4 ms·

Warn HN: Monarch upgrade deletes all files in $HOME

114 points by divan 5y ago

There is a neat tool for Flutter development called Monarch. Due to the bug if you run 'monarch upgrade' it deletes all files in HOME :( https://github.com/Dropsource/monarch/issues/38

chockchocschoir 5y ago
What a weakly worded changelog item they have published (https://monarchapp.io/blog/version-1.7.4 https://monarchapp.io/blog/version-1.7.4): > The monarch upgrade command used to delete old monarch files. Under certain conditions, a bug manifested where the command could delete non-monarch files. The releases where it can happen should be immediately yanked from wherever they can be downloaded, and their (Dropsource) social media should be filled with warnings not to run the `upgrade` command if they truly feel bad about deleting peoples most important files ($HOME compared to any other directory on disk). Seems they have ownership of wherever it downloads the update from "https://d2dpq905ksf9xw.cloudfront.net https://d2dpq905ksf9xw.cloudfront.net" so they can make it fail with a error message about it being unavailable, at least to stop from more people deleting files. @divan: maybe rename this submission to "WARN HN: $title" or something to make it more clear what is happening. On top of everything, it's not even clear what the problem was nor what the fix was. The authors just made a new release saying "It's fixed" without showing the patch itself. Not sure if Monarch is fully open source, but after spending 10 minutes digging through sources and releases, I can't find the place where it was adjusted to not delete all files in $HOME.
- tylersmith 5y ago
  They have just rolled out this change to the API.
  - chockchocschoir 5y ago
    I'm glad to hear they didn't wait longer to try to avoid wiping people's $HOME which they initially planned. Looking forward to seeing their release notes being updated as well.
OJFord 5y ago
What's the 'best' way of protecting against this sort of thing? Extremely frequent diff based backups? Firejails? The latter seems a more appropriate/thorough solution, but isn't that convenient, seems mostly people use it for select programs they already slightly distrust.
- chockchocschoir 5y ago
  Use the package manager your OS ships with and stay away from customized install scripts from various 3rd parties. This is not the first time this has happened, most famous one was probably that Steam bug some years ago that deleted everything for people.
  - dmw_ng 5y ago
    OS packagers have bugs like this every so often, because they still run custom upgrade scripts behind the scenes. Pretty sure I remember one in Debian a few years back (sorry, name escapes), and it was not the first time I remember seeing that.
    - chockchocschoir 5y ago
      I might just have been lucky then as that has never happened to me in almost +30 years of using various distributions like Ubuntu, Debian, Arch, CentOS, Redhat and more. Literally not a single time this has happened to me on either desktop nor server. But as I said, I might just have been lucky. Looks like I will increase my backup frequency now.
      - danuker 5y ago
        The first time I installed Linux was around 2007. I use it as my main OS since 2010. I have only lost data due to hard drive failure, or at my own request (i.e formatting over what I thought I had backed up). I recently enabled TRIM on my full-disk-encrypted SSD system. No sign of data loss yet. I have always used ext3/ext4.
  - 5y ago
1970-01-01 5y ago
I'm bookmarking this one for the next "just trust me" discussion.
deleted 5y ago
[deleted]
kaba0 5y ago
This is why I often say that the typical linux user-space has zero security. Yet people like to call sandboxes security policy, e.g. why shouldn't the OSX terminal be able to enter the Documents folder, etc -- for this reason exactly.
zozbot234 5y ago
Hey, at least this is an actual bug and not so-called "protestware".
- jart 5y ago
  On Dropsource's corporate website it says they have a "Patented Dev Process". https://www.dropsource.com/ https://www.dropsource.com/
  - throwaway81523 5y ago
    The product is really called drop source? That sounds like something Little Bobby Tables would type maliciously. In this case though, it is doing what it says on the tin.

114 points by divan 5y ago

There is a neat tool for Flutter development called Monarch. Due to the bug if you run 'monarch upgrade' it deletes all files in HOME :( https://github.com/Dropsource/monarch/issues/38

chockchocschoir 5y ago

What a weakly worded changelog item they have published (https://monarchapp.io/blog/version-1.7.4 https://monarchapp.io/blog/version-1.7.4): > The monarch upgrade command used to delete old monarch files. Under certain conditions, a bug manifested where the command could delete non-monarch files. The releases where it can happen should be immediately yanked from wherever they can be downloaded, and their (Dropsource) social media should be filled with warnings not to run the `upgrade` command if they truly feel bad about deleting peoples most important files ($HOME compared to any other directory on disk). Seems they have ownership of wherever it downloads the update from "https://d2dpq905ksf9xw.cloudfront.net https://d2dpq905ksf9xw.cloudfront.net" so they can make it fail with a error message about it being unavailable, at least to stop from more people deleting files. @divan: maybe rename this submission to "WARN HN: $title" or something to make it more clear what is happening. On top of everything, it's not even clear what the problem was nor what the fix was. The authors just made a new release saying "It's fixed" without showing the patch itself. Not sure if Monarch is fully open source, but after spending 10 minutes digging through sources and releases, I can't find the place where it was adjusted to not delete all files in $HOME.

tylersmith 5y ago
They have just rolled out this change to the API.
- chockchocschoir 5y ago
  I'm glad to hear they didn't wait longer to try to avoid wiping people's $HOME which they initially planned. Looking forward to seeing their release notes being updated as well.

OJFord 5y ago

What's the 'best' way of protecting against this sort of thing? Extremely frequent diff based backups? Firejails? The latter seems a more appropriate/thorough solution, but isn't that convenient, seems mostly people use it for select programs they already slightly distrust.

chockchocschoir 5y ago
Use the package manager your OS ships with and stay away from customized install scripts from various 3rd parties. This is not the first time this has happened, most famous one was probably that Steam bug some years ago that deleted everything for people.
- dmw_ng 5y ago
  OS packagers have bugs like this every so often, because they still run custom upgrade scripts behind the scenes. Pretty sure I remember one in Debian a few years back (sorry, name escapes), and it was not the first time I remember seeing that.
  - chockchocschoir 5y ago
    I might just have been lucky then as that has never happened to me in almost +30 years of using various distributions like Ubuntu, Debian, Arch, CentOS, Redhat and more. Literally not a single time this has happened to me on either desktop nor server. But as I said, I might just have been lucky. Looks like I will increase my backup frequency now.
    - danuker 5y ago
      The first time I installed Linux was around 2007. I use it as my main OS since 2010. I have only lost data due to hard drive failure, or at my own request (i.e formatting over what I thought I had backed up). I recently enabled TRIM on my full-disk-encrypted SSD system. No sign of data loss yet. I have always used ext3/ext4.
- 5y ago

1970-01-01 5y ago

I'm bookmarking this one for the next "just trust me" discussion.

deleted 5y ago

[deleted]

kaba0 5y ago

This is why I often say that the typical linux user-space has zero security. Yet people like to call sandboxes security policy, e.g. why shouldn't the OSX terminal be able to enter the Documents folder, etc -- for this reason exactly.

zozbot234 5y ago

Hey, at least this is an actual bug and not so-called "protestware".

jart 5y ago
On Dropsource's corporate website it says they have a "Patented Dev Process". https://www.dropsource.com/ https://www.dropsource.com/
- throwaway81523 5y ago
  The product is really called drop source? That sounds like something Little Bobby Tables would type maliciously. In this case though, it is doing what it says on the tin.