L1[17:11:27] ⇨
Joins: Neo (~neo@vps-9c69ad6a.vps.ovh.ca)
L2[17:11:37] *** Server sets mode: +ntz
L3[17:13:19] ⇨
Joins: Neo (~neo@vps-9c69ad6a.vps.ovh.ca)
L4[17:13:29] *** Server sets mode: +ntz
L5[17:13:39] <Michiyo> ffs
L6[17:37:48] <gruetzkopf> shall i throw a
sql query against my quasselcores postgresql?
L7[17:41:23] 
<Forecaster> Invert the polarity of the
positron shield!
<Forecaster> Invert the polarity of the
positron shield!L8[17:47:08] <techtastic> @walksanator also, make sure
any input text is sanitized so theres no opening for an SQL
Injection Attack
<techtastic> @walksanator also, make sure
any input text is sanitized so theres no opening for an SQL
Injection AttackL9[17:48:45] <Forecaster> That's no fun
<Forecaster> That's no funL10[17:52:17] <techtastic> this is ment to interact with
a playerbase who its playing a programming magic mod and is ment to
be a cross-world/server storage system for their stuff
<techtastic> this is ment to interact with
a playerbase who its playing a programming magic mod and is ment to
be a cross-world/server storage system for their stuffL11[17:52:18] <techtastic> theres bound to be a few
apples bad enough and knowledgeable enough
<techtastic> theres bound to be a few
apples bad enough and knowledgeable enoughL12[17:56:31] <walksanator> >techtastic:
<@596098777941540883> also, make sure any input text is
sanitized so theres no…
<walksanator> >techtastic:
<@596098777941540883> also, make sure any input text is
sanitized so theres no…L13[17:56:31] <walksanator> I am using a library
<walksanator> I am using a libraryL14[17:56:34] <walksanator> I trust it to sanatize
<walksanator> I trust it to sanatizeL15[17:56:53] <walksanator> hooked up a random iota
generator
<walksanator> hooked up a random iota
generatorL16[17:57:01] <walksanator> (and made a sanatizer for
iotas)
<walksanator> (and made a sanatizer for
iotas)L18[17:58:02] <walksanator> so now all that is left is
to hook up the Flatbuffer transport
<walksanator> so now all that is left is
to hook up the Flatbuffer transportL19[17:58:13] <walksanator> which I also revamped that
since last time
<walksanator> which I also revamped that
since last timeL20[18:00:11] <walksanator> here is my
"""well designed""" sanatizer
<walksanator> here is my
"""well designed""" sanatizerL21[18:00:11] <walksanator> https://github.com/walksanatora/HexOvermindServer/blob/main/src/bin/main.rs#L81-L158
<walksanator> https://github.com/walksanatora/HexOvermindServer/blob/main/src/bin/main.rs#L81-L158L22[18:00:25] <walksanator> (all the sanatizer does is
punt entity iotas
<walksanator> (all the sanatizer does is
punt entity iotasL23[18:00:36] <walksanator> cross-server item transfer
is not coming in this update
<walksanator> cross-server item transfer
is not coming in this updateL24[18:00:39] <walksanator> duh
<walksanator> duhL25[18:09:39] <techtastic> >walksanator: I trust it
to sanatize
<techtastic> >walksanator: I trust it
to sanatizeL26[18:09:39] <techtastic> never just trust it,
verify
<techtastic> never just trust it,
verifyL27[18:12:35] <walksanator> > In SQL, queries can be
separated into prepared (parameterized) or unprepared (simple).
Prepared queries have their query plan cached, use a binary mode of
communication (lower bandwidth and faster decoding), and utilize
parameters to avoid SQL injection. Unprepared queries are simple
and intended only for use case where a prepared statement will not
work, such as various database commands (e.g., PRAGMA or SET or
BEGIN).
<walksanator> > In SQL, queries can be
separated into prepared (parameterized) or unprepared (simple).
