No Easter Eggs in Curl

https://daniel.haxx.se/blog/2021/12/06/no-easter-eggs-in-curl/

233 153 5 years ago

daniel.haxx.se

netr0ute• 5 years ago

I can see how the facts/opinions presented would be true if the Easter egg was a closed-source binary blob, but that would be farcical to do in an open-source project like curl.

dairylee• 5 years ago

Or if the Easter egg was obfuscated and looked potentially malicious[1].

1: https://github.com/npm/cli/issues/4091

genewitch• 5 years ago

Wow, found recently, too.

hoten3• 5 years ago

An Easter egg doesn't need to be an undocumented secret thing. Put something silly behind a flag and document the flag in the manual, and it's still a goofy Easter egg.

_nickwhite• 5 years ago

There are 2 types of crotchety old men:

1) This one yells "get off my lawn!". 2) This one yells "get off my lawn!" and proceeds to explain why he doesn't like kids walking through his grass, and gives the complete history of him yelling at kids and then goes into detail why staying off his lawn is best for everybody.

The author of curl is the latter. It would take much less time and effort to just write something fun into it, AND document it. Good grief, life is short, software development should be fun, even while remaining professional.

pavel_lishin4• 5 years ago

But it's not a lawn. It's a critical tool. Do you want your car's brake system to have easter eggs? What about your smoke detectors?

throw10920• 5 years ago

The linked article is only a few hundred words long. It probably took Daniel half an hour to write. It would take far longer to write, integrate, test, document, and maintain even a simple easter egg to the same quality standards as the rest of the curl project.

That last bit is key - to the same quality standards. curl is a really well-done, carefully-built-and-tested project. If we were talking about most other pieces of software - yes, a small easter egg wouldn't have taken much effort. Not in this case.

If someone else had volunteered to take on all of the effort of maintaining the easter egg, Daniel might let it in - but that would still be more work on his part to rope them in to test their thing after every change to code adjacent to the feature.

Conversely, nobody prevents you from forking curl and adding the easter egg in yourself. Why don't you?

oh_sigh• 5 years ago

There's no need to gate-keep software development. People do it for all different purposes.

city41• 5 years ago

To me the real reason to not do them is outlined in the "useless work" section. They add surface area, support and maintenance to a project for essentially no gain. For a project as popular and visible as curl, I'd imagine avoiding having to talk about it, and dealing with feature requests and PRs on it alone makes not having an easter egg well worth it.

mikestew2• 5 years ago

Is that egg accounted for in the threat model? Did we just unnecessarily add to the attack surface? Does it get regular reviews? Does it have tests? Are we willing to continue to donate the cost of maintaining this "component" that serves no purpose but entertainment?

In this specific example, it's friggin' curl, whose whole existence is to go to talk to other machines over a hostile network. I'd rather it stick to its one, really, really hard job and not get cute.

hoten3• 5 years ago

Sure. Was only debunking the false premise that it needs to be secret, which the article highlights as why it's a really bad idea.

pyuser583• 5 years ago

I mean Python has all the functionality of curl (potentially, at least) and it has an Easter egg.

At the same time, I could see someone launching an attack with a module “this.py” that outputs the Zen of Python and also installs a back door.

Come to think of it, one of the nastiest problems in Python programming is keeping track of which modules are in the PYTHONPATH (“hmm why is ‘pytest tests/test_my_module.py’ throwing an import error?”)

Maybe Easter eggs are a bad idea?

shagie• 5 years ago

Even then it can be problematic.

https://unix.stackexchange.com/questions/405783/why-does-man...

hoten3• 5 years ago

That wasn't behind a flag.

Really, I'd call that a prank, which is bad taste in software, not an Easter egg.

belval• 5 years ago

It goes to show that even stuff that I would consider rock solid (such as man pages) can be surprisingly brittle if one person can make a change over a tweet.

