I see Sourcehut, I upvote.
post
So wait, you're sending anyone who asks your real name, office address and your email status?
I mean, you can if you want. But the finger spec doesn’t actually specify a format for the returned data, so anything can be in there. Fingies just reads data from a text file and returns that. So finger foo@server would just have fingies read the file named <data_dir>/foo and respond with whatever is in that file. It could be a real name, address, and phone number, or just a silly greeting.
In the '90s we used to put public info there, kind of like a blog. The .project and .plan files (what we were working on and what we planned to work on, work or life-related), PGP key, geek code, etc.
Some people put their work contact information (not many), but the '90s were a very different time, specially before the Eternal September, and publishing contact info like a phone or email was not too big of a deal back then (remember the white pages).
Of course, finger is now just a curiosity from the past, considering its security issues and that the most healthy way of using the internet now is not to show yourself but to hide yourself the best you can.
I mean, you can if you want. But the finger spec doesn't actually specify a format for the returned data, so anything can be in there. Fingies just reads da
Perhaps look at running it with a systemd .socket file so you don't need to redirect a port using iptables.
That iptables rule would let any userspace application take over port 79 if your program crashes. Having the socket opened and managed by systemd means your app doesn't need to run as root but only your app can answer connections to port 79. You also get a measure of resiliency from systemd being able to restart your service if it crashes.
That's really cool! Unfortunately I have ethical issues with systemd, so I'd rather not support it as a first-class option in documentation or out of the box configs. Thankfully something taking over port 79 isn't a concern on any of my threat models for the software. I still require root for low ports on all my systems (to stop takeovers of 80, 443, 22, etc) but something listening on the finger port is going to be pretty harmless. Just don't try to finger hunter2@example.com :p
all 9 comments