13 ms·

No Easter Eggs in Curl

233 points by TangerineDream 5y ago

netr0ute 5y ago
I can see how the facts/opinions presented would be true if the Easter egg was a closed-source binary blob, but that would be farcical to do in an open-source project like curl.
- dairylee 5y ago
  Or if the Easter egg was obfuscated and looked potentially malicious[1]. 1: https://github.com/npm/cli/issues/4091 https://github.com/npm/cli/issues/4091
  - genewitch 5y ago
    Wow, found recently, too.
emptyparadise 5y ago
A nice harmless easter egg I see a lot is naming variables in test suites after characters.
eternityforest 5y ago
I don't think I've ever put a true easter egg in software. I do decorations instead. A random quote on a login page, some skeuomorphic theming, a config option to put particle effects on your custom dashboards. I wouldn't really trust software less because of eggs though, unless it could be triggered by in band data. --egg is fine, triggering on nano activateEgg.txt is a problem.
- matsemann 5y ago
  I guess it depends on your definition of easter eggs. Some of our "easter eggs" are loading icons showing at specific events. So right now they are christmas themed.
deleted 5y ago
[deleted]
hoten 5y ago
An Easter egg doesn't need to be an undocumented secret thing. Put something silly behind a flag and document the flag in the manual, and it's still a goofy Easter egg.
- _nickwhite 5y ago
  There are 2 types of crotchety old men: 1) This one yells "get off my lawn!". 2) This one yells "get off my lawn!" and proceeds to explain why he doesn't like kids walking through his grass, and gives the complete history of him yelling at kids and then goes into detail why staying off his lawn is best for everybody. The author of curl is the latter. It would take much less time and effort to just write something fun into it, AND document it. Good grief, life is short, software development should be fun, even while remaining professional.
  - pavel_lishin 5y ago
    But it's not a lawn. It's a critical tool. Do you want your car's brake system to have easter eggs? What about your smoke detectors?
    - jjoonathan 5y ago
      Yeah, next time I'm on the highway and go into my foot-brake's "About" menu and click on the word "2020" twenty times I might be in serious danger of crashing my car!
      - Arainach 5y ago
        When the API that enables the effect has a buffer overflow that no one noticed because the feature was snuck in and attackers exploit it to take over your brakes (and from there the CAN bus because how could the brakes possibly have any vulnerabilities?), you'll care.
        jjoonathan 5y ago
piaste 5y ago
If you want to have fun with utilitarian tools, simply apply the Unix philosophy: fortune | cowsay | git commit -F -
- JCWasmx86 5y ago
  I added "fortune | cowsay -f tux| lolcat" to my ~/.bashrc. It is always nice to see some often inspirational or thought-provoking quote if I open a terminal window.
  - mattowen_uk 5y ago
    I've ported fortune to Win32, and now have it show me a nice quote whenever I open a Command Prompt. It was feature I always wanted to have, and gave up waiting for MS to provide it. For me, my first ever experience of fortune was on DEC VMS systems.
    - JCWasmx86 5y ago
      Has the cmd on windows an equivalent to .bashrc? If yes - TIL
      - mattowen_uk 5y ago
        Yes it does - it's specified via a registry key. I tried to find a reliable page to link to but the best I could find was this: https://ss64.com/nt/syntax-autoexec.html https://ss64.com/nt/syntax-autoexec.html Many, many, moons ago Windows NT had support for an 'autoexec.nt' batch file which did the same, so it's not a new feature just horribly undocumented.
        banana_giraffe 5y ago
        It is actually documented in cmd /? .. kinda. cmd's help shows that autorun is disabled with /d, and mentions which keys it looks for. I use it to have a different prompt for administrator windows. To anyone using it: Be careful. Any side effects in your autorun script can have entertaining effects on batch files when you least expect it.
0des 5y ago
It feels like gradually things are getting 'less fun'. We can't have nice things, people can't do jokes, everything is like "your service must be completely professional even if it is just this thing you needed and built and offered to others for free". Everything is SO SERIOUS now, when one thing isnt how a small group feels it should be, suddenly everyone mobs up and more fun disappears. Is there a generation thing that made this happen? It seems now that no matter what you do, if it deviates from what a paying user would expect, even if the thing is free, that as a developer you can get called up in front of these ad-hoc tribunals of the common man to answer and atone for your sins. It's so dumb the way the internet is going, I thought when we invented it that things would be so much better. I have nothing but spite for the last 20 years of the way we have treated this golden resource.
- droopyEyelids 5y ago
  In a way, your comment is an example of itself.
- 0987654321tw 5y ago
  Did you read the article before posting this? It is fun reading articles by people who have created great software.
- deleted 5y ago
  [deleted]
- MisterTea 5y ago
  > Everything is SO SERIOUS now, ... Now? It's been serious since computers were originally built for business. It became a little more lax in the 90's and the 00's with the rise of the web. This has also coincided with a sharp increase in code size and decline in quality. Maybe we need to be more serious.
  - rattlesnakedave 5y ago
    > This has also coincided with a sharp increase in code size and decline in quality Lol this is one hell of a claim to just slip in.
