hddqsb

See my warning regarding s_client and security: https://news.ycombinator.com/item?id=36179850#36186559

But see my warning regarding security: https://news.ycombinator.com/item?id=36179850#36186559

Obligatory: Telnet is better than netcat for interactive logins, but SSH is even better than Telnet for that. So don't use Telnet.

In fact OpenSSH has already done so! https://www.openssh.com/txt/release-9.0

The advice "never use telnet" is fine. Yes, technically there are ways to use telnet safely (e.g. over WireGuard or a LAN), but they are fragile and I think it's better not to mention them.

Take the version in your comment for example. You wrote "With Wireguard in place, it is safe to return to legacy telnet", but that on its own is misleading: it is easy to accidentally route the connection outside WireGuard and compromise the password.

You do note later that it's not best practice and can be vulnerable (aside: I assume "are in place" should be "are not in place"), but a reader might miss that part or underestimate the risk.

Also, "safe" is subjective: telnet allows all the users on the network to try to bruteforce passwords. (SSH also allows that by default, but not for the root account, and it lets you disable password authentication entirely in favour of public key authentication etc.)

I think it's fine to give broadly-applicable-but-technically-inaccurate advice ("never use telnet"), and trust that the experts who can safely ignore this advice will understand that the advice is a simplification. (To be hyper-correct, one should give the broadly-applicable advice but also state that there are exceptions.)

**WARNING:** `openssl s_client` is designed only as a diagnostic tool and is NOT suitable if you care even slightly about security. By default it continues on verification failures so you get absolutely zero security.

You must specify the options `-verify_return_error -verify_hostname <hostname>` to get even a semblance of security; however I don't know if they are sufficient, and the fact that they are not enabled by default is a massive red flag that tells you this tool was not designed to be secure.

As an alternative, I suggest using `gnutls-cli <host>[:<port>]` or `socat - SSL:<host>:<port>` (if they are installed; unfortunately they are not common). They pass the "Certificate" tests on https://badssl.com/ except for "pinning-test".

There is a discussion with some insight into the technical reasons why they don't support Windows 7: https://discuss.python.org/t/windows-7-support-for-python-3-... (summary: api-ms-win-core-path-l1-1-0.dll is not available on Windows 7, so they'd have to switch from static import to feature detection + dynamic import in several places; and the Python team don't have access to Windows 7 so they can't do testing).

An unofficial Python installer for Windows 7 exists: https://github.com/adang1345/PythonWin7 (it uses an unofficial implementation of api-ms-win-core-path-l1-1-0.dll).

It wasn't Sergey who did the skydiving, but still a cool demo: https://www.youtube.com/watch?v=hxmbbtuRszA

Here is an example I linked in another comment: http://www.dest-unreach.org/socat/doc/socat-gender.txt

As another commenter says, you can use socat. Specifically, you can run it in double client mode (see http://www.dest-unreach.org/socat/doc/socat-gender.txt) to connect the UNIX socket to the service.

Note that a trailing slash means to copy the contents when using rsync, but not when using cp (which will copy the directory even if there is a trailing slash). For cp, the correct way to copy only the contents is to use `cp -r foo/. bar`. (This also works with rsync.)

I think you have to visit https://github.com/search, type a query (use /.../ for a regex, and repo:... to filter by repo), then click "Code" in the left navigation bar (and sign in). The search box on project pages appears to use the old search.

Bash has PROMPT_DIRTRIM to only print the last n components (this effect can also be achieved using zsh: https://unix.stackexchange.com/questions/273529/shorten-path...).

And "auto" only added in 2018 (https://git.kernel.org/pub/scm/network/iproute2/iproute2.git...).

Edit: That should have been `[ "${myvar+set}" = "set" ]` for checking that `myvar` is set.

Oops, quite right -- the glob pattern for matching any letter is `[[:alpha:]]`, not `[:alpha:]`. Cheers!

TL;DR:

https://en.wikipedia.org/wiki/Prisoner's_dilemma

https://en.wikipedia.org/wiki/Tit_for_tat

> I can't see why the error you describe would occur in this instance. Would you mind explaining?

Sure, it's due to pathname expansion. The most commonly used pattern is `*` (e.g. `echo *.txt` might expand to `echo foo.txt bar.txt`), but there is also `[...]` for matching a character range. If the current directory contains files named "i" and "j", then `tr -s [:alpha:] Y` will expand to `tr -s i j Y`, which is not what you want. (The reason it works when the current directory doesn't contain single-letter filenames is that a pattern which doesn't match any filenames is left as-is.)

