Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blinking Commits

blog.annharter.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Blinking Commits

#51

Post by chippy »

mahouse wrote: post #36
fit2rule wrote: post #34

Earlier quoted context omitted.

Just yesterday I ran across this example: "(っ˘▽˘)っ :cloud: ⊂(◕。◕⊂)" in the Parse SDK repo, which I found especially distracting, and in general, kind of turned me off from the project (even though I know Parse is awesome). I agree that UTF and special-chars should be permissable; I don't agree that if they don't actually communicate something, they should be used anyway. Maybe this cute 'moticon trend is trendy, but…

I personally just find the committer to be immature, nothing else.

I personally see it as a filter to exclude those who find things too seriously.

Re: Blinking Commits

#52

Post by trampi »

tempodox wrote: post #44

Has nothing to do with git, or committing, it just applies VT100 control codes that work anywhere in a compatible terminal.

"XSS has nothing to do with {my website framework}, it just applies javascript that work anywhere in a compatible browser."

Actually it has something to do with git. Git should strip or escape the user input before displaying. XSS and SQL Injections are the same kind of issue -> do not trust the user input and escape the input before interaction with it happens.

Re: Blinking Commits

#53

Post by thom_nic »

Anyone know if an issue has been opened (or any relevant discussion on the dev list) on stripping escape sequences? It does seem like it could be harmful.

Re: Blinking Commits

#54

Post by thom_nic »

tempodox wrote: post #44

Has nothing to do with git, or committing, it just applies VT100 control codes that work anywhere in a compatible terminal.

So to be clear, the article isn't suggesting that e.g. github will interpret the ANSI escape sequences, but they will be when you `git log` from a command line, right?

Re: Blinking Commits

#55

Post by tempodox »

trampi wrote: post #52
tempodox wrote: post #44

Has nothing to do with git, or committing, it just applies VT100 control codes that work anywhere in a compatible terminal.

"XSS has nothing to do with {my website framework}, it just applies javascript that work anywhere in a compatible browser." Actually it has something to do with git. Git should strip or escape the user input before displaying. XSS and SQL Injections are the same kind of issue -> do not trust the user input and escape the input before interaction with it happens.

I see your point, and I agree. The OP didn't mention that aspect, but yes, git is darned crappy software, repeating stupid mistakes that are long forgotten elsewhere. Some developers don't seem to be learning from past mistakes.

Re: Blinking Commits

#56

Post by samuellb »

fit2rule wrote: post #34
Torn wrote: post #26

Earlier quoted context omitted.

Annoying your coworkers, for one

Just yesterday I ran across this example: "(っ˘▽˘)っ :cloud: ⊂(◕。◕⊂)" in the Parse SDK repo, which I found especially distracting, and in general, kind of turned me off from the project (even though I know Parse is awesome). I agree that UTF and special-chars should be permissable; I don't agree that if they don't actually communicate something, they should be used anyway. Maybe this cute 'moticon trend is trendy, but…

Some Unicode characters can also move the cursor in strange ways. I think most of them only work in GUI programs, though. (See the list of bad strings above)

Re: Blinking Commits

#57

Post by lisivka »

leni536 wrote: post #33
icebraining wrote: post #23

Earlier quoted context omitted.

I think this is quite harmful, especially the character movement ansi escapes could be used for nefarious purposes. Like what?

- Push malicious commit - Rewrite the commit hash in git log with character movement Actually I don't know if it's a practical attack in any way, could cause some confusion.

If you can commit, why not just enter something like "Small fix in formatting" instead of drawing of LOT of attention to malicious comit?

Re: Blinking Commits

#58

Post by [deleted] »

thom_nic wrote: post #54
tempodox wrote: post #44

Has nothing to do with git, or committing, it just applies VT100 control codes that work anywhere in a compatible terminal.

So to be clear, the article isn't suggesting that e.g. github will interpret the ANSI escape sequences, but they will be when you `git log` from a command line, right?

[deleted]

Re: Blinking Commits

#60

Post by tempodox »

thom_nic wrote: post #54
tempodox wrote: post #44

Has nothing to do with git, or committing, it just applies VT100 control codes that work anywhere in a compatible terminal.

So to be clear, the article isn't suggesting that e.g. github will interpret the ANSI escape sequences, but they will be when you `git log` from a command line, right?

We cannot know (in principle) what GitHub does with data streams sent their way, but in the case of the blinking, the target is your terminal. It will interpret and “execute” (by modifying display) any text it is given.
Post reply on HN