`curl wttr.in`: Weather in your terminal
github.com
github.com
Personally I think it's a cute thing and have implemented some similar little easter eggs to this via: curl ip.wtf/moo
[1]: https://blog.mozilla.org/security/2019/10/09/iterm2-critical... [2]: https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt...
Problems with untrusted, unknown input from any source affects *all* software that process it, internet browsers, document editors, archive extractors, even just opening a file can do lots of funky stuff depending on the file system.
In one command you pipe the output to `sh` which will run whatever instruction it receives. In another command you just ask for an output from `curl`, doing so should not cause any side effect than the output action itself.
my idea is to limit the terminal’s cpu usage so that any breach does not spread quickly in the system, and maybe limit the terminal’s network access, but leave the shell out of it. idk if the last part is possible.
screen or tmux (or even mosh) can essentially act as a terminal firewall, as they interpret escape sequences and maintain a virtual “screen”. Then you can sandbox their process in docker or similar.
Or if you want web browser style sandboxing maybe just using Xterm.js could work.
Begging the question is to answer the question with a premise that assumes the result. It's a form of circular reasoning.
https://www.thoughtco.com/what-is-begging-the-question-falla...
https://www.writersdigest.com/write-better-fiction/begging-t...
And to be clear, your question is a good one. It's just that it's raised and not begged. That said, I see and hear this all the time, including by historians of philosophy who are strongly familiar with logical fallacies and their distinctions.
https://www.grammarphobia.com/blog/2021/11/beg-the-question....
In this case, I tend to strongly prefer the prescriptivist view to the prescriptivist, and misuse generates confusion rather than clarity.
Words ... should mean things. Particularly when they're specifically referring to illegitimate reasoning in the first place.
"Enormity", "disinterested", and "very unique" are others on my list.
A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted.
Piping curl into bash is one thing, but this is on the level of "are you sure you want to open this file downloaded off the internet?" prompts of yore -- it's not productive.
Unironically a good idea. Graphics have always been a mistake - most engineers would agree that if we stuck with very basic output, our software would be in a much better place than today (and more usable, too!)
on the other hand, most users are not like me. they want something they can interact with using a mouse, and they often use keyboard only to enter words, not commands or shortcuts. so GUI has definitely a place in today’s world.
Jameson street: (10,220)->(4,110)
Queens lane: (10,220)->(1,55)
...
...
You are at: (15,220)
Turn left at the next intersection.You are standing in an open field west of a white house, with a boarded front door.
There is a small mailbox here.
I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.
I find it hard to believe you could interpret a partial script on the fly as more comes in via stdin.
A shell script is interpreted one line at the time.
Very simple proof:
$ while true; do printf 'date\n' && sleep 5; done | sh
Mon 16 May 2022 07:19:21 AM CEST
Mon 16 May 2022 07:19:26 AM CEST
Mon 16 May 2022 07:19:31 AM CEST
In either case, if the network connection is interrupted, the download is finished. How would sh know it's not the whole script as the author intended it? Remember that in a pipeline the receiving end only sees the pipe, and won't know about the exit status of the process upstream (which may for all we know be zero anyway).If the terminal has a bug w.r.t. something it processes one could leverage that, but they'd probably need to know which terminal and maybe even which shell you're using; so maybe don't let curl/wget but also `cat` of a downloaded file output directly to the terminal if it isn't a trusted origin or if it looks/feels shady.
This is true of any program that prints output directly from a remote host / untrusted source.
In the event your terminal emulator has a vulnerability or allows you to run arbitrary commands (this is a feature of some emulators), the site can target that functionality for users of that emulator and wreak havoc.
I maintain a lot of ANSI escape related code. These exploits have always been theorized, but I've not once heard about this being exploited in the wild. It's certainly possible. Not very probable. Refer to your threat model, as always.
another commenter mentioned the threats of graphics, but this seems more concerning, esp. in an elevated shell. maybe pipe curl to a text file and inspect before running?
And even then, this is probably not a threat you need to worry about.
Archived version of the linked commit: https://archive.softwareheritage.org/browse/revision/b80bedc... (which removes the feature entirely)
Honestly this is a great _simple_ way to access weather without leaving my terminal. Love the basic ASCII graphics.
I noticed it's a LOT faster when I provide the city, probably because it doesn't have to look it up from IP:
``` curl wttr.in/atlanta ```
Nice work.
