Rendered at 19:51:12 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
seoulbigchris 1 days ago [-]
In the mid-90s I taught a night class on Unix, and was experimenting with shell scripts from The Unix Programming Environment. There was an example using a loop and the who command to alert you when someone logged onto your local system. My cousin was a professor at a university several states away, and we had already figured out the talk command. So I decided to expand the examples in the book to use finger. By parsing the reply, somehow I could tell if my cousin was logged on, and I would send myself a notice. There was an ISP in the same building, and one day the ISP engineer came to visit me with a stern look. He asked, "By any chance are you sending a finger command every two minutes to this university's mainframe?" I proudly answered, "As a matter of fact, yes, I am!". I eagerly got out my Unix book to show him what I was doing. He just said, "Stop doing that. They have a system console logging program that has churned out dozens of pages of paper printouts because of you". I sheepishly acknowledged my mistake and quit running the script.
Terr_ 13 hours ago [-]
> finger [...] dozens of pages of paper printouts
I know just the poetry to go with that story:
The Moving Finger writes; and, having writ,
Moves on: nor all thy Piety nor Wit
Shall lure it back to cancel half a Line,
Nor all thy Tears wash out a Word of it.
--Omar Khayyám, 11th-century, translation
poetaster 10 hours ago [-]
Bravo!
inigyou 7 hours ago [-]
This is what teaches people not to do cool things.
It's his fault, not yours, that he wasted paper.
quietbritishjim 1 days ago [-]
I was sure this story was going to end with your script causing chaos by calling finger in a busy loop. But every 2 minutes! Even in the 90s, that's a pretty mild amount of network traffic.
stronglikedan 1 days ago [-]
I think automatically printing the system console log to paper is the real villain in that story.
saidnooneever 12 hours ago [-]
once i saw a guy run a pentest and a box was doing that. it printed an entire vulnerabilityscanner output verbatim all the bytes received o.O guy appearently got handed like 100m of paper with a request to pls not scan _that_ port :'D
some people had these setups and just never saw a lot of traffic because the boxes werent broadly routed on the internet etc. or internal.
now with all the scans and automated spamming by parties its totally unthinkable. most of my server bandwidth despite my efforts is going to this.. (thankfully down pay for that per bytes anymore!)
inigyou 7 hours ago [-]
Printers used to, and maybe still do, have a port open that if you connected to it and send some ASCII text it would print that text. Complete with formatting codes like form-feed to switch to a new page.
15 hours ago [-]
transitorykris 1 days ago [-]
The grey beards in the mid-90s cut their teeth on much more constrained systems! The web crawling these days probably has all the ones who have passed spinning rapidly in their graves.
boomlinde 12 hours ago [-]
Paper companies would rejoice at the idea of OpenTelemetry
mixmastamyk 1 days ago [-]
If running finger causes a paper printout, the issue appears to be with the latter.
kolinko 24 hours ago [-]
early 90s paper may have been cheaper than digital storage I think?
somat 9 hours ago [-]
It may be a case of needing write only logging, I always think of the nuclear power station logging all events to the line printer, But I can see a NOC doing the same, How finger ended up triggering it would probably be a fascinating case study of early innocent decisions getting ossified into the infrastructure.
Sharlin 8 hours ago [-]
Handier to access when something is wrong, certainly.
8 hours ago [-]
inigyou 7 hours ago [-]
Why do they need any storage
saidnooneever 12 hours ago [-]
depends, if its a printer with port 9100 open, or a system that forwards traffic to that, then it will chunk it ontop paper.
It may seem that the admins were wrong to criticize the fingerer for the voluminous output, but if you think about it, paper logging was a very pragmatic security and auditing measure in those days.
We had a lot of printers around the labs in our university, and they were high-speed, high-capacity. And in the earliest days of multi-user and time-sharing, the hardcopy terminal was actually the default, where the fabled "glass terminal" came along later!
So you have a highly secure system and it's outputting important log entries that may need to be examined later, in the case of a malfunction or a compromise attempt. So you send the most important output to your printer, and you get an offline, immutable audit trail to back up your most important log files.
That seems like a very routine and pragmatic step. In the intervening decades, there were many logging strategies, and many of them admitted for "covering your tracks" by hackers who could erase logs and destroy evidence if the admins weren't careful.
But again, if a 2-minute "finger" interval was causing a paper log overflow, the admins could have mitigated that, but perhaps they were justified in telling the kid to knock off the frivolous resource usage.
However, as I worked for an ISP back in those days as well, I can tell you that log overflows were crazy-making. We had a particular system that acted as primary DNS for many customers. And many customers who were brand-new to the Internet and brand-new to this DNS thing were not real good at configuring it according to standards. And so we had a NOC with projection monitors that monitored system status in various ways, and one of them was tailing our syslog file.
And all day long I kept seeing DNS errors. "Lame delegation" was the winner overall, but there were so many. I was so young and had no privileges or knowledge to fix them. But I helplessly watched them scroll, knowing there were issues, slowdowns, and inefficiences that I couldn't solve for them. Sorry guys.
mixmastamyk 16 hours ago [-]
I could see that, thanks. However OP mentioned the mid-nineties and I was working then. No one was printing out logs or saying "glass teletype" at that time. Twenty years earlier, sure, or maybe some elderly curmudgeons working at a conservative bank/govt installation perhaps.
