In the mid-90s I taught a night class on Unix, and was experimenting with shell scripts from The Unix Programming Environment. There was an example using a loop and the who command to alert you when someone logged onto your local system. My cousin was a professor at a university several states away, and we had already figured out the talk command. So I decided to expand the examples in the book to use finger. By parsing the reply, somehow I could tell if my cousin was logged on, and I would send myself a notice. There was an ISP in the same building, and one day the ISP engineer came to visit me with a stern look. He asked, "By any chance are you sending a finger command every two minutes to this university's mainframe?" I proudly answered, "As a matter of fact, yes, I am!". I eagerly got out my Unix book to show him what I was doing. He just said, "Stop doing that. They have a system console logging program that has churned out dozens of pages of paper printouts because of you". I sheepishly acknowledged my mistake and quit running the script.
The Moving Finger writes; and, having writ,
Moves on: nor all thy Piety nor Wit
Shall lure it back to cancel half a Line,
Nor all thy Tears wash out a Word of it.
I was sure this story was going to end with your script causing chaos by calling finger in a busy loop. But every 2 minutes! Even in the 90s, that's a pretty mild amount of network traffic.
once i saw a guy run a pentest and a box was doing that. it printed an entire vulnerabilityscanner output verbatim all the bytes received o.O guy appearently got handed like 100m of paper with a request to pls not scan _that_ port :'D
some people had these setups and just never saw a lot of traffic because the boxes werent broadly routed on the internet etc. or internal.
now with all the scans and automated spamming by parties its totally unthinkable. most of my server bandwidth despite my efforts is going to this.. (thankfully down pay for that per bytes anymore!)
The grey beards in the mid-90s cut their teeth on much more constrained systems! The web crawling these days probably has all the ones who have passed spinning rapidly in their graves.
It may be a case of needing write only logging, I always think of the nuclear power station logging all events to the line printer, But I can see a NOC doing the same, How finger ended up triggering it would probably be a fascinating case study of early innocent decisions getting ossified into the infrastructure.
It may seem that the admins were wrong to criticize the fingerer for the voluminous output, but if you think about it, paper logging was a very pragmatic security and auditing measure in those days.
We had a lot of printers around the labs in our university, and they were high-speed, high-capacity. And in the earliest days of multi-user and time-sharing, the hardcopy terminal was actually the default, where the fabled "glass terminal" came along later!
So you have a highly secure system and it's outputting important log entries that may need to be examined later, in the case of a malfunction or a compromise attempt. So you send the most important output to your printer, and you get an offline, immutable audit trail to back up your most important log files.
That seems like a very routine and pragmatic step. In the intervening decades, there were many logging strategies, and many of them admitted for "covering your tracks" by hackers who could erase logs and destroy evidence if the admins weren't careful.
But again, if a 2-minute "finger" interval was causing a paper log overflow, the admins could have mitigated that, but perhaps they were justified in telling the kid to knock off the frivolous resource usage.
However, as I worked for an ISP back in those days as well, I can tell you that log overflows were crazy-making. We had a particular system that acted as primary DNS for many customers. And many customers who were brand-new to the Internet and brand-new to this DNS thing were not real good at configuring it according to standards. And so we had a NOC with projection monitors that monitored system status in various ways, and one of them was tailing our syslog file.
And all day long I kept seeing DNS errors. "Lame delegation" was the winner overall, but there were so many. I was so young and had no privileges or knowledge to fix them. But I helplessly watched them scroll, knowing there were issues, slowdowns, and inefficiences that I couldn't solve for them. Sorry guys.
I could see that, thanks. However OP mentioned the mid-nineties and I was working then. No one was printing out logs or saying "glass teletype" at that time. Twenty years earlier, sure, or maybe some elderly curmudgeons working at a conservative bank/govt installation perhaps.
