7 ms·

Just imagine how many poorly-written shell scripts will break when we suddenly allow dollars, quotes, backticks and the likes in username. Heck, even allowing s

Just imagine how many poorly-written shell scripts will break when we suddenly allow dollars, quotes, backticks and the likes in username. Heck, even allowing spaces sound like horror to me. On the display side, I'm sure most tools that display usernames won't make it easy to see if there are leading or trailing whitespace characters, double blanks, tabs etc in usernames. This sounds like support hell to me.

gmuslera 2y ago
The problem could be old scripts or systems that doesn’t handle UTF-8 (that doesn’t need to be the ones where the username was defined). I’m not sure if I.e. the Bobby tables trick could be done with characters with UTF8 representation seeing them in pure ascii.
deleted 2y ago
[deleted]
Starlevel004 2y ago
Breaking shell scripts sounds like a good idea to me. The faster they die the better the world gets.
- Rygian 2y ago
  That's going to be a very bumpy road, even if everyone were to agree that the destination is appealing.
  - bigstrat2003 2y ago
    Yeah for better or for worse compatibility is king. I despise shell scripts, they are an absolute nightmare to work with and full of footguns. But they are so commonplace that people are not going to tolerate YOLO breaking changes.
  - raverbashing 2y ago
    Yeah I think ESH While we have more modern shells the fact that bash (or even sh) is the "common denominator" 30 yrs on is both good and awful We need a PowerShell for Linux
    - ygra 2y ago
      Not even that is free of footguns, especially around argument parsing and calling native commands.
- chikere232 2y ago
  Perhaps unix isn't for you?
- makeitdouble 2y ago
  Thing is, they don't die. Instead you get the short end of the stick. You'd have to be pretty darn important for an org to fix their scripts because of your name or the username you created. Of it would need to happen at a larger scale, but then that wouldn't be so controversial in the first place.
codedokode 2y ago
But spaces are allowed in filenames since 80s, didn't software had enough time to adapt?
- michaelt 2y ago
  Microsoft's Windows 95 put spaces into "c:\My Documents" and "c:\Program Files" so that developers targeting Windows were forced to support spaces in filenames. Of course, in those days if an OS upgrade broke some third party software, the end user paid for an upgrade. So although Microsoft forced developers' hands, the developers all got paid for their trouble. And you'd only have your hand forced that way once or twice a decade. Windows at the time was also all about the GUI file-pickers. Breaking the command line? Shell scripts? What are those?
  - toast0 2y ago
    And now it's \Users, presumably because after 20 years, Microsoft gave up?
    - hwc 2y ago
      Or someone got tired of typing long paths.
    - Uvix 2y ago
      They changed from \Documents and Settings to \Users in Vista, alongside other profile rejiggering (e.g. introducing AppData folders). By that point software had either been fixed or would never be fixed, so keeping a space in the name wasn't particularly useful.
    - rcxdude 2y ago
      It's still very common for usernames to have spaces, though.
    - alterom 2y ago
      And now it's \Users, presumably because after 20 years, Microsoft gave up? Only if you assume that people rarely have spaces in their Windows login names (e.g. "Joe Smith"). Either that, or Windows users have learned to not be scared of spaces in filenames, usernames, and their own literal names.
rossy 2y ago
For people using NSS modules like winbind, most of those scripts are already broken
wolrah 2y ago
> Just imagine how many poorly-written shell scripts will break when we suddenly allow dollars, quotes, backticks and the likes in username. Heck, even allowing spaces sound like horror to me. If we're admitting they're poorly-written, why can't we admit that they're already broken regardless of whether that brokenness is currently being triggered? Allowing symbols or spaces didn't break anything, it was broken from day one just no one noticed. Why is the answer always "go out of your way to not upset the broken garbage that's been around forever" rather than "throw Zalgo at it and fix what breaks so it's no longer broken and won't be broken in the future"? Bug compatibility is the worst behavior of the computing industry. Let the bad code break and more importantly call it out so everyone knows where the blame belongs.
- tsimionescu 2y ago
  Because people don't care about the presence or absence of bugs, they care about getting their work or leisure done with the help of the computer. If the computer isn't working, then they can't get their work done, and so they are mad at whoever broke it (for example by upgrading it, or by adding a username with spaces inside it). If it's working, then they're happy, no matter how dangerously on the precipice it is.
raverbashing 2y ago
Yes yes it is Same for when people are being too clever and use a password generator with all the characters for things you need to call/pass on some types of config files No, you're not being smart for adding double quotes to a generated password, in fact quite the contrary. And guess who needs to try all types of escapes for that?! TFA seems like another of Debian's self inflicted problems by people trying to be "too smart"

gmuslera 2y ago

The problem could be old scripts or systems that doesn’t handle UTF-8 (that doesn’t need to be the ones where the username was defined). I’m not sure if I.e. the Bobby tables trick could be done with characters with UTF8 representation seeing them in pure ascii.

