Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

131–140 of 257 posts

Re: Don't copy paste from a website to a terminal

#131

Post by jimrandomh »

jwilk wrote: post #84
jimrandomh wrote: post #51

This is properly viewed as a bug in bash (and most other shells). Shells can tell terminals to do "bracketed paste": the start and end of a pasted block is marked with escape sequences. The correct behavior is to use bracketed paste, and to treat newlines inside pastes as multiline text input, not as a ready-to-execute signal. Apparently that hasn't happened because of compatibility problems with broken terminals, pl…

Bracketed paste can save you from accidental damage, but not from malicious pastes. As the fine article says, the end sequence can be inside the text you paste unless your terminal emulator filters out the bracketed paste characters (and last time I checked, at least urxvt didn't). Besides, teaching shell about bracketed paste could only help for pasting directly to shell; it won't help if you're pasting to vim (thin…

Ok, sounds like it's two bugs - terminals definitely shouldn't pass through a bracketed paste end-marker, and probably shouldn't pass any control characters at all (ie, no esc or ^D). Passing special control characters through the clipboard is already unreliable, so I don't think this change would break anything legitimate.

Re: Don't copy paste from a website to a terminal

#132

Post by semi-extrinsic »

ownagefool wrote: post #114
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

The same argument applies for the following command. wget https://example.com/script.sh | bash If you trust the source, you might as well install it. Otherwise, we're basically arguing that everyone who has ever installed any non-distro software is an idiot. Consuming http or the connection dying and script ending early and being left in a weird state is probably a more interesting argument than the trust issue.

Or even

$ git clone https://github.com/somedev/package .

$ ./install.py

Re: Don't copy paste from a website to a terminal

#133

Post by ewindisch »

ownagefool wrote: post #114
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

The same argument applies for the following command. wget https://example.com/script.sh | bash If you trust the source, you might as well install it. Otherwise, we're basically arguing that everyone who has ever installed any non-distro software is an idiot. Consuming http or the connection dying and script ending early and being left in a weird state is probably a more interesting argument than the trust issue.

The connection-closed problem can be solved by wrapping the code in the script within a function, then calling that function at the end of the script. Of course, that needs to be done by the software's author, but we trust the authors of our software if we're going to run it, yes?

Re: Don't copy paste from a website to a terminal

#134

Post by vectorjohn »

Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

Also the ever popular Docker.

On the other hand, if it's over SSL, you're just as well off as installing the software any other way. Although, I noticed the Drupal console installer isn't even on SSL.

Re: Don't copy paste from a website to a terminal

#135

Post by maratd »

redthrowaway wrote: post #121
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

It would make for a good spearphishing attack. If you know the target's stack and can guess what sorts of issues they might run into, you can throw up a few pages detailing fixes for those issues. Give half-right answers on stack and link to your honeypot for "more in-depth discussion of the issue". Then sit back and wait for a dev to run your "fix" on one of their servers.

That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anything malicious on their screen.

Re: Don't copy paste from a website to a terminal

#137

Post by voltagex_ »

Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

On one hand, I'm glad people are working on easier ways to install software. On the other, everyone is ignoring distro package managers.

Docker gets it right [1] and then gets it wrong [2] - depends which set of instructions you read.

I know creating distro packages and self-hosted repos is difficult, maybe we should be attacking that as a problem instead of writing hundreds of different shell scripts.

1: https://docs.docker.com/engine/installation/ubuntulinux/

2: https://docs.docker.com/v1.8/installation/ubuntulinux/#insta...

Bonus: https://twitter.com/mjg59/status/655812609715769349

Re: Don't copy paste from a website to a terminal

#138

Post by ctdonath »

jonas21 wrote: post #120
ctdonath wrote: post #97

Earlier quoted context omitted.

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.

"Three strikes" would be 3 major offenses like flagrant plagiarism/cheating. I was rather surprised buying answers to a final exam wasn't sufficient for expulsion. Didn't dig into the policy details further.

Re: Don't copy paste from a website to a terminal

#139

Post by Rexxar »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Similarly, running "make" in the directory of a freshly downloaded repo is dangerous too. It's really difficult to check all code running on our behalf and to quantify the risks.

If someone take control of a popular git repo and push a malicious build script. How many people will be affected before the fix ?

But this doesn't seem to happen very often too.

Re: Don't copy paste from a website to a terminal

#140

Post by wyldfire »

e12e wrote: post #94
wyldfire wrote: post #42

Earlier quoted context omitted.

No, I just put my terminal into a mode where I could see what I pasted without any possibility executing it. If you don't give cat any arguments, it reads from stdin and writes to stdout. I could have just as easily opened vim/emacs/notepad and done the same, or for that matter, written the contents to an actual file instead of redirecting the contents to /dev/null.

But you could still paste ^d (End-of-file)? Granted, if you paste ^d in the terminal, you'd exit, but one could do this?: dangerous-commands \n ^d #eof dangerous-commmands \n #repeat (I'm not actually sure if you can paste ^d in general... but I expect you could?)

Great point, we've just fired another salvo in an escalating war. The only winning move is not to paste. :)
Post reply on HN