cli - Dave's Blog


Retweet of ClickHole

17 hours ago
Amazing! How many times can @neiltyson win the internet?

Retweet of SavedYouAClick

Nov 10, 10:19
Blah Blah Blah And Some People On Twitter Are Mad About It

Tweet from David_Risney

Oct 12, 9:31
Auto generating clickbait articles via neural network: …. And the result: 

workjuice: Such whimsy! Video of the “Captain Laserbeam”...

Sep 17, 3:02


Such whimsy! Video of the “Captain Laserbeam” segment of our April Fool’s Funaround is up; just click this sentence!
Starring Paul F. Tompkins​, John Hodgman​, Michael McMillian​, Lauren Lapkus​, Marc Evan Jackson​, Ben Schwartz​, Felicia Day​, Hal Lublin​, Annie Savage, Craig Cackowski, Busy Philipps​, and more!

Tickets are still on sale for our Improv show and other shows in NY in October. Get ‘em here.


Tweet from David_Risney

Aug 23, 8:12
Got TAH Concert Film bday gift! Sparks musical ep, visual CLINK & more. So much awesome!  @ThrillingAdv

Tweet from David_Risney

Aug 18, 10:23
RL point & click adv game via Twitter gets man out of hole. Use shirt on dog. Use dog on umbrella. Use leash on shirt …

Retweet of grittygrease

Jul 2, 9:53
TLS Client Puzzles Extension 

Retweet of ChromiumDev

Apr 14, 7:29
Now in Chrome 43, document.execCommand() gives you programmatic access to copy and cut content to the clipboard! …

Tweet from David_Risney

Feb 3, 3:37
After visiting a page then immediately wanting to take back my page view and associated ad revenue: REGRET http://clicbait HTTP/1.1 ...

Retweet of ClickHole

Jan 27, 7:47
This Will Change The Way You Watch ‘Fight Club’  #NSFW

lunarcicadas: when did monsters that live under your bed start writing clickbait articles

Jan 17, 4:05
Yandere Boyfriend LC @lunarcicadas :
when did monsters that live under your bed start writing clickbait articles

sharkfucker96: when did monsters that live under your bed start writing clickbait articles

Jan 17, 4:05
Yandere Boyfriend LC @sharkfucker96 :
when did monsters that live under your bed start writing clickbait articles

From Inside Edward Snowden’s Life as a Robot: Wizner had...

2014 Jun 23, 7:04

From Inside Edward Snowden’s Life as a Robot:

Wizner had to jump on a phone call during a meeting with his whistleblower client. When he got off the phone, he found that Snowden had rolled the bot into civil liberties lawyer Jameel Jaffer’s office and was discussing the 702 provision of the Foreign Intelligence Surveillance Act. “It was kind of cool,” Wizner says.

It is neat but they’re marketing video is at times strangely terrifying. Put different music on when the Susan-bot comes up behind the unknowing Mark and this could be a horror movie trailer.

PermalinkCommentsedward-snowden beam robot telepresence

The decline of the mobile web...

2014 Apr 8, 6:49

The decline of the mobile web

PermalinkCommentstechnical web browser mobile phone

FitBit and WebOC Application Compatibility Errors

2013 Aug 29, 7:17
I just got a FitBit One from my wife. Unfortunately I had issues running their app on my Windows 8.1 Preview machine. But I recognized the errors as IE compatibility issues, for instance an IE dialog popup from the FitBit app telling me about an error in the app's JavaScript. Given my previous post on WebOC versioning you may guess what I tried next. I went into the registry and tried out different browser mode and document mode versions until I got the FitBit software running without error. Ultimately I found the following registry value to work well ('FitBit connect.exe' set to DWORD decimal 8888).
Windows Registry Editor Version 5.00

"Fitbit Connect.exe"=dword:000022b8

For those familiar with the Windows registry the above should be enough. For those not familiar, copy and paste the above into notepad, save as a file named "fitbit.reg", and then double click the reg file and say 'Yes' to the prompt. Hopefully in the final release of Windows 8.1 this won't be an issue.

Shout Text Windows 8 App Development Notes

2013 Jun 27, 1:00

My first app for Windows 8 was Shout Text. You type into Shout Text, and your text is scaled up as large as possible while still fitting on the screen, as you type. It is the closest thing to a Hello World app as you'll find on the Windows Store that doesn't contain that phrase (by default) and I approached it as the simplest app I could make to learn about Windows modern app development and Windows Store app submission.

I rely on WinJS's default layout to use CSS transforms to scale up the user's text as they type. And they are typing into a simple content editable div.