To answer the sibling post below, I had a 1GB drive at home around that time, enough to store text logs cheaply. Logrotate is apparently from 1996.
saidnooneever 12 hours ago [-]
people in 2026 still print out logs like this on rolls lf paper. cant be tampered. log tampering is a big issue for forensics. most programs do not have cryptographically verifiable logs.... and yes that wont be for all systems and all types of logs. but will take shittons of paper still to keep the records going back up to like 7+ years
anonreplier 10 hours ago [-]
we're talking about logs for finger here, not bank transactions
qarl2 2 hours ago [-]
FINGER IS VERY IMPORTANT!
ButlerianJihad 40 minutes ago [-]
Well, the brainchild of YC Founder Robert Morris, the Morris Worm, exploited a zero-day in fingerd, so yes, after 1988, fingerd was extremely important for network security.
ah my bad :D. i wasnt talkin about bank transactions but yeah :p not finger logs either haha.
ButlerianJihad 1 days ago [-]
Speaking of finger, console logging, and the 90s: when I was a freshman in college I took a Pascal programming course. We were assigned accounts on a cluster of AT&T 3B2 systems running SVR3. The students only had access to a terminal lab; the servers were upstairs, out of our reach.
There was no disc quota or significant restriction on the resources available to us, so I became a video game mogul. I found all the freeware download sites, and I became an expert on portability, tweaking and compiling game software to run on our idiosyncratic system.
As students, we made extensive use of "finger", "w", "who", and "write". We also knew the existence of "wall" and the like. So it was de rigeur for us all to write a little something into our .project and our .plan files. I took it much further, and discovering VT100 escape sequences, produced an animated .plan file which erased and mutated some of the immutable datapoints displayed, such as replacing my $HOME directory with "/" and some script-kiddie flexes like "I have root access... you know!"
Subsequently I explored the system extensively and eventually found /etc/passwd, and for reasons, attempted to "su" to every single account I found in there, most of them being system maintenance accounts. Due to logging and auditing, of course, these blatant, brazen failures captured the attention of the unseen administrator.
I received an email that made my blood run cold. The admin (and I still remember his name 37 years later) told me everything I had done in detail, and said that claiming "root access" was equivalent to telling airport officials that I was carrying a bomb. And there were no academic sanctions or threats in this email, but his veritable omniscience and dead-serious tone made me reconsider many of my life choices at the age of 19. Today, I am thankful for this guy putting things into perspective, that Unix was not just a huge game of Zork or Nethack, and he definitely inspired my career goal as systems admin.
kstrauser 4 hours ago [-]
In the Before Times, when I didn't have direct Linux experience yet, I was telnetted into my university's computer lab (as a non-root user) to do homework. I needed a newer version of GCC, and was resourceful enough to download, compile, and install it. A few days later I got called into the comp sci department to explain why I was hacking the shared server. I didn't know enough then to articulate how much I honestly didn't do anything malicious, but the sysadmin had evidence that I'd written files all over the place. I denied knowingly doing anything, but he had the proof. I was nearly on the edge of tears afterward out of fear of getting suspended for hacking. It was made clear that this was absolutely on the table.
I told a much more experienced friend what happened and he investigated. He dragged the sysadmin to the dean's office and told everyone loudly that the sysadmin was a dipshit who had made all of /usr world-writeable for who-knows-why, and from my shell history, it was clear that my `make install` of gcc had put it in /usr/local, the default --prefix. I'd "written files all over the place" because GNU tools default to installing in /usr/local, the sysadmin had deliberately made that possible, the logs showed that I'd done nothing more than download, build, and install an appropriate educational tool, the sysadmin was a dumbass and ought to quit, I was blameless, and that better be the end of it or it was going to get publicly embarrassing. My friend was the right kind of asshole to march into that meeting on my behalf: smart enough to prove that he was right, and aggressive enough to make it clear that the other party was undeniably wrong. I'm still grateful to him for that day.
ralferoo 1 days ago [-]
Hehe, I know I managed to undo the damage I caused, but I'm sure my activity was logged and noticed by the sysadmins at the time. Ironically, after graduating I later became a sysadmin at another department at my university and told them about the particular thing I'd exploited.
But, anyway this was on SunOS and specifically some Sun4c machines with a PROM password. I discovered a couple of new machines were put into the labs without a PROM password, so you could press STOP-A and get into the forth debugger, and read/write system memory. This seemed interesting, but I wasn't sure what I should be changing.
Then one day, I was reading some documentation, and there was a system call [1] that returned a pointer to some information about the current process (or maybe it was for a specific pid), and one of those fields was marked as reserved. I discovered that the field seemed to contain some kind of pointer, but I couldn't de-reference it, so I guessed it was something in kernel space, probably the information about the task needed for the task switcher. This also seemed interesting!
