URL is also a shell script that executes some malicious(?) code

It's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.

Please tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I've always just pasted into a text editor and recopied it from there (and even that may not be safe). On one hand, UN*X is not meant to have paste so you should just never use it. On the other hand, if you're using webshit you have to copy from it because there's no UN*X way to get at the data as the page has to be accessed in a proprietary way. On the other hand, I could just use a real OS that doesn't have deep reaching problems in the most basic things

(reply to sibling comment from unixbane which is [dead] for some reason:)

> tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that.

I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post:

- I know how string quoting in programming languages broadly works (no need to know if ' or " escapes or not - just know that if there's any quotes inside the string it deserves a closer look)

- I know that $ in bash (& some other languages) precedes something dynamic (maybe variable substitution, maybe inline code, no need to know about stuff in any detail, just enough to be suspicious)

- I know pipe chars in shells generally separate commands (no need to understand io redirection in any detail here)

- I know that URLs tend to follow boring conventions - if it's not domain/alphanum/alphanum?alphanum=etc then it's suspect and needs further attention (URLs can contain many weird chars but normal ones tend not to).

The above bullets are pretty basic imo - you don't need to be a bash wizard to grok that much. If you know these, you'd never run the one-liner shown in the OP.

Extra:

- if it's a one-liner crossing scroll boundaries, that's too long (excepting very long URLs maybe if they're super-simple)

As a counter-example, here's the type of stuff most people copypaste into shells all the time:

  curl http://example.com/simple/path | bash

That's interesting here for two reasons:

1. as an inline threat, it's clearly harmless - the URL has no unusual special chars or $ and the command is very short - it can be read & grokked at a glance.

2. as a general threat, this is very dangerous because (a) it's unencryped/MITM-able and (b) you may or may not trust the hosted script being downloaded and eval-ed on your machine.

My overall point here is: there's plenty of valid & dangerous social engineering threats in your terminal; plainly obvious inline quoting problems ain't it.

and even worse: if you find a snippey of code online, once you read it carefully and you understand that it is safe to run - you might be lazy enough to copy it from the browser and paste it in the terminal. And it can be altered with JS before you copy it so you paste something different from what you have inspected. Of course you can use a buffer (say, a text editor) or even re-type that snippet yourself - but are you sure you'll never forget to do that?

True, though in practice if I'm scripting the loop body is more like `x=$(curl -Ss "${url}") && dothing "$x" && …`

If you curl | bash from http, you may get MITM'd because you're not checking the checksum. Most modern package managers at least check that what was downloaded is indeed what the original developer intended, so it's slightly better.

> If a carpenter chops his fingers off, it's not the fault of the saw.

That would be an effective argument, but this vile shit has existed for decades without being fixed, for no good reason. This saw is specifically designed to slice fingers off, rather than do useful work, for no reason.

> Having a base level expectation of competence for operators is normal.

UNIX expects perfection, while providing none of its own.

> A separate text input is just stdin by another name.

No, nitwit, it prevents in-band signalling, which is the entire problem here.

Anyway, I use Emacs for everything, and don't have these issues. With wget, I use -i - to enter multiple URLs at once, but it would also defeat this.

> last paragraph

You can't safely paste anything into the shell ever lol. For multiple reasons. It doesn't matter how much visual inspection you do.

$ also gets escaped automatically for me if pasted