Decoding the obfuscated bash script on a Uniqlo t-shirt

(tris.sherliker.net)

1478 points | by speerer 2 days ago

85 comments

  • estebarb 2 days ago
    "Uniqlo x Akamai sells another design of shirt in the same range which is plainly incomplete"

    Imagine having to return a t-shirt because that malfunction!

    — I don't understand why are you returning this, was the size wrong or you didn't like it?

    — No, there is a syntax error at line 37 that makes it impossible to run, and I'm concerned people on the street may think I promote unsafe bash scripting.

    • _joel 2 days ago
      Worked on my torso
      • arikrahman 2 days ago
        Not everyone has a 6 pack sir!
    • mcdonje 2 days ago
      ATTN, Uniqlo customer service employees: If someone tries to return a shirt claiming an error in the printed computer code, decline the request and reply, "A real script kiddie would've spotted that error before buying."
      • deathanatos 2 days ago
        A real hacker, maybe. A script kiddie is by definition someone who wouldn't notice.

        http://www.catb.org/jargon/html/S/script-kiddies.html

        • boothby 2 days ago
          I made the slightly alarming realization yesterday that some script kiddies are old enough to have grandkids by now.
          • QuantumNomad_ 2 days ago
            I wonder how many of them graduated to the level of hacker witches / hacker wizards, and how many of them are nothing but script grannies / script grampses even today.
    • noisy_boy 2 days ago
      - I am shell-shocked at the lack of quality assurance! Can you at least apply a patch?
      • entropie 2 days ago
        Patch could be applied via pants.
      • alentred 2 days ago
        - Sure, we distribute a patch, you hot-fix it.
        • NonHyloMorph 1 day ago
          The person downvoting this doesn't know how to hold an iron (presumably).
      • karussell 1 day ago
        Cut & paste getting more real then!
    • cromka 2 days ago
      Oh the Karens these days!
    • NoSalt 2 days ago
      Spite
  • olooney 2 days ago
    If you enjoy this kind of thing, you might also like Martin Kleppe's work, such as the Quine Clock:

    https://aem1k.com/qlock/

    I reverse engineered it to a unobfuscated version a few years ago:

    https://gist.github.com/olooney/a89db3932b089925b71b68d7e9f2...

    He's done a ton of other great ASCII visualizations as well:

    https://aem1k.com/

  • wbh1 2 days ago
    I love this shirt! Here's a nice video from the actual designer about the process of making this shirt (including intentionally making it hard to OCR): https://youtu.be/jocGLiecpjU?t=526
    • criddell 2 days ago
      It would probably be quicker to type it in than figure out how to OCR it. It would be like typing in a game from a COMPUTE! magazine 45 years go.

      https://archive.org/details/1983-01-compute-magazine/page/96...

      • wildzzz 2 days ago
        At least that stuff was written in cleartext. You'd immediately know you just typed the wrong character if you saw PRONT on your screen.
      • marcus_holmes 2 days ago
        This was my reaction!

        OCR? oh my sweet summer child, you cannot know the days we spent typing in raw code from a magazine, and the joy when it finally ran.

    • speerer 2 days ago
      Author here. Thank you so much for the link which I hadn't seen! I'm very happy to see this and I'm gratified that it was deliberately difficult to OCR, not just me.
      • heresie-dabord 2 days ago
        As much as I hope for Peace, I would have suggested

        echo "Fgnaq+sbe+Qrzbpenpl!" | tr 'A-Za-z+' 'N-ZA-Mn-za-m '

    • VladVladikoff 2 days ago
      I watched the link but I didn’t see where he talked about making it difficult to OCR? What exactly was done that made it difficult to OCR?
    • fennecfoxy 2 days ago
      But it's not hard to OCR? And I don't know why the article dedicates an entire section to it.

      On a Samsung S24U I held down the "circle to search" homescreen button which brings up the AI tools interface (I don't know what it's officially called), held down on the text and copied the whole thing in one shot.

      It took like 2 seconds.

  • raphlinus 2 days ago
    The font is Roboto Mono, not Consolas.

    There's something else a lot stranger going on, though. It is a proper monospace font, but the typesetting on the shirt is not. There's some kerning going on (I noticed it especially in the 'Iy' pair), and also it appears that narrower characters such as 'i' take less horizontal space. If I had to guess, I would say that it was set with a tool such as "optical kerning" in InDesign.

    • somat 2 days ago
      Has anyone ever made a monospace font with dynamic kerning? Which is a silly thing I never thought of until I read the above comment. This sounds nonsensical at first glance(and it may be) but hear me out.

      We use monospace fonts for a reason, they stack in a grid nicely. But within the confines of that grid there is room to shift a character left or right a bit which may lead to a nicer to read monospace. (it is equally likely to lead to a hideous mess, every time a letter would shift left it would leave a larger space right)

      • roblabla 2 days ago
        Monaspace has a feature called "texture healing" that does something similar: it allows bigger letters to "steal" space from adjascent smaller letters, to make it easier to read. The result is that the letters are still in a grid, while still allowing for bigger letters to "breathe".

        https://github.com/githubnext/monaspace/blob/main/docs/Textu...

        It's the main reason I use monaspace as a font.

        • bityard 2 days ago
          I'm open to trying it, but my gosh, having one 'w' offset slightly by a few pixels from the one right above it feels like it would drive me bonkers eventually.

          And: doesn't this result in text that "jumps around" as you type?

