3 ms·
> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire
by chrismonsanto 10y ago
> which means you are basically giving your computer in the hands of a third party
As opposed to any other installation method? Do you regularly vet the entire source code of software you install?
- orf 10y agoNo, but I can verify the hash of the installer before I run it though.
- ricardobeat 10y agoAnd who provided you with the hash?
- joombaga 10y agoFor distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.
- chrismonsanto 10y agoIf the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.
- azernik 10y agoI think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.
- rbut 10y agoEven if its a trusted https:// https:// domain, it can still be compromised. (https://blog.jquery.com/2014/09/24/update-on-jquery-com-compromises/ https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp...) Always review the script first.
- chrismonsanto 10y agoYou trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary
- rbut 10y agoYes, you are correct if the application and script are on the same domain. The link is simply an example of a major 'trusted' domain being compromised.
- chrismonsanto 10y agoAbsolutely.