elevationan hour ago
I know some middle schoolers who are writing PHP apps. I could give them this game, but they don't deeply understand SQLi yet, for instance. Would you consider a mode that could be used to brief software-adjacent but security-ignorant students on the background of each attack style? This could be powerful as an education tool.
justusthane3 days ago
This is a ton of fun! Small suggestions:
- A way to copy (or better yet, email) a session link so I can switch between devices while maintaining my progress
- Allow 1 and 2 to function as hotkeys for Allow and Block, so I don't have to move between "a" and "b" for Allow and Block, and then the number keys for the block reasonjustusthane12 hours ago
Oh, also, change “Uptime” to “Availability”
athrowaway3z3 days ago
This is pretty cool, but at the same time i'm horrified that somebody might walk away thinking you need to deny these requests to protect against XSS or SQL injection.
Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.
Parse, dont validate. (And never interpret what shouldn't be)
pwdisswordfishq3 days ago
Though in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).
Synthetic73463 days ago
Yes, I believe the term is "output encoding"
agileAlligator3 days ago
I made a similar thing, but you are the LLM
doginasuit3 days ago
I enjoyed this!
agileAlligator3 days ago
Seems like a lot of people did. My free cloudflare limit ran out lol, it'll be a couple hours before it resets
nticompass3 days ago
So, it's "Papers, Please" but you're a firewall? I like it. Pretty cool.
Sander_Marechal3 days ago
Papers Please isn't really about the act of checking things. It's about the stories and moral choices. A lot of copycat games miss that point too.
elevation3 days ago
So this game needs a story arc where you become an accomplice to specific threat group to bring vigilante justice while maintaining plausible deniability by blocking some of their requests without letting your total numbers drop below a specific threshold?
Sander_Marechal2 days ago
That would be pretty cool actually :-D
pwdisswordfishq3 days ago
Why not both?
cryptonector2 days ago
In the first round one of the POSTs was to be rejected because it was supposed to contain JSON but contained something else; that should have been made a 400.
synotna2 days ago
You're acting as the firewall, not the application. That was not one of the rules for the day. In the first place a waf is specifically to stop malicious requests hitting the app.
cryptonectora day ago
That's true but not an argument for 403 over 400. Certainly either works. But one is more correct.
deadbabe3 days ago
Please keep the missed attacks on screen instead of rushing to the next request and just leaving some error log.
orthogonal_cube3 days ago
Only tested the first round but identifying SQL injections and XSS brings back memories. Fun project!
welldoneator3 days ago
This is really fun, I enjoyed it a ton!