4 ms·

curl www.foo.bar | sh Yeah, right.

by erikb 9y ago

lowtolerance 9y ago
> Or Download Literally immediately below the install script. I wish people would leave these low-effort comments on reddit where they belong.
- erikb 9y ago
  And? Just because "smoking creates cancer" stickers on cigarettes they don't kill people anymore? Just having that suggestion burried somewhere on page 300 of a documentation is worth enough to mention it. It's not a question of free choice but a question of how we educate people to develop software.
  - lowtolerance 9y ago
    I thinks it’s a matter of how we educate our arm-chair security experts, actually. What is the difference between blindly trusting a script piped directly from the source and blindly trusting a script packaged in a tarball? Can you honestly say that you’ve audited every piece of code that you execute on your system, and can say with complete confidence that no data on your system has been tampered with? Do you reverse engineer and audit your unsigned binary installers before executing them? If not, then I’m very curious to hear why you believe that you are somehow avoiding the same risks posed by a curl | sh script such as this one.
asadlionpk 9y ago
why not though? how is 'git clone a huge repo and run an obfuscated makefile' safer?
- geofft 9y ago
  I do genuinely wonder if all the folks on the "let's make fun of curl | sh" train also steadfastly refuse to run ./configure on tarballs from SourceForge, and instead spend the time to audit every custom M4 macro in the project along with every Makefile.am (lest either of them shell out to something untoward) and run autoreconf themselves.
  - lstamour 9y ago
    Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routines didn't make it in. I'm assuming, of course, that any code you compile, you'd eventually want to /run/ somewhere. And if you're going to sandbox it or use permissions to restrict it, well, you could always do the same with the curl command. ;-)
- erikb 9y ago
  git check certificates to make sure the source is (more likely to be) legit. And as far as I know it doesn't randomly executes downloaded files without giving you the opportunity to review them.
  - icebraining 9y ago
    curl also checks the HTTPS certificate.

curl www.foo.bar | sh Yeah, right.

by erikb 9y ago

curl www.foo.bar | sh Yeah, right.

> Or Download Literally immediately below the install script. I wish people would leave these low-effort comments on reddit where they belong.

erikb 9y ago
And? Just because "smoking creates cancer" stickers on cigarettes they don't kill people anymore? Just having that suggestion burried somewhere on page 300 of a documentation is worth enough to mention it. It's not a question of free choice but a question of how we educate people to develop software.
- lowtolerance 9y ago
  I thinks it’s a matter of how we educate our arm-chair security experts, actually. What is the difference between blindly trusting a script piped directly from the source and blindly trusting a script packaged in a tarball? Can you honestly say that you’ve audited every piece of code that you execute on your system, and can say with complete confidence that no data on your system has been tampered with? Do you reverse engineer and audit your unsigned binary installers before executing them? If not, then I’m very curious to hear why you believe that you are somehow avoiding the same risks posed by a curl | sh script such as this one.

asadlionpk 9y ago

why not though? how is 'git clone a huge repo and run an obfuscated makefile' safer?

geofft 9y ago
I do genuinely wonder if all the folks on the "let's make fun of curl | sh" train also steadfastly refuse to run ./configure on tarballs from SourceForge, and instead spend the time to audit every custom M4 macro in the project along with every Makefile.am (lest either of them shell out to something untoward) and run autoreconf themselves.
- lstamour 9y ago
  Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routines didn't make it in. I'm assuming, of course, that any code you compile, you'd eventually want to /run/ somewhere. And if you're going to sandbox it or use permissions to restrict it, well, you could always do the same with the curl command. ;-)
erikb 9y ago
git check certificates to make sure the source is (more likely to be) legit. And as far as I know it doesn't randomly executes downloaded files without giving you the opportunity to review them.
- icebraining 9y ago
  curl also checks the HTTPS certificate.