HNHacker News
TopNewBestAskShowJobs

collinfunk

618 karma · joined December 8, 2023

submissionscomments
collinfunk··on Upgrade your desktop: Ubuntu 26.04.1 LTS is now available
The [2] link is uutils using the test suite that the GNU coreutils maintainers, including myself, created and continue to improve. This test suite has long predated uutils and gets equal, if not more, man-hours than the program implementations themselves.

When you say that no one bothered to do this testing until uutils existed, it feels like you are discrediting our work. Any other implementation is free to use our test suite, as long as they respect its licensing. Doing so is relatively straightforward; you just need to point a shell variable to the place with the just-built binaries.

Note that the man pages are a quick reference explaining the options. A lot of gotchas and further explanations are located in the texinfo manual, which is over 300 pages in PDF form [1]. If you notice areas where it could be improved, I would be happy to review your bug report sent to bug-coreutils@gnu.org.

[1] https://www.gnu.org/software/coreutils/manual/coreutils.html

collinfunk··on A 32-year-old bug walks into a Telnet server
As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled:

    Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing).
The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch.

Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting.

[1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [3] https://www.openwall.com/lists/oss-security/2026/03/12/4

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
As I have told the authors privately, I find it quite difficult to take their claim that they "don't care about licensing" seriously. 13/14 of the projects under uutils are relicensing GNU or GPL'd software. The other one, shadow-rs, is totally vibe-coded, and the README mistakenly says the original shadow is GNU software under the GPL, which is neither true. If 14/14 are relicensing, or in that one case, what is thought to be relicensing, the simple explanation is that it is an explicit goal of the project.
collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
Only GNU sort uses threads. There is still some room for improvement there, if anyone wants to take a shot at it. :)
collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
Canonical hasn't contributed anything to GNU coreutils in the time since the switch was announced, just to be clear.
collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
I don't think sudo-rs ever advertised itself as a drop in replacement. They seem pretty upfront that it isn't their goal. See this list:

https://github.com/trifectatechfoundation/sudo-rs#difference...

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
Most of them are TOCTOU races or improperly following symbolic links. For example, uutils mkfifo(1) would create a world-readable and writable FIFO before using chmod(2) to restrict its permissions. Another user could replace that file with a symbolic link between the mkfifo(3) call and the chmod(2) to change the permissions of arbitrary files [1].

Other ones I find concerning are that you could also bypass '-- no-preserve-root' with a symbolic link to root [2]. Or by using paths equivalent to "/", e.g., "/../" [3]. Historically, GNU coreutils has been pretty good with symbolic links and avoiding TOCTOU races. The only notable one I can remember is a chmod(1) bug [4].

I agree with your general point that the number of CVEs is a useless metric, though.

[1] https://nvd.nist.gov/vuln/detail/cve-2026-35352 [2] https://nvd.nist.gov/vuln/detail/cve-2026-35349 [3] https://nvd.nist.gov/vuln/detail/cve-2026-35338 [4] https://github.com/coreutils/coreutils/commit/425b8a2f534fe0...

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
You can use equivs to create a dummy coreutils-from-uutils package, as mentioned in the responses to that report.

It is frustrating that Canonical has no interest in fixing it, though. It makes it hard to take their claims seriously that you can still use GNU coreutils if you want.

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
I have had to tell them repeatedly to stop copying tests verbatim, including the original comments from GNU coreutils. So I doubt this is true, which is frustrating.
collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
Glad to hear that I am not alone. I feel like launchpad is totally ignored most of the time.

To get a response on a buggy GNU coreutils patch of theirs [1], I had to mention it in a rust-coreutils bug months later...

[1] https://bugs.launchpad.net/ubuntu/+source/coreutils/+bug/215...

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
I have. It has been an open bug upstream for years as well.
collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
Legacy is a bit harsh...

