Skip to content

Commit 53dfcd8

Browse files
XeXe
committed
feat(no-way-to-prevent-this): add npm subseries
Signed-off-by: Xe Iaso <me@xeiaso.net>
1 parent 37dccd6 commit 53dfcd8

4 files changed

Lines changed: 116 additions & 35 deletions

File tree

‎cmd/no-way-to-prevent-this/main.go‎

Lines changed: 34 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
package main
22

33
import (
4+
"embed"
45
"flag"
6+
"log"
57
"os"
68
"text/template"
79
"time"
@@ -10,23 +12,33 @@ import (
1012
)
1113

1214
var (
13-
date = flag.String("date", time.Now().Format(time.DateOnly), "Date of the CVE")
14-
cPlusPlus = flag.Bool("c++", false, "If true, the project is written in C++")
15-
cve = flag.String("cve", "", "CVE number")
16-
cveLink = flag.String("cve-link", "", "CVE link")
17-
project = flag.String("project", "", "Project name")
18-
projectLink = flag.String("project-link", "", "Project link")
19-
summary = flag.String("summary", "a memory safety vulnerability resulting in arbitrary code execution", "Summary of the CVE")
15+
date = flag.String("date", time.Now().Format(time.DateOnly), "Date of the CVE")
16+
cPlusPlus = flag.Bool("c++", false, "If true, the project is written in C++")
17+
cve = flag.String("cve", "", "CVE number")
18+
cveLink = flag.String("cve-link", "", "CVE link")
19+
project = flag.String("project", "", "Project name")
20+
projectLink = flag.String("project-link", "", "Project link")
21+
summary = flag.String("summary", "a memory safety vulnerability resulting in arbitrary code execution", "Summary of the CVE")
22+
templateName = flag.String("template", "memory-safety", "Template name to use for the post")
23+
24+
//go:embed templates/*.tmpl
25+
templates embed.FS
2026
)
2127

2228
func main() {
2329
flag.Parse()
2430

25-
os.MkdirAll("./lume/src/shitposts/no-way-to-prevent-this", 0755)
26-
fout, err := os.Create("./lume/src/shitposts/no-way-to-prevent-this/" + *cve + ".md")
31+
tmpl, err := template.ParseFS(templates, "templates/*.tmpl")
2732
if err != nil {
28-
panic(err)
33+
log.Fatalf("can't parse templates: %v", err)
2934
}
35+
36+
os.MkdirAll("./lume/src/shitposts/no-way-to-prevent-this/"+*templateName, 0755)
37+
fout, err := os.Create("./lume/src/shitposts/no-way-to-prevent-this/" + *templateName + "/" + *cve + ".md")
38+
if err != nil {
39+
log.Fatalf("can't create output file: %v", err)
40+
}
41+
3042
defer fout.Close()
3143

3244
data := map[string]any{
@@ -40,30 +52,17 @@ func main() {
4052
"CPlusPlus": *cPlusPlus,
4153
}
4254

43-
tmpl := template.Must(template.New("article").Parse(articleTemplate))
44-
if err := tmpl.Execute(fout, data); err != nil {
45-
panic(err)
55+
t := tmpl.Lookup(*templateName + ".tmpl")
56+
if t == nil {
57+
log.Fatalf("can't find template %s", *templateName)
4658
}
47-
}
48-
49-
const articleTemplate = `---
50-
title: '"No way to prevent this" say users of only language where this regularly happens'
51-
date: {{.Date}}
52-
series: "no-way-to-prevent-this"
53-
type: blog
54-
hero:
55-
ai: "Photo by Andrea Piacquadio, source: Pexels"
56-
file: sad-business-man
57-
prompt: A forlorn business man resting his head on a brown wall next to a window.
58-
---
5959

60-
In the hours following the release of [{{.CVE}}]({{.CVELink}}) for the project [{{.Project}}]({{.ProjectLink}}), site reliability workers
61-
and systems administrators scrambled to desperately rebuild and patch all their systems to fix {{.Summary}}. This is due to the affected components being
62-
written in C{{if .CPlusPlus}}++{{end}}, the only programming language where these vulnerabilities regularly happen. "This was a terrible tragedy, but sometimes
63-
these things just happen and there's nothing anyone can do to stop them," said programmer {{.Name}}, echoing statements
64-
expressed by hundreds of thousands of programmers who use the only language where 90% of the world's memory safety vulnerabilities have
65-
occurred in the last 50 years, and whose projects are 20 times more likely to have security vulnerabilities. "It's a shame, but what can
66-
we do? There really isn't anything we can do to prevent memory safety vulnerabilities from happening if the programmer doesn't want to
67-
write their code in a robust manner." At press time, users of the only programming language in the world where these vulnerabilities
68-
regularly happen once or twice per quarter for the last eight years were referring to themselves and their situation as "helpless."
69-
`
60+
err = t.Execute(fout, data)
61+
if err != nil {
62+
log.Fatalf(
63+
"error writing template %s to %s: %v",
64+
*templateName,
65+
fout.Name(),
66+
err)
67+
}
68+
}

