8 ms·

>[1] yes this is an exaggeration No, it's not :(

tormeh 12y ago
It's just automated copy-pasting of commands you don't understand from the internet, which is something everyone who runs Linux (and is not a wizard) does all the time. It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. Unfortunately, this has never been a priority in Unix-land as far as I've gathered.
- TeMPOraL 12y ago
  https://xkcd.com/1168/ https://xkcd.com/1168/ comes to mind. And yes, I Google half of the command invocations too (but usually type them in by hand so that I can remember them faster instead of copy-pasting).
  - shanemhansen 12y ago
    I usually get tar right on the first try. I only have to remember 2 variants (extract file and create file): tar xf ./foo #automagically works with bz2 and gz files tar cf /tmp/out.tar . #add z for compression
    - TeMPOraL 12y ago
      Oh cool. So that works? I've already memorized: tar -xvvzf foo.tar.gz tar -xvvjf bar.tar.bz2 tar -xvvf baz.tar Thanks!
    - Gracana 12y ago
      That second one will create a tarbomb[1], which isn't necessarily wrong and maybe it's what's right for your application, but for more general usage this is friendlier: tar cf <mydir.tar> <mydir> [1] http://www.linfo.org/tarbomb.html http://www.linfo.org/tarbomb.html
    - markrages 12y ago
      And some of those switches are just for convenience, e.g.: tar c . | gzip > /tmp/out.tar.gz
  - falcolas 12y ago
    I don't get this. Tar isn't that hard. x = eXtract files from an archive f = File path to the archive c = Create a new archive from files v = print Verbose output z = apply gZip the input or output That's 99% of common tar right there. The remaining one percent is: j = apply bzip2 to the input or output (I admit, j is a weird one here, though that has made it stick in my memory) --list = does what's on the tin --exclude = does what's on the tin --strip-components = shortcut for dropping a leading directory from the extracted I haven't used a flag outside of these in recent memory.
    - TeMPOraL 12y ago
      It isn't, but so aren't dozens or hundreds of other commands you encounter when working with the command line. I managed to memorize a few invocations of tar (I listed them in another comment) but, for instance, I very rarely create a new archive so I'm never sure what flag I need to use. Part of the problem is that each command line utility has its own flag language, and equivalent functions often have different letters. For instance, very often one command has "recursive" as "-r" while another has it as "-R". It's impossible to remember it all unless you're a sysadmin.
      - xj9 12y ago
        You don't have to be a sysadmin to be comfortable with command line tools. If you want to fully utilize your *NIX system you have to learn how to use that shit, it really isn't that hard. (I'm a developer.)
        TeMPOraL 12y ago
        I am comfortable with command line tools. I just don't remember every switch and flag I happen to use twice a year, and the fact that command line utilities are totally inconsistent in subtle but significant ways, coupled with the overall unreadability of man pages and lack of examples in them makes this process difficult.
        Symbiote 12y ago
- stephenr 12y ago
  I would argue that anyone who is reasonably comfortable in a command line would resort to `man command`, `command --help` or `command -h` before googling for usage.
  - wflann 12y ago
    I think, occasionally, it's a lot easier to grok a command through googling than reading the built-in help. A fair amount of built-in *nix documentation I have run across is mediocre or unhelpful.
    - tormeh 12y ago
      Recursively searching through all files in the current folder (aka the normal use case for grep) is accomplished by using "grep -r". It's on line 270 in "man grep". And that assumes that you know what grep is at all. Would it have hurt so much to call grep "regexsearch" instead? Maybe -r could be the default?
      - jsight 12y ago
        I think a lot of people would hate having it be recursive by default.
      - markrages 12y ago
        Recursive is not the default use for grep. stdin-stdout filtering is. "regexsearch" is more work to type and more space taken up everytime 'grep' appears in a command-line. And says nothing about recursion.
      - gnaritas 12y ago
        Recursion is caused either by -R or -r on nearly all commands and is pretty standard, and r is virtually never the default on any command because that would be a bad idea. And yes, having to type regexsearch rather than grep would have been a bad idea; while grep isn't a great name it's far preferable to someone who types constantly. Search or find would have been better names, names need to be both short and descriptive on the command line, and short comes first.
- danieldk 12y ago
  It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. But it isn't all that hard to understand a clean Unix. I have never copied or typed a command that I don't understand. One problem may be that most Unices these days is not as clean anymore as, say OpenBSD or NetBSD. E.g. the recent X stack, with D-BUS, various *Kits, etc. is quite opaque. This madness was primarily contained to the desktop and proprietary Unices, but seems to spread through server Linuxes these days as well (and no, this is not an anti-systemd rant).