To answer the sibling post below, I had a 1GB drive at home around that time, enough to store text logs cheaply. Logrotate is apparently from 1996.
people in 2026 still print out logs like this on rolls lf paper. cant be tampered. log tampering is a big issue for forensics. most programs do not have cryptographically verifiable logs.... and yes that wont be for all systems and all types of logs. but will take shittons of paper still to keep the records going back up to like 7+ years
Speaking of finger, console logging, and the 90s: when I was a freshman in college I took a Pascal programming course. We were assigned accounts on a cluster of AT&T 3B2 systems running SVR3. The students only had access to a terminal lab; the servers were upstairs, out of our reach.
There was no disc quota or significant restriction on the resources available to us, so I became a video game mogul. I found all the freeware download sites, and I became an expert on portability, tweaking and compiling game software to run on our idiosyncratic system.
As students, we made extensive use of "finger", "w", "who", and "write". We also knew the existence of "wall" and the like. So it was de rigeur for us all to write a little something into our .project and our .plan files. I took it much further, and discovering VT100 escape sequences, produced an animated .plan file which erased and mutated some of the immutable datapoints displayed, such as replacing my $HOME directory with "/" and some script-kiddie flexes like "I have root access... you know!"
Subsequently I explored the system extensively and eventually found /etc/passwd, and for reasons, attempted to "su" to every single account I found in there, most of them being system maintenance accounts. Due to logging and auditing, of course, these blatant, brazen failures captured the attention of the unseen administrator.
I received an email that made my blood run cold. The admin (and I still remember his name 37 years later) told me everything I had done in detail, and said that claiming "root access" was equivalent to telling airport officials that I was carrying a bomb. And there were no academic sanctions or threats in this email, but his veritable omniscience and dead-serious tone made me reconsider many of my life choices at the age of 19. Today, I am thankful for this guy putting things into perspective, that Unix was not just a huge game of Zork or Nethack, and he definitely inspired my career goal as systems admin.
Hehe, I know I managed to undo the damage I caused, but I'm sure my activity was logged and noticed by the sysadmins at the time. Ironically, after graduating I later became a sysadmin at another department at my university and told them about the particular thing I'd exploited.
But, anyway this was on SunOS and specifically some Sun4c machines with a PROM password. I discovered a couple of new machines were put into the labs without a PROM password, so you could press STOP-A and get into the forth debugger, and read/write system memory. This seemed interesting, but I wasn't sure what I should be changing.
Then one day, I was reading some documentation, and there was a system call [1] that returned a pointer to some information about the current process (or maybe it was for a specific pid), and one of those fields was marked as reserved. I discovered that the field seemed to contain some kind of pointer, but I couldn't de-reference it, so I guessed it was something in kernel space, probably the information about the task needed for the task switcher. This also seemed interesting!
Using the PROM monitor to dump memory starting at that address gave a lot of interesting stuff, and at something like offset 22 there was a pointer to another structure and dumping the memory at this one showed my uid and gid, IIRC the uid was offset 6. Sure enough, overwriting the uid changed the euid of my process.
So, I could reliably get root on any machine without a PROM password by running my program, using the PROM to read the contents of the address it printed out, add 22, use the PROM to read that address, add 6 and write a zero to that address. (Assuming they are the correct numbers after 30 years of brain rot).
So, anyway, I had a bit of fun locally, and noticed that there was a memory mapped file that let you read the PROM contents. I then decided that I wanted to examine this on a machine that had a PROM password set, but this was harder than I expected. My initial plan was to rsh into the other machine as root, but that was forbidden by policy (and this would have been logged). I then thought about creating a setuid script with my new found root access, but that was thwarted as each machine had NFS mounted with root-squashing and their own local root partition. So, I decided I needed to create an additional "system" user in /etc/passwd with a password I knew (because that owned the binaries and wouldn't have root squash). The specifics of what went wrong I forget now because things rapidly got stressful so a lot of it became a blur, but the long and the short of it was that I managed to completely delete the NIS password file on that machine and so I couldn't log into it any more to attempt to undo my damage. However, I discovered that the non-NIS passwd file was still intact, and so I had to use my previous PROM trick to hack the "bin" user on a different machine, which allowed me to rsh as "bin" into the machine I'd just trashed (and that would definitely have stood out in the logs). Once I had a shell as "bin" on that machine, I was able to use the PROM trick again to upgrade that to a root shell and undo the damage I'd done before.
