Hacker News Reader

Comment by Brian_K_White | Hacker News Reader

I was about to say "Which is essentially leaking the existence of something terrible inside. They should be embarrassed to say something like this in public. Like saying you can't have %s or $PS1. Why the hell not? What are you doing with this user-supplied input?"

But maybe it's more about what everyone else might do with a channel name. Ie they might cut & paste it anywhere, and I guess windows users aren't expected to escape their own strings when pasted into cmd or powershell or wsl.

View on HN

The Something Terrible in this case is early DOS which did not have separate folders. So the device files were in the same namespace as the user's files, so the user couldn't name a file CON or LPT1. These are preserved for backwards compatibility. To this day you can write a program that writes to a CON file in any folder, and the program will print the write to console.

Another interesting aspect of this, which I remember specifically from reading MS-DOS manuals in the 90s as a kid (I was an incredibly fun 12 year old) is that this choice was an intentional one done in the name of flexibility. These device names were correctly written with a colon, but you are allowed to omit the colons. For instance:

copy con lpt1

And

copy con: lpt1:

were interchangeable. If they’d chosen to not save users keystrokes and force colons when referencing devices, I’m not positive, but I think it would have eliminated the need for many of these reserved words in file names in general.

Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux!

> Also, side note, the “copy con outputfilename.txt” idiom is one that I still can’t ever remember how to do the equivalent on UNIX/Linux!

cat > outputfilename.txt

But it's not CTRL-Z to end, right? That's the part I forget every time :D

One of my favorite bbs sig tags was "REAL programmers use COPY CON FILE.EXE"

This has actually changed a bit in the last few years. In Windows 11 writing to `.\CON` will write to the file but writing to `CON` will still write to the console.

> What are you doing with this user-supplied input?

Creating Sharepoint shares which can be mounted as network shares in Windows where these filenames are not allowed?

I thought this as well but there's plenty of dangerous commands that aren't escaped here. I'm assuming it's a limitation of it actually writing something to the filesystem, hopefully your own (with the desktop app) and not one in Azure.

> I was about to say

Yet you said it twice[1].

[1] https://news.ycombinator.com/item?id=37076913

Reply on news.ycombinator.com