Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

211–220 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#211

Post by limmeau »

Aramgutang wrote: post #194
cmsj wrote: post #14

Earlier quoted context omitted.

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

If you're using Firefox, you can prevent this kind of behaviour by going into about:config, and setting the dom.event.clipboardevents.enabled flag to false.

Would that look at the screen layout to remove a span that is positioned too far to the left? Or just disable JS control over copy-paste, which doesn't solve this problem?

Re: Don't Copy-Paste from Website to Terminal

#212

Post by Lerc »

gmaslov wrote: post #72
crazygringo wrote: post #65

Earlier quoted context omitted.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…

OCR would work ;-)

Yeah, That's a feature I'd like to have back again.

http://amiga-fish.erkan.se/amiga-fish-disk-968-content-Power...

Re: Don't Copy-Paste from Website to Terminal

#213

Post by gbog »

eli wrote: post #20
cmsj wrote: post #14

Earlier quoted context omitted.

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

That's a pretty narrow view. Sometimes I want a site to capture selections or right-click (think: WYSIWYG editor widget). Your beef is with the site owners who put that obnoxious stuff on their site, not with the browser that displays it. There is no limit to the number of ways a site owner can do dumb and annoying things to their readers.

> capture selections or right-click (think: WYSIWYG editor widget)

Why, no, not the same.

I think it is ok for a webapp to be aware that I selected some text, and which text, so a further click on "boldface" would have a context.

But it is not ok for a webapp to interfere with the text selection itself.

For instance, well-intentionned chrome always add "http:// when I select the url. It gets in my way very often and it is not what I intended: I did select google.com with my mouse very carefully, I do not want Chrome to be clever and add "http://. By the way, this issues comes from the excessively minimal UI: Chrome should not hide "http:// in the url bar, point-barre.

I do not use Evernote because it messes with my selections.

I have to use Trello at work but this bully don't even let me select a card title.

And the list goes...

Re: Don't Copy-Paste from Website to Terminal

#214

Post by webreac »

FooBarWidget wrote: post #91
carb wrote: post #84

Earlier quoted context omitted.

It's the suggested install for homebrew. http://mxcl.github.io/homebrew/

There are legit criticisms against the copy-paste-curl-command style of installations. But on the other hand, I've yet to see a critic proposing a viable alternative. With viable I mean that said proposal must: 1. Work on all major platforms. 2. Be easy for the developer to create. 3. Be easy for the user to execute, with as few steps as possible. There are those who advocate that the developer should create a platfo…

I like very much the "copy-paste-curl-command style of installations" because it is as simple as possible, and it invites to be more creative during installation. I do not envisage to perform a copy-paste-curl-command installation, except perhaps in a not throw away VM. I generally perform the curl toward a temporary file, read the file and if it does look suspicious, I do not run it.

Re: Don't Copy-Paste from Website to Terminal

#215

Post by psionski »

desas wrote: post #80
crazygringo wrote: post #65

Earlier quoted context omitted.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…

It strikes that Google probably has some algorithms to detect this. Otherwise black hat SEOers would use this trick to stuff keywords or something.

AFAIK Google fails to penalize you if there is any difference between your background and foreground colors, even if it's 1 unit (e.g. bg #000000 fg #010101). There's always a way around these things :)

Re: Don't Copy-Paste from Website to Terminal

#216

Post by laumars »

nitrogen wrote: post #187
laumars wrote: post #148

Earlier quoted context omitted.

That's just bad administration as even on Windows, you can easily disable them ( msconfig ). With Linux, this isn't even an issue unless you're blindly installing dozens of daemons (which, again, can easily be disabled) as Linux doesn't have hundreds of application launchers that install themselves like Windows does (again, daemons being the exception). The only example I can think of where you might run into problem…

This may have been true 5-10 years ago, but modern desktops are removing the ability to manage services, sessions, and startup apps easily and clearly.

Unless they're blocking access to [insert your favourite terminal emulator] and deinstalling su, rm and unlink, then they are not removing any such ability.

Re: Don't Copy-Paste from Website to Terminal

#217

Post by halfasleep »

0xbadcafebee wrote: post #129
LukeShu wrote: post #102

Earlier quoted context omitted.

Um, GNU wget does check the key, and it requires the lengthy `--no-check-certificate` to disable it. Perhaps busybox wget doesn't check the key? But if you're using busybox, that's a whole other can of worms.

Wget does not validate certificates by default because there's no CA bundle provided with wget. It does check for /etc/ssl/cert.pem, but it doesn't provide one. So you have to provide one or set up /etc/ssl/certs/ as OpenSSL libraries expect. Curl does provide a CA bundle (/usr/share/curl/ca-bundle.crt) and by default libcurl validates certs against it.

cURL doesn't provide a CA bundle any more [1], it's the job of your OS to provide this. As I understand it, all tools that provide SSL support will fail safe if there are no root CAs on your system. [1] http://curl.haxx.se/docs/sslcerts.html

Re: Don't Copy-Paste from Website to Terminal

#218

Post by laumars »

fein wrote: post #199
dredmorbius wrote: post #196

Earlier quoted context omitted.

> With Linux, this isn't even an issue That's a problem systemd is trying very hard to solve. /sarcasm SysV init may be old, crufty, and inelegant, but it's reasonably straightforward to parse and troubleshoot manually (and BSD-style rc inits are even more straightforward). Making the bootstrap process nondeterministic strikes me as tremendously unwise.

I agree here. I really enjoyed the explicit control granted by sysV. The switch to systemd just seems like fixing something that isn't broken. I will probably be proved wrong as systemd matures, but right now it's just not the case.

100% both those comments.

I used to be a huge ArchLinux fan but them switching away from their rc.conf model to systemd felt like a real kick in the teeth.

Re: Don't Copy-Paste from Website to Terminal

#219

Post by cmsj »

NelsonMinar wrote: post #190
csense wrote: post #185

Earlier quoted context omitted.

That's not a sandbox. If you have ten programs installed in /usr/local, and you want to uninstall one of them, rm -Rf /usr/local is not the tool for the job. (At least on Linux. I'm assuming UNIX-like Macs are the same.)

Like I said, Homebrew installs in its own directory pretty well. I chose /usr/homebrew, explicitly so I can rm -rf. I think for most Homebrew users their Macs have nothing else in /usr/local and so that's why it's not an unreasonable default.

Changing the prefix still doesn't mean that each app is sandboxed. That is what the parent comment was talking about.

You can't do rm -rf /usr/homebrew/$SOMEAPP/ and know that it is all gone.

Re: Don't Copy-Paste from Website to Terminal

#220

Post by cmsj »

trotsky wrote: post #141
nicksergeant wrote: post #138

Earlier quoted context omitted.

It's not that you don't trust opscode, it's that it's possible that someone could hack opscode's installer script...

just like they could replace a binary, backdoor the Makefile or hide something bad deep in the repo. And of course their hash of their signing key for their apt repo and any shasums are provided on the same webserver.

Of course that is always a risk, but with most FOSS software being maintained in public revision control systems, it's difficult to truly hide something.

Even if you discard the security angle of wget | bash (which you would be a foolish choice) there is the simple problem of repeatability.

If you are deploying 50 new servers and OpsCode releases a new version of Chef after 25 of the servers have performed the wget, the next 25 will get a different client that might be incompatible with the server.

Post reply on HN