          • stavros 1 day ago
            Only at most one letter jumps around, the previous letter you typed.
        • gavinray 2 days ago
          What a brilliant idea, neat. Thanks for the link.
      • Lalabadie 2 days ago
        iA Writer has Mono, Duo and Quattro fonts, with the latter two being almost monospaced. They concede some size variations for specific characters (Duo has 150% width characters, Quattro also uses 50% and 75% for narrow characters).

        It's a fun subtle adaptation to keep close to the typewriter-like experience of the app.

        https://ia.net/topics/a-typographic-christmas

      • kccqzy 2 days ago
        Shifting a letter left or right a bit can break the grid. What if the user writes the text that keeps triggering left shifts? A better solution is to use ligatures, so that specific character combinations look better while the ligature can maintain the overall width correctly.
    • speerer 2 days ago
      Thank you, I think you're right! I've added a correction in the post and cited your comment.
  • Tiberium 2 days ago
    OCRing this is a nightmare and is a good benchmark to any self-proclaimed good OCR/vision model.

    I think though it could likely be easily OCR'd if you give the image to any decent agentic harness with a good vision model, e.g. newest Claude/GPT ones, and tell them to split the image per lines, and then just OCR each line individually.

    I wonder if the script itself was written by an LLM before obfuscation? There seem to be a lot of comments in it, but in this case it's still ok :)

    • lemagedurage 2 days ago
      I don't think it was written by an LLM, some things stand out:

      The congratulations text is both in English and Japanese. Contains a single heart emoji.

      There was an intention to have a cyan to orange gradient, but the range starts in an ANSI block, ends halfway through the 256 color block and 256 terminal colors are not arranged like a gradient at all.

      There's no sleep at the end of the loop where I feel like an LLM would add that defensively.

      • n2j3 2 days ago
        Human here. I added a sleep 0.5 at the end, it's too fast to read otherwise. Makes for a nice terminal screensaver!
        • INTPenis 2 days ago
          Hi fellow human, I got the same idea. Just a sleep 0.1 before the echo "" makes it readable. Otherwise it scrolls way too fast.
      • make3 2 days ago
        "the code is not quite detail oriented enough to be AI", times are changing
        • pkilgore 2 days ago
          Flawless, completely unnecessary abstraction is a better tell of LLM code than "comment clearly responding to a part of a prompt that I cannot see".
        • DaSHacka 2 days ago
          More like 'not boilerplate-y enough'
        • lemagedurage 2 days ago
          Ehh, AI makes plenty mistakes but they have a different vibe to it.

          In my mind an AI would do something the most popular way even when that's not appropriate.

          A human might do things in an unpopular way even when that's not appropriate.

    • grumbelbart2 2 days ago
      > OCRing this is a nightmare and is a good benchmark to any self-proclaimed good OCR/vision model.

      It's not that difficult, our industrial OCR model read it correctly on its first attempt with default parameters. The characters are easily separable, there is no structured background (think expiration dates on yogurt aluminum lids) that confuses the reader, there is no almost-text-like texture anywhere that would clutter the result. The font is also nice and standard.

      • mmooss 2 days ago
        Cool. What's an industrial OCR model?
        • grumbelbart2 2 days ago
          Essentially part of a machine vision software package, which in turn is computer vision specialized for factory automation. It's "industrial" because it was trained on such data (more expiration dates and SEMI-font on wafers, less random pictures of streets with some text).

          That, plus engineering and support: a robust implementation, deployment on almost any system, fast and good long-term support so your factory doesn't stop for too long if something goes wrong etc.

          • mmooss 1 day ago
            Makes sense. I wonder if there's anything in the technology that would benefit people scanning books or those scanning random things with their phones. Maybe better for low contrast or degraded print?

            (Obviously those applications don't need the engineering and support, and probably would not be a good fit for your company.)

    • netsharc 2 days ago
      The last time Internet people were obsessed with OCRing some base64 was a few months ago when the DoJ released tons of emails from some guy who died, but they were released as rasterized PDFs.

      Can't remember his name now, there's been so many distractions...

      • helterskelter 2 days ago
        All I remember is that it had some to do with Bill Clinton sleeping with underage girls and Bill Gates with a nasty case of VD.
        • netsharc 2 days ago
          I think there's also someone who's very close to him who currently has the reins of power in government... or you forgot about this?

          He even sent the now-deceased man a birthday card with some words that strongly suggest he knew what was going on..

    • OtherShrezzing 2 days ago
      Safari's copy-text-from-image feature manages the entire base64 part of the string, except for the first character (I instead of a T). Weirdly, it gets much worse performance if you try to copy the entire string, including the hashbang part.

      I wonder what it's doing under the hood to get such good performance?

      • khurs 2 days ago
        Didn't know Safari had this.

        Looked it up, you put mouse over text, then just select and copy it - very cool!

        https://support.apple.com/en-gb/guide/safari/ibrw20183ad7/ma...

        • al_borland 2 days ago
          It’s actually a system feature, not strictly a Safari feature. It also works in Photos, Preview, etc.

          On meetings I will often take a screenshot of the URL someone is presenting. I’m then able to just open the image and click the URL in the image.

        • iamflimflam1 2 days ago
          There’s a whole bunch of hidden features that no one seems to be aware of.

          Preview has pretty good background removal.

          Notes will transcribe audio from audio files.

          • al_borland 2 days ago
            Notes will do OCR as well. Trigger the feature, point the camera at something, and it will input just the text.
            • lostlogin 2 days ago
              Notes is amazing. Autocompleting equations, converting jpg to pdf and various other admin chores.

              The seamless cloud sync between devices is much appreciated too.

