Hacker News Reader

Comment by TacticalCoder | Hacker News Reader

> "read scripts before you run them" is a good bit of advice.

I always read the script and do also verify they're only using ASCII chars (and if they're not, I check which Unicode shenanigan is ongoing).

For example:

    ... $ file /usr/local/bin/somescript.sh 
    /usr/local/bin/somescript.sh: Bourne-Again shell script, ASCII text executable

FWIW most of the scripts out there are only ever using ASCII chars.

View on HN

How do you check it without running something that may execute it? Many scripts will execute if opened with vi or even cat or printf from what I understand.

Source for executing files with cat? That certainly defies my understand of how cat works.

Maybe they mean that it can include control characters that mess up your terminal and make it look like something malicious is happening, which of course is not the same as executing it (and has a warning anyway).

> Many scripts will execute if opened with vi

I haven't encountered this. You can execute scripts intentionally in vi, and I assume you could configure it to happen automatically, but can this happen without you making some sort of effort to enable it?

What scripts present such a risk? What vi configuration is required to stop this?

Same question wrt cat.

(n)vi(m), cat, less/more do not execute scripts on read. That would be utterly insane.

Reply on news.ycombinator.com