Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear clueless assholes: stop bashing bash and GNU

weev.livejournal.com

Post reply on HN
Print view View original

31–40 of 107 posts

Re: Dear clueless assholes: stop bashing bash and GNU

#31

Post by jsmthrowaway »

chris_wot wrote: post #28
jsmthrowaway wrote: post #25

Earlier quoted context omitted.

Nobody is bashing Stallman, least of all that Guardian article. I'm honestly not sure what weev is trying to white knight here, but the post is so hilariously off base that I lost what respect for him I had. The point made in the G by an interviewee (not the author) about the Bash codebase and undermining "all bugs are shallow" is actually quite good in the face of two giant counterexamples, and I would have liked to…

Given that rms never said the "all bugs are shallow" statement, I'm not surprised he didn't comment. You are thinking of ESR I think.

Didn't say it was his. He can comment on it when the topic is process failures that led us to this situation (not saying whether there were any, mind, just that's the topic).

Re: Dear clueless assholes: stop bashing bash and GNU

#32

Post by woutervdb »

jiggy2011 wrote: post #18
clarry wrote: post #10

Earlier quoted context omitted.

> What you're missing here, is that bash wasn't the software with an error. Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway ? I think you missed the news that there's a bug in bash. And if you're making the argument that bash should've not bee…

Think of it this way. Say that a car manufacturer builds a car for city driving and doesn't warrant or recommend it's use for off roading. However it just so happens that the car is tough enough that it makes a good offroader anyway and soon people start to buy the car for the express purpose of offroading even though the manufacturer does not recommend this use. Some time later it becomes apparent that there is a we…

Great explenation. To add to your story: imagine being the car manufacturer, doing this all for free (as in beer) and still having people more or less wishing you dead for building a city car not suitable for offroad use. It simply doesn't add up and makes you feel pretty miserable, I guess.

Re: Dear clueless assholes: stop bashing bash and GNU

#33

Post by quakershake »

nailer wrote: post #24
quakershake wrote: post #23

Anyone who bashes open source code for bugs is an idiot. Maybe the "community" should start auditing code instead of blogging and tweeting about how awful things are. This functionality has been around for so long it is generational. +1 to the person(s) responsible for finding this. Everyone complaining should stfu

I actually think it's fine to have an opinion on any piece of software. However weev is completely correct in telling people that shell environment variables were an obviously bad place for arbitrary data set by people on the internet back in the 90s. The shell wasn't designed for that, it's known to be insecure. HNs defence of Apache doing silly things seems to be more love of Apache and lack of knowledge of Unix fu…

Agreed. Misuse is a problem. However sometimes being too flexible opens itself up to unintended misuse.

It seems as if though foss is so reliable that people start to act entitled when shit hits the fan. Software has never been problem free and never will.

I'm just glad I haven't seen a libreBash or some other lame fork instead of just adding more eyes to the existing functioning project.

Re: Dear clueless assholes: stop bashing bash and GNU

#34

Post by chris_wot »

jsmthrowaway wrote: post #31
chris_wot wrote: post #28

Earlier quoted context omitted.

Given that rms never said the "all bugs are shallow" statement, I'm not surprised he didn't comment. You are thinking of ESR I think.

Didn't say it was his. He can comment on it when the topic is process failures that led us to this situation (not saying whether there were any, mind, just that's the topic).

Fair enough. However, it's possible that there weren't many eyes on the code. Now there are... it will be interesting to see if someone forks bash.

Re: Dear clueless assholes: stop bashing bash and GNU

#35

Post by thegeomaster »

I think that bashing bad code, bad practices and whatever lead to any security-critical bug (and any bug whatsoever, for that matter), should happen. If there weren't rants, flame wars and insults in the free software movement, I guarantee it wouldn't have come near where it is today. It's a big part of what drives innovation in all spheres, not just this one: the harsh (and not-so-harsh, sure) comments, the passive-aggressive forks, the rewritings, the heated discussions.

But bashing a person for writing that code? Never. I can't say my views on software politics are aligned with Mr. Stallman's, and neither I can say I have given that much thought to them. But I have enormous respect for everyone who has contributed to free software and helped shape the world, even with the smallest contributions... And Mr. Stallman's are one of the biggest. Everyone in this area should have the deepest respect for the enormous amount of work this man has done, and given it all to the community. It's hard, if not impossible, to stumble upon an anticonformist such as Stallman, who honestly does not care about the superficial things we all, unfortunately, do. I guarantee he could've leveraged everything he's done and been a multi-billionare by now. Instead he decided that the benefit the community can get from his work is far greater than the benefit he himself can get, so he did the only moral thing to do: he gave it all for free. And look at the GNU project now, or the FSF. Magnificent stuff.