Some comments on the SO thread seem to imply that it shouldn't have been removed but I don't think this was a "good" easter egg. The joke is good, but it should have been harder to trigger (in my opinion).

piaste2• 5 years ago

If you want to have fun with utilitarian tools, simply apply the Unix philosophy:

fortune | cowsay | git commit -F -

JCWasmx862• 5 years ago

I added "fortune | cowsay -f tux| lolcat" to my ~/.bashrc. It is always nice to see some often inspirational or thought-provoking quote if I open a terminal window.

mattowen_uk3• 5 years ago

I've ported fortune to Win32, and now have it show me a nice quote whenever I open a Command Prompt. It was feature I always wanted to have, and gave up waiting for MS to provide it.

For me, my first ever experience of fortune was on DEC VMS systems.

gonzus• 5 years ago

Thanks for that! I added -a to fortune, so every once in a while (but not always) I get an offensive aphorism -- yes, I am willing to be offended! NOTE: this may require installing the offensive fortunes package.

zdw• 5 years ago

I see you're also an Ansible user.

piaste2• 5 years ago

Never had the pleasure. I skipped the whole configuration management era and went straight from Windows "click around the UI following this manual procedure" to cloud-config and IaC.

0des8• 5 years ago

It feels like gradually things are getting 'less fun'. We can't have nice things, people can't do jokes, everything is like "your service must be completely professional even if it is just this thing you needed and built and offered to others for free". Everything is SO SERIOUS now, when one thing isnt how a small group feels it should be, suddenly everyone mobs up and more fun disappears.

Is there a generation thing that made this happen? It seems now that no matter what you do, if it deviates from what a paying user would expect, even if the thing is free, that as a developer you can get called up in front of these ad-hoc tribunals of the common man to answer and atone for your sins.

It's so dumb the way the internet is going, I thought when we invented it that things would be so much better. I have nothing but spite for the last 20 years of the way we have treated this golden resource.

droopyEyelids• 5 years ago

In a way, your comment is an example of itself.

nathanaldensr• 5 years ago

I think you are correct in your observations, but I'd attribute the real cause to something other than "fun:" our low-trust society. Things can be fun when one doesn't have to worry about attacks from every angle, in the case of software. There are so many malicious actors out there that one is no longer allowed to "have fun" with hidden software functionality. It might increase the attack surface of your application.

MisterTea• 5 years ago

Everything is SO SERIOUS now, ...

Now? It's been serious since computers were originally built for business. It became a little more lax in the 90's and the 00's with the rise of the web. This has also coincided with a sharp increase in code size and decline in quality. Maybe we need to be more serious.

rattlesnakedave• 5 years ago

This has also coincided with a sharp increase in code size and decline in quality

Lol this is one hell of a claim to just slip in.

arpyzo• 5 years ago

Imagine making this complaint with regards to electrical, or plumbing work. How would you feel if your electrician put an easter egg in your home's electrical system?

0des8• 5 years ago

These are not the same! Plumbers don't make piping for fun and then allow others to use it for free.

laumars8• 5 years ago

Easter Eggs have lead to do many security concerns over the years that software authors have had to get serious.

To put it another way, an easter egg in a TV show or movie is interesting and fun. An Easter egg in a critical system in a plane or car is not amusing.

0des8• 5 years ago

Hang on, this exact situation is like if I make a cake, and as people walk by and see it, they want a slice too. So I say "sure have a slice, its free cake, I made it for myself but it's also free for you".

The person who decides that their steakhouse is going to make my free cake the centerpoint of their dessert cart and then expresses dismay that I like cream cheese icing on my free cake can fuck right off and bake their own cake.

In this case the author is saying that they don't do easter eggs because it would cause an erosion of trust, and that's fine, that's their prerogative and I get it. HOWEVER, let us not be fooled that there isn't an outrage contingent waiting to pounce every time someone dares to make free software the way it is most useful/accurate/fulfilling for themselves. This causes a chilling effect for a portion of us who write free software.

efsavage2• 5 years ago

It's not a generation thing, it's a paycheck thing. curl is run many many billions of times per day in lots of critical workloads. There's nothing to stop anyone from developing a similar library with some jokes in it. I'd probably use it for ad hoc or personal stuff, but I don't want this in the thing I'm getting paid to built, and going to get paged* for when the joke shows up in the wrong place.