‎cmd/no-way-to-prevent-this/templates/memory-safety.tmpl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: '"No way to prevent this" say users of only language where this regularly happens'
3+
date: {{.Date}}
4+
series: "no-way-to-prevent-this"
5+
type: blog
6+
hero:
7+
ai: "Photo by Andrea Piacquadio, source: Pexels"
8+
file: sad-business-man
9+
prompt: A forlorn business man resting his head on a brown wall next to a window.
10+
---
11+
12+
In the hours following the release of [{{.CVE}}]({{.CVELink}}) for the project [{{.Project}}]({{.ProjectLink}}), site reliability workers
13+
and systems administrators scrambled to desperately rebuild and patch all their systems to fix {{.Summary}}. This is due to the affected components being
14+
written in C{{if .CPlusPlus}}++{{end}}, the only programming language where these vulnerabilities regularly happen. "This was a terrible tragedy, but sometimes
15+
these things just happen and there's nothing anyone can do to stop them," said programmer {{.Name}}, echoing statements
16+
expressed by hundreds of thousands of programmers who use the only language where 90% of the world's memory safety vulnerabilities have
17+
occurred in the last 50 years, and whose projects are 20 times more likely to have security vulnerabilities. "It's a shame, but what can
18+
we do? There really isn't anything we can do to prevent memory safety vulnerabilities from happening if the programmer doesn't want to
19+
write their code in a robust manner." At press time, users of the only programming language in the world where these vulnerabilities
20+
regularly happen once or twice per quarter for the last eight years were referring to themselves and their situation as "helpless."

‎cmd/no-way-to-prevent-this/templates/supply-chain.tmpl‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
title: '"No way to prevent this" say users of only package manager where this regularly happens'
3+
date: {{.Date}}
4+
series: "no-way-to-prevent-this"
5+
type: blog
6+
hero:
7+
ai: "Photo by Andrea Piacquadio, source: Pexels"
8+
file: sad-business-man
9+
prompt: A forlorn business man resting his head on a brown wall next to a window.
10+
---
11+
12+
In the hours following the news that [{{.Project}}]({{.ProjectLink}}) fell
13+
victim to a supply chain attack via NPM, developers and systems administrators
14+
scrambled ensure all of their projects were unaffected from {{.Summary}}.
15+
This is is due to the affected dependencies being distributed via
16+
[NPM](https://www.npmjs.com), the only package manager where these supply-chain
17+
attacks regularly happen. "This was a terrible tragedy, but sometimes these
18+
things just happen and there's nothing anyone can do to stop them," said
19+
programmer {{.Name}}, echoing statements expressed by hundreds of thousands of
20+
programmers who use the only package manager where 90% of the world's
21+
supply-chain attacks have occurred in the last decade, and whose projects are
22+
20 times more likely to fall victim to supply chain attacks. "It's a shame, but
23+
what can we do? There really isn't anything we can do to prevent supply-chain
24+
attacks from happening if the maintainers don't want to secure access to their
25+
accounts in a robust manner". At press time, users of the only package manager
26+
in the world where these vulnerabilities regularly happen once or twice per
27+
week for the last year were referring to themselves and their situation as
28+
"helpless".
29+
30+
For more information, please see upstream documentation published by
31+
{{.Project}} at the following link: [{{.CVE}}]({{.CVELink}}).

‎lume/src/shitposts/no-way-to-prevent-this/supply-chain/2026-art-template.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
title: '"No way to prevent this" say users of only package manager where this regularly happens'
3+
date: 2026-05-21
4+
series: "no-way-to-prevent-this"
5+
type: blog
6+
hero:
7+
ai: "Photo by Andrea Piacquadio, source: Pexels"
8+
file: sad-business-man
9+
prompt: A forlorn business man resting his head on a brown wall next to a window.
10+
---
11+
12+
In the hours following the news that [art-template](https://github.com/goofychris/art-template) fell
13+
victim to a supply chain attack via NPM, developers and systems administrators
14+
scrambled ensure all of their projects were unaffected from a supply chain attack where attackers have controlled the repository since 2025 and are using it to load unauthorized JavaScript from third party domains, including but not limited to Baidu Analytics.
15+
This is is due to the affected dependencies being distributed via
16+
[NPM](https://www.npmjs.com), the only package manager where these supply-chain
17+
attacks regularly happen. "This was a terrible tragedy, but sometimes these
18+
things just happen and there's nothing anyone can do to stop them," said
19+
programmer Mrs. Macy Von, echoing statements expressed by hundreds of thousands of
20+
programmers who use the only package manager where 90% of the world's
21+
supply-chain attacks have occurred in the last decade, and whose projects are
22+
20 times more likely to fall victim to supply chain attacks. "It's a shame, but
23+
what can we do? There really isn't anything we can do to prevent supply-chain
24+
attacks from happening if the maintainers don't want to secure access to their
25+
accounts in a robust manner". At press time, users of the only package manager
26+
in the world where these vulnerabilities regularly happen once or twice per
27+
week for the last year were referring to themselves and their situation as
28+
"helpless".
29+
30+
For more information, please see upstream documentation published by
31+
art-template at the following link: [2026-art-template](https://github.com/aui/blog/issues/3).

0 commit comments

Comments
 (0)