11 ms·

Shellfirm: Intercept risky patterns at the command line

145 points by eladkaplan 4y ago

eladkaplan 4y ago
How do I save myself from myself? rm -rf * git reset --hard Before hitting the enter key? kubectl delete ns Stop! you are going to delete a lot of resources And many more! visit here: https://github.com/kaplanelad/shellfirm https://github.com/kaplanelad/shellfirm
deleted 4y ago
[deleted]
travisd 4y ago
Other than rm -rf / (which can happen if you manage to hit enter rather than another key) this feels not terribly useful. Who has accidentally kubectl delete ns prod? Anecdotally, the accidental enter seems like a much more likely scenario (I once ruined a server by chmod -r a+r / ing — that feels like a better use case for accident protection).
- EdwardDiego 4y ago
  If you are able to `kubectl delete ns prod-stuff` then you have somewhat earned the lesson you're about to learn.
- IshKebab 4y ago
  I've accidentally deleted all Docker containers on a shared system (who knew - Docker has no user-level security at all). Though this command wouldn't help in that case since I didn't know the command I was running was dangerous.
synu 4y ago
Usually when I make these mistakes I’m running the command on purpose, but my context is somehow confused. So I would probably happily solve the challenge and break everything.
playingalong 4y ago
Do people really issue these risky commands (and regret)? Or is it rather variable substitution which comes to play? E.g. referenced to undeclared variable which renders to empty string.
- xanathar 4y ago
  Yes, but probably not in the way that makes the program any useful. Example: I recently executed `git checkout .` (that incidentally would not be caught by this project) on the wrong repo. Oh the pain. But I would have probably confirmed the "captcha" blindly as I really wanted to execute that... just not on that repo.
makeitdouble 4y ago
This kind of tool needs context awareness to be useful. After the first 30~40 times you’re asked if you want to delete these pods, solving the question coming next becomes automatic. If you’re in a “I’m on my dev env, nothing bad can happen” mindset, that prompt won’t get you out of it, it will just be a tedious step, we’ve seen that time and time again. It becomes a lot more interesting if it can ask “you’re going to delete from the cluster prod, do you really want to ?” and only do so for production. Same for “rm -f” really, if it can confirm before you’re deleting a tree of thousands of file, and not when it’s 3 empty directories you created 3 min ago.
- rootw0rm 4y ago
  my main response to this HN submission was lolwtf. but your more measured response is valuable. this tool with context could actually be pretty cool.
- eladkaplan 4y ago
  I agree that the context will be better and I'm planning to add it in the next releases.
- davedx 4y ago
  When I used to admin Windows servers we had production’s desktop background set to red, that worked well, especially when you had multiple remote desktop sessions open. Wonder if that’s doable for non-GUI enabled Linux servers
  - t-3 4y ago
    The standard way is to set PS1 (the commandline prompt text) to indicate the environment. With escape codes, you can pretty trivially get some flashing red text telling you to be careful.
    - hobs 4y ago
      If used properly the -Confirm parameter in powershell can also have you change the impact level in your environment and ask for confirmation on things that in dev would not be cared about. Also its underused but the just in time access stuff where you can grant users subsets of permissions (again, per environment) is also pretty impressive.
TekMol 4y ago
This should be a small, easy to read bash script. Not a plethora of rust files that compile to a binary. I would never trust this thing to not cause more issues, unless it is so small and elegant, that I can audit it very easily and be very very sure it is safe.
- creatonez 4y ago
  Why nitpick the programming language of a project clearly intended to be used by the author?
  - TekMol 4y ago
    Because of the indirection and complexity it causes. The user is in a shell. The simplest way to add something to their system is a shellscript. No moving parts. You get what you see in the script. The way the project is set up, there are multiple moving parts. The interaction between the shell, some compiler and a bunch of rust files. Imagine during the moon landing, Neil Armstrong could not have communicated directly with Buzz Aldrin. But they would had to go through a translator who translates English to German. Who passes the message on to a translator who translates it from German to French. Who then passes it on to Buzz. BOOM! + /\ + .' '. * * /======\ + ;:. _ ; |:. (_) | |:. _ | + |:. (_) | * ;:. ; .' \:. / `. / .-'':._.'`-. \ |/ /||\ \|
    - pca006132 4y ago
      I don't think this tool changes the shell command for you? Your analogy doesn't fit here. But I do agree that it is probably easier to implement as a shell script.
      - eladkaplan 4y ago
        shellfirm not changes the shell command, only get the the command and check the pattern. the shell is execute the command. You really think shell script will be easier? can you elaborate?
