11 ms·
Kali Linux 2020.3
- bartvk 6y agoThat's a funky prompt they're showing there. Since it came by default on macOS, I'm using zsh. But to be honest, my Linux box still remains on bash. The differences, to my usage, are minimal.
- kristopolous 6y agoFun fact: That's a legacy openstep thing. I was using an x86 version of openstep in a VM just for fun a few months back and it had a 1994 copy of zsh on it. I also remember using it on OS X server 1.0 in around 1999. I have an actual nextstation in my parents garage. I wonder if it's on that...
- ibotty 6y agoI am pretty sure the default shell was csh on OpenStep and thus most likely on NeXTSTEP as well.
- richrichardsson 6y agoHaving watched a bunch of videos of people who bought NeXT computers recently, I can confirm that the shell they saw when running Terminal.app was csh. It would be a hell of a coincindence if all of them had happened to change from the default to csh.
- Twisell 6y agoAlso MacOS switch to zsh was pretty recent (used to be bash). https://support.apple.com/en-us/HT208050 https://support.apple.com/en-us/HT208050 Must have been some confusion here.
- petre 6y agoIt was an old bash 2.x which was still GPLv2. Zsh being MIT licensed posed no licensing issues for inclusion into MacOS. I switched to zsh on Snow Leopard and above and never looked back. Didn't use the fancy stuff much and still use bash on Linux.
- lozf 6y agoISTR OSX defaulted to tcsh way back before the move to bash.
- kristopolous 6y agoNo there's no confusion. Maybe you thought I meant it was the default shell, I didn't. It's simply installed with everything else. The list is sh, csh, and zsh. The executable is on the machine. An operating system can have more than a single shell executable. Do you want me to post the binary? Screen shots? Maybe turn on an ssh hole? Perhaps send the man page? I can do all of this. You can log in remotely and run it if you so desire. I might be able to coerce VNC even although I'd probably need up port it to openstep (I've ported vnc before). Maybe there's a virtual box way of doing it as well
- ibotty 6y agoNobody is accusing you of anything. I understood that the phrase "Fun fact: That's a legacy openstep thing" referred to the previous comment indicating that (at some point in time) MacOS defaulted to zsh. It was just a misunderstanding.
- kristopolous 6y agoThat's not what I meant. I meant it shipped with zsh, which was really unusual. Here's a screenshot I just took (http://9ol.es/ostep.png http://9ol.es/ostep.png) ... I've installed bash on there. It didn't ship with bash.
- xenadu02 6y agoOS X used tcsh as the default shell way back. Later it used bash 3.x as the default up until Catalina. As of Catalina zsh is the default for new users (and the version of zsh that ships with macOS is relatively up to date).
- kristopolous 6y agoAlright. I never claimed it was the default shell... That was obviously csh, everyone knows that. It's a bsdism. FreeBSD's default was tcsh essentially until I stopped using it maybe 15 years ago. Zsh was placed onto the hard drive of the computer by the operating system installation cd and was an available executable program that could be invoked from the terminal. There, is that better?
- fomine3 6y agoI'm totally fine with bash if it could share history between processes by default. That's pain when I operate in someone's server.
- em500 6y ago> Q.) Why did you make the switch? What’s wrong with bash? A.) You can do a lot of advanced things with bash, and customize it to do even more, but ZSH allows you to do even more. This was one really large selling point. AFAICT this is the entire motivation provided. Since they start with stating that it's a very large change, It would be useful to flesh out the motivation a bit. For instance, some concrete examples of those "even more" things that you can do with zsh but not with bash would go a long way.
- refresher 6y agoTheir image says 'zsh auto-suggestions rocks!' but I had to add quite a bit to my .zshrc (in macOS at least) to get them to be good.
- ggm 6y agoFascinating that the conversation goes to zsh over bash. You'd think a decent Bluetooth risk tool was more relevant given the covid19 dependency on more bt always on and so more bt drive-by
- sgillen 6y agoI mean, anyone who cared was not waiting on the tool being shipped with kali linux to start using it. So including it is mostly a convenience thing .
- DominikD 6y agoPeople who don't use Kali comment on whether move from one shell to another was right for the Kali users. This drive by commenting is sadly omnipresent in the open source world. OpenBSD uses CVS? They should use git. XServer? Why not Wayland? Oh, libsdl is using Mercurial, but they should totally use git. And on, and on.
- 50ckpuppet 6y agoDrive by comments are typically from people who want to sound like an expert.
- exikyut 6y agoI find it extremely amusing that your comment has been sufficiently downvoted that it's grey...
- viro 6y agoumm as a pen tester the move from bash to zsh was the most exciting thing about this update. w ^ to find the wfuzz command I did 2 days ago and didn't take notes on the output is useful as hell.
