Hacker News Reader

Comment by klyrs | Hacker News Reader

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

View on HN

newer versions of gnome-terminal have a feature where it will hold your paste buffer in the linefeed before executing anything, does not matter how long or how many line breaks there are. You can then inspect what you just paste into the terminal, even edit it, before actually executing it.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

I distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?

Because that's an unrealistic threat model for most users.

I think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.

A browser extension is not a threat model, I'm not sure what you mean.

Browser extensions are an attack surface, examination of which is a key aspect of threat modeling.

It depends on whether or not your threat model includes threats likely to exploit this attack surface. I'm assuming this is why GP said that a browser extension isn't a threat model.

Realistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs.

Fortunately, my terminal emulator doesn't run on paste.

Which terminal emulator do you use, and what happens if you paste something including newline characters?

Gnome Terminal 3.36.2 with Zsh

The entire newline-inclusive text is pasted into the terminal and nothing is run until I hit Return.

Input: https://pastebin.com/LpDW2r0d

Result: https://streamable.com/94z5oq

Because I just read the command on the site and I trusted my verification of the command.

But if the site is nefarious it can adjust my copy so that I copy a mailious command rather than the one I verified.

Open your shell prompt, press ^X^E, paste the script into the opened editor. Check it for anything malicious, save and exit (or exit without saving if you don't want to execute it). The shell will execute the script.

Reply on news.ycombinator.com