Live data from Hacker News

Dotfiles feel too personal to share

hamatti.org

61–70 of 153 posts

Re: Dotfiles feel too personal to share

#61
post #59

Installing a (read: many) custom vim plugins and color scheme and screen version and etc… stops being fun about the third time you have to log into a nameless server. That being said, there are some settings that I absolutely cannot live without; `j=gj` being a good example in vim. IMO your dot files are only useful to share if they are usable with the default software of the place you’ve shared them to. Otherwise th…

I honestly just can't vibe with the "don't customize because you'll log into other servers" thing. To me it feels like getting told to not put nice shelves in my home because other buildings don't have them.

It completely depends on your work environment. My experience has been doing a lot of admin work and working with distributed databases. I probably spend a third of my day in servers that are not mine. So for me it just doesn’t make sense to make a lot of configuration changes, especially changes that will end up in my muscle memory.

Now my personal computer does have much nicer color schemes and a few plugins for code dev that I don’t carry around. But even then I try to use the defaults in my IDEs and browsers, because at this point I’m on work computer number.. 11? Configuring it is starting to get old

Re: Dotfiles feel too personal to share

#62
post #59

Installing a (read: many) custom vim plugins and color scheme and screen version and etc… stops being fun about the third time you have to log into a nameless server. That being said, there are some settings that I absolutely cannot live without; `j=gj` being a good example in vim. IMO your dot files are only useful to share if they are usable with the default software of the place you’ve shared them to. Otherwise th…

I honestly just can't vibe with the "don't customize because you'll log into other servers" thing. To me it feels like getting told to not put nice shelves in my home because other buildings don't have them.

It's bananas!

If the claim these folks make is "time spent struggling through a default config on an unfamiliar machine" > "time saved by crafting an workshop to fit your mind", then we are not the same.

(Probably, the dividing line here is time spent coding vs time spent managing infra.)

Re: Dotfiles feel too personal to share

#63
post #59

Installing a (read: many) custom vim plugins and color scheme and screen version and etc… stops being fun about the third time you have to log into a nameless server. That being said, there are some settings that I absolutely cannot live without; `j=gj` being a good example in vim. IMO your dot files are only useful to share if they are usable with the default software of the place you’ve shared them to. Otherwise th…

I honestly just can't vibe with the "don't customize because you'll log into other servers" thing. To me it feels like getting told to not put nice shelves in my home because other buildings don't have them.

"Free and easy

That's my style

Howdy-do me?

Watch me smile

But fare-the-well me

After a while

'Cause I gotta roam

And any place I hang my hat is home"

Re: Dotfiles feel too personal to share

#64

I think it's even realistic to say that dotfiles are vulnerable to being used as a fingerprint mechanism by nefarious packages. One could easily create an inventory of github profiles dotfiles; then read local dotfiles when their package gets installed on a developer laptop.

Such a nefarious package could also read browser cookies, SSH keys, emails, photos, and a million of other things.

Re: Dotfiles feel too personal to share

#66
Professional security researcher here.

I would strongly discourage threat modeling with vibes.

Your post already reveals potentially the scariest things someone might learn if you published your dotfiles: that you use Homebrew, pip, etc as part of them. In doing so you are telling everyone you allow any internet rando to have remote code execution rights on your computer. To me that is like boldly saying you like privacy in the same breath as saying you never lock your front door or close your drapes.

Those package managers operate like Wikipedia where anyone can push whatever they want without signatures or vetting from poorly secured accounts without phishing-resistant 2FA etc.

At that point you already allow anyone capable of creating a few useful PRs to Homebrew, basic phishing, or sim swapping the ability to see and publish anything on your computer, so your dotfiles being public should be the least of your concerns.

Now you are probably thinking "There is no way tools that every smart person I know uses could be that wildly insecure"

Ask yourself if those same people have experience exposing and exploiting supply chain attacks. We all have blind spots, and almost everyone has a massive blind spot here and my team and I have exploited it many times in audits.

All said though, I personally publish my dotfiles because I am confident they are of more use to me and others public, and do not reveal anything useful to someone targeting me other than that I use some kind of Linux distro and neovim.

Any sensitive work I do is in offline stateless virtual machines deterministically built from a supply chain with high accountability and I do not use any dotfiles in those environments.

With good separation of concerns between yolo systems and hardened trusted systems, publishing information about either is perfectly fine. Almost no one has that kind of workflow separation though, usually accessing prod from their compromised dev macbooks.

Re: Dotfiles feel too personal to share

#67
I'll never understand people not wanting to share their dots. Obviously you have to have a way to not share the private stuff of which there are many simple solutions, but I've learned so much from reading other peoples. To each their own, of course.

Re: Dotfiles feel too personal to share

#68

My dots are open to anyone who cares to view my GitHub. I do tend to keep employer specific aliases/stuff in an `.employer.zsh` file that is sourced by my main `.zshrc`. But my NeoVim config is completely open for inspection. I'm not doing anything all that extraordinary though. I don't share my dots on Reddit simply because I don't feel like using my real identity on that platform. When it comes to consuming the dot…

Similarly, I have two sets of dotfiles, a public one and a private one (hosted on my own server).

Somehow, 11 people have starred my public ones on GitHub.

Re: Dotfiles feel too personal to share

#69
post #59

Installing a (read: many) custom vim plugins and color scheme and screen version and etc… stops being fun about the third time you have to log into a nameless server. That being said, there are some settings that I absolutely cannot live without; `j=gj` being a good example in vim. IMO your dot files are only useful to share if they are usable with the default software of the place you’ve shared them to. Otherwise th…

I honestly just can't vibe with the "don't customize because you'll log into other servers" thing. To me it feels like getting told to not put nice shelves in my home because other buildings don't have them.

Here you go

  # Roaming bashrc profile
  function sshrc() {
      BASHRC=$(cat ${HOME}/.bashrc_roaming | base64 -w 0)
      ssh -t $@ "echo \"${BASHRC}\" | base64 --decode >   ~/.bashrc_roaming; \
      bash --rcfile ~/.bashrc_roaming; \
      rm ~/.bashrc_roaming";
  }

Re: Dotfiles feel too personal to share

#70
post #59

Earlier quoted context omitted.

I honestly just can't vibe with the "don't customize because you'll log into other servers" thing. To me it feels like getting told to not put nice shelves in my home because other buildings don't have them.

It completely depends on your work environment. My experience has been doing a lot of admin work and working with distributed databases. I probably spend a third of my day in servers that are not mine. So for me it just doesn’t make sense to make a lot of configuration changes, especially changes that will end up in my muscle memory. Now my personal computer does have much nicer color schemes and a few plugins for co…

Seems like a great opportunity to learn a bit about automating this set up. Really not hard to upload a .vim directory on a remote server for example.
Post reply on HN