Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

S/party/hack like it's 1999

openwall.com

Post reply on HN
Print view View original

11–20 of 33 posts

Re: S/party/hack like it's 1999

#14

Post by 0942v8653 »

ajkjk wrote: post #4
akkartik wrote: post #2

But it wouldn't fool any text editor, right? Or even less ?

Did you read the article? "'less' doesn't interpret escape sequences unless the -r switch is used, so stop aliasing it to 'less -r' just because there's no colored output."

For GNU less, you can use the -R option, which is like -r except that it only lets color escapes through, and not all escape sequences. So if you want to alias less to less -R that is much safer.

Re: S/party/hack like it's 1999

#15

Post by rohansingh »

FTA:

> Hint: > 'less' doesn't interpret escape sequences unless the -r switch is used, > so stop aliasing it to 'less -r' just because there's no colored output.

Instead you can just use `less -R` which allows colored output but doesn't interpret any other escape sequences.

Re: S/party/hack like it's 1999

#16

Post by Mahn »

> You might be thinking "If I opened that in my browser, I would detect it being malicious!" Well, think again... One can have all sorts of fun with user-agents, something that can easily come to mind is verifying if the user-agent is from curl or wget, and make them download the malicious file, if not, redirect them to a legitimate file that looks like the original output. Your browser would fool you then.

I can't decide whether this is evil, genius or disturbing. I don't typically copy paste curl commands, but it never occurred to me that even if you check the URL curl is pointing to with your browser that's no guarantee that the same script will be downloaded and parsed in the server.

Re: S/party/hack like it's 1999

#17

Post by jamiesonbecker »

Mahn wrote: post #16

> You might be thinking "If I opened that in my browser, I would detect it being malicious!" Well, think again... One can have all sorts of fun with user-agents, something that can easily come to mind is verifying if the user-agent is from curl or wget, and make them download the malicious file, if not, redirect them to a legitimate file that looks like the original output. Your browser would fool you then. I can't d…

Or you can just do it yourself if you don't trust the source (And if you don't, you should really ask yourself why you're engaging in this exercise at all anyway): download the file, review in vim (which will display esc sequences), and then execute that file with sh yourself.
Post reply on HN