Hacker News Reader

Comment by dedward | Hacker News Reader

Paste into a text buffer first, which is generally a good idea anyway to deal with formatting issues.

I do that regardless because I'm super paranoid about stuff like this but I'm really wondering if I'm not taking it a bit too far. I've also yet to run into any kind of attempt to pull a stunt like this in a very long time of activity so I'm wondering what the actual incidence is.

I generally find it worth it for the simple risk that you may end up breaking stuff without anything malicious on behalf of the site.

E.g. cut and paste a command and get a linebreak in the wrong location and the "rm -rf /var/tmp/foo" turns into "rm -rf /var/". Fun times.

These days I'm more and more often just spinning up temporary containers as well. Not so much for security as to avoid making a mess of my environment with all the stuff I'm testing. So trivial to start out with a "docker run --rm -t -i ubuntu -v /some/suitable/host/dir:/mnt /bin/bash -l" or similar to get a fresh container with a directory I can dump anything I decide I want to keep in.

> docker run --rm -t -i ubuntu -v /some/suitable/host/dir:/mnt /bin/bash -l

So is it safe to cut-and-paste that line there ;) ?

I type very fast but if I see a 100+ character line with a whole bunch of flags and what not the chances of introducing a fatality while re-typing it (was that / var or /var?) are quite large.

And of course anything that involves 'rm' or other nice and friendly commands gets an extra eyeball but at some point you have to decide to pull the trigger or not.

If you know any docker, that line is pretty basic, so you shouldn't copy-paste it, just write it from scratch:

docker run -it --rm -v `pwd`:/mnt ubuntu bash

Also, this one works, the other one doesn't ;)

I do not do that. I have copied and pasted git clone commands directly in my terminals many times. The questions is, for those who do it, how often you notice a malicious command and this saves your day.

I've never encountered a malicious command in the wild, but having the commands I execute saved in a "notes.txt" or a wiki page I keep to document whatever I'm doing at any given time, sure has saved my day more than once. Usually several days after, when I can look back at what I did and replicate, fix or enhance whatever procedure.

So if it also protects me against this, I say doubleplusgood.

Reply on news.ycombinator.com