Hacker News Reader

Comment by phs318u | Hacker News Reader

Back in 1989 I worked as a one-man-IT-department for a bunch of ex-academic economists doing econometric modelling on a Digital VAX 11/750. This mini-computer was running VMS - a multi-user operating system. All users had admin rights and each one thought that they could make their models run faster by bumping up the process priority as far as it could go - which of course interfered with the realtime processes needed to manage the effective running of the computer. Unsurprisingly, this had the opposite effect to what they intended. When I discovered this was what was happening, I revoked their privileges and after a system restart, sanity was restored. I was thanked for finally making the system work faster.

View on HN

There was a system that a bunch of students administered (I was one of the students at the time). We would occasionally prank each other. On this DEC station where memory was scarce, one guy ran emacs.

Another guy wrote a program that forked 1000 copies of itself, nice itself to 19, did a sleep(0) and then exit. As soon as it got any cpu time, it would exit, but it never would as long as emacs was running. Meanwhile, the load (as displayed by xload) became a solid black box.

So the emacs guy would run 'ps -ef | grep procname | xargs kill' as root.

This meant that it had to get some cpu time to handle the kill, which took longer than a sleep(0) and was largely ineffective.

The second time this prank was done, the process was named 'ema'... which promptly also killed all instances of emacs too.

The third time this prank was done, the process was named 'et'. This happened to have also matched /etc/initd and the machine rebooted rather suddenly.

We used to play pranks on each other such as logging into the NeWS server on a colleagues machine and manually setting a small rotation in the transformation matrix for a terminal window that someone was typing in....

NeWS had an interactive PostScript shell and almost no security so this kind of mucking about was trivial...

For april fools' day, on my first job as a troublesome ~16-year-old administering our university lab's firewall (academia was a different land when it comes to trust), I set up some automatic network-wide substring replacement filters for incoming HTTP responses to replace `<body` with something like `<body style="transform: rotate(0.1deg);"`. This was in the time before HTTPS was ubiquitous, so it worked on most websites.

Unfortunately, it broke some pages that lab users needed for school. I later learned one colleague wasn't able to complete a homework assignment because of my prank.

The joy of running Upside-Down-Ternet as transparent proxy on April Fool's day.

I last did this in about 2011-2012 and was shocked and/or pleased to discover many images on my friend's Xbox 360 dashboard turning upside down!!

Ah, good times.... we used to do similar things across the HP Apollo workstations at the place where a friend of mine worked (and I unofficially "borrowed" computing facilities for a project of my own -- though I did also contribute a substantial speed optimization to their main product, so nobody seemed to mind).

Somehow I've never considered what will happen on Unix if pid 1 exits!

Even though I'm pretty sure I've run with init=/bin/sh and then typed "exit" at some point in my single-user session, I have absolutely no recollection of the results. I should try it on a few OSes and see!

If PID 1 exits, the system usually panics immediately and restarts.

"Attempted to kill init!" https://github.com/torvalds/linux/blob/0b5547c51827e053cc754...

"...and that's why we have to put half a million lines of C in PID 1"

i'm reasonably sure that kill -1 1 used to be a canonical way to `halt`

I used to work with a long-time AIX kernel developer. His method of shutting off his machine was "sync; sync; kill -9 1".

Of course, his method of preparing to move offices (a common occurrence at IBM) was to

1. Take his (RS-6000) workstation home with him the night of the move.

2. Otherwise, just lock his desk.

He didn't have anything in his office but his chair, desk, and workstation.

As a random trivia about sysadmins: the reason he sync-ed twice is not because "twice is better than once, just to make sure".

Sync is not synchronous. When it is back to the shell there is no guarantee that data in memory is fully copied to disk.

However, it sets a flag that is reset when the copying is done. Sync will hang if the flag is set.

So the first sync arms the copy and sets the flag and is back to the shell.

The second sync starts, blocks at the flag. The flag gets reset and it is back to the shell.

So the 2nd sync going back to the shell is a guarantee that the first sync is fine and data is safe

Heck, you wrote an init on bash with the LNX-BBC (at least in some versions of it).

I'm pretty sure psdoom warns you against killing init

"occasionally"

Occasionally. It wasn't a daily, or even weekly occurrence. But, in all honesty those pranks were some of the things that helped my early sysadmin experience.

