Don't Copy-Paste from Website to Terminal • Hacker News Board

Re: Don't Copy-Paste from Website to Terminal

#91

Post by FooBarWidget » Sun, Apr 07, 2013, 8:46 PM UTC

carb wrote: post #84

ivix wrote: post #78

Earlier quoted context omitted.

Why would you say that is industry practice when it is not?

It's the suggested install for homebrew. http://mxcl.github.io/homebrew/

There are legit criticisms against the copy-paste-curl-command style of installations. But on the other hand, I've yet to see a critic proposing a viable alternative. With viable I mean that said proposal must:

1. Work on all major platforms.

2. Be easy for the developer to create.

3. Be easy for the user to execute, with as few steps as possible.

There are those who advocate that the developer should create a platform-specific package for every platform. While this fits their purist views in which only their own platform matters, this is not a good solution for the developer, who often has users from multiple platforms. Creating platform-specific packages places an unbelievable maintenance burden on the developer.

This is not to mention that platform-specific packages, too, have their own security flaws.

Re: Don't Copy-Paste from Website to Terminal

#92

Post by robinson-wall » Sun, Apr 07, 2013, 8:48 PM UTC

spullara wrote: post #83

SG- wrote: post #43

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

There is a good use case for this. For example, if you copy a link from Twitter, you instead get the shortened URL so you're protected from malware when you click through: https://twitter.com/sampullara/status/320695597894098944

No, they're actually using this trick to do the exact opposite.

If you right click and say 'copy link' you'll get the t.co URL, but if you select the partially rendered URL and ^C you get the full (non-shortened) URL in your clipboard.

Re: Don't Copy-Paste from Website to Terminal

#93

Post by somesay » Sun, Apr 07, 2013, 8:49 PM UTC

lnguyen wrote: post #82

somesay wrote: post #81

Earlier quoted context omitted.

Watch out. Does curl check the key chain against any key store? I bet not.

Actually it does. You turn off checking via -k

Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.

Re: Don't Copy-Paste from Website to Terminal

#94

Post by TheJH_ » Sun, Apr 07, 2013, 8:50 PM UTC

ams6110 wrote: post #11

hollerith wrote: post #4

One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.

Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl | sh`, and that script would, for example, set aliases in your shell for `su` and `sudo` that call the real commands but log your password in the background. Unless you're using requiretty, of course, but I don't assume that you're using a real tty.

Re: Don't Copy-Paste from Website to Terminal

#95

Post by somesay » Sun, Apr 07, 2013, 8:52 PM UTC

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

You are trusting some third-party everytime you download a proprietary or just big open-source app. Even on Open Source, you just have trust in the public review.

In that example you can read the source before, the chances of an evil change just when loading it with your terminal is quite limited, MITM doesn't work that well on SSL, too.

Re: Don't Copy-Paste from Website to Terminal

#96

Post by TheJH_ » Sun, Apr 07, 2013, 8:53 PM UTC

cmsj wrote: post #14

raymondh wrote: post #7

Nicely done! Here's the underlying source: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "block JS by default" :D

Re: Don't Copy-Paste from Website to Terminal

#97

Post by TheJH_ » Sun, Apr 07, 2013, 8:54 PM UTC

joliss wrote: post #21

I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594 [1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash.…

That sounds like a really good approach.

Re: Don't Copy-Paste from Website to Terminal

#98

Post by deno » Sun, Apr 07, 2013, 8:55 PM UTC

jneen wrote: post #89

I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.

Matches against what? If the website is compromised the checksum can be compromised as well.

If the tarball is not pgp signed by the author (e.g. Bazaar and Tor Project do that), checking the checksum is basically checking if the server you’re downloading from didn’t have any silent data corruption (see recent KDE hosting incident), because in transit TCP does its own checksumming anyway.

Re: Don't Copy-Paste from Website to Terminal

#99

Post by TheJH_ » Sun, Apr 07, 2013, 8:56 PM UTC

Tyr42 wrote: post #63

Actually, since I tried to copy it by triple clicking, which selects one line (at least, I expect it to. It's what sublime text does). That didn't copy any of the malicious text, and it just stopped between the clone and the url.

I feared someone would do that. :D Well, it'd be easy to work around this if you have JS enabled... without it, it would probably not be so easy to trick you into copying multiple lines.

Re: Don't Copy-Paste from Website to Terminal

#100

Post by lukeschlather » Sun, Apr 07, 2013, 8:56 PM UTC

somesay wrote: post #93

lnguyen wrote: post #82

Earlier quoted context omitted.

Actually it does. You turn off checking via -k

Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.

Wget has the --no-check-certificate flag, I've had to use it to work with self-signed certs before.