11 ms·
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed t
by ckastner 10y ago
The installation shortcut given is
curl -sSL https://install.pi-hole.net | bash
and one is expected to execute this as root.
Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
- cphoover 10y agoIf you care to you can easily view the contents before executing them. `curl -sSL https://install.pi-hole.net` https://install.pi-hole.net` It's only 1400 lines of code. At least it has TLS to prevent a MITM
- Gaelan 10y agoUnless you've audited the source, a manual install isn't any better.
- ckastner 10y agoHence why I merely opposed actively encouraging this pattern. I can't stop people from doing potentially dangerous things, but I don't have to promote those things, either.
- mrstone 10y agoI don't think the other way is inherently any safer, because people don't tend to actually audit their sources to begin with.
- noja 10y agoNo. With a curl install, you cannot audit the source. You cannot know if you have been served the same content as someone else. You cannot look at version history, check a signed package, etc. etc. If someone wants to root just a few select machines, you would want people to do a curl install.
- dmbass 10y agofrom the article: > Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.
- strictnein 10y agoThe compounds in this medicine are public knowledge, but taking them could be dangerous. For a safer experience, review all medical literature pertaining to these compounds before consuming.
- slau 10y agoNot really the same. One of the main issues with curl pipes is that the server (or MITM) can detect that the request goes into a pipe. This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it. So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.
- deleted 10y ago[deleted]
- tpxl 10y agoHow can you detect if the output is curl/piped?
- Achshar 10y agoI would hazard a guess that curl won't send the standard request headers that browsers would.
- nemo1618 10y agoLike so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... To combat this sort of thing, @jbenet made hashpipe: https://jbenet.github.io/hashpipe https://jbenet.github.io/hashpipe
- j_s 10y agoYou acknowledge the prioritization of ease-of-use/adoption vs. security so I think we're on the same page. I doubt step-by-step instructions including a review of the script's content would improve the average user's security, in much the same way that click-through ToS dialogs always garner such much scrutiny. Edit: another comment quoted the warning on the page, at this point it feels like complaining is tilting at windmills.
- 0xdeadbeefbabe 10y ago> but I wish people wouldn't actively encourage this pattern Why do you care so much about what people do or don't do? Edit: We're talking about blocking ads, right? If people encouraged everyone to block ads what would happen to the economy?
- sosborn 10y agoThe discussion is about the installation method. Piping to bash can be dangerous.
- 0xdeadbeefbabe 10y agoThis superhero attitude, I think, is more dangerous.
- jwilk 10y agohttps://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- legulere 10y agoI do not really see the problem. You have to trust them anyway to run code as root on your computer and the connection is encrypted.
- deleted 10y ago[deleted]
- chatterbeak 10y agoDid you read the website? They tell you to check it first.