gitpenguin -- hide dangerous blocks by default #346

derpygamer2142 · 2025-07-30T02:38:15Z

small children probably don't know what a token is, why it should be kept private, how to do that, or other basic things that would be needed for this to not be a bad idea.
this unlists the blocks that take a github token as an input because some kid posted a project with their token in it

vercel · 2025-07-30T02:38:20Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
penguinmod-extensions-gallery	✅ Ready (Inspect)	Visit Preview	Jul 31, 2025 1:59am

LordCat0 · 2025-07-30T02:44:15Z

I like this but wouldn't it be better to give a warning or something for using those blocks? Maybe a label or a button that warns the user of it's dangers (of course I'm not the one accepting these pr's, I'm just throwing ideas out there)

derpygamer2142 · 2025-07-30T02:46:39Z

i'm guessing half the small children won't read a warning or anything, or not understand what it means

SharkPool-SP

Id rather you use a warning button than hide these blocks.

GitHub offers decent security with their tokens. And if kids figure out how to setup a token they can probably read the warnings

SharkPool-SP · 2025-07-30T03:04:48Z

Plus what if people want to use those blocks in a private project

derpygamer2142 · 2025-07-30T03:07:54Z

supposedly the kid that i'm referencing ignored a warning already, and i also think it's not a good idea for them to be in a private project because they might assume projects can't be unpackaged

SharkPool-SP · 2025-07-30T03:11:43Z

Still no, cuz there's the case of private projects that aren't packaged.

And people could use these blocks and be smart enough to get their token externally

Plus there are multiple other extensions that have fallbacks to having exposed data in their code, but you can't rly do anything about it. Just add a warning

derpygamer2142 · 2025-07-30T20:50:42Z

Just add a warning

changed

SharkPool-SP · 2025-07-30T21:26:46Z

Not a fan of this wording. Will change later

Steve0Greatness · 2025-07-30T23:48:28Z

static/extensions/justablock/gitpenguin.js

+          {
+            blockType: Scratch.BlockType.BUTTON,
+            func: "showHiddenBlocks",
+            text: Scratch.translate("Show dangerous blocks using a github token")


"Show potentially dangerous blocks"

Steve0Greatness · 2025-07-30T23:50:46Z

static/extensions/justablock/gitpenguin.js


+    showHiddenBlocks() {
+      alert(Scratch.translate("Anyone with your github token can access your account and create repositories, delete repositories, commit changes, and more, all while pretending to be you. You should not include your token in any capacity in a project shared with other people."))
+      const response = prompt(Scratch.translate("To show these blocks, type \"I will not post a project with my github token anywhere and I understand people can impersonate me if I do\" (not case sensitive)."))


Merge these 2 into a 2-line prompt:

Anyone with your GitHub token can access your account and create repositories, delete repositories, commit changes, and more, all while pretending to be you. You should not include your token in any capacity in a project shared with other people.\nTo show these blocks, type ...

Steve0Greatness · 2025-07-30T23:51:54Z

static/extensions/justablock/gitpenguin.js

+      alert(Scratch.translate("Anyone with your github token can access your account and create repositories, delete repositories, commit changes, and more, all while pretending to be you. You should not include your token in any capacity in a project shared with other people."))
+      const response = prompt(Scratch.translate("To show these blocks, type \"I will not post a project with my github token anywhere and I understand people can impersonate me if I do\" (not case sensitive)."))
+
+      if (response.toLowerCase() === "i will not post a project with my github token anywhere and i understand people can impersonate me if i do") {


The "i will not post a project" string should be a constant that is used both here and in the above prompt so that it's easier to edit later.

static/extensions/justablock/gitpenguin.js

Steve0Greatness · 2025-07-30T23:54:25Z

static/extensions/justablock/gitpenguin.js

+
+      if (response.toLowerCase() === "i will not post a project with my github token anywhere and i understand people can impersonate me if i do") {
+        dangerousBlocksHidden = false;
+        Scratch.vm.extensionManager.refreshBlocks()


Make the first argument here that is the extension id, so only this extension gets refreshed.

Note: This is in reference to PenguinMod/PenguinMod-Vm#133, which should probably get merged soon because it's a parity change with TurboWarp.

