No Easter Eggs in Curl

If they are security risks, why are they not removed?

> I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.

I think it’s hard to think of the problem that way.

These days* of course you have to worry about security on almost anything you work on. And when you do, the folks who think of security all the time are going to tell you to simplify your interfaces so they are easier to think about, then then armor them. What a pain!

But we do those things because of all the bad actors. The security recommendations are a consequence, not the cause.

* I grew up — literally — in a non-security environment: networked computers with no passwords or any other security. The only “protection” what would be called today kernel space memory barrier just to protect against bugs, and most machines didn’t have that. It was the late 70s and security was considered a barrier to hacking. I knew people working on security and frankly it seemed weird.

It's more of a risk/reward thing. Any code on a networked computer has non-zero risk. And what's the reward... an engineer had fun at work today? That's not a very compelling argument in a business context.

I say this as someone who snuck an easter egg into our product at my last job. Yes, it was fun, but if I had gotten in trouble for it, I would have deserved it.

> I think this is really why we can't "have fun" anymore. Because bad actors exist and can exploit things being done "just for fun".

That's often how things works. With friends we joke around a lot because we know each other well and know there aren't bad actors. At work, I'm way more careful. If there were no cases of harassement, exploitation or things like that at work I may joke around more. But since they exist, I'm more careful. I don't want to harass people, be seen as an harasser, or create an atmosphere were harassers feel welcomed.

When bad actors exist, the way to show good will is to not act like them, so they can be quickly identified and removed.

MoTD and have fun all you want for people who should have access.

This is precisely why it's useful for fingerprinting -- If you get this response, you know that an old, out of date version of PHP is in use.

Unfortunately it is (or at least was) enabled by default.

By knowing the version, you can more efficiently determine which CVEs may apply, surely?

The arsenal of attacks includes "let's try and figure out server version", too.

Because if you know the version, it gives you a shortcut, and you can immediately switch to a smaller arsenal designed for that specific version.

While a bit of an extreme scenario, I can imagine it being useful for high-level actors with their own private vulns which they'd like to keep on the down low unless absolutely necessary.

Exploiting a memory corruption vulnerability depends on the exact details of the software version and platform. Attempting the wrong exploit risks crashing the process, which might be noticed and investigated.

Not sure why you're being downvoted. Your question is reasonable and any attacker worth their salt will fire a full arsenal of all the CVE's at your environment regardless of version.

Hiding version numbers etc is an example of "Security through obscurity" and is a weak defence strategy:

https://en.wikipedia.org/wiki/Security_through_obscurity

I understand your argument; but it sounds to me like you expect hobby projects to be paying your wage.

I know we stand tall because we stand on the shoulders of giants (and, in our industry: many giants!) but I don't think you can expect any form of guarantee that curl continues to work exactly like you expect unless you're paying for it.

It's a different story if you have some kind of enterprise contract, but somehow I have the impression that we're all using cURL for free and paying nothing for support-- thus, there is no support and you shouldn't really expect any.

If you want to make cURL-Enterprise then that's fine..

but it's a bit unfair to co-opt someone else's project just because you and I chose to use it professionally.

(this applies to me also: I am guilty of this, I'm not pointing fingers at you specifically; just my, and our, collective attitude)

Looking at it another way, you didn't need to set up any tooling to shepherd data into production because everyone involved understood the point of the joke. It was a very clear example of GIGO for your entire company and the cost was one meeting.

A lot of my joke errors boiled down to "you've hit an edge case I didn't handle, here's an easily searchable string to find the location". They were jokey because the subtext was another late night and you might as well soften the blow.

I'd also argue that jokes in the business world aren't that funny; they feel like advertising in another form, an attempt to ingratiate a brand through emotional means.

Hang on, this exact situation is like if I make a cake, and as people walk by and see it, they want a slice too. So I say "sure have a slice, its free cake, I made it for myself but it's also free for you".

The person who decides that their steakhouse is going to make my free cake the centerpoint of their dessert cart and then expresses dismay that I like cream cheese icing on my free cake can fuck right off and bake their own cake.

In this case the author is saying that they don't do easter eggs because it would cause an erosion of trust, and that's fine, that's their prerogative and I get it. HOWEVER, let us not be fooled that there isn't an outrage contingent waiting to pounce every time someone dares to make free software the way it is most useful/accurate/fulfilling for themselves. This causes a chilling effect for a portion of us who write free software.

These are not the same! Plumbers don't make piping for fun and then allow others to use it for free.

> This has also coincided with a sharp increase in code size and decline in quality

Lol this is one hell of a claim to just slip in.

Sure. Was only debunking the false premise that it needs to be secret, which the article highlights as why it's a really bad idea.

I mean Python has all the functionality of curl (potentially, at least) and it has an Easter egg.

At the same time, I could see someone launching an attack with a module “this.py” that outputs the Zen of Python and also installs a back door.

Come to think of it, one of the nastiest problems in Python programming is keeping track of which modules are in the PYTHONPATH (“hmm why is ‘pytest tests/test_my_module.py’ throwing an import error?”)

Maybe Easter eggs are a bad idea?

That wasn't behind a flag.

Really, I'd call that a prank, which is bad taste in software, not an Easter egg.

It goes to show that even stuff that I would consider rock solid (such as man pages) can be surprisingly brittle if one person can make a change over a tweet.

Some comments on the SO thread seem to imply that it shouldn't have been removed but I don't think this was a "good" easter egg. The joke is good, but it should have been harder to trigger (in my opinion).

The linked article is only a few hundred words long. It probably took Daniel half an hour to write. It would take far longer to write, integrate, test, document, and maintain even a simple easter egg to the same quality standards as the rest of the curl project.

That last bit is key - to the same quality standards. curl is a really well-done, carefully-built-and-tested project. If we were talking about most other pieces of software - yes, a small easter egg wouldn't have taken much effort. Not in this case.

If someone else had volunteered to take on all of the effort of maintaining the easter egg, Daniel might let it in - but that would still be more work on his part to rope them in to test their thing after every change to code adjacent to the feature.

Conversely, nobody prevents you from forking curl and adding the easter egg in yourself. Why don't you?

But it's not a lawn. It's a critical tool. Do you want your car's brake system to have easter eggs? What about your smoke detectors?

There's no need to gate-keep software development. People do it for all different purposes.

I've ported fortune to Win32, and now have it show me a nice quote whenever I open a Command Prompt. It was feature I always wanted to have, and gave up waiting for MS to provide it.

For me, my first ever experience of fortune was on DEC VMS systems.

Thanks for that! I added -a to fortune, so every once in a while (but not always) I get an offensive aphorism -- yes, I am willing to be offended! NOTE: this may require installing the offensive fortunes package.

Never had the pleasure. I skipped the whole configuration management era and went straight from Windows "click around the UI following this manual procedure" to cloud-config and IaC.

Wow, found recently, too.

My entire premise is that you are wrong on all counts. Your ideological point is balanced by the fact that no one cares in reality. `apt-get` and other tools are used in critical systems all day long, and Krebs isn't blogging about it. Easter eggs aren't causing outages and data breaches. The fact we're discussing it all is a form of bait; the entire discussion is useless and distracting a-la Twitter culture wars, but we're addicted to the debate of minutiae.

The only point I acknowledge is part two of point #3: They have better things to do, especially if, as the author says, they constantly ship buggy code.

I'm almost ashamed for having spent any time responding to the original submission, butb here I am. I agree, it is much ado about nothing.

Of all the data breaches, of all the zero days, of all the massive bugs found in open source software, how many have been caused by Easter eggs?