vulnerability: getcursor() function removed, inline it
errors redirect to stderr