Readit NewsCurious if you were inspired by Lego's build-a-fish* exhibit at the Lego House? I visited recently and it is ridiculously addictive to see a fish you create swim with others :)
POST https://fishes-be-571679687712.northamerica-northeast1.run.a... {"fishId":"xxxx","vote":"up"}
Is there some sort of overlap between HN and cesspits like 4chan? Or did this get posted elsewhere?
Anyway, working on the rollback now. A nice guy from here reached out and reported some small vulns I involuntarily committed.
Uncaught (in promise) Error: Fish model not loaded verifyFishDoodle https://drawafish.com/src/js/app.js:514 <anonymous> https://drawafish.com/src/js/app.js:170 EventListener.handleEvent* https://drawafish.com/src/js/app.js:168
Edit: Never mind, I had to wait till the model loaded. Took some time though. Fun project nevertheless!
(jk)
This is definitely a drawback with with vibe-coding. I never really write like HTML5 style code - at work I always use typescript with heavy ESLint, so never have to worry about this.
I figured the string sanitization in the backend would take care of any XSS vulns, which was my main concern. But I will have to read into the dangers of string interpolation which I admit I do not remember too much about (outside of the XSS stuff I tried to mitigate).
Thanks for giving the opportunity to learn... :)
> I built a basic CNN trained against penises
After seeing it in action, my second thought (first was just watching my fish) was that I was amazed at the good behavior of the users because I would have expected a lot of penises floating around. Now I understand. Nicely done!
The code shows it... Your escaping routine seems OK, but you really __should not__ be building HTML and JS(!) using raw string interpolation. Or letting the client decide whether the submission needs moderation.
There's a very slightly different model in the backend that sends things to the mod queue. Strings are also sanitized there. But copilot really wanted to add all that logic to the frontend too and I thought it was funny
Added :) https://aldenhallak.com/blog/rss.xml