7 ms·
> The last few versions of MacOS have introduced random fires which burn down your .bash_history, leaving this occasional sad, sad result: $ wc -l .bash_histor
by forgotpwtomain 10y ago
> The last few versions of MacOS have introduced random fires which burn down your .bash_history, leaving this occasional sad, sad result:
$ wc -l .bash_history
0
I think there is some context missing here... Why is your .bash_history getting cropped? Was there a change in some default configuration of your Terminal app on update perhaps?
On a side-note I really think fish-shell really got history-recall and completion right, which is really the one thing that keeps me using it even if I still script in bash.
- hartator 10y agoWhat do you think about zsh? I really like zsh history.
- jcsalterego 10y agozsh history, from what I've seen a long time ago, can include timestamps, which is why I added a timestamp field in the schema, though it's currently unpopulated: https://github.com/jcsalterego/historian/blob/3bf7158b163d3febca4399a90dd8eb10dcce6611/hist#L38 https://github.com/jcsalterego/historian/blob/3bf7158b163d3f... #soon
- ishigoemon 10y agoBash can as well, though I'm not certain if the OS X version is new enough. http://wiki.bash-hackers.org/syntax/shellvars#histtimeformat http://wiki.bash-hackers.org/syntax/shellvars#histtimeformat
- TheGRS 10y agoIf you're an oh-my-zsh user there is a handy part of the .zshrc config for enabling and customizing the timestamp format. Dead simple.
- sillysaurus3 10y agoI like your zsh history too. Will you post all of it here unedited? Also, on pentests the ~/.bash_history file is literally the first thing we look at. It's lovely: in an instant, you know exactly which files on the system are important, why they're being used, and what the high-priority targets might be for pivoting to a different box. In some cases it cuts hours off the job. So to keep hackers happy, please don't delete your bash history on production servers.
- viraptor 10y agoIt's just a delay. Are you really suggesting that making work harder on a daily basis is worth it to slow down by a few hours (not preventing!) lateral movement in an already exploited system? Because that's why users hate security restrictions.
- sillysaurus3 10y agoBy all means, steam ahead. It's certainly your right as a developer not to be slowed down by pesky restrictions. The easiest marks were always the companies that had a culture of hating security restrictions.
- arjie 10y agoWait a minute. If you've owned my user, what's to stop you from setting the histfile even if I turned it off? Not to speak of how you can just listen to my pty. I mean, it's really clever talking like a mafia enforcer making vague threats but everyone here is treating you respectfully and you're not responding in kind. It's not cool, man. If you don't feel like engaging, don't.
- brazzledazzle 10y agoI'm legitimately curious about their question so I'll phrase it differently: have you ever found something in the shell history that you wouldn't have discovered on your own? Is it more of a delay tactic or real deterrent?
- bitexploder 10y agoI have done my share of internals. Some of the time you find valuable clues in administrative audit logs and bash_history. Clues that mean you make a good and impactful finding within the timeframe of your timebox. Reality is an attacker with this level of access is going to have more time than I will, but it still means a measurable impact to security because it decreased the time it took to find something. So in that sense the OP is correct, it comes down to a risk reward trade off and is it worth clearing the history to potentially buy yourself more time in the event you are owned. It isn't as black and white as "well, the server is owned, of course you have my bash_history, that is the least of my worries now..." it is, but it could also be the one thing that gives you 3 extra hours to detect and shut down an attack.
- jcsalterego 10y agoI've lost the stackoverflow links since but it's something like http://apple.stackexchange.com/questions/218731/why-bash-history-on-my-mac-wont-save http://apple.stackexchange.com/questions/218731/why-bash-his...
- oxidized 10y agoThis is probably not related to the MacOS issues the author had, but I've actually had my .bash_history cleared out due to a known issue in bash: http://unix.stackexchange.com/a/88856 http://unix.stackexchange.com/a/88856 > When closing multiple bash instances at the same time, there is a known race condition that may cause the history to be cleared.
- jcsalterego 10y agoAh, interesting!
- matt_morgan 10y agoLooks like it's fixed (at least mostly) in bash 4.3?