Slashdot Mirror
Gaming Foursquare With 9 Lines of Perl
caffeinemessiah writes "With the recent launch of Facebook Places, the rise to prominence of Foursquare and GoWalla, and articles in the New York Times about the increasing popularity of 'checking in' to locations using GPS-enabled mobile phones, a number of businesses are wondering how to reward frequent patrons. But exactly how susceptible are these 'location based services' to being abused? A researcher at the University of Illinois at Chicago shows how easily Foursquare can be gamed in 9 Perl statements, and invites readers to submit more succinct versions of the code to game the system."
An anonymous reader contributes a link to a similar article about spoofing Facebook Places to create an alibi.
I am happy that this is taking off. It's the only way we can fight back against data hoarders.
I propose SOCIAL PHREAKING: We need a P2P client that pretends to be a user of a social network: twitter, facebook, linked in, whatever. The software will login periodically (each client does it at a different rate, in fact, they negotiate.)
The idea is, the various fake accounts form relationships with one another. Every now and then they create a new account and share passwords where they login and 'appear to login' to be from a different location. The growth should be such that it is not suspicious and not an abuse of service. It would make more sense for every node to have only 1 or 2 accounts at most, to simulate families with accounts per family member.
With enough privacy advocates on the phreaknet should be able to generate enough traffic and data to distort the demographics at least slightly. We could make poison the data hoarders to make them think that everyone loves a certain brand of ice cream and then it would become more popular.
We can restore the tip of knowledge and power to ourselves.
How long before Julian Assange is proven (through his Facebook account) to have been at a McDonald's in Seattle when the alleged assault took place?
"If srand() is not called explicitly, it is called implicitly at the first use of the "rand" operator." -- perldoc -f rand
:)
So there is a wasted line right there. This whole thing is quite silly, though. perlgolf can be a lot more challenging and fun than making a simple http post.
Sure it is! It is a revolutionary app indispensable for burglars everywhere!
http://www.object404.com
#!/usr/bin/perl -W
use IO::Socket;
srand;
sleep(rand()*600);
my $sock = IO::Socket::INET->new(PeerAddr=>'api.foursquare.com', PeerPort=>80,
Proto =>'tcp', Type=>SOCK_STREAM) or die;
$ARGV[1] += rand() * 0.0001 - 0.00005;
$ARGV[2] += rand() * 0.0001 - 0.00005;
my $str = "vid=$ARGV[0]&private=0&geolat=$ARGV[1]&geolong=$ARGV[2]";
print $sock "POST
length($str)+2, "\r\n\r\n$str\r\n";
$_=;
The author didn't really even try, so it'll be easy to shorten it. Shortening it a lot is left as further exercise. I'll just get rid of some low-hanging fruit. I'm sure Perlmonks will pick up the challenge if they haven't already.
#!/usr/bin/perl -W
use IO::Socket;
sleep(rand()*600);
my $sock = IO::Socket::INET->new(PeerAddr=>'api.foursquare.com', PeerPort=>80,
Proto =>'tcp', Type=>SOCK_STREAM) or die;
my $str = "vid=$ARGV[0]&private=0&geolat=" . ($ARGV[1] += rand() * 0.0001 - 0.00005)
. "&geolong=" . ($ARGV[2] += rand() * 0.0001 - 0.00005);
print $sock "POST
. " Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ "
length($str)+2, "\r\n\r\n$str\r\n";
Five logical lines. Actual display lines may of course be different depending upon several factors like attempting to break long lines for viewing and the vagaries of the textual mangling on Slashdot.
Foursquare is a mobile application that makes cities easier to use and more interesting to explore. It is a friend-finder, a social city guide and a game that challenges users to experience new things, and rewards them for doing so. Foursquare lets users "check in" to a place when they're there, tell friends where they are and track the history of where they've been and who they've been there with. For more information on how foursquare works, see our searchable FAQ. http://foursquare.com/about
Firefox allows you to fake your geolocation: http://pugio.net/2009/07/fake-your-geolocation-in-firef.html
Did any body else catch that the Foursquare API has you sending your username and password in the clear?
Please tell me you can do all this on port 443 and that your phone is using SSL.
That said, I love it!
cause \r\n isn't \015\012 on every platform