121–130 of 147 posts
Earlier quoted context omitted.
Engineers are not UX designers, so their opinion on UX has little value imo.
Engineers can't be users?
Earlier quoted context omitted.
This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary examples. Have you seen some of the recent GPU driver ACEs? Better not render any graphics! A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted. Pipi…
Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every time I run 'npm i' arbitrary commands can also run, and now it seems wild that I ever cared about curl | bash on websites that I trust
I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.
Earlier quoted context omitted.
Curl isn't the problem they're describing. The remote can assume you're running it in a terminal (especially since the user agent string indicates you're using curl) and can send malicious escape sequences in the body, which will be interpreted by your terminal emulator in most cases. This is true of any program that prints output directly from a remote host / untrusted source. In the event your terminal emulator has…
is there way to “sanitize” the curl output such that escaping is disabled? another commenter mentioned the threats of graphics, but this seems more concerning, esp. in an elevated shell. maybe pipe curl to a text file and inspect before running?
And even then, this is probably not a threat you need to worry about.
Earlier quoted context omitted.
That would be cool, but how would you condense the information enough that it's both useful and doesn't take up 2/3 of a line?
I might be a heathen, but my PS1 is as long as it wants to be, and ends with \n$
I have also started adding a time stamp to the second, so that when I run long commands and come back later in a tmux session I can see when it finished.
cool widget but sucks on a mac where default background is white. yellow stuff is almost invisible.
Earlier quoted context omitted.
Yes, and I use terminal emulators too, but I look at it the same way I look at browsers. Sure, there is a lot of useful stuff being made with heavy Javascript dependencies, weird Web frameworks, etc., but this doesn't mean that the technology is good in itself.
a terminal is the bare minimum you get when installing an OS (think Arch). is what gives you the power and speed to shape your workflow exactly the way you want it. running shell inside Emacs is not a bad idea, but you don’t get emacs when you install a new OS. you get a terminal that then lets you install emacs. at that point, you might as will just use the terminal.
Earlier quoted context omitted.
This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary examples. Have you seen some of the recent GPU driver ACEs? Better not render any graphics! A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted. Pipi…
Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every time I run 'npm i' arbitrary commands can also run, and now it seems wild that I ever cared about curl | bash on websites that I trust
In the USA, I like the National Weather Service direct APIs. I wish I could get more granular forecast data, both in time and space, but they forecast dewpoint/humidity, which is really nice.
https://www.weather.gov/arx/why_dewpoint_vs_humidity
> less than or equal to 55: dry and comfortable
> between 55 and 65: becoming "sticky" with muggy evenings
> greater than or equal to 65: lots of moisture in the air, becoming oppressive
If only there's a $PS1 version
i know you’re referring to the shell prompt, but it reminded me that PowerShell file extension is also *.ps1 (which I find strange as I’m not used to seeing numbers in file extensions). didn’t this really come up when MS was designing PowerShell?
alias weather=weather function weather() { if [ $# -le 2 ]; then Command="wttr.in/$1" if [ $# -eq 2 ]; then Command="$Command,$2" fi fi Command="curl ${Command// /%20}" eval $Command }