* Ages ago, when the millennials were still in grade school and CMS was still a multi-million dollar proposition, I wrote a nifty little copyediting tool for a Very Large Telephone Customer. Someone made a benign jokey edit in during a demo of the tool, which made it to production. The next day there was an emergency meeting with over 150 people across several offices about "what happened" that led to a page deep in the site showing people in New Jersey that calls from your basement were free.

dijit• 5 years ago

I understand your argument; but it sounds to me like you expect hobby projects to be paying your wage.

I know we stand tall because we stand on the shoulders of giants (and, in our industry: many giants!) but I don't think you can expect any form of guarantee that curl continues to work exactly like you expect unless you're paying for it.

It's a different story if you have some kind of enterprise contract, but somehow I have the impression that we're all using cURL for free and paying nothing for support-- thus, there is no support and you shouldn't really expect any.

If you want to make cURL-Enterprise then that's fine..

but it's a bit unfair to co-opt someone else's project just because you and I chose to use it professionally.

(this applies to me also: I am guilty of this, I'm not pointing fingers at you specifically; just my, and our, collective attitude)

gopher_space• 5 years ago

Looking at it another way, you didn't need to set up any tooling to shepherd data into production because everyone involved understood the point of the joke. It was a very clear example of GIGO for your entire company and the cost was one meeting.

A lot of my joke errors boiled down to "you've hit an edge case I didn't handle, here's an easily searchable string to find the location". They were jokey because the subtext was another late night and you might as well soften the blow.

nindalf• 5 years ago

I wouldn’t read the article as a polemic against all Easter eggs, just not in critical lower level infra where reliability and security are paramount. So Easter eggs in my music player - sure. In my pacemaker - not so much.

___q• 5 years ago

Everything is SO SERIOUS now

Actually, if you read the article the author explain why this only applies to curl, and explicitly says they understand if other software wants to continue including easter eggs

snowwrestler• 5 years ago

I’ve noticed the same thing, and I think it comes down to this: the Internet is important now.

I started online in the early 90s. The Internet was not important back then. Not much depended on it, there weren’t many people on it, so the folks who were there could fuck around and not worry about it. Jokes are easy and safe when they are low-stakes.

Now, the Internet is extremely high stakes. A huge part of society depends on it. People are just naturally less willing to tolerate jokes in things they depend on. Powerful emotions involving fear and safety and security and power can get invoked, maybe accidentally.

Let’s say you’re driving with some friends and one falls asleep. So as a joke, the driver gives the car a swerve and everyone yells. The friend wakes up in a panic and everyone laughs, hopefully including them, eventually.

Now let’s say you’re flying across the Pacific. You fall asleep, but then wake up as the plane starts to drop and the pilot is yelling over the intercom. But then he straightens out and says, “just kidding folks! Ha ha ha, you should see the looks on your faces.” To many people, that’s not so funny.

Basically the Internet started as a car full of friends and now is a giant airliner with everyone in it. So the “pilots” are held to a higher standard.

Seems to me that there are still communities of jokers on the Internet to be found. They just tend to operate at “joke scale,” which is now a lot smaller than “entire Internet” scale.

threatofrain• 5 years ago

I'd also argue that jokes in the business world aren't that funny; they feel like advertising in another form, an attempt to ingratiate a brand through emotional means.

leephillips• 5 years ago

curl is part of the network infrastructure. We want a lack of fun there. Putting an Easter egg in Minesweeper is a different basket of rabbits.

tombert2• 5 years ago

I mean, I don't think it's generational at all, there are plenty of libraries on Github that are meant to be fun and silly [1] [2] [3] [4].

I think we've largely just decoupled the fun and goofy projects from the mainline projects; I think businesses have less of a sense of humor than engineers.

[1] https://github.com/Herzult/SimplePHPEasyPlus [2] https://github.com/philipl/pifs [3] https://github.com/hubsmoke/bro [4] https://github.com/jneen/balls

asveikau• 5 years ago

I don't know how this post serves your "generational" observation when curl was introduced in 1996.

SamReidHughes• 5 years ago

I'm too young to really say, but I think the widespread use of code review and project management software has caused this.

rgovostes• 5 years ago

PHP has some Easter eggs which reveal contributor credits in response to a request with certain GET parameters. This can be used to fingerprint the server version: https://labs.detectify.com/2012/10/29/do-you-dare-to-show-yo...

colonelpopcorn• 5 years ago

I think this is really why we can't "have fun" anymore. Because bad actors exist and can exploit things being done "just for fun". I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.

howdydoo• 5 years ago

It's more of a risk/reward thing. Any code on a networked computer has non-zero risk. And what's the reward... an engineer had fun at work today? That's not a very compelling argument in a business context.

