Highly recommend the entertaining talk Ben Huges from Esty gave at Operability.IO in London on "Security for non-unicorns" https://www.youtube.com/watch?v=B4ra9_KnMdk&list=PLK4VB0caul...
He talks about this as well
Don't copy paste from a website to a terminal
71–80 of 257 posts
Re: Don't copy paste from a website to a terminal
#72[deleted]
Re: Don't copy paste from a website to a terminal
#73Off-topic/meta: "Oh, and it seems that other people wrote a detailed text about this issue in 2008." Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years. My point here is that maybe it's time we started designing some curricula around t…
I made a very similar suggestion, perhaps less well articulated, just a few minutes ago on HN re: instragram v2 going to multi-DC;
When there is a write up of "We just did this super awesome scaling migration to the new hotness!" -- there will be mini-how-to articles in them... or at least more in-depth reasons why and for what problem they were specifically solving.
A how-to-wiki-gist? with "this is how you connect X with Y over ABC service in order to eliminate problem XYZ" would be great and allow for people to contribut to the how-to...
But we've been saying this for 15+ years... :-)
Re: Don't copy paste from a website to a terminal
#74You don't even need to be that crafty with CSS. Just a few lines of JS will do. Try copying the Hello World text in this fiddle and paste it in a text editor: http://jsfiddle.net/teleclimber/8q6sp5ga/ (Tested in Chrome)
I believe the point was to show it will work even on people with js disabled.
Re: Don't copy paste from a website to a terminal
#75I like the in the HTML
I always paste into Emacs notes first
Re: Don't copy paste from a website to a terminal
#76I never paste anything directly anywhere when copied from a webpage. I first paste it on Notepad to handle any formatting and hidden text. Once pasted on notepad, I copy/paste to the final destination.
Re: Don't copy paste from a website to a terminal
#77Guilty as charged. I LOL'ed when I pasted this in to notepad first.
Luckily I usually do the paste, but not for security reasons, to make sure formatting is as expected.
Now I have a reason to do that every time.
Thanks poster!
Re: Don't copy paste from a website to a terminal
#78Well, that is why I always paste stuff into a text editor first. git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git
Or just paste it in the address bar and copy it again (ctrl+l ctrl+v, then ctrl+a ctrl+c). This removes newlines, though.
Re: Don't copy paste from a website to a terminal
#79So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the street (where that old lady on the left of me could pull a knife and stab me any time they wanted) that you have to wonder if the downsides weigh up against the upsides of simply trusting the website you get the information from and getting on with your life (besides the fact that it is the browser acting in an un-expected way here, the bit selected does not mirror the visual feedback given to the user, this might even simply qualify as a bug).
What is the actual risk here, how many people have been bitten by this sort of thing and what was the resulting damage? I'm not saying there isn't any risk, clearly there is a possibility for exploitation here so chances are this is an actual risk. But I find it hard to make the case that we should all now start re-typing all the text in how-to's and scripts. It's one thing to run wget | curl, quite another to distrust each and every snippet of code on the web. I don't see much difference compared to say installing Ubuntu from a website whose contents I haven't inspected and that may have been built with a bunch of malicious stuff in it, I did not actually inspect all the source code this machine was built up with and I would be busy for half a lifetime if I did, so I outsourced the trust and verify that trust by looking at some checksum but that's about the extent of it.
Is there anybody that can quantify this risk somehow?
Has anybody been personally burned by this?
Re: Don't copy paste from a website to a terminal
#80Off-topic/meta: "Oh, and it seems that other people wrote a detailed text about this issue in 2008." Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years. My point here is that maybe it's time we started designing some curricula around t…
Further from the main topic but related to your sentiment. One of the best ways to deal with this is to have more experienced guys who have faced these difficulties hanging around. I am a theorist in an experimental laser group, and the group head remarked on a possible counter-intuitive arcing between two separated plates (for the sake of making an electric field) when pumping out the air in a chamber. One would exp…
The corona effect is a real surprise the first time you see it.