Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start all of your commands with a comma (2009)

rhodesmill.org

Post reply on HN
Print view View original

231–240 of 252 posts

Re: Start all of your commands with a comma (2009)

#231

Post by lexicality »

alsetmusic wrote: post #142
mid-kid wrote: post #37

Earlier quoted context omitted.

Either adding your script directory in front of the PATH, or creating `alias` that provide a full path to your script where a conflict exists, makes a whole lot more sense to me. I've never had this collision problem yet, despite appending my script directory to the end, but I'll use either of the above solutions if that ever becomes a problem.

From my own aliases: alias curl='/opt/homebrew/opt/curl/bin/curl ' alias rsync-copy='/opt/homebrew/bin/rsync -avz --progress -h ' alias rsync-move='/opt/homebrew/bin/rsync -avz --progress -h --remove-source-files ' alias rsync-synchronize='/opt/homebrew/bin/rsync -avzu --delete --progress -h ' alias rsync-update='/opt/homebrew/bin/rsync -avzu --progress -h ' alias vi='/opt/homebrew/bin/vim -S ~/.vimrc' alias vim='/op…

Slightly confused as to why - surely homebrew adds itself to the PATH ahead of the system utilities?

Also - surely vim auto-reads your vimrc?

Re: Start all of your commands with a comma (2009)

#232

Post by oneeyedpigeon »

lanyard-textile wrote: post #211
ahepp wrote: post #158

Earlier quoted context omitted.

Just to save the trouble of writing './'?

Yes??? :) I'm not the crazy one here! That's a whole two characters on the same side of the keyboard...

How often do you find yourself running executables from the current directory? Is this a daily thing?

Re: Start all of your commands with a comma (2009)

#233

Post by FergusArgyll »

macintux wrote: post #108

This has been a popular topic nearly every time the post makes the HN front page. * https://news.ycombinator.com/item?id=40769362 (2024, 169 comments) * https://news.ycombinator.com/item?id=31846902 (2022, 123 comments) * https://news.ycombinator.com/item?id=22778988 (2020, 90 comments)

hn is at it's best when discussing bash shenanigans

Re: Start all of your commands with a comma (2009)

#234

Post by piekvorst »

oneeyedpigeon wrote: post #232
lanyard-textile wrote: post #211

Earlier quoted context omitted.

Yes??? :) I'm not the crazy one here! That's a whole two characters on the same side of the keyboard...

How often do you find yourself running executables from the current directory? Is this a daily thing?

For my workflow, yes

I don’t think it’s a severe security vulnerability. The same thing can happen with $home/bin.

Re: Start all of your commands with a comma (2009)

#235

Post by mdnahas »

jkercher wrote: post #78

Tangentially related. Don't ever put "." in your PATH. I used to do this to avoid typing the "./" to execute something in my current directory. BAD IDEA. It can turn a typo into a fork bomb. I took down a production server trying to save typing two characters.

Related: My grad school had a shared bin/ directory with common local tools. Of course, that directory was after /bin and /usr/bin in the PATH so that no one could override “ls” or “more”. So… one grad student added scripts with names that matched common typos: “sl” and “mroe”!

Sure enough, they got run. The scripts didn’t take over your account. They ran “ls” and “more”. They may have also logged your username in a file so he could lord it over you.

Re: Start all of your commands with a comma (2009)

#236

Post by necovek »

ndsipa_pomu wrote: post #228
necovek wrote: post #197

Earlier quoted context omitted.

Which was the point here, wasn't it? Script files that you will be commonly running and only editing rarely, I'd optimize for how easy they are to run, not operate other commands on them from within a shell.

Naming a file with a "-" as the first character means you have to be careful to use "--" with commands to signify the end of options as otherwise the filename will be interpreted as being additional options with unexpected results. e.g. ls -l -- * Even when you're not deliberately operating on the commands, it's too easy to get caught out by it with wildcards etc.

Sure, but this would be contained to when your CWD is ~/bin or ~/.local/bin (or wherever you put your "-" scripts in).

Re: Start all of your commands with a comma (2009)

#237

Post by necovek »

mathfailure wrote: post #192
necovek wrote: post #172

Earlier quoted context omitted.

Somebody mentioned it elsewhere, but it is a security risk: if you end up in a directory that's not under your control, and you do a "ls", it might execute "./ls" instead of /usr/bin/ls, and that can be doing anything, including piping your ~/.ssh/id_* to a remote server. This can also happen by downloading something off the internet (git clone, or tar xz foo.tar.gz), or on a multi-user system (eg. someone can put an…

> if you end up in a directory that's not under your control, and you do a "ls", it might execute "./ls" instead of /usr/bin/ls, Not if if you APPEND the dot path to the PATH env: the system traverses the dirs specified in the PATH env from left to right and stops at first match. Your system's ls binary is in the dir that's to the left of your '.' dir.

Yeah, there are ways to reduce the impact (as a sibling comment mentioned, typos or commands missing on a system could still be used to trick the operator), but I was mostly explaining the attack vector in case it is present in the PATH.

Re: Start all of your commands with a comma (2009)

#238

Post by AceyMan »

The comma has an unusual but super handy usage in PowerShell. When it precedes a variable of any array (list) type, the code it's the input to handles it as an array object, defending against the usual tendency to "unpack" the array and read in the elements that compose it.

Re: Start all of your commands with a comma (2009)

#239

Post by alsetmusic »

lexicality wrote: post #231
alsetmusic wrote: post #142

Earlier quoted context omitted.

From my own aliases: alias curl='/opt/homebrew/opt/curl/bin/curl ' alias rsync-copy='/opt/homebrew/bin/rsync -avz --progress -h ' alias rsync-move='/opt/homebrew/bin/rsync -avz --progress -h --remove-source-files ' alias rsync-synchronize='/opt/homebrew/bin/rsync -avzu --delete --progress -h ' alias rsync-update='/opt/homebrew/bin/rsync -avzu --progress -h ' alias vi='/opt/homebrew/bin/vim -S ~/.vimrc' alias vim='/op…

Slightly confused as to why - surely homebrew adds itself to the PATH ahead of the system utilities? Also - surely vim auto-reads your vimrc?

I learned to deliberately declare paths pretty early on in my adventures at the CLI. I don't leave room for accidental alternative execution. It might be overkill, but it gives me a sense of security and that's why it's there. Don't worry, I probably made a terrible mistake somewhere else that completely negates my attempts at a correct shell environment.

Re: Start all of your commands with a comma (2009)

#240

Post by ahepp »

piekvorst wrote: post #234
oneeyedpigeon wrote: post #232

Earlier quoted context omitted.

How often do you find yourself running executables from the current directory? Is this a daily thing?

For my workflow, yes I don’t think it’s a severe security vulnerability. The same thing can happen with $home/bin.

I think it's substantially riskier. At the very least, it means you are trusting any directory you cd into, rather than just trusting your $home/bin.

Stuff that would not typically raise eyebrows has been made risky. You might cd into less privileged user's $home, or some web service's data directory, and suddenly you've given whoever had access to those users, access to your user.

Maybe you could argue "well, I just won't cd outside of my $home", but the sheer unexpectedness of the behavior seems deeply undesirable to me.

Post reply on HN