Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

141–150 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#141

Post by trotsky »

nicksergeant wrote: post #138
trotsky wrote: post #132

Earlier quoted context omitted.

So you're trusting opscode to provide the primary centralized control system of your entire server ecosystem but you're concerned they might be embedding something malicious in their installer shell script? Don't get me wrong, i'm no fan of the practice especially sans tls, but this seems like a poor example.

It's not that you don't trust opscode, it's that it's possible that someone could hack opscode's installer script...

just like they could replace a binary, backdoor the Makefile or hide something bad deep in the repo. And of course their hash of their signing key for their apt repo and any shasums are provided on the same webserver.

Re: Don't Copy-Paste from Website to Terminal

#142

Post by tiredofcareer »

FooBarWidget wrote: post #127
Scaevolus wrote: post #119

Earlier quoted context omitted.

The only difference between "wget | sh" and "download and run our installer" is that you could inspect the installer before running it. You can still do that, "wget | sh" just simplifies the process for most users.

You can also inspect the wgetted/curl'ed script if you so choose. It's just a URL. I don't understand your point. Even with the "exploit" in the article, it will be detected as soon as the user pastes the URL in his browser location bar. People who don't inspect what they run are screwed no matter what.

The point, especially in a non-SSL environment, is not that you're not trusting Opscode or Homebrew. It's that a malicious attacker has a vector, because he knows people will be doing something with that URL.

If I own Opscode and I'm smart, I plant something like this on that URL:

    if request.user_agent.startswith("Curl or wget or..."):
        return deliver_malicious_script(request)
    return deliver_everything_is_fine_script(request)
Nearly everybody's workflow for "checking" this is putting the URL in your bar, looking at it, then jumping over to terminal and running it. (Sounds suspiciously like what you just described.) I just owned that with three lines of effort.

We can do this dance all day where people point out specifics, or we can all just recognize it's a bad idea (a lot of people are saying it's a bad idea; might be worth considering it's a bad idea).

Re: Don't Copy-Paste from Website to Terminal

#143

Post by wulczer »

charlieok wrote: post #130
NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

Check out http://www.gnu.org/software/stow/

Re: Don't Copy-Paste from Website to Terminal

#144

Post by icebraining »

hollerith wrote: post #75
icebraining wrote: post #49

Earlier quoted context omitted.

So, are you saying we shouldn't have text positioning? Because I'm pretty sure that's been a feature of documents since before Gutenberg. I can understand your gripe, but I simply don't see how it applies here.

Maybe I am wrong, but I have been assuming that if the maintainers of the browsers cared only about readers and writers (and not about application users and application developers, or potential customers and marketers) they would change the browsers so that what is copied into the clipboard is exactly the text that has been highlighted and is visible on the page and nothing more. Even if browsers worked that way, the…

If browsers were pure document viewers, I think it's much more likely that they would simply have only a maintainer or two, and most developers currently maintaining browsers would be doing more valuable and interesting work, like developing application platforms.

And that couple of maintainers would probably still have more important things to fix than what's essentially a curious but not really problematic bug.

Re: Don't Copy-Paste from Website to Terminal

#145

Post by jhasse »

arjunbajaj wrote: post #133
charlieok wrote: post #130

Earlier quoted context omitted.

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

I would love to use such a thing! I'm bugged with programs I don't use anymore which start on system boot. Even after removing some programs, they just don't go away. A sandboxed environment would be really good to use!

http://www.gobolinux.org/

unfortunately it seems to be dead.

Re: Don't Copy-Paste from Website to Terminal

#146

Post by Aga »

mistofvongola wrote: post #116

This is another reason I always type a '#' before copy/pasting any long commands. The main reason is that I sometimes want to edit a long copied command and sometimes a newline get caught in my 'copy'. The '#' prevents it from accidentally executing.

As explained above, this will help only against the first line of the attack (until the first newline character). The subsequent lines will be executed.

A better solution would be to paste the text in to an editor.

Re: Don't Copy-Paste from Website to Terminal

#148

Post by laumars »

arjunbajaj wrote: post #133
charlieok wrote: post #130

Earlier quoted context omitted.

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

I would love to use such a thing! I'm bugged with programs I don't use anymore which start on system boot. Even after removing some programs, they just don't go away. A sandboxed environment would be really good to use!

That's just bad administration as even on Windows, you can easily disable them (msconfig). With Linux, this isn't even an issue unless you're blindly installing dozens of daemons (which, again, can easily be disabled) as Linux doesn't have hundreds of application launchers that install themselves like Windows does (again, daemons being the exception).

The only example I can think of where you might run into problems is if your desktop environment is doing some weird sessions. But that's usually fixed pretty easily in the system settings for whatever desktop environment you're running.

This is all pretty basic stuff; you shouldn't need a sandboxed environment to prevent applications from auto-launching unless you're going around installing malware (and if you are deliberately installing malware on your main bare-metal OS, then you're insane).

Re: Don't Copy-Paste from Website to Terminal

#149

Post by dmourati »

mistofvongola wrote: post #116

This is another reason I always type a '#' before copy/pasting any long commands. The main reason is that I sometimes want to edit a long copied command and sometimes a newline get caught in my 'copy'. The '#' prevents it from accidentally executing.

the pound trick is the sign of a true professional

Re: Don't Copy-Paste from Website to Terminal

#150

Post by comice »

somesay wrote: post #81
subway wrote: post #59

Earlier quoted context omitted.

C'mon... That is nothing like the industry standard -- you used SSL.

Watch out. Does curl check the key chain against any key store? I bet not.

It does if you're on a proper operating system like Debian :)
Post reply on HN