Hacker News Reader

Comment by bin_bash | Hacker News Reader

I mean, you could probably launch nuclear missiles with a line of bash

  sudo ./launch-missiles.sh --target=[REDACTED] --missile-count=4 --username=jbiden --password=1111

I like how you redacted the target but not the password – though I’m pretty sure the real password is alphanumeric and based on a family member: http://www.bash.org/?quote=244321

One of the actual big-P Passwords decades ago was actually

0000000

> during the height of the Cold War, the US military put such an emphasis on a rapid response to an attack on American soil, that to minimize any foreseeable delay in launching a nuclear missile, for nearly two decades they intentionally set the launch codes at every silo in the US to 8 zeroes

http://www.todayifoundout.com/index.php/2013/11/nearly-two-d...

...so, a quasi-implicit-and-optional parameter.

Wow! From an InfoSec perspective, that’s hard to believe but when you understand that every large group of humans has competing interests and large bureaucracies don’t have perfect chains of command, it’s totally believable. I guess it’s a high-stakes example of the difficulty in getting the right balance between security and convenience.

Edit: on a related note, a few years ago I was shocked to hear the story of how a simple accident while carrying out routine maintenance of liquid-fuelled nuclear missiles almost resulted in a devastating nuclear explosion in the American heartland: https://www.thisamericanlife.org/634/human-error-in-volatile...

That was what I was paying homage to.

   -j 4

Pretty sure that would be a Perl script.

I love that Biden's putting his password into ~/.bash_history

It's also visible in the process table (ps auxww). It can be erased by rewriting the arguments from inside the process (I think this is OS-specific, not the same as changing argv in-place), but that is a race condition.

The safe way is to either read it from stdin/fd (maybe call isatty(3) to check if someone doesn't echo password | ./foo), or open a file (check if permissions are 600). You could also have a named socket (check permissions!) talking to an authn agent, which could be doing some other fancy stuff like pinging your smartwatch to confirm, etc.

another option is in an env variable (from an encrypted file).

    gpg -d ~/secrets/nuclear_launch_codes.gpg
    source ~/secrets/nuclear_launch_codes

where the gpg key has a password and is stored on a hardware dongle that doesn't allow copying the private key off. If you really want to be fancy, there are some hardware security keys that also require a biometric to confirm.

The other option is something like Hasicorp Vault, but we're way out of "one line bash" territory :p

can't you do `cat /proc/$PID/environ`?

It's chmod 400'd and owned by process owner.

> It can be erased by rewriting the arguments from inside the process

Please nobody rely on this behavior. :O

Spacex launches rockets with one line of bash

Reply on news.ycombinator.com