[HN Gopher] Don't tug on that, you never know what it might be a...
___________________________________________________________________
Don't tug on that, you never know what it might be attached to
(2016)
Author : todsacerdoti
Score : 95 points
Date : 2025-11-28 16:01 UTC (6 hours ago)
(HTM) web link (blog.plover.com)
(TXT) w3m dump (blog.plover.com)
| markstos wrote:
| And this was written 10 years ago, when computers were far less
| complicated and vibe coding sleeper bugs wasn't a thing.
| detourdog wrote:
| From my perspective vibe coding was always a thing.
| WJW wrote:
| Vibe coded sleeper bugs have always been a thing, they just
| came from the bosses' nephew who was still learning PHP at the
| time and left several years ago.
|
| Also, computers in 2015 were not meaningfully less complex than
| today. Certainly not when the topic is weird emacs and perl
| interactions.
| marcosdumay wrote:
| Even if the topic was web applications (that are where Big
| Complexity thrives), 2015 was about peak complexity. Things
| have improved a bit since then.
| add-sub-mul-div wrote:
| The problem isn't that AI is doing something new, we all know
| that it isn't. The problem is that the boss' nephew is
| becoming the rule now rather than the exception.
| jama211 wrote:
| It also makes bugs easier to find and resolve. You win some
| you lose some. Perhaps by the time it is the rule they'll
| be better at writing safer code.
| linsomniac wrote:
| The Internet needs more Buckaroo Banzai references. Because
| wherever you go, there you are.
| neilk wrote:
| Yup. I nearly had this movie memorized when I was a child.
|
| https://www.youtube.com/watch?v=aWXuDNmO7j8
|
| Peter Weller, playing Buckaroo Banzai, is late for his
| military-particle-physics-interdimensional-jet-car test because
| he's helping Jeff Goldblum's character with neurosurgery. Later
| that day he will go play lead guitar in an ensemble.
|
| Scriptwriting gurus advise that your protagonist should have
| flaws and character progression. The writers of this movie
| disagree.
| linsomniac wrote:
| Kevin Smith has an introduction to this movie where he calls
| it a true piece of art: "It doesn't care what you bring to
| the table, it bring itself to the table and says: figure it
| out". https://youtu.be/N8R8wmlggwc?si=sva2-jF1Kl5eFsU4
| svat wrote:
| (2016)
|
| Also, "direct" link: https://blog.plover.com/tech/tmpdir.html
| (This doesn't really matter, as the posted link is to
| https://blog.plover.com/2016/07/01/#tmpdir i.e. the blog post
| named "tmpdir" posted on 2016-07-01 and there is only post posted
| on that date, so the content of the page is basically the same.)
| adrianmonk wrote:
| > _This computer stuff is amazingly complicated. I don 't know
| how anyone gets anything done._
|
| I wonder what could be done to make this type of problem less
| hidden and easier to diagnose.
|
| The one thing that comes to mind is to have the loader fail fast.
| For security reasons, the loader needs to ensure TMPDIR isn't
| set. Right now it accomplishes this by un-setting TMPDIR, which
| leads to silent failures. Instead, it could check if TMPDIR is
| set, and if so, give a fatal error.
|
| This would force you to unset TMPDIR yourself before you run a
| privileged program, which would be tedious, but at least you'd
| know it was happening because you'd be the one doing it.
|
| (To be clear, I'm not proposing actually doing this. It would
| break compatibility. It's just interesting to think about
| alternative designs.)
| tetha wrote:
| Mh, I am starting to dislike this kind of hyper-
| configurability.
|
| I know when this was necessary and used it myself quite a bit.
| But today, couldn't we just open up a mount namespace and bind-
| mount something else to /tmp, like SystemDs private tempdirs?
| (Which broke a lot of assumptions about tmpdirs and caused a
| bit of ruckus, but on the other hand, I see their point by now)
|
| I'm honestly starting to wonder about a lot of these really
| weird, prickly and fragile environment variables which cause
| security vulnerabilities, if low-overhead virtualization and
| namespacing/containers are available. This would also raise the
| security floor.
| ericmcer wrote:
| It is complex. There was another posting on HN where commenters
| were musing over why software projects have a much higher
| failure rate than any other engineering discipline.
|
| Are we just shittier engineers, is it more complex, or is the
| culture such that we output lower quality? Does building a
| bridge require less cognitive load then a complex software
| project?
| rout39574 wrote:
| I think it's a cultural acceptance of lower quality, happily
| traded for deft execution, over and over.
|
| We're better at encapsulating lower-level complexities in
| e.g. bridge building than we are at software.
|
| All the complexities of, say, martensite grain boundaries and
| what-not are implicit in how we use steel to reinforce
| concrete. But we've got enough of it in a given project that
| the statistical summaries are adequate. It's a member with
| thus strength in tension, and thus in compression, and we put
| a 200% safety factor in and soldier on.
