Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

151–160 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#151

Post by SoftwareMaven »

networked wrote: post #139

Perhaps the real problem here is that, as noted by Ted Nelson back when the concept started to gain popularity, "[the computer clipboard is] just like a regular clipboard, except (a) you can't see it, (b) it holds only one object, (c) whatever you put there destroys the previous contents." The presented vulnerability hinges on (a), and, Glipper [1] notwithstanding, (a)-(c) is still the default behavior in every GUI I…

Because of b and c, I would go nuts trying to use a text editor that didn't support an emacs-like "clipboard"[1] ring. I'm constantly dumping stuff in and pulling it out in arbitrary order. It is nice to have a solution to a in the process, too.

1. Yes, I know it is a kill ring in emacs.

Re: Don't Copy-Paste from Website to Terminal

#153

Post by duskwuff »

wulczer wrote: post #143
charlieok wrote: post #130

Earlier quoted context omitted.

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

Check out http://www.gnu.org/software/stow/

Homebrew (http://mxcl.github.io/homebrew/) does largely the same thing for third-party source installs on Mac OS X.

Re: Don't Copy-Paste from Website to Terminal

#154

Post by laumars »

mscarborough wrote: post #118
FooBarWidget wrote: post #109

Earlier quoted context omitted.

Know better... in order to do what? They also provide an APT repository, which you can choose to use instead of the curl command. The curl command exists solely for convenience, because it autodetects your OS, distro version, and automatically registers the right APT repository for you if you're on Debian. As I've mentioned here ( https://news.ycombinator.com/item?id=5508680 ), people often freak out at curl commands…

Well, the downloaded bash script does all that, and a user is always free to leave the last piping-into-bash command off. They can review it first, and then run as sudo (or whoever) if it passes muster. It's not that much different, so I don't understand the huge problem. Most likely if tutorial writers added a second step, the user would just copypasta the second step also. Thankfully I followed this procedure after…

That's one of the better rickrolling I've seen!

One of my mates rickrolled me by post (aka snail mail) just days after I moved house. It took me 2 years to find out who was behind that.

Re: Don't Copy-Paste from Website to Terminal

#155

Post by rits »

charlieok wrote: post #130
NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

You can't just enable/disable software if it depends on other software or vice versa. But your package manager may have facilities for that, like Nix [ http://nixos.org/ ].

Re: Don't Copy-Paste from Website to Terminal

#156

Post by vishnumenon »

I was just thinking it might be cool to have a service that site owners could include via JS that would ensure that the content in a div is the content seen by the user. It could have a little stamp that says "Verified by SuchAndSuch" in the corner of the div. Should I try to make this? Any obvious issues? Is it worth it?

Re: Don't Copy-Paste from Website to Terminal

#157

Post by fnordfnordfnord »

TheJH_ wrote: post #117
fnordfnordfnord wrote: post #108

Earlier quoted context omitted.

It'd be funnier if you invoke 'sl' in their shell.

Definitely, I didn't even know that command :D - but I had to `apt-get install sl` on my machine first. Maybe just do a telnet to a nonstandard port on my server and then send special characters to do the animation? That could work...

Yeah, I didn't consider the fact that not everyone has sl on their machine.

Re: Don't Copy-Paste from Website to Terminal

#158

Post by johnbm »

cmsj wrote: post #14
raymondh wrote: post #7

Nicely done! Here's the underlying source: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

There is a way to fix it: don't select text in document order, but only in visual order. Apple does something like this in their PDF reader. This would probably break things people do today, and there would be whining.

Re: Don't Copy-Paste from Website to Terminal

#160

Post by NelsonMinar »

charlieok wrote: post #130
NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

To be fair to Homebrew (the example I'm picking on here), it does install to a nice sandboxed area. That area is named "/usr/local", but you can give it its own path and everything works pretty well. (I find I have to completely remove and reinstall Homebrew about every two months, generally because libgettext changed yet again.)
Post reply on HN