Some time later, there was some other root exploit knocking around, and I used that on a machine with a PROM password set, and discovered I could easily read what the password was just by reading that memory mapped file. As luck would have it, every machine had the same PROM password, and so from that point I could always have gotten root if I wanted it, but was always too worried about causing other damage that I never actually used it.
However, when I later became a sysadmin at the university, the other sysadmin was very confused one time when I did the same hacking root trick after he'd managed to mess up something similar on the root partition of a couple of machines and he thought he'd have to reinstall them all!
I just did STOP-A and entered the PROM password that he'd never told me, and did the same thing I'd done before and just said "yeah, we should probably change this password as it's the same as it was 2 years ago". The process of changing the password was annoyingly fiddly as the PROM password change tool was designed to only work on the console, which is why they'd never changed, so I wrote something to pretend to be an actual TTY so I could update all 100 odd machines remotely via rsh instead of logging on at the console of each of them. Fun times!
[1] I have some recollection it was an ioctl, but I'm a bit hazy on that now as it was over 30 years ago. I suspect it was the SunOS 4.3 version of the prpsinfo structure described in this: https://www.typewritten.org/Manual/Sun/SunOS/5.1/SPARC/man4/...
Also... When we moved from having multiple users per machine to multiple machines per user, services like finger on a specific machine didn't make much sense. It seems you should have one well-advertised machine that maps `foo@example.com` to a `plan.html` file somewhere. (If a user has multiple machines, which one do you query to get their daily .plan?)
Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.
This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.
EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)
EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.
All of this is addressed in the article. The protocol doesn’t address this stuff because it’s meaningless in the context of the protocol. If you want the extra features then there are other protocols and social networks.
Also if you wanted a .plan for different people you would code your own server as in the article and tie it to a different “user”. The original server ties .plan files to username home dirs but there’s
nothing stopping you from changing how that effectively works on your own server.
Nice to see this here today. A number of hosts the article mentions are on the startpage of lookit, a finger client I've been building: happynetbox, plan.cat, thebackupbox's finger webring, etc.
The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.
Perhaps a global database or a parallel project like a search engine focused on fingering is needed. The sources are scattered, and clients like yours would greatly benefit from that.
Finger was only part of the social network. The multi-user aspect of Unix itself combined with standard tools such as who, finger, write, mesg, talk, mail, biff, etc. combined to form a fairly complete text-based social network.
NAT makes this kind of stuff impractical now a days b/c you can't really host anything from your own machine (well you can set up port forwarding if you can access the router...)
The easiest modern solution would probably be git pulling from an Onion address (running git daemon so it's read only). Then, when your machine is on, people that want updates would just
(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?
Funny thing: today at work, I was curious. Windows utility? try a few of the handles in the article.
Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.
When GitHub released their status update feature I re-imagined finger for the modern world: https://github.com/bketelsen/finger I didn't advertise it, nobody cared. But it was fun.
Man! I’m disappointed this article didn’t mention the coolest .plan hack of all time: you could link your .plan file to a named socket so whenever someone fingered you, an arbitrary program would run that spat out whatever output it wanted back to the client. Made for some very fun hacks, like randomly generated text every time you were fingered, or showing things like the current load on the server, etc…
I used to work at Convex w/ Jay Finger, whose username was "finger". I thought it was funny I could `finger finger` and it would actually do something. This was back when we had multiple users per machine and in the old days if you didn't provide a domain name, the finger command would default to hitting `localhost`.
Also... I seem to remember more than one security issue with stock `fingerd` at the time. After the second or third flaw in fingerd, I think it was banned (as much as it could be) from machines at Convex. By the time I made it to IBM/AIX, it was a serious no-no to have running on your machines.
Fingering was huge at my university in the late 90s and seemed very focused on relationships. Passive aggressive and extremely emo .plans was very much a thing when some people’s feelings were hurt. If you were interested in someone you were definitely fingering them to see from where they were last logged in (we used to call this finger stalking).
Come to think of it I setup my first “date” (more like a hookup) over unix talk.
We had a legit proto social network going, all over telnet!
