Verify generated output before you run it

short · 25 min · Objective 4.5

Task

Practise the verification procedure the objective is built around: read generated commands, check invented flags against the manual, test in a disposable place, and sanitise anything before pasting it into a public service. The skill is judgement, and it is exercised on concrete cases.

Steps

  1. Take a generated shell command that includes a flag you are not certain exists. Check it against man or --help before running. If the flag is invented -- a real failure mode -- note how plausible it looked.
  2. Take a generated regular expression for extracting a field from a log. Run it against a sample where you know the correct count, and compare. A pattern that is 95% right silently drops one line in twenty.
  3. Take a piece of generated infrastructure code and review the security-relevant lines specifically: a 0.0.0.0/0 rule, a bucket without encryption, a container running as root. Note that these are the defaults generated output tends toward.
  4. Practise sanitising: rewrite a question about your real config so it asks about the SHAPE, not your hostnames, addresses or keys. Confirm the answer does not depend on the real values.
  5. Take a generated command containing something destructive -- rm -rf, dd, mkfs -- and treat it as the objective says: read it twice, check the target, and run it only in this disposable machine.
  6. Paste a generated script into an editor and read every line before running any of it, rather than pasting straight into the terminal.

Verify

# the invented-flag check: does it actually exist?
man rsync | grep -- '--the-flag' || echo "flag not in man -- do not trust it"
# the regex check: known count vs produced count
printf '10.0.0.1\n10.0.0.2\nnot-an-ip\n' | grep -Ec '^([0-9]{1,3}\.){3}[0-9]{1,3}$'   # must be 2
# the destructive check: dry-run first
echo rm -rf "${dir:?set me}/"    # echo, so nothing is deleted; guard refuses empty

The regex count matching the known-correct answer is the verification that matters: fluent output that is almost right produces plausible wrong results, and only a test against known data catches it.

Notes

The rule the whole objective rests on is "avoid copy/paste without review". Pasting into a terminal executes at the moment of paste; pasting into an editor first is the entire quality-assurance step, and it costs three seconds. The answer to "we cannot send this data anywhere" is a local model, not "we cannot use the tools".