Dear clueless assholes: stop bashing bash and GNU
weev.livejournal.com
Dear clueless assholes: stop bashing bash and GNU
1–10 of 107 posts
Re: Dear clueless assholes: stop bashing bash and GNU
#2I'm amazed that he's being bashed for this. There are a LOT of security flaws out there, this one is - as Stallman says - a blip on the radar.
Re: Dear clueless assholes: stop bashing bash and GNU
#3Is it actually the case that Stallman has no permanent home? If so, is that by choice or circumstance? He has done so much.
Re: Dear clueless assholes: stop bashing bash and GNU
#4So is it wrong to criticize bad code for being bad if it was written by Mother Theresa?
I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
Re: Dear clueless assholes: stop bashing bash and GNU
#5So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
What you're missing here, is that bash wasn't the software with an error. It's like you use ice cubes for building a house, observing your house is melting and then blaming the developers of ice cubes for making such horible building blocks. Ice cubes were never meant to be used to build houses with.
Re: Dear clueless assholes: stop bashing bash and GNU
#6So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
He doesn't think the code is bad.
Shellshock is not a critical failure in bash. It is a critical failure in thousands of people who knew a tool so useful that they decided to deploy it far beyond its scope. A tool so resilient that it it did not fall over when everyone deployed against best practices. Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first. Anyone that has untrusted input embedded within a shell script does not know what they are doing. The fact that there is a way to get bash to execute untrusted code is unsurprising. The thing that surprises me is the sheer number of developers who thought it would be otherwise in complete contrast to UNIX parables and common sense.
FTFA.
Re: Dear clueless assholes: stop bashing bash and GNU
#7So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
He doesn't think the code is bad. Shellshock is not a critical failure in bash. It is a critical failure in thousands of people who knew a tool so useful that they decided to deploy it far beyond its scope. A tool so resilient that it it did not fall over when everyone deployed against best practices. Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environme…
And I never said weev thinks the code is bad. I said what he calls "bashing bash" is other people criticizing bash for having bad code.
Re: Dear clueless assholes: stop bashing bash and GNU
#8So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
No, it doesn't, but like Heartbleed, I've see a lot of backlash against GNU (sometimes via Stallman bashing). That, I believe, is what's being discussed here.
Re: Dear clueless assholes: stop bashing bash and GNU
#9So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
I think it's more of a point that if you are using something for free, you should think more in terms of "What did I do wrong to cause this? Who did I not support that put us in this situation?".
People pointed out that OpenSSL had a miniscule budget and provided tons of value to the world. Once again, all you can say is mea culpa.
Either that or they should be creating alternatives and moving away from poorly written software.
Re: Dear clueless assholes: stop bashing bash and GNU
#10So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
What you're missing here, is that bash wasn't the software with an error. It's like you use ice cubes for building a house, observing your house is melting and then blaming the developers of ice cubes for making such horible building blocks. Ice cubes were never meant to be used to build houses with.
> What you're missing here, is that bash wasn't the software with an error.
Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway?
I think you missed the news that there's a bug in bash.
And if you're making the argument that bash should've not been used in the first place because it's an ice cube or fragile or whatever, then you are with those who make the argument that bash is bad code.