arusekk
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Friday September 25, 2026 @04:32AM (#49841728)
I presume kgraves meant something along either lack of compensation being unfair to me, or me spoiling the market by being sort of fine with it, or both. It's a valid opinion to have.
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Friday September 25, 2026 @03:57AM (#49841493)
I think you might have misunderstood. The source code of SourceHut itself is hosted on SourceHut, and it has a CI/CD setup that packages the microservices as alpine packages, signs and uploads them automatically to mirror.sr.ht, as files. This is no different than having a pypi-upload action (or similar) on GitHub.
The only material difference is that the deploy keys for *.sr.ht present (by design) on builds.sr.ht also have access to `doas apk upgrade -Ua` and to `doas rc-service *.sr.ht restart` on the production infra. Which is harmless by itself, but might result in Continuous Ownage if a rogue build happens to have access to the keys.
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Friday September 25, 2026 @01:01AM (#49840358)
Fixed! (You can send me patches for https://git.sr.ht/~arusekk/arusekk.srht.site too)
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Friday September 25, 2026 @12:57AM (#49840339)
I hope they will one day. I said I'm fine with verbal credit if they don't have money, so I won't nag them unless I end up finding more.
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Thursday September 24, 2026 @06:59PM (#49837943)
That might have been DNS, the website itself is on sourcehut pages. Should be fine now for a while.
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Thursday September 24, 2026 @06:57PM (#49837929)
You're welcome!
Re:Sourcehut account takeover via build logs (XSS in ansi2html)
on Thursday September 24, 2026 @06:57PM (#49837924)
I would prefer to do a super proper disclosure with coordinated release dates and everything. My first submitting to SourceHut security ML ended up making the vuln existence somewhat public before upstream ever knew.
Sourcehut account takeover via build logs (XSS in ansi2html)
Re:Libertix installs Linux with 3 mouse clicks for Windows users
on Monday August 31, 2026 @11:11AM (#49510744)
Looks similar to mine (but mine has zero vibe code, unlike this one): https://1clicklinux.org
Re:Omarchy Impersonated at Omarchy[.]Net
on Thursday July 02, 2026 @05:48AM (#48758884)
Is there someone making a list of such incidents? It would be very interesting to take a broader look.
Omarchy Impersonated at Omarchy[.]Net
Show HN: Lossless GIF recompression via exhaustive search
Re:Ask HN: What are you working on? (June 2026)
on Monday June 15, 2026 @06:21PM (#48547812)
I'm working on my easy Linux installer and its website. https://1clicklinux.org
Re:Show HN: Linux installer .exe without pendrives (secure-boot compat...
on Wednesday April 22, 2026 @03:36AM (#47860308)
The worst part I think was getting Qt to link statically, and also forcing Windows commandline utilities to output UTF-8 instead of garbage like cp437 etc.
Show HN: Linux installer .exe without pendrives (secure-boot compatible)
It is fairly simple, but useful for non-power users: a statically-linked Qt app that gracefully edits Windows Boot Manager to do a reboot-once into GRUB, which in turn launches ZorinOS live/installer from disk loopback. I needed to make a custom initramfs with dislocker in it, and to squeeze it a little (default Windows EFI partition is not so big).Currently my biggest issue is that systemd is...