Hacker News: collinfunk

New comment by collinfunk in "Ubuntu 26.04"

collinfunk — Fri, 24 Apr 2026 08:25:45 +0000

Well the TOCTOU issues do not require you to run untrusted scripts to be exploited. Another user on your system can use a legitimate command that you may run to make changes to files they shouldn’t be able to, or further escalate privileges.

New comment by collinfunk in ""cat readme.txt" is not safe if you use iTerm2"

collinfunk — Sat, 18 Apr 2026 19:01:01 +0000

I am one of them. The title of the substack seems fine since it mentions "if you use iTerm2".

The tweet has no mention of iTerm2 which makes it sound like an issue in 'cat', which is mildly annoying [1].

[1] https://x.com/calif_io/status/2045207168677503241

New comment by collinfunk in "CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root"

collinfunk — Thu, 19 Mar 2026 00:37:14 +0000

fileutils-1.0 was released in 1990 [1]. shellutils-1.0 was released in 1991 [2], and textutils-1.0 was released a month later in the same year [3].

Those three packages were combined into coreutils-5.0 in 2003 [4].

[1] https://groups.google.com/g/gnu.utils.bug/c/CviP42X_hCY/m/Ys... [2] https://groups.google.com/g/gnu.utils.bug/c/xpTRtuFpNQc/m/mR... [3] https://groups.google.com/g/gnu.utils.bug/c/iN5KuoJYRhU/m/V_... [4] https://lists.gnu.org/archive/html/info-gnu/2003-04/msg00000...

New comment by collinfunk in "Good software knows when to stop"

collinfunk — Fri, 06 Mar 2026 00:26:39 +0000

The bar for adding new options, especially short options, is quite high for coreutils. We have a (likely outdated) page of rejected requests [1]. Some of the changes people have strong feelings about...

[1] https://www.gnu.org/software/coreutils/rejected_requests.htm...

New comment by collinfunk in "Statement from Jerome Powell"

collinfunk — Mon, 12 Jan 2026 02:27:03 +0000

I don't think this addresses the main point of my question, though. Do you know any prominent Democrats, e.g., representatives, senators, or presidents, who have called for a Republican to be killed?

New comment by collinfunk in "Statement from Jerome Powell"

collinfunk — Mon, 12 Jan 2026 01:35:15 +0000

Even if one grants that it is a small minority, aren't they still voting for someone who advocates for jailing and killing political opponents?

New comment by collinfunk in "Statement from Jerome Powell"

collinfunk — Mon, 12 Jan 2026 01:23:58 +0000

Trump appointed him. Do you put not blame on him for choosing "uniparty birds" and "shades of grifters"? Or do you live in his colon.

New comment by collinfunk in "Statement from Jerome Powell"

collinfunk — Mon, 12 Jan 2026 01:22:55 +0000

It seems like they learned a lot from the Letitia James and James Comey cases, which are going great (not in the way they intended).

New comment by collinfunk in "Gpg.fail"

collinfunk — Sat, 27 Dec 2025 17:54:51 +0000

Haven't read it since it is down, but based on other comments, it seems to be an issue with cleartext signatures.

I haven't seen those outside of old mailing list archives. Everyone uses detached signatures nowadays, e.g. PGP/MIME for emails.

New comment by collinfunk in "Rust Coreutils 0.5.0 Release: 87.75% compatibility with GNU Coreutils"

collinfunk — Sun, 14 Dec 2025 19:59:42 +0000

MacOS's utilities are really just FreeBSD's with some patches.

https://github.com/apple-oss-distributions/text_cmds https://github.com/apple-oss-distributions/system_cmds https://github.com/apple-oss-distributions/file_cmds https://github.com/apple-oss-distributions/adv_cmds https://github.com/apple-oss-distributions/shell_cmds https://github.com/apple-oss-distributions/misc_cmds

New comment by collinfunk in "Using Python for Scripting"

collinfunk — Fri, 12 Dec 2025 18:19:06 +0000

FreeBSD 6.0 added 'env -S'. They have adopted a few different GNU inspired options recently, which I am happy about.

New comment by collinfunk in "Notes by djb on using Fil-C"

collinfunk — Sun, 02 Nov 2025 19:56:34 +0000

Yes, linking LLVM takes up a lot of memory. The documented guidance is to allow one link job per 15 GB of RAM [1].

