Some ideas which will allow us to do cool things like subscribing/unsubscribing to podcasts and other functionality from within the chat.
I mention that people will have to trust the bot with their passwords, but it could be done in such a way so that the bot does not store the password. Will explain after...
<awormus> Irobeth: so what kind of stuff can you get us to hook up the bot with the database?
<awormus> you know what I would LOVE
<awormus> !blog Note to self: unsubscribe to lastfuture's podcast
<awormus> and then have that add a blog entry to my pickle blog
<awormus> I would never use the pickle blog since it's just somewhere that I never go, but if there was an interface from here, that would be awesome
<awormus> I had a friend who used his bot to maintain a channel linkblog
<awormus> people just went
<awormus> !linkblog
http://www.example.com/ # A short description
<awormus> and that was added to the page in the format of a blog
<awormus> so
* lastfuture sobs
<awormus> lastfuture: don't worry, I was just kidding
<awormus> your show is like the only german I ever hear so I enjoy it

<lastfuture> heheh I figured
<lastfuture> thanks man
<lastfuture> I'm not forcing anybody to subscribe anyway. I think I should emphasize that in tonight's show
<awormus> or
<awormus> even cooler is if I say
<awormus> my show is 3333
<awormus> then someone else could go
<awormus> !subscribe 3333
<awormus> and they would be subscribed in the pickle
<awormus> Irobeth: I hope you're taking notes

<lastfuture> I think Irobeth is idle
<lastfuture> but I'm sure the backlog will be read
<lastfuture> !unsubscribe anythingbut:3333
<lastfuture> heheh
<awormus> heh
<lastfuture> what ever feature will mess with the database, I would make it so that all changes are being written to a temporary database and as soon as you go to the site (and are logged in) it will ask you to confirm the changes
<lastfuture> that way nobody can spoof which ever mechanism is being used for authentification and you could review what you've done
<lastfuture> well they can spoof but they won't be able to change stuff without you knowing
<lastfuture> ideally the list of changes had checkboxes to untick certain activities that you might regret
<awormus> well, what I would do is do something like
<awormus> send a pvt to the bot like
<awormus> /msg cyberpickle identify myusername mypassword
<awormus> then when you try to blog the pickle will send a request like:
<awormus>
http://www.podcastpickle.com/bloginterface...tever+you+wrote<awormus> and CyberPickle will only identify you by your IP address and probably a time
<awormus> so say 1 day with the same IP address
<lastfuture> that's a pretty good idea. one downside tho: should I mistype the / or use a double slash or something similarly stupid, my pass will be there for all to see
<awormus> I guess you've never done this
<awormus> mysql -uroot -pmyverysecretpassword mydatabase
<awormus> oops, wrong window
<Ronald-san> lol
<lastfuture> well I've done that once, but not in a situation where I know somebody could be faster than me
<lastfuture> I imagine a lot of pickle users aren't necessarily tech-savvy
<awormus> then if you're worried you can right-click on the bot and select "open dialog window"
<Ronald-san> I am back...you didn't notice proberly but I was gone...
<lastfuture> they know how to record their podcast but that doesn't mean they know the pitfalls of irc
<awormus> of course, the REAL problem would be that they would need to trust someone (me) with all their passwords
<awormus> unless, you could set a secondary password on the pickle for use with the bot
<lastfuture> password hashes please

<awormus> lol
<Ronald-san> this might be an idea for the bot...have it so when someone with a name starting with Pickle (PickleUser, Pickler8474 etc) It send a greating message with how to change your name etc.
<awormus> oh well... if the bot uses the same salt and md5 hash as the pickle and then stores the hash in the database it could work
<awormus> Ronald-san: it already does that
<awormus> but it's just impossible to notice with that crummy java client
<Ronald-san> opps.
<Ronald-san> doh - never actually seen it happen.
<lastfuture> is the pickle written in php?
<awormus> lastfuture: I assume that large parts of it are
<lastfuture> if it is it is probably using md5() which doesn't use a salt value (at unless you concat a salt to the password string)
<lastfuture> *that
<awormus> lastfuture: well, that's what they should be doing
<awormus> $md5 = md5($salt.md5($password));
<awormus> that's what I usually do at least
So I'm thinking that there is a script called pwdcheck.php which accepts a username and password and if the username password is correct it replies with a "token" which can be used for a predetermined amount of time to access the database. That token is stored in the database and is used in any transactions from then on for the specific period of time
I log in:
/msg cyberpickle login awormus mysecret password
If my username and password are correct the bot will get a token and add it to the database.
Then someone mentions a podcast and I want to subscribe to it so I go:
!subscribe 2331
the pickle will use the token when communicating to another script on the pickle.
interface.php?op=subscribe&show=2331&user=awormus&token=thetoken
if the token is correct then the user is subscribed to the podcast on the pickle.
When a user identifies themself to the bot, and the bot checks in with the pickle, along with the token the pickle can send the bot any other identifying information.
So someone can type:
!who Oblivion
and the bot will respond with the information that the pickle supplied to it. This is assuming that Oblivion has identified himself to the bot.
In regard to sending the password over the wire (and supplying it to the bot) an alternative could be to give the users an option to set up a secondary password which is only used for the chat. This would mean that they could give that password to the bot without worrying that someone (me) will make the poor bot give me their password and use their account for some unknown nefarious purpose.