Hacker News new | past | comments | ask | show | jobs | submit | thirdplace_'s comments login

i think more bugs reside here.

if tarball or path is user input then they could be used to inject tar command options.


That, however, is an extremely well-known class of bug. The post is about an extremely obscure (but presumably quite common at the time!) class of bug.


Also, if you're writing about bug x, you might make a minimal reconstruction of that piece of code only to showcase bug x, instead of the full version with all bells and whistles.


That's usually prevented by using double dashes ("--") to indicate the end of options, before the file argument. I try to remember to include include double dashes in my shell scripts for as many commands as possible (it's easier to just include them rather than figure out whether a user could possible influence the filename).


tarball is the mandatory parameter to the preceding -f and can’t be used to inject commands


like it. rss is so simple and cool. problems:

* how to make it easier for users to start using feed readers

* how to make it easier to subscribe to feeds

* how to help users discover new content


Well, back in the day firefox had a rss reader integrated and would detect feeds and put a nice rss icon in the location bar. That kind of addressed the first two points.

As for discovery, I think much like Twitter and other social media, the best discovery is one person you follow just plainly links to some other.


For me RSS reader in Firefox was the best idea hands down because of its simplicity and how well it was integrated with the browser: you'd click on that icon in the address bar and page with summary (originally you'd add feed directly to the bookmarks) and subscribe button would appear and then, modal asking where to put new channel/live bookmarks folder. With bookmarks bar on, you could have a handy folder or folders that changed list of "bookmarks" all day and you could glance thru headlines without actually opening a page. And IIRC, the default RSS channel was customized among all language versions - for British English it was BBC News. I really liked this feature and Mozilla removing it angered me much. For a while I tried using something else - RSSOwl or Feedly, or Nextgen Reader for Windows 10 but nothing could replace it for me.

Somehow Mozilla deducted that this feature is no longer needed due to the maintenance, performance and security costs [1] and it will be removed in v64 which was of course done. This reader was known and luckily at that time already ported as an extension to Chromium-based browsers as e.g. Foxish [2], which then was bring back as Firefox extension Livemarks [3]. That's a long way around trip.

[1] - https://www.gijsk.com/blog/2018/10/firefox-removes-core-prod... , https://bugzilla.mozilla.org/show_bug.cgi?id=1477667

[2] - https://chrome.google.com/webstore/detail/foxish-live-rss/nb...

[3] - https://addons.mozilla.org/en-US/firefox/addon/livemarks/


Indeed, it's pretty easy to 'retweet' something from another feed. RSS items can have a <source> element in them, just point this to the original feed. Et voila, you're 'retweeting' with RSS.


Vivaldi still does that. Has a nice visual formatter of feeds too


> how to make it easier for users to start using feed readers

On mobile, RSS readers like NetNewsWire and Lire are available in app stores. Lire can spider images+text for offline reading.

Podcast app users probably don't even know they are using RSS.

> how to make it easier to subscribe to feeds

On iOS, Lire adds a "Subscribe in lire" option to the Safari share menu. Podcast directories seem to work for podcast apps.

> how to help users discover new content

With the demise of search engines, perhaps directories will resurface?


Literally all of these problems (were) solved.

Its called browser integration.


I am an insecure renter and this scares me. What should I do??


probably relax. Any real effect is likely due to stress.


> It’s very clear that large companies do abuse their market power (price-fixing and collusion)

Can we get some examples of this? (not implying otherwise)


I think Amazon's "most favoured nation" clauses[1] qualify. Or deals like those between Amazon and Apple[2] that excluded third party sellers of Apple products from competing with Apple themselves.

Edit: Another example was the collusion between Canada's bread makers[3].

[1] https://arstechnica.com/tech-policy/2021/05/amazon-sued-over...

[2] https://9to5mac.com/2022/11/09/apple-amazon-lawsuit-price-fi...

[3] https://financialpost.com/news/retail-marketing/why-the-hell...


It's also worth mentioning that such activities are generally illegal. The issue is more the enforcement of the laws than it is the laws themselves.


The problem is that "illegal" in the context of a corporation means a fine. If the fine is less than the extra revenue generated (and it often is), there's no reason not to engage in the illegal behavior.

From the bread pricing scandal, the amount of coordination that was going on between supposed competitors is crazy. The fact that it took "a decade and a half" to prosecute the case means that much more subtle collusion is probably very common.

> “Retail customers would call threatening to reject a price increase if another retailer was offside in terms of pricing alignment.”

> The coordination was particularly tough between discounters including Walmart, Giant Tiger, Loblaw’s No Frills, Sobeys’ FreshCo and Metro’s Food Basics, the document says.

> “None of them wanted to be the first to implement the price increase …There was always a negotiation process going back and forth between the four retailers where the supplier was trying to coordinate it, because somebody had to be the first to move.”

> According to redacted witnesses cited in the documents, the individual retailers involved were all in favour of taking price increases, and full-price grocers such as Loblaw tended to hike prices first, followed by discounters such as Walmart.


> The problem is that "illegal" in the context of a corporation means a fine. If the fine is less than the extra revenue generated (and it often is), there's no reason not to engage in the illegal behavior.

I think it's a bit worse than that.

Take a look at sports where plenty of teams will very willingly over-pay for players in terms of salary or even trade say 4 draft picks for a player when you'd expect at least 1 of those picks to draft somebody of a similar caliber.

In situations where the individual can personally gain (say from winning playoffs or a big bonus from extra sales) and the team (corporation) would be liable for the downside there's incentive to make a technically losing move. If the team doesn't do well you're fired anyways so it doesn't matter how much of a long-term bind you cause. Just like if the corporation takes a fine 5~10 years later like you've definitely gotten some fat bonuses in the interim that won't be clawed back.


I mean, I don't disagree, but this is still an enforcement issue. Society still isn't really sure how to easily prosecute these massive companies without also kicking open the doors to some concerning behavior.


To add to the sibling comment: rent optimization software that facilitates collusion between ostensibly competing landlords:

https://arstechnica.com/tech-policy/2023/11/14-big-landlords...


php's composer[0] in 2012 had package namespaces

[0] https://getcomposer.org/


Sorta—it looks like they were mostly just using that system by convention until May 2015, when they finally become enforced [0]. Still, that's a good one that I hadn't thought of, and they at least had the convention in place.

[0] https://github.com/composer/packagist/issues/163#issuecommen...


wayback machine for current url:

javascript:window.location='https://web.archive.org/web/*/'+document.location


seems kinda biased. not a single bad word of Allende's Chile.


No one talks about the reduction in inflation, increases in real wages, improved public transport, and free school meals under Allende, that's true.

They just seem to focus on the fun times of a CIA assisted military dictatorship, the secret killings, and all that nonsense that comes with wiping out a democracy for nigh on two decades..

https://en.wikipedia.org/wiki/Salvador_Allende#Presidency


reminds me of the similar sentiment that a failure may be required in order to get all parties to accept that a change/improvement is needed.


I used to resent coworkers saying "sometimes you have to let the baby fall down" and now I say it.


"We don't know how to infer what we can't directly observe."


shrug


rss-bridge also has xpath-style bridge: https://rss-bridge.org/bridge01/#bridge-XPathBridge


Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: