4 ms·

I was about to say "Which is essentially leaking the existence of something terrible inside. They should be embarrassed to say something like this in public. Li

I was about to say "Which is essentially leaking the existence of something terrible inside. They should be embarrassed to say something like this in public. Like saying you can't have %s or $PS1. Why the hell not? What are you doing with this user-supplied input?" But maybe it's more about what everyone else might do with a channel name. Ie they might cut & paste it anywhere, and I guess windows users aren't expected to escape their own strings when pasted into cmd or powershell or wsl.

tapoxi 3y ago
I thought this as well but there's plenty of dangerous commands that aren't escaped here. I'm assuming it's a limitation of it actually writing something to the filesystem, hopefully your own (with the desktop app) and not one in Azure.
vel0city 3y ago
> What are you doing with this user-supplied input? Creating Sharepoint shares which can be mounted as network shares in Windows where these filenames are not allowed?
dharmab 3y ago
The Something Terrible in this case is early DOS which did not have separate folders. So the device files were in the same namespace as the user's files, so the user couldn't name a file CON or LPT1. These are preserved for backwards compatibility. To this day you can write a program that writes to a CON file in any folder, and the program will print the write to console.
- ChrisSD 3y ago
  This has actually changed a bit in the last few years. In Windows 11 writing to `.\CON` will write to the file but writing to `CON` will still write to the console.
- xp84 3y ago
  Another interesting aspect of this, which I remember specifically from reading MS-DOS manuals in the 90s as a kid (I was an incredibly fun 12 year old) is that this choice was an intentional one done in the name of flexibility. These device names were correctly written with a colon, but you are allowed to omit the colons. For instance: copy con lpt1 And copy con: lpt1: were interchangeable. If they’d chosen to not save users keystrokes and force colons when referencing devices, I’m not positive, but I think it would have eliminated the need for many of these reserved words in file names in general. Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux!
  - gnosek 3y ago
    > Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux! cat > outputfilename.txt
    - xp84 3y ago
      But it's not CTRL-Z to end, right? That's the part I forget every time :D
  - Brian_K_White 3y ago
    One of my favorite bbs sig tags was "REAL programmers use COPY CON FILE.EXE"
cueo 3y ago
> I was about to say Yet you said it twice[1]. [1] https://news.ycombinator.com/item?id=37076913 https://news.ycombinator.com/item?id=37076913

tapoxi 3y ago

I thought this as well but there's plenty of dangerous commands that aren't escaped here. I'm assuming it's a limitation of it actually writing something to the filesystem, hopefully your own (with the desktop app) and not one in Azure.

vel0city 3y ago

> What are you doing with this user-supplied input? Creating Sharepoint shares which can be mounted as network shares in Windows where these filenames are not allowed?

dharmab 3y ago

The Something Terrible in this case is early DOS which did not have separate folders. So the device files were in the same namespace as the user's files, so the user couldn't name a file CON or LPT1. These are preserved for backwards compatibility. To this day you can write a program that writes to a CON file in any folder, and the program will print the write to console.

ChrisSD 3y ago
This has actually changed a bit in the last few years. In Windows 11 writing to `.\CON` will write to the file but writing to `CON` will still write to the console.
xp84 3y ago
Another interesting aspect of this, which I remember specifically from reading MS-DOS manuals in the 90s as a kid (I was an incredibly fun 12 year old) is that this choice was an intentional one done in the name of flexibility. These device names were correctly written with a colon, but you are allowed to omit the colons. For instance: copy con lpt1 And copy con: lpt1: were interchangeable. If they’d chosen to not save users keystrokes and force colons when referencing devices, I’m not positive, but I think it would have eliminated the need for many of these reserved words in file names in general. Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux!
- gnosek 3y ago
  > Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux! cat > outputfilename.txt
  - xp84 3y ago
    But it's not CTRL-Z to end, right? That's the part I forget every time :D
- Brian_K_White 3y ago
  One of my favorite bbs sig tags was "REAL programmers use COPY CON FILE.EXE"

cueo 3y ago

> I was about to say Yet you said it twice[1]. [1] https://news.ycombinator.com/item?id=37076913 https://news.ycombinator.com/item?id=37076913