NeoCities
neocities.org
neocities.org
I am proud to say that's always my first impulse when thrust into security-related circumstances.
http://www.schneier.com/blog/archives/2008/03/the_security_m...
That is pretty frigging mean to exploit such an obvious problem!
He started a month ago. The 'Just Ship It' mantra basically declares that crappy bugs like this are A-OK. I don't know why you're surprised.
If you find any other bad bugs, please let me know (@kyledrake on Twitter) instead of, you know, trashing other people's work. I'm finding the duplicate sites right now and taking care of it. Thanks, and again my apologies.
This is not an email phishing expedition. I don't even require you to enter your email address to make a site.
I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people are going to be signing up. I think they have the right to know that a bug like this exists. Like I said in my initial post, a bug this big seemed to be a sign of a bigger problems. I had suspicions the site was malicious and at that point my priority was to point out those suspicions to the HN community.
Pull requests welcome!
And since it wasn't directed toward me, I guess we all can forget my little rant regarding the "trashing" comment.
If you like it so much, here's a copy-paste from the project for your edification [1]:
def new_tags=(tags_string)
tags_string.gsub! /[^a-zA-Z0-9, ]/, ''
tags = tags_string.split ','
tags.collect! {|c| (c.match(/^\w+\s\w+/) || c.match(/^\w+/)).to_s }
@new_tag_strings = tags
end
I don't mean to pick on this project in particular. In fact, this project as a whole is quite possibly the cleanest Ruby code I've ever seen.That being said, Ruby's syntax makes me want to gouge my eyes out. There's equal signs, unquoted regular expressions, exclamation points, absolute value bars, and at signs all over the above code. You can't even sort-of follow what this code is doing without searching through the manual every third character. Ruby syntax is worse than C++ and almost as bad as Perl.
Someone tried to explain Ruby syntax to me last week [2], and I'm not sure if I understood it more, or less, as a result, because my conclusion was that Ruby's syntax is so bad, the language shouldn't even be able to exist! I.e., there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible!
[1] https://github.com/kyledrake/neocities-web/blob/933c3549264e...
I fail to see how using equal signs for assignment (or for defining assignment methods) is a problem with syntax, rather than an enhancement to clarity.
> unquoted regular expressions
What's wrong with that? Regexes are a different type than strings. Why should they look like strings?
> exclamation points
...again, so, what?
> absolute value bars
vertical bars used to set off block argument lists aren't absolute value bars. (Neither are vertical bars used for logical-or.)
> at signs
Again, so?
> You can't even sort-of follow what this code is doing without searching through the manual every third character.
Yes, I can, and not just "sort-of follow" it.
> Ruby syntax is worse than C++ and almost as bad as Perl.
There's no accounting for taste, I suppose.
> there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible
As Ruby does exist, and is parsed, this is clearly not the case. That said, ruby's syntax is not optimized for machine parsing, its designed to be ruby-developer-friendly rather than ruby-parser-developer-friendly.
If you want something optimized for the developer of the language's parser, look to Lisp.
Oh, the inability to parse Ruby shouldn't be held against it. It has (at the least) a context-sensitive grammar. So do lots of languages, including HTML and perl.
Not being able to parse it doesn't really mean what you think it means. It just means that in order to figure out what it does programmatically, you have to evaluate it. Its unparseability makes certain things impossible, like writing a perfect syntax highlighter. Also makes building certain tools you'd normally see in an IDE difficult.
// Parse tags string.
// Example:
// "tag1, tag2" => {"tag1", "tag2"}
// "tag1, very long tag" => {"tag1", "very long"}
string[] NewTags(string tags_string)
{
//Allow only letters, numbers and spaces in tag.
tags_string = new string(tags_string.Where(c => char.IsLetter(c)
|| char.IsNumber(c) || c == ' ' || c == ',').ToArray());
//Separate multiple tags with commas.
string[] tags = tags_string.Split(',').Select(s => s.Trim()).ToArray();
//Two word per tag maximum (extra words in a tag will be removed).
for (int i = 0; i < tags.Length; i++)
{
List<string> validWords = new List<string>();
string[] wordsInTag = tags[i].Split(' ');
if (wordsInTag.Length > 2)
{
tags[i] = wordsInTag[0] + " " + wordsInTag[1];
}
}
return tags;
}That said, I do really enjoy reading this code. It's indeed very, very clean!
