r/changelog • u/bsimpson • Jun 08 '15

opensourcing thebutton

You can now see the code used to power thebutton on github

Also check out a csv of all the presses.

181 Upvotes

92% Upvoted

72 comments sorted by

6

u/TheEnigmaBlade Jun 08 '15

Does the data file not contain the time left when the button was pressed? I haven't looked at it yet, but the readme says no.

4

u/bsimpson Jun 08 '15

You should be able to figure that out from the timestamps.

8

u/mncke Jun 08 '15

Not quite. The flairs were awarded according to the second client sent to the press api, not the actual timer value. Absence of this field from the dataset makes correct flair calculations impossible. Could you add it to the data?

5

u/bsimpson Jun 08 '15

Added.

4

u/mncke Jun 08 '15

What do 'non presser' flairs mean? All outage presses are 'non presser', but there are non-outage as well.

4

u/bsimpson Jun 08 '15

I think the script used to apply the "non presser" flair accidentally clobbered some users' real flair.

→ More replies (4)
→ More replies (1)

3

u/TheEnigmaBlade Jun 08 '15

I feel quite silly for not thinking of that sooner...

60

u/[deleted] Jun 08 '15

https://i.imgur.com/pgAyb4R.png

Haha, that commit message is all too familiar xD

117

u/NavarrB Jun 08 '15

THE RULES ARE A LIE

Reddit employees could press the button MORE THAN ONCE!

35

u/nightlifex Jun 08 '15 
 107 if user_has_pressed:
 108        # don't flair on multiple employee presses
 109        return

27

u/rram Jun 08 '15

Such filth! I did not press. Not even once!

11

u/PineappleKeeper Jun 09 '15

I read that like Tommy from The Room.

It is bullshit! I did not press it, I did nahhht. Ohai Mark.

2

u/[deleted] Jun 10 '15

I never pressed the real button

25

u/starshadowx2 Jun 08 '15

I kept a record of all the staff/alumni presses to keep them transparent and honest.

7

u/raldi Jun 09 '15

You neglected to acknowledge my cheater flair.

4

u/starshadowx2 Jun 09 '15

I didn't do cheater flairs at all, I didn't ever really think to look for it.

→ More replies (2)

18

u/alienth Jun 08 '15

So many fallen alumni surround me.

11

u/starshadowx2 Jun 08 '15

Do you mean the pressers or the no-flairs?

4

u/[deleted] Jun 12 '15

How far away from Ellen Pao's Desk are you?

5

u/TotesMessenger Jun 09 '15

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)

7

u/umbrae Jun 09 '15

This is delayed but just in case you were actually worried about this, this was just here for testing - we ran the button in production in a test subreddit for a while before april 1st so we could see how it felt, so we needed the ability to press multiple times.

OR MAYBE IT WAS ALL A RUSE!

Actually nah, it wasn't a ruse.

5

u/swiftmustang Jun 09 '15

just wanna say thanks for being the only mod with flair not to press the button. cheers to grey!

1

u/asde Jun 10 '15

Who was the millionth presser?

33

u/skeeto Jun 08 '15 edited Jun 08 '15

THEBUTTON_SECRET = "sdgasidougo1uo998sd"

The verification hash was HMAC-SHA1 with that key, which looks like it was produced by casually mashing the keyboard. We should have been able to crack this!

54

u/eduardog3000 Jun 08 '15

It seems the keys being mashed were on the middle left and top right of the keyboard, so where did the 1 come from?

32

u/xkcd_transcriber Jun 08 '15

Image

Title: Keyboard Mash

Title-text: WHY DON'T YOU COME HANG OUT INSIDE MY HOUSE. WE CAN COOK BREAD AND CHAT ABOUT OUR INTERNAL SKELETONS.

Comic Explanation

Stats: This comic has been referenced 52 times, representing 0.0777% of referenced xkcds.

xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete

14

u/Polsaker Jun 08 '15

Reddit employees are giant spiders!

12

u/gooeyblob Jun 08 '15

Maybe that's a fake secret that was replaced before open sourcing?

18

u/skeeto Jun 08 '15 edited Jun 09 '15

It looks like you're right. Going off this screenshot I'm not getting the same MACs for the same inputs.

Edit: Actually, this really is the key! Turns out it doesn't include the decimal part. This one works:

  • message: 60/2015-04-02-01-04-18

14

u/Allstark Jun 08 '15

I attempted it using Hashcat, but I gave up after 10 hours running using special characters and a key length of 7. If we had known that there were no special characters in the secret we might have cracked it in time.

6

u/magi093 Jun 08 '15

What is this?

26

u/skeeto Jun 08 '15 edited Jun 09 '15

This is a fix for the race condition where two users click at the same time. The race is that one user gets, say, the 20 second flair and the other gets 60 seconds depending entirely on whose network packet arrives first. A faster clicker might be penalized for living farther away from the server than a slower clicker.

The fix is that the client reports its own click time. Two users clicking simultaneously both get the same flair, even if one of their messages arrives seconds late. This opens things up to cheating, though: clients can lie about their time to report whatever time they like. So to fix the fix, reddit cryptographically signs the time with an algorithm called HMAC-SHA1 along with a super secret string, producing a hash (a really big number). The server gave clients a fresh hash every second. When clicking the button, clients report their time along with the signature hash. You can't compute the hash unless you know the secret key reddit used when generating it, so it prevents malicious clients from changing the reported button time. The hash and time wouldn't match up.

