Can someone explain for me?

A different way to say the same: in forth, words get pushed on the stack, and popped from the stack by words that take arguments:

    code           stack
    I Forth love

    Forth love     I

    love           I
                   Forth

    ; love presumably pops
    ; subject, object args
    ; from stack - and does something 
    ; perhaps prints as side effect

Here is some inexplicably but meticulously formatted FORTH code that uses right justified indentation! Including reverse polish notation assembley.

https://donhopkins.com/home/code/tomt-cam-forth-scr.txt

https://donhopkins.com/home/code/tomt-users-forth-scr.txt

  ( FMOVE -- functional intersegment move                   ) HEX

  88 CONSTANT *MOV*  ( fn = 0 )   20 CONSTANT *AND*  ( fn = 1 )
  08 CONSTANT  *OR*  ( fn = 2 )   30 CONSTANT *XOR*  ( fn = 3 )

  CODE FMOVE ( fn s.seg s.off d.seg d.off length --)  AX, SI MOV
      CX POP  DI POP  ES POP  SI POP  DS POP  DX POP  AX PUSH
                        AL, # *XOR* MOV  DX, # 3 CMP  1$ JE
                        AL, #  *OR* MOV  DX, # 2 CMP  1$ JE
                        AL, # *AND* MOV  DX, # 1 CMP  1$ JE
                        AL, # *MOV* MOV               1$:
     CS: HERE 5 + , AL MOV  ( modify "[DI], AL MOV" ) 2$:
                      LODS  ES: [DI], AL MOV  DI INC  2$ LOOP
      AX, CS MOV  ES, AX MOV  DS, AX MOV  SI POP  NEXT,  END-CODE

                                                            -->

Is that loss?

No.

well played

Actually the stack is wrong here, after pushing two words, the sequence should be:

    Forth
    I

Forth I assume uses reverse polish notation: arguments before the operator.

3 4 +

for example, would return 7.

> would return 7

more pedantically, it would push 7 onto the stack

even more pedantically, would remove 3 and 4 from the stack before pushing 7

Even oddly more pedantically, that's the operand stack, not to be confused with the separate return stack. >R and R> move values between the two stacks.

On the other hand, PostScript also has a dictionary stack, which you can use to implement a Smalltalk-like object oriented programming system. And its data types and executable code are basically polymorphic homoiconic JSON (like Lisp), not raw untyped bytes like FORTH.

https://news.ycombinator.com/item?id=22456471

https://news.ycombinator.com/item?id=47812317

The stack is really a convenience that makes pipeline-driven programming possible in the language.

somewhat relatedly, shell pipelining is very amenable to being massaged into (non stack-based) concatenative programming

Forth uses RPN so the "verb" is last.

That is, you provide the data first (I and Forth) and the command (heart) last.

AKA FJN (Forward Japanese Notation)

I found https://www.explainxkcd.com/wiki/index.php/Main_Page quite useful for that.

This report reads a bit like AI writing :/

You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

Modern day code agents would clone a repo and read the code when you ask it a question about an API that’s not clearly documented. This vulnerability is real.

Don't think that would trigger the bug, it needs to be at the repo root when the user opens the agent CLI, it's not like the agent is calling another agent CLI process with the new repo root as its project root.

This is exactly why every AI agent should run in a sandbox.

The malicious payload can live on the remote: `git clone` a repo, open it with cursor, and you're compromised

It's curious the number of people here who can't link these two things.

git clone a repo, cd into the directory, git checkout ..., and you're compromised

If your an opensource developer you may get a pull request containing the the git.exe

wouldn't the attack vector be like this:

I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

From my reading, boom happens at "open up cursor".

you would only need to open it to be exploited, not edit or prompt. Allegedly

From the article it occurs when Cursor is loaded. iDEs do a lot of stuff when they first open.

You can leave out cursor and it would do the same thing.

I think you’ve got it wrong; no malicious payload need be on your box already. That’s not what the article says.

