Finger: the 1971 social network that never died

In the mid-90s I taught a night class on Unix, and was experimenting with shell scripts from The Unix Programming Environment. There was an example using a loop and the who command to alert you when someone logged onto your local system. My cousin was a professor at a university several states away, and we had already figured out the talk command. So I decided to expand the examples in the book to use finger. By parsing the reply, somehow I could tell if my cousin was logged on, and I would send myself a notice. There was an ISP in the same building, and one day the ISP engineer came to visit me with a stern look. He asked, "By any chance are you sending a finger command every two minutes to this university's mainframe?" I proudly answered, "As a matter of fact, yes, I am!". I eagerly got out my Unix book to show him what I was doing. He just said, "Stop doing that. They have a system console logging program that has churned out dozens of pages of paper printouts because of you". I sheepishly acknowledged my mistake and quit running the script.

Also... When we moved from having multiple users per machine to multiple machines per user, services like finger on a specific machine didn't make much sense. It seems you should have one well-advertised machine that maps `foo@example.com` to a `plan.html` file somewhere. (If a user has multiple machines, which one do you query to get their daily .plan?)

Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.

This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.

EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)

EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.

Finger was only part of the social network. The multi-user aspect of Unix itself combined with standard tools such as who, finger, write, mesg, talk, mail, biff, etc. combined to form a fairly complete text-based social network.

Nice to see this here today. A number of hosts the article mentions are on the startpage of lookit, a finger client I've been building: happynetbox, plan.cat, thebackupbox's finger webring, etc.

The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.

I just released a v0.2 beta, feedback welcome: https://github.com/jonathandeamer/lookit/releases/tag/v0.2.0...

Funny thing: today at work, I was curious. Windows utility? try a few of the handles in the article.

Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.

A discussion about Finger without a mention of WebFinger[1]? Similar in spirit, but HTTP based.

[1] https://webfinger.net

Related fun site: plan.cat (discussed at https://news.ycombinator.com/item?id=29248368 )

"Finger" is how my teenage self got into hacking. I'd dial into local universities, which all had open terminal servers. No authentication needed for the terminal servers. That didn't give me host access though, but I could run "status" or "who" or something and see who was connected and where they were connecting to (CS dept Sun server, etc.) I'd then connect to port 79 (finger) of the host, which let me see the logins and names of who was connected. Because these were college students, they often used their first or last name as a password. I'm sure you can figure it out from there.

In 1989 I wrote a little hack to turn my .plan into a named pipe. That way - anytime someone fingered me - I could do a netstat to detect where they were coming from.

My friend heard about this and fingered me 10,000 times in 5 minutes, and the computer science department's file server went down and I almost got fired.

TFA includes a link to an archive of John Carmack's .plan updates, 1996–2010:

https://github.com/ESWAT/john-carmack-plan-archive/tree/mast...

(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?

User enumeration seems to be the biggest hazard of running a server. I'd be curious to see a fingerd that lets you set a different name than your actual username, to avoid just spitting out names that an attacker can then set to work on cracking passwords for with an ssh daemon. Though I'm sure people will tell me that ssh keys sort this issue well enough -- and given that nobody self hosts email the spam issue isn't really there either.

Still, something like a masked identd used for masking system usernames for irc would go a long way to break the link between actual user accounts and display names for finger.

When GitHub released their status update feature I re-imagined finger for the modern world: https://github.com/bketelsen/finger I didn't advertise it, nobody cared. But it was fun.

> No encryption, no headers, no sessions. Pure simplicity.

AI smell?

I used to work at Convex w/ Jay Finger, whose username was "finger". I thought it was funny I could `finger finger` and it would actually do something. This was back when we had multiple users per machine and in the old days if you didn't provide a domain name, the finger command would default to hitting `localhost`.

Also... I seem to remember more than one security issue with stock `fingerd` at the time. After the second or third flaw in fingerd, I think it was banned (as much as it could be) from machines at Convex. By the time I made it to IBM/AIX, it was a serious no-no to have running on your machines.

The best part was you could `finger @machine` and it would list all the users currently logged on, their idle times, etc. Then you could follow that with `talk user@machine` and start chatting with them.