Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

131–140 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#131

Post by jneen »

runn1ng wrote: post #125
jneen wrote: post #89

I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.

You should basically compile everything yourself and read all the source code yourself if you want to be secure. Good luck with that though. (Escpecially with things like, I don't know, browsers.)

My point exactly. No one is ever actually going to read all the code, so you have to start your trust somewhere. Especially if you're going to type `sudo make install` at the end (which is why I advocate things like ~/.local to prevent the need for that, but I digress).

Re: Don't Copy-Paste from Website to Terminal

#132

Post by trotsky »

rytis wrote: post #104
NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...

So you're trusting opscode to provide the primary centralized control system of your entire server ecosystem but you're concerned they might be embedding something malicious in their installer shell script?

Don't get me wrong, i'm no fan of the practice especially sans tls, but this seems like a poor example.

Re: Don't Copy-Paste from Website to Terminal

#133

Post by arjunbajaj »

charlieok wrote: post #130
NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

I would love to use such a thing!

I'm bugged with programs I don't use anymore which start on system boot. Even after removing some programs, they just don't go away.

A sandboxed environment would be really good to use!

Re: Don't Copy-Paste from Website to Terminal

#134

Post by jiggy2011 »

LukeShu wrote: post #113
gmaslov wrote: post #72

Earlier quoted context omitted.

OCR would work ;-)

So, I know that was a joke, but now I'm trying to figure out why it's a bad idea. The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).

But you don't select text by selecting an area technically, you select a sequence of characters.

You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen.

For example doing Ctrl+A in a document.

Re: Don't Copy-Paste from Website to Terminal

#136

Post by elliottcarlson »

pekk wrote: post #62
Qantourisc wrote: post #19

IMO this is the browsers fault. One expects to copy the selected (visible) text. But kinda hard to fix ...

Doesn't the browser have a model of which text is visible? It has to. So why not copy out of that model?

What constitues as visible though? There is the obvious non-visible CSS modifiers like display: hidden; - but at what point does an off screen rendered text actually count as hidden? If you were wanting to copy the entire contents of a page, and the browser assumed anything off screen was invisible then you would not be able to copy everything at once when it goes below the fold. Different screen resolutions and devices would cause other issues there as well.

Re: Don't Copy-Paste from Website to Terminal

#137

Post by fragsworth »

comex wrote: post #31

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

The person who wrote the line of code is not necessarily the same as the person who owns the git repository.

You can trust "Person A", the owner of the repository, while not trusting "Person B", who wrote the "git clone (Person A's repository)" on their site.

Re: Don't Copy-Paste from Website to Terminal

#138

Post by nicksergeant »

trotsky wrote: post #132
rytis wrote: post #104

Earlier quoted context omitted.

Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...

So you're trusting opscode to provide the primary centralized control system of your entire server ecosystem but you're concerned they might be embedding something malicious in their installer shell script? Don't get me wrong, i'm no fan of the practice especially sans tls, but this seems like a poor example.

It's not that you don't trust opscode, it's that it's possible that someone could hack opscode's installer script...

Re: Don't Copy-Paste from Website to Terminal

#139

Post by networked »

Perhaps the real problem here is that, as noted by Ted Nelson back when the concept started to gain popularity, "[the computer clipboard is] just like a regular clipboard, except (a) you can't see it, (b) it holds only one object, (c) whatever you put there destroys the previous contents." The presented vulnerability hinges on (a), and, Glipper [1] notwithstanding, (a)-(c) is still the default behavior in every GUI I use.

[1] https://launchpad.net/glipper

Re: Don't Copy-Paste from Website to Terminal

#140

Post by joliss »

jakub_g wrote: post #123
joliss wrote: post #21

I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594 [1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash.…

It's still possible to circumvent this by creating a one-liner using semicolons. Just grab a code like [2] and append `; rm -rf` to the selection. If the original selection was a one-liner, it'll still be. [2] http://stackoverflow.com/a/4777746/

My idea was that if you're pasting a single line, then at least you can review the command you pasted before hitting enter.
Post reply on HN