Announcing .NET Core 2.0

[masonwheeler]

Announcing .NET Core 2.0 - .NET Blog

Just came out today.

[cartman82]

I tried the final preview a week ago.

Good news: I can finally run dotnet -h on debian.

Yay.

But then...

Ah, good old .NET core. It always manages to disappoint.

I guess I can give it another try now that it's "gold". But I am not holding my breath.

[RaceProUK]

Otherwise known as the "We can't figure out how to fix all the broken shit, so we're making a new version which is also broken shit" release.

[heterodox]

@cartman82 said in Announcing .NET Core 2.0:

Good news: I can finally run dotnet -h on debian.

[...]

Yay.

For various values of "Yay."

[cartman82]

My first attempt to upgrade to NET Core 2.

Ayyyy. Microsoft, if you're gonna release a new version, how about you update your install script.

[cartman82]

FAIL #2.

Microsoft still doesn't pack the containing directory into their distribution archives, so now I have this crap spewed all over my /opt.

Microsoft, will you ever learn!?

[cartman82]

So now I get some nonsense error message before the segmentation fault.

Progress, I guess? Meh. I am not impressed.

[masonwheeler]

@cartman82 said in Announcing .NET Core 2.0:

Microsoft still doesn't pack the containing directory into their distribution archives, so now I have this crap spewed all over my /opt.

Microsoft, will you ever learn!?

Actually you're TRWTF here. It's so incredibly annoying when I unzip something into a folder for it, and then end up with a folder containing nothing but another folder, and then have to go into that folder and pull everything out of it back up a level into the place where I told it to install in the first place.

You told it to install into /opt, it installed into /opt. You should have told it to install into /opt/netcore (or whatever) if that's where you wanted it.

[cartman82]

@masonwheeler No, it should unpack into a folder. I don't want to type in more commands or right click and type in directory names and make mistakes. I want a computer to do that for me.

[masonwheeler]

@cartman82 said in Announcing .NET Core 2.0:

No, it should unpack into a folder.

It did: it unpacked into the folder you told it to unpack into!

[cartman82]

@masonwheeler said in Announcing .NET Core 2.0:

It did: it unpacked into the folder you told it to unpack into!

It should do what I want, not what I tell it.

[masonwheeler]

DWIM

[kt_]

@masonwheeler said in Announcing .NET Core 2.0:

@cartman82 said in Announcing .NET Core 2.0:

Microsoft still doesn't pack the containing directory into their distribution archives, so now I have this crap spewed all over my /opt.

Microsoft, will you ever learn!?

Actually you're TRWTF here. It's so incredibly annoying when I unzip something into a folder for it, and then end up with a folder containing nothing but another folder, and then have to go into that folder and pull everything out of it back up a level into the place where I told it to install in the first place.

You told it to install into /opt, it installed into /opt. You should have told it to install into /opt/netcore (or whatever) if that's where you wanted it.

I don't really get what's going on here. I've got preview3 running on Ubuntu. I installed it from the official repo. No unpacking. Why would you choose the unpack route?

[TimeBandit]

I like the tutorial

tdykstra

Debug a .NET console application using Visual Studio - .NET

Learn how to debug a .NET console app using Visual Studio.

Fuck you, my name is not Gracie.

[cartman82]

@kt_ said in Announcing .NET Core 2.0:

I don't really get what's going on here. I've got preview3 running on Ubuntu. I installed it from the official repo. No unpacking. Why would you choose the unpack route?

No repo for debian.

[cartman82]

@timebandit said in Announcing .NET Core 2.0:

Fuck you, my name is not Gracie.

Try the entity framework stuff.

I kind of half-followed this: https://docs.microsoft.com/en-us/ef/core/get-started/netcore/new-db-sqlite

[heterodox]

@cartman82 said in Announcing .NET Core 2.0:

I don't want to type in more commands or right click and type in directory names and make mistakes. I want a computer to do that for me.

You want a computer to make mistakes for you? Done!

[TimeBandit]

@cartman82

Manually edit an XML file ?

Who designed this thing, some neckbeard stuck in the '70 </blakeyrant>

[kt_]

@cartman82 said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

I don't really get what's going on here. I've got preview3 running on Ubuntu. I installed it from the official repo. No unpacking. Why would you choose the unpack route?

No repo for debian.

Man, Debian sucks!

[hungrier]

@timebandit said in Announcing .NET Core 2.0:

Fuck you, my name is not Gracie.

The text implies that they probably left out an instruction

The values displayed in the console window correspond to the changes you made in the Immediate Window.

[TimeBandit]

@hungrier said in Announcing .NET Core 2.0:

The text implies that they probably left out an instruction

See, that's why you can't count on open-source crappy devs, no QC at all. Stick to good-old commercial software

[blakeyrat]

@cartman82 said in Announcing .NET Core 2.0:

It should do what I want, not what I tell it.

