Hacker News Reader

Comment by dumpsterdiver | Hacker News Reader

If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading them first, ever. That is so irresponsible. Validating shell scripts will make you a more competent and informed worker. Tools like this breed incompetence, and encourage carelessness.

View on HN

I assume you also read all the source code for every program you run too?

I just don't see how this perspective lives in the real world.

It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in <lang> then you're not worthy enough."

How would you ever begin a career, let alone become a desirable team member?

I would probably start by reading a book.

Yeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?

I am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

If that were true, then why did this post reach the front page of Hacker News? As Larry Wall stated, the three virtues of a programmer are: Laziness, impatience, and hubris. Tools like this embody all three.

There are a hundred reasons to use this script and your responses merely lack imagination:

* Ancient script written by people at the company no longer here that may encode a bunch of assumptions and lots of dead code

* Personal script that is not to the level of full production

* Run untrusted script in a constrained environment to see at what stage it does something ugly - this will bypass obfuscation based on adding lots of dead code

That's like 3 things I already thought of while writing this comment. In like the 90 s it took me to compose this. These ostentatiously dramatic comments of yours aren't that interesting. Hopefully coming generations of engineers will look at your comments and be like "I wish I wasn't like that".

> You should never run shell scripts without reading them first, ever. That is so irresponsible.

Do you run on Gentoo? and presumably read the millions of lines of code your machine is running on?

People have been downloading and running executables almost pretty much as as the internet has been around... and the world is still going 'round.

I understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating systems, but it is not unreasonable to read shell scripts before you run them.

Plus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.

The same can't be said for npm packages and people still use them.

I want this to run my own shell scripts. I have a bunch of scripts that are halfway between "documentation" and "automation"; mostly the record of the last time I did X. Add a prompt to eval a command or two or change variables that are hard coded, and it's ipython for shell.

> I want this to run my own shell scripts.

That's really the only use case for this tool that I could get behind, and I commend you for your diligence.

Reply on news.ycombinator.com