Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

201–210 of 257 posts

Re: Don't copy paste from a website to a terminal

#201

Post by zobzu »

ctdonath wrote: post #97
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

trust but verify ;-)

Re: Don't copy paste from a website to a terminal

#202

Post by yiyus »

dedward wrote: post #87
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Paste into a text buffer first, which is generally a good idea anyway to deal with formatting issues.

I do not do that. I have copied and pasted git clone commands directly in my terminals many times. The questions is, for those who do it, how often you notice a malicious command and this saves your day.

Re: Don't copy paste from a website to a terminal

#204

Post by psyonix »

orionblastar wrote: post #96

I found out the hard way that a lot of websites on Linux are either out of date or give instructions that can ruin your system. In trying to solve a black screen with Mint 17.2 I followed directions on adding a PPA to install Nvidia drivers and then remove the open source drivers. When I rebooted I still got the black screen and in recovery mode I could not log in because it said an ACL for a card was missing a file.…

I ran into a similar issue with a black screen in Ubuntu, seemingly a result of driver issues too. It turns out the normal installation wasn't partitioning enough space for it to run in (I installed it alongside Windows 7). I had to manually partition the disk to give it ample room. Once I did that, everything ran just fine. Along the way I encountered a lot of advice similar to what you did, and it set me back several hours before I realized what the actual cause was.

Re: Don't copy paste from a website to a terminal

#205

Post by euske »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I think the message is mostly directed at developers. It's worth noting that a developer's PC is often a very good target. It carries a lot of power, i.e. source codes, host names and private keys, etc. So even the number is small, a targeted attack might have a big impact. And a targeted attack is much, much more difficult to quantify or even study.

Re: Don't copy paste from a website to a terminal

#206

Post by nickpsecurity »

I decided an alternative route: copied the text and pasted it into a text editor first. Shows the attack. So, I think the lesson is to do two things:

1. Copy in a harmless way first to be sure WYSIWYG.

2. Compare the commands against the man page or local docs to make sure they look right.

This is the method I created after someone posted this in response to me using an online cheat sheet for console app. I appreciated that person bringing it to my attention. However, this should knock out most risk in that area.

Other objections were essentially about how one shouldn't use commands from sources they couldn't totally trust. That's a BS double standard easily countered by, "Oh and I guess you don't run any code/binary you get from proprietary vendors or FOSS repositories unless you inspect every line to be sure it's safe?" Hell will both be empirically proven to exist and freeze over before those people's preaching and practices are consistent.

Re: Don't copy paste from a website to a terminal

#207

Post by borkabrak »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Good point. It is important to realize that being too obsessive about security is possible, and to know a reasonable point at which to draw the line.

But there is a difference between the two types of attack you describe that seems to change the rules on the web at least somewhat.

The difference is risk to the attacker. If I start punching someone on the bus, getting thrown off is the optimistic outcome. I could reasonably expect to be arrested, or assaulted in return, possibly fatally.

But if I post malware on the web, the worst I could reasonably expect is that the offending content is taken down, my account with that host rescinded, and assuming I do nothing to conceal my identity, I may become known as the type of scumbag who does such things. I grant that much worse results are possible, but it just doesn't seem realistic to expect much worse punishment, so long as a government or large corporation wasn't a serious victim.

Or so it seems to me. Thoughts?

Re: Don't copy paste from a website to a terminal

#208

Post by scott_s »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I agree; it comes down to trusting your source. I trust, say, github and bitbucket, and will gladly copy-paste their commands into my terminal. I'm already trusting them with much more.

Re: Don't copy paste from a website to a terminal

#209

Post by Retra »

collyw wrote: post #158
vidarh wrote: post #145

Earlier quoted context omitted.

And I thought it was ridiculous when someone had cut and pasted a page from an Oracle manual in response to a set of pre-screening questions for a hiring round, headers included (for a generic SQL question we expected a one sentence answer to). At least that guy didn't pay for it - to my knowledge at least (he did cut and paste most of his answers from various places, though, and got many of them wrong, including an…

Isn't the first place you would go to the Oracle manual? I use stack overflow all the time these days (documentation pages before that existed), not quite cutting and pasting but close enough.

The thing is, if you came to me and said "I know everything in this book", I'd say "so let's save money and buy the book instead of hiring you."

Interview questions are an opportunity for you to show what you are worth. If you're worth less than a book, it's not a good sign.

Re: Don't copy paste from a website to a terminal

#210

Post by will_pseudonym »

burke wrote: post #198
hyperpape wrote: post #127

Earlier quoted context omitted.

He failed the exam. I assume that "three strikes and you're out" means out of the school. At the schools I went to, I don't think a single plagiarism incident would get a student kicked out. They would fail the assignment or the class.

At my school, it was made very explicit that you'd be immediately expelled for plagiarism (subject to appeal, IIRC, but yes: One strike.)

As it should be. The whole system is underpinned by the assumption that no one can cheat. Everyone knows tons of people cheat, but any university who has a "n-strike" policy for academic dishonesty (aka fraud), is purely in it for the money. To students who busted their asses to graduate legitimately, it's a hard slap in the face.
Post reply on HN