Prepared queries have their query plan cached, use a binary mode of
communication (lower bandwidth and faster decoding), and utilize
parameters to avoid SQL injection. Unprepared queries are simple
and intended only for use case where a prepared statement will not
work, such as various database commands (e.g., PRAGMA or SET or
BEGIN).L28[18:12:38] <walksanator> it protects
<walksanator> it protectsL29[18:12:59] <walksanator> and after all if `6,131,690`
downloads
<walksanator> and after all if `6,131,690`
downloadsL30[18:13:05] <walksanator> it has to be decently
secure
<walksanator> it has to be decently
secureL31[18:14:30] <Sky>
>walksanator: cross-server item transfer is not coming in this
update
<Sky>
>walksanator: cross-server item transfer is not coming in this
updateL32[18:14:30] <Sky> what
do you mean I cant move items from my creative singleplayer world
to my survival multiplayer server?
<Sky> what
do you mean I cant move items from my creative singleplayer world
to my survival multiplayer server?L33[18:14:37] <walksanator> >Sky: what do you mean I
cant move items from my creative singleplayer world to my s…
<walksanator> >Sky: what do you mean I
cant move items from my creative singleplayer world to my s…L34[18:14:38] <walksanator> not yet
<walksanator> not yetL35[18:14:43] <walksanator> also it will be *very*
expensive
<walksanator> also it will be *very*
expensiveL36[18:14:44] <walksanator> and checked
<walksanator> and checkedL37[18:15:38] <walksanator> like not only do you
allready have to build the multiblock (using some hard to
make/expensive amethyst buds and slipways)
<walksanator> like not only do you
allready have to build the multiblock (using some hard to
make/expensive amethyst buds and slipways)L38[18:15:59] <Sky> ok
lets say it costs like 10 nether stars per item stack
<Sky> ok
lets say it costs like 10 nether stars per item stackL39[18:16:00] <Sky> i can
go build a wicked efficient nether star farm, and then I can start
moving lots of items from singleplayer to multiplayer?
<Sky> i can
go build a wicked efficient nether star farm, and then I can start
moving lots of items from singleplayer to multiplayer?L40[18:16:20] <walksanator> I am considering something
like `(nbt_size/16)*stack size`
<walksanator> I am considering something
like `(nbt_size/16)*stack size`L41[18:16:32] <walksanator> >Sky: ok lets say it
costs like 10 nether stars per item stack
<walksanator> >Sky: ok lets say it
costs like 10 nether stars per item stackL42[18:16:32] <walksanator> i can go build a wick…
<walksanator> i can go build a wick…L43[18:16:33] <walksanator> more items are less
effective
<walksanator> more items are less
effectiveL44[18:16:38] <walksanator> after 1k it becomes
90%
<walksanator> after 1k it becomes
90%L45[18:16:45] <walksanator> and ever other 0 reduces
that by another 5%
<walksanator> and ever other 0 reduces
that by another 5%L46[18:16:47] <Sky> build
a new item machine
<Sky> build
a new item machineL47[18:16:52] <walksanator> so 10k 85%
<walksanator> so 10k 85%L48[18:17:01] <walksanator> >Sky: build a new item
machine
<walksanator> >Sky: build a new item
machineL49[18:17:01] <walksanator> correct you have to
diversify
<walksanator> correct you have to
diversifyL50[18:17:03] <Sky> and
what is the % here? % of items moved?
<Sky> and
what is the % here? % of items moved?L51[18:17:13] <walksanator> >Sky: and what is the %
here? % of items moved?
<walksanator> >Sky: and what is the %
here? % of items moved?L52[18:17:13] <walksanator> points cost
<walksanator> points costL53[18:17:19] <Sky> how
do you make points?
<Sky> how
do you make points?L54[18:17:21] <walksanator> yet thats right I am making
a EMC system
<walksanator> yet thats right I am making
a EMC systemL55[18:17:29] <walksanator> >Sky: how do you make
points?
