Hacker News Reader

Comment by comex | Hacker News Reader

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

View on HN

The person who wrote the line of code is not necessarily the same as the person who owns the git repository.

You can trust "Person A", the owner of the repository, while not trusting "Person B", who wrote the "git clone (Person A's repository)" on their site.

But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git"

I know what "git clone" does, and I do trust code from git.kernel.org.

Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.

i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from. if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.

But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.

It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.

Reply on news.ycombinator.com