Hacker Newsnew | past | comments | ask | show | jobs | submit | yagop's commentslogin


What is the "Easter egg in this article"?


Spoiler alert:

It has an XSS vulnerability baked in - if you add a `?continue=javascript:alert('Hi')`, you'll see a button below the easter egg text



I really would like to use Hetzner but their ToS [1] forbids any cryptocurrency related usage. I only want to archive block transaction data (think a block explorer). I don't know why they are so aggressive with that, I would understand PoW and PoS ban but not a hole industry.

[1] https://www.reddit.com/r/hetzner/comments/wucxs4/comment/ilf...


This is also used by some payment processors (probably belongs to banks).

I can relate as I was in Korea some months ago and in order to buy some concert tickets the platform required me to install that shitty thing. I end up not buying the tickets as it was not possible to me to install anything in my corporate machine.

As you said, my friend point out people don't have it installed in their personal computers but use a third party one which brings more insecurity.


Parsing UNIX command outputs is generally a pain and constantly a source of errors. PowerShell mostly solve that, I wish we can use that.


PowerShell has been available for Linux and Mac for a few years now.

https://docs.microsoft.com/en-us/powershell/scripting/instal...


Lack of WebUSB is the major issue to me.


Can not tell if this is sarcasm or not, but I'll suppose not.

Do you mind sharing your WebUSB use case(s)?


To sing transactions with Ledger or any other cryto devices (see ID cards readers)


During the university we had to write code on paper for exams. Nowadays I think how weird it was.


In Soviet Russia, paper executes the code.


Or just Systemd


Obviously systemd for keeping processes up, but is there a god way to centralise journald logs in one place (and search it). Hoping for something that's pure journald not a syslog equivalent (as I'd rather less software than more).


Nice article. I wrote that lua "wrapper" 2 years ago. I used math.js to avoid RCE on bots, turns out math.js API is vulnerable but doesn't affect the wrapper.


Did you also write the gnuplot plugin? Because that's also vulnerable, as found by the same @denysvitali: https://github.com/LucentW/s-uzzbot/issues/9


That was from @francesco-p (he renammed his account from psykomantis) https://github.com/yagop/telegram-bot/commit/89b92b4cbf81ce1... its in my repo but disabled by default.



vim


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: