apple502j

What's the Coinhive case? Why was it important?

TL;DR: It was a battle between us, the enginners who advocate for technology advancements, and the police. And we won.

The Beginning

On March 2018, after raiding his home and some interrogations (some of which was criticized - see later), the Kanagawa Police in Japan charged a web designer (@moro_is on Twitter) for violating the Penal Code. For violating Article 168-3, titled "Acquisition of Electronic or Magnetic Records Containing Unauthorized Commands".

The program in question was one line of HTML tag, that loaded the Coinhive script, a cryptominer. The summary court sentenced him to fine of 100,000 yen - around $940. He could just pay the fine, like many others who got prosecuted for the same "crime". But he instead contacted the lawyer - on March 29th. He had about 2 weeks to object to the summary court's decision and request a formal trial.

The news spread quickly - and many people expressed their concerns on how this could go badly. While cryptomi

apple502j

Fix Unknown

• https://bugs.mojang.com/browse/MC-248208 Villager POI not invalidated when they teleport through portals Source: originally reported public
• https://bugs.mojang.com/browse/MC-242793 Incorrect teleportation to end dimension when pushed into the end portal by a piston Source: originally reported public
• https://bugs.mojang.com/browse/MC-249054 Closing inventory by clicking outside of GUI doesn't close inventory properly, which can be used to carry 4 more stacks using player 2x2 crafting slot Source: originally reported public
• https://bugs.mojang.com/browse/MC-266177 Slowing or increasing ticking affects time calculation in demo mode

1.20.x

• https://bugs.mojang.com/browse/MC-262206 Trapdoor-note block update suppression/recursive neighbor update; fix 1.20.1 (partial), 23w35a (likely full fix)

1.18.x

apple502j

Security Guide for Discord Bots using discord.py

Discord bots, just like web servers, deal with untrusted data. Most of those bots implement interactive commands, which makes the attack surface significantly larger. This guide is to improve security of Discord bots.

Security is usually represented by the three elements of CIA (not related to the agency) - Confidentiality, Integrity, and Availability.

• Confidentiality: Protecting your secrets (and others' secrets) from attackers. "Secrets" include your bot token, message contents and other PII, files stored on your computer and other private data.
• Integrity: Protecting your data from manipulation by attackers. "Manipulation" can vary from compromising the host computer to improper permissions/roles assignment or data spoofing/tampering (e.g. cheating in a chess game to obtain points).
• Availability: Protecting your bot from crashes or similar situations. Examples include infinite loop, blocking codes and error handling issues.

Here are some tips to im

apple502j

How to Bring Back the Old Minecraft Wiki (sort of) - Firefox Edition

1. Install Redirector extension.
2. Go to your extension page (about:addons)
3. Click "Redirector"
4. Click "Options"
5. Click "Edit Redirects"
6. Add redirects as shown below. Pattern type is all "Regular Expression". Advanced options are not used. If you haven't used Redirector before, you can instead just import the settings (see below for the JSON file)
7. Install uBlock Origin extension.
8. Go to your extension page (about:addons)
9. Click "uBlock Origin"

apple502j

Breaking Changes of discord.py 2.0

These are the breaking changes of discord.py version 2.0.

"Breaking change" includes:

• [R]emoval: a feature is removed.
• [N]ame changes: a feature is renamed.
• [B]ehavior: something does not behave the way they did in 1.x.
• [T]yping: types of arguments, attributes or return values changes in an incompatible way. (e.g. None disallowed for argument)
• [S]yntax: a syntax previously allowed for an operation is no longer allowed. (e.g. positional only arguments, new required arguments)

apple502j

CVE Description Templates by CNA

Microsoft before 2020

A <Impact> exists when <Product> <Bug>, aka '<Product> <Impact> Vulnerability'.

<Impact> is one of: "remote code execution", "elevation of privilege", "spoofing", "denial of service", "information disclosure", "cross site scripting", "security feature bypass".

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. (CVE-2020-1472)

apple502j

Animated Text issues

• animated-text blocks yield using Promise.resolve() instead of runtime.requestRedraw() (which is better for handling turbo/warp, see also vm#2079 for similar issues)
• setFoot doesn't Cast.toString
• setColor accepts any CSS color. Is it cool enough that we can keep?
• rainbow clears existing color effect
• _onTargetCreated can use once instead of on+off
• use-after-destroy: crash with zoom effect when a target is being removed

apple502j

class Scratch3TextBlocks{
    constructor (runtime){
        /**
     * The runtime instantiating this block package.
     * @type {Runtime}
     */
        this.runtime = runtime;
        this._onTargetWillExit = this._onTargetWillExit.bind(this);
        this.runtime.on('targetWasRemoved', this._onTargetWillExit);
        this._onTargetCreated = this._onTargetCreated.bind(this);

apple502j

class Scratch3FaceSensingBlocks {
    constructor (runtime) {
    /**
     * The runtime instantiating this block package.
     * @type {Runtime}
     */
        this.runtime = runtime;
        this.runtime.emit('EXTENSION_DATA_LOADING', true);
        Blazeface.load().then(model => {
            this.blazeface = model;

apple502j

// ==UserScript==
// @name         Don't Load Project
// @description  Do not load project when reading comments
// @author       apple502j
// @match        https://scratch.mit.edu/projects/*
// ==/UserScript==

// Credit to Florrie
const destroyGUI = () => {
    const oldMap = Array.prototype.map;