Mistakes such as this one (and a great majority of developers make dozens of these on a weekly basis), are probably the most idiotic reason to call out a person for incompetence or senility. It's ridiculous. It's completely unacceptable to now demonize a man such as RMS, if not for other reasons, then because none of us will probably ever come close to what he has done to change this world for the better.

Re: Dear clueless assholes: stop bashing bash and GNU

#36

Post by oftenwrong »

keithpeter wrote: post #3

Is it actually the case that Stallman has no permanent home? If so, is that by choice or circumstance? He has done so much .

On his personal FAQ, he says:

>Until around 1998, my office at MIT was also my residence. I was even registered to vote from there. Nowadays I have a separate residence in Cambridge not far from MIT. However, I am rarely there, since I am nearly always travelling out of town.

https://www.stallman.org/rms-lifestyle.html

In general, there is a lot about RMS that runs contrary to societal norms. He marches to the beat of his own drummer.

Re: Dear clueless assholes: stop bashing bash and GNU

#37

Post by revelation »

vertex-four wrote: post #17
woutervdb wrote: post #13

Earlier quoted context omitted.

I know about Shellshock and I know what it means. However, I think it's wrong to blame bash for the fact that almost everything seems to be vulnerable. Those developers were wrong by using untrusted user input in places where it didn't belong. It's the FSF's responsibility to release a fix simply because the whole world depends on their (the world's) own stupid mistakes when developing their programs.

> Those developers were wrong by using untrusted user input in places where it didn't belong. Environment variables are text. So long as you control the name of them, and the name doesn't conflict with any other name in the system, there should be absolutely no issue with putting user input into environment variables. Programs like bash should only be executing things that are explicitly marked as trusted code throug…

So you mean the fix is to add some magic constant that variables now have to start with?

I mean, come on, the issue is screaming at you! This is the same basic mistake of using a bunch of string concatenation to build queries for your database.

Bash is the shell I use to control my system with, it's made for convenience of the user. If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for your favorite protocol) on a modern stack should involve launching the shell with user controlled environment variables, you just can't be taken seriously.

Re: Dear clueless assholes: stop bashing bash and GNU

#38

Post by clarry »

revelation wrote: post #37
vertex-four wrote: post #17

Earlier quoted context omitted.

> Those developers were wrong by using untrusted user input in places where it didn't belong. Environment variables are text. So long as you control the name of them, and the name doesn't conflict with any other name in the system, there should be absolutely no issue with putting user input into environment variables. Programs like bash should only be executing things that are explicitly marked as trusted code throug…

So you mean the fix is to add some magic constant that variables now have to start with? I mean, come on, the issue is screaming at you! This is the same basic mistake of using a bunch of string concatenation to build queries for your database. Bash is the shell I use to control my system with, it's made for convenience of the user. If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for you…

> This is the same basic mistake of using a bunch of string concatenation to build queries for your database.

Not at all. The string as a query is expected to execute. Environment variables in general are just data and not expected to be executed, even if some of them have special semantics and may indeed be executed.

Re: Dear clueless assholes: stop bashing bash and GNU

#39

Post by hiphopyo »

quakershake wrote: post #33
nailer wrote: post #24

Earlier quoted context omitted.

I actually think it's fine to have an opinion on any piece of software. However weev is completely correct in telling people that shell environment variables were an obviously bad place for arbitrary data set by people on the internet back in the 90s. The shell wasn't designed for that, it's known to be insecure. HNs defence of Apache doing silly things seems to be more love of Apache and lack of knowledge of Unix fu…

Agreed. Misuse is a problem. However sometimes being too flexible opens itself up to unintended misuse. It seems as if though foss is so reliable that people start to act entitled when shit hits the fan. Software has never been problem free and never will. I'm just glad I haven't seen a libreBash or some other lame fork instead of just adding more eyes to the existing functioning project.

Isn't Zsh basically libreBash though?

Re: Dear clueless assholes: stop bashing bash and GNU

#40

Post by bjornsing »

> Anyone that has untrusted input embedded within a shell script does not know what they are doing.

That's obviously false. To the contrary, I have serious concerns about the judgement of anyone that thinks an interpreter like bash should parse the contents of every environment variable on startup.

Post reply on HN