rgovostes 5y ago
PHP has some Easter eggs which reveal contributor credits in response to a request with certain GET parameters. This can be used to fingerprint the server version: https://labs.detectify.com/2012/10/29/do-you-dare-to-show-your-php-easter-egg/ https://labs.detectify.com/2012/10/29/do-you-dare-to-show-yo...
- colonelpopcorn 5y ago
  I think this is really why we can't "have fun" anymore. Because bad actors exist and can exploit things being done "just for fun". I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.
  - howdydoo 5y ago
    It's more of a risk/reward thing. Any code on a networked computer has non-zero risk. And what's the reward... an engineer had fun at work today? That's not a very compelling argument in a business context. I say this as someone who snuck an easter egg into our product at my last job. Yes, it was fun, but if I had gotten in trouble for it, I would have deserved it.
  - gumby 5y ago
    > I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community. I think it’s hard to think of the problem that way. These days* of course you have to worry about security on almost anything you work on. And when you do, the folks who think of security all the time are going to tell you to simplify your interfaces so they are easier to think about, then then armor them. What a pain! But we do those things because of all the bad actors. The security recommendations are a consequence, not the cause. * I grew up — literally — in a non-security environment: networked computers with no passwords or any other security. The only “protection” what would be called today kernel space memory barrier just to protect against bugs, and most machines didn’t have that. It was the late 70s and security was considered a barrier to hacking. I knew people working on security and frankly it seemed weird.
wodenokoto 5y ago
I too feel an innocence has been lost in software and the internet. It's a shame that things can't be so whimsical, but it is also good that serious software is taken more and more serious. I think this is the right decision by curl and I support it.
- cogman10 5y ago
  I'd say I think it depends on the software, but agree with your assessment. Curl is just perched at a position where an easter egg introducing a vulnerability would be disastrous. I feel the same about OpenSSL or the kernel. Software that is highly security sensitive shouldn't have easter eggs. On the flip side, I'm fine with grep or yes having an easter egg or two. It's hard to imagine using them in such a fashion where that'd create a security risk.
alok99 5y ago
I totally understand this stance. Not every game had cheat codes, not every movie/TV show has hidden details, and so not every piece of software has to have easter eggs. That kind of defeats the fun of it anyway, knowing that everything has a joke. I personally like adding easter eggs to my own code, but I wouldn't do it in software used by billions. At most a funny comment in the code, but nothing executable.
miniwark 5y ago
Well it's probably a good idea. man had for years a "gimme gimme gimme" (a man after midnight) in the past. A fun Easter Egg but... See : https://unix.stackexchange.com/questions/405783/why-does-man-print-gimme-gimme-gimme-at-0030 https://unix.stackexchange.com/questions/405783/why-does-man...
- notacoward 5y ago
  I sort of remembered this and was going to comment once I found it, but you beat me to it - and saved me some work. Thanks! It's a very relevant and important story.
jraph 5y ago
It reminded me of apt-get moo and aptitude moo, which do not seem risky or to trigger unexpected things (since they just print text when using specific, useless flags), nor cause maintenance troubles, and yet those programs are on many computers. I don't care that much about the presence or the absence of easter eggs in curl or in most tools. It's still cool that some have easter eggs if they are inoffensive. Documented easter eggs are fine too. Curl is a great tool and I'm perfectly fine (if not thankful) with this decision.
- ramses0 5y ago
  I've viewed that flag as an admission or convenient hookup point for new features under development, and have taken to adding a `--moo` or `--wip` flag which is a convenient starting point for adding something new to a utility. It's much easier for a developer that's new to a project to make `--moo` do something different than it is to perform all the ceremony to get a `--feature` going in the first place.
nabakin 5y ago
If anyone is interested in Easter eggs, I run a subreddit for them at https://www.reddit.com/r/eastereggs https://www.reddit.com/r/eastereggs
bellyfullofbac 5y ago
He could put the easter egg externally, e.g. create a page on his site that would react differently if fetched with the curl user-agent compared to all other user agents. So all the code would be server side and it'd still be an easter egg, because you get it by entering a certain input. e.g. curl hxxps://haxx.se/something-cute-here Obviously one day someone might see that page in the browser, thinks they need to get an offline copy of it, does a curl and gets something different. But I guess that's a surprising behavior of the server and not the client. Lots of servers already do this to do a first-level filter against people who can't figure out how to set curl's user-agent...
- colejohnson66 5y ago
  It’s (sadly) possible to detect curl|bash, and use it for malicious purposes: https://web.archive.org/web/20180124002447/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20180124002447/https://www.idont... (original URL is giving an HSTS error)
