scratchattach - A Scratch API wrapper (Python)

Digitat321

gem1001 wrote:
Digitat321 wrote:
Oisthebestletter wrote:
Digitat321 wrote:
W fr, also RIP zero-host.org
Just self host bro
ah yes I really want my laptop to run 24/7, overheat, start thermally throttling, probably crash, and consume unneeded amounts of energy
If your laptop does that, it has a problem

Well unneeded amounts of energy is common, my laptop is quite loud because i don't have a state of the art 2024 macbook or ultra-powerful/ultra-thin laptop like some people and long periods of local hosting are extremely unreliable for all.

gem1001

Digitat321 wrote:
Well unneeded amounts of energy is common, my laptop is quite loud because i don't have a state of the art 2024 macbook or ultra-powerful/ultra-thin laptop like some people and long periods of local hosting are extremely unreliable for all.

Mine is a 2022 netbook

Blaireau2012

Try using a Raspberry Pi

Digitat321

Blaireau2012 wrote:
Try using a Raspberry Pi

i don't have a raspberry pi, i have an old arm64 laptop but thats so slow and the modules might not even run.

Digitat321

does reading and writing turbowarp cloud variables require authentication like sa.login? i hope it does.

TechNerd64

Digitat321 wrote:
does reading and writing turbowarp cloud variables require authentication like sa.login? i hope it does.

I don't believe so

TW won't check credentials. Reading cloud vars is avalaible to everyone, but no anyone can write to them I believe.

Digitat321

i thought it checks for scratch account… hopefully, otherwise anyone can change info on the frontend and that could be uhhh not so good.

Digitat321

ill maybe make an authentication token between backend and frontend

TechNerd64

Digitat321 wrote:
i thought it checks for scratch account… hopefully, otherwise anyone can change info on the frontend and that could be uhhh not so good.

From the docs:

import scratchattach as sa
cloud = sa.get_tw_cloud("project_id") #replace with your project id

It never actually asks nor uses any credentials. Now on the turbowarp sight users can only assign real scratch usernames to themselves to prevent impersonation of people.

That's the sketchy part, is technically anyone can change variable values, unless the correct safe-guards are put in the scratch code.

Last edited by TechNerd64 (Sept. 5, 2026 16:04:44)

Digitat321

yeah, TW should really look into keeping their cloud variables secure. im gonna hope that no hacker is dedicated enough to try and hack into my project lol

TechNerd64

Digitat321 wrote:
yeah, TW should really look into keeping their cloud variables secure. im gonna hope that no hacker is dedicated enough to try and hack into my project lol

You could host your own cloud server using scratchattach, but that either requires finding a free cloud hosted server or exposing a port on a self-hosted machine.

Digitat321

someone can still access the cloud variables - uhh now i have to make a key-based encryption system, but who will actually hack into my scratchattach hobby project?

lavender_aesthetics-

i thought you have to enter your session id every time because of security

GvYoutube

lavender_aesthetics- wrote:
i thought you have to enter your session id every time because of security

No.

That is more insecure as the scripts sometimes are opensourced.

There are other methods of logging in.

TechNerd64

GvYoutube wrote:
lavender_aesthetics- wrote:
i thought you have to enter your session id every time because of security
No.

That is more insecure as the scripts sometimes are opensourced.

There are other methods of logging in.

I mean session_ids can be stored as environment variables so open sourced versions don't expose credentials.

TechNerd64

Does scratchattach support connecting to Turbowarp Placeholder-hosted projects? Placeholder has it's own project_id, I am just unsure on if anyone's tested it.

GvYoutube

TechNerd64 wrote:
Does scratchattach support connecting to Turbowarp Placeholder-hosted projects? Placeholder has it's own project_id, I am just unsure on if anyone's tested it.

I don't know…

I would assume not as it's probably a locally hosted thing when you go to the turbowarp site?

wvzack

TechNerd64 wrote:
Digitat321 wrote:
yeah, TW should really look into keeping their cloud variables secure. im gonna hope that no hacker is dedicated enough to try and hack into my project lol
You could host your own cloud server using scratchattach, but that either requires finding a free cloud hosted server or exposing a port on a self-hosted machine.

Im pretty aure cloudflare tunnels now have the capabilities to host a cloud server without exposing a port.

fiosjeofo

Digitat321 wrote:
Oisthebestletter wrote:
Digitat321 wrote:
W fr, also RIP zero-host.org
Just self host bro
ah yes I really want my laptop to run 24/7, overheat, start thermally throttling, probably crash, and consume unneeded amounts of energy

I have a raspberry pi it doesn't use much power. Maybe you can ask if anyone has a R Pi and for them to host it for you? (it's really sad that website went down :-( )

Digitat321

wvzack wrote:
TechNerd64 wrote:
Digitat321 wrote:
yeah, TW should really look into keeping their cloud variables secure. im gonna hope that no hacker is dedicated enough to try and hack into my project lol
You could host your own cloud server using scratchattach, but that either requires finding a free cloud hosted server or exposing a port on a self-hosted machine.
Im pretty aure cloudflare tunnels now have the capabilities to host a cloud server without exposing a port.

No but someone can just connect to the turbowarp projects variables and modify them, and display stuff which i don't want to be displayed

Discuss Scratch