4 ms·

Is there a more comphesensive list of command line options that can be abused in argument injection attacks?

• jacquesm 8y ago
  One nasty trick is web pages that show a benign code snippet that expands to something evil upon being cut-and-pasted.
  • craftyguy 8y ago
    or my personal favorite are folks who recommend this crap: curl https://<whatever> | bash
    • Spivak 8y ago
      This really isn't as bad and people make it seem. If you're trusting the vendor and aren't going to read the code anyway it's no less safe than installing a package. I don't like installations like this because they're messy, hard to track, harder to clean up, don't lend themselves to mass deployments, don't provide any integrity verification, the list goes on, but they're not particularly unsafe. These things exist because there aren't good package that don't require root. Maybe we'll get there eventually.
      • craftyguy 8y ago
        > If you're trusting the vendor Yea, because urls and websites never change! And http can never be compromised! (nope) > but they're not particularly unsafe. Arbitrary execution is never safe! > These things exist because there aren't good package that don't require root. Maybe we'll get there eventually. Well, depending on the language, there are (e.g. pip crap). But maybe folks should produce packages that maintainers can, well, maintain.
      • jwilk 8y ago
        One nasty thing about piping to shell is that the server can detect that this is happening: https://news.ycombinator.com/item?id=11532599 https://news.ycombinator.com/item?id=11532599