  - toyg 12y ago
    > But it isn't all that hard to understand a clean Unix. I have never copied or typed a command that I don't understand. Well, good for you. I can assure you that it's not the case for almost anyone who approached Linux after the likes of Mandrake were released and/or tried to make it work on anything different from a traditional server. I'm all for trying to understand what one is doing (and I wholeheartedly agree with TFA's point), but the reality is that very few people in the world really understand all intricacies of one's operating system. This does not excuse poor security practices, but it explains their background.
    - Twirrim 12y ago
      That's why you get someone who is capable of understanding it. You wouldn't hire some high school kid who's just about taught themselves HTML by reading a book for a week, and get them to write your web application from ground up. You'd hire someone who knows what they're doing. Why is it seen as any different for Operations work? There is a reason systems administration is a skilled field, and a reason they're paid on a par with developers.
      - redblacktree 12y ago
        I think the reason this happens less and less is that sysadmins are cost centers, not revenue generators. When you have developers do that work (poorly or not), you don't have a group that's purely cost. Those costs get hidden in the development group.
- marcosdumay 12y ago
  It's not the same by any measure. When you read the script in a browser, than pastes it in a terminal, you know that "scp -r ~/.ssh u@somehost.com" isn' there.
  - jannic 12y ago
    No, you don't: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
    - juliangregorian 12y ago
      Okay, but this relies on CSS trickery. If you had navigated to a text URL this would not be a vector.
      - shanemhansen 12y ago
        What's a text url? The only way I can see this not being a vector is if you browse with css (and javascript for good measure) turned off. Or use lynx.
        juliangregorian 12y ago
        A page of text? With Content-type: text? An example being a shell script?
        c22 12y ago
        Do you think the average user copying and pasting administrative commands into their shell will stop to check the content encoding of the document they are copying from? Do you trust your browser not to try rendering an ill-defined document with an ambiguous extension?
        recursive 12y ago
        Do you check the Content-type: header of the response for text/plain before copying? If you do, you'd be in the minority.
- briffle 12y ago
  Copy-pasting from the internet can be just fine, for things like (for example) yum install <blah> because the tool itself has built in checks to make sure you have a valid, non-corrupt installer before executing, from someone you trust.
  - michaelmior 12y ago
    The point is that what ends up on your clipboard can be different from what you see and if a new line is there, then the command executes before you have a chance to change your mind.

It's just automated copy-pasting of commands you don't understand from the internet, which is something everyone who runs Linux (and is not a wizard) does all the time. It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. Unfortunately, this has never been a priority in Unix-land as far as I've gathered.

TeMPOraL 12y ago
https://xkcd.com/1168/ https://xkcd.com/1168/ comes to mind. And yes, I Google half of the command invocations too (but usually type them in by hand so that I can remember them faster instead of copy-pasting).
- shanemhansen 12y ago
  I usually get tar right on the first try. I only have to remember 2 variants (extract file and create file): tar xf ./foo #automagically works with bz2 and gz files tar cf /tmp/out.tar . #add z for compression
  - TeMPOraL 12y ago
    Oh cool. So that works? I've already memorized: tar -xvvzf foo.tar.gz tar -xvvjf bar.tar.bz2 tar -xvvf baz.tar Thanks!
  - Gracana 12y ago
    That second one will create a tarbomb[1], which isn't necessarily wrong and maybe it's what's right for your application, but for more general usage this is friendlier: tar cf <mydir.tar> <mydir> [1] http://www.linfo.org/tarbomb.html http://www.linfo.org/tarbomb.html
  - markrages 12y ago
    And some of those switches are just for convenience, e.g.: tar c . | gzip > /tmp/out.tar.gz
- falcolas 12y ago
  I don't get this. Tar isn't that hard. x = eXtract files from an archive f = File path to the archive c = Create a new archive from files v = print Verbose output z = apply gZip the input or output That's 99% of common tar right there. The remaining one percent is: j = apply bzip2 to the input or output (I admit, j is a weird one here, though that has made it stick in my memory) --list = does what's on the tin --exclude = does what's on the tin --strip-components = shortcut for dropping a leading directory from the extracted I haven't used a flag outside of these in recent memory.
  - TeMPOraL 12y ago
    It isn't, but so aren't dozens or hundreds of other commands you encounter when working with the command line. I managed to memorize a few invocations of tar (I listed them in another comment) but, for instance, I very rarely create a new archive so I'm never sure what flag I need to use. Part of the problem is that each command line utility has its own flag language, and equivalent functions often have different letters. For instance, very often one command has "recursive" as "-r" while another has it as "-R". It's impossible to remember it all unless you're a sysadmin.
