3 ms·

I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the

I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed. curl|bash ing a script does not provide this protection.

superuser2 11y ago
Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.
- p4bl0 11y ago
  You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
  - throwaway7767 11y ago
    Also, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.
zokier 11y ago
Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...
- deleted 11y ago
  [deleted]
- raesene4 11y ago
  But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...
  - tokenizerrr 11y ago
    You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.
    - snowwrestler 11y ago
      Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.
      - tokenizerrr 11y ago
        I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.
        snowwrestler 11y ago
        I think that once we're talking about installing server software at the command line, we're already beyond most of the masses. I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.
        tokenizerrr 11y ago
        Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.
        zokier 11y ago

superuser2 11y ago

Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.

p4bl0 11y ago
You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
- throwaway7767 11y ago
  Also, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.

zokier 11y ago

Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...

deleted 11y ago
[deleted]
raesene4 11y ago
But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...
- tokenizerrr 11y ago
  You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.
  - snowwrestler 11y ago
    Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.
    - tokenizerrr 11y ago
      I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.
      - snowwrestler 11y ago
        I think that once we're talking about installing server software at the command line, we're already beyond most of the masses. I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.
        tokenizerrr 11y ago
        Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.
        zokier 11y ago