Steve0Greatness · 2025-07-30T23:56:11Z

static/extensions/justablock/gitpenguin.js


+    showHiddenBlocks() {
+      alert(Scratch.translate("Anyone with your github token can access your account and create repositories, delete repositories, commit changes, and more, all while pretending to be you. You should not include your token in any capacity in a project shared with other people."))
+      const response = prompt(Scratch.translate("To show these blocks, type \"I will not post a project with my github token anywhere and I understand people can impersonate me if I do\" (not case sensitive)."))


The amount needed to be typed should be far shorter. This is comically long.

"I understand the risks of these blocks"

that's the point, while typing it out(or copying and pasting it) they need to read what it says

They'll still have to read what it says if it's shorter, it just means they don't have to type as much.

"the risks" isn't very specific and they might just ignore what it's referencing

You're popping up a massive popup, they have to read it to even know what to type. I'm pretty sure they'll know what "the risks" is a reference to.

would "I understand these blocks could compromise my account" work

Steve0Greatness · 2025-07-30T23:58:46Z

static/extensions/justablock/gitpenguin.js

          },
+          {
+            blockType: Scratch.BlockType.BUTTON,
+            func: "showHiddenBlocks",


Maybe rename to "requestUnhidingDangerousBlocks?"

static/extensions/justablock/gitpenguin.js

Steve0Greatness · 2025-07-31T00:11:34Z

static/extensions/justablock/gitpenguin.js


+    showHiddenBlocks() {
+      alert(Scratch.translate("Anyone with your github token can access your account and create repositories, delete repositories, commit changes, and more, all while pretending to be you. You should not include your token in any capacity in a project shared with other people."))
+      const response = prompt(Scratch.translate("To show these blocks, type \"I will not post a project with my github token anywhere and I understand people can impersonate me if I do\" (not case sensitive)."))


Maybe use ScratchBlocks.prompt instead? It is a bit complicated to work with, so here I did the liberty of turning it into something that can replace the regular prompt function, as long as the function it gets used in is an async function:

var response = await new Promise((res, _) => ScratchBlocks.prompt("...", "", (answer) => { res(answer) }, "Show potentially dangerous blocks", "broadcast_msg"));

broadcast_msg is used here to make sure it only shows the text field, and no radio buttons. Only thing that should be replaced is the "...", which should be replaced with the prompt string.

Steve0Greatness

Alright, looks good to me. You can mark my requested changes as resolved.

unlist blocks from gitpenguin

14720ea

vercel bot deployed to Preview July 30, 2025 02:38 View deployment

SharkPool-SP requested changes Jul 30, 2025

View reviewed changes

use a warning instead of unlisting

8393d19

vercel bot deployed to Preview July 30, 2025 20:44 View deployment

Steve0Greatness suggested changes Jul 31, 2025

View reviewed changes

make requested changes

597b905

derpygamer2142 requested a review from Steve0Greatness July 31, 2025 00:46

vercel bot deployed to Preview July 31, 2025 00:46 View deployment

Steve0Greatness approved these changes Jul 31, 2025

View reviewed changes

rework and reword

fc7b7ca

vercel bot deployed to Preview July 31, 2025 01:59 View deployment

SharkPool-SP changed the title ~~unlist some blocks from gitpenguin~~ gitpenguin -- hide dangerous blocks by default Jul 31, 2025

SharkPool-SP merged commit 9f869d8 into PenguinMod:main Jul 31, 2025
1 check passed

gitpenguin -- hide dangerous blocks by default #346

gitpenguin -- hide dangerous blocks by default #346

Uh oh!

Conversation

derpygamer2142 commented Jul 30, 2025

Uh oh!

vercel bot commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LordCat0 commented Jul 30, 2025

Uh oh!

derpygamer2142 commented Jul 30, 2025

Uh oh!

SharkPool-SP left a comment

Choose a reason for hiding this comment

Uh oh!

SharkPool-SP commented Jul 30, 2025

Uh oh!

derpygamer2142 commented Jul 30, 2025

Uh oh!

SharkPool-SP commented Jul 30, 2025

Uh oh!

derpygamer2142 commented Jul 30, 2025

Uh oh!

SharkPool-SP commented Jul 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Steve0Greatness left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel bot commented Jul 30, 2025 •

edited

Loading