They make a replacement screen too. The feature set depends on the firmware, and you pick the right firmware for your screen (or make your own, it's FOSS).
I added a calibration feature for the pulsometer. Lets me set how many events I want to count in order to get the answer. Allows me to turn the pulsometer into an asthmometer. Use it every day at work, makes counting respiratory frequency painless.
If I remember right, I also made some improvements to the TOTP watch faces. Even maintained the repository for a bit while Joey focused on getting the Sensor Watch Pro out. Merged a lot of stuff.
I think it's obvious too. I'd call out any case of `${{ }}` interpolation in a `run` block, and it's something I watch for in PRs. I also know other people don't watch for this, as I've corrected it about a hundred times. Over the last 10 years my average colleague understands less and less about injection or to watch for it at layer boundaries.
That's surprising to me. It's been a standard feature on laptops for 20 years.
Edit: Or I should say, it was 20 years ago. Maybe modern stuff is worse, but my M2 MacBook Air and Framework 13 Intel Core both power on without a battery.
Heh, the URL OP gave returns an MP3 file (starts with hex FF FB), at the end it mentions "LAME3.100" and about half a kilobyte of U's. It plays in a media player too.
But I guess if it was loaded via mshta it will respond with a different payload.
Now watch the people with "overabundance of caution" tell me what I did was stupid...
> But I guess if it was loaded via mshta it will respond with a different payload.
No, the MP3 file is the payload, mshta ignores the binary noise and executes the HTML in it. The HTML is in the middle of the file (search for "DOCTYPE") and it contains an obfuscated VBScript.
Skipping many steps in the whole chain (registering a scheduled task to be executed 1 second later, disabling TLS certificate verification, corrupting the antimalware scan, deobfuscation/decryption, evasion delays, in-memory PE loading, etc.), it as a whole, roughly speaking:
- downloads second stage payload from gpurq.gravityzone.army/{id}
- downloads an image from i.ibb.co/Q7yqNJpr/init-block.jpg (public image hosting) with a steganographically hidden third stage payload
- decrypts and loads a native PE32, heavily obfuscated and without imports
The semantics are important. A release is composed of multiple distributions (sets of files). Each distribution does have a one-way hash value. This is what you lock to. Adding files does change the value of that hash. Files cannot be removed or changed.
You lock to the distribution instead of the release so your build doesn't have to download distributions for platforms you're not using.
Which is the entire problem. "Release" should be a signed hash of a manifest file that contains hashes of all the other files (in case of Git that's what commit does).
PyPi just decided to do what VCSes already did, worse
It’s not. Steel manning the OP (which at face value seems to be the most reasonable interpretation) they’re wondering why an entire release isn’t hash pinned.
The response is that there is hash pinning but only at the constituent levels. Which clearly isn’t what the OP meant.
https://gist.github.com/JoshCooley/095b80f9639a4dc7e762208ae...