If you less this txt file, your terminal plays a sound | Hacker News Reader

If you less this txt file, your terminal plays a sound

gist.github.com

That's nothing- run `curl https://xmppwocky.net/curlme.txt` on, say, OS X Terminal.app (and a lot of Linux terminal emulators, too) and your terminal window will do things like steal focus, maximize and minimize repeatedly, move around the screen...

(don't do this on a terminal you care about! on some older versions of OS X, this would hard-lock the entire UI (for all apps, requiring a reboot or something!), but these days it's sufficient to force-quit Terminal)

There's some wacky stuff out there: https://www.xfree86.org/current/ctlseqs.html

Not an issue with XTerm and IceWM.

> If you less this txt file, your terminal plays a sound

Actually, no it does not. My less displays the bell characters as ^G instead of showing them as raw.

Whether you hear the bell, or simply see ^G, depends upon how you have less configured. I leave mine configured to use the caret notation for control characters (which for my version of less, is also the default).

This is Hacker News? A file with ^G in it makes the terminal play a sound?

There's a lot of people in today's lucky 10,000[1]. "Terminal Bell" is a rarely used feature nowadays, because we've grown out of it, and yet - It's commonly supported. Hopefully from this a few young hackers will get the itch to go a little deeper into how our terminals are represented.

[1]https://xkcd.com/1053/

I remember learning about this in the 80's, when I got my first modem.

I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, could I get it to somehow type ‘rm -rf /‘?

Not unless your shell or terminal emulator somehow have custom escape codes that can do that, no.

Define "custom"

E.g. iterm2 has a set of custom escapes that control aspects about the window.

https://iterm2.com/documentation-escape-codes.html

Probably. Might depend on your terminal emulator. See, for instance, CVE-2019-9535

Modern terminals are not supposed to allow things like this (though there are bugs!)

There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)

Yeah I'm not a fan of the shell script piped to bash trend in readme files.

I don't understand why they can't just distribute a package with the same install script.

That’s not what I’m questioning at all, but it’s an invalid threat model unless you’ve audited every other file in the wider application

That's because it has the beep character, which is non-visible, on lines 3 through 7

The beep character is control-g, ASCII 0x07

Person learns about the bell character, more at eleven.

I'm guessing it contains https://en.wikipedia.org/wiki/Bell_character ?

A good reminder to practice good opsec to be weary of packages that instruct you to `curl <url> | bash`. You never know what you're running.

Worse, it is possible for the server to detect that you are doing that [1]. It could serve you malicious code when you "curl | bash" and then afterwards when you go to download a copy of the script to try to figure out what the heck it did the server could serve you benign code.

[1] https://news.ycombinator.com/item?id=17636032

Oh wow that is good.

Jokes on you my volume is off.

0x07 = Bell

Reply on news.ycombinator.com