> He deleted his bash history— the commands he had typed into his own Goldman co...

nmrm · on April 12, 2014

$> some_command --username myusername --password mypassword

$> history

...

12345 some_command --username myusername --password mypassword

This comes up fairly often with poorly designed CLI's. Wiping your bash history after running the command isn't an unreasaonble hack.

Edit/Addendum: Although there are other (perhaps better) ways to achieve the same effect, the main point is that doing a "history -c" should be considered no more suspicious than e.g. closing a document to clear your "undo" history.

zx2c4 · on April 12, 2014

Fair enough. Though,

    read -p "Password: " -s password; some_command --username myusername --password "$password"

0x0 · on April 12, 2014

Although this avoid a .bash_history entry, this will still make the password visible to "ps ax" on most multi-user systems.

NoodleIncident · on April 12, 2014

A space before the command stops it from going in your history, though.

ewams · on April 12, 2014

is that only for certain distro's because that isnt true on debian:

115 history

116 history (1 space)

117 history (2 spaces)

118 man passwd

119 passwd -a (1 space)

120 history

121 passwd -a (2 spaces)

122 history

puls · on April 12, 2014

You can control this with the HISTCONTROL and HISTIGNORE environment variables: http://askubuntu.com/questions/15926/how-to-avoid-duplicate-...

judk · on April 12, 2014

Thank you for providing something of technical value in this conversation.

dfc · on April 12, 2014

Much to my dismay this is not true. By default debian is configured to `ignoreboth` ie dupes and spaces. Like you I also change the debian default for HISTCONTROL. Lines 11-13 of /etc/skel/.bashrc:[^1]

  # don't put duplicate lines or lines starting with space in the history.
  # See bash(1) for more options
  HISTCONTROL=ignoreboth

[^1]: https://bazaar.launchpad.net/~doko/+junk/pkg-bash-debian/vie...

Provenance for /etc/skel/.bashrc:

  dfc@ronin:~$ dlocate /etc/skel/
  bash: /etc/skel/.bash_logout
  bash: /etc/skel/.bashrc
  bash: /etc/skel/.profile
  dfc@ronin:~$ apt-cache showsrc bash |grep ^Vcs-
  Vcs-Browser: https://code.launchpad.net/~doko/+junk/pkg-bash-debian
  Vcs-Bzr: http://bazaar.launchpad.net/~doko/+junk/pkg-bash-debian

paxswill · on April 12, 2014

It's controlled by the HISTCONTROL variable in bash. If it contains 'ignorespace' (or 'ignoreboth' to ignore duplicates as well). Check the man page for more details.

judk · on April 12, 2014

Anyone know why this incredible hack was introduced in hr first place? In my entire career this "feature" had only caused annoyance after copy-pasting a command.

Why not have a shell command called 'nohist' to wrap a command line?

dolzenko · on April 12, 2014

Exactly my feeling, this just doesn't make sense, if he was so paranoid about his password being stolen it's unreasonable to rely on something like "remember to remove the shell history on logout". Then he also uploads the code to some random SVN server...