11–20 of 257 posts
I don't get it... even if the pasted content has stuff I don't expect, I still see it in my shell prompt before I press Enter, no?
I did a "cat >/dev/null" before pasting so I could see what it was. Clever masked/hidden content, with embedded shell commands and newline to commit the commands.
A good terminal should show you the full pasted text in a confirmation popup before executing it. Also should never accept new lines from a paste. Or rather; if and when the paste contains new lines, it should show a confirmation popup so you know what the hell you're executing.
> That was a bad idea. Don't copy code from websites you don't trust!
Or indeed, download software from websites you don't trust.
I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file.
Bar the relative ease of hiding bad stuff in copy paste compared to making a fake dmg file, this seems to be basically the same situation no?
A good terminal should show you the full pasted text in a confirmation popup before executing it. Also should never accept new lines from a paste. Or rather; if and when the paste contains new lines, it should show a confirmation popup so you know what the hell you're executing.
P.S. I have a paranoid habit of pasting copied text into the address bar or a notepad to quickly check for unwanted characters. For once, I don't feel like I'm crazy.
If only operating systems offered a way to undo changes, then this would be mostly a non-issue.
if 'curl' in request.UA:
return 'something malicious'
else:
return 'something nice'