From memory from working with these a couple of years ago:

Firefox extension asset URLs are random and long (there's a UUID in there iirc). The extension itself can discover its randomized base so that it can output its asset URLs, but webpage code can't.

Use fans. They don't like flying around in wind and they don't know where to fly to anymore because the fan disperses the CO2 you produce so quickly that there's no gradient for them to follow to the source (you).

The fan has to be very fast for this to work, otherwise the little buggers find pockets and crevasses around you to shelter from the air and then eventually bite.

There's GeckoView which one'd use for embedding Firefox in an Android app. Can't use that on Sailfish OS of course, but it'd help in figuring out what of core Firefox to bind to to make a similar layer.

Yeah, don't know the details of the GeckoView API but looks like its going in the right direction to help what Sailfish OS needs. :)

As for the permissions, using ACLs would work better here. Then you don't need a separate group for every grouping.

TIL about ACLs! I think that would nicely solve the group permission issue.

The final project for my senior year filesystems class thirty years ago was to implement ACLs on top of a SunOS 4 filesystem. That was a fun project.

Write up? Code? :D

Then let me also introduce you to extended attributes, aka xattrs. That's how the data for SELinux is stored.

There is no support for writing multiple xattrs in one transaction.

There is no support for writing multiple xattrs and file contents in one transaction.

Journaled filesystems that immediately flush xattrs to the journal do have atomic writes of single xattrs; so you'd need to stuff all data in one xattr value and serialize/deserialize (with e.g JSON, or potentially Arrow IPC with Feather ~mmap'd from xattrs (edit: but getxattr() doesn't support mmap. And xattr storage limits: EXT4: 4K, XFS: 64k, BTRFS: 16K)

Atomicity (database systems) https://en.wikipedia.org/wiki/Atomicity_(database_systems)

try:

  sed 's:SSH/HTTP/3:SSH over HTTP/3:g'

At least with GNU sed, you can use different separators so dodge the need for exscaping. | works as well.

Totally. Furthermore one can input that (now broken) URL into the Internet Archive to see if they might have snapshotted that red stapler page.

For SSH specifically (ssh user@host "command with args") I've written this workaround pseudoshell that makes it easy to pass your argument vector to execve unmolested.

https://crates.io/crates/arghsh

Note that at least in python, you can use "shlex.quote" instead - it's in stdlib and does not need any extra tools.

    >>> import subprocess
    >>> import shlex
    >>> subprocess.run(['ssh', 'host', shlex.join(['ls', '-la', 'a filename with spaces'])])
    ls: cannot access 'a filename with spaces': No such file or directory

works nested, too

    >>> layer2 = ['ls', '-la', 'a filename with spaces']
    >>> layer1 = ['ssh', 'host1', shlex.join(layer2)]
    >>> layer0 = ['ssh', 'host0', shlex.join(layer1)]
    >>> subprocess.run(layer0)

(I am not sure if Rust has equivalent, but if it does not, it's probably easy to implement.. Python version is only a few lines long)

Wrong! SSH is very much the worst: it uses the user's login shell, not sh -c. So if the user's login shell isn't POSIX compatible, it still fails!

   >>> subprocess.run(["fish", "-c", shlex.join(["echo", "this isn\\'t working"])])
   fish: Unexpected end of string, quotes are not balanced
   echo 'this isn\'"'"'t working'

Well, you gotta draw the line somewhere, right? You can ssh into all sort of weird places, like native windows machines, or routers which expose their own shell, and you cannot expect them to be as usable as the regular ones.

The systems with non-POSIX non-interactive shell are firmly in the "special" category. If a user decided to set their _non_interactive_ shell to fish - they know they are heading for trouble and should not be surprised. I would not worry about such users in my scripts for example.

Please correct me if I'm am wrong, but POSIX doesn't define a non-interactive or interactive shell, it only defines a login shell. You can't "set your non-interactive shell", only "set your login shell". OpenSSH could easily have decided to "join all arguments with spaces and pass them to sh -c", which would also have been a bad decision for the reasons listed in this article, but instead chose the even more esoteric choice of using the login shell, even when running non-interactive commands.

> I am not sure if Rust has equivalent

Not in the standard library, but there are packages.

This just confirms my habit of switching to python as soon as a shell script reaches any level of complexity

Great, but I would've been happier if I'd had some dead simple dependency tracking 10 years ago. Just enough to create metabug functionality with. Like Bugzilla, Trac, Mantis etc have sported for at least two deades. I've always wondered why Github didn't have such basic functionality. (No, just the ability to reference other issues is not enough; I want to get an email for the metabug when all blocking issues are resolved).

I'm running LineageOS, rooted, with MicroG' Safetynet emulation (of sorts?). So a build signed with userdebug keys.

Some banking apps just work - two with warning on first launch, and one just doesn't care at all.

Two refuse to run and I have an old unrooted phone for them. Resulting in me being a good customer of those three banks that are not fussy.

So try and see, perhaps things just work!