Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

111–120 of 257 posts

Re: Don't copy paste from a website to a terminal

#111

Post by jacquesm »

ctdonath wrote: post #97
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Ouch. Double fail.

Re: Don't copy paste from a website to a terminal

#112

Post by jacquesm »

drzaiusapelord wrote: post #99
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Except its very uncommon to be poisoned or stabbed and very common for IT systems to be hacked, because there's a pretty big incentive to do so (setup a spamming farm, steal data, enlarge a botnet, script kiddie cred, etc). >Has anybody been personally burned by this? I imagine a lot of devs who follow bad practices cause a lot of havok, but its up to the security and sysadmin team to clean up after them. They may no…

You have 'uncommon' twice, I think you meant 'common' in the second instance.

Re: Don't copy paste from a website to a terminal

#113

Post by larrys »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

"What is the actual risk here, how many people have been bitten by this sort of thing and what was the resulting damage?"

Exactly. And what I essentially typically say is "the scope of the problem has not been defined".

We see this often on news reports on TV as an example. They go off with hyperbole about some issue but fail to address exactly how many people have been effected by it. Simply saying things like "there is a growing concern..." or cherry picking examples.

We see this now with cases of "police brutality" and use of unwarranted force. It's not that it doesn't exist, but that any reports totally ignore how often it actually happens vs. how many times it doesn't happen.

Re: Don't copy paste from a website to a terminal

#114

Post by ownagefool »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

The same argument applies for the following command.

wget https://example.com/script.sh | bash

If you trust the source, you might as well install it. Otherwise, we're basically arguing that everyone who has ever installed any non-distro software is an idiot.

Consuming http or the connection dying and script ending early and being left in a weird state is probably a more interesting argument than the trust issue.

Re: Don't copy paste from a website to a terminal

#115

Post by mixmastamyk »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

I found it really easy to turn off styles, to show the real code. In firefox the View Menu, Page Style, No Style.

There are ways to assign this to a keypress or button as well.

Re: Don't copy paste from a website to a terminal

#116

Post by cataflam »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

It's a different threat model to your other examples though. The pizza guy, the driver, the lady down the street, unless they know you and have something against you, they would want to target you with no apparent motive in your examples. There is plenty of motive to hack random computers by just putting up a malicious website. And people try to do it all the time, and install malware with various degrees of stealth. It's not really an unknown or crazy threat.

The website threat model also allows the bad guy to target someone by IP, or some country, or only put the malicious code 1 in 1000 times, so it's not going to be widely noticed, etc.

Or it could be an HTTP (not -S) website and someone MitMs you (OK that is a pretty far-fetched attack vector for someone who MitMs you, I admit).

edit: although I agree with you that I've personally never encountered a case where this specific malicious trick happened

Re: Don't copy paste from a website to a terminal

#118

Post by condescendence »

Totally arbitrary. If you're simply copy and pasting commands you probably don't know what you're doing, OR you're just looking for the quick shortcut.

Either way, when I paste I usually put it through a scrapped terminal. Meaning I have to hit enter twice for any command to actually be executed.

If you're not checking your commands before you hit enter it's like getting in a car for the first time and bringing it to top speed hoping that it won't rattle apart and kill you.

To further this analogy, if I were to get a car from a dealership brand new it might have some issues but for the most part it's brand new and safe. If I'm buying a car from some shady lot behind a Waffle House, well then I should probably bring it to a mechanic to get inspected and such.

To detract from the analogy, dealerships are giving out different new cars while copy/pasting code from tutorials such as Linode are always giving the user the same content, they've been checked numerous times and hopefully the bullshit has been caught already.

Re: Don't copy paste from a website to a terminal

#120

Post by jonas21 »

ctdonath wrote: post #97
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.
Post reply on HN