3 ms·
I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on
by azernik 10y ago
I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.
- rbut 10y agoEven if its a trusted https:// https:// domain, it can still be compromised. (https://blog.jquery.com/2014/09/24/update-on-jquery-com-compromises/ https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp...) Always review the script first.
- chrismonsanto 10y agoYou trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary
- rbut 10y agoYes, you are correct if the application and script are on the same domain. The link is simply an example of a major 'trusted' domain being compromised.
- chrismonsanto 10y agoAbsolutely.