Using the PROM monitor to dump memory starting at that address gave a lot of interesting stuff, and at something like offset 22 there was a pointer to another structure and dumping the memory at this one showed my uid and gid, IIRC the uid was offset 6. Sure enough, overwriting the uid changed the euid of my process.
So, I could reliably get root on any machine without a PROM password by running my program, using the PROM to read the contents of the address it printed out, add 22, use the PROM to read that address, add 6 and write a zero to that address. (Assuming they are the correct numbers after 30 years of brain rot).
So, anyway, I had a bit of fun locally, and noticed that there was a memory mapped file that let you read the PROM contents. I then decided that I wanted to examine this on a machine that had a PROM password set, but this was harder than I expected. My initial plan was to rsh into the other machine as root, but that was forbidden by policy (and this would have been logged). I then thought about creating a setuid script with my new found root access, but that was thwarted as each machine had NFS mounted with root-squashing and their own local root partition. So, I decided I needed to create an additional "system" user in /etc/passwd with a password I knew (because that owned the binaries and wouldn't have root squash). The specifics of what went wrong I forget now because things rapidly got stressful so a lot of it became a blur, but the long and the short of it was that I managed to completely delete the NIS password file on that machine and so I couldn't log into it any more to attempt to undo my damage. However, I discovered that the non-NIS passwd file was still intact, and so I had to use my previous PROM trick to hack the "bin" user on a different machine, which allowed me to rsh as "bin" into the machine I'd just trashed (and that would definitely have stood out in the logs). Once I had a shell as "bin" on that machine, I was able to use the PROM trick again to upgrade that to a root shell and undo the damage I'd done before.
Some time later, there was some other root exploit knocking around, and I used that on a machine with a PROM password set, and discovered I could easily read what the password was just by reading that memory mapped file. As luck would have it, every machine had the same PROM password, and so from that point I could always have gotten root if I wanted it, but was always too worried about causing other damage that I never actually used it.
However, when I later became a sysadmin at the university, the other sysadmin was very confused one time when I did the same hacking root trick after he'd managed to mess up something similar on the root partition of a couple of machines and he thought he'd have to reinstall them all!
I just did STOP-A and entered the PROM password that he'd never told me, and did the same thing I'd done before and just said "yeah, we should probably change this password as it's the same as it was 2 years ago". The process of changing the password was annoyingly fiddly as the PROM password change tool was designed to only work on the console, which is why they'd never changed, so I wrote something to pretend to be an actual TTY so I could update all 100 odd machines remotely via rsh instead of logging on at the console of each of them. Fun times!
[1] I have some recollection it was an ioctl, but I'm a bit hazy on that now as it was over 30 years ago. I suspect it was the SunOS 4.3 version of the prpsinfo structure described in this: https://www.typewritten.org/Manual/Sun/SunOS/5.1/SPARC/man4/...
_jackdk_ 13 hours ago [-]
What fun. War stories like this are what keep me coming back to HN.
inigyou 7 hours ago [-]
This is how the system chills our speech, making us nice and compliant little workers. Putting some funny animation codes into your .plan wasn't doing anything wrong.
qarl2 6 hours ago [-]
Meh. Sysadmins are dicks. The system is secure or it's not. Poking at the locks is not a serious threat.
I know a similar story of a sysadmin who did the same, but went into the lab and sat down next to the student. And then put his handgun on the table.
Power tripping assholes.
Source: I was a sysadmin.
kevstev 3 hours ago [-]
One of the more ridiculous stories I remember from Uni was sysadmins getting very upset that students were fork bombing the server. But... it was from the students in the systems programming class that were just learning about fork/exec, and bugs happen... I thought it was the most ridiculous thing ever.
Also, this was the late 90s and while you could get linux running, all the servers were Unix, and the profs made it very clear any issues between differences between Linux and Solaris were ours to deal with... so we were essentially forced to login to their servers. We are truly our own worst enemy sometimes.
makr17 2 hours ago [-]
I still remember being "invited" to a meet-and-greet with the VP of Tech at my college after a fork bomb run amok. 17yo me was sure my academic career was at an end. He let me sweat for a few of minutes and then smiled and offered me a job. <whew>
2snakes 3 hours ago [-]
A gun? Lmao
qarl2 2 hours ago [-]
Yeah. He really enjoyed his newfound authority.
nl 8 hours ago [-]
We had a VMS system at Uni in the 90s and we could tell what lab someone was in via the Finger command. Apparently it caused significant load on the system.
OhMeadhbh 1 days ago [-]
Also... When we moved from having multiple users per machine to multiple machines per user, services like finger on a specific machine didn't make much sense. It seems you should have one well-advertised machine that maps `foo@example.com` to a `plan.html` file somewhere. (If a user has multiple machines, which one do you query to get their daily .plan?)
Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.
This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.
EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)
EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.
righthand 1 days ago [-]
All of this is addressed in the article. The protocol doesn’t address this stuff because it’s meaningless in the context of the protocol. If you want the extra features then there are other protocols and social networks.