When you have nice, well behaved users you'll not have problems that need solving. When things go awry - that's when you'll need to solve problems... sometimes even without pranks.

Before we had yp set up on the machines, we just copied the password file between them with a note "make sure you change your password on foo" since that was the one we regarded as authoritative and would copy that to bar.

One time, while adding a person to the /etc/groups file for write access to the web server, someone did rcp /etc/groups bar:/etc/password (I suspect it was muscle memory) and, well, now bar was unhappy and wouldn't let anyone log in... or even su to root to fix it. Found someone who had an open terminal and had them do a while 1 sync... and then powered the machine down and brought it back up. It wasn't happy, so started up in single user mode. Just needed to get the password file in there... but the terminal was 300h which didn't have a proper termcap entry for vi or emacs to work. I was a mudder and knew how to use ed... so ed /etc/password and then the contents of the minimal password file were dictated to me. When done, we got it back up and then copied the password and groups files to the proper spots.

Another time (and this was a prank), someone left themselves logged in and someone else created a directory path that was about 3000 characters long. /user/jsmith/I/will/not/leave/myself/logged/in/I/will/not/leave/myself/logged/in/ ... The problem with this is that `rm -rf` won't handle paths longer than 2048 characters long. So it didn't get removed "I'll do it later." You know what else doesn't like paths longer than 2048 characters long? fsck. So when the machine was rebooted/crashed at some point, the root volume (yea, user directories were on the root volume) failed to fsck... and failed to mount. Stuck in single user mode with the backup partition and reading the man pages for mount on the other machine we found how to force a mount without fsck and then had the guy who did the extremely long path fix it (and promise not to do it again) and got machines working.

In 1993 my freshman CS class was taught in scheme. All of our assignments had to be developed and tested on some shared Digital machine running Ultrix. The scheme interpreter was kind of slow to start, especially when there were 20+ users logged in. Helpfully, our TA taught us how to ctrl-z to suspend the interpreter, then edit our program in vi, and then "fg" to get back into the interpreter.

Unfortunately the fg part of the equation was lost on about 2/3 of our class... after editing they would start another scheme instance! I recall being in the terminal lab the night one of our first assignments was due, and the machine slowed to an absolute crawl. Can't remember exactly how it was resolved but I do recall being taught how to look for classmates running two or more instances of scheme to remind them about fg. (Also not helpful to machine load: "solutions" to the 8 queens problem with infinite recursion. The real lesson here was, in later years, to not be logged in on nights when CS 401 had assignments due.)

I had a classmate who did her assignments in Ada. The compiler & linker would bring the school's Data General MV/8000 to it's knees, as it swapped out other processes to make room for it. Every 30-40 minutes we would have a coffee break forced on us.

When I was first learning Linux around 2006 I somehow got the idea that Ctrl-Z was the way to exit programs. For maybe 3 years, I would just Ctrl-z my way out of programs.

Luckily I worked almost entirely over ssh so I presume the suspended threads died with my ssh session exiting each day.

I had a similar story with a friend in college in the 2000's. He would always hit Ctrl-z'd to "close" emacs when logged into the server which would've been fine if he wasn't using screen or tmux as well. At some point, he was using a ridiculous amount of RAM on the server and the admins suspended his login to force him to come in.

Oh, my first internet access was through one of those in 1991 at college! Found a cool exploit that let me anonymously broadcast messages to anyone. Sure freaked out a lot of people. Was fun cause you'd get to see the effects of your action in real time because it was a bunch of people in the same room on shared terminals.

Around '84 doing seismic data. We just got a terminal in the office that would allow you to monitor the jobs running on the IBM mainframes downstairs. Completely new tech to all of us. It had a command line message capability. Because it was quite easy to send to all instead of just your recipient, one marriage ended rather suddenly. Seeing the effects of your actions with new tech in real time indeed.

Working at a hedge fund with multiple locations, the founder insisted that mail to “staff” would reach everyone at the local office and mail to “all” would reach everyone (in all offices).

One afternoon (in the middle of the trading day), we got a weird email with an empty body and a bunch of nonsense email addresses. Turns out some poor trader wrote an online dating email, but pasted/wrote the mail in the cc line, resulting in all of us learning that he thought “you don’t seem like all the other girls”, which was sent to you@, don’t@, seem@, and the dreaded all@.

