Turing 0.0.7 && cry for help


#1

Hello all,

I have just released a new library for Ruby:

http://turing.rubyforge.org/

Turing is implementation of Captcha (Completely Automated Public
Turing-Test
to Tell Computers and Humans Apart) that is both easy to use and easy to
customize/extend.

It makes use of the excellent Ruby/GD2 gem released by Robert Leslie.

At this time there are three levels of abstraction you can use:

  • Turing::Image - Simple obfuscated image generator with plugin design.

    ti = Turing::Image.new(:width => 280, :height => 115)
    ti.generate(File.join(Dir.getwd, ‘a.jpg’), “randomword”)

  • Turing::Challenge: Captcha challenge generator and verifier.

    tc = Turing::Challenge.new(:store => ‘store’, :outdir => ‘.’)
    c = tc.generate_challenge

    system(“xv”, c.file)

    puts “Enter solution:”
    r = $stdin.gets.chomp

    if tc.valid_answer?(c.id, r)
    puts “That’s right.”
    else
    puts “I don’t think so.”
    end

  • Turing::CGIHandler: Simple Turing::Challenge wrapper designed to run
    as CGI.

    tcgi_config = {
    :imagepath => “/imgs”,
    :outdir => ‘/home/wejn/ap/htdocs/imgs’,
    :store => ‘/home/wejn/ap/data/turing.pstore’,
    :redirect_to => ‘http://localhost:8000/secured/’,
    }
    tcgi_config[:on_success] = proc do
    out = {}
    out[:headers] = {
    “cookie” => CGI::Cookie.new({
    ‘name’ => ‘turing_passed’,
    ‘value’ => ‘true’,
    ‘path’ => ‘/’,
    ‘expires’ => Time.now + 3600*24,
    }),
    “dude” => “you_rock!”,
    }
    out
    end
    Turing::CGIHandler.new(tcgi_config).handle

You can find ®doc, gem and samples via the site mentioned above.

Rg,
Michal S.

PS: This is my cry for help: I’m looking for volunteer to help me
perform end-user (and performance) test of Apache2 drop-in
replacement
for mod_auth that prevents (among other things)
dictionary/bruteforce
attacks against credentials. If it sounds like fun, please check out
details: http://wejn.org/ta-rt.html


#2

Oh well :-/

Fixed bug in CGIHandler, so version 0.0.8 is out.

Also you can check out demo of CGIHandler here:

http://wejn.org/te/

M.


#3

On Sun, 2005-11-27 at 07:42 +0900, Michal wrote:

Oh well :-/

Fixed bug in CGIHandler, so version 0.0.8 is out.

Hm, you may want to do a 0.0.9… I think your gem was built with Ruby
1.8.3 and thus is experiencing this problem:

http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/161508

Yours,

Tom


#4

yeah, it was :frowning: Is this bug fixed in 1.8.4_preview1 ?
Or – is there a way to diagnose/fix the problem for 1.8.3 ?
I would prefer not to downgrade to 1.8.2 if there’s a way.
You can patch rubygems/builder.rb with
http://rubyforge.org/tracker/index.php?func=detail&aid=2885&group_id=126&atid=577


#5

Hi,

You can patch rubygems/builder.rb with
http://rubyforge.org/tracker/index.php?func=detail&aid=2885&group_id=126&atid=577

excellent! Thanks!

Just released 0.0.9:
http://rubyforge.org/frs/shownotes.php?release_id=3633

Oh, and I added it to Rakefile so no /usr/lib/ruby/…/rubygems changes
are necessary :wink:

If anyone is interested, the trick is overriding to_yaml method:

def spec.to_yaml
out = super
out = '— ’ + out unless out =~ /^—/
out
end

on Gem::Specification instance :slight_smile: God bless Ruby’s open classes :slight_smile:

Rg,
M.


#6

Hi,

Hm, you may want to do a 0.0.9… I think your gem was built with Ruby
1.8.3 and thus is experiencing this problem:

http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/161508

yeah, it was :frowning: Is this bug fixed in 1.8.4_preview1 ?
Or – is there a way to diagnose/fix the problem for 1.8.3 ?
I would prefer not to downgrade to 1.8.2 if there’s a way.

Rg,
M.


#7

I hope your not using

“cookie” => CGI::Cookie.new({
‘name’ => ‘turing_passed’,
‘value’ => ‘true’,
‘path’ => ‘/’,
‘expires’ => Time.now + 3600*24,
}),

to test if the user is authenticated.

On 27/11/05, Michal removed_email_address@domain.invalid wrote:

are necessary :wink:

Rg,
M.

