3 ms·

Run: sh | wget http://www...something.com/install.sh http://www...something.com/install.sh to install something automatically! Way too many projects do it, fr

• tacojuan 11y ago
  docker?
• rplnt 11y ago
  Don't forget that many require you to use sudo.
  • akerro 11y ago
    zsh: command not found: sudo
• bodyfour 11y ago
  No worse than "./configure && make && sudo make install"
  • viraptor 11y ago
    It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc. In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.
    • akerro 11y ago
      What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often). What about `cd /usr/ports/www/firefox && make clean install`?
    • bodyfour 11y ago
      Sure, autoconf is generated, but often develops have to add custom rules.. and do it with arcane m4 macros to boot. I think they're similarly prone to mistakes. For nefarious purposes I actually think it's worse than the much-maligned "curl|sh" scenario. I bet a reasonable number of people will end up trying to download the script, out of curiosity if nothing else. If it's doing anything not straightforward, it would get attention. In contrast, who would notice a line added to the middle of a 8000 line auto-generated configure script?
      • viraptor 11y ago
        That wasn't my point. configure doesn't prevent malicious behaviour, but it would prevent silly mistakes at install time. (unless you actively break out of macro environment) The point is, technically there isn't anything different between `curl | sh` and installing a system from either a downloaded .iso or a mailed DVD. Both run code from untrusted sources on your computer. But in practice they're very different because of user behaviour and ability to validate data before running. There's a whole spectrum in between and configure&make is somewhere on it.
  • organsnyder 11y ago
    If that's being run for code you've downloaded from an untrusted location, then I'd agree with you. However, almost every project that has those instructions starts with "download it from this trusted location, verify its integrity using this GPG key...". Of course, you have to start trusting at some point. But with HTTP, you have to also trust the wifi AP, its owner, all of the routers between you and the server, DNS... At least https takes a lot of those (but not all) out of the equation, while GPG goes even further.
• lqdc13 11y ago
  I think it's the other way and you need the -qO- flags.
• joosters 11y ago
  The problem with this is that the bootloader downloads and runs the code without giving any chance to inspect it. If you download the code manually, how are you to know that the server sent you the exact same code? They could be checking HTTP headers for a bootloader device, or might only be infecting 1 in 100 downloads. You'd never spot it.
  • mavdi 11y ago
    You can always examine the code right? https://github.com/antonym/netboot.xyz/blob/master/src/coreos.ipxe#L29 https://github.com/antonym/netboot.xyz/blob/master/src/coreo... Uses official images as far as I can see
    • joosters 11y ago
      Sure, you could compile it yourself, then host it yourself. Relying on the remote server is the problematic part.
      • mavdi 11y ago
        I see. Correct.
• Chris2048 11y ago
  curlpipesh.tumblr.com/