Comment by retube | Hacker News Reader

Comment by retube | Hacker News Reader

Hmmm. Ok so this guy uploaded both OS and Goldman-authored code - as stated in the article. And uploading pure OS code wouldn't make sense anyway as it would be available anywhere. And did so immediately prior to taking a principle role at a competitor start up - no wonder they checked. He knew he was doing something wrong - as stated in the article - and his reason for deleting his bash history makes no sense (surely bash doesn't cache passwords) - indicating he was trying to cover his tracks.

They're gonna want to protect their IP - particularly when it could give a competitor a huge advantage. It's not surprising they went after him.

I assume he was performing some sort of authenticated action - e.g. against the svn repository - and providing the password as a command-line argument rather than interactively. This would not only leave the password in the history, but would make it visible to anyone else on the machine who runs ps whilst the command is executing. It's terrible security practice, but I've seen it done more times than I can count.

> surely bash doesn't cache passwords

It does if you're careless enough to type them out in clear text, e.g. when connecting to a mysql database:

    mysql -h host -u user -pMyPassword database

Useful tip: with

  HISTCONTROL=ignorespace

in your .bashrc, if you start a line with a space, it won't be entered into your history.

Reply on news.ycombinator.com