3 ms·

This might be attacking the wrong issue. How about making it easier to create packages for major distributions? (this includes Windows and macOS)

nixpulvis 10y ago
You mean like `brew` for macOS, or the many other options like it? It's not the wrong issue, because I believe the main goal here is to raise general awareness that piping to bash with untrusted data is a bad idea and we as developers should frown on it not promote it.
- phn 10y ago
  You do realize brew itself has an installation method like the post describes, right? :)
- voltagex_ 10y ago
  Yes, but what alternative are you suggesting for developers who want to distribute software to multiple platforms? IT security can't just be the ones that come in and say "you've got issues here, here and here" without also providing solutions.
  - notacoward 10y ago
    Bash scripts aren't magically multi-platform either. If you want something to work right on multiple platforms, you have to understand those platforms' proper distribution and packaging methods. Sure it's a pain, but so is writing the mother of all bash scripts to handle every condition on every platform. You won't get it right, just like all the people who tried to do the exact same thing back in the 80s didn't get it right. That approach failed so consistently and so badly that people created package managers to bring some sanity to the situation. They're still the best solution available, even if they're not perfect. BTW, it's not just about security. It's also about correctness, consistency, repeatability, reversibility, auditability, etc. As a developer, I still build and install actual packages on my test systems not because there's a security issue but so I can be sure that an uninstall/reinstall will work exactly as they should and not pollute my system with untracked changes. I don't know what kind of developer wants to risk checking in changes that don't match what they tested, but not the kind I want to work with.

nixpulvis 10y ago

You mean like `brew` for macOS, or the many other options like it? It's not the wrong issue, because I believe the main goal here is to raise general awareness that piping to bash with untrusted data is a bad idea and we as developers should frown on it not promote it.

phn 10y ago
You do realize brew itself has an installation method like the post describes, right? :)
voltagex_ 10y ago
Yes, but what alternative are you suggesting for developers who want to distribute software to multiple platforms? IT security can't just be the ones that come in and say "you've got issues here, here and here" without also providing solutions.
- notacoward 10y ago
  Bash scripts aren't magically multi-platform either. If you want something to work right on multiple platforms, you have to understand those platforms' proper distribution and packaging methods. Sure it's a pain, but so is writing the mother of all bash scripts to handle every condition on every platform. You won't get it right, just like all the people who tried to do the exact same thing back in the 80s didn't get it right. That approach failed so consistently and so badly that people created package managers to bring some sanity to the situation. They're still the best solution available, even if they're not perfect. BTW, it's not just about security. It's also about correctness, consistency, repeatability, reversibility, auditability, etc. As a developer, I still build and install actual packages on my test systems not because there's a security issue but so I can be sure that an uninstall/reinstall will work exactly as they should and not pollute my system with untracked changes. I don't know what kind of developer wants to risk checking in changes that don't match what they tested, but not the kind I want to work with.