Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

191–200 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#191

Post by LnxPrgr3 »

elliottcarlson wrote: post #136
pekk wrote: post #62

Earlier quoted context omitted.

Doesn't the browser have a model of which text is visible? It has to. So why not copy out of that model?

What constitues as visible though? There is the obvious non-visible CSS modifiers like display: hidden; - but at what point does an off screen rendered text actually count as hidden? If you were wanting to copy the entire contents of a page, and the browser assumed anything off screen was invisible then you would not be able to copy everything at once when it goes below the fold. Different screen resolutions and devi…

The text isn't just not visible right now. It can't become visible. It lives above and to the left of the start of the page. Surely the browser's aware of that.

Re: Don't Copy-Paste from Website to Terminal

#192

Post by TheJH_ »

Achshar wrote: post #152

Select the text and right click to copy. The trick is over when the "search google for 'malicious text' comes up instead of the command in chrome.

Right... for a real attack, you'd have to hide the evil commands near the end of the normal-looking one (the string you see there is truncated). I thought about doing that, but it'd give you a few seconds to react in this example because you'd have the git command run first. Hmm, maybe it'd be doable using backticks or so? Those could be put at the end and would evaluate first anyway...

Re: Don't Copy-Paste from Website to Terminal

#193

Post by hollerith »

micampe wrote: post #170
gislifb wrote: post #77

Earlier quoted context omitted.

Could you please tell me in which directory your ~ directory is and in which directory that directory is?

You either enjoy pointless nitpicking or have entirely missed my point.

No, he did not: typing rm -rf / into a root shell will delete the OS and your home directory.

It is a little more complicated than that, but the complications do not really affect very much. Last time I installed Debian around 2005 the documentation encouraged me to give /home its own partition, in which case rm -rf / will not get it. But on OS X the default is to put everything in one big partition and I kind get the feeling that Linux has moved that way, too. And even if /home is on its own partition, there are many ways for the malefactor to get /home, e.g., rm -rf /home.

Re: Don't Copy-Paste from Website to Terminal

#194

Post by Aramgutang »

cmsj wrote: post #14
raymondh wrote: post #7

Nicely done! Here's the underlying source: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

If you're using Firefox, you can prevent this kind of behaviour by going into about:config, and setting the dom.event.clipboardevents.enabled flag to false.

Re: Don't Copy-Paste from Website to Terminal

#195

Post by snowwrestler »

jiggy2011 wrote: post #73
pekk wrote: post #66

Earlier quoted context omitted.

The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?

It is displaying it, just in a place your eye doesn't happen to see it due to a load of wonky CSS rules. You could probably modify your browser to defeat this trick, but doing so you would run the risk of breaking existing sites and making CSS even more complicated than it already is. And malicious code writers would simply switch up their code to a new trick.

It is rendering it, but not displaying it. The browser knows how wide the view port is, and knows that some of the text sits outside the viewport, so it does not display it. The same check could easily be performed upon OS copy event; it just isn't because the browser authors did not think they needed to.

Re: Don't Copy-Paste from Website to Terminal

#196

Post by dredmorbius »

laumars wrote: post #148
arjunbajaj wrote: post #133

Earlier quoted context omitted.

I would love to use such a thing! I'm bugged with programs I don't use anymore which start on system boot. Even after removing some programs, they just don't go away. A sandboxed environment would be really good to use!

That's just bad administration as even on Windows, you can easily disable them ( msconfig ). With Linux, this isn't even an issue unless you're blindly installing dozens of daemons (which, again, can easily be disabled) as Linux doesn't have hundreds of application launchers that install themselves like Windows does (again, daemons being the exception). The only example I can think of where you might run into problem…

> With Linux, this isn't even an issue

That's a problem systemd is trying very hard to solve.

/sarcasm

SysV init may be old, crufty, and inelegant, but it's reasonably straightforward to parse and troubleshoot manually (and BSD-style rc inits are even more straightforward). Making the bootstrap process nondeterministic strikes me as tremendously unwise.

Re: Don't Copy-Paste from Website to Terminal

#197

Post by trotsky »

csense wrote: post #182
charlieok wrote: post #130

Earlier quoted context omitted.

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

I put all my sensitive files under my home directory. Every subdirectory of my home directory is non-world-accessible, and I have a cron job which chmod's world privileges away from new files and directories that don't match a whitelist of directories I wish to publish (e.g. ~/public_html). I've started giving each application its own user and group, and do the git checkout, compile, and install as that user. (You do…

It seems like you've been putting a lot of effort in, but posix uid/gid isolation is increasingly pourous with the typical desktop environment these days. It sounds like you are ready for real RBAC - if you put the time in selinux (or apparmor or grsec) is leaps and bounds more effective.

Re: Don't Copy-Paste from Website to Terminal

#198

Post by micampe »

hollerith wrote: post #193
micampe wrote: post #170

Earlier quoted context omitted.

You either enjoy pointless nitpicking or have entirely missed my point.

No, he did not: typing rm -rf / into a root shell will delete the OS and your home directory. It is a little more complicated than that, but the complications do not really affect very much. Last time I installed Debian around 2005 the documentation encouraged me to give /home its own partition, in which case rm -rf / will not get it. But on OS X the default is to put everything in one big partition and I kind get th…

Yes, you both did. To a user losing / is just as bad as losing ~, because ~ is all she cares about, not her OS settings, hence why I think the idea that running as root is worse than running as an unprivileged user is silly in this context.

They are effectively the same: an unknown script executing "rm -rf ~" with an unprivileged user is going to cause as much grief as root running "rm -rf /".

I couldn't care less that the system is still up if all my data is gone.

Also, I believe “rm -r” traverses mount points.

Re: Don't Copy-Paste from Website to Terminal

#199

Post by fein »

dredmorbius wrote: post #196
laumars wrote: post #148

Earlier quoted context omitted.

That's just bad administration as even on Windows, you can easily disable them ( msconfig ). With Linux, this isn't even an issue unless you're blindly installing dozens of daemons (which, again, can easily be disabled) as Linux doesn't have hundreds of application launchers that install themselves like Windows does (again, daemons being the exception). The only example I can think of where you might run into problem…

> With Linux, this isn't even an issue That's a problem systemd is trying very hard to solve. /sarcasm SysV init may be old, crufty, and inelegant, but it's reasonably straightforward to parse and troubleshoot manually (and BSD-style rc inits are even more straightforward). Making the bootstrap process nondeterministic strikes me as tremendously unwise.

I agree here. I really enjoyed the explicit control granted by sysV. The switch to systemd just seems like fixing something that isn't broken.

I will probably be proved wrong as systemd matures, but right now it's just not the case.

Post reply on HN