4 ms·

Sorry to be snide, but seriously? curl -L https://git.io/cleansweep | sh For a security tool? [edit] I still think it's a great idea, though [/edit]

whorleater 11y ago
Yeah telling us to blindly run a shell script is...a quirky design choice. At least it doesn't tell you to run it with sudo like I've seen some other ones do, and the shell script itself is sanely commented.
- jacobscott 11y ago
  If the script source is on github and isn't run under sudo, is there a meaningful difference between curl | sh and apt-get install from a PPA, gem/pip install, etc?
  - whorleater 11y ago
    Meaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.
    - jacobscott 11y ago
      The software has to be distributed somehow, right? Probably over https? What makes curl more susceptible to MITM than apt-get/pip/gem/etc? I don't particularly like curl | sh either, but without sudo, I'm not sure how much it /really/ differs, security wise, from other options. Edit: real package managers have improved features compared to curl, as outlined in another branch of the comments.
    - dchanm 11y ago
      If you want to be extra cautious you can verify that the script hasn't changed with our release key https://patchworksecurity.com/releases.txt https://patchworksecurity.com/releases.txt The latest release (2.0.0) has been signed by my key 0x85C64E20
- deleted 11y ago
  [deleted]
- yaworsk 11y ago
  Looked at the site and read the comments which made me think about the HN post yesterday about hiding vulnerabilities in plain site (https://news.ycombinator.com/item?id=10889721 https://news.ycombinator.com/item?id=10889721). Like your idea though.
  - dchanm 11y ago
    Hi yaworsk, We're working on improving our API documentation. You can develop against our API and not use the supplied client. https://patchworksecurity.com/docs/ https://patchworksecurity.com/docs/
    - yaworsk 11y ago
      Oh nice! that's a great idea, thanks for sharing
dchanm 11y ago
Hi, we decided to make it easy to setup the tool and run it. The source code is available on GitHub https://github.com/PatchworkSecurity/cleansweep/blob/master/clients/shell/cleansweep.sh https://github.com/PatchworkSecurity/cleansweep/blob/master/... The comments explain what is happening at each step.
- DoubleMalt 11y ago
  Would you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful? http://www.seancassidy.me/dont-pipe-to-your-shell.html http://www.seancassidy.me/dont-pipe-to-your-shell.html
  - kentonv 11y ago
    That problem is easily avoided by wrapping the whole script in a function and then calling it on the last line. It looks like Patchwork's script doesn't quite do that, but it does put _most_ of its functionality into functions, and AFAICT there is no particular place in the script where a connection loss could lead to anything bad happening. Admittedly this appears to be a lucky accident rather than following best practice.
  - dchanm 11y ago
    Hi DoubleMalt, Thanks for the link. I've filed an issue and should have this fixed tonight https://github.com/PatchworkSecurity/cleansweep/issues/7 https://github.com/PatchworkSecurity/cleansweep/issues/7
swsieber 11y ago
I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... He addresses code signing and mitm and connection interruptions. Edit: The gist of it is no, it's not more insecure than other software distribution methods.

whorleater 11y ago

Yeah telling us to blindly run a shell script is...a quirky design choice. At least it doesn't tell you to run it with sudo like I've seen some other ones do, and the shell script itself is sanely commented.

jacobscott 11y ago
If the script source is on github and isn't run under sudo, is there a meaningful difference between curl | sh and apt-get install from a PPA, gem/pip install, etc?
- whorleater 11y ago
  Meaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.
  - jacobscott 11y ago
    The software has to be distributed somehow, right? Probably over https? What makes curl more susceptible to MITM than apt-get/pip/gem/etc? I don't particularly like curl | sh either, but without sudo, I'm not sure how much it /really/ differs, security wise, from other options. Edit: real package managers have improved features compared to curl, as outlined in another branch of the comments.
  - dchanm 11y ago
    If you want to be extra cautious you can verify that the script hasn't changed with our release key https://patchworksecurity.com/releases.txt https://patchworksecurity.com/releases.txt The latest release (2.0.0) has been signed by my key 0x85C64E20
deleted 11y ago
[deleted]
yaworsk 11y ago
Looked at the site and read the comments which made me think about the HN post yesterday about hiding vulnerabilities in plain site (https://news.ycombinator.com/item?id=10889721 https://news.ycombinator.com/item?id=10889721). Like your idea though.
- dchanm 11y ago
  Hi yaworsk, We're working on improving our API documentation. You can develop against our API and not use the supplied client. https://patchworksecurity.com/docs/ https://patchworksecurity.com/docs/
  - yaworsk 11y ago
    Oh nice! that's a great idea, thanks for sharing

dchanm 11y ago

Hi, we decided to make it easy to setup the tool and run it. The source code is available on GitHub https://github.com/PatchworkSecurity/cleansweep/blob/master/clients/shell/cleansweep.sh https://github.com/PatchworkSecurity/cleansweep/blob/master/... The comments explain what is happening at each step.

DoubleMalt 11y ago
Would you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful? http://www.seancassidy.me/dont-pipe-to-your-shell.html http://www.seancassidy.me/dont-pipe-to-your-shell.html
- kentonv 11y ago
  That problem is easily avoided by wrapping the whole script in a function and then calling it on the last line. It looks like Patchwork's script doesn't quite do that, but it does put _most_ of its functionality into functions, and AFAICT there is no particular place in the script where a connection loss could lead to anything bad happening. Admittedly this appears to be a lucky accident rather than following best practice.
- dchanm 11y ago
  Hi DoubleMalt, Thanks for the link. I've filed an issue and should have this fixed tonight https://github.com/PatchworkSecurity/cleansweep/issues/7 https://github.com/PatchworkSecurity/cleansweep/issues/7

swsieber 11y ago

I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... He addresses code signing and mitm and connection interruptions. Edit: The gist of it is no, it's not more insecure than other software distribution methods.