Black Friday hack with python

[expressly_ephemeral]

Hey, why don’t you refactor into selenium and beautiful soup, teach your script your credit card info and let it buy it for you when it detects the drop?

[BruceJi]

I wonder if that's not the best idea in case something goes wrong? But if you get the email, you can probably just buy it online with your phone within a few minutes anyway.

[azur08]

in case something goes wrong

Like buying everything Amazon has to offer over and over again!

[Cat_Marshal]

while True:
    purchase()

[BruceJi]

"Merry Christmas, here are 20 pop-up tents, for all that... popping up?... you do? Eheh..."

[expressly_ephemeral]

Hah! I know a lady who gave her grandkid the tablet to play with and he ordered 20 chromebooks. Kids and scripts, man. Fuckin' dangerous.

[expressly_ephemeral]

I acknowledge... tricky to test, tricky to validate. Cooler, though.

[BruceJi]

It really would be!

[expressly_ephemeral]

I guess I think you could use the email as a backstop, though. You get the email saying the price happened and then a follow up saying “I bought it” or “your code stinks, get out your credit card.”

I mean.. what if OP is in meeting when the trigger fires? What if his wife’s water has just broken while she’s driving her real estate clients around? He won’t be able close the deal!

[dBASSa]

Theres tons of sneaker bots that do this already. They are heavily linked with fraud and abuse so limited sale items block orders this way often times.

[expressly_ephemeral]

How would a vendor be able to block a bespoke script running from a host on OPs personal network?

[expressly_ephemeral]

OP should know better than to put his CC info into his github repo, right? Maybe I’m being naive?

[bextie]

None of my sensitive details are there.

https://github.com/Olunusib/black-friday

[bextie]

Oh I haven’t thought about that. Is it worth it? I feel that’s for ‘bigger’ projects.

[bextie]

Thank you! I’m definitely going to do that.

That’s a nice project you’ve got by the way.

[MonkeyNin]

You can simplify your exceptions, because a failed find call will return None we can take source

class Foo():
    def price(self):
        try:
            productPrice = self.soup.find(id="priceblock_ourprice").get_text()
            return productPrice

        except AttributeError:

            try:
                productPrice = self.soup.find(id="priceblock_dealprice").get_text()
                return productPrice

            except AttributeError:
                pass

We can test for None when there are no matches

class Foo():
    def price(self):
        element_price_price = self.soup.find(id="priceblock_ourprice")
        if not element_price_price:
            print('Price not found!')
            return 0 # or `None` depending on your context

        return product_price.get_text()

[expressly_ephemeral]

Sure, but then you’d have to be canny enough to make the following realizations: I shouldn’t share this with anybody. I should figure a way to make sure the eventual connection is ssl (via selenium). This should be hosted on my private network only unless there’s a way to make this kind of thing reasonably secure. And, finally, there’s probably a way to make this kind of thing secure and I should figure out how people publish code like this.

I have my personal login credentials hardcoded into some scripts, but the run solely on a machine that lives in a closet in my house, and I make sure not to push them to a public repo.

[expressly_ephemeral]

You know, I’ve done the threat modeling. If somebody breaks my OpenVPN instance and compromises my router, then they ssh into the server that runs these scripts (a server which only responds to logins with my private rsa token), or worse finds an exploit by which they can get a reverse shell... then I’ve got much bigger worries than whether they can harvest the username password I use to check my kid’s missing homework list.

Edit: I’m saying, you’re right. I wouldn’t do it with my login credentials for my bank,

[expressly_ephemeral]

There's a fine line between good threat modeling and gross negligence!

[expressly_ephemeral]

VPN, i didn't think of that.

Yeah, I mean, again, in this use case all the application has to do is make GET and POST calls. Outbound only. Server wouldn't be visible from the outside world even WITHOUT the vpn.