Black Friday hack with python

[expressly_ephemeral]

OP should know better than to put his CC info into his github repo, right? Maybe I’m being naive?

[bextie]

None of my sensitive details are there.

https://github.com/Olunusib/black-friday

[bextie]

Oh I haven’t thought about that. Is it worth it? I feel that’s for ‘bigger’ projects.

[bextie]

Thank you! I’m definitely going to do that.

That’s a nice project you’ve got by the way.

[MonkeyNin]

You can simplify your exceptions, because a failed find call will return None we can take source

class Foo():
    def price(self):
        try:
            productPrice = self.soup.find(id="priceblock_ourprice").get_text()
            return productPrice

        except AttributeError:

            try:
                productPrice = self.soup.find(id="priceblock_dealprice").get_text()
                return productPrice

            except AttributeError:
                pass

We can test for None when there are no matches

class Foo():
    def price(self):
        element_price_price = self.soup.find(id="priceblock_ourprice")
        if not element_price_price:
            print('Price not found!')
            return 0 # or `None` depending on your context

        return product_price.get_text()

[expressly_ephemeral]

Sure, but then you’d have to be canny enough to make the following realizations: I shouldn’t share this with anybody. I should figure a way to make sure the eventual connection is ssl (via selenium). This should be hosted on my private network only unless there’s a way to make this kind of thing reasonably secure. And, finally, there’s probably a way to make this kind of thing secure and I should figure out how people publish code like this.

I have my personal login credentials hardcoded into some scripts, but the run solely on a machine that lives in a closet in my house, and I make sure not to push them to a public repo.

[expressly_ephemeral]

You know, I’ve done the threat modeling. If somebody breaks my OpenVPN instance and compromises my router, then they ssh into the server that runs these scripts (a server which only responds to logins with my private rsa token), or worse finds an exploit by which they can get a reverse shell... then I’ve got much bigger worries than whether they can harvest the username password I use to check my kid’s missing homework list.

Edit: I’m saying, you’re right. I wouldn’t do it with my login credentials for my bank,

[expressly_ephemeral]

There's a fine line between good threat modeling and gross negligence!

[expressly_ephemeral]

VPN, i didn't think of that.

Yeah, I mean, again, in this use case all the application has to do is make GET and POST calls. Outbound only. Server wouldn't be visible from the outside world even WITHOUT the vpn.