Maybe you should considering using an OS that has standards for shit like this.

[jesujcastillom]

Any luck on this?

[Deadfast]

@blakeyrat said in Announcing .NET Core 2.0:

@cartman82 said in Announcing .NET Core 2.0:

It should do what I want, not what I tell it.

Maybe you should considering using an OS that has standards for shit like this.

What is the standard way of unpacking tar.gz on said OS?

[anonymous234]

@cartman82 said in Announcing .NET Core 2.0:

I want a computer to do that for me.

Indeed, the decompressing command should do it.

An archive is already pretty much a folder. It's a thing that contains files. Requiring that every archive have a second folder inside doesn't make sense.

[anonymous234]

@heterodox said in Announcing .NET Core 2.0:

@cartman82 said in Announcing .NET Core 2.0:

I don't want to type in more commands or right click and type in directory names and make mistakes. I want a computer to do that for me.

You want a computer to make mistakes for you? Done!

"If only I'd programmed the robot to be more careful what I wished for!" - Futurama

[PleegWat]

@anonymous234 said in Announcing .NET Core 2.0:

@cartman82 said in Announcing .NET Core 2.0:

I want a computer to do that for me.

Indeed, the decompressing command should do it.

An archive is already pretty much a folder. It's a thing that contains files. Requiring that every archive have a second folder inside doesn't make sense.

What then about archives containing members named ../../../etc/passwd?

[anonymous234]

@pleegwat It's not my fault that you use an OS where "put this file inside this folder" can result in that file being outside that folder.

[masonwheeler]

@pleegwat said in Announcing .NET Core 2.0:

What then about archives containing members named ../../../etc/passwd?

Seriously? Is that even a thing?

[Benjamin Hall]

@masonwheeler said in Announcing .NET Core 2.0:

@pleegwat said in Announcing .NET Core 2.0:

What then about archives containing members named ../../../etc/passwd?

Seriously? Is that even a thing?

nuke_it_from_orbit.meme

Seriously, I don't see why archive utilities should even accept files with malicious paths like that. Just munge the paths: replace it with something like .._..._.._etc_passwd or borrow a ClueCo-brand hammer from a certain hedgehog and use it on anyone attempting such a thing.

[anonymous234]

@masonwheeler It's very much a thing, on most programs and on pretty much every OS

Directory traversal attack - Wikipedia

[masonwheeler]

@anonymous234 said in Announcing .NET Core 2.0:

@masonwheeler It's very much a thing, on most programs and on pretty much every OS

Directory traversal attack - Wikipedia

Sure, but inside an archive? I didn't know relative paths were allowed there...

[kt_]

@cartman82 said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

I don't really get what's going on here. I've got preview3 running on Ubuntu. I installed it from the official repo. No unpacking. Why would you choose the unpack route?

No repo for debian.

OK, took a look. Another reason not to use Debian:

Also, @cartman82, please note the Note. You must choose a user controlled directory if you use a lesser OS.

On the other hand, for Ubuntu:

---

ETA I love this aka.ms short URL domain!

[cartman82]

Wow, a genuine Ubuntu fanboy. Been a long time since I've seen one that hasn't already killed themselves trying to eat glue or give their pet toaster a bath.

[Atazhaia]

@kt_ Why would they only support Ubuntu(-based distros) and not go for Debian directly and support more in one go? Although I can hazard a guess...

thinks Hmm... To install on Linux Mint... And it works on Ubuntu but not Debian... I wonder what would happen if one would try following those instructions on Linux Mint Debian Edition...

Also, why are they still using apt-get in their instructions? At least on Mint they moved over to using apt as standard a while back.

[Jaloopa]

@atazhaia said in Announcing .NET Core 2.0:

Also, why are they still using apt-get in their instructions? At least on Mint they moved over to using apt as standard a while back.

Maybe because people who aren't died-in-the-wool Linux enthusiasts don't have time to remember which exact magic incantation is the standard this week

[Atazhaia]

@jaloopa But I thought Microsoft were total Linux enthusiasts nowadays!

[PleegWat]

@masonwheeler said in Announcing .NET Core 2.0:

@anonymous234 said in Announcing .NET Core 2.0:

@masonwheeler It's very much a thing, on most programs and on pretty much every OS

Directory traversal attack - Wikipedia

Sure, but inside an archive? I didn't know relative paths were allowed there...

I don't think it was ever a feature. It's just that archive formats like tar (probably also zip and others) store a file name as a path relative to the extract location. And at least in tar there was no check for ../ components in that path until the attack started occurring.
Tar is particularly susceptible to this because tar files are relatively easy to hand-edit.

[PleegWat]

@pleegwat After some fiddling I've got a reproduction.

