Neat Technique For a (sort-of) Unforkable Repl

[JonathanNitzan]

So, I came up and made this concept into a repl, and it works surprisingly well.
I have a 64-digit code, and I put it in as a secret. I then hid some code among core module files (of which there are several hundred python files in) and hid some code in several of the files. When the repl starts, if the secret doesn’t match a certain value, it deletes all the files. Though it’s technically doable to get it working still, most people won’t spend the time to scan several hundred files (which can contain tens of thousands of lines of code).

All in all, a fairly neat solution

[Firepup650]

@JonathanNitzan

When the repl starts, if the secret doesn’t match a certain value, it deletes all the files.

What if you just don’t start the Repl, and dig through the files?

@JonathanNitzan

I have a 64-digit code, and I put it in as a secret.

Then no one can use it at all, Secrets only exist for your end of the Repl. (Cover page will shred itself too)

[JonathanNitzan]

@Firepup650

Then no one can use it at all, Secrets only exist for your end of the Repl.

Then I can call it from a replit db instead ig.

[Firepup650]

@JonathanNitzan

Then I can call it from a replit db instead ig.

That also doesn’t exist for anything but your end of the Repl, unless you put the URL to the DB in your code, or use a DB proxy. both methods which make it easier for someone to get the code.

[JonathanNitzan]

Then is there a good way to verify the following?
A. The working user
B. The repl owner

[Firepup650]

@JonathanNitzan

A. The working user

The REPL_OWNER secret/env var.

@JonathanNitzan

B. The repl owner

No, though you could check if it’s in the cover page or not.

[NuclearPasta0]

see:
https://docs.replit.com/programming-ide/repl-env-metadata

[JonathanNitzan]

Which env is that lol for the cover page

[Firepup650]

For the cover page? It’s a function @bigminiboss wrote:

@bigminiboss

import uuid
import os

def is_cover_page():
    x = os.environ["REPL_ID"]
    return not (str(uuid.UUID(x, version=4)) == x)

print(is_cover_page()) # False if forked/owner || True if cover page

[bigminiboss]

In my opinion this doesn’t work. The best you can do is use a server verification link in which you send someone to a website where you do a captcha and check the owner using replit auth and send the info back that way

[JonathanNitzan]

When forking a repl, do the keys in the database copy over?

[bigminiboss]

no they do not. However, any cover repl is forked so keep that in mind. That is, every time a repl is run, it is forked and put into a temp VM that gets deleted

[JonathanNitzan]

Hold up… Then how do systems like highscore work? I thought the cover repl’s use the same database?

[bigminiboss]

they don’t work like that. They send a https request to a global server which stores the scores. Otherwise, if it’s a repl that uses deployment THEN the db is global otherwise it needs an external server

[JonathanNitzan]

So how can I track if it’s a main fork or not. I was thinking I could use the db to store a key or something, but clearly that’s not true.

[bigminiboss]

yeah sadly you can’t. You can know if it’s the cover repl or not but you can’t actually let it run normally on the cover page because replit doesn’t want to spend the afternoon adding proper security or even just deleting env vars after run + give some global ones ;-;

[Classfied3D]

If you want to authenticate a user from a console repl to an external leaderboard, you should use repl identity, that way you can ensure that a request came from an account. You have to use an external leaderboard, because replit ‘ghost forks’ non-server repls.

[JonathanNitzan]

I don’t want to force them to login though, I’d rather just autocheck

[Classfied3D]

Repl identity is autocheck

[JonathanNitzan]

I thought it requires you to sign in though?