10 ms·

Commands like that really need a confirmation prompt and a command line switch to override like --do-as-i-say (long form only). Good example of developers being

Commands like that really need a confirmation prompt and a command line switch to override like --do-as-i-say (long form only). Good example of developers being put in an end user's shoes, I hope they learn from that mistake and update their programs.

soco 4y ago
I don't know about you folks but I can do stupid stuff also with confirmation. Maybe splitting the damaging actions in some substeps, so instead of a big bang you have a slow death?
- imtringued 4y ago
  You are right, something like closing a program shouldn't be valid immediately, the program should be frozen for a day with the ability to cancel the closing at any time until the day is over.
- synu 4y ago
  Also, for me when I make big mistakes like this I think I’m in a different environment or something. It’s not that I don’t realise what command I’m running, it’s that I miss the context. So I would just confirm but not realise what I was confirming.
pbhjpbhj 4y ago
An example of such a command came up on Linus Tech Tips (LTT), from apt (IIRC) on Pop_OS!. Basically (paraphrasing) "this will destroy your system and render it useless; type 'I'm an idiot and wish to proceed'". Our eponymous youtuber went right on, typed the phrase and blitzed the system, and then moaned about how the system shouldn't have let him break it ... I suspect such prompts only work for cautious people, who possibly don't need the prompts as they'll actually read the scary warnings.
- rcxdude 4y ago
  In his defense, it was literally the first package he tried to install, which was in the official repositories but horribly broken, so he had no real way to tell whether this was the normal flow and linux just made it really irritating to install packages.
  - glandium 4y ago
    And the more relevant error message was buried in the scrollback, IIRC.
- renewiltord 4y ago
  That guy is a savvy YouTuber, man. He did that because the resulting content has high memetic replication properties. I find the prompt for dangerous ops useful. GitHub will ask you to repeat the name of the repo before you destructive actions, Terraform will ask you to say yes to the prompt. These are all good things.
  - Grimburger 4y ago
    It's a solid practice in UX design. Physically having to type or copy/paste it in really highlights the action for the end user. There's only so much you can do to stop people setting their own house on fire but something like that puts the onus on them and fairly places the blame where it belongs.
    - andrewaylett 4y ago
      The problems start when you know you want to light a house on fire, but you pick the wrong house. It's almost never the case that blaming the user is actually going to help nor that adding more eyeballs will prevent people from making mistakes. If it's routine, we'll apply it to the wrong entity. If it's not routine, we'll not understand all the implications of our actions.
      - adwn 4y ago
        Some actions have to be irreversible by design (think: emptying the trash to free up space on your drive, or deleting sensible user data). At some point, someone has to greenlight that action, and the best you can do is trying to ensure the user is aware of what they're about to do – and you have to trust that they're using their brain for once. You know, that thing in your head which distinguishes you from that thing sitting in the metal box under your desk... If it were possible to automate that decision in a flawless, 100% safe and correct way, there'd be no need for a human to press the button.
        andrewaylett 4y ago
        Life definitely has one-way gates, but tech can avoid them a lot more than we do today. Soft deletes and backups give a time-bound undo period to user actions, and so freeing up space on my drive isn't irreversible. Also, to stretch the analogy I used further: one way to avoid lighting one's own house on fire by mistake is to not make the things you light on fire look like houses. In the case above, and in many other cases (like the big Atlassian outage earlier this year) the problem wasn't so much that the user was deliberately deleting important stuff, it's that they couldn't tell the difference between the class of unimportant things they thought they were deleting from and the class of important things they would stop and think long and hard about before deleting.
- yaddaor 4y ago
  It's a person who gets paid by views. They did this for the attention.
darrenf 4y ago
Command line switches like that won't, IMO and IME, make developers think "wow, I'm so glad this exists to guard against footguns". Rather they'll just set an alias to get around it. Likewise confirmation prompts albeit with a little more resitance. Once a repeat user is frustrated enough they'll bust out `expect` or similar, angry at the original command for mollycoddling them because they know what they're doing and don't make daft mistakes, damn it.
- selfhoster11 4y ago
  If you alias a —do-as-i-say switch to a command without wrapping into a script to make sanity checks of your own, IMO that’s negligence. The name of the flag should make you think thrice about invoking it without safety checks.
  - raverbashing 4y ago
    It was the same with safety overrides on hydraulic presses People would tape one button on, then wonder why it would chop a finger sometimes Yes it is annoying. Yes, there may be better choices. But it is there for a reason
  - darrenf 4y ago
    I don't disagree. I think negligence happens.
ivan_gammel 4y ago
That's a technical solution to a psychological and organizational problem: when there should be no CLI in production, people still use it and get used to various errors and confirmations so much, that they ignore the signs of a catastrophe. Technical solutions never work in such cases. And then there's a regulatory problem: investors trust their money to businesses which have not earned that trust, because of whatever magical thinking that exists on this market. At least the company seems to be able to return the money, but will it be sanctioned for this failure? There should be a regulatory incentive to do better next time.
- pjc50 4y ago
  > no CLI in production It seems like this was in the "deploy to production" stage, and there has to be some mechanism for doing that. (It also seems unnecessarily complicated; I'd appreciate a plaintext explainer of what actually went wrong)
  - ivan_gammel 4y ago
    Normally such deployment mechanism is one standard command that picks up a tested code, enriches it with environment configuration and rolls it out. This command rarely changes and should be the same as deployment to pre-production or staging. This command is usually executed from a CI tool via a button click and requires only user credentials as an input. Any changes to production must be tested before release. They did not do it.
SkipperCat 4y ago
Sun has a good warning banner on their ZFS appliances. It made you thing twice before proceeding. Shown here: https://news.ycombinator.com/item?id=30195007 https://news.ycombinator.com/item?id=30195007

soco 4y ago

I don't know about you folks but I can do stupid stuff also with confirmation. Maybe splitting the damaging actions in some substeps, so instead of a big bang you have a slow death?

