Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear clueless assholes: stop bashing bash and GNU

weev.livejournal.com

Post reply on HN
Print view View original

41–50 of 107 posts

Re: Dear clueless assholes: stop bashing bash and GNU

#41

Post by jiggy2011 »

XorNot wrote: post #21
jiggy2011 wrote: post #15

Earlier quoted context omitted.

Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.

Proprietary software gets compromised all the time. In serious ways. A simple example is the sheer number of bank websites which get taken down, and then we all yell at the guy who discovered it to absolutely not disclose it for fear of prosecution. The point is, when FOSS software has a bug, there's no small set of developers who are responsible. It's, in some small way, collectively all our faults. Like in the case…

Most people are incapable of taking any responsibility for issues in bash or openssl, in fact people who rely on them might not even know they exist , let alone be able to fix them. If you buy something from Microsoft you are paying them to take care of everything from the kernel upwards so that you don't need to worry about the details.

Re: Dear clueless assholes: stop bashing bash and GNU

#42

Post by rabite »

chris_wot wrote: post #27
jimktrains2 wrote: post #11

Earlier quoted context omitted.

Well. blip because it'll be fixed and we'll move on. It's not a game changer, it's a (major and very problematic) temporary annoyance.

I have to say, it's ironic that weev is feeling offended by mild criticism though. Given he ran the GNAA to deliberately offend , it seems a little rich that he is so upset.

You're missing the point. The GNAA is built to offend worthless parasites who contribute nothing to the world. Social justice whiners, socialites, et al. Such garbage deserve no respect.

Stallman is the antithesis of worthless parasitism. Stallman spent his entire life selflessly giving to the world, and the world gave him nothing but disdain in return. He's truly a prophet, like Diogenes or Ezekiel. He deserves respect, and he gets far too little of it.

Re: Dear clueless assholes: stop bashing bash and GNU

#43

Post by vertex-four »

revelation wrote: post #37
vertex-four wrote: post #17

Earlier quoted context omitted.

> Those developers were wrong by using untrusted user input in places where it didn't belong. Environment variables are text. So long as you control the name of them, and the name doesn't conflict with any other name in the system, there should be absolutely no issue with putting user input into environment variables. Programs like bash should only be executing things that are explicitly marked as trusted code throug…

So you mean the fix is to add some magic constant that variables now have to start with? I mean, come on, the issue is screaming at you! This is the same basic mistake of using a bunch of string concatenation to build queries for your database. Bash is the shell I use to control my system with, it's made for convenience of the user. If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for you…

> So you mean the fix is to add some magic constant that variables now have to start with?

That executable variables have to start with. This is a perfect fix, because attackers can never choose the names of environment variables, because we know that that's a poor idea (anyone who does it is already vulnerable to people setting LD_PRELOAD and similar things). This is simply marking certain variables as executable, while everything else is not.

The default assumption, like it or not, is that if you set some random environment variable to some random text, nothing's going to happen. It's been like that since 1993, at the latest.

> If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for your favorite protocol) on a modern stack should involve launching the shell with user controlled environment variables, you just can't be taken seriously.

Some things end up managing the system - DHCP, for example. It turns out that the shell is really, really good at managing *nix systems. Everyone can understand it, and everyone can figure out how to manage their system with it. The only real alternative would be perl, which nobody wants to code in, and has a greater learning barrier.

As for modern web frameworks - of course they shouldn't use CGI, although more because there's better/more performant alternatives than for security reasons. However, you find me a medium/large business which has absolutely no legacy code anywhere.

Re: Dear clueless assholes: stop bashing bash and GNU

#45

Post by jsmthrowaway »

oftenwrong wrote: post #36
keithpeter wrote: post #3

Is it actually the case that Stallman has no permanent home? If so, is that by choice or circumstance? He has done so much .

On his personal FAQ, he says: >Until around 1998, my office at MIT was also my residence. I was even registered to vote from there. Nowadays I have a separate residence in Cambridge not far from MIT. However, I am rarely there, since I am nearly always travelling out of town. https://www.stallman.org/rms-lifestyle.html In general, there is a lot about RMS that runs contrary to societal norms. He marches to the beat o…

And he wants it that way, which weev missed, apparently.

Re: Dear clueless assholes: stop bashing bash and GNU

#48

Post by hahainternet »

Mankhool wrote: post #46
Mankhool wrote: post #44

I stopped reading at, "a__holes".

Mr. Auernheimer needs to learn to write like an adult if he wants to be taken seriously.

Stopping reading because someone said something offensive is not an adult behaviour, so the irony here is palpable. Read the fucking article.

Re: Dear clueless assholes: stop bashing bash and GNU

#50

Post by fmoralesc »

Tharkun wrote: post #47

What does Shellshock have to do with RMS? RMS didn't author Bash. And I can't see any Shellshock related RMS bashing. So why the angry post?

There was a backlash of sorts against the statement the FSF did regarding Shellshock.[1]

[1]: https://www.fsf.org/news/free-software-foundation-statement-...

Post reply on HN