4 ms·
Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijackin
by jjnoakes 6y ago
Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.
- klyrs 6y agoI distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?
- junon 6y agoBecause that's an unrealistic threat model for most users.
- deleted 6y ago[deleted]
- ipsin 6y agoI think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.
- junon 6y agoA browser extension is not a threat model, I'm not sure what you mean.
- klyrs 6y agoBrowser extensions are an attack surface, examination of which is a key aspect of threat modeling.
- krageon 6y agoIt depends on whether or not your threat model includes threats likely to exploit this attack surface. I'm assuming this is why GP said that a browser extension isn't a threat model.
- renewiltord 6y agoRealistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs. Fortunately, my terminal emulator doesn't run on paste.
- MereInterest 6y agoWhich terminal emulator do you use, and what happens if you paste something including newline characters?
- renewiltord 6y agoGnome Terminal 3.36.2 with Zsh The entire newline-inclusive text is pasted into the terminal and nothing is run until I hit Return. Input: https://pastebin.com/LpDW2r0d https://pastebin.com/LpDW2r0d Result: https://streamable.com/94z5oq https://streamable.com/94z5oq
- kevincox 6y agoBecause I just read the command on the site and I trusted my verification of the command. But if the site is nefarious it can adjust my copy so that I copy a mailious command rather than the one I verified.