4 ms·

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are

by rbut 10y ago

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

drauh 10y ago
Or you could "View Source"
- bbcbasic 10y ago
  Yes look in this one first: all_ze_scripts.min.js (8mb).
  - matt_kantor 10y ago
    I think drauh meant to copy the desired text from the source view, not to reverse-engineer the page to figure out its behavior.
    - bbcbasic 10y ago
      Ah!
nadaviv 10y ago
Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.
- rbut 10y ago
  To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
  - bbcbasic 10y ago
    FTFY: To solve this, browsers should probably disallow modifying the clipboard .
    - Cthulhu_ 10y ago
      That would probably break a lot of WYSIWYG-like editors.
      - bbcbasic 10y ago
        Touche. Then maybe it should be like location you opt-in per domain, as another poster said in this discussion.
  - Manishearth 10y ago
    They do. Browsers only let you intercept and tweak existing clipboard events.
- danielweber 10y ago
  If you're taking that step, then after you paste into the clean room, you copy out of the clean room.
  - joombaga 10y ago
    At first I thought "I don't do this; it's never seemed necessary", but actually, I think I do. Years of copying to a plain text editor to strip formatting have conditioned the behavior.
    - TeMPOraL 10y ago
      Yeah, I started to copy through a text box (usually the Windows Run (Win+R) box, which isn't exactly safe now that I think of it...) to strip formatting some time ago. It's pretty much necessary whenever you want to paste anything into GMail web interface. The web is getting more ridiculous every day...
      - dsptri 10y ago
        ctrl+shift+v removes formatting directly when pasting
borski 10y ago
TextEdit is RTF by default - I wonder if you can include control characters to screw with that? I use Sublime/Atom since those are plaintext by default.
- rbut 10y ago
  Yes, switching TextEdit to default to Plain Text is the first thing I do after installing OSX.
  - borski 10y ago
    Cool - just pointing this out since giving the advice to use TextEdit doesn't actually say 'in plain-text mode.' :)
nathancahill 10y ago
I use Quicksilver, and generally paste what I've copied there first. Also lets me strip the formatting, like pasting with Shift + Option + Command + V.
eelke 10y ago
iTerm warns you when you try to paste some text with a newline.
Raphmedia 10y ago
I do the same but use the browser's URL bar. It's closer than opening TextEdit.
tln 10y ago
I've started putting the preview step right inline with the curl bash instructions. curl -sL http://example.com/install.sh | less -eK && \ curl -sL http://example.com/install.sh | bash
- JadeNB 10y ago
  That still relies on the second `curl` fetching the same instructions as the first (an invariant that a really nasty web server wouldn't have to obey). Wouldn't it be better to use a `tee` to make sure that what you read with `less` is exactly what's executed?
  - JadeNB 10y ago
    (For what it's worth, it turns out that this sort of nefarious invariant disrespect was discussed at https://news.ycombinator.com/item?id=11532599 https://news.ycombinator.com/item?id=11532599 .)

by rbut 10y ago

drauh 10y ago

Or you could "View Source"

bbcbasic 10y ago
Yes look in this one first: all_ze_scripts.min.js (8mb).
- matt_kantor 10y ago
  I think drauh meant to copy the desired text from the source view, not to reverse-engineer the page to figure out its behavior.
  - bbcbasic 10y ago
    Ah!

nadaviv 10y ago

Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.

rbut 10y ago
To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
- bbcbasic 10y ago
  FTFY: To solve this, browsers should probably disallow modifying the clipboard .
  - Cthulhu_ 10y ago
    That would probably break a lot of WYSIWYG-like editors.
    - bbcbasic 10y ago
      Touche. Then maybe it should be like location you opt-in per domain, as another poster said in this discussion.
- Manishearth 10y ago
  They do. Browsers only let you intercept and tweak existing clipboard events.
danielweber 10y ago
If you're taking that step, then after you paste into the clean room, you copy out of the clean room.
- joombaga 10y ago
  At first I thought "I don't do this; it's never seemed necessary", but actually, I think I do. Years of copying to a plain text editor to strip formatting have conditioned the behavior.
  - TeMPOraL 10y ago
    Yeah, I started to copy through a text box (usually the Windows Run (Win+R) box, which isn't exactly safe now that I think of it...) to strip formatting some time ago. It's pretty much necessary whenever you want to paste anything into GMail web interface. The web is getting more ridiculous every day...
    - dsptri 10y ago
      ctrl+shift+v removes formatting directly when pasting

borski 10y ago

TextEdit is RTF by default - I wonder if you can include control characters to screw with that? I use Sublime/Atom since those are plaintext by default.

rbut 10y ago
Yes, switching TextEdit to default to Plain Text is the first thing I do after installing OSX.
- borski 10y ago
  Cool - just pointing this out since giving the advice to use TextEdit doesn't actually say 'in plain-text mode.' :)

nathancahill 10y ago

I use Quicksilver, and generally paste what I've copied there first. Also lets me strip the formatting, like pasting with Shift + Option + Command + V.

eelke 10y ago

iTerm warns you when you try to paste some text with a newline.

Raphmedia 10y ago

I do the same but use the browser's URL bar. It's closer than opening TextEdit.

tln 10y ago

I've started putting the preview step right inline with the curl bash instructions. curl -sL http://example.com/install.sh | less -eK && \ curl -sL http://example.com/install.sh | bash

JadeNB 10y ago
That still relies on the second `curl` fetching the same instructions as the first (an invariant that a really nasty web server wouldn't have to obey). Wouldn't it be better to use a `tee` to make sure that what you read with `less` is exactly what's executed?
- JadeNB 10y ago
  (For what it's worth, it turns out that this sort of nefarious invariant disrespect was discussed at https://news.ycombinator.com/item?id=11532599 https://news.ycombinator.com/item?id=11532599 .)