taviso

That's what the manual on fedora says too, but it is disabled by default. I admit, I didn't try building from pristine source, so it could be patched!

I use it too, nothing is quite so configurable, feature rich or reliable. I'll admit that XtTranslations are not user friendly, but they are powerful!

I think the mitigation advice is incomplete, allowFontOps is disabled by default, so the mitigation is only necessary if you've enabled it.. but in that case you would need to put 'allowFontOps: false' after the stanza enabling it, right?

ffmpeg can capture an xterm as a source, it's called x11grab.

> what in the world would anyone need chromium for?

Perhaps rendering an xterm.js canvas? (I don't know, it's just a guess)

I've actually used ffmpeg + GNU screen to do something very similar in the past.

The benefit of using GNU screen is that the "tape" can be a shell script. I suppose if you don't like shell scripts that's not a benefit, but I do like them.

For example, instead of:

    Type "echo 'Welcome to VHS!'"
    # Pause for dramatic effect...
    Sleep 500ms
    Enter

With GNU screen, you would write:

    #!/bin/sh
    screen -d -m -S whatever -- bash
    screen -S whatever -X stuff "echo Welcome to screen" 
    sleep 0.5
    screen -S whatever -X stuff $'\n'

If you want to start interacting with the session, just do screen -r whatever

You can also read what is in the screen with -X hardcopy, then do something with the output, like verify the output is correct or adjust the input.

I once made an fvwm config designed to look like QNX photon (this was early 2000s). I got dozens of emails about it from people who had found the screenshot and wanted to try it!

Here is an old screenshot from ~2003: http://www.xwinman.org/screenshots/fvwm2-taviso.png

All the panels and menus were all fwvm, it's highly configurable. I dunno, it kinda holds up!

I can't believe it didn't mention my favorite, asciipOrtal

A few years ago I extracted the CDS logic and got it working in Linux so I could experiment with it:

https://twitter.com/taviso/status/902997594460135424

I had planned to see if I could come up with an image that would still be detected even with significant distortion, and then print it on a t-shirt... The idea being you couldn't open a photograph of me in PhotoShop! :)

I got sidetracked, but I should get back to that.

Apologies - I'm not a lawyer or policy expert. Cloudflare personnel asked a friend at the FTC to initiate an investigation into someone they perceived as a critic. If lobbying is not the correct term for that, then I misused it.

You've got my attention with the sixel support. I use screen quite heavily, but I'm open to switching for something like that.

I think I use screen in an unusual way, I know a few keyboard shortcuts but 99% of the time I use the command line.

If you press Ctrl-A :, you get a command line with tab completion to access all the screen commands. I have no idea what the shortcut is to split a window, because I just use :split. Same with :resize, :focus, :remove, :paste, :title, etc, etc. I'm quite happy with one less application I need to memorize bindings for, and I'm reluctant to give that up!

Does Zellij do something similar?

> I don't think it's worth spending much time getting into these arguments because the people arguing against Excel clearly don't know modern Excel very well.

That's not it at all. Excel has been in active development for over 30 years by a multi-trillion dollar development powerhouse with billions of sales, everybody is aware it's a perfectly competent product.

The dispute is the objective claim that it can do something that alternatives cannot, not the subjective claim that Excel is "neater", or more beautiful, or more user friendly. After 30 years of active development I would hope that Excel has some shortcuts, polish and syntax improvements to streamline common operations. That is not the same as not being able to do something.

I question the claim that it can do something unique, and want to hear an example. When pushed for an example I'm told that only Excel has a Solver, or only Excel has Pivot Tables. That is objectively false.

I don't want to hear about "Power Query" unless it's an example query that cannot be done in SQL. It's a proprietary query language, of course alternatives don't have it. I'm glad you're happy about it, but others might call that "Vendor Lock-in".

https://en.wikipedia.org/wiki/Vendor_lock-in

I'm happy that you like this syntax, but the claim you made was "no you fucking well cannot [do everything]", not "excel syntax is more fucking beautiful".

I appreciate your advice, but I don't need to watch a video on R1C1 syntax, I literally maintain a spreadsheet :)

It seems like your real claim is that you really like the way Excel does it, nobody can argue with that.

You need to come up with a task that cannot be accomplished, remember you said "no you fucking well cannot [do everything]", but so far I've seen no examples.

I mean, isn't this just a button that adds some named ranges for you?

You can replicate the exact example you gave with named ranges. If there is something it can do that named ranges can't, then please use that example instead. Similarly, if you think there is something that "Power Query" can do that SQL cannot, then please show that.

I literally use Lotus 1-2-3 for UNIX (I'm not kidding! http://123r3.net).

So far, all of the examples I've seen you give could have been done in 1989 on a VT100 terminal connected to SystemV. You could even write a quick macro in that generates the named ranges from column headers with one keystroke, it would be really trivial.

Lotus 1-2-3 had a Solver (two actually, one called "Solver" and one called "What-If") in 1989. Yes, LibreOffice has one too.

Does Microsoft tell their customers they invented these features? Just a few days ago I saw a Windows developer who thought Microsoft invented conditional breakpoints.

> It also really annoys me when I see Linux/FOSS partisans tell Windows normies "oh you can do everything you can do in Excel in LibreOffice Calc" -- no you fucking well cannot. (And I use Linux on my personal computers full time).

It seems like your argument is that alternatives don't have PowerQuery. That might be true (I don't even know what it is), but isn't that like saying Linux can't compete with Windows, because it doesn't have Internet Explorer? I mean, it doesn't, but there are excellent alternatives that can accomplish exactly the same task.

Unless you can come up with an example task that can't be completed, then it seems like it's just a matter of opinion which is the better solution.