An example -https://www.onsecurity.io/blog/careless-with-curl-dont-be/ -
I live in a big city, it could be raining frogs in one part and a happy sunny day in the other and the best thing any weather report could say to me is 'expect rain'. And if I need to go it doesn't even matter what the report says or if I have/have not an umbrella with me.
Honestly for the last decade even if I look at the weather report I look not for the current conditions (I have eyes and windows) but what would be in a couple of hours, because temperature difference between 9PM and 3AM could be pretty significant.. and it doesn't even matter in winter and summer. *shrug_emoji*
Just in case you haven't seen it: some services provide conditions and forecasts for particular locations with better resolution than ‘the city’, and can show the projected movement of rainclouds.
(You'll have to research the services for your country yourself, as I doubt it that my local one is useful for outsiders. But I'd guess that these days many big web services have these features.)
Still, after I wrote the previous comment the rain has come. And in 15 minutes there was no rain and the sun shone brightly and in another 30 minutes even puddles all dried up. So the practical usability of such service is quite limited.
The one I use is https://yandex.ru/pogoda/maps/nowcast — but I'm not sure if it works in English, and these days perhaps one will prefer not to use Yandex anyway.
Living in Japan, I have always been wary of these type of service, since I find a lot of them really inaccurate. And I just checked, Tokyo show 15C on that website, while high resolution current weather information from Japan Metrological Agency show 18C.
I don't know about Tokyo in particular, but generally speaking, for a large coastal city that wouldn't surprise me at all.
They are complaining about location precision. It might be very coarse (equivalent to US zip code size). It’s a valid complaint. I use Dark Sky on iOS because it’s accurate to 10 meters or so.
Weather or not I care is really not your concern.
As a cyclist I'm mostly interested in rain. So I check the rain radar of the national weather service, which has excellent resolution.
Even when travelling I spend 5 minutes to dig out the relevant local pages of a national weather service and bookmark them. Not something I have to do so frequently that any kind of automation would be needed.
Weather apps and this client are a solutions in search of a real problem. Yes, it's a nice demo, I like working with the terminal. But I am not working with weather all day long.
Also, he maintains the awesome-console-services[5] list
[1] https://github.com/chubin/cheat.sh
[2] https://github.com/chubin/late.nz
[3] https://github.com/chubin/qrenco.de
curl wttr.in/Moon
Shows moon phases curl rate.sx
Shows cryptocurrency exchange rates, from the same author as wttr.inI sourced the above commands from a previous HN post: https://news.ycombinator.com/item?id=23646953
See my dotfiles repo [1] if you're interested in such implementation
weather () {
curl "https://wttr.in/${1}"
}
This lets you run: weather nyc, a zip code and everything else wttr.in supports. alias weather="curl wttr.in && curl v2.wttr.in && curl v3.wttr.in"The Bayern.sxl example works, and is a good way to prove to yourself that your terminal is compatible, instead of your hoped-for region not being indexed.
curl v3.wttr.in/Bayern.sxl
curl v3.wttr.in/California.sxlI wrote a set of scripts --- it takes thee, a bash function, sed, and awk --- to parse the dumped formatted HTML to a more usable form on a terminal.
Raw APIs might be more convenient / less complicated.
Rough weather information for next days and hours:
# Find zone with curl https://api.weather.gov/points/40.5878,-103.0694
ZONE=${ZONE:-CAZ508}
echo "Forecast for zone $ZONE"
curl -s -A MyWeather/1.0 https://api.weather.gov/zones/forecast/$ZONE/forecast \
| jq -r '.properties.periods[] | [.name, .detailedForecast] | join("\t")' \
| column -t -s $'\t'
# Find grid with same curl
GRID=${GRID:-MTR/93,131}
echo ""
echo "Next 24 hours for grid $GRID"
curl -s -A MyWeather/1.0 https://api.weather.gov/gridpoints/$GRID/forecast/hourly \
| jq --arg date $(date -Is) -r '.properties.periods[] | select(.startTime >= $date) | [(.startTime), ((.temperature|tostring) + " " + .temperatureUnit), (.windSpeed + " @ " + .windDirection), .shortForecast] | join("\t")' \
| column -t -s $'\t' \
| head -n 24
Weather discussion script (also using regexps to parse HTML):https://gist.github.com/lachesis/6c7e5020b112fe8d7bcc83d99da...
Some docs on the "DWML rest API" that provides the dewpoint/humidity forecasts that I mentioned earlier:
https://graphical.weather.gov/xml/rest.php
https://graphical.weather.gov/xml/DWMLgen/schema/latest_DWML...
https://graphical.weather.gov/xml/docs/elementInputNames.php
Here's the script I use to access that API but it is still under active development and is pretty tailored for my situation. Please forgive jankiness. Give it LAT / LNG environment variables.
https://gist.github.com/lachesis/480a1811c75999205cb17a119b4...