deleted 5y ago
[deleted]
unethical_ban 5y ago
This is such a stereotype of a kind of over-analytical type that it's hilarious. There are so many poor assumptions and overcaution. "If we put an easter egg in, it would be impossible to sneak in" - It isn't about being completely undetected for the people looking at source code, it's for the people who want to see a funny print output. "If we put an easter egg in, more people will want to put more in, or make the original more elaborate" - complete speculation, handled if true by the word "no". "I bet you all think me writing this means I'm hiding something" - projecting much? "If we would allow some features to get added like that, where would we draw the line? What other functionality and code do we merge into curl without properly disclosing and documenting it?" - Uh, the line is the definition you put in the top of the article: "An unexpected or undocumented feature in a piece of computer software, included as a joke or a bonus." This excludes malicious or harmful software. "We frequently ship bugs and features that go wrong." Yeah, it seems you have more important work to do if that statement is accepted as a given. And when the heck does a bug look like an easter egg?
- eternityforest 5y ago
  At this point the lack of any Easter Eggs almost IS the hidden feature. I would not have expected this much discussion and controversy, it causes more surprise than an actual egg in the app would!
  - unethical_ban 5y ago
    I'm almost ashamed for having spent any time responding to the original submission, butb here I am. I agree, it is much ado about nothing. Of all the data breaches, of all the zero days, of all the massive bugs found in open source software, how many have been caused by Easter eggs?
- chris_wot 5y ago
  I think you miss a few key points: 1. Including undocumented code is a breach of trust. 2. Adding a “fun” piece of code that’s not useful (and “secret”!) adds to the burden of maintainership. 3. People will inevitably want to add to the Easter egg code. Maintainers by and large are overworked, especially for software used on the scale of curl. They have better things to do. If you want curl with Easter eggs, fork it and see if others will use it.
ilogik 5y ago
on the other end of the spectrum, James Thomson created a driving game in the about screen of PCalc, a calculator app: https://www.macstories.net/reviews/pcalcs-delightfully-insane-about-screen/ https://www.macstories.net/reviews/pcalcs-delightfully-insan...
crawl_soever 5y ago
Top has a few easter eggs that have persisted. Check out top(1) section 7: STUPID TRICKS Sampler. Several issues have been filed like https://bugs.launchpad.net/ubuntu/+source/procps/+bug/446002 https://bugs.launchpad.net/ubuntu/+source/procps/+bug/446002 but I am happy to see relics like how to enter "the super bounce zone" remaining in nearly every distro containing top.
jeroenhd 5y ago
This argument works the other way too: if you don't want people to rely on and demand support for your code add in a bunch of easter eggs. The more random the triggers, the better. Random people on the internet can use your code fine, but big corporations run into issues because they need boring software. I think that's neat.
mperham 5y ago
Sidekiq has several easter eggs, involving emoji code. https://github.com/mperham/sidekiq https://github.com/mperham/sidekiq Those eggs did require fixes from YARD and code linters, in order to support emoji code, so in a sense they helped make the ecosystem better.
ReleaseCandidat 5y ago
There are no Easter eggs, but how about Saint Nicholas nuts or Christmas presents?
slmjkdbtl 5y ago
Fun and jokes are healthy for any kind of community, but things like easter eggs definitely shouldn't be forced.
can16358p 5y ago
There is another side of the coin: Not to directly defend easter eggs but if we allow people to insert easter eggs, sure it creates slightly more work and potentially create an attack surface (albeit very unlikely), but in return you get something hard to measure directly. People love and embrace what they work with, they care about the project, spend extra time on it because it creates belonging and sympathy. It makes a little happier developers and a community, which eventually results in a better-cared project. Even knowing any potential downsides of adding an easter egg to a program, I think upsides are a little higher. It's just hard to quantitatively measure.
coldtea 5y ago
>The primary and main reason is the question of trust. No product (where no = a statistically insignificant percentage) ever lost trust because of an easter egg. There are tons of other reasons for losing trust...
pierrebai 5y ago
Weird, I could have sworn I've read this before, not necessarily about curl, but the exact same words and sentiment. Searching for "no easter egg in" yielded nothing. Yet the post is dated as of today. Maybe I lived briefly in an alternate universe? Maybe it was this: https://docs.microsoft.com/en-us/archive/blogs/larryosterman/why-no-easter-eggs https://docs.microsoft.com/en-us/archive/blogs/larryosterman... Which was discussed on HN in 2005 here: https://news.ycombinator.com/item?id=17517085 https://news.ycombinator.com/item?id=17517085
phendrenad2 5y ago
Easter eggs are fine, as long as you hide them in a "non-work area" and not a "work area". In the 80s and 90s, on Macintosh, it was customary to hide easter eggs in the "About" dialog box. Since nobody was relying on the about dialog to do real work, it's safe. An analogous place to hide easter eggs in a CLI program like Curl might be in the --help dialog. Nobody is parsing the output of `curl --help`, so it's safe.

