71–80 of 147 posts
Earlier quoted context omitted.
but imagine if you're in a bunker hacking on your fav project, no artificial light and you wonder.. shall i go to the surface? you curl this website and, if tolerable weather conditions, you plan your ascent.
There isno weather app which gives you the status of nuclear downfall.
Remember with this kind of thing you're trusting the remote site with access to your terminal emulator. There have been various security problems with some more advanced terminals and escape sequences in the past[1][2]. Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo [1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https:/…
Is curl unsafe? This is a pretty basic invocation of curl, no fancy flags needed.
This is true of any program that prints output directly from a remote host / untrusted source.
In the event your terminal emulator has a vulnerability or allows you to run arbitrary commands (this is a feature of some emulators), the site can target that functionality for users of that emulator and wreak havoc.
I maintain a lot of ANSI escape related code. These exploits have always been theorized, but I've not once heard about this being exploited in the wild. It's certainly possible. Not very probable. Refer to your threat model, as always.
Earlier quoted context omitted.
That would be cool, but how would you condense the information enough that it's both useful and doesn't take up 2/3 of a line?
Emojis? For the current weather, a single emoji could convey quite a lot; e.g. a snowflake for sub-60 weather (I have a low tolerance for cold), a sun for 60-80, fire emoji for 80+... Now, I don't know if anyone truly needs the weather in their terminal prompt, but it is doable.
This might be useful for temperature, humidity, wind, preciptitation, and similar measures, either as quantities or timelines.
https://en.wikipedia.org/wiki/Sparkline
https://github.com/deeplook/sparklines
Similar:
https://www.linux-magazine.com/Issues/2016/183/Calc-Conditio...
I have to scroll all they way down to the buttom to find the information source -- WorldWeatherOnline. Does people not care about where their whether data is sourced from? Living in Japan, I have always been wary of these type of service, since I find a lot of them really inaccurate. And I just checked, Tokyo show 15C on that website, while high resolution current weather information from Japan Metrological Agency sh…
As a cyclist I'm mostly interested in rain. So I check the rain radar of the national weather service, which has excellent resolution.
Even when travelling I spend 5 minutes to dig out the relevant local pages of a national weather service and bookmark them. Not something I have to do so frequently that any kind of automation would be needed.
Weather apps and this client are a solutions in search of a real problem. Yes, it's a nice demo, I like working with the terminal. But I am not working with weather all day long.
Remember with this kind of thing you're trusting the remote site with access to your terminal emulator. There have been various security problems with some more advanced terminals and escape sequences in the past[1][2]. Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo [1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https:/…
Remember with this kind of thing you're trusting the remote site with access to your terminal emulator. There have been various security problems with some more advanced terminals and escape sequences in the past[1][2]. Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo [1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https:/…
If you have a vulnerable terminal emulator, yes. Well, the same holds for every web site you visit if you have a vulnerable browser.
I get "Weather report: not found" on the first line and then a 3 day forecast for idk what location.
so the obvious (for me) thing to try was: watch -n 600 -c 'curl -s v2.wttr.in/' This ALMOST works, but somehow it messes up the formatting for me. For some reason watch doesn't pass through formatting cleanly or so?
You can try to run it with any command that has ANSI output, and you will see it.
As a simple alternative, you write your own 'watch' like this:
while true; do curl -s wttr.in; sleep 60; clear; done
weather () {
curl "https://wttr.in/${1}"
}
Earlier quoted context omitted.
This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary examples. Have you seen some of the recent GPU driver ACEs? Better not render any graphics! A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted. Pipi…
> Better not render any graphics! Unironically a good idea. Graphics have always been a mistake - most engineers would agree that if we stuck with very basic output, our software would be in a much better place than today (and more usable, too!)