Running "n stable" removed bin, lib, share, include directories from /usr/local

https://github.com/visionmedia/n/issues/86

by almost • 14 years ago

88 59 14 years ago

cmwelsh2• 14 years ago

I used to use n before I found out about nvm[1]. I used to have issues installing Node.js packages with n, but so far nvm just works.

The best advantage of nvm is that I can easily install global packages without being the root user, because it installs your Node.js files in a per-user ~/nvm/ folder (this is customizable to whatever folder you choose).

[1] https://github.com/creationix/nvm

dfc• 14 years ago

"The best advantage of nvm is that I can easily install global packages without being the root user"

One of us is very confused (it easily could be me). I do not understand this statement at all. How is something global if its in a user directory?

cmwelsh2• 14 years ago

When you install a package using npm with the flag -g, it means that the package is global, i.e. available from any current working directory. The default is to only search the current directory hierarchy for a folder called "node_modules". That way every project that you work on can have its own versions of every library, instead of sharing them for the entire system. You can learn more about "global" vs "local" packages by reading the npm manual.

almost3• 14 years ago

Looks like the mods changed the title I gave. Just for those that don't know, "n" is a version manager for Node.JS that some use to handle multiple copies of Node.JS on their system.

nym• 14 years ago

Your original title was slightly linkbaity. I approve of the mod's change for clarity.

almost3• 14 years ago

They were probably right to do it. But it would have been useful to keep the reference to Node.JS in there as not everyone knows what "n" is.

lukeschlather• 14 years ago

I was hopelessly confused by the title. It may have made the title not linkbait, but it definitely muddled things.

benatkin5• 14 years ago

He merged a pull request from someone he probably didn't know (new to node.js, different country). Without looking at the rest of the file it looks OK to me. That's probably what happened - he didn't get all of the program's relevant structure in his mind when he read the code.

https://github.com/visionmedia/n/pull/85/files#r1781158

zobzu2• 14 years ago

Which is slightly scary security wise. Over the large number of libs, programs, etc people often pull half-blind if the code looks "mostly ok and does what it says"

Except it can do also a lot of other bad things, and its too much to review. So in the end you trust the tree owner, and he blindly trust a zillion people.

I actually have zero good solution to this, but it'll be interesting when it is used for a large attack.

rhizome• 14 years ago

As far as the headline goes, not running any of this as root is a good start.

adgar25• 14 years ago

> Except it can do also a lot of other bad things, and its too much to review. So in the end you trust the tree owner, and he blindly trust a zillion people.

> I actually have zero good solution to this, but it'll be interesting when it is used for a large attack.

The only solution is intelligence and prudence on the part of the tree owners. Large software systems need to ultimately be in the hands of smart and wise people. Unfortunately, that wasn't the case here.

benatkin5• 14 years ago

Ultimately the tree owners need to be bigger and have more resources devoted to them. The rails project routinely gets major bugs fixed in under a day.

biturd• 14 years ago

> I actually have zero good solution to this, but it'll > be interesting when it is used for a large attack.

I don't know what this software is or anything about it aside from an estimating that it appears from comments here and on GH that it's serious as it deletes highly important directories and is possibly a widely used software package.

Whenever I install from source I run the installer as non root. It will error on higher than my user privilege deletes telling me I need to be root. In this case I believe I would have seen the attempt to remove important directories as an error alert.

If I have to be root, running as non root first has helped me as a purely investigative method to installations.

What if everyone adopted an 'rm -rfi' type command for any deletes. Then you are asked: "You are about to remove $dir are you sure you are okay with this? Y/N?

In this case, what I don't get is how it's now been three days and there hasn't been a rollback, pulling of the software, patch, notice, billboard, radio announcement, Emergency Broadcast Syatem alert, or otherwise some way to halt this problem dead in it's tracks right this very second.