No, that I think would be Match.com or something along those lines. This is like the grandfather or grand-grandfather of Tinder, but not even intentionally.
What I find funny is how an Estonian proverb/saying would fit here quite nicely: “don’t try to teach your grandfather how to have sex.” In this case, the grandfather didn’t need teaching - it was molded by the era into what was necessary.
disclose: "AI is one more tool. I use it for mechanical tasks: polishing the wording, catching typos, suggesting synonyms, improving or adapting code blocks and translating the article between Spanish and English."
It always reminds me of how how Apple write the copy for their landing pages. (A couple of examples from the current MacBook Neo page include "Silver, Blush, Citrus, and Indigo. Four stunning colors. One durable design" and "macOS. Easy to use. Runs all your go-to apps. Puts the fun in functional".) It's quite similar to a rhetorical device called the ascending tricolon, and it's definitely not normally how people speak or write unless they're making a deliberate effort to achieve this effect.
I write like this sometimes, and I've come to deeply resent the fact that AI slop-machines mimic things that make some writers' style "suspect" or "AI smells".
The slop-machines write the way they do because they have been fed material, and they then spew that back out. So any writer whose style looks a little different, eccentric, or unique may find that the slop-machine's stochastic processes lead them into a state where the pool of possible continuations is small enough that the mimicry is strong.
My wife's writings have recently been labelled as "probably AI" ... and we are livid.
But there's nothing we can do except write in a style that is not truly our own, just to avoid the inaccurate "slop identification" algorithms from smearing us.
Ahhhhh memories. As far as I remember this didn't really spread beyond the PC game developer world. Back in the day we built an automated finger puller (poller) to grab all the game developers .plans and post them on PlanetQuake, etc (depending on which game they were working on). At the time it was considered a core feature for hot game news! Certainly the twitter of its' time for direct from the horse's mouth news.
I started working on a "modern finger alternative" called winger: https://github.com/ChaseRensberger/winger, and was planning to write an article just like this! Glad to see other people interested in this stuff.
Don't forget head, tail, mount, strip, touch, etc.
My GF when I was first learning these names was convinced the Unix principals did all this quite deliberately and "finger" was her headliner argument. Evidently, even in 1971 someone complained: https://blog.robertelder.org/intro-to-pinky-command/ (relevant to that source, Usenet/Net News/mailing lists may be another social network which never exactly died and even today LKML, zsh-workers, etc. are main communication avenues).
In the mid-90s I taught a night class on Unix, and was experimenting with shell scripts from The Unix Programming Environment. There was an example using a loop and the who command to alert you when someone logged onto your local system. My cousin was a professor at a university several states away, and we had already figured out the talk command. So I decided to expand the examples in the book to use finger. By parsing the reply, somehow I could tell if my cousin was logged on, and I would send myself a notice. There was an ISP in the same building, and one day the ISP engineer came to visit me with a stern look. He asked, "By any chance are you sending a finger command every two minutes to this university's mainframe?" I proudly answered, "As a matter of fact, yes, I am!". I eagerly got out my Unix book to show him what I was doing. He just said, "Stop doing that. They have a system console logging program that has churned out dozens of pages of paper printouts because of you". I sheepishly acknowledged my mistake and quit running the script.
> finger [...] dozens of pages of paper printouts
I know just the poetry to go with that story:
--Omar Khayyám, 11th-century, translationBravo!
I was sure this story was going to end with your script causing chaos by calling finger in a busy loop. But every 2 minutes! Even in the 90s, that's a pretty mild amount of network traffic.
I think automatically printing the system console log to paper is the real villain in that story.
once i saw a guy run a pentest and a box was doing that. it printed an entire vulnerabilityscanner output verbatim all the bytes received o.O guy appearently got handed like 100m of paper with a request to pls not scan _that_ port :'D
some people had these setups and just never saw a lot of traffic because the boxes werent broadly routed on the internet etc. or internal.
now with all the scans and automated spamming by parties its totally unthinkable. most of my server bandwidth despite my efforts is going to this.. (thankfully down pay for that per bytes anymore!)