        • agys 2 days ago
          Preview has it too… And it works extremely well.
    • ErroneousBosh 2 days ago
      Those of us who grew up in the 8-bit era would have just typed it in, carefully, in silence, with no-one allowed to enter or leave the room until we were done ;-)
    • shakna 2 days ago
      > I wonder if the script itself was written by an LLM before obfuscation?

      From the prototype shown here [0], and the way they talk about their process, I sincerely doubt it. Especially as they mention trying to make it hard for AI to handle the output.

      [0] https://youtu.be/jocGLiecpjU?t=567

      • cb321 2 days ago
        I watched that whole video link - thank you for that - and he doesn't really say. In fact, he spends much more time on the beige color harkening to computer case plastics of the 80s & 90s.

        The AI not handling the output relates to the final base64 output on the T-shirt (which other comments in this thread mention manually keying in or TFA discusses in the context of OCR). So, that is just not relevant to the question.

        What made me start to wonder, personally, was that the output seems identical if you use "♥PEACE♥FOR♥ALL" instead of the version with internal repeats. IF there is any point to that "manual expansion of the cycles", IMO that deserves a comment much more so than "# Calculate length of text; text_length=".

        Also, that `echo -n ...` followed by `echo ""` instead of just plain `echo` in the first place seems like the kind of copy-pasta code LLMs generate. Then again, regular devs also write pretty bad copy-pasta code.

        There is also this the weirdly "broken down" calculation with 3 `bc` invocations not 1 as if it was translated from a language with more arithmetic/special function power than bash.

        There is also the color scale stuff done in the loop instead of outside (except the one color=$(..)) which seems very unnatural and also very like machine translation.

        Also, at least for me, on my bash-5.3.15(1), `char="${text:t % text_length:1}"` does not work to slice out the multi-byte UTF8 heart symbols, but it sure does look like the kind of thing an LLM would do translating from a python3 script (such as something like https://news.ycombinator.com/item?id=48830669) into bash.

        Another thing is, as others here have observed, there is nothing "gradual" about the xterm-256 color cube. So, "gradient" is a misnomer and exactly the kind of weird things LLMs do when they cobble text together.

        Finally, all the tput stuff the script does instead of just "print x spaces" really smells like a human description of the side scroll in the video game graphic he shows inspired him somehow LLM-corrupted/complexified into the vertical scroll terminals do.

        None of this is conclusive, but the video mentions 2023..2025 as when he did it and given that he was a designer and his concerns more visual than code-oriented, I'd have to say I disagree with your sincere doubt and I do strongly suspect the decoded script was very likely LLM-circa2024-generated, possibly with light post-edits by hand.

        • shakna 2 days ago
          You mention someone else's Python version. Did you note that the prototype in the video was... Python?

          All the smells you pointed out, just look like a Python dev approaching bash without fully understanding it.

          • bigfishrunning 2 days ago
            > All the smells you pointed out, just look like a Python dev approaching bash without fully understanding it.

            also, referring to Linux as "the language of the internet" when bash isn't particularly suited for internet tasks also smell like "excited windows Python dev"...

            • cb321 2 days ago
              FWIW, his screens looked a lot like OSX to me (which tracks with graphic design users in my experience).

              Anyway, he seems like a very nice fellow and I wish him and almost all T-shirt designers well. That bash script just gave me a lot of pause. (And even that seems possibly downstream of him being nice and doing it himself to spare his team from what he called a "FrankenProject".)

              • jolmg 2 days ago
                "Linux, the open-source language of the internet" comes from the linked akamai.com press release, not the blog post author. Their putting that as a section title to the quote may be their poking light fun at it.
          • cb321 2 days ago
            Yeah. The Flask web-page prototype was indeed in Python. (The prequel shirt was Go.)

            { Also, it was my own Py version which I mostly did in case anyone wanted to actually run the thing after such interest was expressed on this thread. :-) }

            I already said regular devs and LLMs can both gen copy-pasta. That said, being "mostly" a Python dev, asking some LLM to translate to bash for him seems even more likely to me. Only he or those close to him knows for sure. You & I cannot settle it here conclusively (as also said).

            I also noted from the video that the ♥s (hearts) worked on whatever version of bash he tested with though it failed for me (which is why I wrote that Python). And his terminal title bar is switching between `tput` and `bc` and such meaning that what he was demoing was not some Python script. ¯\_(ツ)_/¯

            EDIT: Ah..another resolution of the hearts is to not run in an LC_ALL=C environment. Oops! `LC_ALL=en_US.UTF-8 bash ..` fixed it. Oh well, I think the Python script is nicer in almost every way. E.g., you could |head -n60 and send it to a line printer/dot matrix reminiscent of the 1980s computers he shows in the video, although your printer driver would have to strip the color escapes with a `sed` or maybe https://github.com/c-blake/bu/blob/main/noc.nim. ;-)

    • underyx 2 days ago
      I gave the photo to Opus 4.8 and it reconstructed the same script in one shot. Although it did say it had to correct some parts of it based on context where it suspected OCR mistakes.
    • da_grift_shift 2 days ago
      >I wonder if the script itself was written by an LLM before obfuscation?

      I seem to recall seeing an Akamai-branded base64'd shell script on a white shirt pre-2021(?), so unless they've changed the code since then, I doubt it...

    • richstokes 2 days ago
      Is it a nightmare? I pasted the first, zoomed out, image of the shirt into ChatGPT, and it decoded it / let me know what the bash script does in one shot
    • fennecfoxy 2 days ago
      Is it? Android tap and hold/image text select one-shotted it in 2 seconds.
    • justusthane 2 days ago
      What is it about this that makes it particularly hard to OCR?
    • IshKebab 2 days ago
      Definitely LLM. No humans write that many comments.
      • ChrisMarshallNY 2 days ago
        Ahem...