3np 4y ago
One thing not clear from readme: Will it detect if it's in a TTY or might it also trigger from commands triggered inside shell scripts?
- hnbear 4y ago
  It’s loaded in via .zshrc or .bashrc (didn’t read the fish docs, but I assume it’s similar), so catches commands you enter in an interactive shell. Commands within a shell script won’t be handled by it. Similarly cron jobs don’t typically run with a full user environment, unless you’ve gone out of your way to make them, so would be safe.
- eladkaplan 4y ago
  shellfirm not execute the command. it's just get interrupt when you run the command, check the pattern and prompt your a verification. your shell is the executer
pca006132 4y ago
I frequently do `git reset --hard`, knowing what I am doing, until I found that I probably need the code a few days later. Perhaps I just need a tool to intercept this and backup the affected files somewhere. The files can be deleted after some time (a week? or never?). And when I regret doing resetting the files, I can just dig through the backup and try to find it.
- neilparikh 4y ago
  You could just call `git stash` instead of `git reset --hard`. It'll have the same effect on your working directory, while also "backing up" the changes. Stashes could be cleared using a cron job.
  - pca006132 4y ago
    iirc stash works more in a stack like manner? Say if you do git stash, and then do git rebase -i to clean up the history, proceed to write some other features, git stash again to clean it up, etc. Can you recover the files for the first stash?
    - amichal 4y ago
      git stash list?
    - Delk 4y ago
      Yes, you can. If you save, apply or pop with git stash with no arguments, it works like a stack by default, but you can also access the other entries. For example `git stash pop stash@{n}`, where n is the index of the entry in the stash "stack", applies the nth stash entry on top of the working tree and then removes it from the stored stashes. The latest entry is at index zero, so stash@{0} would be the last saved/pushed one. You can see a list of saved stashes and their indices with `git stash list`.
      - staindk 4y ago
        Ah you can use pop with other stashes too, thanks for the tip... though that feels a bit like a semantic misnomer (? unsure what term would be best to describe what I'm thinking - but 'pop' kind of feels like it should always be applicable only to the top element in a stack. I'd be scared that popping stash@{5} would apply all of stashes 1 to 5 at once lol). I've been using `git stash apply stash@{n}`, which works just fine, but the stash is then not removed from your list and results in clutter.
arijun 4y ago
Only because the creator is on here: oops has two O's. Unless you were making a pun with ops in which case maybe remove the elongation so it doesn't seem like a typo.
userbinator 4y ago
Enter - Required only to press Enter to continue. That sounds like it would be a bit too easy to accidentally go through, especially since Enter was used to initiate the command. Hold down the key just a little too long and it'll be as if you weren't even challenged.
- eladkaplan 4y ago
  this is configurable, depend what you want. the `enter` challenge is not the default. you can configure the challenge
- herpderperator 4y ago
  If you look at the example gif[0] they ask a simple math challenge. It's probably configurable. [0] https://github.com/kaplanelad/shellfirm/blob/main/docs/media/example.gif https://github.com/kaplanelad/shellfirm/blob/main/docs/media...
  - eladkaplan 4y ago
    absolutely, it configurable. run shellfirm config --help and you can changed the challenge
sureglymop 4y ago
I think there is another use case for a tool like this: predictable auto completion instead of input validation. For example, if you type this: `mkdir test && cd test` the tool could realize that the `test` folder was created and offer tab completion for it in the second part. I have long wanted a shell with better auto completion, more prediction etc.
wruza 4y ago
I don’t think it may help in a long run, except in cases when you mistyped a command. Mistakes are done because some assumptions are wrong, e.g. wrong cwd, hostname, account, and a captcha-like barrier cannot point that out or make you think about it more. The correct way to prevent mistakes is easy reversibility. Except for very big files/changes we now have an essentially unlimited disk space. Programs should learn to use it to manage undo.
huksley 4y ago
One way to do it is to use your shell functions (or aliases) for example for bash: function rm() { if [[ "$@" =~ "-rf" && "${RISKY}" != "1" ]]; then echo "Confirm by running RISKY=1 rm $@" else command rm "$@" fi } This goes into ~/.bashrc and I have a lot of commands customized to save time (for example git [1] or docker) [1]: https://gist.github.com/huksley/ef70da85f8dc0c9ca6f8ec4f37c3a637 https://gist.github.com/huksley/ef70da85f8dc0c9ca6f8ec4f37c3...
cassepipe 4y ago
It only cover rm mistakes but is so KISSly great : trash-d will alias rm so that all that you rm goes to the bin instead of disappearing for ever : https://github.com/rushsteve1/trash-d https://github.com/rushsteve1/trash-d