<walksanator> >Sky: how do you make
points?L56[18:17:29] <walksanator> having items in your mote
nexus
<walksanator> having items in your mote
nexusL57[18:17:34] <walksanator> more "complex"
items = more points
<walksanator> more "complex"
items = more pointsL58[18:17:40] <Sky> that
would be nice if I knew what a mote nexus is
<Sky> that
would be nice if I knew what a mote nexus isL59[18:17:40] <walksanator> it pulls randomly
<walksanator> it pulls randomlyL60[18:17:43] <walksanator> like risk of rain 2
<walksanator> like risk of rain 2L61[18:18:02] <Sky> I can
have my M/E system autocraft hundreds of super complex items, can't
I?
<Sky> I can
have my M/E system autocraft hundreds of super complex items, can't
I?L62[18:18:03] <walksanator> >Sky: that would be nice
if I knew what a mote nexus is
<walksanator> >Sky: that would be nice
if I knew what a mote nexus isL63[18:18:03] <walksanator> "infinite" storage
of 1023 items
<walksanator> "infinite" storage
of 1023 itemsL64[18:18:11] <Sky>
ah
<Sky>
ahL65[18:18:12] <walksanator> that can only be accessed by
hexcasting
<walksanator> that can only be accessed by
hexcastingL66[18:18:34] <walksanator> so if you figure out how to
ME export into it 👏 although *tbh*
<walksanator> so if you figure out how to
ME export into it 👏 although *tbh*L67[18:18:34] <walksanator> if you have done that
<walksanator> if you have done thatL68[18:18:41] <walksanator> *what would you even need to
import anymore*
<walksanator> *what would you even need to
import anymore*L69[18:18:56] <Sky>
creative mode only items :P
<Sky>
creative mode only items :PL70[18:19:07] <Sky> like
wouldnt i be able to send over a creative energy cube from
mekanism?
<Sky> like
wouldnt i be able to send over a creative energy cube from
mekanism?L71[18:19:12] <walksanator> banned
<walksanator> bannedL72[18:19:12] <Sky>
creative mana pools?
<Sky>
creative mana pools?L73[18:19:14] <walksanator> by default
<walksanator> by defaultL74[18:19:17] <Sky> oh,
theres a banlist
<Sky> oh,
theres a banlistL75[18:19:19] <walksanator> get deleted when
recieved
<walksanator> get deleted when
recievedL76[18:19:20] <walksanator> yep
<walksanator> yepL77[18:19:30] <Sky> time
to make my own mod that implements these, and make it closed source
:)
<Sky> time
to make my own mod that implements these, and make it closed source
:)L78[18:19:31] <walksanator> tag and itemid bans are
avaliable for config
<walksanator> tag and itemid bans are
avaliable for configL79[18:19:42] <walksanator> >Sky: time to make my own
mod that implements these, and make it closed source :)
<walksanator> >Sky: time to make my own
mod that implements these, and make it closed source :)L80[18:19:42] <walksanator> then it wont show up
<walksanator> then it wont show upL81[18:19:45] <walksanator> since to import a item
<walksanator> since to import a itemL82[18:19:51] <walksanator> it has to be on the
recieveing server
<walksanator> it has to be on the
recieveing serverL83[18:19:59] <walksanator> otherwise it becomes
"generic media mass"
<walksanator> otherwise it becomes
"generic media mass"L84[18:20:03] <Sky>
hm
<Sky>
hmL85[18:20:08] <walksanator> and also this is handled
*mc* server side
<walksanator> and also this is handled
*mc* server sideL86[18:20:09] <Sky>
theres definitely a way to abuse this
<Sky>
theres definitely a way to abuse thisL87[18:20:23] <walksanator> the only thing the rust
server does rn is filter out truename iotas
<walksanator> the only thing the rust
server does rn is filter out truename iotasL88[18:20:32] <walksanator> oh yeah thats a given
<walksanator> oh yeah thats a givenL89[18:21:04] <walksanator> anyways heres the db
schema
<walksanator> anyways heres the db
schemaL90[18:21:04] <walksanator> ```
<walksanator> ```L91[18:21:05] <walksanator> CREATE TABLE IF NOT EXISTS
`HexDataStorageCode Block pastebined null
<walksanator> CREATE TABLE IF NOT EXISTS
`HexDataStorageCode Block pastebined nullL92[18:21:24] <techtastic> id still verify, just because
it has 6mil downloads doesnt mean its not broken ,just that it was
used 6 mil times
<techtastic> id still verify, just because
it has 6mil downloads doesnt mean its not broken ,just that it was
used 6 mil timesL93[18:21:56] <walksanator> I will check github for open
