Charlie Robbins writes about developer tools, terminals, Ruby, Node, and Go, including bracketed paste mode and the CONL config format.
HN commenters link his bracketed paste mode explainer for terminal paste attacks, and also cite his CONL config format and his MVC post.
The issue is mostly with git itself, e.g. take a look at
git cat-file commit HEAD to see something like:
tree <tree-hash> parent <parent-hash> author <author-name> <author-email> <timestamp> committer <committer-name> <committer-email> <timestamp> gpgsig -----BEGIN PGP SIGNATURE----- <ascii-armored RFC9580 signature> -----END PGP SIGNATURE----- <commit message> You can view an example of the structure of this ascii-armored signature here <https://cirw.in/gpg-decoder/#-----BEGIN%20PGP%20SIGNATURE-----%0A%0AiF4EABYIAAYFAlX5X5UACgkQjP3hIZeWWpr2IgD%2FVvkMypjiECY3vZg%2F2xbBMd%2FS%0Aftgr9N3lYG4NdWrtM2YBANCcT6EVJ%2FA44PV%2FIgHYLy6iyQMyZfps60iehUuuYbQE%0A-----END%20PGP%20SIGNATURE----->.
You can add a patch to git to support more signature types than just OpenPGP. You may then be able to move mountains and get GitHub/others to join in the validation. Finally, if you can find bugs/exploits in GnuPG, you should report them and you will definitely get credit and recognition for them. They are not trivial to find.
Some terminal emulators / shells use some heuristics, but the most reliable way is to use a combination of a terminal emulator and shell that support bracketed paste mode. This article (https://cirw.in/blog/bracketed-paste) lists some terminal emulators that supports bracketed paste, and a zsh plugin that makes zsh handle bracketed paste in a safe manner.
As an alternative to zsh, Elvish (https://github.com/elves/elvish) supports bracketed paste out of the box. When you paste anything that includes a carriage return, Elvish will insert a literal return instead of executing it.
(Disclaimer: I am the author of Elvish.)
> Aside: Is there a similar tool for macOS?
I don't know the state of Windows terminal emulators, but it seems strange to describe the problem without mentioning the term for the solution, which is 'bracketed paste'. This article discusses how bracketed-paste mode is signalled using ANSI escape sequences, which I guess can work in most macOS terminal emulators (although it's up to the shell to respond): https://cirw.in/blog/bracketed-paste . (I guess that Win+Ins is doing something similar on Windows?)
Quadruple-click smart selection should be doable with urxt's perl extension feature.
Selecting within a tmux pane: you got me on that one. I'm not aware of a terminal that does that, but again, it should be possible to do with urxvt's perl extension feature.
Regarding the "safer command line paste", Linux can do the same with bracketed paste mode.[1]
For splitting panes, I just use tmux, vim, or emacs.
[1] - https://cirw.in/blog/bracketed-paste
I am gonna leave this here.
https://cirw.in/blog/bracketed-paste
It is not that "I think" it is objectively more efficient and easier to read, yes this has been studied before.
I agree that going too narrow increases scrolling and it's annoying. (Widescreens are a stupid trend)
Turn on bracketed paste mode everywhere. Doesn’t help with homograph attacks (e.g. an IDN homograph attack tricking you into downloading something from the wrong domain), but at least you’re totally safe until you press enter to execute.
https://cirw.in/blog/bracketed-paste