I believe that's the point! (Would probably be more user-friendly if it sent a RST instead of silently dropping the connection and letting it time out.)

(`local` is not in POSIX, I know)

Beware, I would not trust ChatGPT to produce safe scripts. At minimum, consider using ShellCheck on the result to detect common mistakes such as not quoting variables. Writing safe scripts is very hard.

In fact `${foo+some_string}` is supported by POSIX sh (unlike `test -v`).

Note that `test -v` is not in POSIX sh (see https://pubs.opengroup.org/onlinepubs/9699919799/utilities/t...). And you don't need `builtin` because `test ...` invokes the builtin by default; if you want to run coreutils test you need to use `/usr/bin/test ...` or `env test ...` or `(exec test ...)`.

The usual way to check if $2 is present is to use `[ $# -ge 2 ]`. For named variables, I like to use `[ "${myvar+set}" != "set" ]` (the parameter expansion `${myvar+word}` expands to "word" if myvar is set or "" if it is unset, see https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V...).

(Often people want to treat an empty value as unset, so they just use `[ -n "$myvar" ]` to check that the value is non-empty. If you enable `set -u` to treat references to unset variables as errors, this should instead be `[ -n "${myvar-}" ]`.)

Some comments on the script you linked:

I highly recommend ShellCheck (https://www.shellcheck.net/), it picks up a legitimate issue in your script: `tr -s [:alpha:] Y` should be `tr -s "[:alpha:]" Y` (otherwise it fails if the current directory contains a single-letter filename).

Also, you should use `printf "%s\n" "$var"` instead of `echo "$var"` in case $var is "-n" for example.

Actually, the function returns success if the input contains "." and printf succeeds, so it does not consider 2e3 to be a float. I agree that this function is odd (it's not even useful for identifying simple numbers of the form "123.456", because it considers 2.0e3 to be a float).

Yes. printf is not a "flex", it's the only safe way to display arbitrary strings. The link mentions one good reason to avoid echo (string might be "-n"), but another important reason is that the behaviour of echo is implementation-defined if the string contains backslashes (e.g. `echo 'foo\nbar'` displays one line in bash but two lines in dash and zsh).

Your "zsh/bash" code doesn't actually use any zsh/bash-only features, so it is compatible with POSIX sh. But you have a quoting bug: you should escape the `$` in `$2` and `${3...}` to protect from double-eval.

I'd personally try to minimise the use of eval, e.g.

    prepend() {
        local val
        eval "val=\$$1"
        export "$1=$2${val:+${3-:}$val}"
    }

    append() {
        local val
        eval "val=\$$1"
        export "$1=${val:+$val${3-:}}$2"
    }

Note that this is supported by bash/zsh/ksh but not by POSIX sh.

Some feedback:

There are several ambiguities in the "pudding" challenge.

- Unclear if offenders are defined as taking >2 puddings or >=2 puddings (conflicting wording; note that the placeholder comment also refers to this, and should also say 'snr_manager_id' instead of 'senior_manager_id').

- Unspecified how top 5 offenders are chosen if there are ties for 5th place.

- There are cases where multiple puddings are taken at the same instant (probably shouldn't be allowed, because it would be unclear who took the last pudding).

I'm also pretty certain that the model answer is incorrect (regardless of how these ambiguities are interpreted). Please check this; I'd be happy to send you my code.

If the focus is on coming up with the SQL queries rather than getting all the fine details correct, consider adding (optional) intermediate stages to help users check their intermediate results, because debugging based on the final result is difficult.

It would be nice if a model solution was shown after solving the challenge, to compare and learn.

Finally, I think you should ask the user for permission before publishing their score on the leaderboard.

Google's response said that their software does not depend on the vulnerable packages (this is consistent with the researcher only seeing downloads from dev machines and not from automated builds). Reading between the lines, I'm guessing that there is a big human element in play and it's simply not something that the security team can fix. If engineers insist on manually downloading packages insecurely, there is only so much the security team can do because "Googlers can download and run arbitrary code on their machines". (I think that's what they tried to convey by "social engineering" -- not that the researcher was using social engineering, but that there is a social aspect.)

You might also want to set ServerAliveCountMax to something high, the default is 3 which means if your network is down for 3*30s the SSH client will disconnect.