        My code usually clocs at 50/50 (or thereabouts)[0]. Has, since my very first real engineering project (in 1987)[1]. I discuss in detail, here[2].

        But one reason that I like LLMs, is that they help me to write even more documentation. I have found that I can instruct an LLM to revise my documentation, and make it even more effective.

        [0] https://github.com/ChrisMarshallNY (My GH profile. Pretty much everything there, is like that -has, since long before LLMs were a broken rubber on the drug store shelf).

        [1] https://littlegreenviper.com/wp-content/uploads/2022/07/TF30... (Downloads a PDF)

        [2] https://littlegreenviper.com/leaving-a-legacy/

        • IshKebab 2 days ago
          Your code isn't as unnecessarily commented as this. E.g. look at this line

          https://github.com/RiftValleySoftware/RVS_Spinner/blob/d44ee...

          An LLM would have commented `// Create temporary UI view.`

          Completely redundant comments like this are a classic hallmark of LLMs:

            # Set frequency scaling factor
            freq=0.2
          
          Dunno why I have been downvoted for stating the obvious.

          Also from my brief look at one file it looks like you have 50% comments because you have a gazillion comment separator lines.

          • ChrisMarshallNY 2 days ago
            I didn't downvote. There's nothing wrong with your comment. It's just a bit silly, because humans definitely write that much. I learned from Apple and Adobe headerdocs.

            I worked for a Japanese company that accreted comments.

            Yeah, lots of whitespace.

      • petu 2 days ago
        Human could write that many comments to get enough base64 text for a design. Maybe to even get some of the highlighted characters in places they want (roughly equally spaced apart).
      • latexr 2 days ago
        > No humans write that many comments.

        Especially in a case like this, I would definitely write a lot of comments to aid in understanding, thus increasing trust so people would try it out and tinker with it.

        • boomboomsubban 2 days ago
          Plus the main point of this code is to have people look at it, the function is secondary to being an easter egg.
      • ivolimmen 2 days ago
        Since LLM's are mimicking our code my guess we do...
      • NamlchakKhandro 2 days ago
        I do
      • Tiberium 2 days ago
        Honestly it's a bit of a shame. I checked and they could've shortened their base64 payload by 304 chars by removing all comments except the top two congratulatory ones, or by 524 if they removed those too.
        • OtherShrezzing 2 days ago
          Would they still get the highlighted "PEACE FOR ALL" text throughout the shortened string? It looks like the length, and presence of those characters, was an explicit design choice.
        • lemagedurage 2 days ago
          Maybe they added the comments to get a longer payload for the sake of the shirt's design.

          The comments can be more cute/awe inspiring for people who aren't as familiar with bash but like solving puzzles as well.

        • yborg 2 days ago
          The HN optimizing T-shirt compiler is the next stage here :D
        • saidnooneever 2 days ago
          im just sad it didnt render a qr code leading to malware :'). the different ways ppl look at obfuscated codes and scripts hah
  • world2vec 2 days ago
    Oh wow I saw that tshirt at the store and said to my girlfriend "no way that script is functional, probably just for show". I should have persevered.
    • actionfromafar 2 days ago
      An easy miss. :-) Most of the time our thoughts are on autopilot, since we are not calm.
  • haileys 2 days ago
    I thought it was funny that the author used a variety of OCR tools with mixed success before spending a lot of time manually fixing up the output from the best one, rather than just typing it in
    • christoph 2 days ago
      That was also my thought… but I grew up mashing rubber keys for hours copying “games” out of magazines and books! Then hours after fixing all the typos!
      • forinti 2 days ago
        I spent hours typing 6502 assembly. It went a lot better when someone dictated: LDA, STA, BEQ, LDY, STY...
    • acters 2 days ago
      I ran it through paddle paddle OCR and it flawlessly did it. Google's OCR through my phone's Google lens had also worked at getting a very good extraction but not 100% correct. Definitely would spend less time fixing it than hand copying.

      IDK what the author was using but I feel like he could have shared how his OCR attempt went, but I am thinking he tried some naive OCR tools.

      • speerer 2 days ago
        Author here - that's a good idea actually, it shouldn't be too hard to compare the various attempts. The tools I used were whatever my Android built-in is (likely Google Gemini, but I can't tell whether this is something Samsung has replaced in OneUI); tesseract; tesseract with various tweaks and charsrt restrictions; Claude; and finally, manual fixes based on disagreements between all the previous.
    • rtldg 2 days ago
      Took me almost 2 minutes for 4 lines (and I missed a character in one of them!). I would opt for OCR too, obviously so I'm prepared for the next bash t-shirt I'd come across...
      • OtherShrezzing 2 days ago
        I think this is a case where two people can successfully complete the task manually faster than one attempting to automate it. Get a ruler, read five centimetres of characters to your colleague, have them type it in as you go, then repeat that five centimetres back to you. Correct as you go. Format your string with the same line-breaks as the t-shirt, and remove them at the end, so you can be sure you've got the correct length on each row. Trial-and-error adjust the five-cm distance depending on your success rate as you go along

        All in, you should have a non-corrupted string in 10-15 min.

