Is it me or the issue isn't copy-pasting here? The problem is downloading and running a piece of code you haven't looked at. I don't know if git is supposed to work this way but it sure looks dangerous.
Don't copy paste from a website to a terminal
101–110 of 257 posts
Re: Don't copy paste from a website to a terminal
#102Off-topic/meta: "Oh, and it seems that other people wrote a detailed text about this issue in 2008." Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years. My point here is that maybe it's time we started designing some curricula around t…
> always doing things in a root shell
Ah yes. The sudo high horse. I knew I'd see you again.
Viva La #
Re: Don't copy paste from a website to a terminal
#103While by no means a be-all and end-all fix - here is a simple add on for Firefox in which you can set the default copy method to plain text: https://addons.mozilla.org/en-us/firefox/addon/copy-as-plain...
Re: Don't copy paste from a website to a terminal
#104So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…
> Has anybody been personally burned by this?
People get burned by this sort of thing all the time, malicious downloads were hip when Clinton was in the White House. Yes, only on Windows, and yes, easy to thwart if you know what to look for, but it's disingenuous to say that it's never happened. These things are attacks on your ability to recognize and be vigilant, and you can't recognize and be vigilant of everything at the same time.
Obviously the particular vector of console pastes hasn't been exploited yet but that doesn't mean it won't ever. When it does, we'll mourn the passing of our current free-wheeling days the same way we mourn the old Usenet.
Re: Don't copy paste from a website to a terminal
#105My approach is in the same lines of short urls I checked the long url first, so whenever I do the copy and paste I open my text editor, because almost every time need adjustments.
Re: Don't copy paste from a website to a terminal
#106The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…
> The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.
Or, for that matter, a source download. Or one you've hashed (how do you know the hash hasn't been tampered with?), a microprocessor (have you looked at the microcode? the masks), a circuit, etc.
Turtles^H^H^H^H^H^H^HTrust all the way down.
I'm not being entirely facetious, either, given the advice about disposing of electronics after visiting certain countries.
Re: Don't copy paste from a website to a terminal
#107The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…
> The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.
[deleted]
Re: Don't copy paste from a website to a terminal
#108The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…
> The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.
[deleted]
Re: Don't copy paste from a website to a terminal
#109Do not cat log files either: http://unix.stackexchange.com/questions/15101/how-to-avoid-e...
Re: Don't copy paste from a website to a terminal
#110So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…
Paste into a text buffer first, which is generally a good idea anyway to deal with formatting issues.
I do that regardless because I'm super paranoid about stuff like this but I'm really wondering if I'm not taking it a bit too far. I've also yet to run into any kind of attempt to pull a stunt like this in a very long time of activity so I'm wondering what the actual incidence is.