5 ms·

So many footguns in bash. When do we finally get serious about ditching this language as an industry in the same way we are about memory safety?

jerf 2y ago
A lot of this behavior is only a major problem if you're putting arbitrary input in, and especially, externally sourced input. The "good news" is that bash is so full of ways to get command execution that people blow their foot off and get compromised long before these little details are what are compromising their system. People get popped putting in user input at the base string layer where all you have to do is slap down a semi-colon to get arbitrary command execution long before they're getting popped by obscure "test" behaviors.
factormeta 2y ago
Oh no!!! But what about all those Docker files, and k8 clusters!!! Serious, please view the curled file from a link before piping it to bash/sh.
alganet 2y ago
You underestimate the effort of doing this. We all want bash gone, but it is an essential piece of infrastructure. The introduction of dash was a huge step in this direction (of ditching bash). Do you want to help? Try to remove bash from the toolchain bootstrap. It is one of the lowest hanging fruits right now.
flanbiscuit 2y ago
Curious what you use instead of bash? When you spin up a server somewhere, what's the first thing you like to install that replaces what we typically use bash for?
- everforward 2y ago
  Do these apply to NuShell? I think something like that is the way forward. Something with real data types rather than implicitly doing weird array processing. I would be pretty happy with something similar to Python but with easier IO redirection and subprocess management. xonsh is neat in principle, but painful in actual usage ime. And I suspect vulnerable to similar issues around the Python-bash interop.
  - alganet 2y ago
    What would you do with `configure` scripts? Let's say you need to install some third party software that is pretty standard `./configure && make && make install`, what would you do? Port `configure` to python?
    - sshine 2y ago
      sh
  - IYasha 2y ago
    I'd be happy with AngelScript or smth. Hard-typed, but interpretable. But not Python[-like]. I'd kill it with SIGFIRE.

jerf 2y ago

A lot of this behavior is only a major problem if you're putting arbitrary input in, and especially, externally sourced input. The "good news" is that bash is so full of ways to get command execution that people blow their foot off and get compromised long before these little details are what are compromising their system. People get popped putting in user input at the base string layer where all you have to do is slap down a semi-colon to get arbitrary command execution long before they're getting popped by obscure "test" behaviors.

factormeta 2y ago

Oh no!!! But what about all those Docker files, and k8 clusters!!! Serious, please view the curled file from a link before piping it to bash/sh.

alganet 2y ago

You underestimate the effort of doing this. We all want bash gone, but it is an essential piece of infrastructure. The introduction of dash was a huge step in this direction (of ditching bash). Do you want to help? Try to remove bash from the toolchain bootstrap. It is one of the lowest hanging fruits right now.

flanbiscuit 2y ago

Curious what you use instead of bash? When you spin up a server somewhere, what's the first thing you like to install that replaces what we typically use bash for?

everforward 2y ago
Do these apply to NuShell? I think something like that is the way forward. Something with real data types rather than implicitly doing weird array processing. I would be pretty happy with something similar to Python but with easier IO redirection and subprocess management. xonsh is neat in principle, but painful in actual usage ime. And I suspect vulnerable to similar issues around the Python-bash interop.
- alganet 2y ago
  What would you do with `configure` scripts? Let's say you need to install some third party software that is pretty standard `./configure && make && make install`, what would you do? Port `configure` to python?
  - sshine 2y ago
    sh
- IYasha 2y ago
  I'd be happy with AngelScript or smth. Hard-typed, but interpretable. But not Python[-like]. I'd kill it with SIGFIRE.