I say this as someone who snuck an easter egg into our product at my last job. Yes, it was fun, but if I had gotten in trouble for it, I would have deserved it.

gumby3• 5 years ago

I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.

I think it’s hard to think of the problem that way.

These days* of course you have to worry about security on almost anything you work on. And when you do, the folks who think of security all the time are going to tell you to simplify your interfaces so they are easier to think about, then then armor them. What a pain!

But we do those things because of all the bad actors. The security recommendations are a consequence, not the cause.

* I grew up — literally — in a non-security environment: networked computers with no passwords or any other security. The only “protection” what would be called today kernel space memory barrier just to protect against bugs, and most machines didn’t have that. It was the late 70s and security was considered a barrier to hacking. I knew people working on security and frankly it seemed weird.

tomrod• 5 years ago

MoTD and have fun all you want for people who should have access.

Zababa• 5 years ago

I think this is really why we can't "have fun" anymore. Because bad actors exist and can exploit things being done "just for fun".

That's often how things works. With friends we joke around a lot because we know each other well and know there aren't bad actors. At work, I'm way more careful. If there were no cases of harassement, exploitation or things like that at work I may joke around more. But since they exist, I'm more careful. I don't want to harass people, be seen as an harasser, or create an atmosphere were harassers feel welcomed.

When bad actors exist, the way to show good will is to not act like them, so they can be quickly identified and removed.

johannes1234321• 5 years ago

Question is what you gain by knowing the version. Better just fire your arsenal of attacks than waste time trying to figure this out as many sites will hide these things anyways.

mixedCase• 5 years ago

While a bit of an extreme scenario, I can imagine it being useful for high-level actors with their own private vulns which they'd like to keep on the down low unless absolutely necessary.

jen20• 5 years ago

By knowing the version, you can more efficiently determine which CVEs may apply, surely?

dmitriid• 5 years ago

The arsenal of attacks includes "let's try and figure out server version", too.

Because if you know the version, it gives you a shortcut, and you can immediately switch to a smaller arsenal designed for that specific version.

mrob• 5 years ago

Exploiting a memory corruption vulnerability depends on the exact details of the software version and platform. Attempting the wrong exploit risks crashing the process, which might be noticed and investigated.

teh_klev• 5 years ago

Not sure why you're being downvoted. Your question is reasonable and any attacker worth their salt will fire a full arsenal of all the CVE's at your environment regardless of version.

Hiding version numbers etc is an example of "Security through obscurity" and is a weak defence strategy:

https://en.wikipedia.org/wiki/Security_through_obscurity

jaden• 5 years ago

It looks like they were removed several years ago.

Update 12-04-2017: This feature was removed in PHP 5.5.

teejmya• 5 years ago

This is precisely why it's useful for fingerprinting -- If you get this response, you know that an old, out of date version of PHP is in use.

DyslexicAtheist• 5 years ago

All the CISCO networking solutions contain Easter eggs, that allow you to see everything because you get full root. Haters insist on calling them backdoors of course.

xylol• 5 years ago

If they are security risks, why are they not removed?

Borgz• 5 years ago

The post says that Easter egg only works if 'expose_php' is set in php.ini, which will also report the PHP version in the X-Powered-By header of every response. So it doesn't seem to leak any information that wouldn't already be available.

_-david-_• 5 years ago

Unfortunately it is (or at least was) enabled by default.

wodenokoto• 5 years ago

I too feel an innocence has been lost in software and the internet. It's a shame that things can't be so whimsical, but it is also good that serious software is taken more and more serious.

I think this is the right decision by curl and I support it.

cogman10• 5 years ago

I'd say I think it depends on the software, but agree with your assessment.

Curl is just perched at a position where an easter egg introducing a vulnerability would be disastrous. I feel the same about OpenSSL or the kernel. Software that is highly security sensitive shouldn't have easter eggs.