The grey beards in the mid-90s cut their teeth on much more constrained systems! The web crawling these days probably has all the ones who have passed spinning rapidly in their graves.
Paper companies would rejoice at the idea of OpenTelemetry
If running finger causes a paper printout, the issue appears to be with the latter.
early 90s paper may have been cheaper than digital storage I think?
It may be a case of needing write only logging, I always think of the nuclear power station logging all events to the line printer, But I can see a NOC doing the same, How finger ended up triggering it would probably be a fascinating case study of early innocent decisions getting ossified into the infrastructure.
depends, if its a printer with port 9100 open, or a system that forwards traffic to that, then it will chunk it ontop paper.
this scenario still happens today.
Indeed, it's 2026 and people are still putting HP port direct - directly on the internet https://www.shodan.io/search?query=hp+printer+9100
It may seem that the admins were wrong to criticize the fingerer for the voluminous output, but if you think about it, paper logging was a very pragmatic security and auditing measure in those days.
We had a lot of printers around the labs in our university, and they were high-speed, high-capacity. And in the earliest days of multi-user and time-sharing, the hardcopy terminal was actually the default, where the fabled "glass terminal" came along later!
So you have a highly secure system and it's outputting important log entries that may need to be examined later, in the case of a malfunction or a compromise attempt. So you send the most important output to your printer, and you get an offline, immutable audit trail to back up your most important log files.
That seems like a very routine and pragmatic step. In the intervening decades, there were many logging strategies, and many of them admitted for "covering your tracks" by hackers who could erase logs and destroy evidence if the admins weren't careful.
But again, if a 2-minute "finger" interval was causing a paper log overflow, the admins could have mitigated that, but perhaps they were justified in telling the kid to knock off the frivolous resource usage.
However, as I worked for an ISP back in those days as well, I can tell you that log overflows were crazy-making. We had a particular system that acted as primary DNS for many customers. And many customers who were brand-new to the Internet and brand-new to this DNS thing were not real good at configuring it according to standards. And so we had a NOC with projection monitors that monitored system status in various ways, and one of them was tailing our syslog file.
And all day long I kept seeing DNS errors. "Lame delegation" was the winner overall, but there were so many. I was so young and had no privileges or knowledge to fix them. But I helplessly watched them scroll, knowing there were issues, slowdowns, and inefficiences that I couldn't solve for them. Sorry guys.
I could see that, thanks. However OP mentioned the mid-nineties and I was working then. No one was printing out logs or saying "glass teletype" at that time. Twenty years earlier, sure, or maybe some elderly curmudgeons working at a conservative bank/govt installation perhaps.
To answer the sibling post below, I had a 1GB drive at home around that time, enough to store text logs cheaply. Logrotate is apparently from 1996.
people in 2026 still print out logs like this on rolls lf paper. cant be tampered. log tampering is a big issue for forensics. most programs do not have cryptographically verifiable logs.... and yes that wont be for all systems and all types of logs. but will take shittons of paper still to keep the records going back up to like 7+ years
we're talking about logs for finger here, not bank transactions
Speaking of finger, console logging, and the 90s: when I was a freshman in college I took a Pascal programming course. We were assigned accounts on a cluster of AT&T 3B2 systems running SVR3. The students only had access to a terminal lab; the servers were upstairs, out of our reach.
There was no disc quota or significant restriction on the resources available to us, so I became a video game mogul. I found all the freeware download sites, and I became an expert on portability, tweaking and compiling game software to run on our idiosyncratic system.
As students, we made extensive use of "finger", "w", "who", and "write". We also knew the existence of "wall" and the like. So it was de rigeur for us all to write a little something into our .project and our .plan files. I took it much further, and discovering VT100 escape sequences, produced an animated .plan file which erased and mutated some of the immutable datapoints displayed, such as replacing my $HOME directory with "/" and some script-kiddie flexes like "I have root access... you know!"
Subsequently I explored the system extensively and eventually found /etc/passwd, and for reasons, attempted to "su" to every single account I found in there, most of them being system maintenance accounts. Due to logging and auditing, of course, these blatant, brazen failures captured the attention of the unseen administrator.
