8 ms·

One of the more fascinating aspects of human history is how much effort we're willing to devote to creating varied senses of safety, even if that safety is only

One of the more fascinating aspects of human history is how much effort we're willing to devote to creating varied senses of safety, even if that safety is only an illusion. Now, we can call this a failure of design, but really, people who rely on technology they don't understand can't be saved by good design. Sure, this particular case could be fixed by disallowing the recursive flag on the file system root, but safety is never going to be able to be the primary design concern of any technological system. Imagine if a sword were made safety as first-class concern. You can't design a sword that can be used safely by the untrained. No weapon can be, training with a weapon is a prerequisite for safely using it. Similarly, every technology has to be understood by those using it. If you don't you're just inviting trouble. For a business using technology, the needs are actually fairly straightforward. You need an understanding of what needs to be backed up, and a process for performing the backups. If you've picked the former right, (backing up human-readable information rather than data only readable by software programs that might go away in a crash) then risk is minimized.

nickpsecurity 11y ago
Interesting points. I think systems like Burroughs counter the concept in the a lot of safety can be baked into a system. Here's what they did in 1961: http://www.smecc.org/The%20Architecture%20%20of%20the%20Burroughs%20B-5000.htm http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr... Notice that's good UI design for the time, hardware elimination of worst problems, interface checks on functions, limits of what apps can do to system, and plenty recovery. Systems like NonStop, KeyKOS, OpenVMS, XTS-400, JX, and so on added to these ideas. You can certainly bake a strong foundation of safety into a system while allowing plenty flexibility. So, for example, critical files should be write-protected except for use by specific software involved in updates or administrative action. Many above systems did that. Then, one can use VMS-style, versioned filesystem that leaves originals in there in case a rollback is needed so long as there's free space for that. Such a system handling backups and restores with modern-sized HD's wouldn't have nuked everything. Might have even left everything if using lean setup but can't say for this specific case. "You can't design a sword that can be used safely by the untrained." A sword is designed to do damage. A better example would be a saw that's designed to be constructive but with risk of cutting your hand off. Even that can be designed to minimize risk to user. https://www.youtube.com/watch?v=esnQwVZOrUU https://www.youtube.com/watch?v=esnQwVZOrUU "If you've picked the former right, (backing up human-readable information rather than data only readable by software programs that might go away in a crash) then risk is minimized." That's orthogonal. A machine-readable format just needs a program to read it. The risk is whether the data is actually there in whole or part. This leads to mechanisms like append-only storage or periodic, read-only backups that ensure it's there. Or these clustered, replicated filesystems on machines with RAID arrays that lots of HPC or cloud applications use. Also, multiple, geographical locations for the data. People doing the above with proven protocols/tools rarely loose their data. Then there's this guy.
- rosser 11y ago
  Table saws should never be used on flesh. rm(1) should always be used on files. How in FSM's noodly universe is the command supposed to intuit which files it should safely delete versus those it shouldn't? > ...or administrative action. You mean like, "sudo rm -rf {$undefined_value}/{$other_undefined_value}"? D'oh!
  - yrro 11y ago
    Make `--one-file-system` the default!
  - rbanffy 11y ago
    He really should not have made the first element of the path variable. Doing an "rm -rf /folder/{$undefined_value}/{$other_undefined_value}" would have made his day much better. Also, never having all backup disk volumes mounted at the same time is good practice.
  - nickpsecurity 11y ago
    Two different people here have already figured out this wouldn't have happened in OpenVMS due to versioned filesystem w/ rollback. People also claim saner commands for this stuff but I can't recall if remove was smarter. Anyway, pertaining to RM, here you go: https://launchpad.net/safe-rm https://launchpad.net/safe-rm
deleted 11y ago
[deleted]
bryik 11y ago
In the UNIX Hater's Handbook, defenders of rm consider accidental deletion a "rite of passage" and remark that "any decent systems administrator should be doing regular backups" (see page 62). The author's response is funny: “A rite of passage”? In no other industry could a manufacturer take such a cavalier attitude toward a faulty product. “But your honor, the exploding gas tank was just a rite of passage.” “Ladies and gentlemen of the jury, we will prove that the damage caused by the failure of the safety catch on our chainsaw was just a rite of passage for its users.” “May it please the court, we will show that getting bilked of their life savings by Mr. Keating was just a rite of passage for those retirees.” Right. I'm surprised how relevant parts of this book are 22 years later. http://www.vbcf.ac.at/fileadmin/user_upload/BioComp/training/unix_haters_handbook.pdf http://www.vbcf.ac.at/fileadmin/user_upload/BioComp/training...
