6 ms·

The install process is curling a script into bash: curl -sSL https://install.pi-hole.net | bash :-)

daef 8y ago
https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- smittywerben 8y ago
  Curl bash is fine [0]. Even Windows tools do this now [1]. That said, if you're a linux admin you shouldn't copy-paste r̼̯ḁ͙̬̕n̪͍̯d̳̦͓̜͉͜o̴̳m̳͚ ̡̭s̜̦̣̠̀h͓̲i̼̫̮̗̜t̜̗̜̪̬̲͟ anyways. [0] https://brew.sh/ https://brew.sh/ [1] https://chocolatey.org/install#installing-chocolatey https://chocolatey.org/install#installing-chocolatey
bigiain 8y ago
They do at least call it out in the writeup as being poor form. But they don't explain why or offer any alternative...
- ziftface 8y ago
  They do have an official docker image, that's a pretty good alternative in my opinion.
- steevdave 8y ago
  Maybe they added it after you read it, but when I read the post they specifically mention it's bad and provide a link to read more on why it's bad. Sure an alternative would be great but the point of the article is to get up and running with the pi-hole software so they went with the fastest install.
- WaLLy3K 8y ago
  What we need is for the blog to explain things as nicely as the GitHub repo does - unfortunately, it's a topic that's a bit hard to concisely explain in one line. Repo explanation: https://github.com/pi-hole/pi-hole#one-step-automated-install https://github.com/pi-hole/pi-hole#one-step-automated-instal...
- pbhjpbhj 8y ago
  If by they you mean the pi-hole website then I recall being told I could download it and run the download if I didn't want to pipe curl to bash.
  - ziftface 8y ago
    I mean really how is that different from downloading .exe installers and running them?
    - Karunamon 8y ago
      The more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
      - bigiain 8y ago
        I reckon the biggest problem is normalising the pattern. Piping (https) curl to shell from a site who you were going to trust and download software/run from if they had an alternative method anyway - is no less secure than downloading a tarball or .dmg from the same site. Getting into the habit of piping curl to shell is a bad idea though. It's gonna be easier when you're in a rush to not notice you're copy-pasting "curl -sSL https://install.pi-hole.ru https://install.pi-hole.ru | bash" from some "helpful" forum post...
Tomte 8y ago
Who cares? Do you unpack your deb archives and look through them, in case the packager snuck something in?
- pbhjpbhj 8y ago
  Um, sometimes; but I'm conscious it would be pretty easy to sneak something below my radar ... I do check for usage figures, project involvement, apparent real name usage and such when considering random apt repos (PPAs).
- klodolph 8y ago
  Where the hell did this argument come from? “If you don’t personally inspect your .deb you might as well be piping curl | sh?” You can sign a .deb, there’s a whole infrastructure around distributing PGP keys for repos, and plenty of us do examine .deb file from strange places before installing them (like ok, this package runs a service but with appropriately restricted privileges, or that package just has data in it, and yes, some of us examine the source). And when someone distributes a bad .deb we have the ability to put together the package and its signature to get basically a smoking gun that person X is compromised and their key should be revoked immediately. The thing is, with a .deb you don't actually have to detect everything ahead of time you can archive the .deb and figure out what happened after you get pwned. With curl | sh it’s basically impossible. There's no signature, just a bit of TLS at best which is gone to the ether. You can't sign curl | sh and there are some pretty nice attacks which you can use to thwart people who try to read the script sent from the server. I've seen reports of spear phishing attacks sent to otherwise sophisticated developers that use curl | sh as their vector... because curl | sh is fucking perfect for spear phishing. A .deb... is not.
  - Tomte 8y ago
    > “If you don’t personally inspect your .deb you might as well be piping curl | sh?” Exactly. I stand by it. Practically speaking the TLS bit is the important thing. Your package signature doesn't offer more in practice. And the "smoking gun" part is something nobody cares about. By then their systems are compromised.
raverbashing 8y ago
Seems like RPi needs a trusted package manager solution
- boomlinde 8y ago
  It already has a bunch, depending on which OS you are running.
- majewsky 8y ago
  That's like saying the 2018 Lenovo X1 Carbon needs its own trusted package manager.
- geerlingguy 8y ago
  I’m not sure why Pi Hole doesn’t even maintain a Raspbian apt repo; I’m guessing at least 95% of users use it since it’s the ‘default’ OS for the Pi. Failing that, Debian itself.

