The above question came to me after watching the video.
IDK maybe I just have low IQ.

main website down?

Sounds nice, might federate later.

Should've been called HoodReads...

(I actually managed to watch basically the same talk at a different event on the site pgp.fail, whoops)

For me, I feel like the mistake mentioned was the most dead obvious one. Prefixing a plugin name from the file with a path then literally running the executable named. At the end of the talk, an age dev bought the researchers with stickers on camera.

Alrighty! I tried out -fsanitize=address and I have now patched every memory leak. There were many...

Bruce Schneier, who invented the term security theater, would perhaps disagree with you.

however would never trust "age" with what they did

What happened with age (or its devs?) that made you not trust it?

In today's world, adoption is not typically driven by real innovation, it's driven by formulaic marketing people are impressively easily manipulated by. Programming.dev is a very small community of technically inclined people who are capable enough that the conversation can be about values.... Almost the entire rest of the world don't even realize that a computer speaks in 1's and 0's. They live in a world of complete abstraction dictated by manufactured dopamine. NO ONE ELSE IN THE WORLD HAS THE BANDWIDTH TO EVEN DISCUSS THIS TOPIC.

I know an entire group of great people who all use Omarchy because it's an accessible software that they can convince others to install and configure. These are people who are working on projects trying to spread healthy sovereign lifestyles away from this system dictated by money. I asked one of them if they heard about DHH being a Nazi and they were clueless. They are new to linux and it's already difficult enough to get them to make the leap off of windows/macosx. Everyone in the space has their cool Omarchy computer though with its fun screensaver that reminds them of N64 graphics and they go alright I want to be cool too. There's no chance in hell they're going to install NixOS (I already tried for one guy and we hit a glitch with his wifi and he just wanted to go back to Omarchy so he could continue working on stuff).

What I'm trying to say is none of these people are fascist/nazis nor support them, but there bandwidth is minimal. The only way I could ever see them switching off of Omarchy is if the exact same state were branched and all that changed was the name and the people behind it. That switch I could be like "Hey guys! I know you all love Omarchy but sadly the guy behind it is a nazi. Not to worry, you just have to run this command and you'll be on a project supported by good people." That's the most I can expect of them.

FYI I use NixOS and Omarchy and AI were stepping stones for me to get there.

I don't believe I've used the word "innovative" anywhere.

You're forgetting the very important aspect of actually getting users to use your product. Look, I hate marketing. I refuse to do it myself over channels like instagram, twitter/x, etc. Sadly, that's what works for the vast majority of people.

The reality is that right now people are fucked in the head with conditioned patterns. That means you, that means me. There's a lot of dissonance going on in the world of people coming into hard terms with reality, and one of those realities is that dumbasses have a lot of money and we're still allowing that money to have power over us.

There's only so much time in the day and we have to do things intelligently in the ways that they work. Sometimes that is going to involve radical acceptance that we are also part of the problem and that changing our own habits is really the most control we have. Is there fascism around? Yeah, probably. Evil is a part of the world and it will be there tomorrow in another form.

Re: EndeavourOS - no. they wont. I don't even know what EndeavourOS and I'm 1,000,000x more tech savvy then 99% of the people I know. Just like there's a 1% of people who own all the wealth, there's a 1% of people who have technical knowledge and the rest are relatively illiterate. You guys are in an echo box and I'm sorry but no one gives a shit because they don't understand even what a config file is. They might understand that Microsoft and Apple are spying on them, Linux is something that is the new fad. Omarchy looks cool.

Those are really good points! I've been sanitizing other inputs for shell breakage, but never considered checking this. Either way, I have since removed the rm -rf part of the code, instead opting to only use my "good" method of traversing the directory

Gotta love projects with a properly commented config file that makes it easy to modify its defaults.

To add to the last comment, I'd also suggest not mixing logging and business code. That is to say that you should put the system call on its own line, so that it is clear that it's not just a logging call:

  if (!strcmp(platform, "windows") && !isSpecificPlatform) {
    debugLog("Falling back to rm -rf", 2);
    int result = system(strfmt("rm -rf %s", path)); 
    debugLog(strfmt("rm -rf exited with code %d", result), 3);
  }

It may just be a me problem, but I have a tendency to skim over the logging lines unless I'm intentionally reading code carefully, in which case the system call may get overlooked

That was what I prefer to read instead, but fine

Edit: I did watch it, they don't even tell, because it was in the previous disclosure, so I now need to find and watch that one

Edit2: and from reading https://gpg.fail/ with original vulnerability descriptions I can't understand how they did the trick with ISO, is the ISO signed as if it were plaintext and allowed truncated lines? If so, this does look pretty bad both on implementation side and on user side, imo

You can call rm safer manner, but you'll need to fork and use one of the execl functions directly. That way you don't have to worry about escaping the path. The old implement would potentially delete unrelated data if the path contained whitespace, and could even execute arbitrary commands, since it essentially runs bash -c "rm -rf $path"

For example, one of the first vulnerabilities I found, that was used for the introduction hook in the 39c3 talk, remains unpatched to this day. Instead of being fixed with code, Werner Koch - the main developer of GnuPG - published a blog post declaring the widely-used feature being "harmful"; while they had weeks in advance, they published this on day one of 39c3, not even giving us time to respond.

what the actual fuck

You mean that you followed a pattern you noticed. The naming convention is (usually) snake case and with no contractions.

Update to my comment: I changed it up a little bit to remove that bit of code. You can optionally uncomment part of the code to re-enable it, in case the current implementation doesn't work on windows

I was just following the naming convention as other string methods, like strlen, strcmp, strcat, (string length, string compare, and string concatenate, respectively), mine is string format, so I did strfmt!

My reasoning is simple: I had never heard of it.

But also, this is an incredibly simple program and a really good way to help me learn C. Additionally, it seems like tealdeer accepts ai generated submissions, though generally discourages it. I aim to make my project as free of ai as I possibly can.

For the first part: You're probably right! I'm not sure of a safer way to do it though. This specific part is an artifact of the original method I used, which I don't think would have worked on windows (according to some stack overflow post), but the current code might actually work fine, I just don't have access to anything running windows and would rather not set up a VM.

Second: That's highly disappointing! I think their policy is fairly well thought out, in a way that allows for accountability and auditability, so I might be okay with continuing to use it, I'll have to think about it. If you know of an alternative I could use, I will happily take suggestions!

I'm not sure why you did this when Tealdeer exists and has for years? https://github.com/tealdeer-rs/tealdeer

And I didn't notice that you weren't OP. I guess we're even? Haha

Ah I didn’t see OP’s strfmt you’re right I’m wrong

Yeah, but it's slower because it has compile-time safeguards and guardrails that eliminate some families of really dangerous memory and IPC errors.