The app was too simple for me to even consider using ads or charging for it which I learned more about in future apps.

The first interesting issue I ran into was that copying from and then pasting into the content editable div resulted in duplicates of the containing div with copied CSS appearing recursively inside of the content editable div. To fix this I had to catch the paste operation and remove the HTML data from the clipboard to ensure only the plain text data is pasted:

        function onPaste() {
var text;

if (window.clipboardData) {
text = window.clipboardData.getData("Text").toString();
window.clipboardData.setData("Text", util.normalizeContentEditableText(text));
shoutText.addEventListener("beforepaste", function () { return false; }, false);
shoutText.addEventListener("paste", onPaste, false);

I additionally found an issue in IE in which applying a CSS transform to a content editable div that has focus doesn't move the screen position of the user input caret - the text is scaled up or down but the caret remains the same size and in the same place on the screen. To fix this I made the following hack to reapply the current cursor position and text selection which resets the screen position of the user input caret.

        function resetCaret() {
setTimeout(function () {
var cursorPos = document.selection.createRange().duplicate();;
}, 200);

shoutText.attachEvent("onresize", function () { resetCaret(); }, true);
PermalinkCommentsdevelopment html javascript shout-text technical windows windows-store

Ben Goldacre’s TED talk on publication bias, drug...

2012 Sep 28, 3:55

drug companies hiding the results of clinical trials.

(via I did a new talk at TED, on drug companies and hidden data.)

PermalinkCommentsscience video ted

Stripe CTF - Level 7

2012 Sep 13, 5:00

Level 7 of the Stripe CTF involved running a length extension attack on the level 7 server's custom crypto code.


def logs(id):
rows = get_logs(id)
return render_template('logs.html', logs=rows)


def verify_signature(user_id, sig, raw_params):
# get secret token for user_id
row = g.db.select_one('users', {'id': user_id})
except db.NotFound:
raise BadSignature('no such user_id')
secret = str(row['secret'])

h = hashlib.sha1()
h.update(secret + raw_params)
print 'computed signature', h.hexdigest(), 'for body', repr(raw_params)
if h.hexdigest() != sig:
raise BadSignature('signature does not match')
return True


The level 7 web app is a web API in which clients submit signed RESTful requests and some actions are restricted to particular clients. The goal is to view the response to one of the restricted actions. The first issue is that there is a logs path to display the previous requests for a user and although the logs path requires the client to be authenticatd, it doesn't restrict the logs you view to be for the user for which you are authenticated. So you can manually change the number in the '/logs/[#]' to '/logs/1' to view the logs for the user ID 1 who can make restricted requests. The level 7 web app can be exploited with replay attacks but you won't find in the logs any of the restricted requests we need to run for our goal. And we can't just modify the requests because they are signed.

However they are signed using their own custom signing code which can be exploited by a length extension attack. All Merkle–Damgård hash algorithms (which includes MD5, and SHA) have the property that if you hash data of the form (secret + data) where data is known and the length but not content of secret is known you can construct the hash for a new message (secret + data + padding + newdata) where newdata is whatever you like and padding is determined using newdata, data, and the length of secret. You can find a script on VNSecurity blog that will tell you the new hash and padding per the above. With that I produced my new restricted request based on another user's previous request. The original request was the following.

The new request with padding and my new content was the following.
My new data in the new request is able to overwrite the waffle parameter because their parser fills in a map without checking if the parameter existed previously.


Code review red flags included custom crypto looking code. However I am not a crypto expert and it was difficult for me to find the solution to this level.

PermalinkCommentshash internet length-extension security sha1 stripe-ctf technical web

Why Your Links Should Never Say “Click Here” - UX Movement

2012 Jun 25, 1:06

I’ve been following this advice for many years now to the extent that I find myself rewriting text to make linking my nouns easier and shorter.

The one I wasn’t following that seems obvious only after I read it is to keep links towards the end of your text to allow users to follow the link once they’re done reading.

links at the end of the sentence allow users to take action faster

PermalinkCommentsweb technical ux html

A New HTTP Status Code for Legally-restricted Resources

2012 Jun 11, 2:00

451 Unavailable for Legal Reasons: The 451 status code is optional; clients cannot rely upon its use. It is imaginable that certain legal authorities may wish to avoid transparency, and not only forbid access to certain resources, but also disclosure that the restriction exists.

That was fast.

PermalinkCommentshttp internet web 451 law legal rfc ietf censorship technical
Older Entries Creative Commons License Some rights reserved.