- Taek 6y agoI have to say this is the most disappointed I've been with a comment section in a while. Not that the comments are awful or in bad faith, it's just not got any of the topics I was hoping to read about.
- daffy 6y agoOne nice thing in zsh is that you can type `/u/lo/b<tab><return>` and be in `/usr/local/bin`.
- enriquto 6y agoBash does the same thing here, typing tabs instead of slashes. /u<TAB>lo<TAB>b same number of keystrokes actually
- Nullabillity 6y agoNot quite. Zsh can use the subfolders to disambiguate which parent you meant, bash can't.
- enriquto 6y agoWow. While this is quite slick (and must have been funny to implement), I actually hate this kind of "magic" behavior.
- pletnes 6y agoHow is it more or less magic than bash’s? It takes more context into account, sure, but it’s easy to understand and reason about.
- polack 6y agoI usually hate magic too, but I have to say this is one of the cases where I like it. It's convenient without any danger attached to it since you're just switching directory and not actually executing something against this "unknown" path.
- Jach 6y agoFor about a decade I've had in my bashrc C() { cd `$HOME/path-selector.sh "$@"`; } where path-selector is from https://github.com/MarcWeber/path-selector https://github.com/MarcWeber/path-selector Opt-in bash extensions can do basically whatever people complain bash can't do. Though to be honest I don't use it that much over the last, say, 5 years. If I know a deep directory tree that well, I can just type it explicitly and/or tab complete it without losing much time. If I don't know it that well, FZF is quite nice.
- idoubtit 6y agoI think the move of Kali Linux from bash to zsh is sane. I sometimes have to use the default shell of Linux distribution, especially on servers, and my main pain points with bash are: - The history is editable by default. If I move to a previous history line and change it, the old line disappears. Hitting Ctrl-c will remove it from the history. - If I use simultaneous shells (screen, tmux, or several ssh connections), the history saved will be the one of the last shell to quit. The bash config `histappend` should be the default, IMO. - Most of the time, I search the history by the beginning of the command I just typed, which zsh maps to alt-p and which bash does not map by default. I rarely use the ctrl-r search. - No way to pause a command and view the man. With zsh, `git clone<alt-h>` will display `man git-clone`, then return to the incomplete command line. - No way to set a command aside. E.g. if I realise while typing that I'm not in the right directory, `git clone<alt-q>cd src<return>`.
- Neil44 6y agoPause command - I usually hit home, insert a # then enter then man then get the command back and continue. Or tmux it. Didn't realise zsh had that shortcut.
- saagarjha 6y ago> No way to pause a command and view the man. ^A, ^K, m, a, n, space, ^Y, enter. Upon exit, ^Y. > No way to set a command aside. ^A, ^K. Grab it again with ^Y. (Yes, these are all readline shortcuts. If you think they’re a bit long, bind them to something shorter in your inputrc.)
- saagarjha 6y agoWith a heavy heart I join the rest of the zsh discussion because these aren’t even factual: > You can do a lot of advanced things with bash, and customize it to do even more, but ZSH allows you to do even more. Bash can do a lot of things zsh can’t, and vice versa. > Fish is a nice shell (probably nicer than ZSH), but realistically it was not a real consideration due to the fact that it is not POSIX compatible. Neither is zsh, really. There’s emulation modes but I never got the impression that fidelity was a goal there.
- pletnes 6y agoZsh isn’t posix compatible? Citation needed? Also what can bash do that zsh can’t? Genuinely curious, after using both for years.
- ti_ranger 6y ago> Also what can bash do that zsh can’t? I have noticed that a lot of the features listed in https://www.gnu.org/software/bash/manual/bash.html#Major-Differences-From-The-Bourne-Shell https://www.gnu.org/software/bash/manual/bash.html#Major-Dif... aren't present in zsh, but I am not sure of all the ones that aren't in zsh. Ones that I have used in bash that aren't in zsh (there may be many more, I stopped using zsh in many scenarios because of some of these): * Some of https://www.gnu.org/software/bash/manual/bash.html#Shell-Parameter-Expansion https://www.gnu.org/software/bash/manual/bash.html#Shell-Par... (e.g at least ${LOGNAME^^}, `(FOO=BAR;echo ${FOO,,})`) * -p option to read for the prompt, e.g. `read -s -p "Enter the DB password: " PW`
- dous 6y agoMaybe they mean this "Zsh is able to emulate POSIX shells, but its default mode is not POSIX compatible, either." from http://zsh.sourceforge.net/Doc/Release/index.html http://zsh.sourceforge.net/Doc/Release/index.html
- Spooky23 6y agoWhat we really need here is for someone to explain why all of these issues are moot because Emacs the best, most ethical solution.
