Among people gullible enough to download and run executables containing random unknown content, the blogger has now lost some personal credibility, but the good news is the gullible will continue to download and run executables containing random content because they see the story as an individual social norms violation, not a miserable systemic failure. The blogger was successful in that had he not submitted a rm -Rf and then publicized the story, the problem would not be discussed at all, but it was a failure in that the story only resonates with those who already don't care about security.
OMG rm -rf ~ in a valentine bash script and its partly my fault
31–38 of 38 posts
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#32[deleted]
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#33Haha. Next time if you are just trying to make a point to the open source maintainer who's supposed to be reviewing your pull request, write the payload but comment it out so it doesn't actually do anything.
The real lesson here is DON'T MERGE PULL REQUESTS YOU HAVEN'T LOOKED AT.
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#34I get the impression he was not expecting that pull request to get merged. This was silly, but not malicious. He wasn't trying to delete home directories to prove a point: the point he was making was directed at the repo owner. Meanwhile, merging that pull request seems downright stupid, but maybe there are mitigating factors I'm not aware of?
Don't issue pull requests that you don't want merged. It's really that simple. The maintainer could easily merge it by accident by absentmindedly clicking the button they normally click in response to well-formed pull requests while thinking they'd rejected it. Maybe they have a cat, or a toddler, who knows?
Don't put your name on stuff you don't want merged.
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#35"In a fit of silliness" No. Not silly. Not at all. "I think I was the muppet they got to pull the trigger of the gun they pointed." Amazing. ~They got me to pull the trigger.~ ~I'm just a muppet.~ No. Not a muppet. Not at all. Sickening.
Stop being a judgemental ass. He expected the pull request to be read and ignored, not blindly (or maliciously) merged. If anything is sickening, it's this readiness to assign blame and exaggerate guilt.
> ..not blindly (or maliciously) merged..
Or accidentally.
He saw someone making a careless rookie mistake, who quite obviously didn't really understand what they were doing, and equally obviously didn't understand how dangerous it was, and then deliberately put a live landmine in their way.
He then posted to his blog saying how shocked, amazed and not in any way responsible he was for the resulting explosion.
How would you characterise that?
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#36So since we're all so busy assigning blame here, who is going to blame the end user for deciding to pipe a script straight from the Internet into a shell, whether directed by a README or not?
Saves the trouble of having to learn how to attack security vulnerabilities if you can simply have the user r00t themselves for you...
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#37Among people gullible enough to download and run executables containing random unknown content, the blogger has now lost some personal credibility, but the good news is the gullible will continue to download and run executables containing random content because they see the story as an individual social norms violation, not a miserable systemic failure. The blogger was successful in that had he not submitted a rm -Rf…
> Among people gullible enough to download and run executables containing random unknown content
Like Ruby developers, for example?
http://www.ruby-lang.org/en/downloads/
"curl -L https://get.rvm.io | bash -s stable --ruby"
Re: OMG rm -rf ~ in a valentine bash script and its partly my fault
#38What kind of title is this? "Evil Open Source". It has nothing to do with the content. The linked post itself is titled "OMG rm -rf ~ in a valentine bash script and its partly my fault??!?!"
It also isn't technically Open Source. I didn't see anywhere in the REPO that stated it was Open Source. At best, it's Freeware/Shareware, at worst, you're stealing the author's work by downloading.
Minor nit, but I think it adds to your comment.