CyberShadow

2 माह पहलेdiscuss

Kernel panic.

2 माह पहलेdiscuss

Seems to be that the sort function accepts a ternary predicate but then passes it to an implementation accepting a boolean one?

CyberShadow

2 माह पहलेdiscuss

No, I think I'm seeing the same bug. Time seems to sometimes subjectively freeze:

    ─── Messages ───                                                                                                                                                                                                              
      Old man shuts the gate behind you. You hear him mutter "every time, I swear..."                                                                                                                                              
      You must retrieve the Amulet of Lost Semicolons.                                                                                                                                                                             
      You kill the rat! (sneak attack!)                                                                                                                                                                                            
      The rat squeals and dies!                                                                                                                                                                                                    
      You wait. (x10)                                                                                                                                 ᛜ                                                                            
    ᚢ You kill the rat! (sneak attack!)                                                             ᛉ                                                                                                                              
      The rat squeals and dies!                                                                                                                                                                                                    
      You hear muttering.                                                  ᛋ                                                                                                                                                       
      You hear muttering.                                                                                                                                                                                                          
      You hear muttering.                                                                                                                                                                                                          
      You hear a distant creak.                                                                                                                       ᛖ                                                     ᛃ                      
      The runestone crumbles as you touch it. You learn: ᛟ means "ice"!                                               ᛚ                                                                                                            
      You hear a distant creak.                                                                                                                                                                                                    
      The goblin misses you. (x3)                                                                                                                                                                                                  
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                           ᛏ                                                                                       
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                 ᛚ                                                                                                     
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                                                                                                                       
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin misses you. (x2)                                                                                                                                                                                                  
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin kills you!                                                                                                                                                                                                        
      You die...

Note how there were no user action messages during the time the goblin was attacking.

CyberShadow

3 माह पहलेdiscuss

Same, I've added a .#screenshots derivation. High up-front effort but almost zero maintenance afterwards.

Bonus: since you're generating screenshots programmatically anyway, you can generate a pair of each with your app's light/dark theme, and swap them in/out depending on prefers-color-scheme: dark. <picture> elements work in GitHub READMEs, too: https://github.com/CyberShadow/CyDo#readme

CyberShadow

4 माह पहलेdiscuss

If you grant access to the Nix daemon socket but not writing outside the current directory, that's an effective sandbox. It allows evaluating derivations but not actually installing them.

CyberShadow

4 माह पहलेdiscuss

If you invoke Claude Code with --input-format stream-json --output-format stream-json, you can use it headlessly. I built a personal UI / orchestration framework around it. Most features are available, but not exactly all (e.g. there is no way to undo via this protocol, but you can still do it manually by terminating / editing the session file / resuming). Other agentic software has similar features (Codex uses JSON-RPC, Copilot CLI has ACP which is also based on JSON-RPC).

CyberShadow

6 माह पहलेdiscuss

Are you on macOS? That might be a feature specific to that OS, I don't think Firefox does that on other OSes.

CyberShadow

6 माह पहलेdiscuss

Can you share what made this behavior obvious to you? E.g. when I first saw Open Code, it looked like yet another implementation of Claude Code, Codex-CLI, Gemini-CLI, Project Goose, etc. - all these are TUI apps for agentic coding. However, from these, only Open Code automatically started an unauthenticated web server when I simply started the TUI, so this came as a surprise to me.

CyberShadow

6 माह पहलेdiscuss

> Browsers don't let random pages on the internet hit localhost without prompting you anymore

No, that's a Chrome-specific feature that Google added. It is not part of any standard, and does not exist in other browsers (e.g. Safari and Firefox).

> The rest is just code running as your user can talk to code running as your user

No, that assumes that there is only a single user on the machine, and there are either no forms of isolation or that all forms of isolation also use private network namespaces, which has not been how daemons are isolated in UNIX or by systemd. For example, if you were to ever run OpenCode as root, any local process can trivially gain root as well.

CyberShadow

6 माह पहलेdiscuss

PSA - please ensure you are running OpenCode v1.1.10 or newer: https://news.ycombinator.com/item?id=46581095

CyberShadow

8 माह पहलेdiscuss

I don't think you understand. This website imposes its own time limit within which I must solve the CAPTCHA. Taking your time to solve the challenge slowly will not allow you to proceed, because the website's timeout will have expired.

CyberShadow

8 माह पहलेdiscuss

Looks like it's impossible for me to use this service - when I try to submit the form, I get a reCAPTCHA challenge. By the time I complete it (Google requires me to make several attempts, each one being several pages), the page errors out in the background with "reCAPTCHA execution timeout".

CyberShadow

4 वर्ष पहलेdiscuss

Hey, you forgot to put this in the title: "written in Rust" :-)

This looks nice, though I looked through my command history of "watch" and couldn't find any use cases where hwatch would be more useful. Am I using it wrong?

CyberShadow

Submissions

Unauthenticated remote code execution in OpenCode

comments