4 ms·

That's kind of scary — in that case I guess I should avoid creating a file named -rf.

by gmac 12y ago

wodenokoto 12y ago
That is really interesting. Can someone knowledgeable about the shell expand on this? I don't dare test it on my machine.
- vbezhenar 12y ago
  Shell session to demonstrate (DO NOT DO IT IN THE DIRECTORY WITH IMPORTANT FILES): $ touch important $ chmod 400 important $ rm * override r-------- vbezhenar/staff for important? n $ touch -- -rf $ ls -l total 0 -rw-r--r-- 1 vbezhenar staff 0 Mar 24 14:35 -rf -r-------- 1 vbezhenar staff 0 Mar 24 14:35 important $ rm * $ ls -l total 0 -rw-r--r-- 1 vbezhenar staff 0 Mar 24 14:35 -rf $ rm -- -rf
- theothertom 12y ago
  I've not tested it, but it should expand just like anything else. The effect would broadly be that running "rm *" in the directory would recurse into subfolders without warning.
- pbhjpbhj 12y ago
  Re testing. If you follow this link - https://www.digitalocean.com/?refcode=3fc9a5a35c52 https://www.digitalocean.com/?refcode=3fc9a5a35c52 - you get $10 free credit (affiliate link I get $25 if you spend that much in future) on DigitalOcean. You can spin up a droplet and use the online shell tool or ssh in (very easy when you've set up a cert as the droplet can have the cert setup automatically). Then you can mess about with a droplet as much as you like, virtually speaking. Once you're done then use the control panel to destroy the droplet - it costs a few ¢ a day and if you don't have a droplet in use (which means active or paused; preserving images is cheaper but non-zero) then you don't pay anything. Basically sign up and have a year of uptime to mess with a full install of various OS with no charge. Make sure you don't write "rm -rf /*" in the wrong terminal!
coldpie 12y ago
Yes. There was an article linked from HN ages ago (at least a year) that went into mitigation techniques for these issues. As you expect, it basically became fractal, and even then still had bugs. I wish I still had the URL.
un1xl0ser 12y ago
I think it may be more scary for code that allows arbitrary execution using command-line arguments. Commands like find or xargs using without defense against this would be a problem. For example, site that does something precious with your uploaded pet pictures. Defending against this being the use of -- to signal an end of command line arguments.

That's kind of scary — in that case I guess I should avoid creating a file named -rf.

by gmac 12y ago

That's kind of scary — in that case I guess I should avoid creating a file named -rf.

That is really interesting. Can someone knowledgeable about the shell expand on this? I don't dare test it on my machine.

vbezhenar 12y ago
Shell session to demonstrate (DO NOT DO IT IN THE DIRECTORY WITH IMPORTANT FILES): $ touch important $ chmod 400 important $ rm * override r-------- vbezhenar/staff for important? n $ touch -- -rf $ ls -l total 0 -rw-r--r-- 1 vbezhenar staff 0 Mar 24 14:35 -rf -r-------- 1 vbezhenar staff 0 Mar 24 14:35 important $ rm * $ ls -l total 0 -rw-r--r-- 1 vbezhenar staff 0 Mar 24 14:35 -rf $ rm -- -rf
theothertom 12y ago
I've not tested it, but it should expand just like anything else. The effect would broadly be that running "rm *" in the directory would recurse into subfolders without warning.
pbhjpbhj 12y ago
Re testing. If you follow this link - https://www.digitalocean.com/?refcode=3fc9a5a35c52 https://www.digitalocean.com/?refcode=3fc9a5a35c52 - you get $10 free credit (affiliate link I get $25 if you spend that much in future) on DigitalOcean. You can spin up a droplet and use the online shell tool or ssh in (very easy when you've set up a cert as the droplet can have the cert setup automatically). Then you can mess about with a droplet as much as you like, virtually speaking. Once you're done then use the control panel to destroy the droplet - it costs a few ¢ a day and if you don't have a droplet in use (which means active or paused; preserving images is cheaper but non-zero) then you don't pay anything. Basically sign up and have a year of uptime to mess with a full install of various OS with no charge. Make sure you don't write "rm -rf /*" in the wrong terminal!

coldpie 12y ago

Yes. There was an article linked from HN ages ago (at least a year) that went into mitigation techniques for these issues. As you expect, it basically became fractal, and even then still had bugs. I wish I still had the URL.

un1xl0ser 12y ago

I think it may be more scary for code that allows arbitrary execution using command-line arguments. Commands like find or xargs using without defense against this would be a problem. For example, site that does something precious with your uploaded pet pictures. Defending against this being the use of -- to signal an end of command line arguments.