megamorf
Re:Tailcat – Like netcat, but over Tailscale’s data plane
on Wednesday August 26, 2026 @03:00PM (#49454070)
So this is somewhat similar to Iroh?
Re:Hax – a minimalist, terminal-native coding agent written in C
on Wednesday August 12, 2026 @12:55PM (#49275410)
I don't understand why anyone would still start a new software project in C today, given the long track record of mistakes developers can make in it.
Re:How to Record and Retrieve Anything You've Ever Had to Look Up Twice
on Monday March 02, 2026 @05:02AM (#47215900)
I'd love to hear more about this; have you considered creating a blog post, gist or something similar about it?
Re:Show HN: Continue – Source-controlled AI checks, enforceable in CI
on Tuesday February 17, 2026 @04:32PM (#47053688)
How is it different from https://github.github.io/gh-aw/?
Re:Quebec to ban public prayer in sweeping new secularism law
on Saturday November 29, 2025 @10:25AM (#46088227)
Why is that horrific? To me it sounds like something desirable. Religion is a personal matter, as such it should not infringe on public spaces.
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Write Access...
on Wednesday August 20, 2025 @04:43AM (#44959979)
The exfiltrated environment variables contained these entries:
``` "POSTGRESQL_DATABASE": "(CENSORED)", "POSTGRESQL_HOST": "(CENSORED)", "POSTGRESQL_PASSWORD": "(CENSORED)", "POSTGRESQL_USER": "(CENSORED)", ```
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Write Access...
on Wednesday August 20, 2025 @04:36AM (#44959941)
The security researcher noticed that CodeRabbit runs linters against your code base and noticed that Rubocop was among the provided linters. Rubocop supports extensions that contain custom code, so he crafted an extension that exfiltrated the environment variables of the running Rubocop process when it linted the contents of his PR.
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Write Access...
on Wednesday August 20, 2025 @04:29AM (#44959906)
Howon, you can stop posting that canned response. It's not helping the discussion in any way and matches the lack of detail the other commenters have pointed out.
Re:Polypane, The browser for ambitious web developers
on Tuesday March 25, 2025 @07:34PM (#43477236)
Never heard of the product and just had a look at the landing page. Immediately spotted a typo :D
> On Mac, Window and Linux
should be
> On Mac, Windows and Linux
Re:French gov's open source alternative to Notion or Outline
on Sunday March 16, 2025 @03:30PM (#43381486)
Space goes after the comma, not in front of it.
Re:French gov's open source alternative to Notion or Outline
on Sunday March 16, 2025 @03:30PM (#43381481)
Seconded, it’s really irritating
Re:Certificate Transparency in Firefox: A Big Step for Web Security
on Saturday March 01, 2025 @05:36AM (#43217974)
Doesn't this effectively render corporate CAs useless?
Re:Vale's First Prototype for Immutable Region Borrowing
on Wednesday July 12, 2023 @04:12AM (#36691700)
I was confused by the title because when my bubble talks about Vale they mean this:
Re:Show HN: GitHub Org Audit Tool
on Friday November 11, 2022 @04:27AM (#33558681)
That's actually incorrect. Check out this query: https://gist.github.com/megamorf/9c105ac9cc13a93b5449a7b683d...
I have added two output examples. One for when you only want to find users that have been directly assigned to a repo (DIRECT) and one that shows how their roles and team memberships decide what permissions they have on a repo.
Re:Show HN: GitHub Org Audit Tool
on Thursday November 10, 2022 @08:08PM (#33556114)
Unfortunately, it leaves a lot to be desired. I've actually had to do a fair bit of GH access reporting myself recently and I can recommend the GraphQL API as it allows you to properly list direct and indirect permissions on repositories (org + team + direct collaborator) that are alot harder to do with the REST API due to its inconsistent permissions model.