imtringued 4y ago
You are right, something like closing a program shouldn't be valid immediately, the program should be frozen for a day with the ability to cancel the closing at any time until the day is over.
synu 4y ago
Also, for me when I make big mistakes like this I think I’m in a different environment or something. It’s not that I don’t realise what command I’m running, it’s that I miss the context. So I would just confirm but not realise what I was confirming.

pbhjpbhj 4y ago

An example of such a command came up on Linus Tech Tips (LTT), from apt (IIRC) on Pop_OS!. Basically (paraphrasing) "this will destroy your system and render it useless; type 'I'm an idiot and wish to proceed'". Our eponymous youtuber went right on, typed the phrase and blitzed the system, and then moaned about how the system shouldn't have let him break it ... I suspect such prompts only work for cautious people, who possibly don't need the prompts as they'll actually read the scary warnings.

rcxdude 4y ago
In his defense, it was literally the first package he tried to install, which was in the official repositories but horribly broken, so he had no real way to tell whether this was the normal flow and linux just made it really irritating to install packages.
- glandium 4y ago
  And the more relevant error message was buried in the scrollback, IIRC.
renewiltord 4y ago
That guy is a savvy YouTuber, man. He did that because the resulting content has high memetic replication properties. I find the prompt for dangerous ops useful. GitHub will ask you to repeat the name of the repo before you destructive actions, Terraform will ask you to say yes to the prompt. These are all good things.
- Grimburger 4y ago
  It's a solid practice in UX design. Physically having to type or copy/paste it in really highlights the action for the end user. There's only so much you can do to stop people setting their own house on fire but something like that puts the onus on them and fairly places the blame where it belongs.
  - andrewaylett 4y ago
    The problems start when you know you want to light a house on fire, but you pick the wrong house. It's almost never the case that blaming the user is actually going to help nor that adding more eyeballs will prevent people from making mistakes. If it's routine, we'll apply it to the wrong entity. If it's not routine, we'll not understand all the implications of our actions.
    - adwn 4y ago
      Some actions have to be irreversible by design (think: emptying the trash to free up space on your drive, or deleting sensible user data). At some point, someone has to greenlight that action, and the best you can do is trying to ensure the user is aware of what they're about to do – and you have to trust that they're using their brain for once. You know, that thing in your head which distinguishes you from that thing sitting in the metal box under your desk... If it were possible to automate that decision in a flawless, 100% safe and correct way, there'd be no need for a human to press the button.
      - andrewaylett 4y ago
        Life definitely has one-way gates, but tech can avoid them a lot more than we do today. Soft deletes and backups give a time-bound undo period to user actions, and so freeing up space on my drive isn't irreversible. Also, to stretch the analogy I used further: one way to avoid lighting one's own house on fire by mistake is to not make the things you light on fire look like houses. In the case above, and in many other cases (like the big Atlassian outage earlier this year) the problem wasn't so much that the user was deliberately deleting important stuff, it's that they couldn't tell the difference between the class of unimportant things they thought they were deleting from and the class of important things they would stop and think long and hard about before deleting.
yaddaor 4y ago
It's a person who gets paid by views. They did this for the attention.

darrenf 4y ago

Command line switches like that won't, IMO and IME, make developers think "wow, I'm so glad this exists to guard against footguns". Rather they'll just set an alias to get around it. Likewise confirmation prompts albeit with a little more resitance. Once a repeat user is frustrated enough they'll bust out `expect` or similar, angry at the original command for mollycoddling them because they know what they're doing and don't make daft mistakes, damn it.

selfhoster11 4y ago
If you alias a —do-as-i-say switch to a command without wrapping into a script to make sanity checks of your own, IMO that’s negligence. The name of the flag should make you think thrice about invoking it without safety checks.
- raverbashing 4y ago
  It was the same with safety overrides on hydraulic presses People would tape one button on, then wonder why it would chop a finger sometimes Yes it is annoying. Yes, there may be better choices. But it is there for a reason
- darrenf 4y ago
  I don't disagree. I think negligence happens.

ivan_gammel 4y ago

That's a technical solution to a psychological and organizational problem: when there should be no CLI in production, people still use it and get used to various errors and confirmations so much, that they ignore the signs of a catastrophe. Technical solutions never work in such cases. And then there's a regulatory problem: investors trust their money to businesses which have not earned that trust, because of whatever magical thinking that exists on this market. At least the company seems to be able to return the money, but will it be sanctioned for this failure? There should be a regulatory incentive to do better next time.

pjc50 4y ago
> no CLI in production It seems like this was in the "deploy to production" stage, and there has to be some mechanism for doing that. (It also seems unnecessarily complicated; I'd appreciate a plaintext explainer of what actually went wrong)
- ivan_gammel 4y ago
  Normally such deployment mechanism is one standard command that picks up a tested code, enriches it with environment configuration and rolls it out. This command rarely changes and should be the same as deployment to pre-production or staging. This command is usually executed from a CI tool via a button click and requires only user credentials as an input. Any changes to production must be tested before release. They did not do it.

SkipperCat 4y ago

Sun has a good warning banner on their ZFS appliances. It made you thing twice before proceeding. Shown here: https://news.ycombinator.com/item?id=30195007 https://news.ycombinator.com/item?id=30195007