nurkiewicz, (edited ) to random
@nurkiewicz@fosstodon.org avatar

Am I the only one still preferring #curl, #httpie and #jq over desktop tools like #Postman? Findings like that aren't helpful: https://www.leeholmes.com/security-risks-of-postman/

outofcontrol, to random
@outofcontrol@phpc.social avatar

In a quick review of Insomnium, Bruno and Httpie:

didn’t import any of the postman collection auth data, it appears it won’t import/export HAR files, and I don’t see a timeline for a request. Could be I just didn’t see these features.

Insomnium imports collections with all the data, handles HAR files nicely and has a very detailed timeline.

imports fine, has a semi detailed timeline, and has some HAR support which I couldn’t figure out.

Currently is my fave.

TomSellers, to security

Roughly 2 weeks ago Google patched a critical vulnerability, CVE-2023-4863, that was being exploited in the wild. The broad impact of the root cause of the vuln and the fact that it will have a long tail of unpatched software has been poorly communicated. You can read more in @dangoodin 's excellent article on Ars Technica.

As pointed out in the article above, Electron is based on Chromium and is impacted. Electron is bundled in a ton of apps that people might overlook.

I threw together the following shell command to help macOS audit which versions of Electron apps are installed.

find /Applications -type f -name "*Electron Framework*" -exec <br></br>  sh -c "echo  "{}" && strings "{}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | head -n1 && echo " ;<br></br>

When run, you should see something similar to the following:

/Applications/Visual Studio Code.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework<br></br>Chrome/114.0.5735.289 Electron/25.8.1<br></br><br></br>/Applications/Slack.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework<br></br>Chrome/116.0.5845.188 Electron/26.2.1<br></br>

#Security #Electron #CVE20234863 #CVE-2023-4863

mjgardner, (edited )
@mjgardner@social.sdf.org avatar

@delfuego @TomSellers @electronjs After using the above command and pulling down any available updates, I still have the following vulnerable -based apps on my :

for (Electron v18.3.15)
(21.2.0)
Direct (16.2.2)
(22.1.0)
Logi Options+ (23.1.1)
(24.6.3)
(18.3.5) @getpostman
Desktop (20.3.8)
Teams (19.1.8)
(13.6.9)

geekland, to linux Spanish
@geekland@mastodon.social avatar
bagder, to random
@bagder@mastodon.social avatar

I maintain a comparison table. vs other "download tools". Tell me what's missing/wrong in it: https://curl.se/docs/comparison-table.html

(the screenshot here is a partial)

nurkiewicz,
@nurkiewicz@fosstodon.org avatar

@bagder I was thinking about showing the response in real time (e.g. in terminal), rather than waiting for the stream to complete (which might never occur). AFAIK was hanging on SSE stream, unless special --stream option was supplied (now enabled by default)

coderbyheart, to random
@coderbyheart@chaos.social avatar

TIL: my favorite CLI curl replacement now has a Desktop tool.
https://httpie.io/desktop

Looks very similar to .

  • All
  • Subscribed
  • Moderated
  • Favorites
  • JUstTest
  • thenastyranch
  • everett
  • ngwrru68w68
  • magazineikmin
  • rosin
  • Youngstown
  • slotface
  • InstantRegret
  • Durango
  • ethstaker
  • kavyap
  • cisconetworking
  • DreamBathrooms
  • anitta
  • osvaldo12
  • tacticalgear
  • khanakhh
  • mdbf
  • Leos
  • normalnudes
  • modclub
  • GTA5RPClips
  • cubers
  • tester
  • megavids
  • provamag3
  • lostlight
  • All magazines