3 ms·

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the

by fosk 10y ago

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.

chrismonsanto 10y ago
> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?
- orf 10y ago
  No, but I can verify the hash of the installer before I run it though.
  - ricardobeat 10y ago
    And who provided you with the hash?
    - joombaga 10y ago
      For distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.
      - chrismonsanto 10y ago
        If the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.
- azernik 10y ago
  I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.
  - rbut 10y ago
    Even if its a trusted https:// https:// domain, it can still be compromised. (https://blog.jquery.com/2014/09/24/update-on-jquery-com-compromises/ https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp...) Always review the script first.
    - chrismonsanto 10y ago
      You trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary
      - rbut 10y ago
        Yes, you are correct if the application and script are on the same domain. The link is simply an example of a major 'trusted' domain being compromised.
  - chrismonsanto 10y ago
    Absolutely.

by fosk 10y ago

chrismonsanto 10y ago

> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?

orf 10y ago
No, but I can verify the hash of the installer before I run it though.
- ricardobeat 10y ago
  And who provided you with the hash?
  - joombaga 10y ago
    For distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.
    - chrismonsanto 10y ago
      If the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.
azernik 10y ago
I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.
- rbut 10y ago
  Even if its a trusted https:// https:// domain, it can still be compromised. (https://blog.jquery.com/2014/09/24/update-on-jquery-com-compromises/ https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp...) Always review the script first.
  - chrismonsanto 10y ago
    You trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary
    - rbut 10y ago
      Yes, you are correct if the application and script are on the same domain. The link is simply an example of a major 'trusted' domain being compromised.
- chrismonsanto 10y ago
  Absolutely.