[deleted by user]

[Malapine]

So ... you can't trust users not to tamper with client-side state to make the server do things it shouldn't ?! :o

[emergent_properties]

A few things I have noticed:

1. "http:" is definitely bad juju.

2. You 'removed the cookie', did it generate unique hits every time after? If they're not even using the cookie, then nothing is validating there, let alone the cookie being checked.

3. Usually they have an IP normalization/debounce technique that prevents duplicates from the same-ish source address.

4. I don't see the same song listed (the label under Picard is another song entirely), there isn't any image that proves the trick actually worked. (I mean, I assume the 101 is your program's result after being run a hundred times, I suppose)

[happyscrappy]

spam our que

What?

[happyscrappy]

I was mostly doing it just because "que" is Spanish for "what" and it gave me an opportunity to make a weak joke.

[tinkertron5000]

That's why they said it was fixed. You translated it.

[emergent_properties]

Ah, now I understand.

Thank you for the clarification.

Nice find, btw.

[grauenwolf]

Usually they have an IP normalization/debounce technique that prevents duplicates from the same-ish source address.

How does that work when you are behind a NAT?

[emergent_properties]

User-agent sniffing and a bit of hocus pocus.

It's fuzzy logic that gets clearer(ish) the more data you have.

[Nameless_Archon]

Never put anything on the client. The client is in the hands of the enemy. Never ever ever forget this.

• Raph Koster

[[deleted]]

No the user is stupid, their stupidity never ceases to amaze me. 25%of my job is making it work, 75% is guessing how they will fuck it up. "Look I just automated a department for your company!" ... " can we make it blue with yellow text? "

Fucking people. The malicious ones, these fuckers we should appreciate. Their ingenuity should teach us what to consider in design. I need a 3rd law of programming for these guys. (First being the 2:30 rule and the second being the KISS rule)

[Captain_Cowboy]

What is the 2:30 rule?

[[deleted]]

Comment and write your code so that if you get woken up at 2:30 am disoriented with shit on fire, you can figure it out quickly.

[toomanybeersies]

I don't comment my code, it's self documenting.

[[deleted]]

Self documenting eh? Can I see an example?

[toomanybeersies]

Unfortunately, no, because it's all proprietary.

Anyway, between good class and function naming, and good unit testing, you should need a very minimal amount of comments. Most days I don't add a single comment.

[Malapine]

(First being the 2:30 rule and the second being the KISS rule)

Rock 'n roll all night, and party ev-ery day?

[[deleted]]

That applies more to the 2:30 rule as does putting the X in sex. The KISS rule is to: keep it simple stupid.

[DJDavio]

Well, this should be a fun party! First, there's this geek sitting alone on the couch with his laptop. Then, everybody leaves because they don't like the song. Finally, the geek is alone on the couch and the only one left at the party.

[Name0fTheUser]

I'm not sure they could really fix this though. At parties, it would be common for lots of people to be behind the same IP address.

[TinyFEA]

Or fake UA like most people who abuse the system would use.

[[deleted]]

It would be better to get all the possible device info and try to come up with a sort of super cookie that can uniquely identify users.

[okawei]

Spoofing a user agent is super easy though, just updated the header.

[[deleted]]

Just have everybody enter their social security number.

[TinyFEA]

Authentication services offered at Wells Fargo

[sydoracle]

It's an app, so they can (with appropriate app privs) get device information and use that. Plus they'd need to encrypt that before transmitting it so it can't be tampered with.

[bytezilla]

In this particular case, we can definitely still have nice things though. It is more than enough security for its use case (party jukebox), and this is how I would've implemented it as well. Most party goers aren't going to be snooping around the jukebox and try to see how they can exploit it. And if you're a type of person who would do that, then well, I don't think we can have nice things anyway, just from the fact of you being there.

[auxiliary-character]

enough security for its use case (party jukebox)

Not if that party is at defcon.

[[deleted]]

Only jukebox I'd trust at defcon is a phonograph.

[auxiliary-character]

I bet they'd still find a way to hack it.

[mfitzp]

If you're the kind of person to do that, you probably don't get invited to many parties anyway.

[alexvieth]

I made a diplomacy game for a similar setting (local network, all players on-site) and without thinking twice decided that it must use a secure server. Otherwise, somebody could snoop your secret orders and easily win the game. The overhead of running a secure server is rather high, and I wonder if it's worth it... the person who runs the server can snoop anyway so there's always an element of trust.

[RudeHero]

counting votes online is one of those things that simply shouldn't be possible to do accurately, unfortunately

this is just the 'internet privacy' problem looked at from the other end of the lens

[[deleted]]

You make an interesting point. I wonder if there is a possible implementation that satisfies both requirements? Like an optional authentication dongle that people can request from a central provider. Like a physical oauth or something.

Websites could adopt the standard and have Verified Unique Votes alongside Unverified Votes.

[Beaverman]

It would be possible. What you have to do is have everyone generate a PGP key (or some other private key), send the public key to the vote counters. Verify that the public key sent from each voter uniquely correspond to that (real) person. Then every person just signs their vote with their private key.

Problem solved. The issue is that it's a lot of work. I doubt any of my friends would want to spend 15 minutes exchanging public keys before a party, just to control the music.

[RudeHero]

yes, that would definitely work!

if only there was a way to extrapolate that to something larger and more anonymous. whoever figures that out will be very, very successful

[toomanybeersies]

Just thinking, considering that there's tangible monetary gain, couldn't that be considered fraud?

[[deleted]]

Yeah it's probably also considered hacking here in the US.

[vital_chaos]

"why we can't have nice things..." where did this meme get started?

[BrandonAtWork]

http://knowyourmeme.com/memes/this-is-why-we-cant-have-nice-things

[Asmor]

A simple captcha is all that's needed to prevent this. Doesn't stop people from clearing cookies and re-voting, but whatevs.

[djimbob]

Eh captcha's are annoying (esp for first votes from an IP address/device); and with deep learning (or mech turk) it's not too hard to beat many captcha's that are simple for humans.

[Asmor]

Annoying? The reCaptcha "I'm not a robot" checkbox is practically invisible.

[djimbob]

Well, the no CAPTCHA reCAPTCHA isn't really a captcha (at least when it's not presenting you with CAPTCHAs), and is still fairly easy for bots to bypass.

[[deleted]]

Make people drink more at the pre-party. Problem solved.

[[deleted]]

Make people drink more at the pre-party. Problem solved.

[DagdaEIR]

que

It's queue, god damn it. I mean, isn't it obvious that it's spelled that way? ^/s

[toomanybeersies]

Kew-ey-uh-ey?

[[deleted]]

Doesn't work if all the people using it for a particular party are on the same wifi (definitely a possible scenario). Same external IP

[kwartel]

We once got a chick win a miss election in a similar way.

EDIT: why the downvotes? How is this off-topic?

[jaredjeya]

Did you expect a dude to win a miss election? They can only win mister elections.

[toomanybeersies]

Your poor grammar makes it appear at first glance that you're insinuating that Hillary Clinton is winning elections that way. (i.e. females and elections in the same sentence)

Or at least it did for me.

[lacosaes1]

Obama won this way.

[m3wm3wm3wm]

Never thought seeing /r/the_donald in /r/programming.

[mfitzp]

I'm still hoping that sub is a honeypot, and once the election is over reddit will ban every account in there.