Hacker News Reader

Comment by mbrock | Hacker News Reader

I use it when I for some reason need to do something like "delete line 398". Just open ed and do "398d" and "wq". That's my habit for deleting stale entries in ~/.ssh/known_hosts.

For a while I maintained a .html blog using only ed, just for the fun of abstaining from conveniences and learning to use an ancient program. It's somehow nice to know that it's possible.

View on HN

They recently added ssh-keygen -R to remove entries from the known_hosts file, it's been a big time saver for me. I wish more server providers would tell you the keys your server is using though so you don't have to play the TOFU (Trust-On-First-Use) game.

In this case, recently means 2005 when OpenSSH 4.0 was released so you can assume it exists even on things like Red Hat:

https://www.openssh.com/txt/release-4.0

Interesting, I only learned of it recently, it seems a patch was added to Ubuntu called "mention-ssh-keygen-on-keychange.patch" which puts explicit mention of ssh-keygen -R into the error message, I had assumed it was part of openssh itself and arrived at the same time.

This patch was explicitly rejected in upstream openssh as they said it could lead people to copy and paste it without considering attacks - but ignored the fact that by just telling people what file it was in, many people just deleted the file in response and those who did it right, deleting just the relevant line in cases where a key change was expected like my situation, never discovered the easier ssh-keygen -R method.

Perhaps they shouldn't offer a copy and paste solution, but mentioning that ssh-keygen is capable of it and to see the docs would be nice at least...

This is a common problem with open source projects which don't have huge doc/PR teams — I've seen so many times where someone reinvented something because it was obscurely documented or used a different term than they thought to search for.

Or just stuff them into the DNS in the form of SSHFP records, where the OpenSSH client will read it from.

This assumes authenticated DNS data, of course. Not at all a given today, sadly.

sed is easier! You can do it with a oneliner:

`sed -i '398d' ~/.ssh/known_hosts`

I do this all the time. In fact I have a function in my .bashrc for this at work since I use it so much:

`function sedkey() { sed -i "${1}d" ~/.ssh/known_hosts }`

so I can run `sedkey 123` etc. Just another way to skin a cat I suppose.

The sed version is more keystrokes. Is ENTER so much more costly?

More keystrokes, but fewer lines of terminal output. Why have 5 lines of output when I don't want any?

  ktm5j@kurma /pool/share/pkgs $ ed ~/.ssh/known_hosts 
  130923
  398d
  wq
  130755

Sed just quietly does what I want. Like I said, just another way to skin a cat, do whatever works for you.

You can use the -s flag to avoid two of those lines of ed output.

You can put the sed version in a cron job

I suppose that's not what you meant, but I cannot stop thinking of the poor sysadmin whose files keep getting unexpectedly trimmed to exactly 397 lines.

Also, btw, you can absolutely use ed in scripts [0], but this is also something that I would pity the maintainer of.

[0] https://www.ibm.com/developerworks/community/blogs/brian/ent...

Interesting. For small things like that I tend to use sed eg sed -e 398d -i .ssh/known_hosts

For larger things I find vi or something else of that scale more convenient. Ed just seems to fill a space between the two that I never need.

You can do the same thing (for me too, ~/.ssh/known_hosts is the most common use case) with GNU Nano: nano +[line number] [filename], then Ctrl-K, then save and quit.

Nice! Also applies to kate:

kate filename:line

CTRL+K (or CTRL+D to comment out), CTRL+S, quit (current tab: CTRL+W, Alt+Tab or app: CTRL+Q)

Particularly useful when the output of the previous command (compilation for instance) already contains filename:line. Then double click, middle click paste works well.

or: kate filename

CTRL+G line <Enter>, CTRL+K, CTRL+S, quit.

(yet another) one liner:

ed the_file <<< $'398d\nwq'

edit: another one liner but still using ed I guess.

Reply on news.ycombinator.com