issues
<walksanator> I will check github for open
issuesL94[18:22:01] <walksanator> actually wait this would be
a vuln
<walksanator> actually wait this would be
a vulnL95[18:22:05] <walksanator> and only disclosed to the
devs
<walksanator> and only disclosed to the
devsL96[18:22:09] <techtastic> Optifine has possible
millions of downloads despite breaking every other mod
<techtastic> Optifine has possible
millions of downloads despite breaking every other modL97[18:22:28] <walksanator> yes but that wont exploit
your DB
<walksanator> yes but that wont exploit
your DBL98[18:22:33] <walksanator> also optifine isn't open
source
<walksanator> also optifine isn't open
sourceL99[18:23:00] <techtastic> still, verify, try to attack
your own DB within the game using your system
<techtastic> still, verify, try to attack
your own DB within the game using your systemL100[18:23:36] <walksanator> the only attack vector I can
see are Pattern or Data
<walksanator> the only attack vector I can
see are Pattern or DataL101[18:23:50] <walksanator> Pattern is out since it is
filtered to only be `qweasd` any others are filtered
<walksanator> Pattern is out since it is
filtered to only be `qweasd` any others are filteredL102[18:23:54] <walksanator> for Data I will check if it
is valid NBT
<walksanator> for Data I will check if it
is valid NBTL103[18:24:28] <techtastic> just because you cant see it,
doesnt mean an attack vector doesnt exist outside your field of
view
<techtastic> just because you cant see it,
doesnt mean an attack vector doesnt exist outside your field of
viewL104[18:24:35] <walksanator> give me a sql attack
<walksanator> give me a sql attackL105[18:24:39] <walksanator> just a string
<walksanator> just a stringL106[18:24:59] <techtastic> idk, im not a habitual
attacker, i dont have such into lying around
<techtastic> idk, im not a habitual
attacker, i dont have such into lying aroundL107[18:25:33] <techtastic> id likely just google
it
<techtastic> id likely just google
itL108[18:26:36] <walksanator> is this one?
<walksanator> is this one?L109[18:26:36] <walksanator> Code Block pastebined
null
<walksanator> Code Block pastebined
nullL110[18:26:52] <kristopher38> >walksanator: give me a
sql attack
<kristopher38> >walksanator: give me a
sql attackL111[18:26:52] <kristopher38> then give me your
query
<kristopher38> then give me your
queryL112[18:27:14] <walksanator> Code Block pastebined
null
<walksanator> Code Block pastebined
nullL113[18:27:21] <walksanator> this is the RS command and
the query
<walksanator> this is the RS command and
the queryL114[18:27:44] <walksanator> signature is *only* `qweasd`
so cannot be attacked for obvious reasons (try to exploit
qweasd)
<walksanator> signature is *only* `qweasd`
so cannot be attacked for obvious reasons (try to exploit
qweasd)L115[18:27:50] <walksanator> the only vector I can see is
`bytes`
<walksanator> the only vector I can see is
`bytes`L116[18:27:53] <walksanator> since that is NBT data
<walksanator> since that is NBT dataL117[18:27:59] <kristopher38> yeah that caught my
attention too
<kristopher38> yeah that caught my
attention tooL118[18:28:01] <walksanator> (password is not user
controlled)
<walksanator> (password is not user
controlled)L119[18:29:13] <kristopher38> you should sanitize `bytes`
for size and being a valid NBT
<kristopher38> you should sanitize `bytes`
for size and being a valid NBTL120[18:29:17] <walksanator> because bytes is the only
one that goes in with *no* sanatization (by me)
<walksanator> because bytes is the only
one that goes in with *no* sanatization (by me)L121[18:29:29] <walksanator> that is currently the
plan
<walksanator> that is currently the
planL122[18:29:55] <walksanator> (gonna try and load it
uncompressed, and if it fails, send a error message back to the
client "invalid nbt"
<walksanator> (gonna try and load it
uncompressed, and if it fails, send a error message back to the
client "invalid nbt"L123[18:32:37] <Hawk777> Should probably
make sure there isn’t any way to construct a blob of bytes that’s
both valid NBT data and also something else you don’t want (or, you
know, just make sure that the “something else” can’t actually do
anything, which would be the ideal solution).