Also if you wanted a .plan for different people you would code your own server as in the article and tie it to a different “user”. The original server ties .plan files to username home dirs but there’s
nothing stopping you from changing how that effectively works on your own server.
nickdothutton 1 hours ago [-]
I've begun and abandoned a "modern take on finger" a couple of times. Sits in the pile (folder) of unfinished projects and at the back of my mind cluttering up the synapses. The reason I began thinking about this... my dissatisfaction/annoyance with all the dark patterns, mode of participation, and ensh*ttification in social networks. I began using UNIX in the early 90s when finger was still quite useful, and yes we did connect it to a named pipe for all sorts of fun (like a finger to SMS gateway).
steve_taylor 1 days ago [-]
Finger was only part of the social network. The multi-user aspect of Unix itself combined with standard tools such as who, finger, write, mesg, talk, mail, biff, etc. combined to form a fairly complete text-based social network.
Bender 2 hours ago [-]
One could further keep finger alive so to speak using DNS [1] and without exposing any ports. In 2026 there are probably more people with domains or developer sub-domains than people exposing port 79 to the internet. Not just for individuals, companies could add the record as an Easter egg.
Nice to see this here today. A number of hosts the article mentions are on the startpage of lookit, a finger client I've been building: happynetbox, plan.cat, thebackupbox's finger webring, etc.
The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.
Perhaps a global database or a parallel project like a search engine focused on fingering is needed. The sources are scattered, and clients like yours would greatly benefit from that.
Was definitely an inspiration for lookit. And yes, a search engine would be cool!
andros 1 days ago [-]
Wow! Thank you!
icedchai 5 hours ago [-]
"Finger" is how my teenage self got into hacking. I'd dial into local universities, which all had open terminal servers. No authentication needed for the terminal servers. That didn't give me host access though, but I could run "status" or "who" or something and see who was connected and where they were connecting to (CS dept Sun server, etc.) I'd then connect to port 79 (finger) of the host, which let me see the logins and names of who was connected. Because these were college students, they often used their first or last name as a password. I'm sure you can figure it out from there.
spogbiper 3 hours ago [-]
i remember the good old days of wide open terminal servers. used to dial into my local uni so I could then telnet into MUDs all over the world.
icedchai 2 hours ago [-]
Yep! These unis were smart enough to block telnet from the terminal servers to outside of their local network.
alexellisuk 4 hours ago [-]
I also very fond memories of the finger command - though mainly used on MUDs and the odd Linux host:
In 1989 I wrote a little hack to turn my .plan into a named pipe. That way - anytime someone fingered me - I could do a netstat to detect where they were coming from.
My friend heard about this and fingered me 10,000 times in 5 minutes, and the computer science department's file server went down and I almost got fired.
mlmonkey 5 hours ago [-]
The best part was you could `finger @machine` and it would list all the users currently logged on, their idle times, etc. Then you could follow that with `talk user@machine` and start chatting with them.
SoftTalker 4 hours ago [-]
Never died? Nobody runs fingerd anymore.
Yes the code still exists, and it still works if you run it, but that's true of almost any old software.
snohobro 52 minutes ago [-]
True, but I do find it fascinating that it still comes as a standard on my OS. Plus the fact that if I do run it, it just works. No annoying tinkering and adjustments or reconfigs. I can’t say the same for a lot of iOS applications developed in 2011.
Just because it’s not widely used doesn’t mean it’s dead.
teddyh 3 hours ago [-]
I remember xhtalk; a little program you would configure with a list of hosts and user names, and it would show a small window (which you would place in a convenient corner of your screen) where each user name was highlighted when they logged on anywhere (the program would periodically finger each machine and search for your configured user names). If you clicked on a user name, it would start a new terminal with a talk session to that user to the machine where they were logged on. Basically an instant messenger before any others.
elric 1 days ago [-]
A discussion about Finger without a mention of WebFinger[1]? Similar in spirit, but HTTP based.
(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?
mister_mort 5 hours ago [-]
I imagine Carmack's plan files were monitored because people were starving for as much id Software news as they could get, and going straight to the source rather than waiting on gaming news sites for digests would be the smart thing to do.
RenThraysk 1 days ago [-]
BluesNews has archives of some more people in gaming from back then.
Funny thing: today at work, I was curious. Windows utility? try a few of the handles in the article.
Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.
pfdietz 1 hours ago [-]
Les Earnest died in 2024 at the age of 93.
zaik 1 days ago [-]
> No encryption, no headers, no sessions. Pure simplicity.
AI smell?
bargainbin 1 days ago [-]
Those commas do appear to be a load-bearing seam for the sentence — that’s not guaranteed proof, it’s just strong indication.
quietsegfault 4 hours ago [-]
The honest read: it’s not just AI, it’s annoying!
computerfriend 13 hours ago [-]
You mean "smoking gun".
