6 ms·

A lot of Java software is also "(1) download the tar, (2) run bin/whatever which is a 500 line bash script for setting up the jvm environment"

jonathankoren 11y ago
6 of one, half a dozen of the other. As long as it's behind and simple interface and it works, I don't care what it actually does.
- tbrock 11y ago
  And..., just like that, you are part of a bot net.
  - BHSPitMonkey 11y ago
    The truth is, nobody personally vets the source of all the software they use. Even people who compile everything themselves aren't reading the source code that came over the wire. It baffles me when people fret over "don't blindly run that curl|bash installation script because security!" when nobody would bat an eye at a .deb downloaded from the same web site.
    - blub 11y ago
      There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.
      - BHSPitMonkey 11y ago
        What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.
        dragonne 11y ago
        While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!
        BHSPitMonkey 11y ago
        While that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.
        blub 11y ago
        The point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine. At the minimum I want to know what it does and where it puts stuff. This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies. By the way, it's poor form to downvote someone just for disagreeing with them.
  - voltagex_ 11y ago
    Sure, but if I'm really worried, egress filtering will catch it or the VM won't be allowed to connect out to any non-whitelisted hosts. Security is about defense in depth, not just "don't run anything you haven't read in detail" - have you read the code of the web browser you posted with?
  - jonathankoren 11y ago
    Unless audit the code you download, you still could be pwned. Compiling or downloading from github isn't some magic talisman.
- LukeShu 11y ago
  Well, it's more like: (2) run bin/whatever which is a 500 line bash script for setting up the jvm environment that has a 50% chance of not working if you are on a distro that's not Ubuntu or RHEL, and probably also fails if it takes a filename and you give it a filename containing a space.
  - jonathankoren 11y ago
    Well that sounds like a personal problem. Who puts spaces in a filename on UNIX? That's just bad form, and anyway, if you did decide to throw prudence and best practices out the window, you should properly escape it.

jonathankoren 11y ago

6 of one, half a dozen of the other. As long as it's behind and simple interface and it works, I don't care what it actually does.

tbrock 11y ago
And..., just like that, you are part of a bot net.
- BHSPitMonkey 11y ago
  The truth is, nobody personally vets the source of all the software they use. Even people who compile everything themselves aren't reading the source code that came over the wire. It baffles me when people fret over "don't blindly run that curl|bash installation script because security!" when nobody would bat an eye at a .deb downloaded from the same web site.
  - blub 11y ago
    There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.
    - BHSPitMonkey 11y ago
      What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.
      - dragonne 11y ago
        While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!
        BHSPitMonkey 11y ago
        While that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.
      - blub 11y ago
        The point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine. At the minimum I want to know what it does and where it puts stuff. This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies. By the way, it's poor form to downvote someone just for disagreeing with them.
- voltagex_ 11y ago
  Sure, but if I'm really worried, egress filtering will catch it or the VM won't be allowed to connect out to any non-whitelisted hosts. Security is about defense in depth, not just "don't run anything you haven't read in detail" - have you read the code of the web browser you posted with?
- jonathankoren 11y ago
  Unless audit the code you download, you still could be pwned. Compiling or downloading from github isn't some magic talisman.
LukeShu 11y ago
Well, it's more like: (2) run bin/whatever which is a 500 line bash script for setting up the jvm environment that has a 50% chance of not working if you are on a distro that's not Ubuntu or RHEL, and probably also fails if it takes a filename and you give it a filename containing a space.
- jonathankoren 11y ago
  Well that sounds like a personal problem. Who puts spaces in a filename on UNIX? That's just bad form, and anyway, if you did decide to throw prudence and best practices out the window, you should properly escape it.