1. How blocks work, and how their minimalist syntax is beautiful. You see absolute value bars but believe me, getting used to that barebones function syntax is a gift. (No other programming language that I know of has an absolute value operator with vertical bars so it is not as hard as you think.)
2. Every time you see a dot, do NOT think attribute access. Think message sending a la Smalltalk.
Suddenly then, things like the tags.collect! line become pretty for encapsulating a callback on one line unlike the ugly function() {} crud of JavaScript, and things like defining a newtags= method become sensible, because everything including traditional attribute getting and setting reduces to message passing.
Huh. You just rekindled my interest in learning Ruby. Learning Smalltalk was pretty mind-expanding.
Keep in mind that while your protest does sound intuitive - e.g. that Ruby can be syntactically ambiguous, ergo it is unparseable, it turns out that that doesn't stop us from writing a parser. We can parse most things even if we can't parse the "general case." When we DO encounter something unparseable, the compiler can a) guess or b) fail, hopefully with a message that will help us investigate and rectify the failure.
You point out that Perl's syntax may be worse than Ruby's, and I assume that implies that it is more syntactically ambiguous, ergo, writing a parser should also be impossible for Perl. It turns out that Perl is provably unparseable in the general case - in fact, it's been done rather rigorously: http://www.jeffreykegler.com/Home/perl-and-undecidability
Regardless of Perl's general unparseability, we have compilers for Perl and even large projects manage to compile to what appear to be functional executables. The same is true for Ruby.
I wrote this comment mostly a reminder that while something may appear to be insoluble, we may be able to solve for sufficient cases that we don't care about the rest, particularly if we have an oracle to fix the number of cases that we can't solve. (In this case, the oracle is the developer.)
Now it looks like something happened, and you've got no site, and thousands of people trying to access it!
Cheers to you, fine folks!
It's a static web site hosting, exactly what "security holes" could we be talking about? Not theoretical holes, that you could technically exploit on the 45th blue moon of the century, things that might actually happen.
I can understand why the developer viewed you as 'trashing' his work, you claimed it as a phishing expedition. That'd make the best of us upset. I see you've sorted it out between you which is great, and I hope others look at this exchange and get some good takeaway from it.
Guaranteed not.
I don't mean for you in particular, security requires constant vigilance.
Not to nit-pick, but it's never the last security-related bug :)
It indeed goes without saying, since you don't mention this on the site.
(I'm not just being snarky, I have run a freenet out of pocket for sixteen years because people's urls and email addresses are important to not lose.)
Check out my all-new website showing some oldskool JScripting skillz at http://cd.neocities.org/. You can trick your friends by directing them there.
P.S.: Just checked and it actually works with Internet Exploder 6.0 in an M$ Windoze 98 VM, which I had running in VMWare Player 5.0.2 with my PC's physical DVD drive connected. Should work as long as your Win9x or pre-SP2 XP has WMP 7 installed.
P.P.S.: Do post here if it works for you!
Yeesh.
The legal questions are interesting, through it highly depend on the country and political tendencies from one year to the next. In theory, I could run this kind of service in Sweden, and only remove content on order by a judge. In theory. In practice, there might not be any difference between hosting user generated content and simply having a website up hosting in ones own name.
Give the guy a break and a chance to get the project off the ground.
http://jstalin.neocities.org/index.html
It's going to play audio if you clink the link, unless you're using click to play
I think his service is kinda cool in a twisted way and I can totally see me building a little 'old school' homepage on it.
/edit: I did build a homepage: http://kybernetyk.neocities.org I feel better now ;)
Here's mine (NSFW-ish): http://nl.neocities.org
Unfortunately they forgot center tags and to capitalize all of their HTML. I was going to say it's missing a table-based layout, but then I recalled that the height of geocities' popularity was earlier than I remember seeing table-based layouts everywhere.
It's really not very assuring when they state on the front page that they "hope" they can get enough money each month so they can pay the server bills.
