kasia in a nutshell

I have already seen someone using the telnet output to check a device status.
The output was sometimes "random" and he has to update every 2 weeks the code to match it.
The problme is that he found that normal !
Who said that computer programs are not reliable ??

ping a special case. Basically you can't do ICMP unless you are a privliged user and /bin/ping is setuid root so this works. It's a lot easier sometimes to capture the output of ping than to mess with setuid scripts.

The golden rule is not to break things that have been doing something (incorrectly or not) for a long time unless you have a very good reason to. I think the rule was broken in this case.

Hrm I think to rely on the output of some external program is bad design. Many languages have the basic low level programs. For example perl has a ping module already. Another method would be to provide the executable for the program that you would call. So for my monitoring script I would also include the ping binary that I would like to call. This way no matter what the sys admin did to the box my local copy of the program would have the same output.

If I am maintaining Ping or telnet or any other program, I only care about the human readability factor. I cannot know that your little custom script/code/app uses the text output of my code to execute, nor should I care.

:)

ahh, but installing a setuid program on a linux box that isnt your own box does not work. "oh yay, it runs as... ME" and thats only on an improperly configured box. any production box worth its bread board would be locked down to NOT allow setuid's in the /home partition....

i agree with the golden rule stated above... but...

the trick to rewriting output on apps like this is to phase the changes in. 1st make the new output activated via command line switch, but add a note that it will be made standard soon. then after 6 months, or a year make that default, and add the old output via command line switch. then a year later phase it out completely.

thats my $.02

Sometimes you just say "oh well" and decide to track changes in the target application without going through a lot of engineering. Turns out that the mods to the regular expression to recognize both flavors of output were one line and took a couple of minutes to write and test.

Using "ping" output directly may seem low-tech, but it's highly expedient and in the long run probably much easier to maintain even in the face of surprises from the ping authors. Not having to write and test your own setuid code has a benefit.