Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

github.com

Post reply on HN
Print view View original

81–90 of 280 posts

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#81

Post by falcolas »

colanderman wrote: post #32
userbinator wrote: post #20

Earlier quoted context omitted.

Would this have stopped things getting deleted? if [ -z "$STEAMROOT" ] # something isnt right...

Not if the previous line was: STEAMROOT=$SOME_OTHER_UNSET_VARIABLE/ "rm -r " is a code smell, as much as "cc -o myprog .c" is. You should always know what files make up your system, and track them in a MANIFEST file. There's rarely a good reason to use wildcards when a program is dealing with its own files. xargs rm -df -- fixes this.

   rm --preserve-root
isn't a bad thing to have either. That way, even if you do screw up, you won't be able to run rm against '/', even with '-f'.

It's one of the top aliases in my .bash_aliases file.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#82

Post by ploxiln »

ArchD wrote: post #43
fsaintjacques wrote: post #7

Note to all, prepend all your bash script with "set -o errexit -o nounset -o pipefail" It'll save you headaches.

I use the shebang "#!/bin/bash -e". To get the same effect as the "set -o errexit -o nounset", I think you can use "#!/bin/bash -e -u". (There seems to be no option for pipefail.)

The "shebang" treats everything after the binary as a single argument. It only does one argument from the shebang and the file itself as the final argument. So it would run that kinda like

    bash '-e -u' $file
But you can do

    #!/bin/bash -eu

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#83

Post by falcolas »

kazinator wrote: post #53

rm -rf "$STEAMROOT/"* This is why serious bash scripts use set -u # trap uses of unset variables Won't help with deliberately blank ones, of course. Scripting languages in which all variables are defined if you so much as breathe their names are such a scourge ... I did this once in a build script. It wiped out all of /usr/lib. Of course, it was running as root! That machine was saved by a sysadmin who had a similar…

    rm --preserve-root -rf "$STEAMROOT/"*
would have worked too.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#84

Post by barsonme »

mod wrote: post #24
fsaintjacques wrote: post #7

Note to all, prepend all your bash script with "set -o errexit -o nounset -o pipefail" It'll save you headaches.

Can you at least explain what this is doing, outside of saving me headaches?

set -o errexit (set -e): exit script when command fails

set -o nounset (set -u): exit script when it tries to use undeclared variables

set -o pipefail: returns error from pipe `|` if any of the commands in the pipe fail (normally just returns an error if the last fails)

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#85

Post by noarchy »

irishcoffee wrote: post #13
colanderman wrote: post #5

# Scary! rm -rf "$STEAMROOT/"* Anybody who writes a line like this deserves their software engineer license revoked. This isn't the first time I've seen shit like this (I've seen it in scripts expected to be run as root, no less); it makes my blood boil. Seriously. "xargs rm -df -- EDIT: I shouldn't be so harsh, if it weren't for the comment admitting knowing how poor an idea this line is.

The programmer committed a cardinal sin to be sure. But, so did everyone on the code review that let it slide.

Do we know if they do code review? Are pull requests blindly accepted?

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#86

Post by colanderman »

falcolas wrote: post #81
colanderman wrote: post #32

Earlier quoted context omitted.

Not if the previous line was: STEAMROOT=$SOME_OTHER_UNSET_VARIABLE/ "rm -r " is a code smell, as much as "cc -o myprog .c" is. You should always know what files make up your system, and track them in a MANIFEST file. There's rarely a good reason to use wildcards when a program is dealing with its own files. xargs rm -df -- fixes this.

rm --preserve-root isn't a bad thing to have either. That way, even if you do screw up, you won't be able to run rm against '/', even with '-f'. It's one of the top aliases in my .bash_aliases file.

Agreed. Thankfully this is the default on many systems (I'm guessing recent coreutils).

Unfortunately dumb lines like "rm -rf $HOME/$STEAMDIR" still get through unscathed.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#88

Post by FeeTinesAMady »

Xylemon wrote: post #19

Something like this with Steam happened to my friend not too long ago. It was very saddening because he literally lost years of files (including personal projects) and salvaged what he could. That was with the Steam Beta and I caught Steam doing this myself (after he told me what happened). I was lucky to stop the script and switched out of the beta. At the time he reported this to Valve themselves and said they were…

I think Valve should be sued over this, and lose. Sure, there will be clauses in their EULA stating that they aren't liable, but morally, those clauses should not be valid in any licensing agreement. Their commercial software caused damage to people, and they should pay through the nose for it.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#89

Post by gizmo686 »

andrewfong wrote: post #76
Chris_Newton wrote: post #51

This seems like yet another good example of why robust application-level access control would be a helpful thing to build into modern operating systems, in addition to the typical user-based controls. This may have been both a rookie mistake and a regrettable failure of code review processes, but in any case it simply shouldn’t be possible for an application running on a modern system to wipe out all user data withou…

Isn't this the basic idea behind the sandbox in OS X? I think OS X (and mobile app development in general) shows both that this is great in theory and a net improvement over not having it, but that there are some common pitfalls to address. First, there are a handful of apps where this model doesn't work so well -- e.g. text editors, FTP clients, etc. So you're inconveniencing quite a few legit apps which need broade…

It helps if you assume good faith of the application developer. Part of developing an application should be defining what permissions you need at install time. This won't help against legitimate malice, but it would defend against this type of mistake, and (if it is configured such that the app cannot change its own permissions) will also mitigate any exploit of the app.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#90

Post by preconsider »

To those name-calling the author of the script:

The product/update is hyped and the release date is set in stone. Tensions are high and your boss has already let you know that you're on thin ice and not delivering on the project goals.

A last-minute showstopper bug comes in, caused by file leaks. Everyone is scrambling, and the file belongs to you so its on you to fix it alone. There is no time for code review, and delaying isn't an option (so says management). "I'm afraid if we keep seeing these delays in your components, we might have to consider rehiring your position".

The rm rf works -- it's a little bit scary, but it works. You write a test case, and everything passes. Still, you add the "scary" line for good measure. You have two more bugs for fix today and you'll be lucky if you're home by midnight and see your wife or kids. You've been stuck in the office and haven't seen them in days.

Are you an "idiot", "talentless" engineer that "deserves to have his software engineering license permanently revoked"? How do you know this wasn't the genesis of this line of code?

Post reply on HN