1350
Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance (quokk.au)
submitted 3 days ago by to c/fediverse@lemmy.world
486 comments fedilink hide all child comments
 

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 2 days ago (2 children)

that is common usage to get a random number between two values in JS. as unintuitive as it looks it's just more maintainable like that, the code was prolly just minified

Math.random() * (max - min) + min

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random#getting_a_random_integer_between_two_values

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 2 days ago (1 child)

    That would make sense, but the "+ 1 - 1" both inside the patenethis don't, as he also has the "+ 1" outside. I assume ( making an ass of me along the way) he tried to write the formula you described from memory, but cocked it up a bit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 10 points 2 days ago (1 child)

    it's not exactly the formula i posted but the principle is kinda the same

    if u see it like this:

    let min = 1
let max = 100
let random = Math.floor(Math.random() * (max - min + 1)) + min

    the diff is that it's inclusive of max (bc of +1) and it always returns an integer (bc of Math.floor)

    btw not defending this abomination of a man in javascript language or anything lol

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 days ago* (last edited 2 days ago)

    I understand what is happening.

    I think that breaking a constant evaluated value into an expression that is still a constant comprised entirely of literals is bad.

    Extract the constants (100 and 1) to NAMED constants if you wanna do this.

    Edit: You also mentioned it might just be a side effect of a minifier. Maybe it is. I've got tons of grace if that's the case, since the dev has little if any control. Be like if I was roasting someone for what a compiler did.

    You're obviously the js expert, so I'll defer to you on expected minifier behavior, but there are 3 specific reasons that id be surprised (based on what I think a minifier should do)

    • there is a defined variable that already exists "random", i would any minifier worth it's salt to make the variable name smaller

    • since the expression (100 + 1 - 1) is a constant expression, I similarly would expect a minifier to reduce constant expressions to thier evaluated value (especially if the evaluated value is fewer characters than the expression) aka, just collapse to "100"

    • there is still a ton of extraneous whitespace

  • permalink
  • fedilink
  • source
  • parent