Earlier quoted context omitted.
Watch out. Does curl check the key chain against any key store? I bet not.
Actually it does. You turn off checking via -k
[deleted]
Don't Copy-Paste from Website to Terminal
101–110 of 272 posts
Re: Don't Copy-Paste from Website to Terminal
#102Earlier quoted context omitted.
Actually it does. You turn off checking via -k
Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.
Um, GNU wget does check the key, and it requires the lengthy `--no-check-certificate` to disable it.
Perhaps busybox wget doesn't check the key? But if you're using busybox, that's a whole other can of worms.
Re: Don't Copy-Paste from Website to Terminal
#103Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )
one of the recommended ways to install oh-my-zsh wget --no-check-certificate https://github.com/robbyrussell/oh-my-zsh/raw/master/tools/install.sh -O - | sh
Don't forget 'sudo'!
Re: Don't Copy-Paste from Website to Terminal
#104Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )
Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better:
sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash
Re: Don't Copy-Paste from Website to Terminal
#105Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu…
Ctrl-x e in zsh is '_expand_word'. The function you are talking about is 'edit-command-line', which is not loaded or bound to any key by default in zsh. You have to load it manually.
Re: Don't Copy-Paste from Website to Terminal
#106Out of interest, does anyone know of a Mac utility which will intercept the default paste shortcut and pop up a confirmation of what is going to be pasted, with a really quick interface to the previous few items that were copied to the clipboard?
Jumpcut is fairly close to what you're asking for. I guess you could map command + v to Jumpcut & override default paste functionality. Personally I prefer to use option + v.
Re: Don't Copy-Paste from Website to Terminal
#107Pasted result is: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git
You might want to mark the newlines in that command... without those, the attack would be pretty boring.
Re: Don't Copy-Paste from Website to Terminal
#108Earlier quoted context omitted.
I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…
Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "block JS by default" :D
It'd be funnier if you invoke 'sl' in their shell.
Re: Don't Copy-Paste from Website to Terminal
#109Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )
Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...
Know better... in order to do what? They also provide an APT repository, which you can choose to use instead of the curl command. The curl command exists solely for convenience, because it autodetects your OS, distro version, and automatically registers the right APT repository for you if you're on Debian.
As I've mentioned here (https://news.ycombinator.com/item?id=5508680), people often freak out at curl commands, yet at the same time I've yet to see a viable proposal for an alternative.
Re: Don't Copy-Paste from Website to Terminal
#110Earlier quoted context omitted.
Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…
OCR would work ;-)
Maybe... unless you figure out a trick to manipulate the OCR results with invisible, nearly-white gray areas in the image or so.