NoDodgeQuestion 1 days ago [-]
disclose: "AI is one more tool. I use it for mechanical tasks: polishing the wording, catching typos, suggesting synonyms, improving or adapting code blocks and translating the article between Spanish and English."
rhplus 13 hours ago [-]
The first half of the article seemed fine, but then it appeared padded with AI filler.
maeln 1 days ago [-]
This is also a very common way to write (hence why LLM tend to regurgitate it so much).
bshimmin 1 days ago [-]
It always reminds me of how how Apple write the copy for their landing pages. (A couple of examples from the current MacBook Neo page include "Silver, Blush, Citrus, and Indigo. Four stunning colors. One durable design" and "macOS. Easy to use. Runs all your go-to apps. Puts the fun in functional".) It's quite similar to a rhetorical device called the ascending tricolon, and it's definitely not normally how people speak or write unless they're making a deliberate effort to achieve this effect.
inigyou 7 hours ago [-]
This makes sense because AI is optimized to trigger dopamine in corporate executives.
ColinWright 1 days ago [-]
I write like this sometimes, and I've come to deeply resent the fact that AI slop-machines mimic things that make some writers' style "suspect" or "AI smells".
The slop-machines write the way they do because they have been fed material, and they then spew that back out. So any writer whose style looks a little different, eccentric, or unique may find that the slop-machine's stochastic processes lead them into a state where the pool of possible continuations is small enough that the mimicry is strong.
My wife's writings have recently been labelled as "probably AI" ... and we are livid.
But there's nothing we can do except write in a style that is not truly our own, just to avoid the inaccurate "slop identification" algorithms from smearing us.
Vile machines.
/rant
22 hours ago [-]
1 days ago [-]
jibal 1 days ago [-]
Human smell.
layer8 1 days ago [-]
AI was definitely used in the writing; it’s a pity.
runnr_az 1 days ago [-]
Haha... looks like I gotta get finger.farm up and running again... :)
There are people advocating for a new social network that is distributed and not owned by a single company. Turns out it already existed before the modern social networks!
geokon 11 hours ago [-]
NAT makes this kind of stuff impractical now a days b/c you can't really host anything from your own machine (well you can set up port forwarding if you can access the router...)
The easiest modern solution would probably be git pulling from an Onion address (running git daemon so it's read only). Then, when your machine is on, people that want updates would just
Though tbh.. the single-file setup of finger is cuter than a whole repo directory
est 5 hours ago [-]
I like the old MSN/GTalk "presence" idea
Type your current status in a bar.
And the thing that aggregates them? Twitter.
People like to peek into what others are doing.
mdwelsh 1 days ago [-]
Man! I’m disappointed this article didn’t mention the coolest .plan hack of all time: you could link your .plan file to a named socket so whenever someone fingered you, an arbitrary program would run that spat out whatever output it wanted back to the client. Made for some very fun hacks, like randomly generated text every time you were fingered, or showing things like the current load on the server, etc…
bketelsen 1 days ago [-]
When GitHub released their status update feature I re-imagined finger for the modern world: https://github.com/bketelsen/finger I didn't advertise it, nobody cared. But it was fun.
crmd 1 days ago [-]
Fingering was huge at my university in the late 90s and seemed very focused on relationships. Passive aggressive and extremely emo .plans was very much a thing when some people’s feelings were hurt. If you were interested in someone you were definitely fingering them to see from where they were last logged in (we used to call this finger stalking).
Come to think of it I setup my first “date” (more like a hookup) over unix talk.
We had a legit proto social network going, all over telnet!
bananaboy 8 hours ago [-]
Haha that was the case at my uni too. I met my (ex) girlfriend on the unix system at uni through `talk` and `to` [1]. A lot of the CS students (me included) had .plans that we would update regularly as sort of proto-blogs. Definitely a lot of finger stalking (and `flon` [1] stalking as well).
There was a fellow student at university who put the entire Hunting Of The Snark in their .plan file. It scrolled for a while.
bcraven 9 hours ago [-]
This whole thread has me a little puzzled, in the UK 'fingering' is the de-facto term for a sexual act. Is that not the case elsewhere?
"Fingering was huge at my university" is, in the UK, very true, but I feel that's not the context you're using it in!
technothrasher 5 hours ago [-]
Yes, that is, and was, also the case in the US. Back when the finger command was in common use, the double entendre was not lost on anybody.
andros 1 days ago [-]
I'm dying! Using Telnet to flirt. The father of Tinder XD
xprnio 1 days ago [-]
No, that I think would be Match.com or something along those lines. This is like the grandfather or grand-grandfather of Tinder, but not even intentionally.
What I find funny is how an Estonian proverb/saying would fit here quite nicely: “don’t try to teach your grandfather how to have sex.” In this case, the grandfather didn’t need teaching - it was molded by the era into what was necessary.
inigyou 7 hours ago [-]
match.com is a company that literally owns Tinder and nearly every "dating site" btw (even the one you're thinking of, it doesn't matter, it owns all of them including the ones that used to pride themselves on not being owned by match.com).
mwigdahl 1 days ago [-]
In the late 80s, a friend of mine broke up with his girlfriend via email while they were both sitting in the same computer lab.
quietsegfault 4 hours ago [-]
It was awesome to see which lab and xterm someone was on in college so you could pop by. Plus, when you used the xterms, you never had to wait for an open computer!
brcmthrowaway 1 days ago [-]
Sounds like Berkeley.
smalltorch 1 days ago [-]
I like it.
