2 ms·
Why do you think a curling auditable shell code into an executable pipe is riskier than executing a compiled binary?
by scrollaway 10y ago
Why do you think a curling auditable shell code into an executable pipe is riskier than executing a compiled binary?
- qwertyuiop924 10y agobecause you can't check the keys to attempt to detect an MITM replacing the binary before you execute it. Often, the shell script then downloads additional binaries, which are installed and executed immediately, making it even harder to check.
- d33 10y agoJust as an example, out of many reasons: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- scrollaway 10y agoYou missed the 'er' in riskier. Do you seriously think this is more of a threat than executing binaries you have to reverse engineer to know what they do?
- MichaelGG 10y agoWell one could argue that having a shell script invites people to review it, then the article's behaviour could change it. So people might trust it when they otherwise wouldn't have. But... they should just download it locally, verify, and run. Whereas for a binary, they might go verify a signature or something more severe.