I received an email that made my blood run cold. The admin (and I still remember his name 37 years later) told me everything I had done in detail, and said that claiming "root access" was equivalent to telling airport officials that I was carrying a bomb. And there were no academic sanctions or threats in this email, but his veritable omniscience and dead-serious tone made me reconsider many of my life choices at the age of 19. Today, I am thankful for this guy putting things into perspective, that Unix was not just a huge game of Zork or Nethack, and he definitely inspired my career goal as systems admin.
Hehe, I know I managed to undo the damage I caused, but I'm sure my activity was logged and noticed by the sysadmins at the time. Ironically, after graduating I later became a sysadmin at another department at my university and told them about the particular thing I'd exploited.
But, anyway this was on SunOS and specifically some Sun4c machines with a PROM password. I discovered a couple of new machines were put into the labs without a PROM password, so you could press STOP-A and get into the forth debugger, and read/write system memory. This seemed interesting, but I wasn't sure what I should be changing.
Then one day, I was reading some documentation, and there was a system call [1] that returned a pointer to some information about the current process (or maybe it was for a specific pid), and one of those fields was marked as reserved. I discovered that the field seemed to contain some kind of pointer, but I couldn't de-reference it, so I guessed it was something in kernel space, probably the information about the task needed for the task switcher. This also seemed interesting!
Using the PROM monitor to dump memory starting at that address gave a lot of interesting stuff, and at something like offset 22 there was a pointer to another structure and dumping the memory at this one showed my uid and gid, IIRC the uid was offset 6. Sure enough, overwriting the uid changed the euid of my process.
So, I could reliably get root on any machine without a PROM password by running my program, using the PROM to read the contents of the address it printed out, add 22, use the PROM to read that address, add 6 and write a zero to that address. (Assuming they are the correct numbers after 30 years of brain rot).
So, anyway, I had a bit of fun locally, and noticed that there was a memory mapped file that let you read the PROM contents. I then decided that I wanted to examine this on a machine that had a PROM password set, but this was harder than I expected. My initial plan was to rsh into the other machine as root, but that was forbidden by policy (and this would have been logged). I then thought about creating a setuid script with my new found root access, but that was thwarted as each machine had NFS mounted with root-squashing and their own local root partition. So, I decided I needed to create an additional "system" user in /etc/passwd with a password I knew (because that owned the binaries and wouldn't have root squash). The specifics of what went wrong I forget now because things rapidly got stressful so a lot of it became a blur, but the long and the short of it was that I managed to completely delete the NIS password file on that machine and so I couldn't log into it any more to attempt to undo my damage. However, I discovered that the non-NIS passwd file was still intact, and so I had to use my previous PROM trick to hack the "bin" user on a different machine, which allowed me to rsh as "bin" into the machine I'd just trashed (and that would definitely have stood out in the logs). Once I had a shell as "bin" on that machine, I was able to use the PROM trick again to upgrade that to a root shell and undo the damage I'd done before.
Some time later, there was some other root exploit knocking around, and I used that on a machine with a PROM password set, and discovered I could easily read what the password was just by reading that memory mapped file. As luck would have it, every machine had the same PROM password, and so from that point I could always have gotten root if I wanted it, but was always too worried about causing other damage that I never actually used it.
However, when I later became a sysadmin at the university, the other sysadmin was very confused one time when I did the same hacking root trick after he'd managed to mess up something similar on the root partition of a couple of machines and he thought he'd have to reinstall them all!
I just did STOP-A and entered the PROM password that he'd never told me, and did the same thing I'd done before and just said "yeah, we should probably change this password as it's the same as it was 2 years ago". The process of changing the password was annoyingly fiddly as the PROM password change tool was designed to only work on the console, which is why they'd never changed, so I wrote something to pretend to be an actual TTY so I could update all 100 odd machines remotely via rsh instead of logging on at the console of each of them. Fun times!
[1] I have some recollection it was an ioctl, but I'm a bit hazy on that now as it was over 30 years ago. I suspect it was the SunOS 4.3 version of the prpsinfo structure described in this: https://www.typewritten.org/Manual/Sun/SunOS/5.1/SPARC/man4/...
