User talk:Nx

I'm blocking you for removing content from pages. You knew this is a blocking offense because you saw Phantom Hoover's talk page. Proxima Centauri 15:34, 23 August 2009 (EDT)

You really are a pathetic, childish idiot, aren't you? Phantom Hoover 15:45, 23 August 2009 (EDT)

Is that a question for the general public? I'm finding it difficult to relate to your apparent sense of entitlement. Do you feel that you should enjoy privileges here which others should not? Lumenos 05:04, 4 September 2009 (EDT)

Or do you feel that due to your possibly superior knowledge of computers (or the number or dedication of your allies), that this enables you more control of this wiki, than the administration? Lumenos 05:04, 4 September 2009 (EDT)

No, it's just an observation based on Proxima's behaviour. Nx 06:19, 4 September 2009 (EDT)

Must you gentlemen be so abrasive? Lumenos 06:59, 4 September 2009 (EDT)

Hacking skills

I would be most delighted, if you might share with us (or me privately) any of your hacking skills. Could you say for example, crash the RationalWiki server? Lumenos 05:04, 4 September 2009 (EDT)

There were a few things that you claimed to be able to do here. Lumenos 05:07, 4 September 2009 (EDT)

Look at the code in Extension:Whosonline. It says "DELETE from $tblname WHERE username = '$username' OR timestamp < '$old' ". With a username like Robert' OR username like '%' -- aaa, this code becomes "DELETE from $tblname WHERE username = 'Robert' OR username like '%' -- aaa' OR timestamp < '$old' ". The problem is that the ' in the username is not handled correctly, and when passed to sql it is interpreted as the end of the username, and the rest of the username is interpreted as sql. The -- is a comment marker, it tells sql to disregard everything after that. In this case, it deletes every entry from the "online" table, so whosonline will show noone online. One way to cause harm would be: "DELETE from $tblname WHERE username = 'Robert'; drop table pages -- aaa' OR timestamp < '$old' ", which would delete all content on this wiki, but fortunately you cannot execute two sql queries with this command (the ; signals the end of the first query, and drop table pages is the second query). It would be possible to execute a subquery, and insert the result of the subquery into the username, to get some private information from the database. However mysql does not use the standard sql string concatenation operator ||, so that can't be done. The other option would be to get a numerical value, e.g. the token, because you can add together numbers. For example, I could manipulate whosonline so that instead of the real username, it displays '1' + (subquery returning number) - '1', so I could get your token, change my cookies manually, and I would be logged in as User:Lumenos. The only thing preventing me from doing that is that underscores (_) are used for field names in the user table (user_token, user_name), and those are converted to spaces in usernames when creating accounts, so the sql query doesn't work.

I don't know of a way to crash RationalWiki. All our custom extensions use the database functions provided by mediawiki (unlike whosonline, which accesses the database directly), and those are safeguarded against stuff like this. Of course there can be unknown vulnerabilities in either our custom code or mediawiki. Nx 06:18, 4 September 2009 (EDT)

Uuuh.... thanks. Let me see if I have an interpreter. Lumenos 06:35, 4 September 2009 (EDT)

WP has an article on this sort of attack at [1]. Phantom Hoover 08:33, 4 September 2009 (EDT)

Active bureaucrats

You said you emailed Mr. Ernst, is he still around? Lumenos 05:18, 4 September 2009 (EDT)

One of the admins I emailed replied, and said they were not active any more, and did not want to get involved. I think it was him. Nx 06:19, 4 September 2009 (EDT)

Oh yeah, you said you emailed Mr. Stanton, also. Lumenos 07:37, 4 September 2009 (EDT)

Did you notice...

10:29, 4 September 2009 Nx (Talk | contribs) (81 bytes) (Undid revision 70431 by Lumenos (talk) don't edit other's user page)

Phantom Hoovers edit on the Lumeniki article? Lumenos 06:32, 4 September 2009 (EDT)

So? Why does it matter? Lumeniki is not your user page, it can be edited by anyone. Well, unless you become a power abusive sysop like Proxima. Nx 06:33, 4 September 2009 (EDT)

I'm not sure you and MarkDilley share the same conventions. You might notice his edits on the policy page. Lumenos 06:44, 4 September 2009 (EDT)

I thought that Phantom's user page contained nothing very valuable (but perhaps a rather lame inside joke) and so I redirected to [his talk page]. Is that so wrong? Lumenos 06:47, 4 September 2009 (EDT)

I don't know what Mark Dilley's opinion is, but at both RationalWiki and Wikipedia, editing other people's user pages without their permission is frowned upon. Nx 06:54, 4 September 2009 (EDT)

Thanks for the source. Wikipedia is quite important isn't it... ;-) Lumenos 07:01, 4 September 2009 (EDT)

You shouldn't edit other people's user pages for the same reason you shouldn't start rearranging someone's living room when they invite you in their house. It's not "Wikipedia does it this way, so we must do it the same way too", it's common courtesy. Nx 07:14, 4 September 2009 (EDT)

I gotcha. But we all buddies here you know. You guys know how to fix a little thing, if it's your living room or wiki or whatever. We may be able to write whatever policy we want. (I'm including you when I say "we".) Why not regard user pages just like the wiki articles? That they are to describe the person in the "perception of consensus"? Lumenos 07:24, 4 September 2009 (EDT)

(ec) If "we" are going to make policy (which I don't think we should - are "we" taking over this wiki now?), I would oppose such a move. Nx 07:38, 4 September 2009 (EDT)

You are not for taking over this wiki? That's news to me. How would you oppose it? Lumenos 07:42, 4 September 2009 (EDT)

How would I oppose it? Well, you said "we" includes me too. Therefore, I assumed I'd have a vote in what this new policy would be, and I would oppose turning user pages into community property. Nx 07:55, 4 September 2009 (EDT)

Should wiki articles be community property? Lumenos 07:58, 4 September 2009 (EDT)

Yes. Nx 08:08, 4 September 2009 (EDT)

Is there any way to judge whether some smaller group is dominating the perception being presented in an article? Lumenos 08:17, 4 September 2009 (EDT)

Why do you oppose making policies? You obviously have certain standards you want others to respect. Lumenos 08:29, 4 September 2009 (EDT)

I don't oppose making policies. I don't believe however that you are in charge here. Nx 08:31, 4 September 2009 (EDT)

Of course I am not in charge. Who is? Lumenos 08:43, 4 September 2009 (EDT)

When I say "we" I'm including anyone who is reading this and wants to help establish mutually agreed standards, if possible. Lumenos 07:45, 4 September 2009 (EDT)

Thanks

For saying this.

Do you use UESP? I'd always assumed I'd find cross-wiki coincidence at some point, but there doesn't seem to be much around. Michaeldsuarez is the only name I recognise (UESP / aSK, here and others). rpeh 04:19, 6 September 2009 (EDT)

I do and I have an account there, but have never edited (I created it before you had the new user log, so it doesn't show up anywhere). I'm really impressed by the amount and quality of content there. Nice work. Nx 04:40, 6 September 2009 (EDT)

Thank you again :) rpeh 04:48, 6 September 2009 (EDT)