Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

171–180 of 257 posts

Re: Don't copy paste from a website to a terminal

#171

Post by JadeNB »

meric wrote: post #149
ChuckMcM wrote: post #147

Earlier quoted context omitted.

Not sure you will anything more than anecdotal evidence but the propensity of people I've interviewed to go to a site like Stack Overflow and cut/paste "solutions" into their shell or terminal is sadly quite large. I much prefer people who can internalize the core knowledge of their craft over those who are living with all their technical knowlege currently swapped out to the web.

I could never quite get those tar flags right and often have to `man tar`.

I think, though I'm not sure I can explain why exactly, there's a difference between using one utility—Google—to answer all questions (with no real understanding of what's the 'right' place to ask), and doing focussed research—even if that focus is as minor as just reading the relevant documentation for the specific question.

Re: Don't copy paste from a website to a terminal

#172

Post by collyw »

kedean wrote: post #34
SCdF wrote: post #14

> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file. Bar the relati…

Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great at…

It was somewhat hyperbolic, showing the first line of /etc/psswd. With a normal user account that doesn't actually give you much, while giving the impresion that your password has been revealed (certainly those were my first thought upon reading the message). I imediately saw there was more going into the terminal than I expected (and was surprised) but it would have needed me to actually type a password to do much harm. (OK, some securtiy expert point can probably point out where I am wrong, but as a general rule....)

Re: Don't copy paste from a website to a terminal

#173

Post by jacquesm »

JadeNB wrote: post #171
meric wrote: post #149

Earlier quoted context omitted.

I could never quite get those tar flags right and often have to `man tar`.

I think, though I'm not sure I can explain why exactly, there's a difference between using one utility—Google—to answer all questions (with no real understanding of what's the 'right' place to ask), and doing focussed research—even if that focus is as minor as just reading the relevant documentation for the specific question.

At some level google (or ddg or whatever you use) is the new 'man'. Especially since many man pages now simply read:

"The GNU folks, in general, abhor man pages, and create info documents instead. Unfortunately, the info document describing tar is licensed under the GFDL with invariant cover texts, which makes it impossible to include any text from that document in this man page. Most of the text in this document was automatically extracted from the usage text in the source. It may not completely describe all features of the program."

Re: Don't copy paste from a website to a terminal

#174

Post by hollerith »

One possible response to this information is to try to educate all users of the web not to copy paste from a web site into a terminal.

Another possible response -- the one I prefer -- is to change the web browsers so that the copy operation only ever copies selected text visible to the user. That is how the copy operation works in my text editor and how it used to work in web browsers in the 1990s.

Copying and pasting are useful. The fact that some are trying to persuade all web users to stop doing it -- or to stop doing one common kind of it -- is a sign that there is something wrong with current web browsers.

Yes, I know that Unicode contains glyphs that look so much like common ASCII glyphs that a user can be fooled into, e.g., curling from a site controlled by an attacker when he thinks he is curling from github.com or some other trusted site. Maybe that means that the browser warns the user whenever the copied extent of text contains non-ascii characters; maybe the browser simply refuses to copy the non-ascii characters. Regardless of how we deal with malicious use of obscure Unicode characters, I think my previous paragraph holds up.

(Users of languages other than English should replace "non-ascii" above with "characters not commonly used by writers of the languages that the user usually uses".)

Re: Don't copy paste from a website to a terminal

#175

Post by leejo »

OK, i've replied with this elsewhere in the thread but will repeat it here for those who miss it. If you're on the command line and want to drop into your editor to paste, or just write a long command, and then have the command(s) executed after exiting the editor:

CTRL-X CTRL-E

If using zsh: http://nuclearsquid.com/writings/edit-long-commands/

Re: Don't copy paste from a website to a terminal

#177

Post by kcbanner »

ctdonath wrote: post #97
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Keep in mind that if the paste buffer includes a newline, everything preceding that newline will be executed. Pasting into an intermediate buffer, like a text editor, would be advisable.

Re: Don't copy paste from a website to a terminal

#178

Post by redthrowaway »

kbutler wrote: post #146
redthrowaway wrote: post #141

Earlier quoted context omitted.

That requires more stupidity on the target's part. I think most devs know not to `curl | sh` random scripts, but something as innocuous as `ps -ef | grep /some/longish/annoying/path/to/script` would seem both safe at first glance and long enough to want to avoid typing.

Do you download binaries? Do you build or install projects you've downloaded? Those have the same risk as curl|sh

With both binaries and curl|sh, trust in the source is a major factor in whether or not you do it. But copying an innocuous-looking terminal command (like `ps | grep`) doesn't seem like it would require trust.

I'll absolutely grab a binary or `curl | sh` from slack.com. I won't do it from a forum. But I would copy a terminal command that didn't look like it was doing anything fishy from a forum.

Re: Don't copy paste from a website to a terminal

#179

Post by xlvio »

I don't copy paste from anything to a terminal really. I was dealing with an enterprise client once who had an 'IT guy' who insisted for months that the Git repo was broken because the URL I had provided was invalid. dude was copy-pasting directly from the PDF guide I'd sent them (and copying incorrect characters), which actually specifically sates never to copy-paste any commands into the terminal as a basic security guideline.

hah.

Re: Don't copy paste from a website to a terminal

#180

Post by jacquesm »

angelbob wrote: post #161
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Whereas I kinda assume the NSA is already using it, and that's one of the big reasons to care.

I would hope that with all the resources they command that the NSA would not resort to methods involving such co-operation by their intended victims. Though anything goes I guess and why bother doing something intricate certain if something dumb and chancy works just as well.
Post reply on HN