    • conductr 2 days ago
      Feels like my experienced reality of task automation in corporate environments. We routinely have engineers spend 40+ hours automating tasks that an entry level person can do manually in 10 minutes and only need to be done weekly. Automation at all costs seems to be the future
      • e28eta 2 days ago
        It’s certainly not a new phenomenon. I appreciate this XKCD [1], with a chart of “How long can you work on making a routine task more efficient before you’re spending more time than you save”

        It’s not the final word, since automation has other benefits: documenting the procedure’s steps, reducing human errors, increasing consistency, etc.

        1: https://xkcd.com/1205/

    • mayas_ 2 days ago
      "just typing it" would be more error prone for the average human
      • t-3 2 days ago
        Not really. Transcribing long sequences of nonsense is annoying but quite easy to do without error as long you're patient enough to follow a simple process of reading, typing, and double-checking character-by-character.
    • grumbel 2 days ago
      Gemini3.5 Flash didn't have a problem OCR'ing and base64 decoding it, despite the OCR step having errors, it just fixed them in the base64 decoding step.
    • speerer 2 days ago
      (Author here) Yes I agree. It was a fun side-quest though. Reminds me of https://xkcd.com/1205/
    • duskdozer 2 days ago
      I'm guilty of this, but for me this kind of thing is optimizing over annoyance rather than time.
  • chrysoprace 2 days ago
    My old colleague had one with a Go program[0] which I always thought was quite cool.

    [0] https://github.com/GL-Kageyama/UNIQLO_Akamai_T-shirt_Code

    • yogorenapan 1 day ago
      Saw this the other day on the train, and probably stared a bit too hard at the dude wearing it. Surprised to see this on HN so soon after. World feels like a simulation
    • mdgld 2 days ago
      I wasn’t sure if you meant a Go solver or Go the language. Would be fun if someone wrote a Go program in Go
      • psd1 2 days ago
        Or a pong clone in Racket.
    • ExoticPearTree 2 days ago
      I got one this year with the Go code. Never actually thought it is legit code, just some random stuff.
  • mk_stjames 2 days ago
    Neat. My only critique of the script is that I would have added a

      sleep 0.1 
    
    in the loop so that as this prints in a terminal it is actually readable; any modern terminal will scroll so fast you can't see the message in flight.

    Slowing it to a 10hz refresh makes it look great.

    • whartung 2 days ago
      Maybe you can sew a patch into it?
  • qiqitori 2 days ago
    I once wrote a tool that helps with finding mistakes in OCR'd fixed width text, https://blog.qiqitori.com/2023/03/ocring-hex-dumps-or-other-...

    Basically it just clusters same characters and asks the human to find the problems, which is easy when you're looking at a series of pictures like ssssss5sss.

    The UI is kinda least-effort. Should ask a modern AI agent to make it look nice and intuitive, sometime maybe.

  • forinti 2 days ago
    This reminds me of a T-shirt I once saw that read:

              perl -e '
         "$a="etbjxntqrdke";
      $a=~s/(.)/chr(ord($1)+1)/eg;
            print "$a\n;"'
    
    It's cursing. Don't run it if it might offend you.

    Upon seeing this, I decided to golf and came up with a shorter version:

      perl -e "print chr 1+ ord for split //,'etbjxntqrdke'"
    • librasteve 2 days ago
      or

        raku -e 'say "etbjxntqrdke".comb.map({chr .ord + 1}).join'
      • lizmat 2 days ago
        or

        raku -e 'say "etbjxntqrdke".comb.map(*.succ).join'

        • srejk 2 days ago
          This is just a ROT1, so perl -pe'y/a-z/b-za/'<<<etbjxntqrdke
          • forinti 2 days ago
            That makes for a cool rot13: /a-z/n-za-m/
          • librasteve 2 days ago
            raku -pe 'tr/a..z/b..za/' <<< etbjxntqrdke
  • nico 2 days ago
    Very cool. It reminded me of the DeCSS t-shirts, which had source code with the decryption keys for DVDs

    https://en.wikipedia.org/wiki/DeCSS

  • kijin 2 days ago
    Well at least they're not instructing consumers to run curl | bash.

    That's better than half the tech howtos out there.

    • INTPenis 2 days ago
      No, they're instructing their customers to run unknown base64 encoded code instead. :D
      • bigfishrunning 2 days ago
        They should have just had the base64 block and forced you to decode and read it before running it, rather then having the `eval` bit at the beginning...
        • kijin 2 days ago
          But that wouldn't have looked like a bash script, only a random sequence of characters. The shebang at the start definitely contributes to the geek factor.
  • zeumo 1 day ago
    Neat, I'm wearing that exact shirt right at the moment I see this on the front page!

    I typed it out myself, and I liked the comment in Japanese text, which sort of added another layer of obfuscation (even though pasting it in an online decoder was trivial, it still was something more to decode, a level deeper). Also, I can now spot non-ASCII blobs in base64-encoded text, which is a skill I hadn't ever considered was possible before.

  • pacofonix 2 days ago
    For a non English locale that use comma instead of dot for decimals (in my case, Spanish), this script is partially crashing. Run using something like `chmod +x shirt.sh; LC_NUMERIC=C ./shirt.sh`.
  • brazzy 2 days ago
    After being primed by the article, I read the author's name as "Shirtliker"...
    • speerer 2 days ago
      That's a new one and oddly apt :)
  • raffael_de 2 days ago
    while base64 can be considered obfuscation in this context and its inverse as decoding I can't help but feel this title is overselling and catering to a rather cyber-cheesy marketing campaign at that.
    • ape4 2 days ago
      Yeah, its a bit of a cheat. The best obfuscated C programs have the source looking like a Christmas tree (or something) and then play an xmas song (or whatever)
      • raffael_de 2 days ago
        the base64 thing they did feels like a cheap version of that green-obscure-symbols-raining-on-a-terminal animation in The Matrix. should have gone with "Hack the Planet" instead ...
  • pixelpanic360 2 days ago
  • zftnb666 15 hours ago
    Finally, a fashion brand that understands their target audience: people who debug bash for fun.
  • NikxDa 2 days ago
    Super cool, especially that the code is annotated!