FWIW, Canonical did not reach out to any of us who maintain GNU coreutils before, after, or during the transition. Had we known, we could have easily warned them about the incompatibilities.

collinfunk··on Ubuntu 26.10 completes transition to Rust-based coreutils
I really don't understand why Canonical rushes this. If 'rm' can't remove all possible directory entries, that is a big issue:

  $ podman run --rm -it ubuntu:26.10
  $ apt update -y; apt upgrade -y
  $ rm --version
  rm (uutils coreutils) 0.10.0
  $ gnumkdir -p $(yes a/ | head -n $((32 * 1024)) | tr -d '\n')
  $ rm -rf a
  Segmentation fault (core dumped) rm -rf a
  $ ls a
  a
  $ gnurm -rf a
  $ ls a
  ls: cannot access 'a': No such file or directory
collinfunk··on Sovereign Tech Agency invests €500k in Flatpak
Note that STF did not fund GNU coreutils. They funded uutils.
collinfunk··on Rewriting in Rust
> Is there any effort from the GNU organization to solve long-standing issues and pain points such as locales?

Most GNU projects don't have a large overlap, if any overlap at all, between their active contributors. I suspect they behave far more independently than you expect. Also, GNU didn't invent locales, if that is what you are getting at.

> As it stands I am generally averse to using GNU tools because my feeling is that they will be slow, clunky and exhibit arcane behavior in particular edge cases. ripgrep is significantly faster than GNU grep -R; fd than GNU find, etc.

Those programs have their imperfections as well. Particularly, they don't account for arbitrary limits like PATH_MAX. See 'fd' stops before visiting the deepest directory without altering it's exit code:

  $ mkdir -p $(yes a/ | head -n $((16 * 1024)) | tr -d '\n')
  $ fd a | wc -l
  3119
  $ echo ${PIPESTATUS[@]}
  0 0
On the other hand GNU find can visit arbitrarily deep directories:

  $ find a | wc -l
  16384
ripgrep has similar issues:

  $ (while cd $(yes a/ | head -n 1024 |  tr -d '\n'); do :; done > /dev/null 2>&1; echo a > a)
  $ rg '^a$' a
  rg: a/[...]/a: File name too long (os error 36)
GNU grep handles this fine:

  $ grep -r '^a$' a
  a/[...]/a:a

> For example, before LLMs were common, I once had to spend an entire day getting GNU flex and GNU bison to generate code that was: a) properly prefixed with a custom prefix, not yy_ et. al and b) did not use global variables.

Flex isn't a GNU project. I don't use or contribute to Bison, but I am pretty sure that is here:

https://www.gnu.org/software/bison/manual/bison.html#Multipl...

> I would have understood if, for backwards compatibility, this was gated behind a --sane flag or similar, but the GNU manuals were, at least at the time, under the confusing impression that what I was doing was advanced usage and used semi-fancy terms like "re-enterant" to describe what should be the normal behavior. I had to toggle several different knobs, some working for macros, others for functions, and the knobs were different for flex and bison.

Again, I don't contribute to Flex or Bison. I also do not use them. However, I will note that understanding the programs require some complex topics, specifically formal languages and automata. I am not entirely surprised that some of the documentation can be a bit difficult to understand.

> POSIX locales in particular are an anti-feature, and I say this as a non-English native, so uutils adding support for them feels like bug-compatibility with GNU, not feature-compatibility.

They are also widely supported by other implementations. It would be harmful to everyone if we were to disregard them. Also, as I mentioned previously, they were not invented by GNU.

> Other issues involve the dynamic linking requirements of glibc and of the nsswitch in a world that would increasingly prefer to link things statically.

I am a committer to glibc, but this isn't really my area of focus. You are free to discuss it on libc-help@sourceware.org if you'd like.

> I am really saddened if the reaction is just that GNU is the old and stable is the main argument here. Because when you read many GNU documents and manpages, written years ago, you get the feeling that the original authors were looking to do things properly, make breaking changes where they were sane (hence POSIXLY_CORRECT), innovate (Emacs), and overall would not have been particularly swayed by the "old and stable" argument of traditional Unix distributions at the time.

We make breaking changes. I recently changed 'printenv' and 'env' to safely quote their output. I will note though that although you want us to make more changes like this, others get quite angry at us when we do. Even changes that aren't breaking cause angry mailing list messages. We can't make everyone happy.

