14 ms·
Terminal escape sequences in Git commit email field
- bombcar 6y agoThe next step is to add animation.
- viraptor 6y agoIt should be possible: https://github.com/saitoha/libsixel https://github.com/saitoha/libsixel (Unless sixel required nul bytes in the encoding)
- ryan-c 6y agoFor animation, the real issue is frame timing. It looks like there's an animation API in kitty that allows this sort of control, so it'd work there, and iTerm2 supports inline animated gifs which I've already demo'd.
- JohnCurran 6y agoThis same person tweeted a terminal animation out yesterday: https://twitter.com/ryancdotorg/status/1375880616789573633 https://twitter.com/ryancdotorg/status/1375880616789573633 Though I suppose it's not technically a git commit email, it's still a git command
- IgorPartola 6y agoOff topic, but the person posting this mentioned the artist who did the avatar and of course I love their art style, and of course they aren’t taking commissions right now. How does one find good pixel art artists who might do a small commission or three?
- scrollaway 6y agoDeviant Art used to be a good start a few years back. For pixel art you could also look at r/gamedev, lots of artists looking for work roam it.
- ChrisMarshallNY 6y agoThey have some awesome artists, there, but I have had bad luck getting through to them on DeviantArt. There's a couple of artists that definitely could have made some money from me, but couldn't, because I couldn't contact them (or they ignored my contacts).
- krasin 6y agoFiverr? I've had a generally decent experience with it, but I also follow the rule of three: always hire 3 different freelancers for any task, unless when I have established relationships with an artist who did very similar things in the past.
- IgorPartola 6y agoOh that’s a good point. I’ve used them before. It was neat.
- aviditas 6y agoThis user does small commissions on occasion. http://imgur.com/gallery/qszHeHe http://imgur.com/gallery/qszHeHe
- IgorPartola 6y agoLove the Slavic turtle tax, thanks!
- Blikkentrekker 6y agoWell, one can put characters from the Canadian Aboriginal Syllabic Block into Go identifiers, so this would be the next step, I suppose.
- Hendrikto 6y agoYour scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should.
- elchief 6y agoYou can name PostgreSQL tables with poop emoji
- easton 6y agoYou can also use emoji to name any object in Active Directory, which is a heck of a lot of fun if you want to confuse the IT guy that needs to remote into your machine for maintenance.
- rootsudo 6y agoOkay, I'm going to try this now. This is perfect. I wonder if it'd break anything else. This is gold.
- pixl97 6y agoDont forget wifi also allows emojis in the SSID.
- Waterluvian 6y agoI wonder if I can use zalgo text for an ssid.
- ryan-c 6y agoYes, but there's a 32 byte limit which is a bit of a buzzkill.
- dharmab 6y agoI have an Outlook folder named (trash can) (fire) and a rule set up so anything older than 30 days in there is deleted.
- ExtraE 6y agoInteresting. HN will let me submit a comment that contains emoji just fine (no error in dev tools network log or UI) but it doesn't show up in the thread (at least for me, if there's a stream of emoji from me testing that I can't see I apologize).
- deleted 6y ago[deleted]
- wyldfire 6y agoOh wow, can someone repost that ANSI art documentary that was shared recently? Great inspiration for my next commit.
- hedora 6y agoRelated: The Unix Haters Handbook, chapter 6: https://web.mit.edu/~simsong/www/ugh.pdf https://web.mit.edu/~simsong/www/ugh.pdf
- RealStickman_ 6y agoI will have a lot of fun reading this. Thank you!
- ryan-c 6y agoOh, wow, I'd heard of the unix haters handbook, but I never realized it was an actual published book.
- genera1 6y agoIt's still a good read, not only as a historical artifact, but also because many of the criticisms still apply to the spiritual descendant of Unix, Linux. It's funny to see that 20 years ago people were already complaining about X window system or Unix security philosophy.
