User talk:Nx

I'm blocking you for removing content from pages. You knew this is a blocking offense because you saw Phantom Hoover's talk page. Proxima Centauri 15:34, 23 August 2009 (EDT)

You really are a pathetic, childish idiot, aren't you? Phantom Hoover 15:45, 23 August 2009 (EDT)

Is that a question for the general public? I'm finding it difficult to relate to your apparent sense of entitlement. Do you feel that you should enjoy privileges here which others should not? Lumenos 05:04, 4 September 2009 (EDT)

Or do you feel that due to your possibly superior knowledge of computers (or the number or dedication of your allies), that this enables you more control of this wiki, than the administration? Lumenos 05:04, 4 September 2009 (EDT)

No, it's just an observation based on Proxima's behaviour. Nx 06:19, 4 September 2009 (EDT)

Must you gentlemen be so abrasive? Lumenos 06:59, 4 September 2009 (EDT)

Hacking skills

I would be most delighted, if you might share with us (or me privately) any of your hacking skills. Could you say for example, crash the RationalWiki server? Lumenos 05:04, 4 September 2009 (EDT)

There were a few things that you claimed to be able to do here. Lumenos 05:07, 4 September 2009 (EDT)

Look at the code in Extension:Whosonline. It says "DELETE from $tblname WHERE username = '$username' OR timestamp < '$old' ". With a username like Robert' OR username like '%' -- aaa, this code becomes "DELETE from $tblname WHERE username = 'Robert' OR username like '%' -- aaa' OR timestamp < '$old' ". The problem is that the ' in the username is not handled correctly, and when passed to sql it is interpreted as the end of the username, and the rest of the username is interpreted as sql. The -- is a comment marker, it tells sql to disregard everything after that. In this case, it deletes every entry from the "online" table, so whosonline will show noone online. One way to cause harm would be: "DELETE from $tblname WHERE username = 'Robert'; drop table pages -- aaa' OR timestamp < '$old' ", which would delete all content on this wiki, but fortunately you cannot execute two sql queries with this command (the ; signals the end of the first query, and drop table pages is the second query). It would be possible to execute a subquery, and insert the result of the subquery into the username, to get some private information from the database. However mysql does not use the standard sql string concatenation operator ||, so that can't be done. The other option would be to get a numerical value, e.g. the token, because you can add together numbers. For example, I could manipulate whosonline so that instead of the real username, it displays '1' + (subquery returning number) - '1', so I could get your token, change my cookies manually, and I would be logged in as User:Lumenos. The only thing preventing me from doing that is that underscores (_) are used for field names in the user table (user_token, user_name), and those are converted to spaces in usernames when creating accounts, so the sql query doesn't work.

I don't know of a way to crash RationalWiki. All our custom extensions use the database functions provided by mediawiki (unlike whosonline, which accesses the database directly), and those are safeguarded against stuff like this. Of course there can be unknown vulnerabilities in either our custom code or mediawiki. Nx 06:18, 4 September 2009 (EDT)

Uuuh.... thanks. Let me see if I have an interpreter. Lumenos 06:35, 4 September 2009 (EDT)

Mr. Ernst

You said you emailed, em, is he still around? Lumenos 05:18, 4 September 2009 (EDT)

One of the admins I emailed replied, and said they were not active any more, and did not want to get involved. I think it was him. Nx 06:19, 4 September 2009 (EDT)

Did you notice...

10:29, 4 September 2009 Nx (Talk | contribs) (81 bytes) (Undid revision 70431 by Lumenos (talk) don't edit other's user page)

Phantom Hoovers edit on the Lumeniki article? Lumenos 06:32, 4 September 2009 (EDT)

So? Why does it matter? Lumeniki is not your user page, it can be edited by anyone. Well, unless you become a power abusive sysop like Proxima. Nx 06:33, 4 September 2009 (EDT)

I'm not sure you and MarkDilley share the same conventions. You might notice his edits on the policy page. Lumenos 06:44, 4 September 2009 (EDT)

I thought that Phantom's user page contained nothing very valuable (but perhaps a rather lame inside joke) and so I redirected to a page with some useful information. Is that so wrong? Lumenos 06:47, 4 September 2009 (EDT)

I don't know what Mark Dilley's opinion is, but at both RationalWiki and Wikipedia, editing other people's user pages without their permission is frowned upon. Nx 06:54, 4 September 2009 (EDT)

Thanks for the source. Wikipedia is quite important isn't it... ;-) Lumenos 07:01, 4 September 2009 (EDT)

You shouldn't edit other people's user pages for the same reason you shouldn't start rearranging someone's living room when they invite you in their house. It's not "Wikipedia does it this way, so we must do it the same way too", it's common courtesy. Nx 07:14, 4 September 2009 (EDT)

I gotcha. But we all buddies here you know. You guys know how to fix a little thing, if it's your living room or wiki or whatever. We may be able to write whatever policy we want. (I'm including you when I say "we".) Why not regard user pages just like the wiki articles? That they are to describe the person in the "perception of consensus"? Lumenos 07:24, 4 September 2009 (EDT)