- dephraiim 6y agozsh now, What was wrong with bash?
- aww_dang 6y agoAren't the people who know and understand the tools they use, the same people who can install security utilities on any distro? What is the purpose of this distro in regards to that?
- saagarjha 6y agoIt’s all of them in one place.
- Taek 6y agoLess hassle. Plus if you are part of the community you get a better view on what tools are getting more prominent and what fixes or updates are being released. I'm sure nobody who uses Kali needs it to exist, but that doesn't mean it doesn't add value.
- bashwizard 6y agoConvenience.
- _kbh_ 6y agoInstalling some of these tools is annoying, let alone all of them. Having them in a easy to run image / VM makes life really easy.
- viro 6y agolaziness. well thats at least why I use it.
- crims0n 6y agoIt is meant to be run in a VM. Spin it up, log in as root, and go to work. It keeps your pentest machine separate from your daily driver - which you want to do for a myriad of reasons, not least of which is keeping your personal computer off a network that is actively being attacked.
- itomato 6y agoIt's just another type of test harness. It's Debian Live, so you can extend or customize it to suit a particular need. That it is ready to run and leaves no trace adds a lot of value. You may not win a bounty from a vendor, but it's pretty trivial to take their app, add it to an image and expose potential vectors. Your own PIR may benefit from the forensics tools (without the lead time of getting them working). It doesn't deliver any 'security' on its own.
- Timpy 6y agoI always thought Kali wasn't really for daily use. Not a vehicle for every day driving around town, more like a secondary vehicle you only use for work. HiDPI, tool icons, and gnome themes make it seem otherwise. Sure, these things are nice whether you're using it for work or play, but I wonder. Is anybody running kali as their daily driver?
- elagost 6y agoThis is not recommended. It's a specific tool for a specific purpose. I seem to recall a while back that it even had some default security options disabled on the system to allow for all the crazy stuff it does. It's not meant to be a replacement for a Linux Mint or Ubuntu desktop system. Run it on a second laptop, on a USB stick, or in a virtual machine (that you cede access to the networking hardware).
- blaser-waffle 6y agoUpdate for being one of the few non-zsh questions. IMO there are the young script kiddie types that have it on their main laptop to be cool, but yeah I don't see people using it except for work purposes.
- lucideer 6y agoI'd consider these accessibility features and as such I'd say they're important for any GUI work tool, even if it's not your daily driver.
- julianh95 6y agoYou definitely shouldn't use it as a daily. However, Offensive Security is trying to make it a smooth experience given that quite a bit of time is spent using it for penetration tests, CTFs, etc in addition to "competition" from ParrotOS. Most folks that I know would switch to it anyway so having it be the default makes it easier.
- Teever 6y agoCan you elaborate why someone shouldn't use it as a daily driver? I have used Linux for a decade now and I just got a friend interested in it and his pick was Kali because he was interested in learning about security stuff. I took a quick look at it and saw that it was debian based and XFCE is my favourite desktop environment so I figured he'd be alright with it.
- sivizius 6y agoKali Linux still exists? I thought after it was used in so many more or less good films and series it is not cool any more. :D
- enriquto 6y agoSince this has turned into a bash/zsh thread... The only real (non-cosmetic) feature missing in bash that zsh has is process substitution using files. In bash you can use <() to capture the output of a pipeline into a filename, but it is implemented as a non-seekable pipe. In zsh, you have that, but you also have =() that gives you a real, temporary file. It is extremely useful in the rare cases when it is needed.
- BossingAround 6y agoCan anyone recommend training for offensive security and/or Kali Linux pentesting? I've been wanting to explore that branch for a long time, I'd really appreciate some great resources for an engineer with no pentesting experience.
- Shared404 6y agoThis is a copy/paste of one my comments from a different thread. Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy. ... Online sources: * https://hackthissite.org https://hackthissite.org Wargaming site. Plenty of challenges to practice, but some are a bit outdated. * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here. * https://owasp.org/www-project-web-security-testing-guide/ https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one. * https://overthewire.org https://overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different. * https://0x00sec.org/ https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold. * https://www.hackerone.com/ https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first. ... I do a lot of learning through reading, so books: * Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated. * Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful. * Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this. * Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date. ... This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
- greedo 6y agoNo better place than the source: https://www.offensive-security.com/courses-and-certifications/ https://www.offensive-security.com/courses-and-certification...
- beagle3 6y agoStill my OS of choice for my first-ever generation Samsung Chromebook (exynos). Unfortunately, they stopped providing images - does anyone know if the build scripts still work for exynos based chromebook? (Or if other distros do?)
- GekkePrutser 6y agoI wonder why this zsh thing is such a huge change. Bash is just a chsh command away :)