Top all-time · #3191
Sean Cassidy
Personal blog · seancassidy.mesecurityprogramming
Sean Cassidy writes sean cassidy, a personal blog at seancassidy.me about security and programming. Since 2014, 24 different Hacker News readers have linked it 32 times, most often “Phishing attack against Lastpass”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (19) to say how often HN recommends it.?
Why HN links it
HN readers link this blog mainly for its 'Don't pipe to your shell' post on the risks of curl-to-bash installs, including dropped connections mid-download. It is also cited for posts on LastPass phishing.
Summarised by Claude from a sample of 19 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /dont-pipe-to-your-shell.html8 people · 8 mentions · first linked 2015-08-16
- /dont-pipe-to-your-shell.html4 people · 4 mentions · first linked 2014-12-27
- Phishing attack against Lastpass4 people · 4 mentions · first linked 2016-01-16
What Hacker News says?
The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…
Comment linking /dont-pipe-to-your-shell.html
on “Don't copy paste from a website to a terminal”Submitted Shortest bit sequence that's never been sent over the Internet (2017) as a story · 193 points
HN discussionhttps://news.ycombinator.com/item?id=6650987 https://blog.dijit.sh//don-t-pipe-curl-to-bash https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://www.seancassidy.me/dont-pipe-to-your-shell.html
Comment linking /dont-pipe-to-your-shell.html
on “Revolt: Open-source alternative to Discord”Submitted Phishing attack against Lastpass as a story · 157 points
HN discussionAs long as the extension UI is rendered where the page can also render something, it will be vulnerable to phishing. E.g. https://www.seancassidy.me/lostpass.html
Comment linking /lostpass.html
on “Grammarly shared its tokens with all websites”Submitted Phishing Simulations Considered Harmful as a story · 4 points
HN discussionNo, I'm sorry, I seriously don't understand how that applies in this case. How is "trusting the content you get from `apt-get`/`dpkg`/`pacman`" safer than curling-to-bash? In both cases, you are downloading and installing content from a trusted source (assuming you are curling via https to avoid MITMs). In the curl-to-bash case, you have the _ability_ to at least inspect the code first before you install it (though,…
Comment linking /dont-pipe-to-your-shell.html
on “BirdNET-Pi: Automated, locally run bird sound identification and tracking”Submitted Sherlock Holmes Debugging as a story · 4 points
HN discussionI'm pretty sure the OP is intentionally not doing this because piping commands/things-from-the-internet into "bash" (or anything else) is generally considered bad practice. For me, I'm all for this. Anyone that is aware of the security implications is extremely likely aware of how to make the conversion like you've provided. In that case, no reason to tell people, because they already know. But it's not a great thin…
Comment linking /dont-pipe-to-your-shell.html
on “Serving my blog posts as Linux manual pages”Submitted Meditations Redux as a story · 3 points
HN discussionThe more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https:/…
Comment linking /dont-pipe-to-your-shell.html
on “Pi-Hole: Why You Need a Network-Wide Ad-Blocker”Submitted Privilege as a story · 3 points
HN discussionEnpass user here since sheesh, probably 2016? It was whenever the 'LostPass' [1-2] security scandal broke and shortly after Logitech acquired LastPass, after which the usual 'corporate suck' had set in. I had used LastPass for a good seven or more years before switching to Enpass. Enpass has given me good cross platform support, especially like that I'm not a 2nd class citizen on loonix systems. My only gripe would…
Comment linking /lostpass.html
on “1Password delisting forum posts critical of their new Electron based 1Password 8”Submitted Code as Risk as a story · 3 points
HN discussion> No true blogger would wilfully misunderstand a buffer overrun vulnerability in order to score some cheap pageviews. You may want to read up on Ted, and realise that when he writes > if we don’t actually understand what vulnerabilities like Heartbleed are he's probably talking about you. > Basically, he's explicitly re-using a buffer, no buffer was overrun. Which is essentially what happened in heartbleed. Heartble…
Comment linking /diagnosis-of-the-openssl-heartbleed-bug.html
on “Heartbleed in Rust”Submitted Wiggle the mouse to fix the test (2013) as a story · 2 points
HN discussionA package manager. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://news.ycombinator.com/item?id=12766049 Bonus points: serving a different script to people piping to bash, and those not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
Comment linking /dont-pipe-to-your-shell.html
on “Babashka – A Clojure for the grey areas of Bash”Submitted Sherlock Holmes Debugging as a story · 2 points
HN discussion>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a s…
Comment linking /lostpass.html
on “Ask HN: What is your password management solution?”Submitted The Practice Startup as a story · 2 points
HN discussion<a href=" https://www.seancassidy.me/images/lastpass_login.png"><img src="/images/lostpass_login.png" I clicked on the thumbnail to examine it more closely, and was briefly confused, then amused that it pointed to the real one. I think this quite nicely shows why hiding the URL scheme is NOT a good idea; otherwise it would show this, which is far more obvious to indicate that the page is either from the extension or…
Comment linking /images/lastpass_login.png%22><img
on “Phishing attack against Lastpass”Submitted Host an infodump session (2014) as a story · 1 points
HN discussionThis article sums it up better than i can do. http://www.seancassidy.me/dont-pipe-to-your-shell.html
Comment linking /dont-pipe-to-your-shell.html
on “Show HN: Patchwork – Real-time notifications for OSS vulnerabilities”Submitted Seeding /dev/random with with with a $10 SDR receiver as a story · 1 points
HN discussionWould you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful? http://www.seancassidy.me/dont-pipe-to-your-shell.html
Comment linking /dont-pipe-to-your-shell.html
on “Show HN: Patchwork – Real-time notifications for OSS vulnerabilities”Submitted We, the Weapons as a story · 1 points
HN discussionhttps://www.seancassidy.me/dont-pipe-to-your-shell.html For one.
Comment linking /dont-pipe-to-your-shell.html
on “Emacs Live (2013)”> Aren’t abstractions supposed to make things easier to learn? Not always. Some abstractions are designed to make it easier to solve hard problems correctly (than without the abstraction). For example, consider Rust's memory model. Many people criticize that model as difficult to learn. By comparison, you might argue that C's memory model is simpler to learn. Yet, the C approach to allocating, using, and freeing mem…
Comment linking /diagnosis-of-the-openssl-heartbleed-bug.html
on “Tokio internals: Understanding Rust's async I/O framework”You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-…
Comment linking /dont-pipe-to-your-shell.html
on “Remove anti-privacy, anti-security, and general nuisance “features” from Win 10”I write down what I learn sorta like Marcus Aurelius did in his Meditations. I find it useful to revisit them every so often, not just to remind myself what I learned, but to see what I thought was important. https://www.seancassidy.me/meditations-redux.html
Comment linking /meditations-redux.html
on “Ask HN: Do you keep track of what you learn? how?”
![/images/lastpass_login.png%22><img](https://www.seancassidy.me/images/lastpass_login.png"><img){kind=link}