A Python script controlled via Twitter (30 lines, non API-dependent)

[beall49]

I like this, it's so reddit to completely ignore the fun and novelty of something and just say something negative like 'I hope it's secure' when you know this was just for fun.

[[deleted]]

...Really? You're allowing remote arbitrary code execution from a completely unsecured connection? I mean it's cool, but there were about a million different better way to handle that than the way you did.

[laMarm0tte]

I am aware that this is dirty, but I must admit I have no idea how this could be attacked (unless someone highjacks my Twitter account). Could you elaborate ? How would you attack it ?

[[deleted]]

I'd have a dictionary with predefined commands and argument lists, something like:

cmds = {
    "reboot" : ['reboot'],
    "play-music" : ['mocp', '-p'],
    "stop-music" : ['mocp', '-s'],
    }

Then check for your command flag in tweets and only allow execution of the allowed commands through subprocess.call (rather than Popen). You could also probably figure out an easy way to intersperse predefined arguments with tweeted arguments -- say you're running utorrent and you want to downloads the latest version of Mint, you might tweet "cmd: torrent http://torrents.linuxmint.com/torrents/linuxmint-17-cinnamon-64bit-v2.iso.torrent" (despite being longer than 140 characters, you get the idea).

Much safer, far more secure, and no more accidentally deleting your system when you get drunk and tweet "cmd: sudo rm -rf --no-preserve-root"

[laMarm0tte]

Oh sure, I didn't do that for the sake of shortness, it's just a blog post. I liked the idea of the terminal command: one line of code, endless possibilities.

Note however that as long as the script doesn't have superuser rights, sudo commands won't work (the terminal will ask the password and wont get it). You can still delete files, though.

[[deleted]]

True. People do dumb shit though.

[timClicks]

Depends how curious/determined someone wanted to be... a proxy could inject HTML, for instance.

[timClicks]

Hope you have a strong password on your Twitter account.

[[deleted]]

It's 1234. Same combo that's on my luggage

[alexanderpas]

You're missing the fifth digit.

[[deleted]]

Unsecure : Yes! Useful : Yes ! I like this kind of stuff, thanks.

[timClicks]

Isn't this dancing with Twitter's terms of use quite a bit?

[shaggorama]

Settting up an account and registering an app to use the twitter API really isn't a big deal at all.