As far as I know both Google Sheets and LibreOffice have SQL and Pivot Tables, and -- believe it or not -- Lotus 1-2-3 had "/Data queries" in 1989. Naturally, the queries possible in 1-2-3 were limited, but you really could query large tables for things like "[Date] <= #date(2017,6,1)", which is the first result I got from typing "Power Query example statement" into Google.

Tell him about my Linux port, I'm updating it regularly and fixing bugs :)

https://github.com/taviso/123elf/wiki/Getting-Started

I don't know what you mean by "one-off task", of course you can save the commands you use most often. I think part of mastering vim is thinking about movements and commands in a more generalizable way, then macros are just second nature. Macros just make all the insane one-off editing tasks everyone runs into trivial.

This morning I needed to byteswap all the hex constants in several huge tables, I don't know if I've ever needed to do this before, and probably won't need to ever again. I did it in vim with a macro that took me seconds (something like qa2xlpj3hq1000@a).

Sure, this isn't for everyone, but one day you are going to want a minor variation on the operation your magic button performs... and I think you're going to have to take a swig of coffee and just sit there doing it manually!

I'm a fellow mutt user - I've always used ~80 column limit... it makes me wince thinking of removing it!

I do hear from non-nerd contacts asking about the line breaks, perhaps you're right, maybe it's time!

They are fundamentally different ways of thinking about editing, so this doesn't read like an apples to apples comparison.

Vim is all about chaining small commands together to perform complex operations, like building a pipeline in UNIX. You start off learning a few basic commands, then as your vocabulary increases you can construct increasingly complex tools just by hitting a few keys. A Windows veteran hearing about head, grep and cat for the first time might think "I can do all of that in notepad, this UNIX thing is a waste of time"... then they watch a UNIX greybeard build a pipeline in seconds that automates a hour-long workflow of clicking and form filling.

There are criticisms you could make that would read as fair, "many common editing operations are more accessible in foo", "features in foo are more discoverable", "the learning curve in foo is shallower", "I don't think it's worth the time investment to become proficient in vim/emacs" (but you would be wrong!).

It's not surprising that it's possible, sixels are basically just a canvas. It's that they've always been a novelty, very rarely used or supported. Yet somehow they made it into a commercial product in 1992 -- that's surprising!

I think sixels are seeing some resurgence today, terminals are fast enough now to use it to render video. I wonder if GNU ls will add ls --thumbnails :)

WordPerfect 6 did have an optional graphical mode that wrote directly to the framebuffer, I've never used it though!

Is it possible you're thinking of that?

There is a screenshot of it on this page: https://thewanderingnerd.wordpress.com/2015/04/19/corel-word...

You mean because it uses foo=bar rather than --foo=bar? I don't know, it's not that weird.

I mean, find uses parentheses for forcing evaluation precedence, e.g. -foo -or \( -bar -and -baz \). That's pretty unusual.

Even if firefox was running under a different UID, they would still have to grant it access to the X server via xhost/xauth or whatever.

They have certainly misunderstood the attack. Claiming this has zero utility is effectively saying sandboxing is useless, which is just plain wrong.

Congratulations to Mozilla for getting this shipped!

Funny, I think I might be one of the worlds foremost experts on PostScript security :)

I spent a lot of time researching PostScript interpreter security, and ended up finding a bunch of really interesting bugs. There are of course the regular memory corruption, type confusion, etc, bugs, but PostScript has it's own security model that's intended to stop documents you're printing from interfering with the runtime environment or using internal operators. Those bugs can be fascinating!

The TL;DR summary is that PostScript functions are basically just arrays, so to stop documents you're printing from peeking inside and altering system routines, there is a security boundary called "executeonly". The intention is to allow documents to to call routines that might do something powerful on their behalf - e.g. open a printer specification, or run `lpr` or whatever - but not let them open any file or run any command they want.

If you could interfere with them, you can break that expectation and get access to root-equivalent operators that let you do whatever you want. Turns out, that's really hard to get right - often you can trick them into faulting and then crawl through the error state to find references to their internals you're not supposed to have!

Exploiting these bugs requires some really weird PostScript, here are fun examples:

https://www.openwall.com/lists/oss-security/2019/01/23/5 https://bugs.chromium.org/p/project-zero/issues/detail?id=16...

I found about a dozen bugs like these while working on it, fun times.

I'm surprised to hear that, I thought retdec was pretty well regarded.

I spoke to the researcher on twitter, his claims don't make much sense. He sent me a file he said proved his claims, but it was just some naïve attempt at directory traversal that couldn't possibly work. When I told him that, he said "that file doesn't belong to me anyway" - then explained he was planning his wedding and was too busy to answer more questions.

Logically, if there was a way to escalate privileges via 7-zip, then it could also be exploited with CreateRemoteThread() - why would a heap overflow be necessary? What change to 7-zip has he requested that would prevent that? Why the bizarre drag-and-dropping operation, why not just double click a HTA file?

I suspect there is no heap overflow and no privilege escalation.

Thanks! I still use 123 basically daily, It's really grown on me and I can use it very efficiently.

I wrote a display driver to fix a few quirks when using it in a modern terminal (https://github.com/taviso/lotusdrv), but once that was working I don't really have any complaints, it really works beautifully.

...or if you need one that works in a terminal, I've got you covered :)

https://lock.cmpxchg8b.com/spreadsheet.html

Until recently there was an art project called olduse.net that replayed usenet posts with a 30 year time delay. It worked over nntp so you accessed it with a newsreader.

I really enjoyed reading through old discussions at the speed they happened, but sadly they shut down recently :(

They released the source code though, perhaps one weekend I'll restart it!