[{"data":1,"prerenderedAt":195},["ShallowReactive",2],{"project-12942607":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":41,"post_text":43,"what":44,"said":60,"maker_in_thread":126,"shape":128,"grid":132,"attempts":157,"same_week":158,"maker_shows":34,"maker_hidden":187,"reader_version":188,"card":189},"12942607","curl-tap-sh","Tap curl in your editor before it gets to sh","title","Show HN: Tap curl in your editor before it gets to sh","https:\u002F\u002Fgithub.com\u002FawalGarg\u002Fcurl-tap-sh","github.com","awalGarg",1479031023,2016,60,12,637,2264,29,"notable","dev_tools","shell script safety","cli",[24,25,26,27,28],"curl","shell script","curl pipe sh","code review","editor","debated",-0.063,{"positive":32,"neutral":32,"mixed":33,"critical":34},2,0,3,7,{"execution":37,"idea":39,"design":40},{"positive":38,"critical":38},1,{"positive":33,"critical":32},{"positive":38,"critical":33},[34,38,42,33,33,33,38,34,38,33,33,42],5,null,{"problem":45,"audience":43,"pricing":43,"motivation":43,"time_to_build":43,"stack":58,"openness":59,"stage":59,"team_size":59},{"value":46,"source":47,"evidence":48},"Lets you inspect a script downloaded with curl before piping it to sh","inferred",[49,51,55],{"id":50},"post",{"id":52,"by":53,"text":54},"12943567","semi-extrinsic","A much better feature is available in zsh, called safe-paste, that does this without the user having to insert \"tap\" or anything else manually. It relies on something called…",{"id":56,"by":53,"text":57},"12944374","Typical use case: * type \"curl \u003Cpaste>\" in zsh, vim opens with \"curl \u003Cpasted-url> * inspect URL, if OK in Normal mode do !!zsh\u003CCR> (I assume emacs can also somehow eval current…",[],"unknown",{"praise":61,"objections":70,"requests":100,"questions":101,"alternatives":112},[62],{"value":63,"source":64,"evidence":65},"Simple but nice","commenter",[66],{"id":67,"by":68,"text":69},"12943143","tambourine_man","Simple, but nice",[71,82,93],{"value":72,"source":64,"evidence":73},"Storing the whole file in an env variable is wasteful and breaks on null characters",[74,78],{"id":75,"by":76,"text":77},"12943802","robryk","Why do you create an env variable that contains the whole file in question when the editor returned success? Wouldn't something like: ``` cat \"$f\"; rm \"$f\" ``` not involve…",{"id":79,"by":80,"text":81},"12944395","0xmohit","Moreover, dumping the file into a variable doesn't seem to be a good idea if the file were to contain null characters.",{"value":83,"source":64,"evidence":84},"Not needed when moreutils vipe already does this",[85,89],{"id":86,"by":87,"text":88},"12943770","sdx23","I don't really see, why I'd install something from some github repository if I can get it from a moreutils package that I like to have installed anyway.",{"id":90,"by":91,"text":92},"12943886","geofft","I think you're specifically saying that the \"vipe\" command does this: http:\u002F\u002Fmanpages.ubuntu.com\u002Fmanpages\u002Fxenial\u002Fen\u002Fman1\u002Fvipe.1.html moreutils is great. Unfortunately, moreutils…",{"value":94,"source":64,"evidence":95},"Pasting is a different use case from curl piped to sh",[96],{"id":97,"by":98,"text":99},"12944019","tree_of_item","How is it better? Pasting is a totally different use case from `curl | sh`.",[],[102],{"value":103,"source":64,"evidence":104},"Does it have the same terminal escape sequence vulnerability as bracketed paste?",[105,109],{"id":106,"by":107,"text":108},"12943882","JadeNB","Bracketed paste mode can still be broken by a malicious web-site: https:\u002F\u002Fthejh.net\u002Fmisc\u002Fwebsite-terminal-copy-paste . Does this solution have the same vulnerability?",{"id":110,"by":53,"text":111},"12944415","Depends on the terminal emulator you're using, I believe. It (and not zsh) needs to filter out escape sequences.",[113,117],{"value":114,"source":64,"evidence":115},"zsh safe-paste plugin",[116],{"id":52,"by":53,"text":54},{"value":118,"source":64,"evidence":119},"moreutils vipe",[120,121,122],{"id":86,"by":87,"text":88},{"id":90,"by":91,"text":92},{"id":123,"by":124,"text":125},"12944320","OJFord","Then don't. `vipe` from `moreutils` is acknowledged in this project's readme. I don't have `moreutils` installed; it's plausible that someone might want just the single package,…",{"comments":33,"answered":33,"key":127},[],{"commenters":129,"max_depth":34,"maker_replies":33,"first_comment_mins":130,"lifespan_hours":131},10,192,8,[133,135,137,141,143,145,146,148,150,151,153,155],[75,33,34,134,76,33],"project\u002Fneutral\u002Fexecution",[79,33,38,136,80,33],"project\u002Fcritical\u002Fexecution",[138,33,42,139,140,33],"12944492","maker\u002Fpositive\u002Fexecution","littlepootis",[52,38,33,142,53,33],"other\u002Fneutral\u002Fidea",[106,38,33,144,107,33],"other\u002Fneutral\u002Fprivacy",[110,38,33,144,53,33],[97,38,38,147,98,33],"project\u002Fcritical\u002Fidea",[56,38,34,149,53,33],"project\u002Fneutral\u002Fidea",[86,32,38,147,87,33],[90,32,33,152,91,33],"other\u002Fneutral\u002Fnone",[123,32,33,154,124,33],"commenter\u002Fneutral\u002Fidea",[67,34,42,156,68,33],"project\u002Fpositive\u002Fdesign",[],[159,164,169,174,178,182],{"id":160,"name":161,"points":162,"category":163},"12958445","Primitive",798,"creative",{"id":165,"name":166,"points":167,"category":168},"12956243","Whosfiring",256,"web_saas",{"id":170,"name":171,"points":172,"category":173},"12940615","jamesbvaughan.com",238,"languages",{"id":175,"name":176,"points":177,"category":20},"12932592","Blink Shell for iOS",219,{"id":179,"name":180,"points":181,"category":20},"12921389","CloudRail",191,{"id":183,"name":184,"points":185,"category":186},"12938636","Gridmaster",188,"learning_science",false,"v2",{"id":190,"name":5,"line":6,"ai":187,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":191,"top":18,"kw":192,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":193,"url":9,"mix":194,"praise":63,"objection":72,"sub":21},12942607,-0.06,[24,25,26,27,28],"315000131005",[32,32,33,34],1793990950051]