- 0xdeadbeefbabe 11y ago
  The author stretches his analogies substantially. It's nice to see this was happening 22 years ago just like it is nice to see UNIX from more than 22 years ago still being used today. Edit: i.e. it isn't so nice. Not much progress.
  - nickpsecurity 11y ago
    Yeah, I saw the same problem in the NSA backdoor debate where people liken it to brake failures and such. I pointed out repeatedly that computer breaches rarely maim or kill anyone. Usually don't even cost them their jobs or bankrupt their business. Such analogies are strawmen to try to boost their argument with an emotional response.
- erik14th 11y ago
  Is there an alternative to allow scripted destructive actions without the risk of deleting important stuff? Modern OS's will warn you if you try to delete stuff, but you can still ultimately do it anyway, I don't see it as something particular to UNIX. The only similar problem I had was on windows, 98 I guess, I deleted all my files that weren't readonly by fiddling with a .bat script.
deleted 11y ago
[deleted]
clock_tower 11y ago
Or you could use VMS.
- nickpsecurity 11y ago
  BOOM! That's two of us that noticed an OS with the right combo of features to avoid this kind of crap.
deleted 11y ago
[deleted]
mason240 11y ago
>You can't design a sword that can be used safely by the untrained. No weapon can be, training with a weapon is a prerequisite for safely using it. I was tank crewman in the US military, and there is a high chance of death of dismemberment from regular tank operation. Drivers have very limited visibility, tank turrets can pin people as they traverse, the breech of the main gun violently recoils into the crew compartment with limited guards, the rounds can be exploded by static electricity (or just plain lit on fire), I've saw one guy smash all teeth out when riding inside and the tank hit a hole, and so on. We had a saying: "tanks are designed to kill, they don't care who."
- Avshalom 11y ago
  I'm pretty sure my computer is not designed to destroy businesses though.
  - soneil 11y ago
    Your computer is designed to do exactly what it was told, at ludicrous speed. Much like the tank analogy, this is the very essence of the thing.
    - Avshalom 11y ago
      Then why does rm have the f flag in the first place? Clearly some one thought oh-hay-guys maybe a safeguard wouldn't be out of place. They just designed a really awful safety.
auntienomen 11y ago
For the last 1000 years, swords have typically been constructed with a guard. It's a simple and useful safety feature, and it almost never prevents an intended use. Same for disallowing '/' as the target of rm.
- danielweber 11y ago
  After every disaster, you can come up with a process that would have stopped that specific disaster. That doesn't mean it's a good idea to implement that process everywhere.
  - auntienomen 11y ago
    And yet swords have guards. If a disaster recurs repeatedly -- and if fixing it costs essentially nothing -- then it should be fixed.
  - bryanrasmussen 11y ago
    And after every disaster that occurs again and again you might increase your interest in averting the next disaster.
  - danso 11y ago
    It's too bad you're being downvoted. It was not too long ago that people blamed the Germanwings Flight 9525 crash on how the cockpit door was designed to protect against hijackers, post 9/11: http://www.nytimes.com/interactive/2015/03/26/world/europe/germanwings-cockpit-door-lock.html http://www.nytimes.com/interactive/2015/03/26/world/europe/g...
- Semyaz 11y ago
  It's worth noting that since 2006 the default behavior for "rm -rf /" is to exit immediately with warnings. http://superuser.com/questions/542978/is-it-possible-to-remove-the-root-directory http://superuser.com/questions/542978/is-it-possible-to-remo...
- Impl0x 11y ago
  I don't want to sound fussy, but sword guards aren't designed to protect the user from the sword, they're for protecting the user from other swords. That they make using a sword safer is a side-effect. I agree with the point you're making though.
ams6110 11y ago
There's also the phenomenon that people have an inherent tolerance of risk, so the "safer" you make something, the more reckless people tend to be. When traction control and antilock brakes became mainstream, one result was that some people started driving faster on snowy roads, up until their risk tolerance was the same as before. If you understand that a typo can destroy your business, you'll be careful to not log in as "root" on a routine basis and double check everything you do and keep good backups. On the other hand if you expect the system to prevent you from doing anything really damaging, you might be more careless about your approach.
- shadeless 11y ago
