Hacker News Reader

Comment by jjnoakes | Hacker News Reader

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

View on HN

I distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?

Because that's an unrealistic threat model for most users.

I think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.

A browser extension is not a threat model, I'm not sure what you mean.

Browser extensions are an attack surface, examination of which is a key aspect of threat modeling.

It depends on whether or not your threat model includes threats likely to exploit this attack surface. I'm assuming this is why GP said that a browser extension isn't a threat model.

Realistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs.

Fortunately, my terminal emulator doesn't run on paste.

Which terminal emulator do you use, and what happens if you paste something including newline characters?

Gnome Terminal 3.36.2 with Zsh

The entire newline-inclusive text is pasted into the terminal and nothing is run until I hit Return.

Input: https://pastebin.com/LpDW2r0d

Result: https://streamable.com/94z5oq

Because I just read the command on the site and I trusted my verification of the command.

But if the site is nefarious it can adjust my copy so that I copy a mailious command rather than the one I verified.

Reply on news.ycombinator.com