L124[18:33:19] <walksanator> yeah that is what I am
thinking
<walksanator> yeah that is what I am
thinkingL125[18:33:29] <walksanator> because nbt does contain
valid string
<walksanator> because nbt does contain
valid stringL126[18:34:06] <walksanator> so whats stopping a string
within nbt being like `sqli "; DROP TABLE
HexDataStorage;`
<walksanator> so whats stopping a string
within nbt being like `sqli "; DROP TABLE
HexDataStorage;`L127[18:34:29] <walksanator> because right subsequent
executions may fail
<walksanator> because right subsequent
executions may failL128[18:34:34] <walksanator> but the table was
dropped
<walksanator> but the table was
droppedL130[18:37:00] <fingercomp> of course,
since you're using prepared statements
L131[18:37:39] <walksanator> yep
<walksanator> yepL133[18:37:51] <walksanator> so it is gonna take
something *a little more*
<walksanator> so it is gonna take
something *a little more*L134[18:37:57] <walksanator> but I dont really do any
selecting
<walksanator> but I dont really do any
selectingL135[18:38:22] <walksanator> (and what selecting will be
done by the aforementiond pattern which is only `qweasd` and max
length of 256 chars
<walksanator> (and what selecting will be
done by the aforementiond pattern which is only `qweasd` and max
length of 256 charsL136[18:38:26] <walksanator> post-filtering
<walksanator> post-filteringL137[18:52:58] <Amanda> If you're using
prepared statements you should be totally safe, AIUI those are
usually handled by the SQL db's wire protocol to be substituted
server-side safely
L138[19:08:11] ⇦
Quits: Hawk777 (~Hawk777@2607:c000:829b:6400:3285:a9ff:fe40:a36)
(Ping timeout: 190 seconds)
L139[19:22:32] <theredstonewolf> i use opencomputers to
control Immersive Railroading trains. how does getpos() work? What
is the result?
<theredstonewolf> i use opencomputers to
control Immersive Railroading trains. how does getpos() work? What
is the result?L140[19:24:24] <ar2000>
Use the `lua` interpreter to experiment with it
<ar2000>
Use the `lua` interpreter to experiment with itL141[19:24:32] <theredstonewolf> thx
<theredstonewolf> thxL142[19:48:49]
⇨ Joins: Hawk777
(~Hawk777@2607:c000:829b:6400:ef85:1468:64ea:8929)
L143[20:01:35] ⇦
Quits: paperluigis (~Thunderbi@176.118.114.87) (Ping timeout: 195
seconds)
L144[20:41:48] <S3>
Amanda: update 8 is the way to go
<S3>
Amanda: update 8 is the way to goL145[20:41:58] <S3> I just
wish the map was randomly generated
<S3> I just
wish the map was randomly generatedL146[20:42:09] <S3> It
would make the replay value so much better for me
<S3> It
would make the replay value so much better for meL147[20:52:03] <Forecaster> Just invert your controls,
bam, brand new experience
<Forecaster> Just invert your controls,
bam, brand new experienceL148[21:03:22] <Izzy> S3: you can page
through the vtys with alt-, and alt-. :3
L149[21:03:59] <Izzy> https://social.shadowkat.net/media/7d58b6ff1253e5548ee6434776e56c800e5cef33ed97b64c2a82759e919474a1.webm
L150[21:04:06] <Michiyo>
ffs... I need to be able to hairpin my connection over my VPN... OR
I need to tell my local webserver that any access to hosted domains
should connect over the LAN ._.
