5 ms·

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of ot

by comex 14y ago

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

gizmo686 14y ago
But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.
- gyepi 14y ago
  Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.
  - 38leinad 14y ago
    i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from. if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.
- shakesbeard 14y ago
  But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.
johnchristopher 14y ago
It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.
fragsworth 14y ago
The person who wrote the line of code is not necessarily the same as the person who owns the git repository. You can trust "Person A", the owner of the repository, while not trusting "Person B", who wrote the "git clone (Person A's repository)" on their site.

5 ms·

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of ot

by comex 14y ago

gizmo686 14y ago
But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.
- gyepi 14y ago
  Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.
  - 38leinad 14y ago
    i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from. if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.
- shakesbeard 14y ago
  But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.
johnchristopher 14y ago
It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.
fragsworth 14y ago
The person who wrote the line of code is not necessarily the same as the person who owns the git repository. You can trust "Person A", the owner of the repository, while not trusting "Person B", who wrote the "git clone (Person A's repository)" on their site.