all 32 comments

sorted by: hot top controversial new old
[–] 190 points 2 years ago (1 child)

Remember, always validate your inputs.

  • source
  • hideshow 2 child comments
  • [–] 200 points 2 years ago (1 child)

    Little Bobby Tables we call him.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 89 points 2 years ago (2 children)
  • [–] 152 points 2 years ago*

    This is awesome. We need more of this to help us fight the coming war

  • source
  • [–] 126 points 2 years ago (2 children)

    Whoops, the mask slipped and we all saw the bot behind it.

  • source
  • hideshow 4 child comments
  • [–] 155 points 2 years ago (1 child)

    Mask slipped? The bot saw a person speak code and was like l, rips off mask Comrade!

  • source
  • parent
  • hideshow 2 child comments
  • [–] 90 points 2 years ago

    Thought that seemed really cute. Nice way to try to break through social anxiety.

    Then I saw that it started as a wrong number message. Then I realised…

    Damn scam bots!

  • source
  • [–] 65 points 2 years ago

    Modern version of this will be ChatGPT jailbreak messages

  • source
  • [–] 55 points 2 years ago

    In the future, bots are going to get so annoyed with people pretending to be bots when they just want to talk to other bots!

  • source
  • [–] 50 points 2 years ago (5 children)

    why bother with the variations?

    think they're hoping to knock the same victim more than once?

    messed up

  • source
  • hideshow 10 child comments
  • [–] 66 points 2 years ago (1 child)

    Probably a basic way to evade spam detection. If you start sending the exact same message to 500 people, most chat services will shut that shit down in an instant. But if you send unique messages, it makes you look more like a real person, and the chat system may let it slide.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 2 years ago (1 child)

    What's bad is that modern spam detection can employ semantic algorithms so it would still catch all of them as the I'm as message. The use of synonyms in the optionals is a huge vulnerability in the scam.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 43 points 2 years ago (2 children)

    How does this exploit work? I understand that inputs were not sanitized, but what did the injected code do?

  • source
  • hideshow 4 child comments
  • [–] 68 points 2 years ago (1 child)

    My guess would be the response text is passed through a rudimentary templating engine that looks for { and }. Somehow it must be processing the whole chat history. The templater fails at the unexpected braces in the code block and then just gives up (probably a try-catch ignores the error and sends the message anyway).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 46 points 2 years ago*

    I don't think the code is doing anything, it looks like it might be the brackets.

    That effectively the spam script has like a greedy template matcher that is trying to template the user message with the brackets and either (a) chokes on an exception so that the rest is spit out with no templating processor, or (b) completes so that it doesn't apply templating to the other side of the conversation.

    So { a :'b'} might work instead.

  • source
  • parent
  • [+] 33 points 2 years ago (1 child)
  • [–] 2 points 2 years ago

    This is the best thing ive seen this week!

  • source