<Michiyo>
ffs... I need to be able to hairpin my connection over my VPN... OR
I need to tell my local webserver that any access to hosted domains
should connect over the LAN ._.L152[21:16:20] <Amanda> @S3 it's a bit
laggy sometimes, but I'm generally liking it so far. Bit
disconcerting that I'm decapitated in the game though
L153[21:18:24] <Michiyo>
ok got iptables to let the hairpin work
<Michiyo>
ok got iptables to let the hairpin workL154[21:22:29] <S3> Lol
what
<S3> Lol
whatL155[21:22:37] <S3> Yeah
there's some weird bugs for sure
<S3> Yeah
there's some weird bugs for sureL156[21:22:49] <S3> My
friend and I were breaking it the other day with debug on lol
<S3> My
friend and I were breaking it the other day with debug on lolL157[21:23:08] <Forecaster> Having a head is overrated
anyway
<Forecaster> Having a head is overrated
anywayL158[21:23:44] <Forecaster> It just means you have the
potential to get ahead later
<Forecaster> It just means you have the
potential to get ahead laterL159[21:24:06] <Amanda> @S3 :
L160[21:24:13] <Amanda> https://matrix.camnet.site/_matrix/media/r0/download/camnet.site/qBDtXAJfvqVRWIxIPeSnNlvf/PXL_20230626_212349409.jpg
L161[21:24:39] <S3>
LOL
<S3>
LOLL162[21:24:52] <Amanda> I've gotta fix my
steam deck syncing of screenshots
L163[21:25:02] <S3> Also
that's cool,a steamdeck
<S3> Also
that's cool,a steamdeckL164[21:45:55] <Amanda> That's actually a
screenshot in steam, I've broken my syncing to my laptop though, so
I decided to just take a photo of the steamdeck with it uo
L165[21:47:00] <Izzy> hoping the steam
deck encourages more devs to do their UIs properly
L166[21:47:24] <Izzy> letterboxing or
broken UI placement on non-16:9 displays is very
disappointing
L167[21:47:29] *
Izzy stares at capcom
L168[22:03:23] <Amanda> Izzy: honestly I
expect the seemingly growing prevalence of stupid-wide screens is
more likely to drive adaptive UIs
L169[22:04:02] <Izzy> so far that seems to
just make them have a menu option to select between 16:9, 21:9 and
32:9
L170[22:04:27] <Amanda> Ah
L171[22:05:51] <Izzy> see MHW and
MHRise
L172[22:08:45] <Amanda> I'll have to ask
my sister how monster hunter stories 2 is doing, shes been playing
it on her deck
L173[22:09:50] <Izzy> Code Vein was
funny
L174[22:09:58] <Izzy> it was rendering in
full res then adding black bars over the top
L175[22:10:21] <Izzy> which is obnoxious
because you're rendering geometry you can't see ... but also
removing them means hex editing 4 bytes
L176[22:44:17] ⇦
Quits: Vexatos
(~Vexatos@p200300eaef20b35228868c0a9c938aad.dip0.t-ipconnect.de)
(Quit: Insert quantum chemistry joke here)
L177[22:53:02] ⇦
Quits: Teris (sid315557@id-315557.helmsley.irccloud.com) (Ping
timeout: 183 seconds)
L178[22:53:09]
⇨ Joins: Teris
(sid315557@id-315557.helmsley.irccloud.com)
L179[23:07:18] <Amanda> Izzy: apparently
she's playing it in 16:9 because the default was making the menus
not work, so I guess Capcom haven't learned yet
L180[23:09:29] <Izzy> of course .-.