Reminds me of WinPopup spam on Windows 95

Nice, reminds me of my high school computer lab. I wrote a trojan horse in VB6 and distributed it among the lab PCs somehow, then from mine I would open and close peoples CD trays, turn their monitor off, send them to... questionable websites where they would swear it wasn't them! Haha, good times.

A friend and I were able to phish passwords from nearly the entire school we went to with VB6 - the school (board) used active directory for logins on a shoddy network where some switches would often just drop all traffic to a random port for any length of time, meaning a PC would lose connection to the AD server at random. The kicker was that attempting a login after the connection was dropped greeted you with a "could not connect to //SCHOOL_BOARD//SCHOOL_NAME/PC_NAME" to which the solution was reboot the PC and it would work again (99% of the time, anyways). The other kicker was the background image and login domain were the same for every single computer at a single school. We exploited this; we created a full-screen/un-exitable UI with the same background image behind a form simulating the normal login screen. We would first login to our own account and run the program (there were no login limits either), at which point someone else later through the day would sit down and try to login. The credentials that got typed in were added to a .txt in my own user folder before the user rebooted the "non-functional" system. Of all the dumb shit we did, that's probably the only thing we never got caught doing, and probably because we never did anything nefarious with them.

Ha - did the same phishing thing with our RM Nimbuses in the school computer lab. Wrote a turbo pascal program that showed the same login UI as the Nimbus. Logged into my own account on all machines and ran the program. When someone "logged in", it wrote their username and pw to a text file, and rebooted the machine (which got the user to the real login screen). Never got caught for that either, but also don't remember doing anything malicious with the info - I think it was more about the fun of the challenge :)

“Cool exploit“? Like net send? :)

I was banned from the school computer suites several times for (ab)using net send. Good times.

On our high-school network, the Guest account had NET SEND privileges. It was somehow less chaotic than one might expect.

We had a single shared T1 pipe for the whole district. Which was enough for email and stuff, but when web browsers got popular, it was suddenly woefully inadequate.

So I figured out I could NET SEND * SERVER ROOM POWER FAILURE - 9 MINUTES OF BATTERY REMAIN - SAVE YOUR WORK AND LOG OUT and after a flurry of traffic, the network fell to nearly-idle. I could max out the T1 with whatever I needed to do for a few minutes, then NET SEND * SERVER ROOM POWER RESTORED and nobody would be the wiser.

The admin did go check on the "flaky UPS" a few times before looking closely at the message. Had a good laugh and told me not to use it too often.

This is along the lines of my early days learning about computers at school. I saw executables were filled with weird junk when looked at in a text viewer. So I'd load a little of that junk in a file and add

CRITICAL DISK ERROR. TURN OFF SYSTEM TO AVOID CATASTROPHIC DATA LOSS

and then printed it out to a system printer students didn't have access too. So you got a page of random symbols and that error.

Little did I know the company adding more computers to the network was there that day and the guy panicked and had the system shut down, it was down the next day too. I never did ask what happened to bring attention to myself, and this was before we had individual accounts in the system.

A great story and true BSOD material!

BOFH?

Thanks. This was what I was going for but my brain had other ideas.

I remember someone getting a bit wild with their netsend and accidentally spamming the entire school district, including the administration. We also found out that you could DoS your instructor with enough messages.

the key "feature" of the exploit was the ability to send messages anonymously. the unix commands "write" and "wall" allow you to send a message to any users terminal.

apparently "wall" has a switch "-n" to hide the sender

https://unix.stackexchange.com/questions/99460/sending-messa...

for windows there was "net send" which could be exploited by a tool called NetSendFaker, but this was 1991, so i doubt that already existed.

There was a time on some UNIXes where you could just write to other people's ttys, no write/wall needed, just echo >/dev/...

Making write/wall sgid, and restricting tty write access to that group, was a significant security upgrade back in the day.

I was able to use samba to generate these messages such that they looked like they came from other users in the lab. We had a lot of fun with that.

I remember in the mid to late 90's when you could get spam from outside of your network via net send. Happy days...

Wall

Great example of the economic principle The Tragedy of the Commons: https://en.m.wikipedia.org/wiki/Tragedy_of_the_commons

That reminds me of a story from a guy I worked with.

I'm not sure where he worked but it involved a queue of people. He said someone asked him if they could be given priority for their problem to be looked at before others in the queue. In other words jump to the head of the queue.

