Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

71–80 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#71

Post by perlgeek »

cmsj wrote: post #9
moonboots wrote: post #6

Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu…

Out of interest, what is confusing? If you select text it always goes into the selection buffer. If you also press the clipboard copy shortcut (so, Ctrl-C most of the time, sometimes Ctrl-Shift-C in a terminal) the selection is copied into the clipboard buffer. Ctrl-V (or, again, sometimes Ctrl-Shift-V in a terminal) pastes the clipboard buffer. Middle mouse button (or shift-Insert) pastes the selection buffer. Is th…

Firefox causes additional confusion by rebinding Ctrl+Insert to what Ctrl+v usually does (copying the clipboard buffer, not the selection buffer).

Also there are some cases where javascript which selects text for you causes very unintuitive behavior wrt selection buffer.

Re: Don't Copy-Paste from Website to Terminal

#72

Post by gmaslov »

crazygringo wrote: post #65
jiggy2011 wrote: post #50

Earlier quoted context omitted.

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…

OCR would work ;-)

Re: Don't Copy-Paste from Website to Terminal

#73

Post by jiggy2011 »

pekk wrote: post #66
jiggy2011 wrote: post #50

Earlier quoted context omitted.

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?

It is displaying it, just in a place your eye doesn't happen to see it due to a load of wonky CSS rules.

You could probably modify your browser to defeat this trick, but doing so you would run the risk of breaking existing sites and making CSS even more complicated than it already is.

And malicious code writers would simply switch up their code to a new trick.

Re: Don't Copy-Paste from Website to Terminal

#74

Post by koenigdavidmj »

hluska wrote: post #58
dechols wrote: post #13

So the answer is to paste it into an editor first?

Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!! Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.

There was a newline hidden in the one pasted here, so that's not an option. It would have run something no matter what.

Re: Don't Copy-Paste from Website to Terminal

#75

Post by hollerith »

icebraining wrote: post #49
hollerith wrote: post #37

Earlier quoted context omitted.

Valid point. " Design -delivery platform", then. My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting. These ambitious goals include assisting app developers and assisting design professionals (design profes…

So, are you saying we shouldn't have text positioning? Because I'm pretty sure that's been a feature of documents since before Gutenberg. I can understand your gripe, but I simply don't see how it applies here.

Maybe I am wrong, but I have been assuming that if the maintainers of the browsers cared only about readers and writers (and not about application users and application developers, or potential customers and marketers) they would change the browsers so that what is copied into the clipboard is exactly the text that has been highlighted and is visible on the page and nothing more. Even if browsers worked that way, they can have text positioning.

Re: Don't Copy-Paste from Website to Terminal

#76

Post by flogic »

crazygringo wrote: post #65
jiggy2011 wrote: post #50

Earlier quoted context omitted.

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…

It's a game of whack a mole, but that doesn't mean it's not a worthwhile game to play.

Re: Don't Copy-Paste from Website to Terminal

#77

Post by gislifb »

micampe wrote: post #40
ams6110 wrote: post #11

Earlier quoted context omitted.

And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.

I always thought this concept to be silly unless you are a sysadmin. For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.

Could you please tell me in which directory your ~ directory is and in which directory that directory is?

Re: Don't Copy-Paste from Website to Terminal

#78

Post by ivix »

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

Why would you say that is industry practice when it is not?

Re: Don't Copy-Paste from Website to Terminal

#79

Post by jiggy2011 »

hollerith wrote: post #70
jiggy2011 wrote: post #57

Earlier quoted context omitted.

The reason that the web is popular is because it supports these features for design-delivery and application delivery. You could probably implement an online text reading system with basic markup and hyperlinks over a weekend, but the problem would be that nobody would use it because it would be seen as strictly inferior to the web.

I hope you are not setting up a false dichotomy in your mind between the web as it is now and an online text-reading system with no design touches. I would want this "text-reading system" for example to have something like CSS. The difference would be that instead of creating ever-more powerful versions of CSS and Javascript, the architects and implementors of the text-reading system would pay attention to gotchas li…

Thing is that the ever more complicated web is a response to demand, from developers and from users.

If at some point we had said "the web is powerful enough now, let's stop" then inevitably somebody like Microsoft or Google would have developed some other system that incorporated everything that the web does + extra stuff. In fact that's basically what stuff like Flash/ActiveX was in the late 90s.

Then gradually people would have switched to this new thing and the web would have gone the way of gopher and usenet.

Of course, if we could have redesigned the web from scratch right now with all the benefit of hindsight we could have (in theory) designed a better system. But as with most open things they rely on evolution rather than intelligent design.

Re: Don't Copy-Paste from Website to Terminal

#80

Post by desas »

crazygringo wrote: post #65
jiggy2011 wrote: post #50

Earlier quoted context omitted.

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way aroun…

It strikes that Google probably has some algorithms to detect this. Otherwise black hat SEOers would use this trick to stuff keywords or something.
Post reply on HN