Michal Safranek, email:

a=((“a”…“z”).to_a+["@","."]);p(("%b"%[0x645bbb83a6a496]
).scan(/…/).map{|x|a[Integer(“0b”+x)]}.join.reverse)


Cheers,
zimba

http://zimba.oree.ch


#8

Can someone show me a code snippet, including require ‘…’ for
deflating a
string with Zlib?
Thanks in advance
John B


#9

Hi,

Can someone show me a code snippet, including require ‘…’
for deflating a string with Zlib?

how about this:

require ‘zlib’

Zlib::Deflate.deflate(“abc”)

=> “x\234KLJ\006\000\002M\001’”

Zlib::Deflate.deflate(“a”*5000)

=>

“x\234\355\3011\001\000\000\000\302\240\254\353_\302\024~@\001\000\000\000\000o\003Kof\362”

Zlib::Inflate.inflate(Zlib::Deflate.deflate(“a”*5000)).size

=> 5000

M.


#10

Excerpt from http://turing.rubyforge.org/classes/Turing/CGIHandler.html
:

Please note: Using this script verbatim is like having no turing
challenge
at all – any non-braindead attacker will get around it in no time.

M.


#11

On Sunday 27 November 2005 17:12, Ross B. wrote:

On Sun, 27 Nov 2005 12:05:35 -0000, Michal removed_email_address@domain.invalid
wrote:
[…]

Rg,
M.

Amen to that :). I’ve been hit with this same problem I think, so
thanks all from me too :slight_smile:

Great! Rant uses this trick now, too.

Thankfully,
Stefan


#12

On Sun, 27 Nov 2005 12:05:35 -0000, Michal removed_email_address@domain.invalid
wrote:

Oh, and I added it to Rakefile so no /usr/lib/ruby/…/rubygems changes
on Gem::Specification instance :slight_smile: God bless Ruby’s open classes :slight_smile:

Rg,
M.

Amen to that :). I’ve been hit with this same problem I think, so thanks
all from me too :slight_smile:


#13

On Monday 28 November 2005 08:27 am, Tobias L. wrote:

Great work on the library!

On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

E.g: don’t use captchas, they are evil.

Not really. Captchas which work properly are protection from automation
bots.
I recommend taking some time to explore security and how damage may be
caused
as an effect of not having any protection at all. This is the real world
we
live in, not Pleasantville.

On 11/26/05, Michal removed_email_address@domain.invalid wrote:

Hello all,

I have just released a new library for Ruby:

http://turing.rubyforge.org/

Great! :slight_smile: This is a nice library to have for protecting sites.

Tsume


#14

Quoting T. removed_email_address@domain.invalid:

Not really. Captchas which work properly are protection from
automation bots.

Indeed. Everybody knows the blind eat old people’s medicine for
fuel.

For many sites, excluding the blind doesn’t constitute “working
properly”.

-mental


#15

Great work on the library!

On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

E.g: don’t use captchas, they are evil.


#16

Hi,

On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.

I’m willing to implement any reasonable protocol that will help disabled
people to successfully pass this authentication – right now I’m just
a tad confused what it should be? Any good ideas/references?

Rg,
Michal

PS: This is my cry for help again: I’m still looking for volunteer to
help me perform end-user (and performance) test of Apache2 drop-in
replacement for mod_auth that prevents (among other things)
dictionary
(and bruteforce) attacks against credentials. If it sounds like fun,
please check out details: http://wejn.org/ta-rt.html


#17

On Mon, 28 Nov 2005, Michal wrote:

Hi,

On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.

I don’t quite understand this.

You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”

So I must have misunderstood you, surely?
Hugh


#18

On Mon, 28 Nov 2005, Michal wrote:

Hi,

You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”

Nah, what I really mean is something like:

I developed this for my Master’s thesis and I expect it to be used
(by me) at servers that have mostly “visual” content, thus I didn’t
have to work on this issue in the first version.

Some consideration of accessibility issues might be a good thing to
write up, even if you don’t have time to address them. [“Audio
description”, “tactile maps”, “Living Paintings Trust” ] is probably
a sufficient list to get you started on accessibility techniques for
visual media.

Since I released it to public, I’m more than willing to make necessary
changes to the code to support other authentication methods – I’m
just not sure what it should be (or how to implement “aural” captcha
for example).

Well, one possiblity is textual only, accessible to deafblind people
as well:

http://www.rubyquiz.com/quiz48.html

I don’t know what your website is for but there has been quite a bit
of work on voice browsers, and that is for sighted people.
http://www.w3.org/Voice/

I’m open to any suggestions and/or patches.

Sounds better?

Rg,
Michal

    HTH
    Hugh

#19

Hi,

On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.

I don’t quite understand this.

it might be b/c English is not my first language?

You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”

Nah, what I really mean is something like:

I developed this for my Master’s thesis and I expect it to be used
(by me) at servers that have mostly “visual” content, thus I didn’t
have to work on this issue in the first version.

Since I released it to public, I’m more than willing to make necessary
changes to the code to support other authentication methods – I’m
just not sure what it should be (or how to implement “aural” captcha
for example).

I’m open to any suggestions and/or patches.

Sounds better?

Rg,
Michal


#20

What am i doing wrong? the text being rendered is very very small.
I have posted an example on www.reapfuels.co.uk,

any ideas?

Thank you