> Can GNU programs innovate?

Individual GNU projects are free to innovate as much or as little as they want.

collinfunk··on Rewriting in Rust
Note, I am a co-maintainer of GNU coreutils. Whether that makes my opinion relevant, biased, or both, you can decide. :)

I really wished the documented their benchmarking methodology here, or at least cautioned the reader not to jump to conclusions based on the benchmarks shown.

GNU 'sort' performance can drastically be altered by the locale in use, the input, and the arguments given to the --buffer-size and --parallel options. GNU 'sort' is fairly conservative in how many threads it will use by default, and in my experience, much more so than uutils. This is because throwing more threads at 'sort' may make it faster (or may not), but also risks running out of memory. This is an issue with uutils, which is poor at deciding when to use external sorting:

  $ export LC_ALL=C
  $ for i in {a..z}; do yes $i | head -n $(numfmt --from=iec 512M) | tr -d '\n' >> input; done
  $ time sort input > /dev/null

  real 0m24.245s
  user 0m0.896s
  sys 0m19.161s
Here is the same command using the latest uutils commit compiled with 'make PROFILE=release':

  $ time uu-sort input > /dev/null
  Killed                     uu-sort input > /dev/null

  real 2m53.560s
  user 1m40.634s
  sys 0m59.847s
The process gets killed by the OOM killer. This is likely because uutils 'sort' decides to use 18 threads, instead of the 1 used by GNU 'sort'. I find it a bit frustrating that benchmarks are thrown out without any methodology or citations, because they are often trusted without question. These could be benchmarks from before uutils had localization, which was the case before 2025, and treated LC_ALL=en_US.UTF-8 as LC_ALL=C. In that case, of course it would be much faster than GNU coreutils, but it also means uutils would give you the wrong results for non-ASCII characters. There is, as shown above, much more considerations beyond speed that seemingly never get the time of day next to flashy benchmarks...
collinfunk··on How the FSF sysadmins block botnets with reaction
When did this occur? I am a GNU maintainer, and have never heard such a thing from the FSF. The GNU Coding Standards and other similar texts leave the decision to support non-free platforms up to the maintainer.
collinfunk··on Show HN: A wc rewrite in Rust that makes it over 100 times faster
I co-maintain GNU coreutils and wrote the Neon 'wc -l' code, for reference.

Based on my quick look at the source code, it looks like this program can handle ASCII whitespace. GNU coreutils uses iswspace, which is locale-aware. That limits how much we can optimize. We could probably add more optimization if the current locale is ASCII, e.g., LC_ALL=C on GNU/Linux.

collinfunk··on OpenBSD has a use-after-free allowing local privilege escalation to root
The others and I, working on GNU coreutils, frequently use 'yes' to generate a bunch of garbage input for testing programs. It is nice that it can do so quickly.
collinfunk··on Honesty gets Emacs patch rejected
The author states that they are not a lawyer, which is all good and okay. However, immediately afterwards they seem to claim that they know the law better than GNU, the FSF, and their lawyers. It confuses me how the author does not see that as a problem.
collinfunk··on DNI Gabbard Reveals Evidence of U.S. Taxpayer-Funded Global Biolab Program
> Why would you mention the labs in connection to a question specifically about bio weapons?

Which situation do you think looks worse, admitting to having biological research facilities (unrelated to weaponry), or having Russians invade, take over one of said research facilities, and run with whatever story they want to justify their war?

collinfunk··on DNI Gabbard Reveals Evidence of U.S. Taxpayer-Funded Global Biolab Program
> is it really that big of a jump to connect gain of function research and bioweaponry?

Have you seen any evidence for the bio-weaponry claim?

> to be fair the world genuinely believes COVID spontaneously manifested directly next to a US funded COVID research site, so perhaps the gap is really that wide.

You would need more evidence than proximity to prove that.

collinfunk··on DNI Gabbard Reveals Evidence of U.S. Taxpayer-Funded Global Biolab Program
The whole "biolab" thing is pretty common Russian propaganda [1]. Unsurprising to hear Gabbard parroting it yet again.

