3 ms·

Will this be enabled by default ? The ability to do 'curl some-site.com | bash' or ssh <hostname> 'curl some-site.com | bash' without having to worry about pla

Will this be enabled by default ? The ability to do 'curl some-site.com | bash' or ssh <hostname> 'curl some-site.com | bash' without having to worry about platform compatibility would be amazing.

creshal 11y ago
Why would you ever want to do 'curl please-pwn-my-computer-so-hard | bash'?
- ake1 11y ago
  maybe he's actually curling https://please-pwn-my-computer-so-hard.own-domain.com/script-he-himself-wrote.sh https://please-pwn-my-computer-so-hard.own-domain.com/script... ?
- izacus 11y ago
  Same reason you want to `brew please-pwn-my-computer-so-hard` or `apt-get please-pwn-my-computer-so-hard` or `please-pwn-my-computer-so-hard.exe`. There's little practical distinction between piping a shell script from a random site or downloading a binary from it.
  - creshal 11y ago
    > or `apt-get please-pwn-my-computer-so-hard` Installing a package manually vetted by distribution maintainers, signed and verified with GPG, is the same as blindly running a random script off the internet? I don't think you appreciate how much effort Linux distributions invested into creating safe ways of distributing software.
  - forgotmypassw 11y ago
    The difference being that distro packages are distributed in a safe matter (signing and verification) whereas a website could be hijacked and the script replaced or you could get MITM'd if you access it over HTTP.
- oneweekwonder 11y ago
  http://brew.sh/ http://brew.sh/ `/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"` https://raw.githubusercontent.com/Homebrew/install/master/in... https://rvm.io/rvm/install https://rvm.io/rvm/install `\curl -sSL https://get.rvm.io https://get.rvm.io | bash` https://www.npmjs.com/package/nodejs-oneline/tutorial https://www.npmjs.com/package/nodejs-oneline/tutorial `curl -sL https://deb.nodesource.com/setup https://deb.nodesource.com/setup | sudo -E bash -z` It is a trend. I can find more examples, the above is just places I remember seeing this behaviour.
  - creshal 11y ago
    Of course these fucking devops #yolo #hashtag hipsters have no clue of how to safely distribute software.
captainmuon 11y ago
I doubt it, and part of me hopes not. This seems like a new possible vector for malware. Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net. OTOH, yes, being able to assume bash on a user's installation would be amazing of course...
- rat87 11y ago
  > Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net. Yes and I fucking hate it, way to cut of useful functionality at the knees.
  - carey 11y ago
    A lot of my PowerShell scripts are accompanied by shortcuts or batch files that do: powershell.exe -ExecutionPolicy RemoteSigned -File whatever.ps1

Will this be enabled by default ? The ability to do 'curl some-site.com | bash' or ssh <hostname> 'curl some-site.com | bash' without having to worry about platform compatibility would be amazing.

creshal 11y ago

Why would you ever want to do 'curl please-pwn-my-computer-so-hard | bash'?

ake1 11y ago
maybe he's actually curling https://please-pwn-my-computer-so-hard.own-domain.com/script-he-himself-wrote.sh https://please-pwn-my-computer-so-hard.own-domain.com/script... ?
izacus 11y ago
Same reason you want to `brew please-pwn-my-computer-so-hard` or `apt-get please-pwn-my-computer-so-hard` or `please-pwn-my-computer-so-hard.exe`. There's little practical distinction between piping a shell script from a random site or downloading a binary from it.
- creshal 11y ago
  > or `apt-get please-pwn-my-computer-so-hard` Installing a package manually vetted by distribution maintainers, signed and verified with GPG, is the same as blindly running a random script off the internet? I don't think you appreciate how much effort Linux distributions invested into creating safe ways of distributing software.
- forgotmypassw 11y ago
  The difference being that distro packages are distributed in a safe matter (signing and verification) whereas a website could be hijacked and the script replaced or you could get MITM'd if you access it over HTTP.
oneweekwonder 11y ago
http://brew.sh/ http://brew.sh/ `/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"` https://raw.githubusercontent.com/Homebrew/install/master/in... https://rvm.io/rvm/install https://rvm.io/rvm/install `\curl -sSL https://get.rvm.io https://get.rvm.io | bash` https://www.npmjs.com/package/nodejs-oneline/tutorial https://www.npmjs.com/package/nodejs-oneline/tutorial `curl -sL https://deb.nodesource.com/setup https://deb.nodesource.com/setup | sudo -E bash -z` It is a trend. I can find more examples, the above is just places I remember seeing this behaviour.
- creshal 11y ago
  Of course these fucking devops #yolo #hashtag hipsters have no clue of how to safely distribute software.

captainmuon 11y ago

I doubt it, and part of me hopes not. This seems like a new possible vector for malware. Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net. OTOH, yes, being able to assume bash on a user's installation would be amazing of course...

rat87 11y ago
> Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net. Yes and I fucking hate it, way to cut of useful functionality at the knees.
- carey 11y ago
  A lot of my PowerShell scripts are accompanied by shortcuts or batch files that do: powershell.exe -ExecutionPolicy RemoteSigned -File whatever.ps1