Earlier quoted context omitted.
Actually it does. You turn off checking via -k
Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.
Touché!
Don't Copy-Paste from Website to Terminal
111–120 of 272 posts
Re: Don't Copy-Paste from Website to Terminal
#112This doesn't seem like such a big deal
You have one of two ways to combat this: 1) always copy things to notepad first so whatever it is that you copied you can verify is what you meant to copy
2) Use the inspection tool of your browser to copy it from source where things can't really be hidden.
I usually do #1 anyway because of weird formatting and characters
Re: Don't Copy-Paste from Website to Terminal
#113Earlier quoted context omitted.
Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…
OCR would work ;-)
So, I know that was a joke, but now I'm trying to figure out why it's a bad idea.
The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).
Re: Don't Copy-Paste from Website to Terminal
#114So the answer is to paste it into an editor first?
This is what I do with anything I'm copying or pasting from anything into anything else, mostly because of the obnoxious and ubiquitous "let's copy and paste formatting as well as text" that presumably came from some insane desire for ubiquitous rich text.
Re: Don't Copy-Paste from Website to Terminal
#115Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu…
Ctrl-x e in zsh is '_expand_word'. The function you are talking about is 'edit-command-line', which is not loaded or bound to any key by default in zsh. You have to load it manually.
Thanks, edited my post
Re: Don't Copy-Paste from Website to Terminal
#116This is another reason I always type a '#' before copy/pasting any long commands. The main reason is that I sometimes want to edit a long copied command and sometimes a newline get caught in my 'copy'. The '#' prevents it from accidentally executing.
Re: Don't Copy-Paste from Website to Terminal
#117Earlier quoted context omitted.
Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "block JS by default" :D
It'd be funnier if you invoke 'sl' in their shell.
Definitely, I didn't even know that command :D - but I had to `apt-get install sl` on my machine first. Maybe just do a telnet to a nonstandard port on my server and then send special characters to do the animation? That could work...
Re: Don't Copy-Paste from Website to Terminal
#118Earlier quoted context omitted.
Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...
Know better... in order to do what? They also provide an APT repository, which you can choose to use instead of the curl command. The curl command exists solely for convenience, because it autodetects your OS, distro version, and automatically registers the right APT repository for you if you're on Debian. As I've mentioned here ( https://news.ycombinator.com/item?id=5508680 ), people often freak out at curl commands…
Well, the downloaded bash script does all that, and a user is always free to leave the last piping-into-bash command off. They can review it first, and then run as sudo (or whoever) if it passes muster.
It's not that much different, so I don't understand the huge problem. Most likely if tutorial writers added a second step, the user would just copypasta the second step also.
Thankfully I followed this procedure after a co-worker sent me this: `curl -L http://bit.ly/10hA8iC | bash` ... was able to turn my speakers down first ;)
Re: Don't Copy-Paste from Website to Terminal
#119Earlier quoted context omitted.
It's the suggested install for homebrew. http://mxcl.github.io/homebrew/
There are legit criticisms against the copy-paste-curl-command style of installations. But on the other hand, I've yet to see a critic proposing a viable alternative. With viable I mean that said proposal must: 1. Work on all major platforms. 2. Be easy for the developer to create. 3. Be easy for the user to execute, with as few steps as possible. There are those who advocate that the developer should create a platfo…
The only difference between "wget | sh" and "download and run our installer" is that you could inspect the installer before running it. You can still do that, "wget | sh" just simplifies the process for most users.
Re: Don't Copy-Paste from Website to Terminal
#120Earlier quoted context omitted.
Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.
Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…
The best option I can think of, which is not ideal, is to flash a message of the total copied text. This of course won't be very useful if you're copying a large amount of text but this sort of attack seems to require appending to the beginning of the text which should be easy enough to catch.