"Asswipe," replied Yahoo's server. That's when I knew I had it

http://ridiculousfish.com/blog/posts/YahooChatRooms.html?display=1

by peteretep • 13 years ago

573 104 13 years ago

tantalor• 13 years ago

Der, why did they filter naughty words in the client?

vwinsyee• 13 years ago

They didn't -- the list was sent from the server, because "this list might need to be updated dynamically, in case someone on the Internet managed to think up a new word for sex."

train_robber• 13 years ago

Yeah but couldn't they just do the filtering in the server itself? Just like the Zbody hack?

sgarman• 13 years ago

The list sent was supposed to be used by the client to filter. What I think the OP is suggesting is that they should have just filtered server side not client side.

cwp• 13 years ago

The list was maintained on the server, but filtering was done in the client. That's why it had to be sent to the client on every log in.

mrmaddog• 13 years ago

Perhaps they did filter messages on the server as well. The client side word-list could be used for display purposes only, so if the user typed a censored word, the client could update the display with that word redacted and without waiting for a round-trip to the server.

ComputerGuru• 13 years ago

This entry made me smile. First, the title with its language caught my eye. Then, as I reached the end of the line and saw the domain name, my tired and sleepy face broke into a full-bodied grin.

fish is my most-favorite tongue-in-cheek technical blogger ever. He doesn't blog too often, but they're almost always very useful (and very witty!) gems.

(Hint: you can find out who he really is by reading far back enough.)

eliasmacpherson• 13 years ago

or if you click the "about fish" on the top right of the kitchen roll.

experiment0• 13 years ago

It still doesn't tell you who it is on the about page though, just that he's on the AppKit team.

wilfra• 13 years ago

still haven't found it, but this is a pretty cool blog

http://ridiculousfish.com/blog/posts/my-one-lame-steve-story...

Cacti• 13 years ago

and all this time I thought "shat" was being polite

smcl• 13 years ago

Not sure about elsewhere in the world but in the UK "shat" is a sort-of fun past tense for "shit", e.g. "Ian shat in his pants"

illuminate• 13 years ago

It's not used very often in the US, but it's still a perfectly understood term.

MichaelApproved3• 13 years ago

If you're going to spam the system, why not just use Win32 API's and control their client like a zombie instead of trying to play the cat and mouse game reverse engineering their protocol?

You can send instructions to manipulate the client and have it do what you want almost as easily as you could if you knew their protocol. And that's without all the cat and mouse headaches.

memoryfault• 13 years ago

I'm not familiar with Win32 APIs. Could you elaborate more as to how they would enable you to control the client like a zombie?

Edootjuh• 13 years ago

I think he means the APIs that allow you to simulate mouseclicks and keyboard input on arbitrary windows and controls

kybernetyk• 13 years ago

Actually it ranges from simple event spoofing (user clicked here, user dragged there) to injecting a DLL + spawning a thread under your control.

Event spoofing is pretty limited. While having a thread under your control gives you full power as you have full access to the process' memory and can call any function you want.

Tuna-Fish• 13 years ago

You can basically read anything from controls, and trigger callbacks at will, as if you had actually clicked a button or written some text. This means that you can write "expect-like" software -- just start up the program, and have another program read input from it's text fields and issue commands to it.

I have actually done a lot of this, putting old sourceless win32 and win16 programs run in the background on virtual machines on the server and building new web-based interfaces on top of them.

atesti• 13 years ago

It's quite easy, see here for example: http://blogs.msdn.com/b/oldnewthing/archive/2013/04/08/10409...

swatkat• 13 years ago

AutoIt is a popular software to automate GUI applications.

http://www.autoitscript.com/site/autoit/

wooster2• 13 years ago

The whole point was to make a Mac client, not to "spam the system."

notb• 13 years ago

I think he's asking how it got so obfuscated in the first place. Seemingly, the spammers could just pilot a standard up to date client with a bot, rather than try and figure out the protocol.

I'm sure it's more complicated than that however, like client side rate limiting or something.

laumars• 13 years ago

I used to write bots for Yahoo's (and a few others) chat rooms back in the mid 90s. Nothing malicious, I was just a bored teenager so we're talking pretty dumb stuff like spamming naughty words in public chat rooms, etc. Anyhow, my point was this: the bots I wrote did just what you described, I used Win32 APIs to control the chat clients. As you said, it took only a few seconds to bang out the code and the bot could work on against multiple different chat clients with very little additional work.