Bonus points, for CA fire season, here's a script that shows PM2.5 for AirNow stations near a certain LAT/LNG:
https://gist.github.com/lachesis/a47212c848430e16e7d1ec6d855...
https://www.weather.gov/arx/why_dewpoint_vs_humidity
> less than or equal to 55: dry and comfortable
> between 55 and 65: becoming "sticky" with muggy evenings
> greater than or equal to 65: lots of moisture in the air, becoming oppressive
But yeah, treating those guidelines as anything other than a loose suggestion is meaningless.
Now, I don't know if anyone truly needs the weather in their terminal prompt, but it is doable.
see the readme here for all options:
This might be useful for temperature, humidity, wind, preciptitation, and similar measures, either as quantities or timelines.
https://en.wikipedia.org/wiki/Sparkline
https://github.com/deeplook/sparklines
Similar:
https://www.linux-magazine.com/Issues/2016/183/Calc-Conditio...
invoke-restmethod wttr.in/?format=4
…and I think it was quite compact
But I don't. I may steal this idea later, than there would be a whole 2 of us!
I have also started adding a time stamp to the second, so that when I run long commands and come back later in a tmux session I can see when it finished.
There's a method that takes 0 space: just change the color of the prompt symbol depending on the weather status (sunny, cloudy, raining, snowing).
didn’t this really come up when MS was designing PowerShell?
Stuffing a three days weather report into $PS1 might be to much information for a prompt.
1. Either give me an error and exit, or warn me about something meaningful 2. Show me the location of the weather report, as it stands I'm left guessing
Otherwise, it's nice to see people making simple text interfaces for important data like this.
Everything in tiny ascii strips. Even shopping, or other needs. A challenge in cute minimalism (not crippled).
alias weather=weather function weather() { if [ $# -le 2 ]; then Command="wttr.in/$1" if [ $# -eq 2 ]; then Command="$Command,$2" fi fi Command="curl ${Command// /%20}" eval $Command }
Yes, if this guy is a state-sponsored computer security hacker, he could pown the 3, maybe 4, ppl (and I am one of them) using its http services via curl and our terminals or image format parsers or etc. Is this worth for that many ppl?
Anyways, that's too sexy, I am willing to take the bait.
That said, I could use an official/trusted online source for the weather information and format it myself (I guess I would get a CSV or json or xml file).
vim ~/.bashrc
``` alias weather='/usr/bin/curl wttr.in' ``` :wq
and now:
weather
alias weather="curl wttr.in && curl v2.wttr.in && curl v3.wttr.in"
so that it shows me the temperature chart and map as well. Well, v3's map isn't working so I commented that out for now but they say it should work in the future.curl wttr.in/:help
Tou get a help document, which also shows you a way to get a suggested bash function; to wit:
curl wttr.in/:bash.function
watch -n 600 -c 'curl -s v2.wttr.in/'
This ALMOST works, but somehow it messes up the formatting for me. For some reason watch doesn't pass through formatting cleanly or so?
You can try to run it with any command that has ANSI output, and you will see it.
As a simple alternative, you write your own 'watch' like this:
while true; do curl -s wttr.in; sleep 60; clear; done
while sleep 60; do clear; curl -s wttr.in; done
Otherwise, I very often get a loop which stubbornly refuses to abort, and I have to hammer both Ctrl-C and Ctrl-\ to make it stop. The downside is, of course, that I have to wait 60 seconds (in this case) the first time. When this is a problem, I just unroll the loop slightly and add an extra invocation to the beginning: clear; curl -s wttr.in; while sleep 60; do clear; curl -s wttr.in; done
This could be generalized into a terminal watch function: termwatch(){ delay="$1"; shift; clear; "$@"; while sleep "$delay"; do clear; "$@"; done; }
termwatch 60 curl -s wttr.inAccording to The Fine Manual: watch --color (-c for short) , should render color correctly, eg.
watch --color ls --color
but watch --color curl -s v2.wttr.in
doesn't quite play ball.In the end I went with something like your solution. I didn't need to put the sleep 60 as the first operation though.
#!/bin/bash
while true; do
clear
curl -s v2.wttr.in
sleep 100
done
^C breaks out of this loop just fine on my system.It might be different when run as a script (with a separate shell process) to when run as an explicit loop in an interactive shell, or a shell function.