4 ms·
> curl https://www.teleconsole.com/get.sh https://www.teleconsole.com/get.sh | sh I understand that the assumption is that the first person I trust is you ;)
by d33 10y ago
> curl https://www.teleconsole.com/get.sh https://www.teleconsole.com/get.sh | sh
I understand that the assumption is that the first person I trust is you ;)
- scrollaway 10y agoWhy do you think a curling auditable shell code into an executable pipe is riskier than executing a compiled binary?
- qwertyuiop924 10y agobecause you can't check the keys to attempt to detect an MITM replacing the binary before you execute it. Often, the shell script then downloads additional binaries, which are installed and executed immediately, making it even harder to check.
- d33 10y agoJust as an example, out of many reasons: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- scrollaway 10y agoYou missed the 'er' in riskier. Do you seriously think this is more of a threat than executing binaries you have to reverse engineer to know what they do?
- MichaelGG 10y agoWell one could argue that having a shell script invites people to review it, then the article's behaviour could change it. So people might trust it when they otherwise wouldn't have. But... they should just download it locally, verify, and run. Whereas for a binary, they might go verify a signature or something more severe.