3 ms·

And that's the sort of thing that could easily sneak into the `curl http://some/url http://some/url | sudo bash`-style of installs that are popular these days.

by endgame 11y ago

moonbug 11y ago
Good.
- snuxoll 11y ago
  I could do it in an RPM post-install script too if it will get people to stop whining about running arbitrary scripts. All software you install on your system through binaries is potentially suspect to an extend. Sure, I trust the Fedora build system to do the right thing, so I can with some certainty assume anything in the Fedora Collection or EPEL is "safe" - but when I need to install 3rd party software to get my video card working I can throw all that out the window. Be sane when testing any binary you install, at least with RPM's or DEB's I can verify the GPG key of the vendor - assuming they bother to use one at all... piping scripts directly from curl to bash is bad because of the potential of the stream ending early and leaving in an inconsistent state, that's the only thing that is notable worse versus installing a package (and can be worked around by downloading it first, THEN executing it).
  - deleted 11y ago
    [deleted]
  - chris_wot 11y ago
    Given you need to be root to install software on an Ubuntu system, a deb could do that also.
cnvogel 11y ago
Are you arguing about malicious attempts to mess up, or brick, your computer, facilitated by efivars presenting an interface accessible by simple shell scripts? Well... If there would be an api requiring, for example, a special syscall (or maybe even uglier, an mmap of /dev/men), I'm 100% percent sure that the default install of all Linux distributions would include an /sbin/efivars command exposing this API to every shell script running as root... So nothing would be gained. For safeguards against accidental damage, on the other hand, in completely in favour.

And that's the sort of thing that could easily sneak into the `curl http://some/url http://some/url | sudo bash`-style of installs that are popular these days.

by endgame 11y ago

And that's the sort of thing that could easily sneak into the `curl http://some/url http://some/url | sudo bash`-style of installs that are popular these days.

moonbug 11y ago

Good.

snuxoll 11y ago
I could do it in an RPM post-install script too if it will get people to stop whining about running arbitrary scripts. All software you install on your system through binaries is potentially suspect to an extend. Sure, I trust the Fedora build system to do the right thing, so I can with some certainty assume anything in the Fedora Collection or EPEL is "safe" - but when I need to install 3rd party software to get my video card working I can throw all that out the window. Be sane when testing any binary you install, at least with RPM's or DEB's I can verify the GPG key of the vendor - assuming they bother to use one at all... piping scripts directly from curl to bash is bad because of the potential of the stream ending early and leaving in an inconsistent state, that's the only thing that is notable worse versus installing a package (and can be worked around by downloading it first, THEN executing it).
- deleted 11y ago
  [deleted]
- chris_wot 11y ago
  Given you need to be root to install software on an Ubuntu system, a deb could do that also.

cnvogel 11y ago

Are you arguing about malicious attempts to mess up, or brick, your computer, facilitated by efivars presenting an interface accessible by simple shell scripts? Well... If there would be an api requiring, for example, a special syscall (or maybe even uglier, an mmap of /dev/men), I'm 100% percent sure that the default install of all Linux distributions would include an /sbin/efivars command exposing this API to every shell script running as root... So nothing would be gained. For safeguards against accidental damage, on the other hand, in completely in favour.