What fun. War stories like this are what keep me coming back to HN.
Also... When we moved from having multiple users per machine to multiple machines per user, services like finger on a specific machine didn't make much sense. It seems you should have one well-advertised machine that maps `foo@example.com` to a `plan.html` file somewhere. (If a user has multiple machines, which one do you query to get their daily .plan?)
Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.
This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.
EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)
EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.
All of this is addressed in the article. The protocol doesn’t address this stuff because it’s meaningless in the context of the protocol. If you want the extra features then there are other protocols and social networks.
Also if you wanted a .plan for different people you would code your own server as in the article and tie it to a different “user”. The original server ties .plan files to username home dirs but there’s nothing stopping you from changing how that effectively works on your own server.
Nice to see this here today. A number of hosts the article mentions are on the startpage of lookit, a finger client I've been building: happynetbox, plan.cat, thebackupbox's finger webring, etc.
The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.
I just released a v0.2 beta, feedback welcome: https://github.com/jonathandeamer/lookit/releases/tag/v0.2.0...
Great work!
Perhaps a global database or a parallel project like a search engine focused on fingering is needed. The sources are scattered, and clients like yours would greatly benefit from that.
I'd also like to mention that if you have Emacs, I also have my own client: https://git.andros.dev/andros/efinger.el
"The Charted Public Fingerverse" does a pretty good job at this! https://640kb.neocities.org/fingerverse/
Was definitely an inspiration for lookit. And yes, a search engine would be cool!
Wow! Thank you!
Finger was only part of the social network. The multi-user aspect of Unix itself combined with standard tools such as who, finger, write, mesg, talk, mail, biff, etc. combined to form a fairly complete text-based social network.
A discussion about Finger without a mention of WebFinger[1]? Similar in spirit, but HTTP based.
[1] https://webfinger.net
THX! I was trying to remember this reference.
Related fun site: plan.cat (discussed at https://news.ycombinator.com/item?id=29248368 )
NAT makes this kind of stuff impractical now a days b/c you can't really host anything from your own machine (well you can set up port forwarding if you can access the router...)
The easiest modern solution would probably be git pulling from an Onion address (running git daemon so it's read only). Then, when your machine is on, people that want updates would just
Though tbh.. the single-file setup of finger is cuter than a whole repo directoryHaha... looks like I gotta get finger.farm up and running again... :)
Thx for the mention blogger!
https://github.com/jonroig/finger.farm
TFA includes a link to an archive of John Carmack's .plan updates, 1996–2010:
https://github.com/ESWAT/john-carmack-plan-archive/tree/mast...
(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?
BluesNews has archives of some more people in gaming from back then.
https://www.bluesnews.com/cgi-bin/summary.pl
Funny thing: today at work, I was curious. Windows utility? try a few of the handles in the article.
Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.
When GitHub released their status update feature I re-imagined finger for the modern world: https://github.com/bketelsen/finger I didn't advertise it, nobody cared. But it was fun.
Man! I’m disappointed this article didn’t mention the coolest .plan hack of all time: you could link your .plan file to a named socket so whenever someone fingered you, an arbitrary program would run that spat out whatever output it wanted back to the client. Made for some very fun hacks, like randomly generated text every time you were fingered, or showing things like the current load on the server, etc…
I used to work at Convex w/ Jay Finger, whose username was "finger". I thought it was funny I could `finger finger` and it would actually do something. This was back when we had multiple users per machine and in the old days if you didn't provide a domain name, the finger command would default to hitting `localhost`.
Also... I seem to remember more than one security issue with stock `fingerd` at the time. After the second or third flaw in fingerd, I think it was banned (as much as it could be) from machines at Convex. By the time I made it to IBM/AIX, it was a serious no-no to have running on your machines.
Fingering was huge at my university in the late 90s and seemed very focused on relationships. Passive aggressive and extremely emo .plans was very much a thing when some people’s feelings were hurt. If you were interested in someone you were definitely fingering them to see from where they were last logged in (we used to call this finger stalking).
Come to think of it I setup my first “date” (more like a hookup) over unix talk.
We had a legit proto social network going, all over telnet!
