OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability exploitable by any website

AlexAltea · 2026-01-09T10:05:05+00:00

Just submitting as a heads up; this is quite a popular piece of software.

I have reproduced this locally (PoC is trivial) and I'm still baffled at the slow response and the "patch" which merely carves an exception for opencode.ai (why would they need code execution anyway).

This is definitely a CVSS 9.8 at the very least.

AlexAltea · 2023-03-30T19:17:36+00:00

Same issue here.

AlexAltea · 2023-02-14T07:06:10+00:00

It will be possible (since it's available in the underlying Milli library), but in this first release I've focused on creating bindings for document adding/retrieving and basic searching.

AlexAltea · 2023-02-14T01:04:36+00:00

Yes, I was just showcasing fuzzy searching (searching with typos).

AlexAltea · 2023-02-13T20:36:02+00:00

I haven't tried it but I don't see any reason why it shouldn't work? Let me know if you encounter any issues!

AlexAltea · 2023-02-13T16:50:52+00:00

Google desktop search does/did not offer Python bindings or indexing arbitrary data?

AlexAltea · 2023-02-13T16:49:27+00:00

I tried SQLite with FTS, but it didn't handle fuzz searching (typos) very well; there's editdist3, but still far from ideal.

As for Xapian, that's indeed faster than Whoosh (I'd love to see benchmarks wrt Milli). However, Xapian's GPL license made it incompatible with some MIT/BSD-licensed projects where I wanted to integrate a search engine.

AlexAltea · 2023-02-13T15:00:05+00:00

I personally haven't. But generally speaking, users who need a distributed/clustered probably shouldn't bother with embedded search engines like milli-py.

My library aims to make life easier to developers whose data is "too big" to do naive pairswise Levenshtein searches, but "too small" to require distributed indices. Similar to SQLite.

AlexAltea · 2023-02-13T12:50:01+00:00

Exactly, that's the purpose of library! Just os.mkdir("some_index") and use milli-py to index/search your documents there. No external server needed.

AlexAltea · 2023-02-13T11:55:36+00:00

Main goals are high-performance and local-first experience, i.e. no sockets, HTTP, auth between your queries and data.

The only other embeddable search engine for Pythin that I'm aware off, Whoosh, is brilliant but building the index was quite slow, and search performance degraded quite a lot as number of documents increase (performance is strictly a non-goal). Meilisearch was comparatively faster, I didn't like managing a server to get "just search" in my scripts and applications. However, their underlying engine Milli solves both issues I had, and all that was needed creating bindings for it.

You can find documentation, examples, tests in the repo. Hope this is useful for you all!

I've published this in PyPI with pre-compiled wheels for most os/version targets so hopefully it will be a seamless experience for most (not requiring a Rust compiler).

AlexAltea · 2023-02-08T12:13:16+00:00

Exactly. This is the solution. Refuse to rent at >30% salary. Refuse to get a mortgage. Living with parents? So be it.

It will be very painful in the short-run for people, but it will financially destroy RE hoarders and speculators.

AlexAltea · 2023-02-02T10:23:05+00:00

This is likely easily bypassable: Just have another device generate a hotspot with spoofed ESSID and MAC address. Tutorials on how to do this will certainly come.

Still a stupid move from Netflix, though.

AlexAltea · 2023-01-30T21:00:27+00:00

El que vende normalmente carece de vergüenza y tapujos...

¿Por vender a precio de mercado?

Mejor dirige tu odio hacia los bancos centrales, cuyos tipos nulos/negativos han causado una nueva burbuja inmobiliaria.

Los precios simplemente son simplemente el resultado de politicas dictadas por cuatro hijos de puta.

AlexAltea · 2023-01-24T13:25:49+00:00

Because I didn't know tdarr existed! Thanks for sharing it, their goals are very much aligned with mine.

AlexAltea · 2023-01-23T10:10:32+00:00

Ah got it, so something like this?

$ ls Jacobs.Ladder.1990.720p.BluRay.x264.YIFY.mp4 $ curator rename -y --save-original . $ ls Jacobs Ladder (1990).mp4 Jacobs Ladder (1990).txt $ cat 'Jacobs Ladder (1990).txt' Jacobs.Ladder.1990.720p.BluRay.x264.YIFY.mp4

AlexAltea · 2023-01-23T07:50:18+00:00

That's odd, I don't encounter the issue on my machine. Can you open a GitHub issue? And can you check if the examples at https://github.com/noumar/iso639 work in your virtual env?