  That theory is called Risk Compensation: https://en.wikipedia.org/wiki/Risk_compensation https://en.wikipedia.org/wiki/Risk_compensation
- 794CD01 11y ago
  That's great. People got to their destinations faster with the same level of risk as before.
pyre 11y ago
What you're essentially saying is: > It's impossible to have 100% safety, so let's not bother placing any importance on safety.
xg15 11y ago
This is a strange post. You imply that, only because it's impossible to absolutely prevent all kinds of disasters, no efforts in safety should be taken at all. By the same logic, you could strip away all the airbags, seatbelts, comfy seats and assistance systems of modern cars: After all, accidents still happen and safety mechanisms might even lure drivers into more reckless behavior. (This is in fact happening with seatbelts) I think it's less useful to think about absolute safety than about which failures are likely to occur and how effective our measures against those specific failures are. The --force flag is obviously not an effective measure against root deletions, otherwise we wouldn't have so many stories about it. My theory is that there are three reasons for it: - As other people wrote, if you frequently batch-delete files, you get trained very quickly to always use -f as plain rm is very annoying to use for large sets of files. Unlike other flags, -f won't make you stop and think. This could be fixed by making rm-without-f actually useable - for example by only asking once and not for every file like, oh I don't know... Windows. - rm can interact with shell parsing in very intransparent and fatal ways. My guess is that most root deletions happen similar to this post: not a literal rm -rf / but some unfortunate variable interpolations where the author didn't realize that they can evaluate to "/". That's a very unobvious point of failure that takes a lot longer to learn than just using rm. Therefore rm should absolutely warn about it. - there is actually an expectation that rm could be safe as most deletes you do on a modern system are reversible - either because you have a " recycle bin" or a backup. So a warning would make sense to counter that expectation.
- vinceguidry 11y ago
  > You imply that, only because it's impossible to absolutely prevent all kinds of disasters, no efforts in safety should be taken at all. Not at all. We should absolutely work to make things safer. But we need to be realistic and temper our sense of idealism. Nothing was going to save this guy from disaster, if it wasn't 'rm' it just would have been something else. My point is that you can't expect safety features to obviate the need to know what you're doing.
  - jacobush 11y ago
    Sounds very fatalistic. All people killed in car accidents would also have died from something else?
vacri 11y ago
> You can't design a sword that can be used safely by the untrained. No weapon can be This is a really weird argument, since weapons are used in combat, which is not 'safe' by definition. But if you do want a weapon that the untrained can use without much chance of hurting themselves, look to a spear. It was the go-to weapon for untrained militias from the time history began up to gunpowder taking over - and even then, bayonets are stuck on rifles to turn them into spears.
- randyrand 11y ago
  Swords also don't run code. Just perhaps an importance difference.
  - nickpsecurity 11y ago
    A counter that applies to almost every comparison the opposition brings up. Further, swords don't have an easy solution to stop problems that fits in a comment or two in this same thread. ;)
  - Koshkin 11y ago
    Hmm... A self-wielding sword running Android sounds like a great idea.
ChrisArgyle 11y ago
path=$foo/$bar if [[ $path =~ [[:space:]]*/[[:space:]]* ]]; then echo NOPE else rm -rf $path fi
- deleted 11y ago
  [deleted]
BinaryIdiot 11y ago
> Imagine if a sword were made safety as first-class concern. This seems like a silly example. A weapon, meant to dismember and maim attackers of its owner, is one of those things that's impossible to completely make safe. Granted I could think of plenty of ideas that maybe would make it safer at first that wouldn't compromise its ability to be effective as a weapon but it's simply not an apt example to be used here. A computer is a general purpose device. It can be used to help image cancer, launch a nuclear weapon or play games. Considering that it's meant to be used by everyone, without discrimination, it seems to make sense that you need to do the best you can to protect the user from themselves. I worked in Apple Care support for about a year. The majority of your users are not going to know all of the consequences to their actions, even ones doing system administration (because let's face it almost every company in the world needs at least a little of that now and not all of them are going to hire someone who knows what they're ding). You can't protect a user from everything. But when you can protect a user from doing something that would have screwed up their whole system, lost a project, etc? That's helpful. Correcting input is what computers are essentially there for.

nickpsecurity 11y ago

Interesting points. I think systems like Burroughs counter the concept in the a lot of safety can be baked into a system. Here's what they did in 1961: http://www.smecc.org/The%20Architecture%20%20of%20the%20Burroughs%20B-5000.htm http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr... Notice that's good UI design for the time, hardware elimination of worst problems, interface checks on functions, limits of what apps can do to system, and plenty recovery. Systems like NonStop, KeyKOS, OpenVMS, XTS-400, JX, and so on added to these ideas. You can certainly bake a strong foundation of safety into a system while allowing plenty flexibility. So, for example, critical files should be write-protected except for use by specific software involved in updates or administrative action. Many above systems did that. Then, one can use VMS-style, versioned filesystem that leaves originals in there in case a rollback is needed so long as there's free space for that. Such a system handling backups and restores with modern-sized HD's wouldn't have nuked everything. Might have even left everything if using lean setup but can't say for this specific case. "You can't design a sword that can be used safely by the untrained." A sword is designed to do damage. A better example would be a saw that's designed to be constructive but with risk of cutting your hand off. Even that can be designed to minimize risk to user. https://www.youtube.com/watch?v=esnQwVZOrUU https://www.youtube.com/watch?v=esnQwVZOrUU "If you've picked the former right, (backing up human-readable information rather than data only readable by software programs that might go away in a crash) then risk is minimized." That's orthogonal. A machine-readable format just needs a program to read it. The risk is whether the data is actually there in whole or part. This leads to mechanisms like append-only storage or periodic, read-only backups that ensure it's there. Or these clustered, replicated filesystems on machines with RAID arrays that lots of HPC or cloud applications use. Also, multiple, geographical locations for the data. People doing the above with proven protocols/tools rarely loose their data. Then there's this guy.

rosser 11y ago
Table saws should never be used on flesh. rm(1) should always be used on files. How in FSM's noodly universe is the command supposed to intuit which files it should safely delete versus those it shouldn't? > ...or administrative action. You mean like, "sudo rm -rf {$undefined_value}/{$other_undefined_value}"? D'oh!
- yrro 11y ago
  Make `--one-file-system` the default!
- rbanffy 11y ago
  He really should not have made the first element of the path variable. Doing an "rm -rf /folder/{$undefined_value}/{$other_undefined_value}" would have made his day much better. Also, never having all backup disk volumes mounted at the same time is good practice.
- nickpsecurity 11y ago
  Two different people here have already figured out this wouldn't have happened in OpenVMS due to versioned filesystem w/ rollback. People also claim saner commands for this stuff but I can't recall if remove was smarter. Anyway, pertaining to RM, here you go: https://launchpad.net/safe-rm https://launchpad.net/safe-rm

deleted 11y ago

[deleted]

bryik 11y ago

In the UNIX Hater's Handbook, defenders of rm consider accidental deletion a "rite of passage" and remark that "any decent systems administrator should be doing regular backups" (see page 62). The author's response is funny: “A rite of passage”? In no other industry could a manufacturer take such a cavalier attitude toward a faulty product. “But your honor, the exploding gas tank was just a rite of passage.” “Ladies and gentlemen of the jury, we will prove that the damage caused by the failure of the safety catch on our chainsaw was just a rite of passage for its users.” “May it please the court, we will show that getting bilked of their life savings by Mr. Keating was just a rite of passage for those retirees.” Right. I'm surprised how relevant parts of this book are 22 years later. http://www.vbcf.ac.at/fileadmin/user_upload/BioComp/training/unix_haters_handbook.pdf http://www.vbcf.ac.at/fileadmin/user_upload/BioComp/training...

