2 ms·

Piping to your shell and piping to `man` are not the same thing. The really dangerous thing is copy/pasting from a browser to your terminal. Always do Ctrl-X C

Piping to your shell and piping to `man` are not the same thing. The really dangerous thing is copy/pasting from a browser to your terminal. Always do Ctrl-X Ctrl-E to open an editor, paste it in there, then inspect it before saving/closing the editor to run the command.

crtasm 3y ago
Never knew that shortcut, useful!
- godelski 3y ago
  I only recently learned of it myself despite being on nix for over a decade and reading many advanced bash shortcut blogs. IDK why it isn't well known. For zsh users see here: https://nuclearsquid.com/writings/edit-long-commands/ https://nuclearsquid.com/writings/edit-long-commands/ Note: this can be tricky depending on where it goes in your zshrc. If you use a plugin manager (like Sheldon) then this should be above that. I ended up with this and it works well on OSX and linux autoload -U edit-command-line # Emacs style (<C-x><C-e>) zle -N edit-command-line # make sure `set -o vi` is above this line bindkey '^xe' edit-command-line bindkey '^x^e' edit-command-line # (VIM) Use visual mode bindkey -M vicmd v edit-command-line
vladxyz 3y ago
Aren't they? Are you sure piping to 'man' can't result in arbitrary code execution? The two things you need to be able to say you trust are your CA store, and the source of your curl -> shell.
- globular-toast 3y ago
  No, they're not the same thing! It's not piping to your shell! The shell's single purpose is to execute code. Man is not supposed to do that and it would be considered a huge security issue if it could. In any case, how would you check the downloaded file? With a text editor? Are you sure that can't result in arbitrary code execution?
  - AlecSchueler 3y ago
    Man can run groff which can in turn run arbitrary subprocesses.
- johannes1234321 3y ago
  Even if it were: There is no practical difference. "Nobody" will inspect the man page using a different viewer first. So if I download to disk and then view via man or directly via man is no difference. A shell script one might inspect first using some viewer. While only few probably do.

crtasm 3y ago

Never knew that shortcut, useful!

godelski 3y ago
I only recently learned of it myself despite being on nix for over a decade and reading many advanced bash shortcut blogs. IDK why it isn't well known. For zsh users see here: https://nuclearsquid.com/writings/edit-long-commands/ https://nuclearsquid.com/writings/edit-long-commands/ Note: this can be tricky depending on where it goes in your zshrc. If you use a plugin manager (like Sheldon) then this should be above that. I ended up with this and it works well on OSX and linux autoload -U edit-command-line # Emacs style (<C-x><C-e>) zle -N edit-command-line # make sure `set -o vi` is above this line bindkey '^xe' edit-command-line bindkey '^x^e' edit-command-line # (VIM) Use visual mode bindkey -M vicmd v edit-command-line

vladxyz 3y ago

Aren't they? Are you sure piping to 'man' can't result in arbitrary code execution? The two things you need to be able to say you trust are your CA store, and the source of your curl -> shell.

globular-toast 3y ago
No, they're not the same thing! It's not piping to your shell! The shell's single purpose is to execute code. Man is not supposed to do that and it would be considered a huge security issue if it could. In any case, how would you check the downloaded file? With a text editor? Are you sure that can't result in arbitrary code execution?
- AlecSchueler 3y ago
  Man can run groff which can in turn run arbitrary subprocesses.
johannes1234321 3y ago
Even if it were: There is no practical difference. "Nobody" will inspect the man page using a different viewer first. So if I download to disk and then view via man or directly via man is no difference. A shell script one might inspect first using some viewer. While only few probably do.