daef 8y ago

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

smittywerben 8y ago
Curl bash is fine [0]. Even Windows tools do this now [1]. That said, if you're a linux admin you shouldn't copy-paste r̼̯ḁ͙̬̕n̪͍̯d̳̦͓̜͉͜o̴̳m̳͚ ̡̭s̜̦̣̠̀h͓̲i̼̫̮̗̜t̜̗̜̪̬̲͟ anyways. [0] https://brew.sh/ https://brew.sh/ [1] https://chocolatey.org/install#installing-chocolatey https://chocolatey.org/install#installing-chocolatey

bigiain 8y ago

They do at least call it out in the writeup as being poor form. But they don't explain why or offer any alternative...

ziftface 8y ago
They do have an official docker image, that's a pretty good alternative in my opinion.
steevdave 8y ago
Maybe they added it after you read it, but when I read the post they specifically mention it's bad and provide a link to read more on why it's bad. Sure an alternative would be great but the point of the article is to get up and running with the pi-hole software so they went with the fastest install.
WaLLy3K 8y ago
What we need is for the blog to explain things as nicely as the GitHub repo does - unfortunately, it's a topic that's a bit hard to concisely explain in one line. Repo explanation: https://github.com/pi-hole/pi-hole#one-step-automated-install https://github.com/pi-hole/pi-hole#one-step-automated-instal...
pbhjpbhj 8y ago
If by they you mean the pi-hole website then I recall being told I could download it and run the download if I didn't want to pipe curl to bash.
- ziftface 8y ago
  I mean really how is that different from downloading .exe installers and running them?
  - Karunamon 8y ago
    The more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
    - bigiain 8y ago
      I reckon the biggest problem is normalising the pattern. Piping (https) curl to shell from a site who you were going to trust and download software/run from if they had an alternative method anyway - is no less secure than downloading a tarball or .dmg from the same site. Getting into the habit of piping curl to shell is a bad idea though. It's gonna be easier when you're in a rush to not notice you're copy-pasting "curl -sSL https://install.pi-hole.ru https://install.pi-hole.ru | bash" from some "helpful" forum post...

Tomte 8y ago

Who cares? Do you unpack your deb archives and look through them, in case the packager snuck something in?

pbhjpbhj 8y ago
Um, sometimes; but I'm conscious it would be pretty easy to sneak something below my radar ... I do check for usage figures, project involvement, apparent real name usage and such when considering random apt repos (PPAs).
klodolph 8y ago
Where the hell did this argument come from? “If you don’t personally inspect your .deb you might as well be piping curl | sh?” You can sign a .deb, there’s a whole infrastructure around distributing PGP keys for repos, and plenty of us do examine .deb file from strange places before installing them (like ok, this package runs a service but with appropriately restricted privileges, or that package just has data in it, and yes, some of us examine the source). And when someone distributes a bad .deb we have the ability to put together the package and its signature to get basically a smoking gun that person X is compromised and their key should be revoked immediately. The thing is, with a .deb you don't actually have to detect everything ahead of time you can archive the .deb and figure out what happened after you get pwned. With curl | sh it’s basically impossible. There's no signature, just a bit of TLS at best which is gone to the ether. You can't sign curl | sh and there are some pretty nice attacks which you can use to thwart people who try to read the script sent from the server. I've seen reports of spear phishing attacks sent to otherwise sophisticated developers that use curl | sh as their vector... because curl | sh is fucking perfect for spear phishing. A .deb... is not.
- Tomte 8y ago
  > “If you don’t personally inspect your .deb you might as well be piping curl | sh?” Exactly. I stand by it. Practically speaking the TLS bit is the important thing. Your package signature doesn't offer more in practice. And the "smoking gun" part is something nobody cares about. By then their systems are compromised.

raverbashing 8y ago

Seems like RPi needs a trusted package manager solution

boomlinde 8y ago
It already has a bunch, depending on which OS you are running.
majewsky 8y ago
That's like saying the 2018 Lenovo X1 Carbon needs its own trusted package manager.
geerlingguy 8y ago
I’m not sure why Pi Hole doesn’t even maintain a Raspbian apt repo; I’m guessing at least 95% of users use it since it’s the ‘default’ OS for the Pi. Failing that, Debian itself.