0xdeadbeefbabe 11y ago
The author stretches his analogies substantially. It's nice to see this was happening 22 years ago just like it is nice to see UNIX from more than 22 years ago still being used today. Edit: i.e. it isn't so nice. Not much progress.
- nickpsecurity 11y ago
  Yeah, I saw the same problem in the NSA backdoor debate where people liken it to brake failures and such. I pointed out repeatedly that computer breaches rarely maim or kill anyone. Usually don't even cost them their jobs or bankrupt their business. Such analogies are strawmen to try to boost their argument with an emotional response.
erik14th 11y ago
Is there an alternative to allow scripted destructive actions without the risk of deleting important stuff? Modern OS's will warn you if you try to delete stuff, but you can still ultimately do it anyway, I don't see it as something particular to UNIX. The only similar problem I had was on windows, 98 I guess, I deleted all my files that weren't readonly by fiddling with a .bat script.

deleted 11y ago

[deleted]

clock_tower 11y ago

Or you could use VMS.

nickpsecurity 11y ago
BOOM! That's two of us that noticed an OS with the right combo of features to avoid this kind of crap.

deleted 11y ago

[deleted]

mason240 11y ago

>You can't design a sword that can be used safely by the untrained. No weapon can be, training with a weapon is a prerequisite for safely using it. I was tank crewman in the US military, and there is a high chance of death of dismemberment from regular tank operation. Drivers have very limited visibility, tank turrets can pin people as they traverse, the breech of the main gun violently recoils into the crew compartment with limited guards, the rounds can be exploded by static electricity (or just plain lit on fire), I've saw one guy smash all teeth out when riding inside and the tank hit a hole, and so on. We had a saying: "tanks are designed to kill, they don't care who."

Avshalom 11y ago
I'm pretty sure my computer is not designed to destroy businesses though.
- soneil 11y ago
  Your computer is designed to do exactly what it was told, at ludicrous speed. Much like the tank analogy, this is the very essence of the thing.
  - Avshalom 11y ago
    Then why does rm have the f flag in the first place? Clearly some one thought oh-hay-guys maybe a safeguard wouldn't be out of place. They just designed a really awful safety.

auntienomen 11y ago

For the last 1000 years, swords have typically been constructed with a guard. It's a simple and useful safety feature, and it almost never prevents an intended use. Same for disallowing '/' as the target of rm.

danielweber 11y ago
After every disaster, you can come up with a process that would have stopped that specific disaster. That doesn't mean it's a good idea to implement that process everywhere.
- auntienomen 11y ago
  And yet swords have guards. If a disaster recurs repeatedly -- and if fixing it costs essentially nothing -- then it should be fixed.
- bryanrasmussen 11y ago
  And after every disaster that occurs again and again you might increase your interest in averting the next disaster.
- danso 11y ago
  It's too bad you're being downvoted. It was not too long ago that people blamed the Germanwings Flight 9525 crash on how the cockpit door was designed to protect against hijackers, post 9/11: http://www.nytimes.com/interactive/2015/03/26/world/europe/germanwings-cockpit-door-lock.html http://www.nytimes.com/interactive/2015/03/26/world/europe/g...
Semyaz 11y ago
It's worth noting that since 2006 the default behavior for "rm -rf /" is to exit immediately with warnings. http://superuser.com/questions/542978/is-it-possible-to-remove-the-root-directory http://superuser.com/questions/542978/is-it-possible-to-remo...
Impl0x 11y ago
I don't want to sound fussy, but sword guards aren't designed to protect the user from the sword, they're for protecting the user from other swords. That they make using a sword safer is a side-effect. I agree with the point you're making though.

ams6110 11y ago

There's also the phenomenon that people have an inherent tolerance of risk, so the "safer" you make something, the more reckless people tend to be. When traction control and antilock brakes became mainstream, one result was that some people started driving faster on snowy roads, up until their risk tolerance was the same as before. If you understand that a typo can destroy your business, you'll be careful to not log in as "root" on a routine basis and double check everything you do and keep good backups. On the other hand if you expect the system to prevent you from doing anything really damaging, you might be more careless about your approach.

