RS

Backend mystic | Mostly observing entropy | C̶a̶l̶l̶O̶f̶D̶u̶t̶y̶ ̶s̶o̶m̶e̶t̶i̶m̶e̶s̶!̶

तत्त्वमसि:

[InfiniteHorizon @InFiniteH0riZ0n]

rainy day in edinburgh

[RS @SRahul_]

@baremetalbalak in my case, they called me to verify the address...of the police station itself. verified for 700.

[RS @SRahul_]

ek thi daayan rewatch after so many years. apparently, peace was never the objective for a long weekend 👻

[RS @SRahul_]

3/3 it handle both the cases:
- simple commands go straight to argv, no shell involved
- pipes and redirections get auto quoted shell lines

also includes an audit scanner for legacy code

zero deps. check it out
https://t.co/lF0mlqU1j5

[RS @SRahul_]

thread for why it exists:

1/3 shell injection has been in the OWASP top 10 for over a decade

every Python dev has hit it: pass user input to a shell command via f-string, watch it break.

[RS @SRahul_]

rm -rf ~ is a feature, not a bug.
you just have to ask nicely.

shellsafe makes sure nobody asks.

https://t.co/lF0mlqU1j5

[RS @SRahul_]

2/3 safe version exists but breaks when you need pipes or redirections. so ppl go back to shell=True. every time.

[RS @SRahul_]

thread for why it exists:

1/3 shell injection has been in the OWASP top 10 for over a decade

every Python dev has hit it: pass user input to a shell command via f-string, watch it break.

[RS @SRahul_]

rm -rf ~ is a feature, not a bug.
you just have to ask nicely.

shellsafe makes sure nobody asks.

https://t.co/lF0mlqU1j5

[RS @SRahul_]

rm -rf ~ is a feature, not a bug.
you just have to ask nicely.

shellsafe makes sure nobody asks.

https://t.co/lF0mlqU1j5

[RS @SRahul_]

pretty odd days lately. no idea what branch we're on anymore

[Mikk Martin 🇪🇪🇺🇦 @mikkmartin]

Little agent status indicator

[RS @SRahul_]

my first mac was a temp work issued one with the touch bar. it made me so delighted every time i used it. still miss that thing.

[欧巴聊AI @hungryturbo]

这么一看，TouchBar 确实太超前了，生不逢时啊。

[Yubana @silent_ybn]

A little summer left.