    In case the author is reading: The decorative feather images are between 2MB to almost 5MB in size. Compression might be in order to save users time and bandwidth, and make the site look less broken while the images are partially loaded :)

  • sixtyj 2 days ago
    > Interesting. I told my wife "that’s basically how people ship viruses’ and bought it.

    It’s a movie plot.

  • episode404 2 days ago
    > Calling base64 encoding obfuscation

    I was expecting some cool js deobfuscation tricks, so to put nicely I’ll just say that my disappointment is immeasurable and my day is ruined.

  • 9dev 2 days ago
    Huh! I was sure the copy-text-from-image feature in MacOS would handle this flawlessly. But the best run I managed produced the following:

        base64: stdin: (null): error decoding base64 input stream
        #!/bin/bash
        
        # Congratulations! You found thu eastur ugg!#B��O��
        # おめでとう��M�ぇM�す!隣C��わM�サ�#ライ����見でM�������!O��
        
        # Define thu tuxt to anima|e
        text="♥PEACE♥FOR♥ALOB��PEACE♵FOR♵ALL♵PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♵FOR♵ALL♥"
        
        # Get termb�al dmmensions
        cols=$(tput cols)
        linus=$(tput lines)
  • thomaslwang 2 days ago
    This reminds me of the old "code on a shirt" tradition - MIT used to sell shirts with Lisp one-liners. What I find interesting is that the script actually runs. Most of these novelty shirts just print something that looks like code but is meaningless. The fact that someone at Akamai went through the trouble of writing a self-evaluating obfuscated script for a retail product is either a great prank or someone's pet project that made it to production.
  • _spduchamp 1 day ago
    So glad I clicked this random HN item, because now I learned about tput.
  • duggan 2 days ago
    I do like these sorts of things; decoded a less exciting one from a bottle of wine I found in 2019. Significantly more eye-watering without OCR: https://xcancel.com/duggan/status/1130920846304993282
  • cb321 2 days ago
    For anyone that cares, this is a slightly less stupid Python version:

        #!/usr/bin/env python3
        from os   import environ; E = environ.get
        from math import sin
        from time import sleep
        text = "♥PEACE♥FOR♥ALL" # The text to sine-scroll animate
        nText  = len(text)      # Number of utf8 chars
        freq   = 0.2            # Frequency scaling factor
        color0 = 12             # xt256 Color cube segment 12..<208
        color1 = 208; nColor = color1 - color0
        (w, h) = (int(E("COLUMNS", 80)), int(E("LINES", 24)))
        t = 0
        while True:
            x = (w/2) + (w/4)*sin(t*freq)           # x pos via sine value
            x = max(0, min(w - 1, int(x + 0.5)))    # bound to tty width
            color = color0 + ((nColor*t)//h)%nColor # cycle colors
            ch = text[t%nText]  # Get char & Use xterm-256 color escs
            print("%*s\033[38;5;%sm%s\033[m\n" % (x, "", color, ch))
            t += 1
            sleep(0.1)   # original used bc shell outs to rate-limit
    
    As mentioned in https://news.ycombinator.com/item?id=48830634 , the heart symbols did not otherwise even work for my bash and some have commented on liking the screen saver.
    • conductr 2 days ago
      You should base64 it and sell tshirts
  • jibal 2 days ago
    I used to work for the first CDN company, Sandpiper Networks Inc. Akamai drank our milkshake.
  • DrewADesign 2 days ago
    > I guess Uniqlo is run through Windows though: one thing that struck me was the font, which I’m almost certain is Consolas,

    Surely this would use whatever font the virtual terminal profile was set to? I don’t know of any method to choose a virtual terminal font from bash and don’t see any code that addresses it?

    • nisiddharth 2 days ago
      They're referring to the font on the T-shirt.
      • tym0 2 days ago
        Thank you for spelling it out for me because I thought I was looking at a completely hallucinated AI article...
        • speerer 2 days ago
          Author here. All hallucinations are my own. Now you point it out, I see why the jump in context from the terminal back to the tshirt font would give the wrong impression.
          • tym0 2 days ago
            Honestly it was quite a whiplash to go from what looked like a good article to something that seemed completely made up. But I would chalk that up more to my reading comprehension than your writing.
            • DrewADesign 2 days ago
              I didn’t read it as generated text, but the context definitely threw me.
      • DrewADesign 2 days ago
        Ah, I see. I’m sure the clothing designer that actually made the design couldn’t care less about technical consistency and was just looking for something ‘tech’ looking that also read well in that design context in that medium.
    • efreak 2 days ago
      I don't recall the exact command I used, but I had my console font set to Comic Sans for a while (though it wasn't quite recognizable due to low resolution and aliasing). There's tools out there to convert type 1 and other fonts to console font format (I couldn't quite manage to get the opentype converter tool working, but truetype worked fine at large sizes)
  • high_byte 2 days ago
    what if it contained a zero day for tesseract and the script you thought you got is just a throwaway
  • thenthenthen 2 days ago
    My japanese friends say: yes because uniqlo is a science company not a clothing company
  • wyldfire 2 days ago
    That "beige box" term is not the beige box I was thinking of at first.

