[ANN] Turing 0.0.7 && cry for help

M

Michal

Hello all,

I have just released a new library for Ruby:

http://turing.rubyforge.org/

Turing is implementation of Captcha (Completely Automated Public Turing-Test
to Tell Computers and Humans Apart) that is both easy to use and easy to
customize/extend.


It makes use of the excellent Ruby/GD2 gem released by Robert Leslie.


At this time there are three levels of abstraction you can use:

* Turing::Image - Simple obfuscated image generator with plugin design.

ti = Turing::Image.new:)width => 280, :height => 115)
ti.generate(File.join(Dir.getwd, 'a.jpg'), "randomword")

* Turing::Challenge: Captcha challenge generator and verifier.

tc = Turing::Challenge.new:)store => 'store', :eek:utdir => '.')
c = tc.generate_challenge

system("xv", c.file)

puts "Enter solution:"
r = $stdin.gets.chomp

if tc.valid_answer?(c.id, r)
puts "That's right."
else
puts "I don't think so."
end

* Turing::CGIHandler: Simple Turing::Challenge wrapper designed to run as CGI.

tcgi_config = {
:imagepath => "/imgs",
:eek:utdir => '/home/wejn/ap/htdocs/imgs',
:store => '/home/wejn/ap/data/turing.pstore',
:redirect_to => 'http://localhost:8000/secured/',
}
tcgi_config[:eek:n_success] = proc do
out = {}
out[:headers] = {
"cookie" => CGI::Cookie.new({
'name' => 'turing_passed',
'value' => 'true',
'path' => '/',
'expires' => Time.now + 3600*24,
}),
"dude" => "you_rock!",
}
out
end
Turing::CGIHandler.new(tcgi_config).handle

You can find (r)doc, gem and samples via the site mentioned above.

Rg,
Michal S.

PS: This is my cry for help: I'm looking for volunteer to help me
perform end-user (and performance) test of Apache2 drop-in replacement
for mod_auth that prevents (among other things) dictionary/bruteforce
attacks against credentials. If it sounds like fun, please check out
details: http://wejn.org/ta-rt.html
 
M

Michal

Oh well :-/

Fixed bug in CGIHandler, so version 0.0.8 is out.

Also you can check out demo of CGIHandler here:

http://wejn.org/te/

M.

Hello all,

I have just released a new library for Ruby:

http://turing.rubyforge.org/

Turing is implementation of Captcha (Completely Automated Public Turing-Test
to Tell Computers and Humans Apart) that is both easy to use and easy to
customize/extend.


It makes use of the excellent Ruby/GD2 gem released by Robert Leslie.


At this time there are three levels of abstraction you can use:

* Turing::Image - Simple obfuscated image generator with plugin design.

ti = Turing::Image.new:)width => 280, :height => 115)
ti.generate(File.join(Dir.getwd, 'a.jpg'), "randomword")

* Turing::Challenge: Captcha challenge generator and verifier.

tc = Turing::Challenge.new:)store => 'store', :eek:utdir => '.')
c = tc.generate_challenge

system("xv", c.file)

puts "Enter solution:"
r = $stdin.gets.chomp

if tc.valid_answer?(c.id, r)
puts "That's right."
else
puts "I don't think so."
end

* Turing::CGIHandler: Simple Turing::Challenge wrapper designed to run as CGI.

tcgi_config = {
:imagepath => "/imgs",
:eek:utdir => '/home/wejn/ap/htdocs/imgs',
:store => '/home/wejn/ap/data/turing.pstore',
:redirect_to => 'http://localhost:8000/secured/',
}
tcgi_config[:eek:n_success] = proc do
out = {}
out[:headers] = {
"cookie" => CGI::Cookie.new({
'name' => 'turing_passed',
'value' => 'true',
'path' => '/',
'expires' => Time.now + 3600*24,
}),
"dude" => "you_rock!",
}
out
end
Turing::CGIHandler.new(tcgi_config).handle

You can find (r)doc, gem and samples via the site mentioned above.

Rg,
Michal S.

PS: This is my cry for help: I'm looking for volunteer to help me
perform end-user (and performance) test of Apache2 drop-in replacement
for mod_auth that prevents (among other things) dictionary/bruteforce
attacks against credentials. If it sounds like fun, please check out
details: http://wejn.org/ta-rt.html
 
M

Michal

Hi,

excellent! Thanks!

Just released 0.0.9: http://rubyforge.org/frs/shownotes.php?release_id=3633

Oh, and I added it to Rakefile so no /usr/lib/ruby/.../rubygems changes
are necessary ;)

If anyone is interested, the trick is overriding to_yaml method:

def spec.to_yaml
out = super
out = '--- ' + out unless out =~ /^---/
out
end

on Gem::Specification instance :) God bless Ruby's open classes :)

Rg,
M.
 
Z

zimba-tm

I hope your not using

"cookie" =3D> CGI::Cookie.new({
'name' =3D> 'turing_passed',
'value' =3D> 'true',
'path' =3D> '/',
'expires' =3D> Time.now + 3600*24,
}),

to test if the user is authenticated.
 
S

speechexpert

Can someone show me a code snippet, including require '...' for deflating a
string with Zlib?
Thanks in advance
John B
 
M

Michal

Hi,
Can someone show me a code snippet, including require '...'
for deflating a string with Zlib?

how about this:

require 'zlib'

Zlib::Deflate.deflate("abc")
# => "x\234KLJ\006\000\002M\001'"
Zlib::Deflate.deflate("a"*5000)
# => "x\234\355\3011\001\000\000\000\302\240\254\353_\302\024~@\001\000\000\000\000o\003Kof\362"

Zlib::Inflate.inflate(Zlib::Deflate.deflate("a"*5000)).size
# => 5000

M.
 
R

Ross Bamford

Hi,


excellent! Thanks!

Just released 0.0.9:
http://rubyforge.org/frs/shownotes.php?release_id=3633

Oh, and I added it to Rakefile so no /usr/lib/ruby/.../rubygems changes
are necessary ;)

If anyone is interested, the trick is overriding to_yaml method:

def spec.to_yaml
out = super
out = '--- ' + out unless out =~ /^---/
out
end

on Gem::Specification instance :) God bless Ruby's open classes :)

Rg,
M.

Amen to that :). I've been hit with this same problem I think, so thanks
all from me too :)
 
S

Stefan Lang

[...]
If anyone is interested, the trick is overriding to_yaml method:

def spec.to_yaml
out = super
out = '--- ' + out unless out =~ /^---/
out
end

on Gem::Specification instance :) God bless Ruby's open classes
:)

Rg,
M.

Amen to that :). I've been hit with this same problem I think, so
thanks all from me too :)

Great! Rant uses this trick now, too.

Thankfully,
Stefan
 
T

Tobias Luetke

Great work on the library!

On a semi-ontopic post i'd like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

E.g: don't use captchas, they are evil.
 
T

Tsume

Great work on the library!

On a semi-ontopic post i'd like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

E.g: don't use captchas, they are evil.

Not really. Captchas which work properly are protection from automation bots.
I recommend taking some time to explore security and how damage may be caused
as an effect of not having any protection at all. This is the real world we
live in, not Pleasantville.

Great! :) This is a nice library to have for protecting sites.

Tsume
 
M

Michal

Hi,
On a semi-ontopic post i'd like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.

well, I'm aware of this issue ... I just didn't need to solve it right
away because the site(s) I'll be deploying this on are mostly "visual",
so having seeing disabilities is deal breaker anyway.

I'm willing to implement any reasonable protocol that will help disabled
people to successfully pass this authentication -- right now I'm just
a tad confused what it should be? Any good ideas/references?

Rg,
Michal

PS: This is my cry for help again: I'm still looking for volunteer to
help me perform end-user (and performance) test of Apache2 drop-in
replacement for mod_auth that prevents (among other things) dictionary
(and bruteforce) attacks against credentials. If it sounds like fun,
please check out details: http://wejn.org/ta-rt.html
 
H

Hugh Sasse

Hi,


well, I'm aware of this issue ... I just didn't need to solve it right
away because the site(s) I'll be deploying this on are mostly "visual",
so having seeing disabilities is deal breaker anyway.

I don't quite understand this.

You appear to be saying: "It's OK for my package to discriminate
against blind people, because I'm going to be doing that anyway."

So I must have misunderstood you, surely?
Hugh
 
M

Michal

Hi,
I don't quite understand this.

it might be b/c English is not my first language?
You appear to be saying: "It's OK for my package to discriminate
against blind people, because I'm going to be doing that anyway."

Nah, what I really mean is something like:

I developed this for my Master's thesis and I expect it to be used
(by me) at servers that have mostly "visual" content, thus I didn't
have to work on this issue in the first version.

Since I released it to public, I'm more than willing to make necessary
changes to the code to support other authentication methods -- I'm
just not sure what it should be (or how to implement "aural" captcha
for example).

I'm open to any suggestions and/or patches.

Sounds better?

Rg,
Michal
 
H

Hugh Sasse

Hi,


Nah, what I really mean is something like:

I developed this for my Master's thesis and I expect it to be used
(by me) at servers that have mostly "visual" content, thus I didn't
have to work on this issue in the first version.

Some consideration of accessibility issues might be a good thing to
write up, even if you don't have time to address them. ["Audio
description", "tactile maps", "Living Paintings Trust" ] is probably
a sufficient list to get you started on accessibility techniques for
visual media.
Since I released it to public, I'm more than willing to make necessary
changes to the code to support other authentication methods -- I'm
just not sure what it should be (or how to implement "aural" captcha
for example).

Well, one possiblity is textual only, accessible to deafblind people
as well:

http://www.rubyquiz.com/quiz48.html


I don't know what your website is for but there has been quite a bit
of work on voice browsers, and that is for sighted people.
http://www.w3.org/Voice/
I'm open to any suggestions and/or patches.

Sounds better?

Rg,
Michal

HTH
Hugh
 

Members online

No members online now.

Forum statistics

Threads
473,755
Messages
2,569,534
Members
45,008
Latest member
Rahul737

Latest Threads

Top