Just one cell.
Heck, you could probably make a little program for HN to use the about box as the service and achieve the same thing.
andros 1 days ago [-]
the bare minimum!
OhMeadhbh 1 days ago [-]
I used to work at Convex w/ Jay Finger, whose username was "finger". I thought it was funny I could `finger finger` and it would actually do something. This was back when we had multiple users per machine and in the old days if you didn't provide a domain name, the finger command would default to hitting `localhost`.
Also... I seem to remember more than one security issue with stock `fingerd` at the time. After the second or third flaw in fingerd, I think it was banned (as much as it could be) from machines at Convex. By the time I made it to IBM/AIX, it was a serious no-no to have running on your machines.
selcuka 6 hours ago [-]
> in the old days if you didn't provide a domain name, the finger command would default to hitting `localhost`.
It still does (at least on my MacBook):
$ finger myusername
Login: myusername ...
...
No Mail.
No Plan.
egorfine 11 hours ago [-]
Impossible to run practically if your site is on CDN. Finger connects to the A record IP directly. Unfortunately.
inigyou 7 hours ago [-]
You don't need a CDN and it's holding you back.
egorfine 4 hours ago [-]
I need a cdn actually.
inigyou 1 hours ago [-]
Why?
Multiplayer 1 days ago [-]
Ahhhhh memories. As far as I remember this didn't really spread beyond the PC game developer world. Back in the day we built an automated finger puller (poller) to grab all the game developers .plans and post them on PlanetQuake, etc (depending on which game they were working on). At the time it was considered a core feature for hot game news! Certainly the twitter of its' time for direct from the horse's mouth news.
arscan 6 hours ago [-]
I was very into PC gaming during this era, and ran a decently sized gaming news website, and Carmacks use of .plan as a one-to-many microblog was really a decade or two ahead of what became mainstream twitter’s primary use case. None of the games I ‘covered’ had enough .plan activity by the developers to warrant an automated script, but I remember being really impressed by the sites that did it (usually id-centric ones like blues news or stomped I think?)
Such good memories. I think my whole career has been built around chasing the feeling I had when making that gaming site.
l72 3 hours ago [-]
icculus [1] (who ported a bunch of games to linux), still uses finger [2]
Fantastic! How lovely to read these stories. And what influences Id has had on Finger.
ChaseRensberger 1 days ago [-]
I started working on a "modern finger alternative" called winger: https://github.com/ChaseRensberger/winger, and was planning to write an article just like this! Glad to see other people interested in this stuff.
dramm 11 hours ago [-]
I occasionally find myself longing for talk(1) to actually work on Macs.
billfor 1 days ago [-]
Don't forget Zephyr as well - the original AIM....
atleastoptimal 1 days ago [-]
Protocol named Finger
nutts 13 hours ago [-]
I set fingerd up on my OpenBSD host:
finger nutts@nutts.org
Also worth checking:
finger ring@thebackupbox.net
kstrauser 4 hours ago [-]
And those both work over IPv6, which I thought was a delightful mix of the old and new. Nice!
1 days ago [-]
ur-whale 1 days ago [-]
finger is the best-named utility of the Unix world.
andros 1 days ago [-]
Second place is Cat
cb321 1 days ago [-]
Don't forget head, tail, mount, strip, touch, etc.
My GF when I was first learning these names was convinced the Unix principals did all this quite deliberately and "finger" was her headliner argument. Evidently, even in 1971 someone complained: https://blog.robertelder.org/intro-to-pinky-command/ (relevant to that source, Usenet/Net News/mailing lists may be another social network which never exactly died and even today LKML, zsh-workers, etc. are main communication avenues).
_flux 7 hours ago [-]
I rather enjoy the derivative name tac as well, and I suppose you can count GNU tools to be in the Unix world.
I know just the poetry to go with that story:
--Omar Khayyám, 11th-century, translationIt's his fault, not yours, that he wasted paper.
some people had these setups and just never saw a lot of traffic because the boxes werent broadly routed on the internet etc. or internal.
now with all the scans and automated spamming by parties its totally unthinkable. most of my server bandwidth despite my efforts is going to this.. (thankfully down pay for that per bytes anymore!)
this scenario still happens today.
We had a lot of printers around the labs in our university, and they were high-speed, high-capacity. And in the earliest days of multi-user and time-sharing, the hardcopy terminal was actually the default, where the fabled "glass terminal" came along later!
So you have a highly secure system and it's outputting important log entries that may need to be examined later, in the case of a malfunction or a compromise attempt. So you send the most important output to your printer, and you get an offline, immutable audit trail to back up your most important log files.
That seems like a very routine and pragmatic step. In the intervening decades, there were many logging strategies, and many of them admitted for "covering your tracks" by hackers who could erase logs and destroy evidence if the admins weren't careful.
But again, if a 2-minute "finger" interval was causing a paper log overflow, the admins could have mitigated that, but perhaps they were justified in telling the kid to knock off the frivolous resource usage.
