3 ms·
How did this extremely poor written and technically incorrect article make it to the Hacker News front page? This "trick" is absolutely trivial. What's next, t
by 4ad 14y ago
How did this extremely poor written and technically incorrect article make it to the Hacker News front page?
This "trick" is absolutely trivial. What's next, the trick about using grep to search through files? The author's lack of competence is evident due to the improper way of using su, the extremely weird idiom of sourcing the profile where it is not required and representing su as being useful for running untrusted binaries.
Simulating a login is usually not what you want. Sometimes it is, most often it is not. The author simulates a login but does not tell you why would you want to do it.
Su takes arguments that can be passed to the started shell. In particular -c can be passed to the original shell started bu su[1]; no need to start a second shell. This is not used here. Starting two shells instead of one is hardly a crime (I always do cat file | grep something instead of the more effective grep something file) but misrepresenting how su works is. In particular su does not work like "su - user cmd", as he claims, su works like "su [login [args]]" where args are passed to the started shell. The author does not understand su therefore he is not capable of writing an article about it.
The fact that he just simulated a full login only to run a non-interactive shell that manually sources .profile is hilarious, but the fact that he says chroots are good for running untrusted code is dangerously misleading.
[1] Interestingly GNU su takes -c by itself rather than passing it to the shell, but the effect of su user -c cmd is the same in BSD and Linux, although for different reasons.
- StavrosK 14y agoWhat's the difference between a login shell and a plain one?
- 4ad 14y agoI believe the following links explain it pretty well: http://unix.stackexchange.com/questions/38175/difference-between-login-shell-and-non-login-shell http://unix.stackexchange.com/questions/38175/difference-bet... http://serverfault.com/questions/8882/what-is-the-difference-between-a-login-and-an-interactive-bash-shell http://serverfault.com/questions/8882/what-is-the-difference...
- StavrosK 14y agoThey do indeed, thank you.
- pkrumins 14y agoThanks for the great comment! I just updated the article and explained that I misunderstood how "su" works. I also removed the statement about running untrusted binaries. I had simply added it to the article without thinking much to have a closing line for the article. I found sourcing the profile trick useful in case the chrooted users need a customized environment such as custom PATHs or something else user specific.
- thaumaturgy 14y agoHow did this rude and in poor taste comment make it to the top of the thread? Peteris is a solid HN contributor with 216 submissions to date, many of which focus on math or programming or shell tricks, which puts him head and shoulders above those that submit the daily sewage from techcrunch.com (or those, like me and you, that don't submit at all). Here's a quick sample of some of his top HN submissions: 1. Announcing his business, making virtual machines accessible over the web (and open-sourcing the code behind it): http://news.ycombinator.com/item?id=1534973 http://news.ycombinator.com/item?id=1534973 2. An introduction to pipe viewer: http://news.ycombinator.com/item?id=462244 http://news.ycombinator.com/item?id=462244 3. Top Ten One-Liners from CommandLineFu Explained: http://news.ycombinator.com/item?id=1200900 http://news.ycombinator.com/item?id=1200900 4. Low-level bit hacks: http://news.ycombinator.com/item?id=1811104 http://news.ycombinator.com/item?id=1811104 5. Using Fibonacci Numbers to Convert from Miles to Kilometers and Vice Versa: http://news.ycombinator.com/item?id=1050151 http://news.ycombinator.com/item?id=1050151 6. How I went to Silicon Valley and raised $55,000 for Browserling: http://news.ycombinator.com/item?id=2808314 http://news.ycombinator.com/item?id=2808314 7. How to steal a botnet: http://news.ycombinator.com/item?id=1072225 http://news.ycombinator.com/item?id=1072225 etc. And, his submissions often provoke even greater discussion in comment threads, even when they contain a mistake (as in http://news.ycombinator.com/item?id=3684515 http://news.ycombinator.com/item?id=3684515). Peteris is legit (and a really nice guy besides). No matter how much you know, it's likely that he's written about something you don't know. He has earned enough respect from the HN community that he deserves to have corrections to his articles submitted gracefully and with tact, not with accusations of incompetence.