3 ms·

I'm all for scripts to help set these things up fast, but never in a million years will i download some random .bat file to just click and run. Especially witho

I'm all for scripts to help set these things up fast, but never in a million years will i download some random .bat file to just click and run. Especially without documentation of each operation it's going to perform. I know i can just read the code, but i'm not skilled enough with windows to know if there's something else snuck in there or not.

marak830 11y ago
I agree, a little documentation would go a long way here. Id really like to read a post saying actually what it does too, it wouldbe interesting to see how effective it is.
- MaulingMonkey 11y ago
  What exactly should be documented? The commands? The service names? The DNS records being sinkholed? The redirect-to-127.0.0.1 trick? There are blog/post links in various comments in these files, I should note. I'm not sure how documentation would help with the "might sneak something in" issue either. If anything, if you're feeling paranoid / reasonably cautious, you should ignore the documentation in favor of documentation you source yourself - if you can't trust the author to write the commands, you can't trust the author's documentation of the commands either.
  - marak830 11y ago
    Honeatly if i was running 10, id have definatly run though it, sorry poorly worded on my behalf. I should have just said id like to read a post on what he has done, any negative effects it may have and if he thinks he missed anything.
lawnchair_larry 11y ago
Seriously? Did you even look at it?
- im3w1l 11y ago
  I agree that the scripts are very readable, but even if therobot24 might be able to understand them, there are many people who wont. Verifying it yourself doesn't work for the non-hacker crowd. The solution is that someone trustworthy vouches for the files.
y0ghur7_xxx 11y ago
> but never in a million years will i download some random .bat file to just click and run. I think that in this particular case you can trust the random bat file more than Microsofts official binary blob OS.
- cwyers 11y ago
  Why on Earth would you think that?
lcswi 11y ago
Is there no 'curl http://example.com/script.sh http://example.com/script.sh | sh' equivalent for windows? It's really popular among the typical js/ruby/mongodb crowd so I guess it is safe and secure.
- jholman 11y ago
  You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-agent, and so you're not getting the code you think you're getting... ... even aside from these issues, curl-and-pipe-to-sh is dangerous because of its failure modes. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
  - lcswi 11y ago
    I was sarcastic, thanks for that great link!
- lmz 11y ago
  You're joking, but of course there is such an equivalent. See instructions on https://chocolatey.org/ https://chocolatey.org/ for an example.
- mkup 11y ago
  There's no curl in default Windows installation, but "bitsadmin.exe /transfer" can do pretty much the same, and the shell (cmd.exe) has been around since Windows 95. So, actually, yes, but unfortunately without a pipe.

marak830 11y ago

I agree, a little documentation would go a long way here. Id really like to read a post saying actually what it does too, it wouldbe interesting to see how effective it is.

MaulingMonkey 11y ago
What exactly should be documented? The commands? The service names? The DNS records being sinkholed? The redirect-to-127.0.0.1 trick? There are blog/post links in various comments in these files, I should note. I'm not sure how documentation would help with the "might sneak something in" issue either. If anything, if you're feeling paranoid / reasonably cautious, you should ignore the documentation in favor of documentation you source yourself - if you can't trust the author to write the commands, you can't trust the author's documentation of the commands either.
- marak830 11y ago
  Honeatly if i was running 10, id have definatly run though it, sorry poorly worded on my behalf. I should have just said id like to read a post on what he has done, any negative effects it may have and if he thinks he missed anything.

lawnchair_larry 11y ago

Seriously? Did you even look at it?

im3w1l 11y ago
I agree that the scripts are very readable, but even if therobot24 might be able to understand them, there are many people who wont. Verifying it yourself doesn't work for the non-hacker crowd. The solution is that someone trustworthy vouches for the files.

y0ghur7_xxx 11y ago

> but never in a million years will i download some random .bat file to just click and run. I think that in this particular case you can trust the random bat file more than Microsofts official binary blob OS.

cwyers 11y ago
Why on Earth would you think that?

lcswi 11y ago

Is there no 'curl http://example.com/script.sh http://example.com/script.sh | sh' equivalent for windows? It's really popular among the typical js/ruby/mongodb crowd so I guess it is safe and secure.

jholman 11y ago
You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-agent, and so you're not getting the code you think you're getting... ... even aside from these issues, curl-and-pipe-to-sh is dangerous because of its failure modes. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
- lcswi 11y ago
  I was sarcastic, thanks for that great link!
lmz 11y ago
You're joking, but of course there is such an equivalent. See instructions on https://chocolatey.org/ https://chocolatey.org/ for an example.
mkup 11y ago
There's no curl in default Windows installation, but "bitsadmin.exe /transfer" can do pretty much the same, and the shell (cmd.exe) has been around since Windows 95. So, actually, yes, but unfortunately without a pipe.