HNHacker News
TopNewBestAskShowJobs

marshallofsound

62 karma · joined September 7, 2017

submissionscomments
marshallofsound··on Cowork: Claude Code for the rest of your work
Should be a feedback button (like a megaphone) next to your profile name in the bottom of the left sidebar.
marshallofsound··on Cowork: Claude Code for the rest of your work
I think this should be fixed now. If not can you tell me the URL you're getting redirected to.
marshallofsound··on Cowork: Claude Code for the rest of your work
Can you submit feedback and attach your logs when asked?
marshallofsound··on Cowork: Claude Code for the rest of your work
That's correct, currently the networking allowlist is the same as what you already have configured in claude.ai. You can add things to that allowlist as you need.
marshallofsound··on Electron 11.0 released with support for Apple Silicon
Electron maintainer here, although we _also_ support arm64 for Windows. Apple silicon support was driven from the beginning as a priority, it was obvious that it was the future of macOS and without direct support you'd be left behind. arm64 on Windows is barely supported by anything, let alone msft itself...

Also Apple did a fantastic job with early engagement for Apple silicon development, even going as far as to assist with code changes / patches early on.

marshallofsound··on Electron 9.0
Interested in why you think this was a bad decision. For a multitude of reasons surrounding security, performance and wanting the Latest And Greatest JS features we want to stay as close to upstream Chromium as possible. Curious what you feel the negative impact of major-versioning is?

For more info on our release cadence: https://www.electronjs.org/blog/12-week-cadence

marshallofsound··on Electron 7.0
Disclaimer: Electron dev

So few quick things, the projects that are copied are done so to guarantee deterministic builds in an isolated build environment (no dependencies on third party systems).

The API you say they don't provide is literally the API that Electron uses. --> https://chromium.googlesource.com/chromium/src/+/HEAD/conten...

And as for the build process, eh, it's kinda slow but it's hardly arcane. On linux you can run like 4 commands and it'll build Chromeium.

marshallofsound··on Basic Electron Framework Exploitation
Hi Electron maintainer here, I explained how gatekeeper and asar validation plays in with macOS codesigning here --> https://news.ycombinator.com/item?id=20637791
marshallofsound··on Basic Electron Framework Exploitation
Hi Electron maintainer here

ASAR files are signed as part of the application bundle. The issue is that folks don't understand how gatekeeper works so let me try explain it here.

When you download an application from the internet, macOS initially considers it "quarantined". When a quarantined application is first opened gatekeeper scans it _completely_ and if it's happy removes the quarantine tag and let's it launch.

Once that quarantine tag is removed, gatekeeper will never run a complete check of that application again. Meaning the ASAR files are validated once, when the application is first launched.

What people are seeing here is they're taking an application that gatekeeper has already signed off on, modifying it, and then asking why gatekeeper didn't stop them.

If you took that modified application, zipped it up, uploaded it somewhere, downloaded it again and tried to run it, it would NOT work. Gatekeeper would boot that invalid application to the shadow realm.

marshallofsound··on Basic Electron Framework Exploitation
Hey Electron maintainer here

> but if the first thing your codesigned binary does is to read an unprotected JS file off disk and execute it, there's no codesigning benefit.

The ASAR files described in this post are part of the signature of the application though. You can't modify that file and then redistribute the app to another machine without gatekeeper getting incredibly angry at you.

E.g. Try modifying the ASAR file, zip the app up, upload to google drive, download again and try run the app. Gatekeeper will boot it into the shadow realm :)

marshallofsound··on Basic Electron Framework Exploitation
Hi, Electron maintainer here.

> I just tried this out with Slack on macOS, and it did work

Here's the thing with how gatekeeper works, that application had already passed gatekeeper and will never be _fully_ validated ever again.

If you zipped your modified Slack.app up, uploaded it to google drive, and downloaded it again. Gatekeeper would 100% reject that application, the ASAR file is included as part of the application signature. You can prove this by checking the "CodeResources" file in the apps signature.

You can't re-distribute the app without gatekeeper completely shutting you down.

marshallofsound··on Atlassian launches Stride, its Slack competitor
It has an API --> https://developer.atlassian.com/cloud/stride/

:)

marshallofsound··on Atlassian launches Stride, its Slack competitor
There is a direct migration path from HipChat Cloud to Stride: https://confluence.atlassian.com/stride-documentation/faq-st...
marshallofsound··on Atlassian launches Stride, its Slack competitor
There is a page on HipChat Data Center aswell: https://confluence.atlassian.com/stride-documentation/faq-st...

:)

marshallofsound··on Atlassian launches Stride, its Slack competitor
Check out the Stride FAQ: https://confluence.atlassian.com/stride-documentation/faq-st...

> Starting soon, we will begin to upgrade all HipChat Cloud teams to Stride. HipChat Cloud will continue to work as it does today until your team upgrades to Stride. After upgrading, HipChat Cloud will remain in 'read-only' mode so that you can reference your API configuration in HipChat Cloud and receive integration notifications for those apps that are not yet in Stride.