    [1] https://en.wikipedia.org/wiki/Beige_box_(phreaking)

  • busymom0 2 days ago
    > I’ve no idea at all how many views this site gets, but I’m willing to bet it’s not even double-digit humans per month.

    I'd take that bet considering it's got close to thousand upvotes and on front page of HN

  • _kst_ 2 days ago
    The image shows the `eval` on the same line as the `#!/bin/bash`.

    It should be on a separate line.

        #!/bin/bash eval "$(base64 -d <<< '...
  • dylanzhangdev 2 days ago
    Cool! I bought one a few months ago as soon as I spotted it at a Uniqlo store, and later ordered a larger size online—I really love wearing them. But it never occurred to me to look into the story behind them.
  • chrisweekly 2 days ago
    Great post! It's interesting, detailed but concise, and well-written. Also, I appreciate the "no cookies or tracking" and attractive, functional and performant site design.
  • _flux 2 days ago
    On one hand it's nice how it's clean and commented, but on the other hand some golfing could have made the encoded block a lot more reasonable to actually manually enter.
    • puttycat 2 days ago
      The comments just mean they used AI to do that in 3 seconds
    • speerer 2 days ago
      It might not have filled up the whole shirt then?
      • _flux 2 days ago
        Could have used bigger font.
  • sharyphil 1 day ago
    I love this thread for the sheer amount of humor and knowledge. Good to be a part of this community.
  • l337h4x0rz 2 days ago
    there's no newline between the shebang and the actual code
  • shim__ 2 days ago
    Could have saved 50% with 'base64 -d | gzip -d'
    • speerer 2 days ago
      Maybe useful for those XS sizes.
  • preetham_rangu 2 days ago
    The real threat model here isn't the base64 payload, it's Uniqlo turning a T-shirt into a QR code that requires a human OCR pipeline to redeem.
  • riccardik 18 hours ago
    this is great, who designed it really has put some effort in it
  • onraglanroad 2 days ago
    There is so much there that could be code golfed. I'm tempted to try when I'm back. Anyone done it already though?
  • icevl 2 days ago
    Base64 without error correction turns the t-shirt itself into a lossy transport layer, so the OCR/transcription step becomes the actual challenge.
  • brightball 2 days ago
    Nice!

    Might have to do something like that for a verse on the next Carolina Code Conference shirt. Been trying to figure out a good way to pull in cybersecurity.

  • teo_zero 2 days ago
    I don't know... I prefer unobfuscated text that you can immediately grok. The other day I saw this on a T-shirt:

    > May the m×s/t² be with you

    • jolmg 2 days ago
      Wouldn't be interesting enough to nerd-snipe people.
  • webprofusion 2 days ago
    I have the one with Go code on it, unfortunately I don't think that one would even compile.
  • throwaway270925 1 day ago
    Does anyone know, is there something like base64 but with error correction?
  • mschuster91 2 days ago
    > # Hide the cursor \ tput civis

    Never thought I'd learn shell tricks from the back of a fast-fashion t-shirt, but here we are.

  • jsonc 1 day ago
    i bought this tshirt in tokyo (goes to uniqlo tokyo despite having uniqlo at home), i also thought it looked like malware so i bought it :D

    happy to see that the base64 was valid and did something cool! ^_^

  • doppp 2 days ago
    Thanks for the post! Love Easter Eggs like these!
  • lz400 2 days ago
    I have this tshirt. I'm relieved it's not a cognitohazard, virus or something, thanks!
  • mpascale00 1 day ago
    Seems like this post might have put them out of stock.
  • Gabrys1 2 days ago
    I don't understand the font bit. This is a terminal script, it uses the font that your terminal uses?
    • LeifCarrotson 2 days ago
      Your terminal doesn't typically use Consolas. You can do:

          $ wget  https://archive.org/download/PowerPointViewer_201801/PowerPointViewer.exe
          $ cabextract PowerPointViewer.exe
          $ cabextract ppviewer.cab
          $ open CONSOLA*.TTF
      
      and use Consolas on Linux, but it's not available by default.

      What they're suggesting is that a lot of their users are logging into an Akamai Linux box from a Windows machine, and therefore aren't "real Linux geeks".

    • SebRollen 2 days ago
      They're talking about the font on the shirt
    • creaturemachine 2 days ago
      What Bash blog would be complete without some Windows trash-talk?
  • khurs 2 days ago
    Brilliant marketing when you can get people to pay to walk around advertising with your logo!!
  • Brian_K_White 2 days ago
    I want to submit a pr to s/SIGINT/0

    You want to do that cleanup regardless why you exit.

  • khernandezrt 2 days ago
    Ive been to 3 Uniqlos in my are and i havent been blessed with a bash shirt :(
  • felineflock 2 days ago
    Phew! I was hoping it was not a novel way of spreading a malicious script!
  • willejs 2 days ago
    Looks like it has a few shellcheck issues, and no set -euo pipefail? ;)
  • breppp 2 days ago
    Feels very reminiscent of the style of old DeCSS tshirts

    https://www.wired.com/2000/08/court-to-address-decss-t-shirt...

  • alexpotato 2 days ago
    Fascinating that we have base64 but not error correction for it!
  • brcmthrowaway 2 days ago
    Whats going on with Uniqlo? Is it still popular in the US?
  • FijiBY 2 days ago
    Nice investigation, thx
  • luciana1u 2 days ago
    finally, a t-shirt that ships with a CVE. i'm waiting for the limited edition that requires a firmware update before washing.
  • 0ld 2 days ago
    so they presume there is bash in my system, and it is under /bin

    well, i guess no peace for me then

  • jack_pp 2 days ago
    Love the font on the blog
  • tantalor 2 days ago
    TIL Consolas is a Windows font
  • grepsedawk 2 days ago
    This is so sick!
  • mgaunard 2 days ago
    how is it obfuscated? It's literally written as plain black monospace text on a white background.

