Don't Copy-Paste from Website to Terminal • Hacker News Board

Re: Don't Copy-Paste from Website to Terminal

#201

Post by sliverstorm » Mon, Apr 08, 2013, 5:18 AM UTC

trotsky wrote: post #197

csense wrote: post #182

Earlier quoted context omitted.

I put all my sensitive files under my home directory. Every subdirectory of my home directory is non-world-accessible, and I have a cron job which chmod's world privileges away from new files and directories that don't match a whitelist of directories I wish to publish (e.g. ~/public_html). I've started giving each application its own user and group, and do the git checkout, compile, and install as that user. (You do…

It seems like you've been putting a lot of effort in, but posix uid/gid isolation is increasingly pourous with the typical desktop environment these days. It sounds like you are ready for real RBAC - if you put the time in selinux (or apparmor or grsec) is leaps and bounds more effective.

uid/gid is generally a sound system, the problem IMO is basically that no one uses it for serious security, so a lot of things are not set up to be properly careful by default.

Re: Don't Copy-Paste from Website to Terminal

#202

Post by munimkazia » Mon, Apr 08, 2013, 5:24 AM UTC

Did it stop working for anyone the second time? I tried it once, and it worked (gave me the warning and first line of my /etc/passwd file). I wanted to show it to a coworker but it mysteriously stopped working. It is just copying the displayed text now. Kinda weird..

Using Google Chrome 26.0.1410.43 on ubuntu 12.10 64bit.

Re: Don't Copy-Paste from Website to Terminal

#203

Post by re_todd » Mon, Apr 08, 2013, 5:31 AM UTC

dechols wrote: post #13

So the answer is to paste it into an editor first?

Yeah, I always have gedit or kate running so I can paste there first and verify it.

Re: Don't Copy-Paste from Website to Terminal

#204

Post by ck2 » Mon, Apr 08, 2013, 5:33 AM UTC

Can browsers fix this behavior?

It seems like a security hole for many reasons.

The default should be to copy plain text as highlighted, and advanced right click for html based copying.

Re: Don't Copy-Paste from Website to Terminal

#205

Post by peterkelly » Mon, Apr 08, 2013, 5:42 AM UTC

charlieok wrote: post #130

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”

It's called iOS

Re: Don't Copy-Paste from Website to Terminal

#206

Post by mh- » Mon, Apr 08, 2013, 6:07 AM UTC

dalke wrote: post #184

dechols wrote: post #13

So the answer is to paste it into an editor first?

or "cat > /dev/null" and paste into the terminal to review.

wonder if there's something that would be copyable from the browser to the clipboard/pastebuffer/what-have-you (and pasteable to your terminal emulator) that would constitute a ^C?

Re: Don't Copy-Paste from Website to Terminal

#207

Post by cschramm » Mon, Apr 08, 2013, 6:40 AM UTC

moonboots wrote: post #6

Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu…

Yeah, copying GitHub URLs sucks. You cannot actually select it with your mouse, since some creepy JavaScript interferes and selects it for you. the result is that it's selected, but not copied to PRIMARY, as you'd expect. I fall into this trap every single time.

Re: Don't Copy-Paste from Website to Terminal

#208

Post by oelmekki » Mon, Apr 08, 2013, 6:40 AM UTC

bluetooth wrote: post #18

This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site…

> This is really just an extension of clickjacking

That's was my first thought too, but in fact, it's quite the reverse of clickjacking (even though the same basic idea is used).

With clickjacking, you would positionate some opacity:0 link on top of some apparently legit link. Here, on the contrary, the malicious content is within the apparently legit content, then moved away with css (setting opacity to 0 would not do the trick).

Not a big difference, but that would deserve a dedicated name, IMO.

Re: Don't Copy-Paste from Website to Terminal

#209

Post by Kiro » Mon, Apr 08, 2013, 6:50 AM UTC

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I don't understand what this has to do with copying or pasting at all. I would still copy-paste it.

Re: Don't Copy-Paste from Website to Terminal

#210

Post by zsiciarz » Mon, Apr 08, 2013, 7:28 AM UTC

fnordfnordfnord wrote: post #103

q_revert wrote: post #87

Earlier quoted context omitted.

one of the recommended ways to install oh-my-zsh wget --no-check-certificate https://github.com/robbyrussell/oh-my-zsh/raw/master/tools/install.sh -O - | sh

Don't forget 'sudo'!

You don't need sudo as this is your user's shell.