- u801e 6y agoI'm not sure if there are any format specifications for the author and committer lines in a git commit message object. I guess it really depends on whether commands that are used to display the information (git show, git log, etc.) can handle arbitrary data. I wonder how commands like git format-patch and git am would deal with a commit like this.
- ExcavateGrandMa 6y agoawful
- chaganated 6y agoSometimes, it's better to keep things to yourself, and not give people any ideas.
- DarknessFalls 6y agoI've not had much success showing block characters in the standard Mac Terminal.app. Is there a particular font I need to use?
- dapids 6y agoAFAIK terminal.app doesn't have any control code filtering before it's rendered. Although iTerm2.app does have this as a feature, if that helps.
- tambourine_man 6y agoIt can probably be done in grayscale, with even some dithering with shading characters from Unicode Block Elements to support Terminal.app and other emulators.
- danielyaa5 6y agowhat a waste of time
- zephyr____ 6y agoIt may not be productive but understanding the extensibility of our systems gives us a more wholistic view of them. It could be useful in unexpected ways in the future. Or not.
- rlt 6y agoFor someone who frequents a site called “hacker news” it sure seems like you don’t understand the hacker mentality.
- userbinator 6y agoMany years of experience have taught me that fields holding data being able to hold any sequence of bytes is normal (and in the case of string data, anything except 00), so this didn't surprise me too much; in fact, it's usually when something is unusually restrictive that it becomes notable.
- ryan-c 6y agoI was honestly more surprised at how much data I could fit in that field. Git itself doesn't appear to have any limit at all, though GitHub doesn't allow more than a few dozen megabytes.
- invsblduck 6y agowhy is this so astounding to those commenting on twitter? because git doesn't artificially limit the line length? i've used ansi sequences in my zsh prompt for 20 years to make colors and move the cursor; it's just in-band ascii that is interpreted by the terminal emulator, no?
- danielheath 6y agoBy default, I'd expect data that likely came from third parties to be sanitized before output.
- enriquto 6y agoSure, sure, but why would such a sanitization remove useful things like terminal drawing codes? That would be untoward.
- theamk 6y agoit was, note the twitter had you pass "--no-pager" to get cursor movement to work. With default options, you only get colors, and this is pretty safe.
- ryan-c 6y agoIt's a bit more complicated than that. For example, if you do git log --format=%ae | sort -u the cursor movement sequences will be preserved. I haven't delved too deeply into what git actually does here in terms of processing for "pager" output vs not.
- ryan-c 6y ago...and for this "display some art" hack specifically, it looked like it can be made to work with plain git log by using `\r` characters as newlines in addition to the escape sequences, but I haven't tested that much.
- etaioinshrdlu 6y agoIts things like this that make me think terminals are irredeemably broken. One does not simply print a string to a terminal. I'm not aware of a standard way to handle user strings safely like you can on say, the web, or any other UI platform. The Unix way seems to be to not solve the problem at all, unless you're writing a text editor, and then you reinvent the wheel and solve it yourself.
- jasonjayr 6y agoThis is the SAME type of injection attack we've been fighting on the web for years. Apache 1.3 (way back when) would escape escape sequences before printing them to the log, to prevent this exact same thing. It is the responsibility of the program dumping data to the terminal to escape things prior to dumping to the tty.
- etaioinshrdlu 6y agoExcept, could you imagine a software ecosystem where 95% of the software is vulnerable to injection, and nothing is ever done about it, and there is no clear easy solution for developers either, and you have a legion of users who turn technology into a religion and think there's nothing wrong at all with Unix terminals. It also probably doesn't help that the problem is unfixable in general without rewriting so much software... and that things mostly work okay, most of the time.
