My weekend project: anonymous, realtime message board with socket.io

http://oak.io/about

by ecto • 14 years ago

45 43 14 years ago

oak.io

This is just a simple node app on a small Joyent server!

ecto16• 14 years ago

This is just on a small Joyent server, running one process. I started it Friday night so there's still a few holes.

sudonim• 14 years ago

Yeah, like it's not anonymous. Someone figured out that you can see all ip addresses (tied to comments) when you open up firebug.

ecto16• 14 years ago

I fixed that actually. You can still get around my fix but I will fix the fix later.

opendomain• 14 years ago

Do NOT go to this service! It does not filter JavaScript and so is succeptble to XSS and other hacks. I sent on and clicked on a chat named 'Natalie portman' and it can up with an alert box that said 'no chance bro' and kept on popping up and I had to shut down my browser. Other than that - pretty kewl! Is the code open source?

ecto16• 14 years ago

I actually got tricked by that too haha. I went into the database and deleted that, and pushed a fix to production.

mkramlich• 14 years ago

You are now totally qualified to start a Bitcoin bank.

chrisbroadfoot• 14 years ago

Who cares if it's open to XSS? Does the site have a cookie you care about?

If it's truly anonymous, then it doesn't matter if someone forges your cookie.

nsmartt5• 14 years ago

Let me start by saying that the notion that XSS can only be used to harvest cookies is a very common misconception. The truth is that, with XSS, any action a user may do on the vulnerable site (that doesn't require a password) can be mimicked.

With an XSS vector in the board title (meaning the JavaScript would be injected into the page listing all boards) it would be possible to force all visitors to participate in a DDoS attack against this site. If I'm not mistaken, it would be possible to force the participation in a DDoS against ANY site. I'm fairly certain that cross-site ajax works fine in modern browsers, but without cookies to prevent abuse- cookies are not necessary for DDoS.

Edit/Note: This does mean that any site could force visitors to participate in a DDoS attack. What prevents this from becoming common is the number of visitors required for a DDoS attack to succeed.

This would probably not work on this site because the number of users is only ~6000. I don't know how many users would actually be required to dent a typical site. I do know that "Anonymous" recently used a client side DDoS tool on a large number of users.

Edit 2: In light of http://news.ycombinator.com/item?id=4000301, I'll point out that XSS could result in the forced posting of illegal content, as well.

DigitalSea2• 14 years ago

This is actually a lot of fun man, kudos.

ecto16• 14 years ago

Thanks! I had a lot of fun writing it!

DigitalSea2• 14 years ago

Are you planning on open sourcing the code via Github or something? I haven't built a Node app myself just yet, would be interesting to see how you did it.

bromagosa• 14 years ago

Cool one!

It'd probably be a good idea to crop titles and contents if they exceed a particular length.

ecto16• 14 years ago

Doing this right now!

zxcvb2• 14 years ago

I guess he's NOT GOING TO GET BANNED....

ecto16• 14 years ago

Pushed a limit of 200 chars

brettbergeron• 14 years ago

Nice work dude! This is like 4chan, but real-time :D

ecto16• 14 years ago

I'll take that as a compliment haha.

voxx3• 14 years ago

lol the xss possibilities on this thing are making me drool a bit

and that guy is not going to get banned

ecto16• 14 years ago

I patched up the ones that were apparent, but I'm sure there's still some open.

voxx3• 14 years ago

oh trust me, there are still plenty. depending on how you handle the spamming and stuff, I might even contribute the ones I find myself.

biwuchen2• 14 years ago

cool

biwuchen2• 14 years ago

nice

joshryandavis• 14 years ago

It is a fun little site, I really enjoyed playing with it. You really need to add some spam prevention, title & comment length limits, fix exploits, etc.

I wanted to play around with it some more, but it's just pure spam now.

ecto16• 14 years ago

Thanks! I really hate spammers :\

ecto16• 14 years ago

I just added a basic spam detector and truncated title lengths :|

ecto16• 14 years ago

Also I had to upgrade my RAM pretty fast haha. Should be better now.

vics• 14 years ago

Nice MVP with critical mass reached.

shousper• 14 years ago

It's like real-time reddit.. its be fun, but probably hard to make constructive, lol

I like it, and envy the fact you could just create this on a whim over a weekend. I wish I had that kind of discipline when it comes to some of my spontaneous ideas!

ma2xd• 14 years ago

What kind of server do you use?

ecto16• 14 years ago

This is just a single process on a Joyent SmartMachine. It's the first time I've used them and I've been pleased!

pcopley• 14 years ago

So you built 4chan without the user base.

My weekend project: anonymous, realtime message board with socket.io

Related Stories