Don't Copy-Paste from Website to Terminal • Hacker News Board

Re: Don't Copy-Paste from Website to Terminal

#41

Post by jmesserly » Sun, Apr 07, 2013, 7:55 PM UTC

cmsj wrote: post #9

moonboots wrote: post #6

Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu…

Out of interest, what is confusing? If you select text it always goes into the selection buffer. If you also press the clipboard copy shortcut (so, Ctrl-C most of the time, sometimes Ctrl-Shift-C in a terminal) the selection is copied into the clipboard buffer. Ctrl-V (or, again, sometimes Ctrl-Shift-V in a terminal) pastes the clipboard buffer. Middle mouse button (or shift-Insert) pastes the selection buffer. Is th…

I think "confusing" in this context doesn't mean that the concepts are hard to enumerate or understand, it means they're hard to apply with low error rate in a practical setting.

I don't have a problem with X selection+paste if I'm just using Linux. But using it when connected to a remote machine via various remoting technologies (NX, Chrome Remote Desktop), and then mix in that the host machine is a Mac with its terrible command/control split, and the result is pretty confusing.

Re: Don't Copy-Paste from Website to Terminal

#42

Post by mobweb » Sun, Apr 07, 2013, 7:55 PM UTC

Wow, crazy, never really thought about this as an attack vector but it seems pretty obvious. I must confess that as a person who solves many problems by Googling I have directly pasted terminal commands from unknown websites countless times...

Re: Don't Copy-Paste from Website to Terminal

#43

Post by SG- » Sun, Apr 07, 2013, 7:58 PM UTC

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

Re: Don't Copy-Paste from Website to Terminal

#44

Post by cmsj » Sun, Apr 07, 2013, 7:59 PM UTC

Out of interest, does anyone know of a Mac utility which will intercept the default paste shortcut and pop up a confirmation of what is going to be pasted, with a really quick interface to the previous few items that were copied to the clipboard?

Re: Don't Copy-Paste from Website to Terminal

#45

Post by moonboots » Sun, Apr 07, 2013, 7:59 PM UTC

petepete wrote: post #36

moonboots wrote: post #28

Earlier quoted context omitted.

I use rxvt and never figured out how to paste the clipboard buffer, so I use shift-insert to paste the primary buffer. Unfortunately, the primary buffer can be overwritten without my consent, e.g. an autofocused web input field. Vim and emacs also have their own shortcuts for accessing the clipboard buffer.

You might find urxvt-perls useful, amongst the useful things it offers is clipboard interaction. https://github.com/muennich/urxvt-perls

Thanks for the link. I'll find a place for uxvrt-perls in my hacky copy-paste workflow. I'm currently using tmux paste buffers and shell functions around xclip to move around text.

Re: Don't Copy-Paste from Website to Terminal

#46

Post by h2s » Sun, Apr 07, 2013, 7:59 PM UTC

ams6110 wrote: post #11

hollerith wrote: post #4

One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.

Sadly this is not complete protection. Many Linux distributions configure sudo to prompt for the password only once every 15 minutes or so. If you have successfully executed sudo in your terminal within the last 15 minutes, any malicious code that you run can silently escalate its privileges to root just by starting with "sudo -i;".

You need to have the following in /etc/sudoers in order to be truly protected by not being logged-in as root:

    Defaults timestamp_timeout=0

Re: Don't Copy-Paste from Website to Terminal

#47

Post by gyepi » Sun, Apr 07, 2013, 7:59 PM UTC

gizmo686 wrote: post #35

comex wrote: post #31

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.

Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.

Re: Don't Copy-Paste from Website to Terminal

#48

Post by [deleted] » Sun, Apr 07, 2013, 8:00 PM UTC

icebraining wrote: post #15

hollerith wrote: post #4

One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

This uses only HTML and basic CSS (for positioning). There's absolute no "application-delivery" features being used here.

[deleted]

Re: Don't Copy-Paste from Website to Terminal

#49

Post by icebraining » Sun, Apr 07, 2013, 8:03 PM UTC

hollerith wrote: post #37

icebraining wrote: post #15

Earlier quoted context omitted.

This uses only HTML and basic CSS (for positioning). There's absolute no "application-delivery" features being used here.

Valid point. " Design -delivery platform", then. My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting. These ambitious goals include assisting app developers and assisting design professionals (design profes…

So, are you saying we shouldn't have text positioning? Because I'm pretty sure that's been a feature of documents since before Gutenberg.

I can understand your gripe, but I simply don't see how it applies here.

Re: Don't Copy-Paste from Website to Terminal

#50

Post by jiggy2011 » Sun, Apr 07, 2013, 8:03 PM UTC

SG- wrote: post #43

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

Problem is , as far as the browser knows you meant to copy the whole thing.

If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.