Base tarball:

$ hexdump -C test 
00000000  2e 2d 2f 66 6f 6f 62 61  72 00 00 00 00 00 00 00  |.-/foobar.......|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000060  00 00 00 00 30 30 30 30  36 36 34 00 30 30 30 31  |....0000664.0001|
00000070  37 35 31 00 30 30 30 31  37 35 31 00 30 30 30 30  |751.0001751.0000|
00000080  30 30 30 30 30 30 30 00  31 33 31 34 34 36 30 34  |0000000.13144604|
00000090  35 36 33 00 30 31 32 36  36 35 00 20 30 00 00 00  |563.012665. 0...|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 75 73 74 61 72 20 20  00 70 6c 65 65 67 77 61  |.ustar  .pleegwa|
00000110  74 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |t...............|
00000120  00 00 00 00 00 00 00 00  00 70 6c 65 65 67 77 61  |.........pleegwa|
00000130  74 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |t...............|
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002800

Edited tarball:

$ hexdump -C test 
00000000  2e 2e 2f 66 6f 6f 62 61  72 00 00 00 00 00 00 00  |../foobar.......|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000060  00 00 00 00 30 30 30 30  36 36 34 00 30 30 30 31  |....0000664.0001|
00000070  37 35 31 00 30 30 30 31  37 35 31 00 30 30 30 30  |751.0001751.0000|
00000080  30 30 30 30 30 30 30 00  31 33 31 34 34 36 30 34  |0000000.13144604|
00000090  35 36 33 00 30 31 32 36  36 36 00 20 30 00 00 00  |563.012666. 0...|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 75 73 74 61 72 20 20  00 70 6c 65 65 67 77 61  |.ustar  .pleegwa|
00000110  74 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |t...............|
00000120  00 00 00 00 00 00 00 00  00 70 6c 65 65 67 77 61  |.........pleegwa|
00000130  74 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |t...............|
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002800

Tar generates an error on decompression:

$ tar -xf test
tar: Removing leading `../' from member names

cpio on the same environment is vulnerable:

$ cpio -iH tar < test
2 blocks

0_1502808642362_test

[masonwheeler]

@pleegwat said in Announcing .NET Core 2.0:

Tar generates an error on decompression:

$ tar -xf test
tar: Removing leading `../' from member names

Interesting. But what about ../ in non-leading positions?

[boomzilla]

@cartman82 said in Announcing .NET Core 2.0:

Ubuntu fanboy...give their pet toaster a bath.

The secret is to make sure you shake out most of the crumbs first. Nobody likes doughy bath water.

[kt_]

@atazhaia said in Announcing .NET Core 2.0:

@kt_ Why would they only support Ubuntu(-based distros) and not go for Debian directly and support more in one go?

Because Debian users are lunatic and they would never add a third party ppa in fear of proprietary software that would taint their OS and force them to reinstall.

[kt_]

@cartman82 said in Announcing .NET Core 2.0:

Wow, a genuine Ubuntu fanboy. Been a long time since I've seen one that hasn't already killed themselves trying to eat glue or give their pet toaster a bath.

You're just jelly. Why are you a jelly? No one likes a jelly.

[TimeBandit]

@kt_ said in Announcing .NET Core 2.0:

Because Debian users are lunatic and they would never add a third party ppa in fear of proprietary software that would taint their OS and force them to reinstall.

I guess you're right

-rw-r--r-- 1 root root 189 Mar 29  2016 google-chrome.list
-rw-r--r-- 1 root root  51 Sep 14  2015 spotify.list
-rw-r--r-- 1 root root  73 Mar  3 13:35 vscode.list

[kt_]

@timebandit said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

Because Debian users are lunatic and they would never add a third party ppa in fear of proprietary software that would taint their OS and force them to reinstall.

I guess you're right

-rw-r--r-- 1 root root 189 Mar 29  2016 google-chrome.list
-rw-r--r-- 1 root root  51 Sep 14  2015 spotify.list
-rw-r--r-- 1 root root  73 Mar  3 13:35 vscode.list

Don't think we didn't notice that this is a forged picture. Great photoshop skills!

[TimeBandit]

@kt_ said in Announcing .NET Core 2.0:

Don't think we didn't notice that this is a forged picture. Great photoshop Gimp skills!

FTFY

[kt_]

@timebandit said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

Don't think we didn't notice that this is a forged picture. Great photoshop Gimp skills!

FTFY

I know you secretly run Windows in virtualbox to shoot aliens and do .NET coding.

[TimeBandit]

@kt_ said in Announcing .NET Core 2.0:

I know you secretly run Windows in virtualbox to shoot aliens

Last time I tried that, it was horrible.

[kt_]

@timebandit said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

I know you secretly run Windows in virtualbox to shoot aliens

Last time I tried that, it was horrible.

Aliens are supposed to be, dummy.

[ben_lubar]

@timebandit said in Announcing .NET Core 2.0:

@kt_ said in Announcing .NET Core 2.0:

I know you secretly run Windows in virtualbox to shoot aliens

Last time I tried that, it was horrible.

srcds.exe from a certain video game runs fine in Wine.