It's almost like: README This software is 'use at your own risk', etc., etc., etc., see Hacker News for any potentially dangerous side-effects caused by installing this software.

emmelaich• 14 years ago

The change also has one of my pet hates: the -f flag to rm. It not only means force, it means ignore errors. If you're not interested in errors, why attempt to do it in the first place?

benatkin5• 14 years ago

git has done an excellent job of bringing this abuse into the 2010s. If you need to delete a local copy of a git repo, which is often only useful for a couple minutes while evaluating code, you have to do something to override the read only files git creates. Mercurial doesn't have this issue.

jlgreco• 14 years ago

I think it is a great flag, if used with that functionality in mind. Useful reasons very similar to why the -p flag to mkdir is useful.

Confusion• 14 years ago

To remove stuff?

paulrademacher• 14 years ago

https://github.com/visionmedia/n/pull/85/files#r1781158

  |  for d in bin lib share include; do
  |    rm -rf $N_PREFIX/$d

LGTM!

rat87• 14 years ago

Reminds me of https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue... (install script does rm -rf /usr for ubuntu) although I guess deleting /usr/local isn't nearly as bad.

1SaltwaterC2• 14 years ago

Depends on platform. It is under FreeBSD. It wipes the entire userland that isn't part of the base system. That means every piece of software installed from the ports collection.

lmm3• 14 years ago

Yeah, but honestly that's FreeBSD's fault for installing system-managed software in a poor location for such.

(speaking as a FreeBSD user myself)

SCdF• 14 years ago

Somewhat off-topic, but allowing people to post inline images-- especially animated ones, is such an awful idea.

protomyth• 14 years ago

Makes me wish we had a transactional file system and the ability to force certain deletes to verify even if run as root with the -rf flags so we could roll back this type of thing.

cokernel_hacker• 14 years ago

Transactional filesystems have been implemented at considerable expense. To be clear, I mention transactions at a high enough level to encompass deleting a subdirectory (most reasonably implemented filesystems have support for tiny transaction that ensure that metadata is available on disk in a consistent fashion).

When I say considerable expense, I mean _very_ considerable expense. I know of no efficient implementation and only one practical implementation: TxF. TxF is not very fast either, it requires double the writes and, on top of that, is not easy to use. Microsoft is considering deprecating TxF due to the cost of continuing it's maintenance at the expense of other features [1]

I think a more reasonable model for what you want is filesystem snapshots. This is a feature that can be implemented with relatively high performance and without causing terribly large amounts of complication (needing to transact file descriptors, etc.)

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/hh80...

lmm3• 14 years ago

My setup is pretty simple and could recover from this with few problems: I use ZFS and have zfSnap configured to take a snapshot every hour, saved for five days. So I'd lose potentially the last hour's worth of changes to /usr/local, but that's unlikely to be big.

mcosta• 14 years ago

bsd? linux? solaris?

lucian1900• 14 years ago

I think explicitly versioned file systems might be better. Cheaper to implement than transactions and useful in more cases.

tjholowaychuk2• 14 years ago

my bad, sorry about the limbo-merge guys, I'll read PRs closer and/or ignore them since I don't have time

Evbn• 14 years ago

Wow, just today I commented on the Anvil post about how to delete your system using this exact bug.

ben0x5392• 14 years ago

As a non-Node.js user, I'm more bewildered by how easily github issues turn into reddit threads.

TazeTSchnitzel• 14 years ago

Worse than reddit threads. No moderation and unstructured.

Xion• 14 years ago

This looks more like 4chan to me.

1SaltwaterC2• 14 years ago

It isn't a node.js related problem, but more of a GitHub related problem when a specific issue is deemed to be "legendary". Example: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...

almost3• 14 years ago

It only happens occasionally on bugs issues that get a lot of attention (by being posted to HN for example, sorry about that). Usually GitHub issues threads are sensible and helpful places.

ben0x5392• 14 years ago

That's what so scary to me. There's all that productive discussion that is only a step over some noteworthiness threshold away from being completely ruined. I wouldn't think of blaming HN or even reddit submitters for that, though.

Running "n stable" removed bin, lib, share, include directories from /usr/local

Related Stories