The only time I've every bothered to write my own chat protocol client was for IRC in the late 90s (at which point I'd left college, was working full time so had turned my programming skills to good) and the only reason I bothered to write my own IRC client was because I was utterly fed up with the quality of Windows clients.

Back in the old days, Win32 APIs were so insecure that you could have all sorts of fun with them. I'm not sure how things stand these days though; my development these days are almost exclusively Linux and UNIX based.

peter_l_downs2• 13 years ago

Seems to be down -- nyud cache here http://ridiculousfish.com/blog/posts/YahooChatRooms.html?dis...

dbaupp• 13 years ago

I think the .nyud.net has to go straight after the domain name: http://ridiculousfish.com.nyud.net/blog/posts/YahooChatRooms...

swinglock• 13 years ago

That it does.

Visiting http://example.com/index.html.nyud.net would send a request to "example.com" for the path "/index.html.nyud.net". That's not what you want.

peter_l_downs2• 13 years ago

Thanks for pointing this out, I had really never noticed that before. I feel slightly silly now -- obviously the nyud.net was just being passed as in the query string...

cbhl• 13 years ago

Yup!

You can find out more about CoralCDN at http://www.coralcdn.org/

miles_matthias• 13 years ago

Awesome! Network sniffing and analyzing is one of my favorite hobbies since being introduced to it as a security analyst for an MSSP and then writing Wireshark plugins at Sandia. If anyone is looking for a fun Saturday, I highly recommend http://forensicscontest.com/.

sriramk• 13 years ago

At Microsoft, I once wrote code for a public facing login system where you had to make sure usernames didn't contain some banned words. I was surprised by how many words on the list were new to me and how, err, creative people get.

I always wondered who at Microsoft was tasked with keeping that list 'up to date'.

ryalfalpha3• 13 years ago

Oh man, when I worked there in Localisation for Office, there were crazy length lists for every language, it was so much fun to read through with foreign friends!

smsm422• 13 years ago

There are opensource dictionaries, timezone DBs, geo databases, etc. I wonder if there are also opensource multilingual swear word lists.

Aardwolf• 13 years ago

Banned words like sffcei? (Which was a real banned word on MSN)

lostlogin• 13 years ago

I have to ask - Googling has further infuriated me.

James_Duval4• 13 years ago

How did it treat more 'ambiguous', context-dependent offensive names such as, to take a real example I saw, "Realist88"?

pygy_• 13 years ago

How is this offensive?

I know that "88" is used as a surrogate for "Heil Hitler" in neo nazi circles (H is the 8th letter of the alphabet), but "Realist" doesn't ring any bell.

mseebach• 13 years ago

I can't answer your question, but in this example, it's the context, not that name, that is offensive. I doubt it's even linguistically possible to make a reliable classifier.

alokm• 13 years ago

These lists can be very locale insensitive. A few years back my friend was trying to get a Gmail id with his name. To his surprise he wasnt able to get any id, no matter how long and obscure suffix he tried. Then it hit me that it was because of his name Kshitij. Systems should take terms from other languages and locales as white lists in these cases.

InclinedPlane• 13 years ago

A clbuttic problem of naive sub-word filtering.

coldtea2• 13 years ago

>These lists can be very locale insensitive.

Perhaps because english is all it matters to them. Who in Europe, for example, even cares if a forum or chat has some swear words in his language?

We might be even more pissed off that we can't swear and leave the service, rather than complain about it.

chousuke• 13 years ago

The world filter on the PS3 chat is my favourite example of this. It was almost impossible to chat with friends during gaming session when for example "Akuma" (A Street Fighter character and a perfectly safe word in Japanese as well) gets censored into "a---a", and Several Finnish words like "pelata" (to play. "pela" is something offensive I guess?) "mutta" ('but'... apparently it considers "mutt" a bad word.) and anything containing "ass" (ssa is the inessive suffix and Finnish has vowel harmony. Fun.) and lots of others get completely mutilated.

