51–60 of 337 posts
I used to recommend micro[1] to people like those in the target audience of this editor. I wonder if that should change or not. -- 1: https://micro-editor.github.io/
IMO it should not. `edit` doesn't even support syntax highlighting (atleast, out of the box when I tried it).
It'd be nice if they didn't recommend winget for installation though. winget is an egregious security risk that Microsoft has just like pretended follows even minimal security practices, despite just launching four years ago with no protection from bad actors whatsoever and then never implementing any improvements since.
winget is just Windows developers' version of curl | bash . Yet another example of Microsoft copying Linux features.
There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
Earlier quoted context omitted.
winget is just Windows developers' version of curl | bash . Yet another example of Microsoft copying Linux features.
Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
HTTPS only guarantees the packets containing the unverified malicious code are not tampered with from the server to you. A server which could very well be compromised and alternate code put in its place.
You are drawing an egregious apples-to-oranges comparison here. Please re-read what you said.
You could serve digitally signed code over plain HTTP and it would be more secure than your example over HTTPS. Unfortunately there are a lot of HTTPS old wives' tales that many misinformed developers believe in.
Earlier quoted context omitted.
winget is just Windows developers' version of curl | bash . Yet another example of Microsoft copying Linux features.
Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/
There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into more/less is not enough to protect you.
Earlier quoted context omitted.
Honestly dude, this is clever. Good on you for finding an opportunity to make a useful tool and you made out like a bandit in the process. :)
That was the toolchain that my company used. Turbo vision was a Borland product, back when Philippe Khan was running the company. We were that ahead of the curve for "shrinkwrapped software development" at the time. That legacy, Delphi and FPC still maintain the standard for desktop, native dev, really for the last 30 years.
This is just a "because I wanted to" project. And I get that; done a lot of those myself just to understand what the hell was going on. But the rewrite of turbo vision into FPC and compiling to half a dozen targets has been around for 20 years. Turbo vision is probably the best text mode windowing library in existence. The cool fun kicks in when you can map a whole text screen to an array like so: var Screen: Array[1…
Earlier quoted context omitted.
winget is just Windows developers' version of curl | bash . Yet another example of Microsoft copying Linux features.
Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
Can this be ported to MacOS?