Hacker News Reader

Comment by franciscop | Hacker News Reader

Okay this is pretty cool, I can set up so `.js` files are opened automatically with Node.js:

    $ alias -s js=node
    $ echo "console.log('Hello world')" > demo.js
    $ demo.js
    Hello world

View on HN

This seems like a good way to accidently run abitrary code downloaded from the internet.

I can see opening up in an editor as useful shortcut. But actually executing code without an executable bit seems a bit more dangerous.

Really? Last time I downloaded a .js file by accident was never if my memory doesn't fail me (.html I remember a couple). Even if I did, I normally use the UI to manage my files. The only time I might try to do something with the CLI and a JS file is exactly to run `node file.js`, and this is just a convenience.

Worse, imagine if someone set their shell as the suffix alias for .sh, just to save time on their curl shell pipes... Oh the horror. Suffix aliases should come with a big caveat.

Don't worry. I got you.

    alias -s sh='_c(){ curl -sk $1 | sudo bash };_c'

Wait. Improved.

    alias -s sh='_c(){ [[ -f $1 ]] && sudo bash $1 || curl -sk $1 | sudo bash };_c'

You can do something similar with a shebang and chmod +x.

...and even in a safe way.

But then you need the cooperation of every file to include the shebang line. Muuch easier to just

    echo :js:E::0::/usr/bin/node: >/proc/sys/fs/binfmt_misc/register

Yes suffix aliases are super useful

Reply on news.ycombinator.com