Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

91–100 of 257 posts

Re: Don't copy paste from a website to a terminal

#91

Post by terminado »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

It's the same level of risk experienced, when dealing with the types of individuals who invariably always download and execute unsafe email attachments, click malicious links in emails, respond to chain letters, business solicitations from Nigerian princes, and so on, and so on, and so on...

Re: Don't copy paste from a website to a terminal

#93

Post by headwayoldest »

haswell wrote: post #90
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

This is a great point, and something I often wonder about as well. I think it's reasonable to think that only a compromised site or site run by someone with ill-intent would pose any real risk. And in such a scenario, it's going to get out pretty quickly that the site is compromised/dangerous. While this doesn't help that theoretical set of initial victims, it just doesn't feel like a credible risk worthy of too much…

Little Snitch serves this purpose to some extent on OS X. If the malicious hidden script invoked a remote server I'd get a popup asking if I would like to allow it.

Re: Don't copy paste from a website to a terminal

#94

Post by e12e »

wyldfire wrote: post #42
jnbiche wrote: post #33

Earlier quoted context omitted.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

No, I just put my terminal into a mode where I could see what I pasted without any possibility executing it. If you don't give cat any arguments, it reads from stdin and writes to stdout. I could have just as easily opened vim/emacs/notepad and done the same, or for that matter, written the contents to an actual file instead of redirecting the contents to /dev/null.

But you could still paste ^d (End-of-file)? Granted, if you paste ^d in the terminal, you'd exit, but one could do this?:

  dangerous-commands \n
  ^d #eof
  dangerous-commmands \n #repeat
(I'm not actually sure if you can paste ^d in general... but I expect you could?)

Re: Don't copy paste from a website to a terminal

#95

Post by geerlingguy »

Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

Luckily both can be installed almost as easily without the curl pipe hack... Not sure why so many projects want to reduce install steps from three to one with a shell script. I could understand if you have 90 steps (in which case I would recommend you figure out a better install process in general), but not for simple 'download something, move it to a path, run a command, and you're done'. See my roles for both of the packages you mentioned above on Ansible Galaxy for more info; I tend to avoid doing the curl pipes for sanity even more so than security.

I want to know what I'm doing with my server when I'm installing packages or other software!

Re: Don't copy paste from a website to a terminal

#96

Post by orionblastar »

I found out the hard way that a lot of websites on Linux are either out of date or give instructions that can ruin your system.

In trying to solve a black screen with Mint 17.2 I followed directions on adding a PPA to install Nvidia drivers and then remove the open source drivers. When I rebooted I still got the black screen and in recovery mode I could not log in because it said an ACL for a card was missing a file.

When I went to reinstall Mint it didn't want to overwrite the partition and wanted to create a new one alongside it. Forcing me to delete the Linux partition and start all over again.

A lot of websites just give wrong advice and if you aren't an advanced user who knows how to fix things when they break, you could be stuck with an unusable system.

Re: Don't copy paste from a website to a terminal

#97

Post by ctdonath »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted":

I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probably wouldn't really help you anyway).

Grading one student's submission, the wording of most of the "essay" questions seemed ... odd. Nothing objectively wrong, but everyone has their own writing style and his answers weren't, well, his. Scrolling thru one particular answer there were some blank lines after the answer ... and then a URL. The URL contained much of the test question. Checking the unfamiliar site, it was a paid technical-question-answering service, base price for answers $30 and rising depending on depth, quality & speed of answer. Copying-and-pasting the purchased answers added the source URL to the selected text, proving malicious plagiarism on the final exam. I figure he spent at least $300 to fail that exam and get one strike per the school's "three strikes and you're out" policy.

Re: Don't copy paste from a website to a terminal

#98

Post by kedean »

javajosh wrote: post #81
kedean wrote: post #34

Earlier quoted context omitted.

Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great at…

I'm not so sure we're really capable of distinguishing between "random executable" and everything else. What do you have to go on in making the distinction? Let's say you're installing a new version of Sublime, or curl, or Chrome. These aren't 'random executables' - or are they? If someone poisons DNS, they could be. If someone MITMs them, they could be. What about stack overflow? Surely they are trustworthy. But if…

Of course there's always going to be attack vectors, but clearly it's safer to execute a known program (Firefox) from a trusted website (firefox.com) than it is to use an unknown program (Jons Legit Calculator App) from an unknown website (some bit.ly link). Sure there's still attack vectors at play, but you've mitigated the easy ones. This is the same thing. Everyone needs to know not to go copying terminal commands unless they really trust the source. Obviously there's still a security issue there, but its significantly lower, and that's really all we can aim for.

Re: Don't copy paste from a website to a terminal

#99

Post by drzaiusapelord »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Except its very uncommon to be poisoned or stabbed and very common for IT systems to be hacked, because there's a pretty big incentive to do so (setup a spamming farm, steal data, enlarge a botnet, script kiddie cred, etc).

>Has anybody been personally burned by this?

I imagine a lot of devs who follow bad practices cause a lot of havok, but its up to the security and sysadmin team to clean up after them. They may not be fully aware of all their bad practices and a refrain of "Let us be bad, it hasn't caused any problems yet," is short-sighted.

>say installing Ubuntu from a website

At the very least you have a SSL identified site and published checksum hashes on a separate server. That's a far cry from a random shell script. Installing an OS is a special case anyway, so its not really a good comparison here.

edit: typos

Post reply on HN