I can see how the facts/opinions presented would be true if the Easter egg was a closed-source binary blob, but that would be farcical to do in an open-source project like curl.

dairylee 5y ago
Or if the Easter egg was obfuscated and looked potentially malicious[1]. 1: https://github.com/npm/cli/issues/4091 https://github.com/npm/cli/issues/4091
- genewitch 5y ago
  Wow, found recently, too.

emptyparadise 5y ago

A nice harmless easter egg I see a lot is naming variables in test suites after characters.

eternityforest 5y ago

I don't think I've ever put a true easter egg in software. I do decorations instead. A random quote on a login page, some skeuomorphic theming, a config option to put particle effects on your custom dashboards. I wouldn't really trust software less because of eggs though, unless it could be triggered by in band data. --egg is fine, triggering on nano activateEgg.txt is a problem.

matsemann 5y ago
I guess it depends on your definition of easter eggs. Some of our "easter eggs" are loading icons showing at specific events. So right now they are christmas themed.

deleted 5y ago

[deleted]

hoten 5y ago

An Easter egg doesn't need to be an undocumented secret thing. Put something silly behind a flag and document the flag in the manual, and it's still a goofy Easter egg.

_nickwhite 5y ago
There are 2 types of crotchety old men: 1) This one yells "get off my lawn!". 2) This one yells "get off my lawn!" and proceeds to explain why he doesn't like kids walking through his grass, and gives the complete history of him yelling at kids and then goes into detail why staying off his lawn is best for everybody. The author of curl is the latter. It would take much less time and effort to just write something fun into it, AND document it. Good grief, life is short, software development should be fun, even while remaining professional.
- pavel_lishin 5y ago
  But it's not a lawn. It's a critical tool. Do you want your car's brake system to have easter eggs? What about your smoke detectors?
  - jjoonathan 5y ago
    Yeah, next time I'm on the highway and go into my foot-brake's "About" menu and click on the word "2020" twenty times I might be in serious danger of crashing my car!
    - Arainach 5y ago
      When the API that enables the effect has a buffer overflow that no one noticed because the feature was snuck in and attackers exploit it to take over your brakes (and from there the CAN bus because how could the brakes possibly have any vulnerabilities?), you'll care.
      - jjoonathan 5y ago

piaste 5y ago

If you want to have fun with utilitarian tools, simply apply the Unix philosophy: fortune | cowsay | git commit -F -

