damienwebdev

11 ms·

1.
Show HN: One-click open-source ecommerce starter (Magento), drive it with Claude(ecommerce-ai-starter.graycore.io)
3 points by damienwebdev 4mo ago|0 comments
2.
by damienwebdev 4mo ago
I don't have an exact count, but during my analysis, I found that ~40 of the top 100 starred repos in the PHP ecosystem were impacted. Primarily by jobs that run `on: schedule` or by a maintainer with an `on: push`
3.
CVE-2026-45793: Anatomy of a 14-Hour PHP Supply-Chain Near-Miss(github.com)
3 points by damienwebdev 4mo ago|1 comments
4.
by damienwebdev 4mo ago
After yesterday's composer situation, I felt the need to write down my perspective on how this came to be as the vulnerability reporter.
5.
by damienwebdev 4mo ago
It's a mix of responsibility between both systems. A new format combined with an old "bug".
6.
LogLeak: Composer GitHub Actions token disclosure in error messages, patched(blog.packagist.com)
2 points by damienwebdev 4mo ago|0 comments
7.
Composer leaks contents of tokens configured as GitHub OAuth tokens(github.com)
70 points by damienwebdev 4mo ago|27 comments
8.
by damienwebdev 4mo ago
I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
9.
Show HN: Open-Source AI CMS Editor for Magento/Adobe Commerce(github.com)
1 points by damienwebdev 10mo ago|0 comments
10.
Show HN: Daffodil – Open-Source Ecommerce Front End, Now with Shopify(demo.daff.io)
7 points by damienwebdev 1y ago|1 comments
11.
by damienwebdev 1y ago
From a brief review, it looks like the underlying platform they use is https://www.scayle.com/ (though I'm not sure its the one that was attacked) its just the one I found while looking at their site.
12.
by damienwebdev 1y ago
I'd like to think that I'm a somewhat "odd" person, but I'm not exactly sure how that reflects in my code. This code hasn't been taken over, it's just been something I've been working on a long time.
13.
by damienwebdev 1y ago
Just following up that I've fixed this!
14.
by damienwebdev 1y ago
I noticed this too. I was actually working on this yesterday, https://github.com/graycoreio/daffodil/pull/3946 I got a little side-tracked over the weekend and didn't get a new build of the demo in with
15.
Show HN: Daffodil – Open-Source Ecommerce Framework to connect to any platform(github.com)
66 points by damienwebdev 1y ago|8 comments
16.
by damienwebdev 3y ago
There are many tech startup companies that pay for: 1. HN Upvotes 2. Product Hunt Upvotes 3. Github Stars Why? Because it's all part of their marketing con. For some software companies, they rely on the hivemind to drive the purchase o
17.
by damienwebdev 3y ago
I'm one of the maintainers of Faker, so hopefully I can help remedy any situation we inadvertently created. https://fakerjs.dev/api/helpers.html#arrayelement I believe is what you're looking for. The issue, a
18.
by damienwebdev 4y ago
Businesses will always have commerce problems, so you're pretty stable in terms of consistent income. If you can make a name for yourself, you can do very well. Especially for Magento, I love the fact that I can make small change, deli
19.
by damienwebdev 4y ago
Fully agree. The problems are hard, the interested talent is limited (who would want to work on line of business software when academia actively pushes people towards other things), and the problem space (all possible online business config
20.
by damienwebdev 4y ago
MageOS is not a maintenance mode, unfortunately we don't do a good job expressing that. The goal is to migrate management of the codebase out of Adobe's hands back into the community's. Community PRs, triage, etc. We're
21.
by damienwebdev 4y ago
So, I happen to know this niche extremely well! I'm one of the maintainers of MageOS (a fork of Magento) as well as a maintainer of Daffodil (a monolithic Angular PWA framework - not Microfrontends yet). APIS are definitely the way to
22.
by damienwebdev 4y ago
I actively hire this way.
23.
by damienwebdev 4y ago
> Python Django specific sub dependency, that broke the admin interface, which obviously, we don't explicitly test. There's your problem.
24.
by damienwebdev 5y ago
My org has forked this to https://github.com/graycoreio/faker.js from a fairly recent verified commit from Marak, even if its only temporary for some semblance of stability.
25.
by damienwebdev 5y ago
There's a reason I submitted this PR one year ago. https://github.com/graycoreio/daffodil/pull/625 Specifically, > Relying on a curl'd bash script downloaded off your server seems inherently vuln