Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

github.com

Post reply on HN
Print view View original

111–120 of 280 posts

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#111

Post by click170 »

preconsider wrote: post #90

To those name-calling the author of the script: The product/update is hyped and the release date is set in stone. Tensions are high and your boss has already let you know that you're on thin ice and not delivering on the project goals. A last-minute showstopper bug comes in, caused by file leaks. Everyone is scrambling, and the file belongs to you so its on you to fix it alone. There is no time for code review, and d…

This.

This is the reality of corporate development. I think we should be demanding more before buying software from vendors, especially when you can't just whip out the source code to audit or fix yourself.

Suff like this doesn't have to happen, but we let it.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#112

Post by clebio »

irishcoffee wrote: post #13
colanderman wrote: post #5

# Scary! rm -rf "$STEAMROOT/"* Anybody who writes a line like this deserves their software engineer license revoked. This isn't the first time I've seen shit like this (I've seen it in scripts expected to be run as root, no less); it makes my blood boil. Seriously. "xargs rm -df -- EDIT: I shouldn't be so harsh, if it weren't for the comment admitting knowing how poor an idea this line is.

The programmer committed a cardinal sin to be sure. But, so did everyone on the code review that let it slide.

Absolutely. Arguably, that's the main point of the code review -- you're sharing responsibility. If your team scape-goats, it's not going to be a team for very long.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#113

Post by Alupis »

enneff wrote: post #55
giggles_giggles wrote: post #26

Earlier quoted context omitted.

So the script wouldn't pause and ask for user input during normal operation.

But why would the script prompt for user input unless something was awry? Presumably they control the contents of $STEAMROOT, so I don't see why rm -r should prompt unless it's about to do the wrong thing.

most systems have "alias rm='rm -i'" by default, so it would prompt on every single file regardless of ownership, etc.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#114

Post by woodman »

Chris_Newton wrote: post #51

This seems like yet another good example of why robust application-level access control would be a helpful thing to build into modern operating systems, in addition to the typical user-based controls. This may have been both a rookie mistake and a regrettable failure of code review processes, but in any case it simply shouldn’t be possible for an application running on a modern system to wipe out all user data withou…

You are describing a problem that has been solved several times over. Blame steam, the distro devs, or the user for not implementing one of the many long existing solutions: chroot [0].

[0] http://en.wikipedia.org/wiki/Chroot

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#115

Post by colanderman »

8_hours_ago wrote: post #108
colanderman wrote: post #32

Earlier quoted context omitted.

Not if the previous line was: STEAMROOT=$SOME_OTHER_UNSET_VARIABLE/ "rm -r " is a code smell, as much as "cc -o myprog .c" is. You should always know what files make up your system, and track them in a MANIFEST file. There's rarely a good reason to use wildcards when a program is dealing with its own files. xargs rm -df -- fixes this.

Fyi: the -d option is specific to the BSD implementation of rm, it's not available in the GNU coreutils rm.

It's in my coreutils (8.22). Maybe it's recently added?

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#116

Post by Alupis »

jtokoph wrote: post #8

The biggest lesson here is that backing up your files is extremely important. Both local backups and remote backups. I like the 3-2-1 rule: At least three copies, In two different formats, with one of those copies off-site. Software is written by humans who will undoubtably miss a corner case and not think of every possible environment.

Always live by the saying:

"If it doesn't exist in at least three places, it doesn't actually exist"

- Allan Jude - TechSnap

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#117

Post by colanderman »

click170 wrote: post #99
colanderman wrote: post #35

Earlier quoted context omitted.

You're right, but I don't retract my statement, because we know the dev knew how dangerous this line was thanks to his "Scary!" comment.

I don't whole heartedly disagree with you but I think its grayer than that. Maybe there were time constraints. Maybe the coder explained that this code was dangerous to his boss but was not grantee the time to fix it. I think we agree that said code should never have been written, but there are any number of circumstances that place the blame squarely on management. If he explained the dangers of doing it that way bu…

You are right. Consider my original assertion (which is past its edit window) amended to read "engineer (or manager who prevented an engineer from fixing)".

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#118

Post by vezzy-fnord »

Chris_Newton wrote: post #51

This seems like yet another good example of why robust application-level access control would be a helpful thing to build into modern operating systems, in addition to the typical user-based controls. This may have been both a rookie mistake and a regrettable failure of code review processes, but in any case it simply shouldn’t be possible for an application running on a modern system to wipe out all user data withou…

Role-based and other access control mechanisms unfortunately come off all too frequently as bolted on and arcane hacks.

The real issue lies in the fact that the file system resides in a global namespace, when it shouldn't. Much like each process has its own environment variables, so should it have its own namespace. Linux does support so-called "mount namespaces" now, but once again they're not inherent parts of the system, but have to be tacked on through explicit unshares, and thus lose the cohesiveness of platforms such as Plan 9. [1]

[1] http://doc.cat-v.org/plan_9/4th_edition/papers/names

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#119

Post by clebio »

endgame wrote: post #87
nodesocket wrote: post #2

What is this magic doing? $(cd "${0%/*}")

It's a bashism. Open up "man bash" and search for "Remove matching suffix pattern".

which, regrettably, is not something you can do with `man` if you find `${0%/*}` in a script you're reading that someone else wrote.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#120

Post by enneff »

Alupis wrote: post #113
enneff wrote: post #55

Earlier quoted context omitted.

But why would the script prompt for user input unless something was awry? Presumably they control the contents of $STEAMROOT, so I don't see why rm -r should prompt unless it's about to do the wrong thing.

most systems have "alias rm='rm -i'" by default, so it would prompt on every single file regardless of ownership, etc.

"most systems"? Not on Debian or Ubuntu, and that's most of them.
Post reply on HN