JCWasmx86 5y ago
I added "fortune | cowsay -f tux| lolcat" to my ~/.bashrc. It is always nice to see some often inspirational or thought-provoking quote if I open a terminal window.
- mattowen_uk 5y ago
  I've ported fortune to Win32, and now have it show me a nice quote whenever I open a Command Prompt. It was feature I always wanted to have, and gave up waiting for MS to provide it. For me, my first ever experience of fortune was on DEC VMS systems.
  - JCWasmx86 5y ago
    Has the cmd on windows an equivalent to .bashrc? If yes - TIL
    - mattowen_uk 5y ago
      Yes it does - it's specified via a registry key. I tried to find a reliable page to link to but the best I could find was this: https://ss64.com/nt/syntax-autoexec.html https://ss64.com/nt/syntax-autoexec.html Many, many, moons ago Windows NT had support for an 'autoexec.nt' batch file which did the same, so it's not a new feature just horribly undocumented.
      - banana_giraffe 5y ago
        It is actually documented in cmd /? .. kinda. cmd's help shows that autorun is disabled with /d, and mentions which keys it looks for. I use it to have a different prompt for administrator windows. To anyone using it: Be careful. Any side effects in your autorun script can have entertaining effects on batch files when you least expect it.

0des 5y ago

It feels like gradually things are getting 'less fun'. We can't have nice things, people can't do jokes, everything is like "your service must be completely professional even if it is just this thing you needed and built and offered to others for free". Everything is SO SERIOUS now, when one thing isnt how a small group feels it should be, suddenly everyone mobs up and more fun disappears. Is there a generation thing that made this happen? It seems now that no matter what you do, if it deviates from what a paying user would expect, even if the thing is free, that as a developer you can get called up in front of these ad-hoc tribunals of the common man to answer and atone for your sins. It's so dumb the way the internet is going, I thought when we invented it that things would be so much better. I have nothing but spite for the last 20 years of the way we have treated this golden resource.

droopyEyelids 5y ago
In a way, your comment is an example of itself.
0987654321tw 5y ago
Did you read the article before posting this? It is fun reading articles by people who have created great software.
deleted 5y ago
[deleted]
MisterTea 5y ago
> Everything is SO SERIOUS now, ... Now? It's been serious since computers were originally built for business. It became a little more lax in the 90's and the 00's with the rise of the web. This has also coincided with a sharp increase in code size and decline in quality. Maybe we need to be more serious.
- rattlesnakedave 5y ago
  > This has also coincided with a sharp increase in code size and decline in quality Lol this is one hell of a claim to just slip in.

rgovostes 5y ago

PHP has some Easter eggs which reveal contributor credits in response to a request with certain GET parameters. This can be used to fingerprint the server version: https://labs.detectify.com/2012/10/29/do-you-dare-to-show-your-php-easter-egg/ https://labs.detectify.com/2012/10/29/do-you-dare-to-show-yo...

colonelpopcorn 5y ago
I think this is really why we can't "have fun" anymore. Because bad actors exist and can exploit things being done "just for fun". I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.
- howdydoo 5y ago
  It's more of a risk/reward thing. Any code on a networked computer has non-zero risk. And what's the reward... an engineer had fun at work today? That's not a very compelling argument in a business context. I say this as someone who snuck an easter egg into our product at my last job. Yes, it was fun, but if I had gotten in trouble for it, I would have deserved it.
- gumby 5y ago
  > I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community. I think it’s hard to think of the problem that way. These days* of course you have to worry about security on almost anything you work on. And when you do, the folks who think of security all the time are going to tell you to simplify your interfaces so they are easier to think about, then then armor them. What a pain! But we do those things because of all the bad actors. The security recommendations are a consequence, not the cause. * I grew up — literally — in a non-security environment: networked computers with no passwords or any other security. The only “protection” what would be called today kernel space memory barrier just to protect against bugs, and most machines didn’t have that. It was the late 70s and security was considered a barrier to hacking. I knew people working on security and frankly it seemed weird.

