For those trying to find it...the added code is injected in the space character between "git clone" and "git://git.kernel.org/pub/scm/utils/kup/kup.git"
Don't copy paste from a website to a terminal
61–70 of 257 posts
Re: Don't copy paste from a website to a terminal
#62Aside: its not sufficient to look at a file you 'curl | bash' into bash via your browser. It is very trivial to detect curl/wget's UA (mine has: "User-Agent": "curl/7.43.0") and dynamically modify files depending on the request's UI. if 'curl' in request.UA: return 'something malicious' else: return 'something nice' Always create a local file with the content, read it, then perhaps run it.
And remember to use cat -v if you read it with cat.
https://ma.ttias.be/terminal-escape-sequences-the-new-xss-fo...
Re: Don't copy paste from a website to a terminal
#63Earlier quoted context omitted.
None of those commands are so long that you shouldn't just be retyping them by hand. It's obviously not an ideal way to install anything, but it's much safer than copy and pasting.
or copy them to a text editor first?
Is that safe? (Legitimate question)
Re: Don't copy paste from a website to a terminal
#64Reminds me of a time a few years back when many vigorously defended a similar process with sublime text:
https://news.ycombinator.com/item?id=4247566
TL:DR "Just paste this obscure python code into the console!"
I'm still surprised, looking back at that thread today.
Re: Don't copy paste from a website to a terminal
#65Sadly I am guilty of doing this.
It boils down to trust. I trust that Mint won't screw up securing my bank credentials. I also trust that OSX HomeBrew's install instructions aren't fubar.
Re: Don't copy paste from a website to a terminal
#66Aside: its not sufficient to look at a file you 'curl | bash' into bash via your browser. It is very trivial to detect curl/wget's UA (mine has: "User-Agent": "curl/7.43.0") and dynamically modify files depending on the request's UI. if 'curl' in request.UA: return 'something malicious' else: return 'something nice' Always create a local file with the content, read it, then perhaps run it.
I use
curl example.org | vipe | bash -
Re: Don't copy paste from a website to a terminal
#67Off-topic/meta: "Oh, and it seems that other people wrote a detailed text about this issue in 2008." Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years. My point here is that maybe it's time we started designing some curricula around t…
Further from the main topic but related to your sentiment. One of the best ways to deal with this is to have more experienced guys who have faced these difficulties hanging around.
I am a theorist in an experimental laser group, and the group head remarked on a possible counter-intuitive arcing between two separated plates (for the sake of making an electric field) when pumping out the air in a chamber. One would expect that pumping out the air reduces the "stuff" (air) that could support a current between the plates, but due to other physics (longer mean-free path) actually allows a sweet point in which the plates can arc, possibly ruining equipment like power supplies. No one thinks about this until it happens because it's physically counter-intuitive, and its too late...it really is one of those "never happens until it happens" sort of unexpected catastrophes that even if you read it in a book, you'd probably never remember it. He said this is why it's important to have newer grad students work with senior graduate to provide continuity and experience so these mistakes don't reoccur...that, I suppose, the horrific memory of destroying expensive power supplies helps the senior grads remember it better compared to someone reading a list of warning labels in a manual...
I'm assuming if you're a small start-up, you don't have more experienced people unless you hire them. So yeah, something like the C++-faq for general hacking suggestions is fun, if someone reads it.
Re: Don't copy paste from a website to a terminal
#68Should I consider my browser betraying me by selecting stuff that's outside the viewport without a hint / warning ? (absolute positioned element, (-100,-100)). It's simply too convenient to copy/paste from the browser. P.S. I have a paranoid habit of pasting copied text into the address bar or a notepad to quickly check for unwanted characters. For once, I don't feel like I'm crazy.
Start programming editors and you will understand. What you see in a rich text editor contains hundreds of debugging flags and formatting tweaks. When copying, you want to copy something clean which will paste nicely in Word or Excel. And you want to add some metadata, so you can trace is source if it's pasted back in one of your editors.
Re: Don't copy paste from a website to a terminal
#69Well, that is why I always paste stuff into a text editor first.
git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git
Re: Don't copy paste from a website to a terminal
#70Earlier quoted context omitted.
no but if you change the user agent of the wget to the same one the curl uses, it would be much harder to figure out the differences.
I'm pretty sure wget still makes it's http requests as version 1.0 rather than 1.1 (which nearly everything else uses), and if you want to change that you need to patch it.
of course. There are also other differences. Actually, I have no idea why it even matters unless you are specifically exploiting curl. And they are not in this case. You can redirect wget output to stdout too...