This whole thread has me a little puzzled, in the UK 'fingering' is the de-facto term for a sexual act. Is that not the case elsewhere?
"Fingering was huge at my university" is, in the UK, very true, but I feel that's not the context you're using it in!
There was a fellow student at university who put the entire Hunting Of The Snark in their .plan file. It scrolled for a while.
I'm dying! Using Telnet to flirt. The father of Tinder XD
No, that I think would be Match.com or something along those lines. This is like the grandfather or grand-grandfather of Tinder, but not even intentionally.
What I find funny is how an Estonian proverb/saying would fit here quite nicely: “don’t try to teach your grandfather how to have sex.” In this case, the grandfather didn’t need teaching - it was molded by the era into what was necessary.
In the late 80s, a friend of mine broke up with his girlfriend via email while they were both sitting in the same computer lab.
Sounds like Berkeley.
I like it.
Just one cell.
Heck, you could probably make a little program for HN to use the about box as the service and achieve the same thing.
the bare minimum!
Impossible to run practically if your site is on CDN. Finger connects to the A record IP directly. Unfortunately.
> No encryption, no headers, no sessions. Pure simplicity.
AI smell?
Those commas do appear to be a load-bearing seam for the sentence — that’s not guaranteed proof, it’s just strong indication.
You mean "smoking gun".
disclose: "AI is one more tool. I use it for mechanical tasks: polishing the wording, catching typos, suggesting synonyms, improving or adapting code blocks and translating the article between Spanish and English."
This is also a very common way to write (hence why LLM tend to regurgitate it so much).
It always reminds me of how how Apple write the copy for their landing pages. (A couple of examples from the current MacBook Neo page include "Silver, Blush, Citrus, and Indigo. Four stunning colors. One durable design" and "macOS. Easy to use. Runs all your go-to apps. Puts the fun in functional".) It's quite similar to a rhetorical device called the ascending tricolon, and it's definitely not normally how people speak or write unless they're making a deliberate effort to achieve this effect.
I write like this sometimes, and I've come to deeply resent the fact that AI slop-machines mimic things that make some writers' style "suspect" or "AI smells".
The slop-machines write the way they do because they have been fed material, and they then spew that back out. So any writer whose style looks a little different, eccentric, or unique may find that the slop-machine's stochastic processes lead them into a state where the pool of possible continuations is small enough that the mimicry is strong.
My wife's writings have recently been labelled as "probably AI" ... and we are livid.
But there's nothing we can do except write in a style that is not truly our own, just to avoid the inaccurate "slop identification" algorithms from smearing us.
Vile machines.
/rant
The first half of the article seemed fine, but then it appeared padded with AI filler.
Human smell.
AI was definitely used in the writing; it’s a pity.
I occasionally find myself longing for talk(1) to actually work on Macs.
Ahhhhh memories. As far as I remember this didn't really spread beyond the PC game developer world. Back in the day we built an automated finger puller (poller) to grab all the game developers .plans and post them on PlanetQuake, etc (depending on which game they were working on). At the time it was considered a core feature for hot game news! Certainly the twitter of its' time for direct from the horse's mouth news.
Fantastic! How lovely to read these stories. And what influences Id has had on Finger.
I started working on a "modern finger alternative" called winger: https://github.com/ChaseRensberger/winger, and was planning to write an article just like this! Glad to see other people interested in this stuff.
Don't forget Zephyr as well - the original AIM....
I set fingerd up on my OpenBSD host: finger nutts@nutts.org
Also worth checking: finger ring@thebackupbox.net
Protocol named Finger
finger is the best-named utility of the Unix world.
Second place is Cat
Don't forget head, tail, mount, strip, touch, etc.
My GF when I was first learning these names was convinced the Unix principals did all this quite deliberately and "finger" was her headliner argument. Evidently, even in 1971 someone complained: https://blog.robertelder.org/intro-to-pinky-command/ (relevant to that source, Usenet/Net News/mailing lists may be another social network which never exactly died and even today LKML, zsh-workers, etc. are main communication avenues).
Maybe, an ssh version?
woah, never knew.. so cool.