4 ms·

This is a discussion that’s been had before and a problem that’s been solved before: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-ins

by yzmtf2008 9y ago

This is a discussion that’s been had before and a problem that’s been solved before: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... As a gist, here’s a quote: When you install software on Linux, no matter what package manager you use, you are giving that software permission to act as you.

saghm 9y ago
Most (if not all) legit package managers at least use checksums to reduce the chance of malicious packages getting installed; I'm not sure about others, but I believe pacman (the Arch Linux package manager) also refuses to install packages from unless you've imported the GPG key of the distributor. This isn't to say that package managers are completely safe (nothing is), but there are fairly significant differences between using a Linux package manager and piping a script from the internet to be executed.
- ue_ 9y ago
  The owner of the website could sign responses, and you could verify them, in addition to TLS via HTTPS. I think that can make it at least as secure as package management systems.
  - saghm 9y ago
    Yep, I agree. Providing checksums for scripts to curl isn't the the norm from what I've seen, though, which I think fits in with what GP (of my original comment) was saying. Also, I'm not super convinced that most users would bother verifying the checksum; from what I've seen, most people downloading Linux distro images don't even bother verifying the checksums that are provided.
    - JeremyBanks 9y ago
      I'd be great if something like hashpipe could become standard on Linux for this purpose. See https://news.ycombinator.com/item?id=9318286 https://news.ycombinator.com/item?id=9318286
      - saghm 9y ago
        This is really cool! I hadn't heard of it before
vacri 9y ago
That article is mixing up "is it safe to do that from us?" and "is it safe to do that?". Do it from another vendor that isn't using https and all their reassurances about the method evaporate. Simply put: the method is bad; it's only when you use a bunch of mitigating actions that it becomes 'not bad'.

saghm 9y ago

Most (if not all) legit package managers at least use checksums to reduce the chance of malicious packages getting installed; I'm not sure about others, but I believe pacman (the Arch Linux package manager) also refuses to install packages from unless you've imported the GPG key of the distributor. This isn't to say that package managers are completely safe (nothing is), but there are fairly significant differences between using a Linux package manager and piping a script from the internet to be executed.

ue_ 9y ago
The owner of the website could sign responses, and you could verify them, in addition to TLS via HTTPS. I think that can make it at least as secure as package management systems.
- saghm 9y ago
  Yep, I agree. Providing checksums for scripts to curl isn't the the norm from what I've seen, though, which I think fits in with what GP (of my original comment) was saying. Also, I'm not super convinced that most users would bother verifying the checksum; from what I've seen, most people downloading Linux distro images don't even bother verifying the checksums that are provided.
  - JeremyBanks 9y ago
    I'd be great if something like hashpipe could become standard on Linux for this purpose. See https://news.ycombinator.com/item?id=9318286 https://news.ycombinator.com/item?id=9318286
    - saghm 9y ago
      This is really cool! I hadn't heard of it before

vacri 9y ago

That article is mixing up "is it safe to do that from us?" and "is it safe to do that?". Do it from another vendor that isn't using https and all their reassurances about the method evaporate. Simply put: the method is bad; it's only when you use a bunch of mitigating actions that it becomes 'not bad'.