6 ms·
It's common to see people frown upon seeing curl ... | sh Sad that we happily allow a black box to connect to our internet without any inkling of the fact t
by 0xmohit 10y ago
It's common to see people frown upon seeing
curl ... | sh
Sad that we happily allow a black box to connect to our internet without any inkling of the fact that it might be used to attack someone, spy upon someone (ourselves?), ...
- qbrass 10y agoYou say that like the people frowning about curl|sh are the same ones plugging random crap into the internet. I doubt there's much overlap between the two groups of people.
- knodi123 10y agoahem... well, there's, uh... me... I'm afraid that you would find the number of people who failed to consider blackbox internet appliances as attack vectors to be disappointingly large. Luckily, I already had a paranoid router setup, so I think I'm probably okay.
- a3n 10y agoThe crowd raises their styrofoam coffee cups and says "Hi knodi123."
- a3n 10y agoCertainly not the majority, but probably more than you think.
- 0xmohit 10y agoI didn't say that "people frowning about curl|sh are the same ones plugging random crap into the internet". That said, I wouldn't be terribly surprised to see a fair bit of overlap.
- graedus 10y agoThe set of those who frown upon curl ... | sh and the set of those who happily allow a black box to connect to their internet and potentially spy on them must be pretty close to disjoint, no?
- witty_username 10y agoWhat is wrong with curl | sh with HTTPS? Linux does essentially the same thing with GPG signatures instead.
- ceejayoz 10y agoI'm fairly comfortable with `curl | sh` over HTTPS, but to my knowledge, the servers serving the GPG signatures for Linux packages aren't able to sign them with the right keys.
- CiPHPerCoder 10y agoGPG is great for offline signatures, which in addition to HTTPS is a great way to assure that the software you obtain is legitimate. That isn't to say that it isn't the product of a targeted trojan signed with a stolen GPG key.
- jakub_g 10y agoThere was a nice writeup some time ago that the server can detect piping to shell via some properties of that call, and perhaps send an exploit in such case: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... https://news.ycombinator.com/item?id=11532599 https://news.ycombinator.com/item?id=11532599
- burke 10y agoOk, here's the thing: Almost no one actually audits the source they download before they run it, whether it be a package installer, a configure/make/make-install tarball, or a curl|sh. If you know enough to audit a shellscript, you can easily decompose the command-line to download, audit, and run the local copy. For the vast majority that chooses to simply trust the author, there is no additional security issue with curl|sh compared to other non-signed distribution methods provided the script is wrapped in a function call or otherwise resistant to errors that might happen if a partial download is executed. Should we do better than curl|sh? Yes. But it's no worse than downloading some random tarball or even cloning some random git repository, as long as it's served over HTTPS.
- est 10y agoEven worse, people would happily comply with any suggestions their IT department told them to. Sometimes IT department just google random instructions from the interweb. Some of them include really outdated security practice
- pjc50 10y agoPretty much all devices with wifi have "black box" elements: their closed source firmware is quite capable of sending and receiving packets without the OS ever being informed.
- _audakel 10y agoTHE MOST POPULAR CURL DOWNLOAD – BY A MALWARE https://news.ycombinator.com/item?id=10574011 https://news.ycombinator.com/item?id=10574011