Hacker News new | ask | show | jobs
by lucideer 1379 days ago
(reply to sibling comment from unixbane which is [dead] for some reason:)

> tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that.

I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post:

- I know how string quoting in programming languages broadly works (no need to know if ' or " escapes or not - just know that if there's any quotes inside the string it deserves a closer look)

- I know that $ in bash (& some other languages) precedes something dynamic (maybe variable substitution, maybe inline code, no need to know about stuff in any detail, just enough to be suspicious)

- I know pipe chars in shells generally separate commands (no need to understand io redirection in any detail here)

- I know that URLs tend to follow boring conventions - if it's not domain/alphanum/alphanum?alphanum=etc then it's suspect and needs further attention (URLs can contain many weird chars but normal ones tend not to).

The above bullets are pretty basic imo - you don't need to be a bash wizard to grok that much. If you know these, you'd never run the one-liner shown in the OP.

Extra:

- if it's a one-liner crossing scroll boundaries, that's too long (excepting very long URLs maybe if they're super-simple)

As a counter-example, here's the type of stuff most people copypaste into shells all the time:

  curl http://example.com/simple/path | bash
That's interesting here for two reasons:

1. as an inline threat, it's clearly harmless - the URL has no unusual special chars or $ and the command is very short - it can be read & grokked at a glance.

2. as a general threat, this is very dangerous because (a) it's unencryped/MITM-able and (b) you may or may not trust the hosted script being downloaded and eval-ed on your machine.

My overall point here is: there's plenty of valid & dangerous social engineering threats in your terminal; plainly obvious inline quoting problems ain't it.

2 comments

Usually its https nowadays but other than that there's methods a hostile webserver can detect whether the content is piped or not (IIRC I/O speed). It can decide to inject different commands based on whether it is piped or not. So you need to end up writing to a file with redirect or tee. Or by using a hash of the script. We do that with binaries, why not with scripts? If its complex enough, a shell script should be considered source code.
You can click the date of the post and then “vouch” if the post seems legitimate (I’ve done that for you now).
Thanks. I had done that but it doesn't fix ability to reply (at least not automatically - perhaps it summons mod intervention?)