wodenokoto 5y ago

I too feel an innocence has been lost in software and the internet. It's a shame that things can't be so whimsical, but it is also good that serious software is taken more and more serious. I think this is the right decision by curl and I support it.

cogman10 5y ago
I'd say I think it depends on the software, but agree with your assessment. Curl is just perched at a position where an easter egg introducing a vulnerability would be disastrous. I feel the same about OpenSSL or the kernel. Software that is highly security sensitive shouldn't have easter eggs. On the flip side, I'm fine with grep or yes having an easter egg or two. It's hard to imagine using them in such a fashion where that'd create a security risk.

alok99 5y ago

I totally understand this stance. Not every game had cheat codes, not every movie/TV show has hidden details, and so not every piece of software has to have easter eggs. That kind of defeats the fun of it anyway, knowing that everything has a joke. I personally like adding easter eggs to my own code, but I wouldn't do it in software used by billions. At most a funny comment in the code, but nothing executable.

miniwark 5y ago

Well it's probably a good idea. man had for years a "gimme gimme gimme" (a man after midnight) in the past. A fun Easter Egg but... See : https://unix.stackexchange.com/questions/405783/why-does-man-print-gimme-gimme-gimme-at-0030 https://unix.stackexchange.com/questions/405783/why-does-man...

notacoward 5y ago
I sort of remembered this and was going to comment once I found it, but you beat me to it - and saved me some work. Thanks! It's a very relevant and important story.

jraph 5y ago

It reminded me of apt-get moo and aptitude moo, which do not seem risky or to trigger unexpected things (since they just print text when using specific, useless flags), nor cause maintenance troubles, and yet those programs are on many computers. I don't care that much about the presence or the absence of easter eggs in curl or in most tools. It's still cool that some have easter eggs if they are inoffensive. Documented easter eggs are fine too. Curl is a great tool and I'm perfectly fine (if not thankful) with this decision.

ramses0 5y ago
I've viewed that flag as an admission or convenient hookup point for new features under development, and have taken to adding a `--moo` or `--wip` flag which is a convenient starting point for adding something new to a utility. It's much easier for a developer that's new to a project to make `--moo` do something different than it is to perform all the ceremony to get a `--feature` going in the first place.

nabakin 5y ago

If anyone is interested in Easter eggs, I run a subreddit for them at https://www.reddit.com/r/eastereggs https://www.reddit.com/r/eastereggs

bellyfullofbac 5y ago

He could put the easter egg externally, e.g. create a page on his site that would react differently if fetched with the curl user-agent compared to all other user agents. So all the code would be server side and it'd still be an easter egg, because you get it by entering a certain input. e.g. curl hxxps://haxx.se/something-cute-here Obviously one day someone might see that page in the browser, thinks they need to get an offline copy of it, does a curl and gets something different. But I guess that's a surprising behavior of the server and not the client. Lots of servers already do this to do a first-level filter against people who can't figure out how to set curl's user-agent...

colejohnson66 5y ago
It’s (sadly) possible to detect curl|bash, and use it for malicious purposes: https://web.archive.org/web/20180124002447/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20180124002447/https://www.idont... (original URL is giving an HSTS error)

deleted 5y ago

[deleted]

unethical_ban 5y ago

This is such a stereotype of a kind of over-analytical type that it's hilarious. There are so many poor assumptions and overcaution. "If we put an easter egg in, it would be impossible to sneak in" - It isn't about being completely undetected for the people looking at source code, it's for the people who want to see a funny print output. "If we put an easter egg in, more people will want to put more in, or make the original more elaborate" - complete speculation, handled if true by the word "no". "I bet you all think me writing this means I'm hiding something" - projecting much? "If we would allow some features to get added like that, where would we draw the line? What other functionality and code do we merge into curl without properly disclosing and documenting it?" - Uh, the line is the definition you put in the top of the article: "An unexpected or undocumented feature in a piece of computer software, included as a joke or a bonus." This excludes malicious or harmful software. "We frequently ship bugs and features that go wrong." Yeah, it seems you have more important work to do if that statement is accepted as a given. And when the heck does a bug look like an easter egg?