[1] https://llvm.org/docs/CMake.html#frequently-used-llvm-relate...

New comment by collinfunk in "Hard Rust requirements from May onward"

collinfunk — Sat, 01 Nov 2025 21:09:59 +0000

A lot of the complexity is to handle localized date formats on systems that support them. Most other implementations of 'date' do not do this.

The easiest way to see this is in US locales, which use 12-hour clocks in GNU 'date' but not other implementations:

  $ date -d '13:00'
  Sat Nov  1 01:00:00 PM PDT 2025
  $ uu_date -d '13:00'
  Sat Nov  1 13:00:00 2025

I added a test case for that recently, since it is a nice usability feature [1].

[1] https://github.com/coreutils/coreutils/commit/1066d442c2c023...

New comment by collinfunk in "Hard Rust requirements from May onward"

collinfunk — Sat, 01 Nov 2025 20:01:45 +0000

2 GNU coreutils maintainers, including myself, monitor the issues and PRs on a GitHub mirror that we have [1]. Generally the mailing list is preferred though, since more people follow it.

[1] https://github.com/coreutils/coreutils

New comment by collinfunk in "Date bug in Rust-based coreutils affects Ubuntu 25.10 automatic updates"

collinfunk — Fri, 24 Oct 2025 08:09:33 +0000

Yep. I was slightly incorrect in my original message, though. SUSv2 (1997) specified egrep and fgrep but marked them LEGACY. POSIX.1-2001 removed them.

The only place that that doesn't support 'grep -E' and 'grep -F' nowadays is Solaris 10. But if you are still using that you will certainly run into many other missing options.

[1] https://pubs.opengroup.org/onlinepubs/007908775/xcu/egrep.ht... [2] https://pubs.opengroup.org/onlinepubs/007908775/xcu/fgrep.ht...

New comment by collinfunk in "Date bug in Rust-based coreutils affects Ubuntu 25.10 automatic updates"

collinfunk — Fri, 24 Oct 2025 07:49:17 +0000

Minor correction, but that bug was never in any "official" coreutils release. The bug was in a multi-byte character patch that many distributions use (and still use). There have been other CVEs in that patch [1].

But the worst you can do is crash 'sort' with that. Note that uutils also has crashes. Here is one due to unbounded recursion:

  $ ./target/release/coreutils mkdir -p `python3 -c 'print("./" + "a/" * 32768)'`
  Segmentation fault (core dumped)

Not saying that both issues don't deserve fixing. But I wouldn't really panic over either of them.

[1] https://lwn.net/Articles/535735/

New comment by collinfunk in "Date bug in Rust-based coreutils affects Ubuntu 25.10 automatic updates"

collinfunk — Fri, 24 Oct 2025 01:36:02 +0000

> See also the recent insanity of GNU grep suddenly tossing an error when invoked as "fgrep". You just don't do that folks.

The 'fgrep' and 'egrep' didn't throw errors, it would just send a warning to standard error before behaving as expected.

Those commands were never standardized, and everyone is better off using 'grep -F' and 'grep -E' respectively.

New comment by collinfunk in "A years-long Turkish alphabet bug in the Kotlin compiler"

collinfunk — Sun, 12 Oct 2025 22:45:33 +0000

> While half of the language design of C is questionable and outright dangerous, making its functions locale-sensitive by all popular OSes was an avoidable mistake. Yet everybody did that. Just the existence of this behavior is a reason I would like to get rid of anything GNU-based in the systems I develop today.

POSIX requires that many functions account for the current locale. I'm not sure why you are blaming GNU for this.

New comment by collinfunk in "Show HN: ut – Rust based CLI utilities for devs and IT"

collinfunk — Sun, 05 Oct 2025 21:58:17 +0000

Note that uutils does not work if the file does not fit into memory.

With GNU coreutils:

   $ base64 /dev/zero | head -c 1 | wc -c
   1

With uutils doing the same would exhaust your systems memory until either it freezes or oomd kills the process.

New comment by collinfunk in "Ubuntu 25.10's Rust Coreutils Is Causing Major Breakage for Some Executables"

collinfunk — Sat, 27 Sep 2025 19:37:29 +0000

Ah, I should have guessed from the program name. :)

I thought I remember Go having pretty optimized assembly for crypto routines. But I have not used the language much. If you have your source code uploaded somewhere I'd be interested to have a look to see what I am missing out on.