. It's funny, I was able to "click" the how does it work button even though it makes it look like you can't mouseover it.

Also, kind of obvious given I use a gtk+3 dark theme and the mouse they use is white.

I used Mac OS for decades before switching, but I changed my Windows cursor to black because I'm used to it and I genuinely think it makes more sense with most backgrounds being light colors.

I'm not sure what the panicking would be about being able to move the cursor inside the website.

I had assumed there would simply be Javascript calls for this. — how is it a problem that this be possible? that it can make one click on links that can be activated with Javascript on their own already?

Of course it could move one's cursor outside of it's own rendered page that would be problematic, but this trick cannot simulate that either.

And the fact that it draws a mouse on mobile-devices.

This is fantastic.

whoah, that's cool... and he built another demo here that's pretty amazing: http://schemasofuncertainty.com/

That would be useful to keep the ad under the pointer.... /s

Huh. If I move my mouse fast enough I can escape the lock.

especially when you go all four corners and then dramatically put the cursor right in the middle. goosebumps.

saw a scary face in the background and nope nope nope nope

It's basically just Xeyes.

I found that one as well, I appreciate them hiding it for only the curious to find :)

Yup, bravo, they got me too. I'm so angry.

e: The JavaScript can be found on the <head> section of the page btw

youtube should make an exception for this video so that it doesn't show ads when you visit from an external referral. Ads really ruin a good rickroll.

> Sometimes it disappears "under" the fixed part of the browser.

Thanks for reporting this. The behavior around the edges should be improved now.

Hmmh, that's weird. The only 3rd party script on that page is Plausible Analytics, and blocking that doesn't affect the functionality on the page. It is loading one (first party) JS file, maybe your uBlock configuration is somehow blocking that? I'm also using uBlock with the default configuration, and it works on the 2 machines that I tested with.

;)

I clicked it^^

If you look at the source you'll find a link to a youtube video that tells you all you need to know. Don't give up :-)

Found a fun Firefox issue where after putting FF in the background I tried to command-click that button to trigger it. My mouse cursor disappeared across the entire OS even though Firefox wasn't the active application! Had to bring Firefox back to the front to see my cursor again.

Yeah, you can click it, but only if you already figured out how it works - move the fake mouse cursor to the point where it is almost over the button, blindly move it down a bit and click.