Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

`curl wttr.in`: Weather in your terminal

github.com

Post reply on HN
Print view View original

41–50 of 147 posts

Re: `curl wttr.in`: Weather in your terminal

#41

Post by dgl »

behnamoh wrote: post #33
dgl wrote: post #15

Remember with this kind of thing you're trusting the remote site with access to your terminal emulator. There have been various security problems with some more advanced terminals and escape sequences in the past[1][2]. Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo [1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https:/…

which begs the quotation: is there such a thing as a “firewall” for terminals? my idea is to limit the terminal’s cpu usage so that any breach does not spread quickly in the system, and maybe limit the terminal’s network access, but leave the shell out of it. idk if the last part is possible.

I think that is probably excessive, a terminal is hardly as complex as a web browser.

screen or tmux (or even mosh) can essentially act as a terminal firewall, as they interpret escape sequences and maintain a virtual “screen”. Then you can sandbox their process in docker or similar.

Or if you want web browser style sandboxing maybe just using Xterm.js could work.

Re: `curl wttr.in`: Weather in your terminal

#43

Post by mekster »

nooyurrsdey wrote: post #28

Only HN can be so critical of what is a really cool project. Honestly this is a great _simple_ way to access weather without leaving my terminal. Love the basic ASCII graphics. I noticed it's a LOT faster when I provide the city, probably because it doesn't have to look it up from IP: ``` curl wttr.in/atlanta ``` Nice work.

It's just cool but practically I never check weather until I'm about to leave home and then I'll just check a local weather app on my phone which should give more accurate and detailed info than a service that covers the entire world with presumably varying degree of accuracy.

Re: `curl wttr.in`: Weather in your terminal

#44

Post by xyzzy_plugh »

dgl wrote: post #15

Remember with this kind of thing you're trusting the remote site with access to your terminal emulator. There have been various security problems with some more advanced terminals and escape sequences in the past[1][2]. Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo [1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https:/…

This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary examples. Have you seen some of the recent GPU driver ACEs? Better not render any graphics!

A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted.

Piping curl into bash is one thing, but this is on the level of "are you sure you want to open this file downloaded off the internet?" prompts of yore -- it's not productive.

Re: `curl wttr.in`: Weather in your terminal

#45

Post by galenguyer »

NmAmDa wrote: post #30
nooyurrsdey wrote: post #28

Only HN can be so critical of what is a really cool project. Honestly this is a great _simple_ way to access weather without leaving my terminal. Love the basic ASCII graphics. I noticed it's a LOT faster when I provide the city, probably because it doesn't have to look it up from IP: ``` curl wttr.in/atlanta ``` Nice work.

People on HN should he normally worried about running 'curl' from any untrustworthy sources because that is a security issue. An example - https://www.onsecurity.io/blog/careless-with-curl-dont-be/ -

This talks about concerns with piping curl into bash. It doesn't address any issues with just curling arbitrary data

Re: `curl wttr.in`: Weather in your terminal

#47

Post by granddave »

This is a really nice service and I have used it for quite some time. Just a small reminder; to relieve the wttr servers, please cache the results on disk if you for example want to have a higher refresh rate on your tmux status bar.

See my dotfiles repo [1] if you're interested in such implementation

[1] https://github.com/Granddave/dotfiles/tree/master/tmux

Re: `curl wttr.in`: Weather in your terminal

#49

Post by js4ever »

texaslonghorn5 wrote: post #40
behnamoh wrote: post #33

Earlier quoted context omitted.

which begs the quotation: is there such a thing as a “firewall” for terminals? my idea is to limit the terminal’s cpu usage so that any breach does not spread quickly in the system, and maybe limit the terminal’s network access, but leave the shell out of it. idk if the last part is possible.

Run it in a container?

Containers can be escaped...

Re: `curl wttr.in`: Weather in your terminal

#50

Post by mrweasel »

trinovantes wrote: post #2

If only there's a $PS1 version

It might just be me, but I never saw the usefulness in widgets that shows the current weather, at your current location. I mean can’t you just look out the window?

Stuffing a three days weather report into $PS1 might be to much information for a prompt.

Post reply on HN