Uber CLI(github.com)
github.com
Uber CLI
https://github.com/jaebradley/uber-cli
60 comments
We have Unicode now.
Not everyone and not everywhere, and depending on the font, the line-drawing characters may not be the same width as the others even if it's a monospace font (e.g. see https://blog.helftone.com/ascii-art-unicode/ ). The whole point of text files in things like RFCs is to be as portable as possible, and using Unicode somewhat defeats that point.
Not everyone and not everywhere, and depending on the font, the line-drawing characters may not be the same width as the others even if it's a monospace font (e.g. see https://blog.helftone.com/ascii-art-unicode/ ). The whole point of text files in things like RFCs is to be as portable as possible, and using Unicode somewhat defeats that point.
That's a problem. The above example looks good in a Ubuntu terminal window and in Firefox, but misaligned in the "gedit" text editor. In the SciTE editor, the line drawing characters show as four hex values in a box. groff, even with the "preconv" preprocessor for Unicode, can't display them either.
The box drawing characters aren't even in the astral planes. They're in plane 0 in the 0x2xxx range. So even old 16-bit Unicode implementations should support them.
(The TCP header from an RFC was just an example. I'm converting some old troff documents to PDF, and they have lots of box drawings.)
The box drawing characters aren't even in the astral planes. They're in plane 0 in the 0x2xxx range. So even old 16-bit Unicode implementations should support them.
(The TCP header from an RFC was just an example. I'm converting some old troff documents to PDF, and they have lots of box drawings.)
My take-away from the Monodraw writeup was that Unicode is just as portable, and all Unicode line drawing glyphs are the same size in monospace fonts -- they're just not available in all fonts. When that happens, a different font may be substituted by browsers (probably not by Terminal, though).
I wouldn't put the finger on Unicode but rather that not all fonts have all Unicode glyphs yet, as I seem to recall was the case with ASCII line drawing glyphs years back. Definitely seen that before and it's good to know why. Thanks!
I wouldn't put the finger on Unicode but rather that not all fonts have all Unicode glyphs yet, as I seem to recall was the case with ASCII line drawing glyphs years back. Definitely seen that before and it's good to know why. Thanks!
Very nice. Just one question: what if the host environment uses a large line height?
That argument to UberClient() looks like an API token. Did you mean to leave it in there for the world to use?
https://github.com/jaebradley/uber-cli/blob/master/src/servi...
https://github.com/jaebradley/uber-cli/blob/master/src/servi...
Not sure this was submitted by the original author. I forwarded a note to the repo owner pointing back here.
Hey, I'm the author (thanks @zoodle for notifying me).
Obviously, this is a security issue that is pretty much bottom-of-the-barrel-shitty.
My explanation is that I didn't feel like standing up a middleware service to direct traffic through in order to obfuscate the server token. Especially for a tool that I anticipated being used by pretty much only me.
Not a satisfying answer, but thanks for exposing this security flaw - definitely going to add it to my project task queue.
Obviously, this is a security issue that is pretty much bottom-of-the-barrel-shitty.
My explanation is that I didn't feel like standing up a middleware service to direct traffic through in order to obfuscate the server token. Especially for a tool that I anticipated being used by pretty much only me.
Not a satisfying answer, but thanks for exposing this security flaw - definitely going to add it to my project task queue.
There's no need for a middleware service. Just store it outside of the repo.
It's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...
$ uber time '123 anywhere st'
No API key found. Please create one using the
instructions at <site> and call 'uber set-key <key>'
$ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo
Well done!
$ uber time '123 anywhere st' # reads <key> from file, works as you have it
...I think the idea is that you implement some interface for interested users to supply their own API keys.
Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.
A friend of mine accidentally pushed his Heroku or New Relic API key to a toy repo which was public and that information was immediately scraped and used. He was billed a non trivial about which he disputed but cost some time and headache.
Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.
Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.
Yep!
So if I clone this repo I can now access your API account? Might want to pull this repository from Github......
You would have access to my server token, certainly. But I checked the documentation and in order to request rides, I think you would need other pieces of information that I did not expose. Additionally, there are various scopes that Uber grants regarding the API exposure that any application has.
I think / hope that the worst damage that can be done is hitting Uber's rate limit.
Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).
I think / hope that the worst damage that can be done is hitting Uber's rate limit.
Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).
until they launch a new API endpoint and forget to enforce something...
I guess it might be better to disable the api key...
How does Google Maps get this information? They probably have their middleware, right?
> Can't really use an environment variable at that point, right?
Why not?
Why not?
