rkta

> The suggestion that paying OSS maintainers is a solution really misses some major issues.

As a maintainer, the biggest major issue is that I don't want their money.

The quilt patch series comes from the time when I was basing my work on the Debian version, it was easier for me to follow upstream than rebasing branches.

Most patches are now merged into master, only some unfinished work is still in that series. I should update the docs.

And as my browser does not automatically follow any redirects I'm left with some text in a language I don't understand.

There is an maintained (by me) fork at https://w3m-pager.org

Here is my fork of w3m, which is not dead:

https://w3m-pager.org

> Text fragments are currently supported in all the browsers.

All meaning all the browsers listed in the linked table. These may be the major browsers, but not all of them.

Why don't you read your local man pages? w3m comes with w3mman to do so.

With local man pages I know at least that the man page matches my installed version.

> An attacker can use this vulnerability to obtain root on OpenBSD 7.4 and 7.5.

Ouch! And this all due to unsanitized user input. I really would have expected better from OpenBSD in 2023. I mean I would expect better from everyone but especially from OpenBSD.

It's still there and it works quite well for HN because it can display the spacer gif, so you get indentation for the threads.

After reading the website and also trying the mentioned `ssh pr.pico.sh help` I still don't know what exactly to do to use this.

> 4. External contributor submits a PR to SSH server But how? That numbered list let me think of that old cartman profit meme.

I like the idea, but I'm not convinced yet, that this is really easier than just sending an email by `git request-pull`.

> Sure, who cares, nobody targets w3m in 2024.

I care. There's still w3m users out there - and I am one of them.

I don't care if the website looks like shit, but at least keep it usable for us.

Parsing ls is an anti-pattern, but the author says it works for years - we all do mistakes and as long as it works you don't notice.

And it's an easy fix:

    - for project in $(ls go-cicd); do
    + cd go-cicd || exit 1; for project in \*; do

The attacker had access to the GH mirror of the repo. The original repo remained at https://git.tukaani.org/

What's malicious about that patch? From reading the thread it looks like an attempt to fix a FP from some tooling.

The official channel for the project.