He said "Sure!" to the surprise of the person asking "But you do realize I will do that for anyone else who asks the same thing?"

So they person chose to remain in their place in line.

I remember going along to a VAX/VMS System Administration workshop. Another bloke and I did a prank where we substituted text of the text editor that would produce blinking "Working" if it got busy. We substituted "or" with "an". The workshop coordinator caught us because we forgot to do something I can't remember and a login was tied to the change in the executable.

Happy System Administrator's Day!

Economy is all about incentives and behaviors. Did they learn any lessons from how they acted during the episode? And hopefully published a whole bunch of papers from it?

> All users had admin rights and each one thought that they could make their models run faster by bumping up the process priority as far as it could go - which of course interfered with the realtime processes needed to manage the effective running of the computer

It amazes me what the bios and OS or OS api's let you do, even on modern devices.

> It amazes me what the bios and OS or OS api's let you do, even on modern devices.

Same, but not necessarily in a negative way. I like pushing my hardware and software to the limits, becoming unable to push those limits would be pretty disappointing.

I'm not sure anyone should call VMS "modern", but that's beside the point ;)

VMS has a very comprehensive system of quotas and limits, so a "properly" configured system wouldn't suffer those issues.

And furthermore, VMS isn't intended to be used "interactively" as such. You should be submitting work to the built-in batch queues - each with various attributes that can include the priority level. This allows the system to intelligently manage work based on a comprehensive view of the entire system - something a single user in a multi-user system can't have. If you like pushing a multi-user system to its limits, you'd be impressed with what VMS could do even way back in the 1990s.

We don't typically use multi-user systems, actually - I'm pretty sure Logan meant our personal hardware. For example, we run an i5-12400F at 5.2GHz and run a fairly customized Windows 11 Enterprise, both of which would become impossible if our BIOS and operating system were too much more locked down.

I mean, our motherboard has an external clock generator almost entirely dedicated to pointing and laughing at CPUs with a "locked multiplier". (It's also used for PCIe 5.0)

-Emily (see HN profile for details)

We don't typically use multi-user systems, actually

Isn't pretty much every "cloud" nothing more than an elaborate multi-user system?

okay, then we don't own computers that are intended to serve multiple physical users. They may run multi-user operating systems but ours are typically configured with only one actual user*.

*ignoring all the system and service users in OSes like Windows and Linux.

-Emily

> i5-12400F at 5.2GHz

Overclocking. Profile explains why. For security I prefer single cores, but have to work with whats available.

> Overclocking. Profile explains why.

Not sure whether you're referring to your or our profile, but yes, we do overclock to a significant degree. Our motherboard has a setting to downgrade the CPU microcode to an older version that doesn't try to detect higher clock speeds and shut down. Clearly, stuff is already getting more and more locked down even as we enjoy our relative freedom in the present.

-Emily

Running code on a priority thread enables interception of data on a normal priority thread which can then invalidate the data.

Its a problem I'm facing at the moment, trying to keep the data as it moves around the hw, tamper proof.

Intel CPUs are designed with certain characteristics, which can highlight thread priority attacks.

Cant comment on ARM or AMD yet, havent tested them.

I had something of the opposite experience.

Digging into the manuals I figured out how to launch the compiler as a background process so I could still have a working system while waiting for it. Brought the whole classroom to a halt.

More digging revealed that the background priority was set well above user priority. AFIAK no malice involved, just someone who didn't know how to set the system up and left that landmine for me to find.

Had exactly the same with a bunch of developers who could change the queue priority on a mainframe for their own work. They couldn't work out for themselves that if everybody set their work to the highest priority it had no benefit to any of them. Trying to educate them failed, so we revoked access.

If a group of economists can’t coordinate their behavior to prevent tragedy of the commons then they should rethink their career and life choices.

A group of economists couldn't coordinate splitting a bill at Applebee's.

Applebee's... Does not compute.

On the contrary, it was a rational attempt to limit their ability to break things.

A bunch of economists couldn't play nice?

Behaving like perfectly rational actors, of course.

That's like complaining that real world physicists don't behave like frictionless spheres in a vacuum.

But they were, economic rational actors behave in their own self-interest

Getting his software stuck and then kicked off the computer is his self interest?

Wow, you annoyed someone enough to get your comment hidden, impressive.

Reply on news.ycombinator.com