145 points by eladkaplan 4y ago

How do I save myself from myself? rm -rf * git reset --hard Before hitting the enter key? kubectl delete ns Stop! you are going to delete a lot of resources And many more! visit here: https://github.com/kaplanelad/shellfirm https://github.com/kaplanelad/shellfirm

deleted 4y ago

[deleted]

travisd 4y ago

Other than rm -rf / (which can happen if you manage to hit enter rather than another key) this feels not terribly useful. Who has accidentally kubectl delete ns prod? Anecdotally, the accidental enter seems like a much more likely scenario (I once ruined a server by chmod -r a+r / ing — that feels like a better use case for accident protection).

EdwardDiego 4y ago
If you are able to `kubectl delete ns prod-stuff` then you have somewhat earned the lesson you're about to learn.
IshKebab 4y ago
I've accidentally deleted all Docker containers on a shared system (who knew - Docker has no user-level security at all). Though this command wouldn't help in that case since I didn't know the command I was running was dangerous.

synu 4y ago

Usually when I make these mistakes I’m running the command on purpose, but my context is somehow confused. So I would probably happily solve the challenge and break everything.

playingalong 4y ago

Do people really issue these risky commands (and regret)? Or is it rather variable substitution which comes to play? E.g. referenced to undeclared variable which renders to empty string.

xanathar 4y ago
Yes, but probably not in the way that makes the program any useful. Example: I recently executed `git checkout .` (that incidentally would not be caught by this project) on the wrong repo. Oh the pain. But I would have probably confirmed the "captcha" blindly as I really wanted to execute that... just not on that repo.

makeitdouble 4y ago

This kind of tool needs context awareness to be useful. After the first 30~40 times you’re asked if you want to delete these pods, solving the question coming next becomes automatic. If you’re in a “I’m on my dev env, nothing bad can happen” mindset, that prompt won’t get you out of it, it will just be a tedious step, we’ve seen that time and time again. It becomes a lot more interesting if it can ask “you’re going to delete from the cluster prod, do you really want to ?” and only do so for production. Same for “rm -f” really, if it can confirm before you’re deleting a tree of thousands of file, and not when it’s 3 empty directories you created 3 min ago.

rootw0rm 4y ago
my main response to this HN submission was lolwtf. but your more measured response is valuable. this tool with context could actually be pretty cool.
eladkaplan 4y ago
I agree that the context will be better and I'm planning to add it in the next releases.
davedx 4y ago
When I used to admin Windows servers we had production’s desktop background set to red, that worked well, especially when you had multiple remote desktop sessions open. Wonder if that’s doable for non-GUI enabled Linux servers
- t-3 4y ago
  The standard way is to set PS1 (the commandline prompt text) to indicate the environment. With escape codes, you can pretty trivially get some flashing red text telling you to be careful.
  - hobs 4y ago
    If used properly the -Confirm parameter in powershell can also have you change the impact level in your environment and ask for confirmation on things that in dev would not be cared about. Also its underused but the just in time access stuff where you can grant users subsets of permissions (again, per environment) is also pretty impressive.

TekMol 4y ago

This should be a small, easy to read bash script. Not a plethora of rust files that compile to a binary. I would never trust this thing to not cause more issues, unless it is so small and elegant, that I can audit it very easily and be very very sure it is safe.

creatonez 4y ago
Why nitpick the programming language of a project clearly intended to be used by the author?
- TekMol 4y ago
  Because of the indirection and complexity it causes. The user is in a shell. The simplest way to add something to their system is a shellscript. No moving parts. You get what you see in the script. The way the project is set up, there are multiple moving parts. The interaction between the shell, some compiler and a bunch of rust files. Imagine during the moon landing, Neil Armstrong could not have communicated directly with Buzz Aldrin. But they would had to go through a translator who translates English to German. Who passes the message on to a translator who translates it from German to French. Who then passes it on to Buzz. BOOM! + /\ + .' '. * * /======\ + ;:. _ ; |:. (_) | |:. _ | + |:. (_) | * ;:. ; .' \:. / `. / .-'':._.'`-. \ |/ /||\ \|
  - pca006132 4y ago
    I don't think this tool changes the shell command for you? Your analogy doesn't fit here. But I do agree that it is probably easier to implement as a shell script.
    - eladkaplan 4y ago
      shellfirm not changes the shell command, only get the the command and check the pattern. the shell is execute the command. You really think shell script will be easier? can you elaborate?

