←back to thread

Malicious versions of Nx and some supporting plugins were published

(github.com)
441 points longcat | 5 comments | 27 Aug 25 01:38 UTC | HN request time: 0.752s | source
Show context
f311a ◴[27 Aug 25 12:55 UTC] No.45038992[source]▶
People really need to start thinking twice when adding a new dependency. So many supply chain attacks this year.

This week, I needed to add a progress bar with 8 stats counters to my Go project. I looked at the libraries, and they all had 3000+ lines of code. I asked LLM to write me a simple progress report tracking UI, and it was less than 150 lines. It works as expected, no dependencies needed. It's extremely simple, and everyone can understand the code. It just clears the terminal output and redraws it every second. It is also thread-safe. Took me 25 minutes to integrate it and review the code.

If you don't need a complex stats counter, a simple progress bar is like 30 lines of code as well.

This is a way to go for me now when considering another dependency. We don't have the resources to audit every package update.

replies(17): >>45039115 #>>45039225 #>>45039464 #>>45039724 #>>45039994 #>>45040021 #>>45040056 #>>45040113 #>>45040151 #>>45040162 #>>45040972 #>>45041479 #>>45041745 #>>45044165 #>>45045435 #>>45045983 #>>45052913 #
1. skydhash ◴[27 Aug 25 14:11 UTC] No.45039994[source]▶
I actually loathe those progress trackers. They break emacs shell (looking at you expo and eas).

Why not print a simple counter like: ..10%..20%..30%

Or just: Uploading…

Terminal codes should be for TUI or interactive-only usage.

replies(3): >>45040178 #>>45041399 #>>45047706 #
2. quotemstr ◴[27 Aug 25 14:25 UTC] No.45040178[source]▶
Try mistty
3. sfink ◴[27 Aug 25 15:56 UTC] No.45041399[source]▶
Carriage returns are good enough for progress bars, and seem to work fine in my emacs shell at least:

    % echo -n "loading..."; sleep 1; echo -en "\rABORT ABORT"; sleep 1; echo -e "\rTerminated"
works fine for me, and that's with TERM set to "dumb". (I'm actually not sure why it cleared the line automatically though. I'm used to doing "\rmessage " to clear out the previous line.)

Admittedly, that'll spew a bunch of stuff if you're sending it to a pager, so I guess that ought to be

    % if [ -t 1 ]; then echo -n "loading..."; sleep 1; echo -en "\rABORT ABORT"; sleep 1; echo -e "\rTerminated"; fi
but I still haven't made it to 15 dependencies or 200 lines of code! I don't get a full-screen progress bar out of it either, but that's where I agree with you. I don't want one.
replies(1): >>45043964 #
4. JdeBP ◴[27 Aug 25 19:29 UTC] No.45043964[source]▶
The problem is that two pagers don't do everything that they should do in this regard.

They are supposed to do things like ul utility does, but neither BSD more nor less handle when a CR is emitted to overstrike the line from the beginning. They only handle overstriking characters with BS.

most handles overstriking with CR, though. Your output appears as intended when you page it with most.

* https://jedsoft.org/most/

5. flexagoon ◴[28 Aug 25 02:35 UTC] No.45047706[source]▶
I feel like not properly supporting widely used escape codes is an issue with the shell, not with the program that uses them