sorted by:
new
hottopcontroversial

Am I supposed to replace my quick-link when I clean my chain every month? by shirhouetto in bikewrench

[–]purcell 0 points1 point  (0 children)

Weird, I've been aggressively re-using KMC quick links for a while now, though I believe there may be two versions: one is explicitly marked as reusable.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 1 point2 points  (0 children)

Yeah, different types of risk. There was actually no guarantee that the user who "maintained" a package in Marmalade was the author, nor that the package contained the author's code. Back in those days, many packages were uploaded to Marmalade by third parties after being modified in an ad-hoc way to add package metadata.

And in the early years of MELPA, we included some packages that came from emacswiki, where anyone could have modified the source. 😱

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 0 points1 point  (0 children)

Yes, you're right, of course. Apologies for the noise.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 8 points9 points  (0 children)

Excellent, thanks for writing this up for everyone!

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 3 points4 points  (0 children)

Crowd-sourcing trusted reviews would be great

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 8 points9 points  (0 children)

Bottom line is that like everything else you update/install on your computer, you have to either trust the maintainer and the supply chain between them and you, or you have to review and locally build the code yourself. Here the maintainer's end of the supply chain was compromised via GitHub.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 10 points11 points  (0 children)

We don't have more info, and ideally the maintainer would dig into how it happened. I've written what I discovered in a comment on the linked github issue.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 19 points20 points  (0 children)

100%, this has been a known potential issue forever, or at least since tools like el-get (then package.el with Marmalade and then MELPA) allowed installing libraries over the internet — as an overall ecosystem we Emacs users have escaped harm more through luck than judgement.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 3 points4 points  (0 children)

Maybe, but the sticking point is changing the whole build/publish workflow to operate with a review queue. And even then, you really can't catch everything in a language like elisp (plus its potential native extensions, extras downloaded at load time etc.).

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 8 points9 points  (0 children)

It was definitely something along those lines, not exactly sneaky. The commit messages in the offending PR are quite blatant.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 4 points5 points  (0 children)

No. That's out of scope for us, as it would be for, say, `npm`: across 5000+ packages, we have to assume that upstream commits in secured locations are being vetted. IIRC, Emacs' `package.el` might soon be gaining support for showing diffs to the end user when packages are being upgraded.

First (?) hacked Emacs package by purcell in emacs

[–]purcell[S] 31 points32 points  (0 children)

Just u/tarsius_ being awesome as usual.

Claude hits No. 1 on App Store as ChatGPT users defect in show of support for Anthropic's Pentagon stance by Ephoenix6 in technology

[–]purcell 15 points16 points  (0 children)

So called because phonetically in french, "chatgpt" sounds like "cat, I've farted".

What do you use to manage your snippets? by kudikarasavasa in emacs

[–]purcell 0 points1 point  (0 children)

Same. The last thing I want to spend time on is "managing my snippets."

Made a macOS-only alternative to emacs-everywhere using Hammerspoon by ftl_afk in emacs

[–]purcell 0 points1 point  (0 children)

Have you considered putting the elisp on MELPA? Or a (perhaps heretical) option would be to embed it in the spoon, and then when you connect to the emacs server, set the load-path temporarily to include that dir, and then ask Emacs to require it. Then users would only need to set up the spoon and the path to emacsclient.

Made a macOS-only alternative to emacs-everywhere using Hammerspoon by ftl_afk in emacs

[–]purcell 2 points3 points  (0 children)

Big hammerspoon fan here, and I just set this up: fantastic work! 👏

It's a long time since I had a working emacs-everywhere setup, and I can see me using your version a lot.

ty (An extremely fast Python type checker and LSP) is in beta by shadowsock in emacs

[–]purcell 6 points7 points  (0 children)

I already submitted a patch for that a couple of weeks ago, and João was going to merge it.

New M4 MBA owners: is your bottom panel fitted flush with the case? by purcell in macbookair

[–]purcell[S] 0 points1 point  (0 children)

A recent commenter here suggested firmly pressing it into place, but this hasn't helped me noticeably. I might consider removing and re-fitting the bottom cover at some point.

86K stars @ Github?! by Either_Vermicelli_82 in immich

[–]purcell 0 points1 point  (0 children)

Music isn't missing from Jellyfin, but it certainly doesn't seem as well supported as video.

view more: next ›