next »

[nutballs]

i wasnt tired. was entering weights into a new product catalog.

[thedarkness]

i wasnt tired. was entering weights into a new product catalog.

weights?

[nutballs]

ya, i am launching a new online store, and i needed to enter the weights of the products for realtime UPS calcs. Stoopid dropshipper doesnt have the weights in an easy to deal with file. i tried a few tricks, but gave up and manually entered it all. only a few hundred products, so no biggy, just mind numbing.

[thedarkness]

ya, i am launching a new online store, and i needed to enter the weights of the products for realtime UPS calcs. Stoopid dropshipper doesnt have the weights in an easy to deal with file. i tried a few tricks, but gave up and manually entered it all. only a few hundred products, so no biggy, just mind numbing.

lol, I can relate dude. Some people have no idea about keeping data clean and useable.

Cheers,
td

[nop_90]

I thought about opening an online store.

but then i might have to leave the house to actually buy a product ....
then i would have to like pay for hosting or some crap like that ...
I also probably would have to actually make a website ....

shit i am all tired just thinking about that.

[nutballs]

so I am gonna start monkeying with this idea now.

I have had some thoughts about usages as well. Although im sure you guys can guess my primary usage for this, which would be traffic direction in my BH network, I actually have a legitimate use for this, that i think could be interesting.

Every social bookmarking site out there has a problem, and that problem is spammers. So they add in Captchas, which can be broken, they add in codes into the URL which also can be broken, and a host of other things.

I run two social bookmarking sites, lower end, and they dont make any money because that wasnt the purpose in them. But now, I am wondering if i jumped into the game, with a good design, and simplify my concept down to the most basic level, would i get a userbase.
The biggest things with SBM sites are:
adding the bookmark easily. done
mark as spam. done
mark as good. done
personalizing bookmarks, like titles and such. done.
Ranking Algo. done.
way to prevent spammers from using your site for evil. not done.

So here is the thought. that last part of preventing spammers is the biggest hurdle for any user generated content site. Captchas are annoying, and can be busted if the target is worth the effort. everyone hates them. so what if you could determine "friend or foe" without any captcha. without any interaction with the user?

you could technically do this with usage analysis. but that means the user would have to be around for a while before you trust him. so thats no good for a new user anxious to try out this cool new SBM site.

So... what if you used the browser to your advantage. The idea of how a browser works is what has already been said, but i will reiterate. the browser requests a page, parses it, requests images to be downloaded that the page requires, sets cookies if that site asked for them in the headers, and then run any JS on the page. If that JS is ajax, it then continues with communication if required. This all happens in seconds.

all bots currently work under the principle of download the page, come back later for the extras.
so have the page do the following:
request an image, which is actually a routine on the server.
that image sets a cookie.
the page itself sets a cookie from serverside.
and a cookie is set via JS
JS in the page makes a request via ajax which then tests for the cookies which have some kind of key pair in them.

so if a bot, then none of those things will happen at the same time.
if user with a browser, they should all happen in the same basic timeframe.

The way I understand all of this to work is that all the communication for this can be sniffed with even the most basic of header analyzer. would HTTPS eliminate that problem? or is there a way to hide whats going on? im guessing not, since all traffic across the wire would be able to be sniffed. So the spammer would now know that, we set three cookies, and make 2 requests out, 1 to a fake GIF and one to an ajax request.

basically, i am wondering if there is a way to pull this off, with enough back and forthing between the client and server, to make it very difficult to crack.

like page loads, js requests image, image sets cookie, js reads cookie, js sends code back to server, assuming code matches, server replies with routine to allow redirect, redirect is requested, etc etc etc.

thoughts?

[nop_90]

The way I understand all of this to work is that all the communication for this can be sniffed with even the most basic of header analyzer. would HTTPS eliminate that problem? or is there a way to hide whats going on? im guessing not, since all traffic across the wire would be able to be sniffed. So the spammer would now know that, we set three cookies, and make 2 requests out, 1 to a fake GIF and one to an ajax request.

basically, i am wondering if there is a way to pull this off, with enough back and forthing between the client and server, to make it very difficult to crack.

Simple answer no.
I am getting lazy and writing curl code is getting boring. I am thinking how i could run multiple browsers which have greasemonkey installed on them and control them from a program of some sort . That way I will not have to worry about stupid ajax shit etc

Since the user controls 1/2 of the equation, and it is his playground he can do anything he wants.
Saying that i think ur scheme good one. It will eliminate quite a few of the spammer.

I am pondering if u somehow could take the info from the sites users mark as spam and use it to train a spam detector,
(kinda like they do with email spam ?).

[thedarkness]

I start with sockets, if I can tell that's not going to work I escalate to HTTP_Request/HTTP_Client/curl, if that won't cut it I escalate to automating a browser using mozilla's control object (Firefox) or shdocvw/webbroser object on the Micro$oft side. By the time I get there I'm virtually indistinguishable from a human user (I can add sleeps, etc.).

I think if someone really wants in it's pretty much a foregone conclusion they're gonna get there eventually. Your way will indeed make it hard for the masses as Nop mentioned but it won't be 100% unless you tell us all what the url is and ask us nicely to stay away  

Cheers,
td

[perkiset]

Hey NBs -

Do you remember the post @ Syndk8 a bit ago that contained VERY SCARY code that Zwart and I decompiled a bit? The asshole that wrote that had something entirely different in mind, but the point was that he sent code down to the client box that was only decipherable and executable by the code sent down to it... we couldn't even mimic the code sent, because it was sort of a "one-way cipher" kind of thing. Just a gear turner.

The fact of the matter is that you are correct: if IE can run it, it can be figgerd out. Two issues: do you want the code obscurred, or do you want the packets unsniffable? You can apply both techniques, but at the end of the day, if IE can run it, eventually so could I.

So realistically, this is a game of "good enough" not "perfect." Honestly, my experience with most of our adversaries is that they are *considerably* less capable than you or I. A bit of obsfucation, perhaps a lightly encrypted or munged packet and the vast majority of spamming techniques will be rendered impotent. What you have described above is *so far beyond* the vast vast vast majority of who you will be playing with it's not even funny. Add a timed technique, like a requirement that the packet is called within 2 seconds of dispatch and then it expires on your side and you're gonna be looking good.

Looking forward to playing with this my friend 

/p