    Pretty sure any AI can solve it in 20 seconds.

    • sanmarzano 2 days ago
      It’s encoded not obfuscated. It’s even commented, which is the opposite of obfuscated. Plus it’s not really an Easter egg that was found: it is literally printed in a shirt. Easter eggs are supposed to be hidden and either only found by insider knowledge or deep investigation. This was neither.
  • tiagod 2 days ago
    >peace for all >akamai ha!
  • koiueo 2 days ago
    > I ran OCR in a few ways: First, using the built-in OCR of the circle-to-search feature on Android, which is often very good. Second, by using Tesseract with a few options and tweaks. And third by running it through Claude. After diffing the three to look for mismatches and getting Claude to output a table of locations for quick scanning, it became trivial but time-consuimg to tidy up the remainder

    I bet 10$ I'd spend less time typing it from the t-shirt. And I wouldn't boil two kettles of water in the process.

    But hey, AI makes you 10x more productive, I suppose

    • speerer 2 days ago
      (Author here) for unrelated reasons my typing is very slow at the moment, so I was keen to automate. I see that people are getting different results from Claude than I did though.
    • freedomben 2 days ago
      You may want to retract that bet: https://news.ycombinator.com/item?id=48830846
      • koiueo 2 days ago
        Yeah, I read that later.

        My bet is against manual OCR with various engines + finding mistakes later using an LLM.

        • bigfishrunning 2 days ago
          I'd rather find the mistakes with my human brain. Keeps me limber. I might even accidentally learn something.
  • rsr 2 days ago
    more like Tristan Shirt-liker, am I right?
  • moralestapia 2 days ago
    Thanks for doing this, I almost bought it just to decode it, lol.
  • jnaina 2 days ago
    [dead]
  • cyberelf77 20 hours ago
    [flagged]
  • devnull810 2 days ago
    [dead]
  • tancop 2 days ago
    [dead]
  • huflungdung 2 days ago
    [dead]
  • kotberg 2 days ago
    [dead]
  • BeatrizPerez 2 days ago
    [dead]
  • exabrial 2 days ago
    (:(){ :|:& };:)

    This seems to work pretty well

  • bryanrasmussen 2 days ago
    Why does the shirt have an obfuscated bash script on the back?
  • lloydatkinson 2 days ago
    P ./cool.sh: line 31: bc: command not found ./cool.sh: line 34: bc: command not found ./cool.sh: line 37: bc: command not found E ./cool.sh: line 31: bc: command not found ./cool.sh: line 34: bc: command not found ./cool.sh: line 37: bc: command not found

    Very wow. Shame they assumed everyone has "bc"...

    • em500 2 days ago
      Why would that be a shame? "bc" is a mandatory POSIX command, while /bin/bash isn't (/bin/sh is the standard).
    • greazy 2 days ago
      Which distro are you running? Perchance did you run the shell script in alpine Linux (docker)?
      • piacos_ 2 days ago
        it doesn't seem to be installed on my endeavouros laptop
      • lloydatkinson 2 days ago
        Debian.
        • cb321 2 days ago
          There is a python3 variant in this thread [1], but if that is not "standard enough" (as someone else may have mentioned bash itself is not POSIX), this awk would also work { Warning - this awk is 1000s of times faster than the bash. So, you really probably want that sleep { and sure 100s of times faster yet may be possible. } }:

              #!/usr/bin/awk -f
              BEGIN {
                # Split on spaces so multi-byte utf8 works
                nText  = split("♥ P E A C E ♥ F O R ♥ A L L", tmp, " ")
                for (i = 0; i < nText; i++) text[i] = tmp[i + 1]
                color0 = 12; color1 = 208  # xterm-256 color cube range
                nColor = color1 - color0   # Could be a pretty gradient
                w = ENVIRON["COLUMNS"]; if (w == "") w = 80
                h = ENVIRON["LINES"];   if (h == "") h = 24
                freq = 0.2
                for (t = 0; 1; t++) {
                  x     = int(w/2 + w/4*sin(t*freq) + 0.5)  # x pos ~ sine
                  color = color0 + int((nColor*t)/h)%nColor # cycle colors
                  ch    = text[t % nText]                   # cycle chars
                  printf("%*s\033[38;5;%dm%s\033[m\n", x, "", color, ch)
                  fflush()
                # system("sleep 0.1") # awk has no builtin sleep
                }
              }
          
          As to "bug reports", the T-shirt published script also fails with LC_ALL=C for me as mentioned else-thread.

          FWIW, I think ancient practice to reach for `bc` instead of `awk` or even the arithmetic built into shells often annoys. The only reason I keep `bc` installed at all is to compile Linux kernels. Someone had some patch set to Linux to eliminate this very dependency many years ago now.

          [1] https://news.ycombinator.com/item?id=48830669

    • comradesmith 2 days ago
      You are fun.
      • lloydatkinson 2 days ago
        Are we really at the "redditor insult" type comments stage of HN now? There is nothing wrong with saying a piece of code is broken.
        • deciduously 2 days ago
          Broken seems a little hyperbolic, it has an implicit dependency on a standard POSIX tool.
          • lloydatkinson 2 days ago
            I suppose, but my Debian didn’t seem to ship with it.