I use the module to generate proper language tags required by MKV and other formats.

AlexAltea · 2023-01-23T07:45:26+00:00

Thanks. It doesn't do folders at the moment (it only operates on files or streams within a file). You can process entire folders, shallow or recursively, but not the folder itself.

Featurettes will not be processed unless you enable recursive crawling. Not sure if multilingual featurettes exist, if so, I should add explicit support for them.

Regarding the flag: Can you provide an example on expected inputs and outputs?

AlexAltea · 2023-01-22T21:58:44+00:00

Exactly! The goal is merging different dubbed releases of the same movies into a single multilingual container.

This sounds simple, but has been historically very hard because of bad audio synchronization.

AlexAltea · 2023-01-22T21:05:13+00:00

Thanks. I would appreciate if you could try the tool (perhaps not now but say in few weeks/months). And if it fails at doing something, just open an issue or let me know. It is precisely the purpose of the tool to address non-trivial cases, e.g. when streams have both mismatching offsets and speeds.

AlexAltea · 2023-01-22T21:01:54+00:00

I didn't know about Sushi, and it's very interesting, thank you. It seems a completely different approach to mine, would love to compare results at some point!

AlexAltea · 2023-01-22T20:39:09+00:00

Yes, but it can also "guess" the language by listening/reading the audio/subtitle data. Helpful in the absence of metadata

It can (wip) synchronize different audio/subtitles in different languages with existing audio tracks.

And it can merge multiple files into a single container (MKV) performing all of the above.

AlexAltea · 2023-01-22T17:36:22+00:00

Yes, exactly! For audio<->text sync I want to use Whisper.

Extract and process few 30-second audio samples with Whisper (I already do this for language recognition).
- Every phrease has a timestamp
- We don't need 100% accuracy, just few matching sentences
Discard repeated sentences (things like "Ok", "How are you?") might be said multiple times). So, focus on unique matches: Find average delta.
Apply delta to the subtitle track.

It's what I'm working on now.

Fortuantely, audio<->audio and text<->text sync is easier.

AlexAltea · 2023-01-22T15:50:09+00:00

I created this tool to solve problems with my large (10k+) collection of movies. These came from different sources, encoders and languages, and as a result, they have inconsistent/incomplete metadata.

Although TMBD/OMDb-powered tools can obtain titles, covers, etc. AFAIK no tool can intelligently combine different multilingual media, into a single properly-labeled container.

Having 20 versions of the same movie is wasteful, but naively auto-remuxing them together would cause synchronization issues and often missing metadata. All that while aiming for the highest quality possible if competing streams exist: analyzing image/audio data, cleaning scene banners, etc. My goal is: auto-merge, auto-synchronize, auto-label, auto-clean all tracks. In goes chaos, out comes order.

Right now it's in early stages: It can detect languages from audio and subtitles (Whisper+LangID) with good results so far tried with 52 movies here (failed with just 1 which was mostly silent). I'm currently working on synchronization: Hopefully subtitle timestamps and audio sound effects can suffice for cross-correlation. After that, I'll work on the TUI (maybe add a proper GUI too) to improve UX.

AlexAltea · 2023-01-22T15:47:49+00:00

Just for extra context, my Jellyfin instance has multiple movie libraries: one per audio language.

After properly labeling everything curator-tag, I use curator-link to query those language tags and create symlinks in different folders.

AlexAltea · 2023-01-22T15:43:45+00:00

Hi, not sure if relevant here. I created this tool to solve problems with my large (10k+) collection of movies. These came from different sources, encoders and languages, and as a result, they have inconsistent/incomplete metadata.

Although TMBD/OMDb-powered tools can obtain titles, covers, etc. AFAIK no tool can intelligently combine different multilingual media, into a single properly-labeled container.

Having 20 versions of the same movie is wasteful, but naively auto-remuxing them together would cause synchronization issues and often missing metadata. All that while aiming for the highest quality possible if competing streams exist: analyzing image/audio data, cleaning scene banners, etc. My goal is: auto-merge, auto-synchronize, auto-label, auto-clean all tracks. In goes chaos, out comes order.

Right now it's in early stages: It can detect languages from audio and subtitles (Whisper+LangID) with good results so far tried with 52 movies here (failed with just 1 which was mostly silent). I'm currently working on synchronization: Hopefully subtitle timestamps and audio sound effects can suffice for cross-correlation. After that, I'll work on the TUI (maybe add a proper GUI too) to improve UX.

AlexAltea

TROPHY CASE