Code in Response to “The Trouble with Symlinks.”
See: https://news.ycombinator.com/item?id=32190032 This was written in about the past hour or so; it has no documentation or test cases yet. Think twice before relying on it in production. The idea is that we can perform a detailed validation of the trustworthiness of an absolute or relative path, as a simple function that can be reused anywhere: I call this function safepath_check. A trustworthy path is one whose meaning cannot be changed by a third party: another user who isn't root. The path is therefore immune, for instance, to TOCtoTOU security problems, like the…
What it does
In the maker’s words, at launch
See: https://news.ycombinator.com/item?id=32190032 This was written in about the past hour or so; it has no documentation or test cases yet. Think twice before relying on it in production. The idea is that we can perform a detailed validation of the trustworthiness of an absolute or relative path, as a simple function that can be reused anywhere: I call this function safepath_check. A trustworthy path is one whose meaning cannot be changed by a third party: another user who isn't root. The path is therefore immune, for instance, to TOCtoTOU security problems, like the insertion of a symbolic link or other tampering. A trustworthy path is allowed to contain symbolic links. Symbolic links can be validated to be safe. To that end, safepath_check performs its own symlink resolution, to ensure that every link resolution step substitutes path material that is trustworthy.
Does the same job
all alternatives →
RedentialJul 2026 · redential.com · ▲116A developer credential that proves what you built, NDA safe.
- IBI built a tool for policy driven vetting of open source packages2023 · github.com · ▲7
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, July 2022
the whole month →
- PO
Life & fun · 2022 · justine.lol
- PO
Dev tools · 2022 · github.com
- PP
Hello, HN - I wanted to share this puzzle game I made during my vacation. I'm rather fond of the pipes puzzle where your goal is to restore a scrambled network of connections by rotating tiles. It's usually played on a grid of squares and this all started when I decided to make a programmatic solver for that kind of puzzle. Then I realized that with some minor changes the solver could generate new puzzle instances. I thought about what kind of puzzle to make and someone suggested a hexagonal grid. Adapting the generator wasn't too hard but then I had to create a way to play this variant. So…
Life & fun · 2022 · hexapipes.vercel.app
- PD
We're building Parsnip to create a "tech tree" of cooking skills that allows anyone to level up on the building blocks of cooking knowledge while tracking their progress over time. It took us a few iterations to figure out the right product; here's the story of our latest pivot: [https://parsnip.substack.com/p/a-new-hope] The goal is to create a personalized way to learn any recipe on the Internet, then use this as a springboard to help home cooks of all levels solve the problem of repeated meal planning in a 10x better way:…
Work · 2022 · parsnip.ai