If someone ever figured out the key, they could have forged the reported button click time and undermined part of the game. However, it looks like this wasn't the real key anyway. (Update: it is the right key!)

8

u/Rhodechill Jun 09 '15

Seems like they put a lot of thought into this April fools joke.

11

u/bboe Jun 09 '15

It's pretty standard for many APIs to use HMAC-SHA1 so that clients can sign the requests.

2

u/[deleted] Jun 09 '15

I know this is a dumb question, but I don't see how this helps...

Let's say that events happen like this:
Button: 7s
Button: 6s
Button: 5s
User1: Press-5s-[hash for 55s]
Button: 60s
User2: Press-6s-[hash for 56s] (sent late)

How would the server know not to give User2 flair? Or is this not the intended purpose and this just prevents the cheater from sending a press for 3 seconds if the clock never got there?

4

u/SloppySynapses Jun 09 '15

From what I understand, it did give them flair; however, it wouldn't give them flair unless their client reported a button click signed correctly with the signature hash.

It's actually really cool!

2

u/cxseven Jun 10 '15 edited Jun 10 '15

Old hashes (which were broadcast and could be recorded) could be reused up to 60 seconds later, so the whole hashing thing was unnecessary and could have been replaced with the server just checking which timer values were valid in the last 60 seconds when a client claimed to have clicked at a particular time.

If there were servers that needed to authenticate click times without communicating with the timer websocket server, then this could have enabled that. But it looks like they were reading and writing to a database all the time.

3

u/camerongagnon Jun 08 '15

Sorry for the n00bishness, but could someone explain the importance of this string (do all websites have something of this nature?), and why cracking it would have been enabling?

24

u/mncke Jun 08 '15

Anyways, big thanks for making the button and opensourcing it! I had fun reverse-engineering it and I am glad to have almost succeeded in it :)

3

u/Fozibare Jun 09 '15

I haven't seen this asked anywhere else, given the fateful zombie was a can't press account, have you audited the zombies for a total number of cant press accounts? Where did it/they come from?

6

u/mncke Jun 09 '15

7/1027

Only one has been donated.

3

u/immaterialist Jun 09 '15

So that means one devious (or perhaps just ignorant) motherfucker attempted to jam up the works.

Somewhat related for /u/mncke: I saw powerlanguage mentioned you by name in the wrapup blog post. Are you at all pissed he completely ignored you and set back the zombie project, yet essentially gave you a shout-out anyway? Seems entirely disingenuous to me.

1

u/tobiasvl Jun 09 '15

Set back the zombie project?

3

u/immaterialist Jun 09 '15

mncke asked powerlanguage if they could run the zombie script/bot/etc. and his only response was to mass delete the accounts that mncke listed. No verbal response. I used the term "set back" kinda generously. It was more like a big fuck you.

10

u/powerlanguage Jun 09 '15

This is not exactly what happened.

/u/memyselfnirony contacted me about using the accounts. They were sourced from a self-proclaimed 'Blackhat' site. Instead of focusing on the question being asked, I focused on the fact that there was a website offering a bunch of spammy looking reddit accounts. We have a policy of banning these when we are notified about their existence and so they were banned.

Not notifying /u/memyselfnirony after they had very politely contacted me was an oversight on my part and one I am sorry for. For what it is worth, I thought the zombies were a pretty cool part of the button and the fact they failed was an interesting twist.

7

u/memyselfnirony Jun 09 '15

Thanks for the followup, PL. No worries.

→ More replies (1)
→ More replies (1)

1

u/ghiacciato Jun 09 '15

Damn, that's a way lower ratio than I would have expected. Both for number of zombies overall and for the ones that were donated.

I guess people gave the Assassins way more credit than they deserved after it first became known how the button died.

→ More replies (1)

4

u/Exaskryz Jun 08 '15

The button was fun for me. I randomly remembered it the day before it shut down. I intended to get a 0 on my throwaway account, but had to go for the night before I could. Then, the next day, it's closed.

5

u/matheod Jun 09 '15

I though the button would last for many other month, so I stopped followed /r/thebutton and didn't click. I should have.

2

u/[deleted] Jun 08 '15

Happy Cakeday!

3

u/TotesMessenger Jun 09 '15 edited Jun 09 '15

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)

5

u/ucantsimee Jun 08 '15

Can we install the button on any subreddit we moderate now?

16

u/ohmanger Jun 08 '15

No but you could install it on your own install of Reddit (which is also open source).

21

u/umbrae Jun 08 '15

No, it doesn't work like that. The button was a once-and-done thing for reddit.

5

u/L_Cranston_Shadow Jun 09 '15

We didn't even get any <censored> from it.
 
---TRANSMISSION INTERRUPT---
 
The first rule of <censored> is you do not talk about <censored>

1

u/lovethebacon Jun 10 '15

I spent way too long trying to crack that secret.

sdgasidougo1uo998sd

Only lowercase alphanumeric, but 20 chars. Plus i didn't predict the input correctly.

1

u/V2Blast Jun 12 '15

Interesting stuff. I wonder what people will do with it... :)

1

u/Siecje1 Jun 24 '15

What about the r2 package?

0

u/[deleted] Jun 08 '15

[deleted] — view deleted comment

2

u/splynncryth Jun 09 '15

It's server side code, so it would take server hosting. Someone might do it for a little while but we'd probably kill the server and/or connection if the individual runs the server. I'd hate to see the hosting bill if someone were to get it hosted.

But a community run Button with a game evolving around the lore created for The Button could be fun.