On the flip side, I'm fine with grep or yes having an easter egg or two. It's hard to imagine using them in such a fashion where that'd create a security risk.

alok99• 5 years ago

I totally understand this stance. Not every game had cheat codes, not every movie/TV show has hidden details, and so not every piece of software has to have easter eggs. That kind of defeats the fun of it anyway, knowing that everything has a joke.

I personally like adding easter eggs to my own code, but I wouldn't do it in software used by billions. At most a funny comment in the code, but nothing executable.

miniwark• 5 years ago

Well it's probably a good idea. man had for years a "gimme gimme gimme" (a man after midnight) in the past. A fun Easter Egg but...

See : https://unix.stackexchange.com/questions/405783/why-does-man...

notacoward• 5 years ago

I sort of remembered this and was going to comment once I found it, but you beat me to it - and saved me some work. Thanks! It's a very relevant and important story.

jraph• 5 years ago

It reminded me of apt-get moo and aptitude moo, which do not seem risky or to trigger unexpected things (since they just print text when using specific, useless flags), nor cause maintenance troubles, and yet those programs are on many computers.

I don't care that much about the presence or the absence of easter eggs in curl or in most tools. It's still cool that some have easter eggs if they are inoffensive. Documented easter eggs are fine too.

Curl is a great tool and I'm perfectly fine (if not thankful) with this decision.

ramses0• 5 years ago

I've viewed that flag as an admission or convenient hookup point for new features under development, and have taken to adding a `--moo` or `--wip` flag which is a convenient starting point for adding something new to a utility.

It's much easier for a developer that's new to a project to make `--moo` do something different than it is to perform all the ceremony to get a `--feature` going in the first place.

nabakin• 5 years ago

If anyone is interested in Easter eggs, I run a subreddit for them at https://www.reddit.com/r/eastereggs

emptyparadise• 5 years ago

A nice harmless easter egg I see a lot is naming variables in test suites after characters.

bellyfullofbac• 5 years ago

He could put the easter egg externally, e.g. create a page on his site that would react differently if fetched with the curl user-agent compared to all other user agents. So all the code would be server side and it'd still be an easter egg, because you get it by entering a certain input.

e.g. curl hxxps://haxx.se/something-cute-here

Obviously one day someone might see that page in the browser, thinks they need to get an offline copy of it, does a curl and gets something different. But I guess that's a surprising behavior of the server and not the client. Lots of servers already do this to do a first-level filter against people who can't figure out how to set curl's user-agent...

colejohnson66• 5 years ago

It’s (sadly) possible to detect curl|bash, and use it for malicious purposes: https://web.archive.org/web/20180124002447/https://www.idont... (original URL is giving an HSTS error)

unethical_ban4• 5 years ago

This is such a stereotype of a kind of over-analytical type that it's hilarious. There are so many poor assumptions and overcaution.

"If we put an easter egg in, it would be impossible to sneak in" - It isn't about being completely undetected for the people looking at source code, it's for the people who want to see a funny print output.

"If we put an easter egg in, more people will want to put more in, or make the original more elaborate" - complete speculation, handled if true by the word "no".

"I bet you all think me writing this means I'm hiding something" - projecting much?

"If we would allow some features to get added like that, where would we draw the line? What other functionality and code do we merge into curl without properly disclosing and documenting it?" - Uh, the line is the definition you put in the top of the article: "An unexpected or undocumented feature in a piece of computer software, included as a joke or a bonus." This excludes malicious or harmful software.

"We frequently ship bugs and features that go wrong." Yeah, it seems you have more important work to do if that statement is accepted as a given. And when the heck does a bug look like an easter egg?

eternityforest2• 5 years ago

At this point the lack of any Easter Eggs almost IS the hidden feature. I would not have expected this much discussion and controversy, it causes more surprise than an actual egg in the app would!

unethical_ban4• 5 years ago

I'm almost ashamed for having spent any time responding to the original submission, butb here I am. I agree, it is much ado about nothing.

Of all the data breaches, of all the zero days, of all the massive bugs found in open source software, how many have been caused by Easter eggs?

chris_wot2• 5 years ago

I think you miss a few key points:

1. Including undocumented code is a breach of trust.

2. Adding a “fun” piece of code that’s not useful (and “secret”!) adds to the burden of maintainership.

3. People will inevitably want to add to the Easter egg code. Maintainers by and large are overworked, especially for software used on the scale of curl. They have better things to do.

