Hacker News Reader

Comment by brynet | Hacker News Reader

And yet another interesting GNU tar "feature", also noteworthy is remote tar:

https://www.gnu.org/software/tar/manual/html_section/tar_46....

> "If the archive file name includes a colon (`:'), then it is assumed to be a file on another machine. If the archive file is `user@host:file', then file is used on the host host. The remote host is accessed using [rsh]."

and

> "If you need to use a file whose name includes a colon, then the remote tape drive behavior can be inhibited by using the `--force-local' option."

On many systems, rsh is aliased to ssh, so if you don't properly sanitize your archive names, GNU tar will make network connections.

View on HN

Wow... I'm starting to get really scared of the shell, and how much hidden complexity there is waiting to trap the unwary. Feels like best practice for shellscripts is to only ever use them for one-offs. And that tar and friends should never be used as "helpers" by other programs.

Welcome to life.

What you are, rudely, implying is that what I am saying is already well known. I'd argue that isn't so.

Until recently shell-scripts was the way you inited a system. I still have almost 2000 shell scripts on my machine that I didn't write myself.

People got owned during shellshock, which means they did run helper programs, in web-facing applications even.

No, life is stuffed full of hidden complexities.

Complexities that are ready to bite the hand of the unwary at the slightest of chances.

Honesty i think the biggest lie in modern times is the MS/Apple lie that computing can be made so simple that even the proverbial aunt Tillie can do it without reading any sort of manual.

It's amazing how many programs that most people would consider "core unix utilities" totally eschew the (alleged) unix philosophy of "do one thing well."

That's probably a GNU thing. GNU's Not Unix, after all.

None of the BSD tar implementations support remote tar.

touché

Reply on news.ycombinator.com