Dear clueless assholes: stop bashing bash and GNU • Hacker News Board

Re: Dear clueless assholes: stop bashing bash and GNU

#21

Post by XorNot » Sun, Sep 28, 2014, 1:34 PM UTC

jiggy2011 wrote: post #15

ClashTheBunny wrote: post #9

Earlier quoted context omitted.

I think it's more of a point that if you are using something for free, you should think more in terms of "What did I do wrong to cause this? Who did I not support that put us in this situation?". People pointed out that OpenSSL had a miniscule budget and provided tons of value to the world. Once again, all you can say is mea culpa. Either that or they should be creating alternatives and moving away from poorly writte…

Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.

Proprietary software gets compromised all the time. In serious ways. A simple example is the sheer number of bank websites which get taken down, and then we all yell at the guy who discovered it to absolutely not disclose it for fear of prosecution.

The point is, when FOSS software has a bug, there's no small set of developers who are responsible. It's, in some small way, collectively all our faults. Like in the case of Bash - apparently for 20 years, we never actually checked if environment variables were executable.

Re: Dear clueless assholes: stop bashing bash and GNU

#22

Post by parennoob » Sun, Sep 28, 2014, 1:37 PM UTC

clarry wrote: post #4

So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.

This is completely missing the point and intent of the article.

The author is (IMO, rightly) getting pissed about "technology journalists" at places like Forbes, or bankers at JP Morgan, who will smugly say stuff like, "Oh, there was a really horrible vulnerability in this software, and there's nothing we can do until those incompetent programmers get out a patch" (even if this is not explicitly said, it is often implied in these articles). They completely overlook the fact that

a) The source it right there. You think you can do a better job, please fix it and submit a patch upstream. Or post on the bugtracker.

b) The reason this is a problem is usually because of lack of sanitization of user input before passing it to bash. So that is your problem, not really bash itself. Use one of the patches out there that disable the "feature" that leads to the bug.

How many articles state stuff like "Thousands of organizations over the world use bash, yet no one has discovered this for 22 years. This means a lot of companies are not taking security seriously enough to audit the (open) source of the code they ride on."? Until we start seeing articles that address the complex social and economic aspects of the issue, I don't blame FSF supporters for being pissed at them.

Re: Dear clueless assholes: stop bashing bash and GNU

#23

Post by quakershake » Sun, Sep 28, 2014, 1:38 PM UTC

Anyone who bashes open source code for bugs is an idiot. Maybe the "community" should start auditing code instead of blogging and tweeting about how awful things are. This functionality has been around for so long it is generational.

+1 to the person(s) responsible for finding this.

Everyone complaining should stfu

Re: Dear clueless assholes: stop bashing bash and GNU

#24

Post by nailer » Sun, Sep 28, 2014, 1:44 PM UTC

quakershake wrote: post #23

Anyone who bashes open source code for bugs is an idiot. Maybe the "community" should start auditing code instead of blogging and tweeting about how awful things are. This functionality has been around for so long it is generational. +1 to the person(s) responsible for finding this. Everyone complaining should stfu

I actually think it's fine to have an opinion on any piece of software.

However weev is completely correct in telling people that shell environment variables were an obviously bad place for arbitrary data set by people on the internet back in the 90s. The shell wasn't designed for that, it's known to be insecure.

HNs defence of Apache doing silly things seems to be more love of Apache and lack of knowledge of Unix fundamentals than hate of free tools.

Re: Dear clueless assholes: stop bashing bash and GNU

#25

Post by jsmthrowaway » Sun, Sep 28, 2014, 1:46 PM UTC

chris_wot wrote: post #2

I'm amazed that he's being bashed for this. There are a LOT of security flaws out there, this one is - as Stallman says - a blip on the radar.

Nobody is bashing Stallman, least of all that Guardian article. I'm honestly not sure what weev is trying to white knight here, but the post is so hilariously off base that I lost what respect for him I had.

