Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

121–130 of 257 posts

Re: Don't copy paste from a website to a terminal

#121

Post by redthrowaway »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

It would make for a good spearphishing attack. If you know the target's stack and can guess what sorts of issues they might run into, you can throw up a few pages detailing fixes for those issues. Give half-right answers on stack and link to your honeypot for "more in-depth discussion of the issue". Then sit back and wait for a dev to run your "fix" on one of their servers.

Re: Don't copy paste from a website to a terminal

#122

Post by mod »

condescendence wrote: post #118

Totally arbitrary. If you're simply copy and pasting commands you probably don't know what you're doing, OR you're just looking for the quick shortcut. Either way, when I paste I usually put it through a scrapped terminal. Meaning I have to hit enter twice for any command to actually be executed. If you're not checking your commands before you hit enter it's like getting in a car for the first time and bringing it to…

> when I paste I usually put it through a scrapped terminal

How does this work / how do you do it?

Re: Don't copy paste from a website to a terminal

#123

Post by hellbanner »

mixmastamyk wrote: post #115
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I found it really easy to turn off styles, to show the real code. In firefox the View Menu, Page Style, No Style. There are ways to assign this to a keypress or button as well.

Thank you, that is very helpful!

Re: Don't copy paste from a website to a terminal

#125

Post by noobermin »

derefr wrote: post #88
noobermin wrote: post #67

Earlier quoted context omitted.

Further from the main topic but related to your sentiment. One of the best ways to deal with this is to have more experienced guys who have faced these difficulties hanging around. I am a theorist in an experimental laser group, and the group head remarked on a possible counter-intuitive arcing between two separated plates (for the sake of making an electric field) when pumping out the air in a chamber. One would exp…

> physically counterintuitive Not entirely sure about that; my first intuition here was "temperature and pressure do pretty similar things to chromodynamic interactions—so if materials become more conductive [or even superconductive] at low temperature, then gas media probably become more conductive [or even superconductive] at low pressures, too."

(don't want to nitpick) Chromodynamic? As in QCD? We certainly are not probing anywhere near those regimes :) Also, conductivity is not the thing to think about, arcing has to do with dielectric breakdown. I guess my loosey-goosey explanation (less stuff to support current, as in less valence electrons to get stripped off to actually make a current from negative to positive plates) confused it a little.

Re: Don't copy paste from a website to a terminal

#126

Post by vectorjohn »

lqdc13 wrote: post #55
pyre wrote: post #50

Earlier quoted context omitted.

... so this: wget -qO- 'http://example.com/script.sh' | less won't work to review the script?

no but if you change the user agent of the wget to the same one the curl uses, it would be much harder to figure out the differences.

I think he's suggesting using wget both times, not curl. So it doesn't matter what the UA is.

As other have suggested, there are still possible ways to trick you, but it's getting more and more remote.

Re: Don't copy paste from a website to a terminal

#127

Post by hyperpape »

jonas21 wrote: post #120
ctdonath wrote: post #97

Earlier quoted context omitted.

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.

He failed the exam. I assume that "three strikes and you're out" means out of the school.

At the schools I went to, I don't think a single plagiarism incident would get a student kicked out. They would fail the assignment or the class.

Re: Don't copy paste from a website to a terminal

#128

Post by azdle »

jonas21 wrote: post #120
ctdonath wrote: post #97

Earlier quoted context omitted.

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.

Usually these policies work where the first strike is a zero on the assignment, the second strike is a F in the class, and the third strike is getting expelled from the school.

Re: Don't copy paste from a website to a terminal

#130

Post by jjuhl »

Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

If you don't know what it will do. Don't do it. Don't hide behind "I need this and this is how to install it". know what's going on or don't do it.
Post reply on HN