- comex 6y ago> where 95% of the software is vulnerable to injection As opposed to what, the ẃ͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́᷅́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͅͅͅͅͅͅͅͅé͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́᷅́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͅͅͅͅͅͅͅͅb͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔͔̩͔́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́᷅́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́̂́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͥ́͗́́͗́́͗́́͗́́͗́́͗́́͗́́͗́ͅͅͅͅͅͅͅͅ? :) (note: appearance of above may depend on browser)
- junon 6y agoI maintain chalk and a slew of other TTY related things. Terminal emulators are, far and away, the most archaic computer technology we still use daily. Believe me when I say, it's a very hard problem to solve since everyone has subscribed to Unix's philosophy of "everything is text". As much as I dislike Microsoft's philosophies on software, they had the right idea with Powershell. Its execution is just abysmal. Expect this stuff to change drastically in the next 5 years.
- gugagore 6y agoWhy are the next 5 years going to be different than the last 50?
- st_goliath 6y ago> Expect this stuff to change drastically in the next 5 years. Bwahaha... is this your first encounter with backwards compatibility? Changing this would be very hard, but this has nothing to do with somebody embracing some grand philosophy, but with tons of existing software relying on Unix like systems to, well ... be Unix-like, because that's what the software was written for.
- Ericson2314 6y agoI've given it a lot of thought, and below is my one "reformist" idea to significantly improve things without breaking back compat so bad Invert the shell and terminal: every shell command (with unredirected streams) gets it's own pty. - Like the those repl "notebooks" you can scroll each output separately, without hacks. - Backgrounded processes won't spew garbage when you are trying to type. They just continue running in their terminal. You can even background something like vim or a game that takes the whole terminal, and it's just fine! - Rather than hacking scroll back onto processes that might use tty stuff in expected ways, just straight-jacket them by giving them plain pipes instead! The OP exploits are then opt-in impossible. - Having powershell-esque "post-text" commands that dispense with the bullshit are far easier to manage: also give them regular file descriptors and negotiate protocol or whatever, just like the above, rather than a pty. - stdin can be a nice form with submit button rather than fixed (usually line) buffering policy. - shell might even be simpler as there is less careful juggling of shared resources except where the programmer asks for it. I also use ssh multiplexing instead of tmux for extra shells. When I do need to use tmux, I hate that read only mode prevents scrollback. The above builds nicely upon this: - The persistent remote shell has as many ptys as needed before for chained commands which might still be running, or separate "sessions" - The local client can use native UI elements for everything, no TUI jank. - Scrolling over many (live or saved) terminals, the normal scrollback case, is possible and very side-effect free. Anyone see any issues? I don't for anything I do daily (git, coretuils, etc.)! I don't think I have time to make this, so please someone else do.
- creamytaco 6y agoRecent, 1999: https://packetstormsecurity.com/files/18376/ADMesc.html https://packetstormsecurity.com/files/18376/ADMesc.html
- daniel5151 6y agoReading that just made me want to re-watch 1995's Hackers
- gruez 6y agoThe problem with this attack is that you have to drop the 6c file in your PATH for it to work, because otherwise you need to use ./ for it to execute. This makes the attack pointless because if the attacker can drop something to your PATH, you're already pwned since the attacker can just name his payload "ls" and wait for you to execute it.
- theamk 6y agoGood thing I normally reach to "less" instead of "cat" nowadays. You get scrolling, and your terminal is safe from malicious injections or (much more likey) binary garbage. And "git" for example applies "less" to pretty much all output by default, which makes most of the git-based attacks, including this one, irrelevant.
- tempodox 6y agoFrom the thread: Our continuing mission: To explore strange new platforms. To seek out new bugs and new software. To boldly shitpost where no one has shitposted before. Mission accomplished, LMAO.
- ryan-c 6y agoYeah, it's kind of my thing :-) One of the previous times I hit the front page of HN it was for inserting snark into an X509 certificate and then using it on my site. https://rya.nc/cert-tricks.html https://rya.nc/cert-tricks.html
- tempodox 6y agoI'd say the hat of a security researcher suits you well :)
- kenrose 6y agoPrevious submissions over the last few days: https://news.ycombinator.com/from?site=twitter.com/ryancdotorg https://news.ycombinator.com/from?site=twitter.com/ryancdoto...