The point made in the G by an interviewee (not the author) about the Bash codebase and undermining "all bugs are shallow" is actually quite good in the face of two giant counterexamples, and I would have liked to have seen Stallman counter that. He didn't, and instead took another opportunistic shot at proprietary software, just like the FSF's tone-deaf statement.

That weev would get The World vs. Stallman from that, then invest his time into a defense of poor Stallman and shame the world for not giving him money (when his politics and ideals create an economic scenario where he is unlikely to ever receive money from those who benefit most, and ostensibly he accepted this decades ago), is just bananas. I will continue to criticize whatever I like, bash's codebase and GNU process potentially being on the list, and I do not need weev's permission or acceptance to do so.

Maybe if we on HN and in Silicon Valley culture found his racial epithet organization amusing, he wouldn't have to talk about us like a lower class.

Re: Dear clueless assholes: stop bashing bash and GNU

#26

Post by nailer » Sun, Sep 28, 2014, 1:46 PM UTC

vertex-four wrote: post #20

spindritf wrote: post #6

Earlier quoted context omitted.

He doesn't think the code is bad. Shellshock is not a critical failure in bash. It is a critical failure in thousands of people who knew a tool so useful that they decided to deploy it far beyond its scope. A tool so resilient that it it did not fall over when everyone deployed against best practices. Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environme…

> Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first. CGI was standardised in 1997 to use environment variables to pass information into the CGI program. I'm sure software existed before that that does the same - procmail, perhaps? No software that's been touched in the past two decades should assume that the environment variable is…

Postfix is of a similar age and does exactly as weev says.

Re: Dear clueless assholes: stop bashing bash and GNU

#27

Post by chris_wot » Sun, Sep 28, 2014, 1:47 PM UTC

jimktrains2 wrote: post #11

chris_wot wrote: post #2

I'm amazed that he's being bashed for this. There are a LOT of security flaws out there, this one is - as Stallman says - a blip on the radar.

Well. blip because it'll be fixed and we'll move on. It's not a game changer, it's a (major and very problematic) temporary annoyance.

I have to say, it's ironic that weev is feeling offended by mild criticism though. Given he ran the GNAA to deliberately offend, it seems a little rich that he is so upset.

Re: Dear clueless assholes: stop bashing bash and GNU

#28

Post by chris_wot » Sun, Sep 28, 2014, 1:48 PM UTC

jsmthrowaway wrote: post #25

chris_wot wrote: post #2

I'm amazed that he's being bashed for this. There are a LOT of security flaws out there, this one is - as Stallman says - a blip on the radar.

Nobody is bashing Stallman, least of all that Guardian article. I'm honestly not sure what weev is trying to white knight here, but the post is so hilariously off base that I lost what respect for him I had. The point made in the G by an interviewee (not the author) about the Bash codebase and undermining "all bugs are shallow" is actually quite good in the face of two giant counterexamples, and I would have liked to…

Given that rms never said the "all bugs are shallow" statement, I'm not surprised he didn't comment. You are thinking of ESR I think.

Re: Dear clueless assholes: stop bashing bash and GNU

#29

Post by Goopplesoft » Sun, Sep 28, 2014, 1:50 PM UTC

keithpeter wrote: post #3

Is it actually the case that Stallman has no permanent home? If so, is that by choice or circumstance? He has done so much .

This post might shed some light into Stallman's lifestyle: http://gizmodo.com/5853729/please-do-not-buy-richard-stallma...

Re: Dear clueless assholes: stop bashing bash and GNU

#30

Post by scott_s » Sun, Sep 28, 2014, 1:54 PM UTC

jimktrains2 wrote: post #8

clarry wrote: post #4

So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.

No, it doesn't, but like Heartbleed, I've see a lot of backlash against GNU (sometimes via Stallman bashing). That, I believe, is what's being discussed here.

I'm not trying to be sarcastic, this is an honest question: where have you seen the blame against GNU and Stallman related to the bash bug? I ask because I haven't seen it here (thankfully) or anywhere else.