Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

Super Search searches scratchpads which are not public

by deprecated (Priest)
on Jun 12, 2004 at 03:55 UTC ( #363555=monkdiscuss: print w/ replies, xml ) Need Help??

Feed "vec" to Super Search. It will tell you princepawn's scratch pad contains the string. Attempt to see said scratch pad. You will find that pad is not public.

I'd offer to fix this, except that I'm about to write a node on vectors. I'd also happily file an rt ticket or somesuch, but I didn't really see anywhere appropriate to do anything like that.

brother dep

--
Tilly is my hero.

Comment on Super Search searches scratchpads which are not public
Re: Super Search searches scratchpads which are not public
by Zaxo (Archbishop) on Jun 12, 2004 at 04:07 UTC

    What's the problem? You get to know that princepawn has an interest, and he gets the privacy. If he doesn't respond to a /msg, you can at least look at his nodes for a clue.

    After Compline,
    Zaxo

      Well, with regex searches, and enough hits to the host, you could use binary searching to figure out the exact text of the scratchpad. Presuming printables (and newline) only, it'd take only 6 or 7 hits per character you wanted to guess. Look for /^[a-m]/ and if that fails, look for /^[n-z]/, otherwise look for /^[a-h]/ and so on. As you get each letter, you add it to the beginning: /^v[a-m]/.

      So, yes, this is a leak, but a slow leak.

      Hmm. That'd be an interesting article about why not to allow regex searches against text you can't eventually see. >>todo.

      -- Randal L. Schwartz, Perl hacker
      Be sure to read my standard disclaimer if this is a reply.

        How can you do a regexp search? I thought that super-search would allow only fixed text.

Re: Super Search searches scratchpads which are not public
by saskaqueer (Friar) on Jun 12, 2004 at 08:28 UTC

      Or maybe just nobody commented. (: Did anyone notice that scratchpads had a lot of changes done to them recently? The work isn't finished. This particular problem is well known and as the work for these changes progresses, this problem will go away.

      Update: About one day later and most of the kinks are removed from scratchpads (mostly due to demerphq's diligence, again, it appears -- though I don't mean to not credit others who may have helped, ysth probably being one) including preventing private scratchpads from having their contents subject to search. And I managed to change Super Search to allow the 'scratchpad' box to be checked.

      - tye        

Re: Super Search searches scratchpads which are not public
by ambrus (Abbot) on Jun 12, 2004 at 13:35 UTC

    You can use this feature to find out the full text of the private scratchpad.

    For example, if you want to know what follows "vec" in princepawn's scratchpad, you super-search the scratchpad for "veca", "vecb", ... putting each character after vec. This is very slow, so don't do it unless you really need to. It also sucks because the search is case-sensitive.

    I tried this just to test that it works. It turns out that princepawn's scratchpad contains "$vector, 1, rand(2" (some letters may be ucased): super-search proves it.

    I did the search with a little script that tries every character automatically (some think there are 2**31 characters). To find out the next character, just try (Update: readmored code)

    Beware, this takes some time to finish. Some guesswork can help (I guessed that "or" would follow "vact").

      You are aware, of course, that on the other side of that ruby is a webserver, with other people connected to it? Serving a site that many people complain has performance issues?

      I'd have been perfectly happy with just "test code" that hadn't made a thousand hits on the server. It's neat, but I got the point from the code.

      dep

      --
      Tilly is my hero.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: monkdiscuss [id://363555]
Approved by PodMaster
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others pondering the Monastery: (4)
As of 2014-09-20 05:57 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    How do you remember the number of days in each month?











    Results (154 votes), past polls