Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

31–40 of 257 posts

Re: Don't copy paste from a website to a terminal

#31

Post by friendzis »

I personally do web stuff in GUI with a mouse (I have vimium chrome extension, but old habits die hard) and select text by multitap: 60% of the time it works all the time. When it does not work I just drag-select and paste to terminal. Seems rather safe, as this does not work on this example.

tripple-tap on both urls give "git://git.kernel.org/pub/scm/utils/kup/kup.git" (with the exception that the first one contains a newline), and in such cases I am too lazy to reselect and just prepend the url with muscle memory git clone.

Re: Don't copy paste from a website to a terminal

#32

Post by delinka »

Off-topic/meta:

"Oh, and it seems that other people wrote a detailed text about this issue in 2008."

Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years.

My point here is that maybe it's time we started designing some curricula around these things that people keep rediscovering: Why you do indeed want a relational database manager and probably not a 'NoSQL' store; and when you do want a NoSQL store. Multiplexing existing systems with VMs; how your VPS works and why it worked so well on mainframes back in the day. (and oh, btw did you know that you can just pull hardware, including CPUs, right out of the mainframe and it'll keep doing its job?) Dangerous things we've all done at some point and prime (hands-on) examples of the failures that might ensue...

And no, I don't mean (necessarily) to teach in schools. Maybe an online collection. "So you wanna 'do computers' without getting hacked and without re-inventing everything..."

Re: Don't copy paste from a website to a terminal

#33

Post by jnbiche »

wyldfire wrote: post #11
hellofunk wrote: post #3

I don't get it... even if the pasted content has stuff I don't expect, I still see it in my shell prompt before I press Enter, no?

No, unfortunately not. I did a "cat >/dev/null" before pasting so I could see what it was. Clever masked/hidden content, with embedded shell commands and newline to commit the commands.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

Re: Don't copy paste from a website to a terminal

#34

Post by kedean »

SCdF wrote: post #14

> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file. Bar the relati…

Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of.

However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great attack vector for, say, intro to CS students who just want to make this linux thing work right.

Re: Don't copy paste from a website to a terminal

#35

Post by rnovak »

Generally I take a "Trust, but Verify" approach to most everything, and luckily, modern browsers have a nifty "search google for..." context menu option that lets me check anything that I highlight out on google (what a wonderful world), so the second I right clicked on what was highlighted the 'hidden' content was revealed.

Re: Don't copy paste from a website to a terminal

#36

Post by eveningcoffee »

teleclimber wrote: post #28

You don't even need to be that crafty with CSS. Just a few lines of JS will do. Try copying the Hello World text in this fiddle and paste it in a text editor: http://jsfiddle.net/teleclimber/8q6sp5ga/ (Tested in Chrome)

Works with FF on Ubuntu latest stable.

Re: Don't copy paste from a website to a terminal

#37

Post by coldtea »

Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

>The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like.

The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.

Re: Don't copy paste from a website to a terminal

#38

Post by hguant »

andreasvc wrote: post #24
spdy wrote: post #12

At the end of the day we have to have trust in others especially in opensource. Everything you incorporate in your apps/sites could be malicious.

Why especially in open source? The leap of faith is larger with a binary blob. (Although I admit it doesn't make much difference in practice, most people don't audit source code).

I think the argument is that open source is based on the fundamental ideal of trust - I put this software out into the world so that people can better it, tweak it, make it their own. If those people don't trust you, and have to audit everything they install, the model breaks.

Re binary blobs - honestly, for me at least, if I'm installing a blob it's probably because I purchased the software. Maybe it's naive but I more or less assume no company is going to actively screw over a paying customer

Re: Don't copy paste from a website to a terminal

#39

Post by falcolas »

friendzis wrote: post #31

I personally do web stuff in GUI with a mouse (I have vimium chrome extension, but old habits die hard) and select text by multitap: 60% of the time it works all the time. When it does not work I just drag-select and paste to terminal. Seems rather safe, as this does not work on this example. tripple-tap on both urls give "git://git.kernel.org/pub/scm/utils/kup/kup.git" (with the exception that the first one contains…

On Firefox on my mac, triple click and drag onto a notepad gave me the entire thing, including the echo lines.

Re: Don't copy paste from a website to a terminal

#40

Post by RyanMcGreal »

teleclimber wrote: post #28

You don't even need to be that crafty with CSS. Just a few lines of JS will do. Try copying the Hello World text in this fiddle and paste it in a text editor: http://jsfiddle.net/teleclimber/8q6sp5ga/ (Tested in Chrome)

Works in Firefox 42.0 as well.
Post reply on HN