See also src/services/GeocodeService.js
Do tell me, why are you still using Uber? What needs to happen? Let's see: Weakening the rule of law by deliberately ignoring taxi legislation, that's not enough. Rebuilding indentured servitude via subprime mortgaged cars where the payment comes out of the drivers' wages, that's not enough. Launching self driving cars going again against regulations and putting cyclists in deadly danger, that's not enough. Treating women like shit, that's not enough. Stealing Google tech brazenly, that's not enough.
Tell me, what would be enough?
Sources for subprime loans: http://valleywag.gawker.com/uber-and-its-shady-partners-are-... https://www.bloomberg.com/news/articles/2016-05-31/inside-ub... https://twitter.com/shashashasha/status/688734478181732352 Self driving shit: https://www.theguardian.com/technology/2016/dec/19/uber-self... the rest is either obvious or recent enough not to need a source.
Tell me, what would be enough?
Sources for subprime loans: http://valleywag.gawker.com/uber-and-its-shady-partners-are-... https://www.bloomberg.com/news/articles/2016-05-31/inside-ub... https://twitter.com/shashashasha/status/688734478181732352 Self driving shit: https://www.theguardian.com/technology/2016/dec/19/uber-self... the rest is either obvious or recent enough not to need a source.
This is about Uber CLI not about your 'righteous' war against uber.
You could make the case that, since they have a -140% profit margin, the best way to hurt them is to use them all the time ^_^ Every $1.00 you give them costs them $2.40, every dollar you don't give them costs them nothing.
As long as investors see people using them, there'll be money. Stay away.
Using this, a command that will get your public IP, geo locate it, and then get an uber pickup time for those coordinates.
dig +short myip.opendns.com @resolver1.opendns.com | xargs -I {} echo "ipinfo.io/"{} | xargs curl | grep loc | cut -d: -f2 | sed "s/,$//" | xargs uber time
dig +short myip.opendns.com @resolver1.opendns.com | xargs -I {} echo "ipinfo.io/"{} | xargs curl | grep loc | cut -d: -f2 | sed "s/,$//" | xargs uber time
Nice ipinfo.io mashup! This whole part
But ip geolocation usually gives you city or zipcode level accuracy, which may or may not be good enough to get an accurate uber estimate depending on how big your city/zip area is.
dig +short myip.opendns.com @resolver1.opendns.com | xargs -I {} echo "ipinfo.io/"{} | xargs curl | grep loc | cut -d: -f2 | sed "s/,$//"
curl ipinfo.io/loc
But ip geolocation usually gives you city or zipcode level accuracy, which may or may not be good enough to get an accurate uber estimate depending on how big your city/zip area is.
too bad IP geolocation is pretty bad. if you're lucky you'll get the city correct but that's about it.
I thought everyone already deleted that app...
I was just going to ask if this would let someone delete their account... ;) [EDIT] No, it doesn't support deleting accounts.
__jal(1)
I'd be more interested in this except for Lyft instead of uber.
Like many others, I'm done with the tire fire that is uber.
Like many others, I'm done with the tire fire that is uber.
And what if you fly somewhere outside the US ? still no Uber ?
I've found trains are very good outside the US.
ok, what about train-less cities ? i can list 10s of them in third world countries ..
Use a taxi.
In the UK that would be doubling the cost and receiving a much worse service.
Tech workers may be uninstalling Uber in protest in the valley but non-tech people do not know that there is even an issue/scandal.
When I am sharing a ride with friends in London I'm not going to say: "No, I can't share the fare because I uninstalled Uber".
Tech workers may be uninstalling Uber in protest in the valley but non-tech people do not know that there is even an issue/scandal.
When I am sharing a ride with friends in London I'm not going to say: "No, I can't share the fare because I uninstalled Uber".
clearly you haven't been in too many third world countries :)
try getting a reliable yellow taxi driver in those countries who WON'T try to pull a trick on you :) they exist, but are a minority (or at least not a majority)
Is there a way for this to grab your current location, so you don't have to type your address?
Google maps makes it easy to see the estimated prices of Uber and other services.
The goal of this project is to be able to check it from the command line. So while you're at the computer, you can check it via CLI rather than opening a browser.
I think the authors intent was just for his own use and some fun.
I think the authors intent was just for his own use and some fun.
Great, just another thing I need to delete
Well it's on npm so the Author will delete it once you become dependent on it.
aioprisan(2)
I have a program which takes text files with ASCII line art and automatically turns them into text files with UNICODE line art.[1] I wrote this for some very old documents, but it's still useful.
[1] https://github.com/John-Nagle/pasv/blob/master/src/Util/picf...