[1] https://en.wikipedia.org/wiki/Ukraine_bioweapons_conspiracy_...

collinfunk··on Why Gentoo?
Well, they have held back some slop in CPAN (a surprising place to find slop) [1]. Some of said slop recently caused GNU coreutils test suite to fail [2]. Surely the bot will get it right one day, right?

[1] https://bugs.gentoo.org/971488 [2] https://github.com/cpan-authors/IO-Tty/issues/91

collinfunk··on Disabling the new AF_ALG by default in gnulib (from 2018)
This came up again recently when I added SHA-3 support to 'cksum'. I think the conclusion was that OpenSSL was still faster. All of Assaf's points are good too, though.
collinfunk··on Bugs Rust won't catch
At the current moment I would be against it. The language and library is changing too fast. Also, Rust has some other things that make it hard to use for coreutils. For example, Rust programs always call signal (SIGPIPE, SIG_IGN) or equivalent code before main(). There is no stable way to get the longstanding behavior of inheriting the signal action from the parent process [1]. This is quite annoying, but not unique to Rust [2].

[1] https://doc.rust-lang.org/beta/unstable-book/compiler-flags/... [2] https://www.pixelbeat.org/programming/sigpipe_handling.html

collinfunk··on Bugs Rust won't catch
No need to apologize at all. Doing it in one cd invocation would fail since the file name is longer than PATH_MAX. In that case passing it to a system call would fail with errno set to ENAMETOOLONG.

You could probably make the loop more efficient, but it works good enough. Also, some shells don't allow you to enter directories that deep entirely. It doesn't work on mksh, for example.

collinfunk··on Bugs Rust won't catch
Hi, I am one of the maintainers of GNU Coreutils. Thanks for the article, it covers some interesting topics. In the little Rust that I have used, I have felt that it is far too easy to write TOCTOU races using std::fs. I hope the standard library gets an API similar to openat eventually.

I just want to mention that I disagree with the section titled "Rule: Resolve Paths Before Comparing Them". Generally, it is better to make calls to fstat and compare the st_dev and st_ino. However, that was mentioned in the article. A side effect that seems less often considered is the performance impact. Here is an example in practice:

  $ mkdir -p $(yes a/ | head -n $((32 * 1024)) | tr -d '\n')
  $ while cd $(yes a/ | head -n 1024 | tr -d '\n'); do :; done 2>/dev/null
  $ echo a > file
  $ time cp file copy

  real 0m0.010s
  user 0m0.002s
  sys 0m0.003s
  $ time uu_cp file copy

  real 0m12.857s
  user 0m0.064s
  sys 0m12.702s
I know people are very unlikely to do something like that in real life. However, GNU software tends to work very hard to avoid arbitrary limits [1].

Also, the larger point still stands, but the article says "The Rust rewrite has shipped zero of these [memory saftey bugs], over a comparable window of activity." However, this is not true [2]. :)

[1] https://www.gnu.org/prep/standards/standards.html#Semantics [2] https://github.com/advisories/GHSA-w9vv-q986-vj7x

collinfunk··on The West forgot how to make things, now it’s forgetting how to code
> There are some pretty substantial differences. Russia is on the strategic back foot here trying to figure out a way to stop NATO's advance.

His rationale for invading Ukraine was to "demilitarise and denazify" it. The NATO point seems largely be invented by people who dislike NATO in the west.

> They've only turned to violence after long attempts at resolving the tension diplomatically and the US has been implacable.

I hope the "tension" you are referring to was not the little green men taking over Crimea and the Donbas in 2014.

> Putin's actually been pretty hesitant in his escalations so far; he's 70 and has a long history of trying to avoid war.

This is a totally unseriousness statement. Can you remind me what Putin was doing in Syria again?

collinfunk··on The West forgot how to make things, now it’s forgetting how to code
You see zero similarities between Hitler invading Poland and Putin invading Ukraine?
Page 1 of 3Next →