shadeless 11y ago
That theory is called Risk Compensation: https://en.wikipedia.org/wiki/Risk_compensation https://en.wikipedia.org/wiki/Risk_compensation
794CD01 11y ago
That's great. People got to their destinations faster with the same level of risk as before.

pyre 11y ago

What you're essentially saying is: > It's impossible to have 100% safety, so let's not bother placing any importance on safety.

xg15 11y ago

This is a strange post. You imply that, only because it's impossible to absolutely prevent all kinds of disasters, no efforts in safety should be taken at all. By the same logic, you could strip away all the airbags, seatbelts, comfy seats and assistance systems of modern cars: After all, accidents still happen and safety mechanisms might even lure drivers into more reckless behavior. (This is in fact happening with seatbelts) I think it's less useful to think about absolute safety than about which failures are likely to occur and how effective our measures against those specific failures are. The --force flag is obviously not an effective measure against root deletions, otherwise we wouldn't have so many stories about it. My theory is that there are three reasons for it: - As other people wrote, if you frequently batch-delete files, you get trained very quickly to always use -f as plain rm is very annoying to use for large sets of files. Unlike other flags, -f won't make you stop and think. This could be fixed by making rm-without-f actually useable - for example by only asking once and not for every file like, oh I don't know... Windows. - rm can interact with shell parsing in very intransparent and fatal ways. My guess is that most root deletions happen similar to this post: not a literal rm -rf / but some unfortunate variable interpolations where the author didn't realize that they can evaluate to "/". That's a very unobvious point of failure that takes a lot longer to learn than just using rm. Therefore rm should absolutely warn about it. - there is actually an expectation that rm could be safe as most deletes you do on a modern system are reversible - either because you have a " recycle bin" or a backup. So a warning would make sense to counter that expectation.

vinceguidry 11y ago
> You imply that, only because it's impossible to absolutely prevent all kinds of disasters, no efforts in safety should be taken at all. Not at all. We should absolutely work to make things safer. But we need to be realistic and temper our sense of idealism. Nothing was going to save this guy from disaster, if it wasn't 'rm' it just would have been something else. My point is that you can't expect safety features to obviate the need to know what you're doing.
- jacobush 11y ago
  Sounds very fatalistic. All people killed in car accidents would also have died from something else?

vacri 11y ago

> You can't design a sword that can be used safely by the untrained. No weapon can be This is a really weird argument, since weapons are used in combat, which is not 'safe' by definition. But if you do want a weapon that the untrained can use without much chance of hurting themselves, look to a spear. It was the go-to weapon for untrained militias from the time history began up to gunpowder taking over - and even then, bayonets are stuck on rifles to turn them into spears.

randyrand 11y ago
Swords also don't run code. Just perhaps an importance difference.
- nickpsecurity 11y ago
  A counter that applies to almost every comparison the opposition brings up. Further, swords don't have an easy solution to stop problems that fits in a comment or two in this same thread. ;)
- Koshkin 11y ago
  Hmm... A self-wielding sword running Android sounds like a great idea.

ChrisArgyle 11y ago

path=$foo/$bar if [[ $path =~ [[:space:]]*/[[:space:]]* ]]; then echo NOPE else rm -rf $path fi

deleted 11y ago
[deleted]

BinaryIdiot 11y ago

> Imagine if a sword were made safety as first-class concern. This seems like a silly example. A weapon, meant to dismember and maim attackers of its owner, is one of those things that's impossible to completely make safe. Granted I could think of plenty of ideas that maybe would make it safer at first that wouldn't compromise its ability to be effective as a weapon but it's simply not an apt example to be used here. A computer is a general purpose device. It can be used to help image cancer, launch a nuclear weapon or play games. Considering that it's meant to be used by everyone, without discrimination, it seems to make sense that you need to do the best you can to protect the user from themselves. I worked in Apple Care support for about a year. The majority of your users are not going to know all of the consequences to their actions, even ones doing system administration (because let's face it almost every company in the world needs at least a little of that now and not all of them are going to hire someone who knows what they're ding). You can't protect a user from everything. But when you can protect a user from doing something that would have screwed up their whole system, lost a project, etc? That's helpful. Correcting input is what computers are essentially there for.