Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly?
ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go)
Don't Copy-Paste from Website to Terminal
51–60 of 272 posts
Re: Don't Copy-Paste from Website to Terminal
#52[deleted]
Re: Don't Copy-Paste from Website to Terminal
#53Earlier quoted context omitted.
But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.
Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.
i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from.
if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.
Re: Don't Copy-Paste from Website to Terminal
#54Earlier quoted context omitted.
And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.
Sadly this is not complete protection. Many Linux distributions configure sudo to prompt for the password only once every 15 minutes or so. If you have successfully executed sudo in your terminal within the last 15 minutes, any malicious code that you run can silently escalate its privileges to root just by starting with "sudo -i;". You need to have the following in /etc/sudoers in order to be truly protected by not…
[deleted]
Re: Don't Copy-Paste from Website to Terminal
#55Yes, but not just that. It's also important to make an effort to understand what commands you are typing into your shell before typing them (Google them first if you don't know).
Re: Don't Copy-Paste from Website to Terminal
#56This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site…
Even if the shell had such protection, they could just do 'evil command && visible command'.
Re: Don't Copy-Paste from Website to Terminal
#57Earlier quoted context omitted.
This uses only HTML and basic CSS (for positioning). There's absolute no "application-delivery" features being used here.
Valid point. " Design -delivery platform", then. My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting. These ambitious goals include assisting app developers and assisting design professionals (design profes…
The reason that the web is popular is because it supports these features for design-delivery and application delivery.
You could probably implement an online text reading system with basic markup and hyperlinks over a weekend, but the problem would be that nobody would use it because it would be seen as strictly inferior to the web.
Re: Don't Copy-Paste from Website to Terminal
#58So the answer is to paste it into an editor first?
Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!!
Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.
Re: Don't Copy-Paste from Website to Terminal
#59Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )
C'mon... That is nothing like the industry standard -- you used SSL.
Re: Don't Copy-Paste from Website to Terminal
#60FWIW, I use shell mode in emacs most of the time and it happily accepts, and buffers, multiline commands until you hit enter, unlike the terminal.