Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading Ubuntu Forum's warning about malicious commands and found this interesting gem:

:(){ :|:& };:

WARNING: The above code will crash your machine unless you have strict proc limits in place (which you probably don't) prompting a hard restart.

Consider this code similar to running sudo rm -rf /.

But what does that mean? Even with my programming experience I've never seen a command that cryptic that's not assembly language.

share|improve this question
An additional point: this is really in no way similar to sudo rm -rf /. That command deletes all your files; this one just clogs your machine's resources until it becomes unusable and you have to restart. – jtbandes Jul 23 '10 at 4:56
@jtban: Then edit it out. Both pieces of code are what I would consider "dangerous" to run. Yes sudo rm -rf / is more dangerous but I've seen people execute this on remote servers "just wanted to see what it did" where you have a hard time restarting without access to a control panel. – Josh K Jul 23 '10 at 17:03
its an emotibomb :P – RCIX Jul 26 '10 at 2:32
up vote 35 down vote accepted

It's, as you said, a forkbomb. What it does is define a function, then call it. The function is called :.

Let's name it forkbomb so we can better see what's going on:

forkbomb(){ forkbomb|forkbomb& };forkbomb

As you can see, and probably guess from your programming experience, the first part is the function definition (forkbomb(){ ... }), and the very last : is where the function gets called (the ; just separates statements in Bash).

Now, what does this function do? If you're familiar with Bash, you'll know that the | character pipes the standard output of one command/program to the standard input of another. So basically, :|: starts up two instances of the function (this is where it "forks").

And then the magic: the & puts those commands in the background, allowing the original function to return, while each instance forks 'til the cows come home in the background, thus using up all your resources and taking down the system (unless it has limits imposed on it).

share|improve this answer
Great answer! I didn't realize you could use : as a function name. The rename helps. Will accept in 3 minutes . – TheLQ Jul 23 '10 at 4:48
+1 Cool... Great explanation. This is like a stack overflow for an the OS taskswitcher. Does it actually crash the kernel or does it just eat up resources until it just becomes too unbearable to use? – Evan Plaice Jul 23 '10 at 6:24
I don't think it actually crashes the kernel, at least not directly. It just keeps creating exponentially more processes, each of which take up CPU & memory, and with the processor trying to handle all of them it really becomes impossible to use. It might be that the kernel eventually crashes under the load (I'm not sure), but it'll be unusable before then. – jtbandes Jul 23 '10 at 14:17
Don't forget to explain the final :, which actually executes the function! – Phoshi Jul 23 '10 at 16:59
@Phoshi: thought I did, but I'll edit to clarify! – jtbandes Jul 23 '10 at 18:29

Taken from the Wikipedia article Forkbomb:

:()      # define ':' -- whenever we say ':', do this:
{        # beginning of what to do when we say ':'
    :    # load another copy of the ':' function into memory...
    |    # ...and pipe its output to...
    :    # ...another copy of ':' function, which has to be loaded into memory
         # (therefore, ':|:' simply gets two copies of ':' loaded whenever ':' is called)
    &    # disown the functions -- if the first ':' is killed,
         #     all of the functions that it has started should NOT be auto-killed
}        # end of what to do when we say ':'
;        # Having defined ':', we should now...
:        # ':', initiating a chain-reaction: each ':' will start two more.
share|improve this answer

Broken down:

: () // Define ':' as a function. When you type ':' do the following
    : // Call ':' 
    | // Redirect output
    : // Into ':'
    & // Push process to the background
}; // End of ':' def
: // Now do ':'

Change : to bomb and you have:

bomb(){ bomb|bomb& };bomb

It's really quite elegant.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .