Requests, Please

Posted by sysoleg 3 days ago

Comments

Comment by athrowaway3z 4 hours ago

This is pretty cool, but at the same time i'm horrified that somebody might walk away thinking you need to deny these requests to protect against XSS or SQL injection.

Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.

Parse, dont validate. (And never interpret what shouldn't be)

Comment by pwdisswordfishq 4 hours ago

Though in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).

Comment by Synthetic7346 3 hours ago

Yes, I believe the term is "output encoding"

Comment by justusthane 5 hours ago

This is a ton of fun! Small suggestions:

    - A way to copy (or better yet, email) a session link so I can switch between devices while maintaining my progress
    - Allow 1 and 2 to function as hotkeys for Allow and Block, so I don't have to move between "a" and "b" for Allow and Block, and then the number keys for the block reason

Comment by agileAlligator 5 hours ago

I made a similar thing, but you are the LLM

https://avneeshk.me/you-are-the-model/

Comment by doginasuit 4 hours ago

I enjoyed this!

Comment by agileAlligator 3 hours ago

Seems like a lot of people did. My free cloudflare limit ran out lol, it'll be a couple hours before it resets

Comment by nticompass 6 hours ago

So, it's "Papers, Please" but you're a firewall? I like it. Pretty cool.

Comment by Sander_Marechal 4 hours ago

Papers Please isn't really about the act of checking things. It's about the stories and moral choices. A lot of copycat games miss that point too.

Comment by elevation 4 hours ago

So this game needs a story arc where you become an accomplice to specific threat group to bring vigilante justice while maintaining plausible deniability by blocking some of their requests without letting your total numbers drop below a specific threshold?

Comment by Sander_Marechal 2 hours ago

That would be pretty cool actually :-D

Comment by pwdisswordfishq 4 hours ago

Why not both?

Comment by orthogonal_cube 5 hours ago

Only tested the first round but identifying SQL injections and XSS brings back memories. Fun project!

Comment by welldoneator 5 hours ago

This is really fun, I enjoyed it a ton!

Comment by deadbabe 3 hours ago

Please keep the missed attacks on screen instead of rushing to the next request and just leaving some error log.