However, as I worked for an ISP back in those days as well, I can tell you that log overflows were crazy-making. We had a particular system that acted as primary DNS for many customers. And many customers who were brand-new to the Internet and brand-new to this DNS thing were not real good at configuring it according to standards. And so we had a NOC with projection monitors that monitored system status in various ways, and one of them was tailing our syslog file.
And all day long I kept seeing DNS errors. "Lame delegation" was the winner overall, but there were so many. I was so young and had no privileges or knowledge to fix them. But I helplessly watched them scroll, knowing there were issues, slowdowns, and inefficiences that I couldn't solve for them. Sorry guys.
To answer the sibling post below, I had a 1GB drive at home around that time, enough to store text logs cheaply. Logrotate is apparently from 1996.
https://en.wikipedia.org/wiki/Morris_worm
There was no disc quota or significant restriction on the resources available to us, so I became a video game mogul. I found all the freeware download sites, and I became an expert on portability, tweaking and compiling game software to run on our idiosyncratic system.
As students, we made extensive use of "finger", "w", "who", and "write". We also knew the existence of "wall" and the like. So it was de rigeur for us all to write a little something into our .project and our .plan files. I took it much further, and discovering VT100 escape sequences, produced an animated .plan file which erased and mutated some of the immutable datapoints displayed, such as replacing my $HOME directory with "/" and some script-kiddie flexes like "I have root access... you know!"
Subsequently I explored the system extensively and eventually found /etc/passwd, and for reasons, attempted to "su" to every single account I found in there, most of them being system maintenance accounts. Due to logging and auditing, of course, these blatant, brazen failures captured the attention of the unseen administrator.
I received an email that made my blood run cold. The admin (and I still remember his name 37 years later) told me everything I had done in detail, and said that claiming "root access" was equivalent to telling airport officials that I was carrying a bomb. And there were no academic sanctions or threats in this email, but his veritable omniscience and dead-serious tone made me reconsider many of my life choices at the age of 19. Today, I am thankful for this guy putting things into perspective, that Unix was not just a huge game of Zork or Nethack, and he definitely inspired my career goal as systems admin.
I told a much more experienced friend what happened and he investigated. He dragged the sysadmin to the dean's office and told everyone loudly that the sysadmin was a dipshit who had made all of /usr world-writeable for who-knows-why, and from my shell history, it was clear that my `make install` of gcc had put it in /usr/local, the default --prefix. I'd "written files all over the place" because GNU tools default to installing in /usr/local, the sysadmin had deliberately made that possible, the logs showed that I'd done nothing more than download, build, and install an appropriate educational tool, the sysadmin was a dumbass and ought to quit, I was blameless, and that better be the end of it or it was going to get publicly embarrassing. My friend was the right kind of asshole to march into that meeting on my behalf: smart enough to prove that he was right, and aggressive enough to make it clear that the other party was undeniably wrong. I'm still grateful to him for that day.
But, anyway this was on SunOS and specifically some Sun4c machines with a PROM password. I discovered a couple of new machines were put into the labs without a PROM password, so you could press STOP-A and get into the forth debugger, and read/write system memory. This seemed interesting, but I wasn't sure what I should be changing.
Then one day, I was reading some documentation, and there was a system call [1] that returned a pointer to some information about the current process (or maybe it was for a specific pid), and one of those fields was marked as reserved. I discovered that the field seemed to contain some kind of pointer, but I couldn't de-reference it, so I guessed it was something in kernel space, probably the information about the task needed for the task switcher. This also seemed interesting!
Using the PROM monitor to dump memory starting at that address gave a lot of interesting stuff, and at something like offset 22 there was a pointer to another structure and dumping the memory at this one showed my uid and gid, IIRC the uid was offset 6. Sure enough, overwriting the uid changed the euid of my process.
So, I could reliably get root on any machine without a PROM password by running my program, using the PROM to read the contents of the address it printed out, add 22, use the PROM to read that address, add 6 and write a zero to that address. (Assuming they are the correct numbers after 30 years of brain rot).
So, anyway, I had a bit of fun locally, and noticed that there was a memory mapped file that let you read the PROM contents. I then decided that I wanted to examine this on a machine that had a PROM password set, but this was harder than I expected. My initial plan was to rsh into the other machine as root, but that was forbidden by policy (and this would have been logged). I then thought about creating a setuid script with my new found root access, but that was thwarted as each machine had NFS mounted with root-squashing and their own local root partition. So, I decided I needed to create an additional "system" user in /etc/passwd with a password I knew (because that owned the binaries and wouldn't have root squash). The specifics of what went wrong I forget now because things rapidly got stressful so a lot of it became a blur, but the long and the short of it was that I managed to completely delete the NIS password file on that machine and so I couldn't log into it any more to attempt to undo my damage. However, I discovered that the non-NIS passwd file was still intact, and so I had to use my previous PROM trick to hack the "bin" user on a different machine, which allowed me to rsh as "bin" into the machine I'd just trashed (and that would definitely have stood out in the logs). Once I had a shell as "bin" on that machine, I was able to use the PROM trick again to upgrade that to a root shell and undo the damage I'd done before.