|
| And nobody can take over the ownership of leftpad and
| suddenly falsify all our assumptions about how steel is
| supposed to act when we next deploy ibeam.js ...
|
| The most well understood and dependable components of our
| electronic infrastructure are the ones we cordially loathe
| because they're composed in _shudder_ COBOL, or CICS
| transactions, or whatever.
| kace91 wrote:
| (Let me start clarifying that this is not at all a criticism of
| the author)
|
| I am usually amused by the way really competent people judge
| other's context.
|
| This post assumes understanding of:
|
| - emacs (what it is, and terminology like buffers)
|
| - strace
|
| - linux directories and "everything is a file"
|
| - environment variables
|
| - grep and similar
|
| - what git is
|
| - the fact that 'git whatever' works to run a custom script if
| git-whatever exists in the path (this one was a TIL for me!)
|
| - irc
|
| - CVEs
|
| - dynamic loaders
|
| - file priviledges
|
| but then feels important to explain to the audience that:
|
| >A socket is a facility that enables interprocess communication
| dwedge wrote:
| I found it interesting that they know how to use strace, but
| not how to list open files held by a process which to me seems
| simpler. Again, not criticism just an observation and I enjoyed
| the article
| parliament32 wrote:
| Given the "(hi Julia!)" immediately after the strace
| shenanigans, I interpreted this as a third-party hint; the
| author most likely had not used strace before.
|
| The author is both an example of and an example for how we
| can get caught in "bubbles" of tools/things we know and use
| and don't, and blog posts like this are great for discovery
| (I didn't know about git invoking a binary in the path like
| his "git re-edit", for example, until today).
| goranmoomin wrote:
| I haven't even realized that while I was reading the article,
| but it is amusing!
|
| Though one explanation is that I think for the other stuff that
| the writer doesn't explain, one can just guess and be half
| right, and even if the reader guesses wrong, isn't critical to
| the bug -- but sockets and capabilities are the concepts that
| are required to understand the post.
|
| It still is amusing and I wouldn't have even realized that
| until you pointed that out.
| hakunin wrote:
| As a blogger who makes similar assumptions, I think we depend
| on how a lot of us from that time "grew up" similarly. Sockets
| came to relevance later in my career compared to everything
| else listed here.
| kace91 wrote:
| That might be part of it, yes.
|
| As someone younger, ports and sockets appeared very early in
| my learning. I'd say they appeared in passing before
| programming even, as we had to deal with router issues to get
| some online games or p2p programs to work.
|
| And conversely, some of the other topics are in the
| 'completely optional' category. Many of my colleagues work on
| IDEs from the start, and some may not even have used git in
| its command line form at all, though I think that extreme is
| more rare.
| addled wrote:
| I mean, the title is a quote from Buckaroo Banzai. Lack of
| context is part of the fun!
| kragen wrote:
| To be fair, it does link the CVE, so if you don't know what a
| CVE is, you can click the link.
|
| I agree that it's amusing.
| mr_toad wrote:
| Most people these days are using http and don't need to touch
| sockets. (Except for the people implementing http of course).
| derefr wrote:
| All of the things you listed are ops topics. But sockets are a
| programming concept.
|
| I would expect a person with 10+ years of Unix sysadmin
| experience -- but who has never programmed directly against any
| OS APIs, "merely" scripting together invocations of userland
| CLI tools -- to have exactly this kind of lopsided knowledge.
|
| (And that pattern is more common than you might think; if you
| remember installing early SuSE or Slackware on a random beige
| box, it probably applies to you!)
| ericmcer wrote:
| That feels like part of why some juniors are so confident while
| more senior engineers are plagued with self-doubt.
|
| Juniors know how much they have learned whereas a 10+ year
| senior (like the author) forget most people don't know all this
| stuff intuitively.
|
| I still will say stuff like "yeah it's just a string"
| forgetting everyone else thinks a "string" is a bit of
| thread/cord.
| Retric wrote:
| I found that specific clarification useful while everything
| else was easy to follow.
|
| It's not that I was unaware that's how Unix worked here, just
| that I rarely think of sockets in that context.
| jcynix wrote:
| BTW, the author "mjd" is the author of the excellent book
| "Higher-Order Perl" which is available online at
| https://hop.perl.plover.com/book/
| pinkmuffinere wrote:
| I love mjd! He once replied to me on an HN thread and it lives
| forever in my memory :)
| roywashere wrote:
| Me three! mjd fanboy here
| LordGrey wrote:
| Buckaroo Banzai: You can check your anatomy all you want, and
| even though there may be normal variation, when it comes right
| down to it, this far inside the head it all looks the same. No,
| no, no, don't tug on that. You never know what it might be
| attached to.
| thayne wrote:
| Setting a capability on the perl executable seems like a very bad
| idea. That effectively grants tha capability to everything that
| is able to invoke perl (without being restricted to
| NO_NEW_PRIVILEGES).
___________________________________________________________________
(page generated 2025-11-28 23:00 UTC)