It's all understandable. But even if it's free and even if my content is stupid, I'd still feel a little uncomfortable because of how much doubt the owner expresses over the viability of the service.
I have a lot of experience scaling web applications, I've been doing this for over 14 years. I should probably highlight that somewhere.
I've already gotten enough donations today to run the server as-is for 8 months! I also found a sweet deal with a reliable dedicated provider via a tip that will cost substantially less than my intial estimates.
That said, I don't care if people use it for Geocities parodies. I think Geocities sites are a lot more interesting than the bland, drab Facebook profile layout that everybody is forced into with no ability to change in any meaningful way.
Set your username and password at the beginning of the script and run it with the path to the directory as an argument:
./neocities-uploader.php /path/to/my/site
kyledrake if any negativity on this thread gets to you, something tells me it will not, just ask yourself how many others have posted their side project on HN that made it to #1, I know I have not and that is why I created this account to begin with - to share my start-up with a start-up community.
And if they add a premium tier... well then that kind of kills their differentiation, doesn't it? They're aiming for the niche of free, modest, simple, laissez faire vis-a-vis content. When you take 'free' out of the mix then you're in the arena of commoditized cheap hosting; inertia would be the only reason for someone to upgrade their free account to a premium plan.
Already worth the price of admission. This is a really fun idea.
"Security page. Please enter your password here."
Here is an updated version.
Next, enter a password. This will be used to allow you to login. Minimum 5 characters. If you don't make it a good password, Dade Murphy from the movie Hackers will come in and steal your "garbage files".Recaptcha might not be enough in the long run, but it will be enough in the short run.
I love getting old and seeing technology continually reinvent itself.
I really like this and I'll probably use it for something real.
Good luck with that.
Oh well.
Here's mine : http://eksith.neocities.org (Also people are forgetting, it's .org not .com)
http://scientists.neocities.com/ (Back to the Future)
I've had issues uploading CSS, JS and manifest (for offline) files - anyone else?
What about '<>/{};:[]=+~' ?
All of which are useful in html/css
<a href="http://meowcat.neocities.org/index.html"
target="_blank">View <br></a>
Unfortunately, this means that I cannot click with the middle mouse button to bring up the page in a new tab. Please remove the extraneous target="_blank" code.I hope we will soon see these pathetic Facebook like buttons replaced with good old JavaScript guest counters (only half-joking).
You may be interested to learn about non-profits organizations, many of which have donations as their primary source of income.
Man i hate that -.-
Edit
Found them. Check out mah page.
No censorship means no censorship.
It doesn't mean the provider of neocities couldn't be ordered to remove the illegal content and hand over all details about the person who uploaded it.
"No censorship" doesn't mean criminals will be protected by neocities. It doesn't mean that child abuse images can't be dealt with in accordance with the law.
Remember that the internet is not classified like movies and TV. There is no requirement to put "Rated R18+" on a website. As it should be.
All he is saying is that Neocities basically has the same censorship rules as the internet itself. In other words, no censorship.
A murderer can turn their PC into a server and self-publish images of his victims for all to see. They will get caught, and the server shut down, but the point is he didn't need to go through a censorship body to get the images published. Exactly how it should be.
edit: ps: internal server error
Does that mean he's running 61k sites on a single server? Even if each site gets one single visitor per day, that 61k visitors for the Server. There is no way the server can manage that traffic.
Sorry, but do you really want a static site? Just pay for a good one.
Even with uneven traffic that's probably 4-5 pageviews/second at most. The cheapest linode or AWS instance can handle that for serving static files.
Assuming text pages, the full 61k sites could be accessed every 15 seconds. If the pages have nontrivial graphics, then you're (as others have mentioned) far more likely to be bandwidth-limited. If the site has an unmetered 10Mbps connection, then it could serve 1Mbyte per second: If each of those 61k pages contained 1MB of data, then it would STILL be able to serve (at most) 86k pages per day.
It's likely that most of the pages hosted will be accessed less than once a day, though. Power law distribution of the long tail [1] and all that. And a megabyte is a lot of data for a single web page; I would imagine that with a 10Mb limit on the entire site, it's not going to be a place to host sites with tons of images.
Quick, sign up right now or you'll miss out!
Get it?
its static pages.