SideburnsOfDoom• 13 years ago

This is known as "The Scunthorpe problem". http://en.wikipedia.org/wiki/Scunthorpe_problem

(The substring part of it, not the locale-sensitive part.)

freehunter• 13 years ago

Bring to mind the classic Fark example of "a bit chilly". Fark's swear filter removes spaces to hunt for disallowed words...

ctdonath• 13 years ago

The town of Cumming GA is subject to some interesting objections. Entering the address, one system refused with the comment "My, what colorful language you have."

danielki• 13 years ago

Microsoft uses a tool called Policheck that maintains different wordlists for different locales

There's a blog post on it here: http://blogs.msdn.com/b/michkap/archive/2010/12/04/10100294....

chiph• 13 years ago

It's not just swear-words: A credit card processor I used to work with wouldn't accept a payment from Mr. Echo because they regarded it as an attempt to hack them.

riffraff• 13 years ago

it's not online only either, I had university classes with a guy whose family name sounds like a swear word, and since to attend exams you had to preregister on a big dead-tree book left alone, usually teachers assumed it was a joke and didn't account for him.

pavel_lishin• 13 years ago

We had a customer once who wanted order IDs to be random four-digit strings.

We had to put in some filtering after a customer's order ID ended up being something along the lines of CRAP or SHIT or something.

FuzzyDunlop• 13 years ago

I suppose British people never really used the chat to talk about paedophiles. At least they looked for actual words rather than any occurrence in the string.

jrabone• 13 years ago

We'd also spell it "pædophile" just to make sure you understand Unicode...

ilitirit• 13 years ago

I had to work on implementing fairly well-known advertiser's banned-words list into our system recently. Their system is incredibly stupid. For example, they'll ban the word "Dimethltryptamine", but "Dimethyltryptamine" (the correct spelling) is allowed. You're not allowed to use the word "bulldog" under the Pets category. You can't use the word "dragon" under Jobs. It seems like they just have a form that visitors to the site can use to link ads containing "offensive" words and the system will automatically add it to a list.

emidln• 13 years ago

:waves bye

Linux, FreeBSD, Solaris:1 and Hackers' Lounge:2 were the first major time sinks of my digital life in the late 90s and early 2000s. ychat and ymsg were my intro to network protocols. I learned Makefiles, C, C++, and Python so I could build, understand, and modify programs like curfloo, curphoo, zinc, and gchat+/gyach. Although I moved on to IRC, I'll never forget when someone passed me "Smashing the Stack for Fun and Profit" (and the implicit link to Phrack) or the first time a bot I created logged in and took drink orders. The pride the first time I wrote a patch for my client to handle a login change all by myself.

A lifetime later, I know I wouldn't be where I am as a programmer if not for the encouragement of friends (some of whom I still talk with and do business with) I made as a teenager on yahoo chat. A lot of people I know grew up on IRC, but Yahoo Chat was my first love. Good bye, I'll miss you!

dopamean• 13 years ago

> or the first time a bot I created logged in and took drink orders.

My first experience with programming was writing bots in the mIRC scripting language. After first getting things to work the feeling was truly empowering. I have to say though, my next attempt in programming was in C and I found it extraordinarily difficult to get started in. Having said that, I was 14 at the time.

I think the fact that my first programming experience was with a scripting language really affected how I how I think about programming now. Ever since then I've found it easier to learn scripting languages than systems languages. Maybe that doesn't make sense to some but that's just me.

fmela• 13 years ago

I had a really similar experience. As a bored teenager in the late 90s, I would sometimes log into the Yahoo chat rooms using the computers at my high school. The chat client was a Java applet, and it was atrociously slow and prone to crashing. I had started teaching myself to program a few years earlier, so creating a chat client seemed like a fun project.

There was a guy that hung out in the Programming:1 chat room with the chat handle was 127001 (he was able to create that handle before Yahoo became more strict with the chat handles one could create) that had reverse-engineered the protocol and posted a guide online. I wonder what happened to him. Thanks, loopy!

Anyway, I created a Yahoo chat client in Win32/C as I was learning the API and the language. I was the only user for quite a while, but eventually I posted it using the free web space EarthLink gave me for being a dial-up subscriber. It got pretty popular through word of mouth. Later, when I installed Linux for the first time, I took that code and turned it into an ncurses-based client. It was a lot of fun, and somehow I ended up turning the fun I had hacking on little projects like that into a living.

leephillips2• 13 years ago

What a charming and informative website! So refreshing to see an original design instead of another Wordpress, etc. site. Check out this fascinating note on how grep manages to be so fast by being secretly slow:

http://ridiculousfish.com/blog/posts/old-age-and-treachery.h...

charlieok• 13 years ago

Obligatory SNL reference:

http://www.hulu.com/watch/285711

pondababa• 13 years ago

I'm surprised that "phag" is blocked but "fag" isn't.

"Asswipe," replied Yahoo's server. That's when I knew I had it

Related Stories