(Let me start clarifying that this is not at all a criticism of the author)<p>I am usually amused by the way really competent people judge other's context.<p>This post assumes understanding of:<p>- emacs (what it is, and terminology like buffers)<p>- strace<p>- linux directories and "everything is a file"<p>- environment variables<p>- grep and similar<p>- what git is<p>- the fact that 'git whatever' works to run a custom script if git-whatever exists in the path (this one was a TIL for me!)<p>- irc<p>- CVEs<p>- dynamic loaders<p>- file priviledges<p>but then feels important to explain to the audience that:<p>>A socket is a facility that enables interprocess communication
That feels like part of why some juniors are so confident while more senior engineers are plagued with self-doubt.<p>Juniors know how much they have learned whereas a 10+ year senior (like the author) forget most people don't know all this stuff intuitively.<p>I still will say stuff like "yeah it's just a string" forgetting everyone else thinks a "string" is a bit of thread/cord.
As a blogger who makes similar assumptions, I think we depend on how a lot of us from that time "grew up" similarly. Sockets came to relevance later in my career compared to everything else listed here.
That might be part of it, yes.<p>As someone younger, ports and sockets appeared very early in my learning. I'd say they appeared in passing before programming even, as we had to deal with router issues to get some online games or p2p programs to work.<p>And conversely, some of the other topics are in the 'completely optional' category. Many of my colleagues work on IDEs from the start, and some may not even have used git in its command line form at all, though I think that extreme is more rare.
git was released in 2005.<p>>The term socket dates to the publication of RFC 147 in 1971, when it was used in the ARPANET. Most modern implementations of sockets are based on Berkeley sockets (1983), and other stacks such as Winsock (1991).<p><a href="https://en.wikipedia.org/wiki/Network_socket" rel="nofollow">https://en.wikipedia.org/wiki/Network_socket</a>
I haven't even realized that while I was reading the article, but it is amusing!<p>Though one explanation is that I think for the other stuff that the writer doesn't explain, one can just guess and be half right, and even if the reader guesses wrong, isn't critical to the bug — but sockets and capabilities are the concepts that are required to understand the post.<p>It still is amusing and I wouldn't have even realized that until you pointed that out.
I found that specific clarification useful while everything else was easy to follow.<p>It’s not that I was unaware that’s how Unix worked here, just that I rarely think of sockets in that context.
I found it interesting that they know how to use strace, but not how to list open files held by a process which to me seems simpler. Again, not criticism just an observation and I enjoyed the article
Given the "(hi Julia!)" immediately after the strace shenanigans, I interpreted this as a third-party hint; the author most likely had not used strace before.<p>The author is both an example of and an example for how we can get caught in "bubbles" of tools/things we know and use and don't, and blog posts like this are great for discovery (I didn't know about git invoking a binary in the path like his "git re-edit", for example, until today).
All of the things you listed are ops topics. But sockets are a programming concept.<p>I would expect a person with 10+ years of Unix sysadmin experience — but who has never programmed directly against any OS APIs, “merely” scripting together invocations of userland CLI tools — to have exactly this kind of lopsided knowledge.<p>(And that pattern is more common than you might think; if you remember installing early SuSE or Slackware on a random beige box, it probably applies to you!)
Most people these days are using http and don’t need to touch sockets. (Except for the people implementing http of course).
To be fair, it does link the CVE, so if you don't know what a CVE is, you can click the link.<p>I agree that it's amusing.
I mean, the title is a quote from Buckaroo Banzai. Lack of context is part of the fun!
(2016)<p>Also, “direct” link: <a href="https://blog.plover.com/tech/tmpdir.html" rel="nofollow">https://blog.plover.com/tech/tmpdir.html</a> (This doesn't really matter, as the posted link is to <a href="https://blog.plover.com/2016/07/01/#tmpdir" rel="nofollow">https://blog.plover.com/2016/07/01/#tmpdir</a> i.e. the blog post named “tmpdir” posted on 2016-07-01 and there is only post posted on that date, so the content of the page is basically the same.)
> <i>This computer stuff is amazingly complicated. I don't know how anyone gets anything done.</i><p>I wonder what could be done to make this type of problem less hidden and easier to diagnose.<p>The one thing that comes to mind is to have the loader fail fast. For security reasons, the loader needs to ensure TMPDIR isn't set. Right now it accomplishes this by un-setting TMPDIR, which leads to silent failures. Instead, it could check if TMPDIR is set, and if so, give a fatal error.<p>This would force you to unset TMPDIR yourself before you run a privileged program, which would be tedious, but at least you'd know it was happening because you'd be the one doing it.<p>(To be clear, I'm not proposing actually doing this. It would break compatibility. It's just interesting to think about alternative designs.)
Yeah, this case is a good example of why many people don't like linux. Too much interconnected stuff that can go wrong.
Mh, I am starting to dislike this kind of hyper-configurability.<p>I know when this was necessary and used it myself quite a bit. But today, couldn't we just open up a mount namespace and bind-mount something else to /tmp, like SystemDs private tempdirs? (Which broke a lot of assumptions about tmpdirs and caused a bit of ruckus, but on the other hand, I see their point by now)<p>I'm honestly starting to wonder about a lot of these really weird, prickly and fragile environment variables which cause security vulnerabilities, if low-overhead virtualization and namespacing/containers are available. This would also raise the security floor.
> But today, couldn't we just open up a mount namespace and bind-mount something else to /tmp, like SystemDs private tempdirs?<p>No, because unless you're already root (in which case you wouldn't have needed the binary with the capability in the first place), you can't make a mount namespace without also making a user namespace, and the counterproductive risk-averse craziness has led to removing unprivileged users' ability to make user namespaces.
