Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

251–257 of 257 posts

Re: Don't copy paste from a website to a terminal

#251

Post by simonh »

will_pseudonym wrote: post #222
overgard wrote: post #218

Earlier quoted context omitted.

That's way too hardline, surely some people are wrongly accused or some cases are borderline. This sort of "zero tolerance" nonsense always just ends up removing human judgement and common sense from the equation. Also the idea that "the system is underpinned by the notion nobody can cheat" is absurd. Cheating is rampant! Even in the ivy leagues. Especially in the ivy leagues! But people still value college degrees.

Cheating is rampant, but that doesn't mean that we all as a society don't still ignore that fact! It's a beautiful display of cognitive dissonance. There's no way to know if someone truly achieved their degree, so you have to test them, which is one of the reasons the degree was valuable. You shouldn't have to test someone if they had certain credentials. They've passed their rigorous training program. I'm not really…

A system where you fail the exam and three strikes and you're out != ignoring the problem.

Re: Don't copy paste from a website to a terminal

#252

Post by bipin_nag »

The middle mouse paste (select to copy) in Ubuntu makes it even more seductive. In many occasions I have accidentally pasted code into my terminal window and many times without even knowing (debugging phantom menaces). I have started using Clipit/gedit to screen code now.

Re: Don't copy paste from a website to a terminal

#253

Post by pyre »

ryan-c wrote: post #56
pyre wrote: post #50

Earlier quoted context omitted.

... so this: wget -qO- 'http://example.com/script.sh' | less won't work to review the script?

No. Totally possible to serve the "bad stuff" only some of the time. Browser exploit kits commonly will return different stuff depending on user agent, and will track what IPs they have interacted with so that if after someone clicks the link you try to look at it, you'll get something harmless. Nasty business. The only way to be sure is to save it, inspect what you saved (make sure you use something that will show t…

I'm not sure why you're taking about browser exploit kits when we're talking specifically about using curl or wget to pipe an HTTP payload into a shell.

Re: Don't copy paste from a website to a terminal

#254

Post by ryan-c »

pyre wrote: post #253
ryan-c wrote: post #56

Earlier quoted context omitted.

No. Totally possible to serve the "bad stuff" only some of the time. Browser exploit kits commonly will return different stuff depending on user agent, and will track what IPs they have interacted with so that if after someone clicks the link you try to look at it, you'll get something harmless. Nasty business. The only way to be sure is to save it, inspect what you saved (make sure you use something that will show t…

I'm not sure why you're taking about browser exploit kits when we're talking specifically about using curl or wget to pipe an HTTP payload into a shell.

All the same tricks could just as easily be applied to (wget|curl) pipe to shell scenarios.

Re: Don't copy paste from a website to a terminal

#255

Post by GalacticDomin8r »

delinka wrote: post #249
GalacticDomin8r wrote: post #102

Earlier quoted context omitted.

> always doing things in a root shell Ah yes. The sudo high horse. I knew I'd see you again. Viva La #

Don't jump to conclusions; my comment says nothing about sudo. There's a time to use the root shell, and a time to sudo; the key is knowing the difference. Dismissing advice because "it's never caused me a problem before" or "you don't know what you're talking about" will cause problems at some point. If you can elucidate the reasons (plural), you need to be in a root shell, by all means use a root shell. If you're d…

>Don't jump to conclusions; my comment says nothing about sudo

Yeah sure this has nothing to do with sudo. Right, gotcha.

> If you can elucidate the reasons (plural)

"Reasons" means plural where I come from(denoted by the "s"). There is no reason to repeat yourself. I decline your request for an elaboration. The "don't use a root shell crowd" has clearly won the popularity contest in the same way TSA now has a significant presence at larger US airports.

> If you're doing because "it's easier" and no other reasons, then you probably need a bit more experience.

Don't jump to conclusions. There are few people here who can truthfully claim more experience than I could. Regardless of our experience levels, it bears no weight in the validity of my statement.

> In any case,

Not really.

> always using a root shell is the Wrong Thing To Do.

You are free to hold whatever opinion you wish.

Re: Don't copy paste from a website to a terminal

#256

Post by pyre »

ryan-c wrote: post #254
pyre wrote: post #253

Earlier quoted context omitted.

I'm not sure why you're taking about browser exploit kits when we're talking specifically about using curl or wget to pipe an HTTP payload into a shell.

All the same tricks could just as easily be applied to (wget|curl) pipe to shell scenarios.

Ok. Someone posed a scenario where an attacker uses the User-Agent to differentiate between a victim vetting the URL via a regular browser and someone using curl/wget to pipe it to the shell. I suggested a simple solution to this specific scenario.

There are any number of scenarios where any given solution could be broken. Why not point out that you OS might be compromised and the wget/curl binary that you're using is patched to present the wrong information to you?

Re: Don't copy paste from a website to a terminal

#257

Post by vidarh »

collyw wrote: post #158
vidarh wrote: post #145

Earlier quoted context omitted.

And I thought it was ridiculous when someone had cut and pasted a page from an Oracle manual in response to a set of pre-screening questions for a hiring round, headers included (for a generic SQL question we expected a one sentence answer to). At least that guy didn't pay for it - to my knowledge at least (he did cut and paste most of his answers from various places, though, and got many of them wrong, including an…

Isn't the first place you would go to the Oracle manual? I use stack overflow all the time these days (documentation pages before that existed), not quite cutting and pasting but close enough.

For a basic SQL question? No. I'd never even seen an Oracle manual prior to that, and I haven't since.

If I needed specifics about Oracle, sure. I don't expect to ever need that.

But the more important aspect was that the full, complete answer to the question we raised took a single, short sentence. It was not clear from the page he had cut and pasted whether or not he even understood the question, so even if he hadn't copied it without telling us the source we'd not have considered it an acceptable answer.

Post reply on HN