Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.
Don't Copy-Paste from Website to Terminal
31–40 of 272 posts
Re: Don't Copy-Paste from Website to Terminal
#32Re: Don't Copy-Paste from Website to Terminal
#33One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.
But there's the other side of the coin - usually making things more secure means making them less useful and less fun.
Re: Don't Copy-Paste from Website to Terminal
#34Re: Don't Copy-Paste from Website to Terminal
#35Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.
But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git"
I know what "git clone" does, and I do trust code from git.kernel.org.
Re: Don't Copy-Paste from Website to Terminal
#36Earlier quoted context omitted.
Out of interest, what is confusing? If you select text it always goes into the selection buffer. If you also press the clipboard copy shortcut (so, Ctrl-C most of the time, sometimes Ctrl-Shift-C in a terminal) the selection is copied into the clipboard buffer. Ctrl-V (or, again, sometimes Ctrl-Shift-V in a terminal) pastes the clipboard buffer. Middle mouse button (or shift-Insert) pastes the selection buffer. Is th…
I use rxvt and never figured out how to paste the clipboard buffer, so I use shift-insert to paste the primary buffer. Unfortunately, the primary buffer can be overwritten without my consent, e.g. an autofocused web input field. Vim and emacs also have their own shortcuts for accessing the clipboard buffer.
You might find urxvt-perls useful, amongst the useful things it offers is clipboard interaction.
Re: Don't Copy-Paste from Website to Terminal
#37One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.
This uses only HTML and basic CSS (for positioning). There's absolute no "application-delivery" features being used here.
Valid point. "Design-delivery platform", then.
My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting.
These ambitious goals include assisting app developers and assisting design professionals (design professionals on the internet intersecting very strongly with "professional persuaders" on the internet).
Note that I am not saying that these ambitious goals are worthless or nefarious, just that maintaining a smooth and reliable way to share static documents over the internet is important, too.
Re: Don't Copy-Paste from Website to Terminal
#38I usually put a # before anything I paste into a terminal. Mostly because I sometimes get a newline at the end, but it will disarm this behavior too. I'm not sure if it works in all situations though. Edit: Won't work! Use a heredoc (<<paste) or the editor method suggested above instead.
It won't work in this situation. Multiple commands here are separated by newlines (like pressing enter on your keyboard) and putting # will only comment out the first one.
Yep, you're right. This one had a " char on the second line that made me confused. A heredoc will still work though, I should start doing that instead :)
Re: Don't Copy-Paste from Website to Terminal
#39Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.
It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.
Re: Don't Copy-Paste from Website to Terminal
#40One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.
And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.
I always thought this concept to be silly unless you are a sysadmin.
For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.