rm -rf ${var}/ is a disaster waiting to happen.

Always do rm -rf "${var:?}/" so that the script aborts if the variable is empty. Or better yet rm -rf "./${var:?}/".

Edited to add quotes. Always quote a path: it might have spaces in it, without quotes that will become multiple paths! Which would also have avoided the particular bug in question.

Reminds me of old bumblebee install script:

An extra space at line 351:
rm -rf /usr /lib/nvidia-current/xorg/xorg

That reminds me...

In circa 1995 I was running a dial upBBS service -- as a teenager. So if course, it was full of bootlegged video games and such, and people would dial in, download a game, log off.

Someone uploaded Descent or something like that. But they had put "deltree /y C:" or similar into a batch file, used a BAT2COM converter program, then a COM2EXE program, then padded the file size to approximately the right size with random crap (probably just using APPEND)... And uploaded it. Well, fortunately for the rest of my users, I say the game and said: oh, that's neat, I should try it and copied it to another computer over my internal network and launched it. It started deleting files right away and I hit CTRL-C to abort. I lost only a few dozen files.

Banned the user, deleted the package. Got lucky.

The theme contained rm -rf, but claims it wasn't malicious intent...I assume rm -rf for cleanup, but seems like it should have a apecific path other than /

A Linux user's nightmare: the machine was wiped clean with one click

Timo Tamminen

One day a Linux user using KDE Plasma decided to download a generic theme for his desktop environment. This is possible with Plasma's built-in tool, through which you can download anything from themes to icons and wallpapers.

Installing themes using Plasma's tool is easy and fast. It practically only requires one click. This time, however, the user in question certainly wishes that that one click had not been completed.

Namely, installing the theme called Gray Layout wiped the machine completely empty of the user's personal files. Without asking anything.

Although the theme developer's intention this time was apparently not malicious, the accident was a clear indication that installing third-party themes without careful supervision can be a bad mistake. With the theme, almost anything can be installed in the user's home directory.

The Gray Layout installation script ran the rm -rf command, which normally removes all files from the device, making the command particularly dangerous to use. However, without root access, it can only cause limited damage.

Reddit user Jeansen Vaars says that he lost all his games, settings files, browser history and other contents of his home directory in a crash.

The unofficial face of KDE, Nate Graham, apologizes for what happened. He promises that the matter will be thoroughly investigated. The theme in question has also been removed from the theme store.

A theme is software and software has bugs. While this one had a pretty dramatic effect, you take basically the same risk with every program you run. This, along with hardware and user errors are why backups are so important; they change a disaster to an inconvenience.

/ Preach mode off

The Gray Layout installation script ran the rm -rf command, which normally removes all files from the device

Translation difficulties, or does the author really think that's what it's normally used for?

Click bait

That's what good backups are for.

I image all my PCs daily with Veeam, bootable media is on my Ventoy USB stick, and restoring is easy as you just boot up the restore media and it pulls the latest backup over the network.

I wonder what the sudo rm -rf equivalent for windows is

SIDPlay did something similar on the Mac.

It has the neat built-in feature of rsyncing the high voltage SID collection to your computer.

However, if you deleted your local copy of it and tried to re-sync it'd update (with deletes) against / instead. Bye bye files.

I wonder how much would break, and how much time it would take to update everything, if all shells decided to implement a breaking change to prevent these kind of scenarios. E.g. make "set -u" default or some other solution

Trust but verify. It was a text file, it doesn't get much easier to do the second step of that.

Hetken jo ajattelin, että mitä hiivatin noituutta nämä Suomeksi olevat konekääntäjän tekstit ovat olevinaan.

wiped clean?

It is windows users that pretend to be linux user.

They are root.