eternityforest 5y ago
At this point the lack of any Easter Eggs almost IS the hidden feature. I would not have expected this much discussion and controversy, it causes more surprise than an actual egg in the app would!
- unethical_ban 5y ago
  I'm almost ashamed for having spent any time responding to the original submission, butb here I am. I agree, it is much ado about nothing. Of all the data breaches, of all the zero days, of all the massive bugs found in open source software, how many have been caused by Easter eggs?
chris_wot 5y ago
I think you miss a few key points: 1. Including undocumented code is a breach of trust. 2. Adding a “fun” piece of code that’s not useful (and “secret”!) adds to the burden of maintainership. 3. People will inevitably want to add to the Easter egg code. Maintainers by and large are overworked, especially for software used on the scale of curl. They have better things to do. If you want curl with Easter eggs, fork it and see if others will use it.

ilogik 5y ago

on the other end of the spectrum, James Thomson created a driving game in the about screen of PCalc, a calculator app: https://www.macstories.net/reviews/pcalcs-delightfully-insane-about-screen/ https://www.macstories.net/reviews/pcalcs-delightfully-insan...

crawl_soever 5y ago

Top has a few easter eggs that have persisted. Check out top(1) section 7: STUPID TRICKS Sampler. Several issues have been filed like https://bugs.launchpad.net/ubuntu/+source/procps/+bug/446002 https://bugs.launchpad.net/ubuntu/+source/procps/+bug/446002 but I am happy to see relics like how to enter "the super bounce zone" remaining in nearly every distro containing top.

jeroenhd 5y ago

This argument works the other way too: if you don't want people to rely on and demand support for your code add in a bunch of easter eggs. The more random the triggers, the better. Random people on the internet can use your code fine, but big corporations run into issues because they need boring software. I think that's neat.

mperham 5y ago

Sidekiq has several easter eggs, involving emoji code. https://github.com/mperham/sidekiq https://github.com/mperham/sidekiq Those eggs did require fixes from YARD and code linters, in order to support emoji code, so in a sense they helped make the ecosystem better.

ReleaseCandidat 5y ago

There are no Easter eggs, but how about Saint Nicholas nuts or Christmas presents?

slmjkdbtl 5y ago

Fun and jokes are healthy for any kind of community, but things like easter eggs definitely shouldn't be forced.

can16358p 5y ago

There is another side of the coin: Not to directly defend easter eggs but if we allow people to insert easter eggs, sure it creates slightly more work and potentially create an attack surface (albeit very unlikely), but in return you get something hard to measure directly. People love and embrace what they work with, they care about the project, spend extra time on it because it creates belonging and sympathy. It makes a little happier developers and a community, which eventually results in a better-cared project. Even knowing any potential downsides of adding an easter egg to a program, I think upsides are a little higher. It's just hard to quantitatively measure.

coldtea 5y ago

>The primary and main reason is the question of trust. No product (where no = a statistically insignificant percentage) ever lost trust because of an easter egg. There are tons of other reasons for losing trust...

pierrebai 5y ago

Weird, I could have sworn I've read this before, not necessarily about curl, but the exact same words and sentiment. Searching for "no easter egg in" yielded nothing. Yet the post is dated as of today. Maybe I lived briefly in an alternate universe? Maybe it was this: https://docs.microsoft.com/en-us/archive/blogs/larryosterman/why-no-easter-eggs https://docs.microsoft.com/en-us/archive/blogs/larryosterman... Which was discussed on HN in 2005 here: https://news.ycombinator.com/item?id=17517085 https://news.ycombinator.com/item?id=17517085

phendrenad2 5y ago

Easter eggs are fine, as long as you hide them in a "non-work area" and not a "work area". In the 80s and 90s, on Macintosh, it was customary to hide easter eggs in the "About" dialog box. Since nobody was relying on the about dialog to do real work, it's safe. An analogous place to hide easter eggs in a CLI program like Curl might be in the --help dialog. Nobody is parsing the output of `curl --help`, so it's safe.