Some time later, there was some other root exploit knocking around, and I used that on a machine with a PROM password set, and discovered I could easily read what the password was just by reading that memory mapped file. As luck would have it, every machine had the same PROM password, and so from that point I could always have gotten root if I wanted it, but was always too worried about causing other damage that I never actually used it.
However, when I later became a sysadmin at the university, the other sysadmin was very confused one time when I did the same hacking root trick after he'd managed to mess up something similar on the root partition of a couple of machines and he thought he'd have to reinstall them all!
I just did STOP-A and entered the PROM password that he'd never told me, and did the same thing I'd done before and just said "yeah, we should probably change this password as it's the same as it was 2 years ago". The process of changing the password was annoyingly fiddly as the PROM password change tool was designed to only work on the console, which is why they'd never changed, so I wrote something to pretend to be an actual TTY so I could update all 100 odd machines remotely via rsh instead of logging on at the console of each of them. Fun times!
[1] I have some recollection it was an ioctl, but I'm a bit hazy on that now as it was over 30 years ago. I suspect it was the SunOS 4.3 version of the prpsinfo structure described in this: https://www.typewritten.org/Manual/Sun/SunOS/5.1/SPARC/man4/...
I know a similar story of a sysadmin who did the same, but went into the lab and sat down next to the student. And then put his handgun on the table.
Power tripping assholes.
Source: I was a sysadmin.
Also, this was the late 90s and while you could get linux running, all the servers were Unix, and the profs made it very clear any issues between differences between Linux and Solaris were ours to deal with... so we were essentially forced to login to their servers. We are truly our own worst enemy sometimes.
Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.
This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.
EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)
EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.
Also if you wanted a .plan for different people you would code your own server as in the article and tie it to a different “user”. The original server ties .plan files to username home dirs but there’s nothing stopping you from changing how that effectively works on your own server.
[1] - https://nochan.net/b/Internet-Crap/20260527-DNS-A-Replacemen...
The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.
I just released a v0.2 beta, feedback welcome: https://github.com/jonathandeamer/lookit/releases/tag/v0.2.0...
Perhaps a global database or a parallel project like a search engine focused on fingering is needed. The sources are scattered, and clients like yours would greatly benefit from that.
I'd also like to mention that if you have Emacs, I also have my own client: https://git.andros.dev/andros/efinger.el
Was definitely an inspiration for lookit. And yes, a search engine would be cool!
https://blog.alexellis.io/the-90s-unix-command-fell-out-of-f...
https://news.ycombinator.com/item?id=44943313
My friend heard about this and fingered me 10,000 times in 5 minutes, and the computer science department's file server went down and I almost got fired.
Yes the code still exists, and it still works if you run it, but that's true of almost any old software.
Just because it’s not widely used doesn’t mean it’s dead.
[1] https://webfinger.net
https://github.com/ESWAT/john-carmack-plan-archive/tree/mast...
(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?
https://www.bluesnews.com/cgi-bin/summary.pl
Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.
AI smell?
The slop-machines write the way they do because they have been fed material, and they then spew that back out. So any writer whose style looks a little different, eccentric, or unique may find that the slop-machine's stochastic processes lead them into a state where the pool of possible continuations is small enough that the mimicry is strong.
My wife's writings have recently been labelled as "probably AI" ... and we are livid.
But there's nothing we can do except write in a style that is not truly our own, just to avoid the inaccurate "slop identification" algorithms from smearing us.
Vile machines.
/rant
Thx for the mention blogger!
https://github.com/jonroig/finger.farm
The easiest modern solution would probably be git pulling from an Onion address (running git daemon so it's read only). Then, when your machine is on, people that want updates would just
Though tbh.. the single-file setup of finger is cuter than a whole repo directoryType your current status in a bar.
And the thing that aggregates them? Twitter.
People like to peek into what others are doing.
Come to think of it I setup my first “date” (more like a hookup) over unix talk.
We had a legit proto social network going, all over telnet!
[1] https://mewburn.net/luke/software.html
"Fingering was huge at my university" is, in the UK, very true, but I feel that's not the context you're using it in!
What I find funny is how an Estonian proverb/saying would fit here quite nicely: “don’t try to teach your grandfather how to have sex.” In this case, the grandfather didn’t need teaching - it was molded by the era into what was necessary.
Just one cell.
Heck, you could probably make a little program for HN to use the about box as the service and achieve the same thing.
Also... I seem to remember more than one security issue with stock `fingerd` at the time. After the second or third flaw in fingerd, I think it was banned (as much as it could be) from machines at Convex. By the time I made it to IBM/AIX, it was a serious no-no to have running on your machines.
It still does (at least on my MacBook):
Such good memories. I think my whole career has been built around chasing the feeling I had when making that gaming site.
Also worth checking: finger ring@thebackupbox.net
My GF when I was first learning these names was convinced the Unix principals did all this quite deliberately and "finger" was her headliner argument. Evidently, even in 1971 someone complained: https://blog.robertelder.org/intro-to-pinky-command/ (relevant to that source, Usenet/Net News/mailing lists may be another social network which never exactly died and even today LKML, zsh-workers, etc. are main communication avenues).