Hacker News Reader

megamorfon Tailcat – Like netcat, but over Tailscale’s data plane

So this is somewhat similar to Iroh?

megamorfon Hax – a minimalist, terminal-native coding agent written in C

I don't understand why anyone would still start a new software project in C today, given the long track record of mistakes developers can make in it.

megamorfon How to record and retrieve anything you've ever had to look up twice

I'd love to hear more about this; have you considered creating a blog post, gist or something similar about it?

megamorfon Show HN: Continue – Source-controlled AI checks, enforceable in CI

How is it different from https://github.github.io/gh-aw/?

megamorfon Quebec to ban public prayer in sweeping new secularism law

Why is that horrific? To me it sounds like something desirable. Religion is a personal matter, as such it should not infringe on public spaces.

megamorfon How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

The exfiltrated environment variables contained these entries:

``` "POSTGRESQL_DATABASE": "(CENSORED)", "POSTGRESQL_HOST": "(CENSORED)", "POSTGRESQL_PASSWORD": "(CENSORED)", "POSTGRESQL_USER": "(CENSORED)", ```

megamorfon How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

The security researcher noticed that CodeRabbit runs linters against your code base and noticed that Rubocop was among the provided linters. Rubocop supports extensions that contain custom code, so he crafted an extension that exfiltrated the environment variables of the running Rubocop process when it linted the contents of his PR.

megamorfon How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

Howon, you can stop posting that canned response. It's not helping the discussion in any way and matches the lack of detail the other commenters have pointed out.

megamorfon Polypane, The browser for ambitious web developers

Never heard of the product and just had a look at the landing page. Immediately spotted a typo :D

> On Mac, Window and Linux

should be

> On Mac, Windows and Linux

megamorfon Docs – Open source alternative to Notion or Outline

Space goes after the comma, not in front of it.

megamorfon Docs – Open source alternative to Notion or Outline

Seconded, it’s really irritating

megamorfon Certificate Transparency in Firefox

Doesn't this effectively render corporate CAs useless?

megamorfon Vale's first prototype for immutable region borrowing

I was confused by the title because when my bubble talks about Vale they mean this:

https://github.com/errata-ai/vale

megamorfon Show HN: GitHub Org Audit Tool

That's actually incorrect. Check out this query: https://gist.github.com/megamorf/9c105ac9cc13a93b5449a7b683d...

I have added two output examples. One for when you only want to find users that have been directly assigned to a repo (DIRECT) and one that shows how their roles and team memberships decide what permissions they have on a repo.

megamorfon Show HN: GitHub Org Audit Tool

Unfortunately, it leaves a lot to be desired. I've actually had to do a fair bit of GH access reporting myself recently and I can recommend the GraphQL API as it allows you to properly list direct and indirect permissions on repositories (org + team + direct collaborator) that are alot harder to do with the REST API due to its inconsistent permissions model.