4 ms·

Pretty cool. Just a thought - maybe add an endpoint directly to the shell script? Would be cool to be able to simply `curl max.io/...` and see it

by chowes 9y ago

comboy 9y ago
Please don't. Why would you want that. Do you really want to put trust in another 3rd party (even if author is great, site can be compromised), just to see some colors in your terminal? I don't see how do we solve this problem by the way. Most people will always choose convenience over security. And they, as a user, must have some privileges. Even if you ask, they will just go ahead and say yes to get their thing. I understand that. Is there some clever technical fix for this, or do ransomware need to get popular enough to increase users security awareness? It seems to be a really hard problem. edit: Oh, I'm not very clever, no execution necessary here, just an output from curl. Realized that just after I sent it, but I'm leaving the reply for the second OT part.
- philtar 9y ago
  I choose convenience over security. And so do you. You didn't read every line of every software you use,because it's not convenient.
  - deleted 9y ago
    [deleted]
- yzmtf2008 9y ago
  This is a discussion that’s been had before and a problem that’s been solved before: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... As a gist, here’s a quote: When you install software on Linux, no matter what package manager you use, you are giving that software permission to act as you.
  - saghm 9y ago
    Most (if not all) legit package managers at least use checksums to reduce the chance of malicious packages getting installed; I'm not sure about others, but I believe pacman (the Arch Linux package manager) also refuses to install packages from unless you've imported the GPG key of the distributor. This isn't to say that package managers are completely safe (nothing is), but there are fairly significant differences between using a Linux package manager and piping a script from the internet to be executed.
    - ue_ 9y ago
      The owner of the website could sign responses, and you could verify them, in addition to TLS via HTTPS. I think that can make it at least as secure as package management systems.
      - saghm 9y ago
        Yep, I agree. Providing checksums for scripts to curl isn't the the norm from what I've seen, though, which I think fits in with what GP (of my original comment) was saying. Also, I'm not super convinced that most users would bother verifying the checksum; from what I've seen, most people downloading Linux distro images don't even bother verifying the checksums that are provided.
        JeremyBanks 9y ago
        I'd be great if something like hashpipe could become standard on Linux for this purpose. See https://news.ycombinator.com/item?id=9318286 https://news.ycombinator.com/item?id=9318286
        saghm 9y ago
        This is really cool! I hadn't heard of it before
  - vacri 9y ago
    That article is mixing up "is it safe to do that from us?" and "is it safe to do that?". Do it from another vendor that isn't using https and all their reassurances about the method evaporate. Simply put: the method is bad; it's only when you use a bunch of mitigating actions that it becomes 'not bad'.
- olalonde 9y ago
  Kind of unrelated but I wish I could do `curl http://example.com/evil-script.sh http://example.com/evil-script.sh | vim | bash` and have vim stop the pipe if I :q! or proceed to forward stdin to stdout if I :wq.
  - spb 9y ago
    That's what `vipe` is for: https://joeyh.name/code/moreutils/ https://joeyh.name/code/moreutils/
  - deleted 9y ago
    [deleted]
binarymax 9y ago
I thought about that, but then I'd need to support it server side, and right now it's just a static page. For convenience I made you this (requires node): https://github.com/binarymax/bashfill/blob/master/zip2bash.js https://github.com/binarymax/bashfill/blob/master/zip2bash.j... So you can run './zip2bash.js $somebashfillurl | bash' to light it up.

Pretty cool. Just a thought - maybe add an endpoint directly to the shell script? Would be cool to be able to simply `curl max.io/...` and see it

by chowes 9y ago

Pretty cool. Just a thought - maybe add an endpoint directly to the shell script? Would be cool to be able to simply `curl max.io/...` and see it

comboy 9y ago

Please don't. Why would you want that. Do you really want to put trust in another 3rd party (even if author is great, site can be compromised), just to see some colors in your terminal? I don't see how do we solve this problem by the way. Most people will always choose convenience over security. And they, as a user, must have some privileges. Even if you ask, they will just go ahead and say yes to get their thing. I understand that. Is there some clever technical fix for this, or do ransomware need to get popular enough to increase users security awareness? It seems to be a really hard problem. edit: Oh, I'm not very clever, no execution necessary here, just an output from curl. Realized that just after I sent it, but I'm leaving the reply for the second OT part.

philtar 9y ago
I choose convenience over security. And so do you. You didn't read every line of every software you use,because it's not convenient.
- deleted 9y ago
  [deleted]
yzmtf2008 9y ago
This is a discussion that’s been had before and a problem that’s been solved before: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... As a gist, here’s a quote: When you install software on Linux, no matter what package manager you use, you are giving that software permission to act as you.
- saghm 9y ago
  Most (if not all) legit package managers at least use checksums to reduce the chance of malicious packages getting installed; I'm not sure about others, but I believe pacman (the Arch Linux package manager) also refuses to install packages from unless you've imported the GPG key of the distributor. This isn't to say that package managers are completely safe (nothing is), but there are fairly significant differences between using a Linux package manager and piping a script from the internet to be executed.
  - ue_ 9y ago
    The owner of the website could sign responses, and you could verify them, in addition to TLS via HTTPS. I think that can make it at least as secure as package management systems.
    - saghm 9y ago
      Yep, I agree. Providing checksums for scripts to curl isn't the the norm from what I've seen, though, which I think fits in with what GP (of my original comment) was saying. Also, I'm not super convinced that most users would bother verifying the checksum; from what I've seen, most people downloading Linux distro images don't even bother verifying the checksums that are provided.
      - JeremyBanks 9y ago
        I'd be great if something like hashpipe could become standard on Linux for this purpose. See https://news.ycombinator.com/item?id=9318286 https://news.ycombinator.com/item?id=9318286
        saghm 9y ago
        This is really cool! I hadn't heard of it before
- vacri 9y ago
  That article is mixing up "is it safe to do that from us?" and "is it safe to do that?". Do it from another vendor that isn't using https and all their reassurances about the method evaporate. Simply put: the method is bad; it's only when you use a bunch of mitigating actions that it becomes 'not bad'.
olalonde 9y ago
Kind of unrelated but I wish I could do `curl http://example.com/evil-script.sh http://example.com/evil-script.sh | vim | bash` and have vim stop the pipe if I :q! or proceed to forward stdin to stdout if I :wq.
- spb 9y ago
  That's what `vipe` is for: https://joeyh.name/code/moreutils/ https://joeyh.name/code/moreutils/
- deleted 9y ago
  [deleted]

binarymax 9y ago

I thought about that, but then I'd need to support it server side, and right now it's just a static page. For convenience I made you this (requires node): https://github.com/binarymax/bashfill/blob/master/zip2bash.js https://github.com/binarymax/bashfill/blob/master/zip2bash.j... So you can run './zip2bash.js $somebashfillurl | bash' to light it up.