2026-08-25 GnuCash IRC logs
01:10:59 *** fell_laptop has quit IRC
01:12:17 *** fell_laptop has joined #gnucash
01:12:17 *** ChanServ sets mode: +o fell_laptop
01:22:26 *** chf has quit IRC
01:22:57 *** chf has joined #gnucash
01:22:57 *** ChanServ sets mode: +v chf
05:19:37 *** AdrienM has quit IRC
05:22:21 *** AdrienM has joined #gnucash
05:22:21 *** ChanServ sets mode: +v AdrienM
05:28:18 *** AdrienM has quit IRC
05:31:42 *** AdrienM has joined #gnucash
05:31:42 *** ChanServ sets mode: +v AdrienM
05:32:29 *** bauen1 has quit IRC
06:38:00 *** bauen1 has joined #gnucash
06:38:01 *** ChanServ sets mode: +v bauen1
12:21:18 *** fell_laptop has quit IRC
12:22:37 *** fell_laptop has joined #gnucash
12:22:37 *** ChanServ sets mode: +o fell_laptop
14:33:37 *** fell_laptop has quit IRC
15:09:07 <jralls> warlord, I've got future-branch Windows nightly builds mostly working in Github actions so it's time to think about distribution. The github-only way would be to make nightly releases but that would clutter up the releases pane and I don't think we want to do that. I guess putting them on code with the other nightlies makes the most sense, but the download link includes a different hash every time so a simple netcat knock
15:09:07 <jralls> er wouldn't work. Any ideas?
15:09:14 *** tmrsm4 has joined #gnucash
15:10:11 <warlord> jralls, are you trying to push into code or pull from github?
15:10:16 <warlord> or... something else?
15:11:24 *** tmrsm has quit IRC
15:11:24 *** tmrsm4 is now known as tmrsm
15:15:30 <jralls> warlord, either would work I suppose but I would think for security you'd rather have code pull than have github push.
15:15:54 <warlord> True. How would I know what to get code to pull?
15:17:37 <jralls> I'd add something to the github action that would send a notification with the link. I'm looking for a good way to do that.
15:18:58 <warlord> Could it do a netcat or http post or something with the L?target rl as contennt? Or perhaps a part of the
15:19:03 <warlord> URL?
15:20:44 <jralls> Not sure about a netcat, but I know curl is available so it could do an http post.
15:22:10 <warlord> Let me think on it -- a simple CGI that would take an input and password and then pull using that input.. THat would be doable. Would need to think about the security of the target.
15:23:56 <jralls> Github can store secrets, supposedly safely, but I'm skeptical about that safely part. Gemini tells me that the windows runners don't have netcat built-in but it can be installed with chocolatey so that's another option.
15:28:03 <warlord> Well, the secret doesn't have to be a strong secret; just something to quickly filter out false POSTs to the URL
15:35:48 *** fell has joined #gnucash
15:35:49 *** ChanServ sets mode: +o fell
15:36:23 <jralls> Strength isn't the issue; I'd suggest encrypting the url with a public key stored on github that you decrypt with the corresponding private key. The problem is that if somebody cracks github and gets the key they can get code to upload something malicious.
15:40:49 <warlord> This is why I was thinking it would only be a partial URL. Like the tail end.. And code "knows" the beginning: https://..../<post-data>
15:52:03 <jralls> That would block off that line of attack. Are there others that we should worry about?
15:55:42 <warlord> worst cast might be a downgrade attack -- POSTing for a previous version?
16:10:54 <jralls> Which would already be there so code could ignore it.
16:22:02 <warlord> True.
21:20:46 *** fell_laptop has joined #gnucash
21:20:47 *** ChanServ sets mode: +o fell_laptop
21:21:11 *** fell has quit IRC
23:07:19 *** fell has joined #gnucash
23:07:19 *** ChanServ sets mode: +o fell
23:07:21 *** fell_laptop has quit IRC
23:10:00 *** jonakeys has quit IRC
23:10:07 *** jonakeys has joined #gnucash