deleted 2y ago

[deleted]

Starlevel004 2y ago

Breaking shell scripts sounds like a good idea to me. The faster they die the better the world gets.

Rygian 2y ago
That's going to be a very bumpy road, even if everyone were to agree that the destination is appealing.
- bigstrat2003 2y ago
  Yeah for better or for worse compatibility is king. I despise shell scripts, they are an absolute nightmare to work with and full of footguns. But they are so commonplace that people are not going to tolerate YOLO breaking changes.
- raverbashing 2y ago
  Yeah I think ESH While we have more modern shells the fact that bash (or even sh) is the "common denominator" 30 yrs on is both good and awful We need a PowerShell for Linux
  - ygra 2y ago
    Not even that is free of footguns, especially around argument parsing and calling native commands.
chikere232 2y ago
Perhaps unix isn't for you?
makeitdouble 2y ago
Thing is, they don't die. Instead you get the short end of the stick. You'd have to be pretty darn important for an org to fix their scripts because of your name or the username you created. Of it would need to happen at a larger scale, but then that wouldn't be so controversial in the first place.

codedokode 2y ago

But spaces are allowed in filenames since 80s, didn't software had enough time to adapt?

michaelt 2y ago
Microsoft's Windows 95 put spaces into "c:\My Documents" and "c:\Program Files" so that developers targeting Windows were forced to support spaces in filenames. Of course, in those days if an OS upgrade broke some third party software, the end user paid for an upgrade. So although Microsoft forced developers' hands, the developers all got paid for their trouble. And you'd only have your hand forced that way once or twice a decade. Windows at the time was also all about the GUI file-pickers. Breaking the command line? Shell scripts? What are those?
- toast0 2y ago
  And now it's \Users, presumably because after 20 years, Microsoft gave up?
  - hwc 2y ago
    Or someone got tired of typing long paths.
  - Uvix 2y ago
    They changed from \Documents and Settings to \Users in Vista, alongside other profile rejiggering (e.g. introducing AppData folders). By that point software had either been fixed or would never be fixed, so keeping a space in the name wasn't particularly useful.
  - rcxdude 2y ago
    It's still very common for usernames to have spaces, though.
  - alterom 2y ago
    And now it's \Users, presumably because after 20 years, Microsoft gave up? Only if you assume that people rarely have spaces in their Windows login names (e.g. "Joe Smith"). Either that, or Windows users have learned to not be scared of spaces in filenames, usernames, and their own literal names.

rossy 2y ago

For people using NSS modules like winbind, most of those scripts are already broken

wolrah 2y ago

> Just imagine how many poorly-written shell scripts will break when we suddenly allow dollars, quotes, backticks and the likes in username. Heck, even allowing spaces sound like horror to me. If we're admitting they're poorly-written, why can't we admit that they're already broken regardless of whether that brokenness is currently being triggered? Allowing symbols or spaces didn't break anything, it was broken from day one just no one noticed. Why is the answer always "go out of your way to not upset the broken garbage that's been around forever" rather than "throw Zalgo at it and fix what breaks so it's no longer broken and won't be broken in the future"? Bug compatibility is the worst behavior of the computing industry. Let the bad code break and more importantly call it out so everyone knows where the blame belongs.

tsimionescu 2y ago
Because people don't care about the presence or absence of bugs, they care about getting their work or leisure done with the help of the computer. If the computer isn't working, then they can't get their work done, and so they are mad at whoever broke it (for example by upgrading it, or by adding a username with spaces inside it). If it's working, then they're happy, no matter how dangerously on the precipice it is.

raverbashing 2y ago

Yes yes it is Same for when people are being too clever and use a password generator with all the characters for things you need to call/pass on some types of config files No, you're not being smart for adding double quotes to a generated password, in fact quite the contrary. And guess who needs to try all types of escapes for that?! TFA seems like another of Debian's self inflicted problems by people trying to be "too smart"