Hacker News Reader

Comment by HKH2 | Hacker News Reader

So YouTube is setting environment variables for people who don't do shell quoting. Next they can add "&reboot" to all their URLs.

View on HN

What? Look at the URL in your browser right now. It has a bunch of x=y parameters. That's how URLs work.

The parent comment is talking about what would happen if, for example, you typed this in bash to try to download a video:

$ youtube-dl https://www.youtube.com/watch?v=dQw4w9WgXcQ&pp=sAQA

In this case, bash would interpret it as "run youtube-dl in the background with the parameter 'https://www.youtube.com/watch?v=dQw4w9WgXcQ', then execute the command 'pp=sAQA' to set the 'pp' variable".

The comment is joking that if YouTube decided to replace "pp=sAWA" with "reboot", they could get a lot of people to accidentally reboot their machines instead because they didn't quote the URL.

That was always a problem if you just copy-and-pasted URLs into your terminal. You need to quote them. It's not new.

It used to work in bash but doesn't in zsh

....&foo=BAR

sets a shell variable, not an environment variable. The value of $foo will not be available to shell-forked processes.

This is how you append query params to a url - nothing to do with the shell.

The GP complained about shell quoting.

I doubt it is YouTube's intention to require people start quote URLs in shell, though.

curl http://foo.com?x=1&rm -rf ~/

That's hilarious

Reply on news.ycombinator.com