Hacker News Reader

Comment by rbut | Hacker News Reader

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal.

While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

View on HN

Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.

To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.

FTFY:

To solve this, browsers should probably disallow modifying the clipboard .

That would probably break a lot of WYSIWYG-like editors.

Touche. Then maybe it should be like location you opt-in per domain, as another poster said in this discussion.

They do. Browsers only let you intercept and tweak existing clipboard events.

If you're taking that step, then after you paste into the clean room, you copy out of the clean room.

At first I thought "I don't do this; it's never seemed necessary", but actually, I think I do. Years of copying to a plain text editor to strip formatting have conditioned the behavior.

Yeah, I started to copy through a text box (usually the Windows Run (Win+R) box, which isn't exactly safe now that I think of it...) to strip formatting some time ago. It's pretty much necessary whenever you want to paste anything into GMail web interface. The web is getting more ridiculous every day...

ctrl+shift+v removes formatting directly when pasting

TextEdit is RTF by default - I wonder if you can include control characters to screw with that? I use Sublime/Atom since those are plaintext by default.

Yes, switching TextEdit to default to Plain Text is the first thing I do after installing OSX.

Cool - just pointing this out since giving the advice to use TextEdit doesn't actually say 'in plain-text mode.' :)

I've started putting the preview step right inline with the curl bash instructions.

    curl -sL http://example.com/install.sh | less -eK && \
    curl -sL http://example.com/install.sh | bash

That still relies on the second `curl` fetching the same instructions as the first (an invariant that a really nasty web server wouldn't have to obey). Wouldn't it be better to use a `tee` to make sure that what you read with `less` is exactly what's executed?

(For what it's worth, it turns out that this sort of nefarious invariant disrespect was discussed at https://news.ycombinator.com/item?id=11532599 .)

I use Quicksilver, and generally paste what I've copied there first. Also lets me strip the formatting, like pasting with Shift + Option + Command + V.

I do the same but use the browser's URL bar. It's closer than opening TextEdit.

Or you could "View Source"

Yes look in this one first: all_ze_scripts.min.js (8mb).

I think drauh meant to copy the desired text from the source view, not to reverse-engineer the page to figure out its behavior.

Ah!

iTerm warns you when you try to paste some text with a newline.

Reply on news.ycombinator.com