3np 4y ago

One thing not clear from readme: Will it detect if it's in a TTY or might it also trigger from commands triggered inside shell scripts?

hnbear 4y ago
It’s loaded in via .zshrc or .bashrc (didn’t read the fish docs, but I assume it’s similar), so catches commands you enter in an interactive shell. Commands within a shell script won’t be handled by it. Similarly cron jobs don’t typically run with a full user environment, unless you’ve gone out of your way to make them, so would be safe.
eladkaplan 4y ago
shellfirm not execute the command. it's just get interrupt when you run the command, check the pattern and prompt your a verification. your shell is the executer

pca006132 4y ago

I frequently do `git reset --hard`, knowing what I am doing, until I found that I probably need the code a few days later. Perhaps I just need a tool to intercept this and backup the affected files somewhere. The files can be deleted after some time (a week? or never?). And when I regret doing resetting the files, I can just dig through the backup and try to find it.

neilparikh 4y ago
You could just call `git stash` instead of `git reset --hard`. It'll have the same effect on your working directory, while also "backing up" the changes. Stashes could be cleared using a cron job.
- pca006132 4y ago
  iirc stash works more in a stack like manner? Say if you do git stash, and then do git rebase -i to clean up the history, proceed to write some other features, git stash again to clean it up, etc. Can you recover the files for the first stash?
  - amichal 4y ago
    git stash list?
  - Delk 4y ago
    Yes, you can. If you save, apply or pop with git stash with no arguments, it works like a stack by default, but you can also access the other entries. For example `git stash pop stash@{n}`, where n is the index of the entry in the stash "stack", applies the nth stash entry on top of the working tree and then removes it from the stored stashes. The latest entry is at index zero, so stash@{0} would be the last saved/pushed one. You can see a list of saved stashes and their indices with `git stash list`.
    - staindk 4y ago
      Ah you can use pop with other stashes too, thanks for the tip... though that feels a bit like a semantic misnomer (? unsure what term would be best to describe what I'm thinking - but 'pop' kind of feels like it should always be applicable only to the top element in a stack. I'd be scared that popping stash@{5} would apply all of stashes 1 to 5 at once lol). I've been using `git stash apply stash@{n}`, which works just fine, but the stash is then not removed from your list and results in clutter.

arijun 4y ago

Only because the creator is on here: oops has two O's. Unless you were making a pun with ops in which case maybe remove the elongation so it doesn't seem like a typo.

userbinator 4y ago

Enter - Required only to press Enter to continue. That sounds like it would be a bit too easy to accidentally go through, especially since Enter was used to initiate the command. Hold down the key just a little too long and it'll be as if you weren't even challenged.

eladkaplan 4y ago
this is configurable, depend what you want. the `enter` challenge is not the default. you can configure the challenge
herpderperator 4y ago
If you look at the example gif[0] they ask a simple math challenge. It's probably configurable. [0] https://github.com/kaplanelad/shellfirm/blob/main/docs/media/example.gif https://github.com/kaplanelad/shellfirm/blob/main/docs/media...
- eladkaplan 4y ago
  absolutely, it configurable. run shellfirm config --help and you can changed the challenge

sureglymop 4y ago

I think there is another use case for a tool like this: predictable auto completion instead of input validation. For example, if you type this: `mkdir test && cd test` the tool could realize that the `test` folder was created and offer tab completion for it in the second part. I have long wanted a shell with better auto completion, more prediction etc.

wruza 4y ago

I don’t think it may help in a long run, except in cases when you mistyped a command. Mistakes are done because some assumptions are wrong, e.g. wrong cwd, hostname, account, and a captcha-like barrier cannot point that out or make you think about it more. The correct way to prevent mistakes is easy reversibility. Except for very big files/changes we now have an essentially unlimited disk space. Programs should learn to use it to manage undo.

huksley 4y ago

One way to do it is to use your shell functions (or aliases) for example for bash: function rm() { if [[ "$@" =~ "-rf" && "${RISKY}" != "1" ]]; then echo "Confirm by running RISKY=1 rm $@" else command rm "$@" fi } This goes into ~/.bashrc and I have a lot of commands customized to save time (for example git [1] or docker) [1]: https://gist.github.com/huksley/ef70da85f8dc0c9ca6f8ec4f37c3a637 https://gist.github.com/huksley/ef70da85f8dc0c9ca6f8ec4f37c3...

cassepipe 4y ago

It only cover rm mistakes but is so KISSly great : trash-d will alias rm so that all that you rm goes to the bin instead of disappearing for ever : https://github.com/rushsteve1/trash-d https://github.com/rushsteve1/trash-d