If you want curl with Easter eggs, fork it and see if others will use it.

unethical_ban4• 5 years ago

My entire premise is that you are wrong on all counts. Your ideological point is balanced by the fact that no one cares in reality. `apt-get` and other tools are used in critical systems all day long, and Krebs isn't blogging about it. Easter eggs aren't causing outages and data breaches. The fact we're discussing it all is a form of bait; the entire discussion is useless and distracting a-la Twitter culture wars, but we're addicted to the debate of minutiae.

The only point I acknowledge is part two of point #3: They have better things to do, especially if, as the author says, they constantly ship buggy code.

ilogik• 5 years ago

on the other end of the spectrum, James Thomson created a driving game in the about screen of PCalc, a calculator app: https://www.macstories.net/reviews/pcalcs-delightfully-insan...

crawl_soever• 5 years ago

Top has a few easter eggs that have persisted. Check out top(1) section 7: STUPID TRICKS Sampler. Several issues have been filed like https://bugs.launchpad.net/ubuntu/+source/procps/+bug/446002 but I am happy to see relics like how to enter "the super bounce zone" remaining in nearly every distro containing top.

jeroenhd• 5 years ago

This argument works the other way too: if you don't want people to rely on and demand support for your code add in a bunch of easter eggs. The more random the triggers, the better.

Random people on the internet can use your code fine, but big corporations run into issues because they need boring software. I think that's neat.

mperham• 5 years ago

Sidekiq has several easter eggs, involving emoji code.

https://github.com/mperham/sidekiq

Those eggs did require fixes from YARD and code linters, in order to support emoji code, so in a sense they helped make the ecosystem better.

eternityforest2• 5 years ago

I don't think I've ever put a true easter egg in software. I do decorations instead.

A random quote on a login page, some skeuomorphic theming, a config option to put particle effects on your custom dashboards.

I wouldn't really trust software less because of eggs though, unless it could be triggered by in band data. --egg is fine, triggering on nano activateEgg.txt is a problem.

matsemann3• 5 years ago

I guess it depends on your definition of easter eggs. Some of our "easter eggs" are loading icons showing at specific events. So right now they are christmas themed.

ReleaseCandidat• 5 years ago

There are no Easter eggs, but how about Saint Nicholas nuts or Christmas presents?

slmjkdbtl• 5 years ago

Fun and jokes are healthy for any kind of community, but things like easter eggs definitely shouldn't be forced.

can16358p• 5 years ago

There is another side of the coin:

Not to directly defend easter eggs but if we allow people to insert easter eggs, sure it creates slightly more work and potentially create an attack surface (albeit very unlikely), but in return you get something hard to measure directly. People love and embrace what they work with, they care about the project, spend extra time on it because it creates belonging and sympathy. It makes a little happier developers and a community, which eventually results in a better-cared project.

Even knowing any potential downsides of adding an easter egg to a program, I think upsides are a little higher. It's just hard to quantitatively measure.

coldtea• 5 years ago

The primary and main reason is the question of trust.

No product (where no = a statistically insignificant percentage) ever lost trust because of an easter egg.

There are tons of other reasons for losing trust...

pierrebai• 5 years ago

Weird, I could have sworn I've read this before, not necessarily about curl, but the exact same words and sentiment. Searching for "no easter egg in" yielded nothing. Yet the post is dated as of today. Maybe I lived briefly in an alternate universe?

Maybe it was this: https://docs.microsoft.com/en-us/archive/blogs/larryosterman...

Which was discussed on HN in 2005 here: https://news.ycombinator.com/item?id=17517085

phendrenad2• 5 years ago

Easter eggs are fine, as long as you hide them in a "non-work area" and not a "work area". In the 80s and 90s, on Macintosh, it was customary to hide easter eggs in the "About" dialog box. Since nobody was relying on the about dialog to do real work, it's safe.

An analogous place to hide easter eggs in a CLI program like Curl might be in the --help dialog. Nobody is parsing the output of `curl --help`, so it's safe.

No Easter Eggs in Curl

Related Stories