>You need to have an already malicious payload on your pc to make this exploit work

Uh, no, not exactly from what I'm reading.

At least from my piss poor understanding of it, you could possibly prompt inject something like "download https://github.com/hackmycursor/exploit.git". Would an agent do this, I'm unsure, but if so, it would download the git.exe and execute it.

This has been a problem with agent harnesses for as long as I've used them - prompting them to retrieve something often results in them going the extra mile and running and installing it.

Uh, I don't think people typically associate downloading a repository, and viewing the source, as being synonymous with activating a malicious payload. That is the bit that's concerning.

I'm also so tired of people groaning about AI writing, yes, it's annoying, but attack the message, not the messenger.

Do they have a doc that says what scale this can operate at?

It's embedded. Single machine. But it runs their forum/ticketing thing so good enough for that I guess :)

I have a daily puzzle game called https://lettered.io and I’ve been playing around with shareable replay gifs via gifenc. It’s been fun trying to get good looking replays without sacrificing size for quality

The age of AI has been incredible for the daily game space because you can play around with ideas so much faster and riff to find something that works. On the flip side, there’s a lot more games that just rip off another idea and change some mechanic slightly to make it “new”

Still cranking away on my daily game called https://lettered.io. I’ve been learning a lot about WebGL recently trying to improve perf and UX on some of the larger puzzles

I recently had someone email me saying they loved my game but ran slow on their 12 year old(!) android phone that really put things into perspective for me

Oh wow

I worked on the react team while at GitHub and you could easily tell which pages rendered with react vs which were still using turbo. I wish we took perf more seriously as a culture there

Did react render better than turbo or the opposite? I assume a well-optimized turbo page would perform better

React destroyed perf and used more resources than turbo

That's what I figured and has been my experience as well.

Was there any discussion to use something other than react?

I’m working on my second daily game, https://lettered.io. Like if wheel of fortune puzzles were solvable with Tetris pieces instead of letters

Nice description, nice UI. How do you scale the difficulty? Do you have a puzzle generator algorithm, or is each puzzle made by hand?

Thanks a ton! Difficulty is a great question. After a few rounds of puzzles, I like to aim for an 85-90% completion rate and found that puzzles with around 30-40 characters or usually 10-15 words is the sweet spot. Smaller letter pieces can also up the ante. There is a seeded puzzle generator algorithm that handles puzzle layout and piece creation. There’s an option to create your own puzzles and it’s always a treat seeing the bee movie script get generated lol

Having worked with implementing SAML for a large University-funded application, I learned more than I ever wanted to know but less than I needed to know

I regret learning nearly everything that I know about SAML.

This is exactly how it works every time I need to touch SAML. Spend two weeks with the ping identity manual, somehow get everything working, forget all about it until the next time a customer wants it :}

Ping ID is "SAML" - they actually don't comply with the spec. If you remove the Bearer element from the SAMLRequest, you should be on your way. Ask me how I know.

I see this comment often, but when I implemented SAML, the spec wasn't too unreadable... I did write my own IdP [0] instead of using something that existed though, since those were more complicated than I needed.

So maybe because I only implemented features I was using it wasn't bad. What did you struggle with?

[0] https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml...

When I tried to do this, I was looking at an OASIS spec I think? Several hundred pages? I found it to be quite impenetrable. Mainly because of all the jargon. It was all defined of course, but just in terms of other jargon. It was a bit like trying to understand monads by reading wikipedia. In the end I spent about a month on the project, with basically nothing to show for it. If GPT had existed at the time, I probably could have gotten enough of a foothold using AI conversations to understand the spec.

Ah yes, the dreaded University integration!

I was in charge of a SaaS offering for Academic and Public libraries years ago, and we had to add SAML functionality for the Academic side ... it was a frustrating few weeks, and I was glad when it was over.

Congrats on the launch! Always cool seeing a familiar face build something badass