4 ms·

But can't you see that's bad? 1. It doesn't work on all distros, and even on Debian you need to already know that "dpkg -L" gets a list of commands. I tried

by 13of40 11y ago

But can't you see that's bad? 1. It doesn't work on all distros, and even on Debian you need to already know that "dpkg -L" gets a list of commands. I tried googling "debian distro package tool" and it doesn't tell me about dpkg. Discoverability. 2. The reason you're praying that the package developer put everything in 'bin' is because there's no metadata to distinguish between commands and other files. 3. You're actually executing(!!) the commands to get the help, because, again, no metadata. Parsing the arguments is delegated to the command, so what if the command ignores the --help and reboots your server instead? (Note that if you run a PowerShell cmdlet with -?, it doesn't actually hand control over to the command.) 4. At the end of the day it's not going to work because all of the parameters are strings and all you can look for is the parameter name, which might be "password" or "pass" or "pwd" or anything else the author picked. (Another reason this matters is the PSCredential is stongly-typed and backed by a SecureString, so if the process crashes it won't get leaked into the heap dump. In your Linux command it's just a plain-text string on the heap.) Now, I'm not trying to say you should give up bash/Linux and become a Windows fan boy. I'm saying you need to take an honest look at bash and decide whether it makes sense to stick with that paradigm in the 21st century.

pritambaral 11y ago
1. Every distro has its own package tool, and a user (if they're going to be messing with packages) is expected to know them. If a dev/admin can't use `dpkg -L` on Arch Linux, it is their fault for not learning Arch Linux. I wouldn't expect you to know about dpkg from one Google search, like you wouldn't expect me to know about '?{$_.Parameters.Values.ParameterType' from one Google search, would you? 2. The location of the file IS the metadata! Placing a command outside a bin/ folder in a Debian package is the same as mistyping <whatever metadata lets Get-Command know something is a command>. 3.1. Yeah, sure, executing is bad. So use the manual pages. They are well structured (the structure is parsed every time they are displayed, for example). 3.2 Executing is not that bad, when you trust the source of the commands. It is anti-convention to use arbitrary, non-vetted repos. 4. Looking for a single value is always better than looking for three values, but is the latter really that much more bad? BTW, taking a password as a string argument is wrong in the Linux world too. C'mon, people aren't that stupid. As for where you store it: unless you're handing it over to hardware immediately, there's little protection to it. I did a little bit of searching on what SecureString is (admittedly, not much, maybe you can enlighten me), and is there any reason to believe the encryption key isn't in memory too? Bash alone isn't what's keeping me on Linux or away from Windows. When bash becomes bad/obsolete/uncool, another will take its place. Or if a new feature seems good/worthwhile/cool, it can get added to bash. The secret (heh) is: open source. Fish happened, zsh happened, and it was easier for them to happen because bash was open source. If they had to reimplement all of bash from scratch, it would have been a little bit discouraging, a little bit too hard, but thankfully it wasn't. I doubt I'll hardly ever become a fanboy of anything, even Linux, but I'm not going to look at Windows in the same light until the magic of open source has worked on it.

by 13of40 11y ago

pritambaral 11y ago

1. Every distro has its own package tool, and a user (if they're going to be messing with packages) is expected to know them. If a dev/admin can't use `dpkg -L` on Arch Linux, it is their fault for not learning Arch Linux. I wouldn't expect you to know about dpkg from one Google search, like you wouldn't expect me to know about '?{$_.Parameters.Values.ParameterType' from one Google search, would you? 2. The location of the file IS the metadata! Placing a command outside a bin/ folder in a Debian package is the same as mistyping <whatever metadata lets Get-Command know something is a command>. 3.1. Yeah, sure, executing is bad. So use the manual pages. They are well structured (the structure is parsed every time they are displayed, for example). 3.2 Executing is not that bad, when you trust the source of the commands. It is anti-convention to use arbitrary, non-vetted repos. 4. Looking for a single value is always better than looking for three values, but is the latter really that much more bad? BTW, taking a password as a string argument is wrong in the Linux world too. C'mon, people aren't that stupid. As for where you store it: unless you're handing it over to hardware immediately, there's little protection to it. I did a little bit of searching on what SecureString is (admittedly, not much, maybe you can enlighten me), and is there any reason to believe the encryption key isn't in memory too? Bash alone isn't what's keeping me on Linux or away from Windows. When bash becomes bad/obsolete/uncool, another will take its place. Or if a new feature seems good/worthwhile/cool, it can get added to bash. The secret (heh) is: open source. Fish happened, zsh happened, and it was easier for them to happen because bash was open source. If they had to reimplement all of bash from scratch, it would have been a little bit discouraging, a little bit too hard, but thankfully it wasn't. I doubt I'll hardly ever become a fanboy of anything, even Linux, but I'm not going to look at Windows in the same light until the magic of open source has worked on it.