9 ms·

The thing I don't see in this article, which I do regard as (another) drawback to curl|bash is that you're not just trusting the software developer, you're also

The thing I don't see in this article, which I do regard as (another) drawback to curl|bash is that you're not just trusting the software developer, you're also trusting their hosting provider. Anyone who gets access to modify that script on their server can change the content. Now it could be that they're hosting on a dedicated system, in a datacentre that they own, with no 3rd party access, but that's very much not the norm for most companies these days, and it's impossible for a customer to verify. This is a problem which is solved with good package signing practices, where the developer signs the content on a system they control before distribution, so at least you can verify that what you're installing is what they released.

FooBarWidget 11y ago
How is that an argument against curl|bash? If you download a source tarball from the developer's website, then you are also trusting their hosting provider. curl|bash changes nothing.
- creshal 11y ago
  A source tarball can (and should!) be checked against GPG signatures et. al. With curl|bash you have nothing.
  - FooBarWidget 11y ago
    A bash script can be signed too. See article. How many projects provide GPG signatures for their tarballs? How often do you check signatures on tarballs?
    - 4ad 11y ago
      > How often do you check signatures? Every time you run apt-get. So the answer is almost every time.
      - FooBarWidget 11y ago
        The context of the comment is source tarballs. How often do you check the signatures on random tar.gz you download?
        4ad 11y ago
        tar.gz vs. curl|bash is a false dichotomy, there is no reason for either. We have better ways to install software these days. And yes, when I download tar.gz (e.g. when I am responsible of managing my own packages) I do check the signatures. You should, too.
        tokenizerrr 11y ago
        Could you point me to the better way of installing software that will work on all Linux distros?
        stephenr 11y ago
        District-appropriate packages. Use the right fucking tool for the job.
        tokenizerrr 11y ago
        That will not work on all Linux distros. That is writing a specific installer for each distro, which does not satisfy my requirements and as such is not the right tool for the job.
        stephenr 11y ago
        > That will not work on all Linux distros The result of the work to create packages using the major packaging formats will produce a series of packages that combined, will arguably work better, on more distros than your home-grown installer. > That is writing a specific installer What makes you think creating e.g. a debian package equates to "writing a specific installer". The whole point of packages is that you don't "write an installer" you provide an existing installer (the package manager/package installer) with information about what to install where.
    - raesene4 11y ago
      This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps. Looking at Dockers deployment of Content Trust as an example of this. You still have a trust decision on first use, but it's better protection than nothing.
      - kentonv 11y ago
        > You still have a trust decision on first use, but it's better protection than nothing. That's what you're getting by curl|bashing sandstorm today (if you skip the PGP verification step). Once installed the updater verifies signatures automatically.
- raesene4 11y ago
  I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed. curl|bash ing a script does not provide this protection.
  - superuser2 11y ago
    Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.
    - p4bl0 11y ago
      You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
      - throwaway7767 11y ago
        Also, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.
  - zokier 11y ago
    Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...
    - deleted 11y ago
      [deleted]
    - raesene4 11y ago
deleted 11y ago
[deleted]

FooBarWidget 11y ago

How is that an argument against curl|bash? If you download a source tarball from the developer's website, then you are also trusting their hosting provider. curl|bash changes nothing.

creshal 11y ago
A source tarball can (and should!) be checked against GPG signatures et. al. With curl|bash you have nothing.
- FooBarWidget 11y ago
  A bash script can be signed too. See article. How many projects provide GPG signatures for their tarballs? How often do you check signatures on tarballs?
  - 4ad 11y ago
    > How often do you check signatures? Every time you run apt-get. So the answer is almost every time.
    - FooBarWidget 11y ago
      The context of the comment is source tarballs. How often do you check the signatures on random tar.gz you download?
      - 4ad 11y ago
        tar.gz vs. curl|bash is a false dichotomy, there is no reason for either. We have better ways to install software these days. And yes, when I download tar.gz (e.g. when I am responsible of managing my own packages) I do check the signatures. You should, too.
        tokenizerrr 11y ago
        Could you point me to the better way of installing software that will work on all Linux distros?
        stephenr 11y ago
        District-appropriate packages. Use the right fucking tool for the job.
        tokenizerrr 11y ago
        That will not work on all Linux distros. That is writing a specific installer for each distro, which does not satisfy my requirements and as such is not the right tool for the job.
        stephenr 11y ago
        > That will not work on all Linux distros The result of the work to create packages using the major packaging formats will produce a series of packages that combined, will arguably work better, on more distros than your home-grown installer. > That is writing a specific installer What makes you think creating e.g. a debian package equates to "writing a specific installer". The whole point of packages is that you don't "write an installer" you provide an existing installer (the package manager/package installer) with information about what to install where.
  - raesene4 11y ago
    This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps. Looking at Dockers deployment of Content Trust as an example of this. You still have a trust decision on first use, but it's better protection than nothing.
    - kentonv 11y ago
      > You still have a trust decision on first use, but it's better protection than nothing. That's what you're getting by curl|bashing sandstorm today (if you skip the PGP verification step). Once installed the updater verifies signatures automatically.
raesene4 11y ago
I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed. curl|bash ing a script does not provide this protection.
- superuser2 11y ago
  Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.
  - p4bl0 11y ago
    You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
    - throwaway7767 11y ago
      Also, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.
- zokier 11y ago
  Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...
  - deleted 11y ago
    [deleted]
  - raesene4 11y ago

deleted 11y ago

[deleted]