It is complex. There was another posting on HN where commenters were musing over why software projects have a much higher failure rate than any other engineering discipline.<p>Are we just shittier engineers, is it more complex, or is the culture such that we output lower quality? Does building a bridge require less cognitive load then a complex software project?
I think it's a cultural acceptance of lower quality, happily traded for deft execution, over and over.<p>We're better at encapsulating lower-level complexities in e.g. bridge building than we are at software.<p>All the complexities of, say, martensite grain boundaries and what-not are implicit in how we use steel to reinforce concrete. But we've got enough of it in a given project that the statistical summaries are adequate. It's a member with thus strength in tension, and thus in compression, and we put a 200% safety factor in and soldier on.<p>And nobody can take over the ownership of leftpad and suddenly falsify all our assumptions about how steel is supposed to act when we next deploy ibeam.js ...<p>The most well understood and dependable components of our electronic infrastructure are the ones we cordially loathe because they're composed in <i>shudder</i> COBOL, or CICS transactions, or whatever.
Exactly. The properties rarely matter outside the item. The column is of such-and-such a strength, that's it. But when things get strange we see failures. Perfect example: Challenger. Was the motor safe sitting on the pad? Yes. Was the motor safe in flight? Yes. Was the motor safe at ignition? On the test stand, yes. Stacked for launch, ignition caused the whole stack to twang--and maybe the seals failed....
> Are we just shittier engineers, is it more complex [...]<p>Both IMO: first, anybody could buy a computer during the last three decades, dabble in programming without learning basic concepts of software construction and/or user-interface design and get a job.<p>And copying bad libraries was (and is) easy. I still get angry when software tells me "this isn't a valid phone number" when I cut/copy/paste a number with a blank or a hyphen between digits. Or worse, libraries which expect the local part of an email address to only consist of alphanumeric characters and maybe a hyphen.<p>Second, writing software definitely is more complex than building physical objects. Because there are "no laws" of physics which limit what can be done. In the sense that physics tell you that you need to follow certain rules to get a stable building or a bridge capable of withstanding rain, wind, etc.
Absolutely. As an Electrical Engineer turned software guy, Ohm's/Kirchhoff's laws remain as valid and significant as when I was taught them 35 years ago. For software however, growth of hardware architectures/constraints made it possible to add much more functionality. My first UNIX experience was on PDP-11/44, where every process (and kernel) had access to an impressive maximum of 128K of RAM (if you figured out the flag to split address and data segments). This meant everything was simple and easy to follow: the UNIX permission model (user/group/other+suid/sgid) fit it well. ACLs/capabilities etc were reserved for VMS/Multics, with manuals spanning shelves.<p>Given hardware available to an average modern Linux box, it is hardly surprising that these bells and whistles were added - <i>someone</i> will find them useful in some scenarios and additional resource is negligible. It does however make understanding the whole beast much, much harder...
BTW, the author "mjd" is the author of the excellent book "Higher-Order Perl" which is available online at <a href="https://hop.perl.plover.com/book/" rel="nofollow">https://hop.perl.plover.com/book/</a>
Setting a capability on the perl executable seems like a very bad idea. That effectively grants tha capability to everything that is able to invoke perl (without being restricted to NO_NEW_PRIVILEGES).
The Internet needs more Buckaroo Banzai references. Because wherever you go, there you are.
Yup. I nearly had this movie memorized when I was a child.<p><a href="https://www.youtube.com/watch?v=aWXuDNmO7j8" rel="nofollow">https://www.youtube.com/watch?v=aWXuDNmO7j8</a><p>Peter Weller, playing Buckaroo Banzai, is late for his military-particle-physics-interdimensional-jet-car test because he's helping Jeff Goldblum's character with neurosurgery. Later that day he will go play lead guitar in an ensemble.<p>Scriptwriting gurus advise that your protagonist should have flaws and character progression. The writers of this movie disagree.
Kevin Smith has an introduction to this movie where he calls it a true piece of art: "It doesn't care what you bring to the table, it bring itself to the table and says: figure it out". <a href="https://youtu.be/N8R8wmlggwc?si=sva2-jF1Kl5eFsU4" rel="nofollow">https://youtu.be/N8R8wmlggwc?si=sva2-jF1Kl5eFsU4</a>
And this was written 10 years ago, when computers were far less complicated and vibe coding sleeper bugs wasn't a thing.
Vibe coded sleeper bugs have always been a thing, they just came from the bosses' nephew who was still learning PHP at the time and left several years ago.<p>Also, computers in 2015 were not meaningfully less complex than today. Certainly not when the topic is weird emacs and perl interactions.
Even if the topic was web applications (that are where Big Complexity thrives), 2015 was about peak complexity. Things have improved a bit since then.
The problem isn't that AI is doing something new, we all know that it isn't. The problem is that the boss' nephew is becoming the rule now rather than the exception.
From my perspective vibe coding was always a thing.
Buckaroo Banzai: You can check your anatomy all you want, and even though there may be normal variation, when it comes right down to it, this far inside the head it all looks the same. No, no, no, don’t tug on that. You never know what it might be attached to.
See, this is the point, for me, where it started to look like a problem. You know, I wanted to sacrifice the precentral vein in order to get some exposure, but because of this guy's normal variation, I got excited, and all of a sudden I didn't know whether I was looking at the precentral vein, or one of the internal cerebral veins, or the vein of Galen, or the vascular vein of Rosenthal. So, on my own, to me, at this point, I was ready to say that's it, let's get out.
[dead]