Top all-time · #1078
thejh.net
Personal blog · thejh.netprogrammingsecurity
thejh.net is a personal blog at thejh.net about programming and security. Since 2013, 62 different Hacker News readers have linked it 78 times, most often “Don't Copy-Paste from Website to Terminal”. No feed was found, so read it on the site itself.
Rarely recommended · 0 of 40 sampled comments recommend it?
Why HN links it
HN readers link this short page as a demonstration that text copied from a web page can differ from what is shown, so pasting commands into a terminal is risky.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Don't Copy-Paste from Website to Terminal37 people · 39 mentions · first linked 2013-04-07
- Copy-Paste from Website to Terminal20 people · 30 mentions · first linked 2015-06-13
- Want to use my wifi? (2013)2 people · 2 mentions · first linked 2018-01-04
What Hacker News says?
No, you don't: http://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “The sad state of sysadmin in the age of containers”Submitted Don't Copy-Paste from Website to Terminal as a story · 689 points
HN discussionWell there are attacks in the vein of this: https://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Firefox makes click-to-activate Flash the default”Submitted Don't copy paste from a website to a terminal as a story · 665 points
HN discussionOoh goodie, we get to re-open the argument about whether it was bad of GitHub to publish the public keys![1] Pick your talking points: "They're called public for a reason.", "This could enable identity tracking.", "If your security model prefers public keys to be kept secret, it's absurd -- security by obscurity.", "This could enable factoring weak keys.", "This is good for security research.", "It's wrong to reveal…
Comment linking /misc/website-terminal-copy-paste
on “Show HN: My SSH server knows who you are”Submitted Want to use my wifi? (2013) as a story · 125 points
HN discussionThis can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942
Comment linking /misc/website-terminal-copy-paste
on “Permission.site”Submitted Want to use my wifi? as a story · 94 points
HN discussionhttps://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Be careful what you copy: Invisibly inserting usernames into text”Submitted Reduce bandwidth usage of PNG transfers over HTTP with this one weird trick as a story · 3 points
HN discussion- y7 · 2016-05-24
Even if browsers didn't allow changing the clipboard, there's still this older problem: http://thejh.net/misc/website-terminal-copy-paste The solution is definitely to avoid pasting commands with newlines in them into your terminal. With Vim, you can use the + register to paste (e.g. "+p). Using iTerm on OS X, I've added a custom keymap for Cmd+V, bound to Run coprocess: pbpaste | tr -d "\n" which filters out the ne…
Comment linking /misc/website-terminal-copy-paste
on “Pastejacking” Submitted Want to use my wifi? as a story · 3 points
HN discussionI initially thought it'd work, but actually, this protection can be circumvented. See the updated version of http://thejh.net/misc/website-terminal-copy-paste .
Comment linking /misc/website-terminal-copy-paste
on “Don't Copy-Paste from Website to Terminal”Submitted OpenSSH 6.8 X11 Security bug as a story · 2 points
HN discussionAlternative method: click the big on/off switch for online search results. Don't get me wrong -- I'm not defending Ubuntu. I think it's gross that they include this at all, and extra-gross that it's on by default. But let's not get too carried away with the hyperbole and conspiracy theories. Just read the source! Or if you don't trust the source, just examine your network traffic. Pretty easy to verify whether the b…
Comment linking /misc/website-terminal-copy-paste
on “Fix Ubuntu”Submitted Unicode Underliner as a story · 2 points
HN discussionWhy you shouldn't paste code from websites directly into terminal: http://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Fix Ubuntu”Submitted Copy-Paste from Website to Terminal as a story · 1 points
HN discussionThis is a neat idea. I won't comment on the name--but observations on the tool: Looks like anyone can submit examples to this. Users need to be very careful before blindly copy-pasting the "example" scripts into their shell. Hopefully the voting system will remedy this, but that's not guaranteed. While not nearly as dangerous as copy-pasting from the browser[1], still proceed with caution. [1] http://thejh.net/misc/…
Comment linking /misc/website-terminal-copy-paste
on “Bro pages: like man pages, but with examples only”Submitted Don't copy-paste from a website to a terminal (2013) as a story · 1 points
HN discussionI feel like they should state this first before giving the command. I had to scroll down the page to see this warning. Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Pi-hole – A black hole for Internet advertisements”Submitted Copy-Paste from Website to Terminal as a story · 1 points
HN discussionSince copy-pasting to the terminal is also unsafe[1], it's not really a solution... At any rate - code-signing doesn't really help if the author is the attacker. [1] http://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Detecting the use of "curl | bash" server-side”Submitted Don't Copy-Paste from Website to Terminal as a story · 1 points
HN discussionIntegrity protection. There are a lot of ways to instruct someone to configure their web server in a way that is subtly insecure, not to mention attacks like http://thejh.net/misc/website-terminal-copy-paste It'd be slightly nice if we were able to have integrity-protected HTTP without encryption (lower overhead, easier debugging with packet dumps), but the advantages are minimal (ciphers are not really the overhead…
Comment linking /misc/website-terminal-copy-paste
on “Google Will Soon Shame All Websites That Are Unencrypted”Submitted Copy Paste from Website to Terminal as a story · 1 points
HN discussionhttps://github.com/thejh https://thejh.net/ https://twitter.com/tehjh
Comment linking /
on “LLVM patch to fix half of Spectre attack”Submitted Do Not Copy and Paste from a Website to Your Terminal as a story · 1 points
HN discussionWhy not to copy and paste: 1) what you paste might not be exactly what you copied. i.e: http://thejh.net/misc/website-terminal-copy-paste 2) possible licensing issues 3) it enables cargo cult programming
Comment linking /misc/website-terminal-copy-paste
on “Why Create a New Unix Shell?”Please note that copying and pasting commands from a web browser into a terminal can result in malicious code being executed. A good idea to double check using a text editor. http://thejh.net/misc/website-terminal-copy-paste
Comment linking /misc/website-terminal-copy-paste
on “Why Create a New Unix Shell?”