    - xj9 12y ago
      You don't have to be a sysadmin to be comfortable with command line tools. If you want to fully utilize your *NIX system you have to learn how to use that shit, it really isn't that hard. (I'm a developer.)
      - TeMPOraL 12y ago
        I am comfortable with command line tools. I just don't remember every switch and flag I happen to use twice a year, and the fact that command line utilities are totally inconsistent in subtle but significant ways, coupled with the overall unreadability of man pages and lack of examples in them makes this process difficult.
      - Symbiote 12y ago
stephenr 12y ago
I would argue that anyone who is reasonably comfortable in a command line would resort to `man command`, `command --help` or `command -h` before googling for usage.
- wflann 12y ago
  I think, occasionally, it's a lot easier to grok a command through googling than reading the built-in help. A fair amount of built-in *nix documentation I have run across is mediocre or unhelpful.
  - tormeh 12y ago
    Recursively searching through all files in the current folder (aka the normal use case for grep) is accomplished by using "grep -r". It's on line 270 in "man grep". And that assumes that you know what grep is at all. Would it have hurt so much to call grep "regexsearch" instead? Maybe -r could be the default?
    - jsight 12y ago
      I think a lot of people would hate having it be recursive by default.
    - markrages 12y ago
      Recursive is not the default use for grep. stdin-stdout filtering is. "regexsearch" is more work to type and more space taken up everytime 'grep' appears in a command-line. And says nothing about recursion.
    - gnaritas 12y ago
      Recursion is caused either by -R or -r on nearly all commands and is pretty standard, and r is virtually never the default on any command because that would be a bad idea. And yes, having to type regexsearch rather than grep would have been a bad idea; while grep isn't a great name it's far preferable to someone who types constantly. Search or find would have been better names, names need to be both short and descriptive on the command line, and short comes first.
danieldk 12y ago
It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. But it isn't all that hard to understand a clean Unix. I have never copied or typed a command that I don't understand. One problem may be that most Unices these days is not as clean anymore as, say OpenBSD or NetBSD. E.g. the recent X stack, with D-BUS, various *Kits, etc. is quite opaque. This madness was primarily contained to the desktop and proprietary Unices, but seems to spread through server Linuxes these days as well (and no, this is not an anti-systemd rant).
- toyg 12y ago
  > But it isn't all that hard to understand a clean Unix. I have never copied or typed a command that I don't understand. Well, good for you. I can assure you that it's not the case for almost anyone who approached Linux after the likes of Mandrake were released and/or tried to make it work on anything different from a traditional server. I'm all for trying to understand what one is doing (and I wholeheartedly agree with TFA's point), but the reality is that very few people in the world really understand all intricacies of one's operating system. This does not excuse poor security practices, but it explains their background.
  - Twirrim 12y ago
    That's why you get someone who is capable of understanding it. You wouldn't hire some high school kid who's just about taught themselves HTML by reading a book for a week, and get them to write your web application from ground up. You'd hire someone who knows what they're doing. Why is it seen as any different for Operations work? There is a reason systems administration is a skilled field, and a reason they're paid on a par with developers.
    - redblacktree 12y ago
      I think the reason this happens less and less is that sysadmins are cost centers, not revenue generators. When you have developers do that work (poorly or not), you don't have a group that's purely cost. Those costs get hidden in the development group.
marcosdumay 12y ago
It's not the same by any measure. When you read the script in a browser, than pastes it in a terminal, you know that "scp -r ~/.ssh u@somehost.com" isn' there.
- jannic 12y ago
  No, you don't: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
  - juliangregorian 12y ago
    Okay, but this relies on CSS trickery. If you had navigated to a text URL this would not be a vector.
    - shanemhansen 12y ago
      What's a text url? The only way I can see this not being a vector is if you browse with css (and javascript for good measure) turned off. Or use lynx.
      - juliangregorian 12y ago
        A page of text? With Content-type: text? An example being a shell script?
        c22 12y ago
        Do you think the average user copying and pasting administrative commands into their shell will stop to check the content encoding of the document they are copying from? Do you trust your browser not to try rendering an ill-defined document with an ambiguous extension?
        recursive 12y ago
        Do you check the Content-type: header of the response for text/plain before copying? If you do, you'd be in the minority.
briffle 12y ago
Copy-pasting from the internet can be just fine, for things like (for example) yum install <blah> because the tool itself has built in checks to make sure you have a valid, non-corrupt installer before executing, from someone you trust.
- michaelmior 12y ago
  The point is that what ends up on your clipboard can be different from what you see and if a new line is there, then the command executes before you have a chance to change your mind.