5 ms·
If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading
by dumpsterdiver 6y ago
If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading them first, ever. That is so irresponsible. Validating shell scripts will make you a more competent and informed worker. Tools like this breed incompetence, and encourage carelessness.
- GauntletWizard 6y agoI want this to run my own shell scripts. I have a bunch of scripts that are halfway between "documentation" and "automation"; mostly the record of the last time I did X. Add a prompt to eval a command or two or change variables that are hard coded, and it's ipython for shell.
- dumpsterdiver 6y ago> I want this to run my own shell scripts. That's really the only use case for this tool that I could get behind, and I commend you for your diligence.
- martinald 6y agoI assume you also read all the source code for every program you run too?
- dataflow 6y ago> You should never run shell scripts without reading them first, ever. That is so irresponsible. Do you run on Gentoo? and presumably read the millions of lines of code your machine is running on? People have been downloading and running executables almost pretty much as as the internet has been around... and the world is still going 'round.
- dumpsterdiver 6y agoI understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating systems, but it is not unreasonable to read shell scripts before you run them.
- barbazoo 6y agoPlus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.
- carlhjerpe 6y agoThe same can't be said for npm packages and people still use them.
- Waterluvian 6y agoI just don't see how this perspective lives in the real world. It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in <lang> then you're not worthy enough." How would you ever begin a career, let alone become a desirable team member?
- dumpsterdiver 6y agoI would probably start by reading a book.
- Skunkleton 6y agoYeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?
- dumpsterdiver 6y agoI am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.
- Skunkleton 6y agoYou are on HN. Most of us are software engineers. You aren't telling us something we don't know.
- deleted 6y ago[deleted]
- dumpsterdiver 6y agoIf that were true, then why did this post reach the front page of Hacker News? As Larry Wall stated, the three virtues of a programmer are: Laziness, impatience, and hubris. Tools like this embody all three.