Good article with images, code samples and explanations.
Code could use more comments.
Your contribution has been evaluated according to Utopian policies and guidelines, as well as a predefined set of questions pertaining to the category.
To view those questions and the relevant answers related to your post, click here.
This is an amazing work @Emrebeyler and the entire @dpoll team. These restrictions is a good way to sanitize the blockchain to really bring out the value it stands for. It is quite sad how people would always be on readiness to abuse others' intellectual capacity.
My suggestion:
I would advise that you also help the dpoll creator to limit voters by the level of acitvity of the accounts. SOme idle accounts may just be created for such purposes. This implies that an account that has not been active for a few days past should not just become active for the purpose of voting. ANy account that should participate must be active at least in the last 7 days before being eligible. The reputation, age, no. of posts can still be abused, but the level of account activity would rarely be.
I was watching the #89 pull request, maybe if you add a validation before the loop asking for all the variables equal to zero , you could avoid the entire loop (if 0 is the default value of all the field will be usefull).
I dont know python language, and I supous that the cast and try is enough, but is possible to use Sql injection in this kind of forms?
Wait, I was talking about a vulnerability called "sql injection", it's a way to introduce malicious sql code in a human filled form.
If you have a field that is concatenated in a sql query, some like:
query = "SELECT * FROM USERS WHERE SP > " + sp;
If I put this in the field:
[1 select password from users --]
I can execute sql code in your app. Even if you use a read/write connection, the code could contain some "drop table " or "drop database". Take a look of this:
I enjoyed voting on dpoll a few times. I wish we had something like dpoll when some of the important details for the previous hardforks were being discussed.
I foresee dPoll playing a critical role in gauging community sentiment on future upgrades to the Steem blockchain.
Since we are part of a decentralized ecosystem, it seems to follow that many might use polling as a way to arrive at various degrees of consensus... for example for directions to take, and features on apps, and so forth. And so, a polling system needs to be as "robust" and resistant to manipulations, as possible.
Allowing the results to be filtered while everyone can still vote seems like the superior approach, as it will help expose patterns (if any) that suggest "bad actors" attempting to manipulate...
Thank you so much for participating the Partiko Delegation Plan Round 1! We really appreciate your support! As part of the delegation benefits, we just gave you a 3.00% upvote! Together, let’s change the world!
Your contribution has been evaluated according to Utopian policies and guidelines, as well as a predefined set of questions pertaining to the category.
To view those questions and the relevant answers related to your post, click here.
Need help? Chat with us on Discord.
[utopian-moderator]
Thank you for your review, @helo! Keep up the good work!
ǝɹǝɥ sɐʍ ɹoʇɐɹnƆ pɐW ǝɥ┴
This is a speedy and quality update to the system, nice one! :D
Impressive work and data to strengthen the outcomes of the results. Amazing that you were able to do in such short time!
Posted using Partiko iOS
This is an amazing work @Emrebeyler and the entire @dpoll team. These restrictions is a good way to sanitize the blockchain to really bring out the value it stands for. It is quite sad how people would always be on readiness to abuse others' intellectual capacity.
My suggestion:
I would advise that you also help the dpoll creator to limit voters by the level of acitvity of the accounts. SOme idle accounts may just be created for such purposes. This implies that an account that has not been active for a few days past should not just become active for the purpose of voting. ANy account that should participate must be active at least in the last 7 days before being eligible. The reputation, age, no. of posts can still be abused, but the level of account activity would rarely be.
Goodluck!
Meanwhile, thanks to @Theycallmedan for really spicing the value of @dpoll
Hi! How can I vote for this app in the rank?
I was watching the #89 pull request, maybe if you add a validation before the loop asking for all the variables equal to zero , you could avoid the entire loop (if 0 is the default value of all the field will be usefull).
I dont know python language, and I supous that the cast and try is enough, but is possible to use Sql injection in this kind of forms?
Best regards!
Wait, I was talking about a vulnerability called "sql injection", it's a way to introduce malicious sql code in a human filled form.
If you have a field that is concatenated in a sql query, some like:
query = "SELECT * FROM USERS WHERE SP > " + sp;
If I put this in the field:
[1 select password from users --]
I can execute sql code in your app. Even if you use a read/write connection, the code could contain some "drop table " or "drop database". Take a look of this:
Perfect! Are you able to use linq to retrieve a filtered dataset in python?
I enjoyed voting on dpoll a few times. I wish we had something like dpoll when some of the important details for the previous hardforks were being discussed.
I foresee dPoll playing a critical role in gauging community sentiment on future upgrades to the Steem blockchain.
Voted for your witness!
Thank you for this useful update
Seems to me you are doing important work here!
Since we are part of a decentralized ecosystem, it seems to follow that many might use polling as a way to arrive at various degrees of consensus... for example for directions to take, and features on apps, and so forth. And so, a polling system needs to be as "robust" and resistant to manipulations, as possible.
Allowing the results to be filtered while everyone can still vote seems like the superior approach, as it will help expose patterns (if any) that suggest "bad actors" attempting to manipulate...
Nice work!
Adding your witness, as well.
Thank you so much for participating the Partiko Delegation Plan Round 1! We really appreciate your support! As part of the delegation benefits, we just gave you a 3.00% upvote! Together, let’s change the world!