Hacker News Reader

Comment by QuadmasterXLII | Hacker News Reader

This doesn't seem conceptually different from running

    [ $[ $RANDOM % 6] = 0 ] && rm -rf / || echo "Click"

on your employer's production server, and the liability doesn't seem murky in either case

View on HN

What if you wrote something more like:

    # terrible code, never use ty
    def cleanup(dir):
      system("rm -rf {dir}")


    def main():
        work_dir = os.env["WORK_DIR"]
        cleanup(work_dir)

and then due to a misconfiguration "$WORK_DIR" was truncated to be just "/"?

At what point is it negligent?

This is not hypothetical. Steam and Bumblebee did it.

That was the result of an additional space in the path passed to rm, IIRC.

Though rm /$TARGET where $TARGET is blank is a common enough footgun that --preserve-root exists and is default.

You'd be surprised to see how often we're seeing those types of semantic attack vulnerabilities in Agent frameworks: https://niyikiza.com/posts/map-territory/

Even better, $TARGET might be "/home/user/documents and settings /bin"

I believe that is what staticassertion was suggesting. / is a poor example because of --preserve-root being the default.

Not quite. The grandparent's example was missing quotes around $TARGET. Which is yet _another_ footgun.

Without quotes it becomes: `rm -Rf /home/user/documents and settings /bin`

Found it. is was this line [0] specifically. "rm -rf /usr /lib/nvidia-current/xorg/xorg" instead of "rm -rf /usr/lib/nvidia-current/xorg/xorg", which will delete all of /usr and then fail to delete a non-existent directory at /lib/nvidia-current/xorg/xorg

0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/commi...

Bungie, too, in a similar way.

Reply on news.ycombinator.com