4 ms·

Don’t ever install software by piping arbitrary remote scripts into bash.

bluejekyll 8y ago
Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager? What would it take beyond https and a well-known site to make you comfortable doing this?
- flukus 8y ago
  > why would this be any more dangerous than downloading and installing from a a package manager? Normally the packager and developer are different people so there is a second set of eyes to at least give a cursory glance to the changes. It takes more than a single compromised account to publish malicious changes. There are of course a million exceptions and caveats to this and it's not perfect, but it's better than allowing developers to push code directly.
- adev_ 8y ago
  > Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager? Most package manager use an offline signature mechanism done at build time (rpm, dpkg, nix) and do not rely on HTTPS security for anything else than eyes-dropping reasons. Relying purely on HTTPS is insecure. Nothing guarantee you that your source / script / package did not get hacked / modified between the time you uploaded it and the time your user downloaded it. This is not hypothetical scenario, it already happened in the past with sites like sourceforge.
hollerith 8y ago
Unless you read and thoroughly understand the script first.
- michaelkrupp 8y ago
  Not even then. The Server can detect if you pipe to a shell or just download the script: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
  - Cyph0n 8y ago
    “Don’t ever” is a statement that depends on your threat model. The vast majority of users would trust Homebrew (for example) to not do something like that.
  - hollerith 8y ago
    Thanks for that. (Now I hate bash slightly more than I hated it already.)
waruqi 8y ago
This is just one of the more convenient installation methods, like homebrew, of course, we can also compile and install directly.
deleted 8y ago
[deleted]

Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager? What would it take beyond https and a well-known site to make you comfortable doing this?

flukus 8y ago
> why would this be any more dangerous than downloading and installing from a a package manager? Normally the packager and developer are different people so there is a second set of eyes to at least give a cursory glance to the changes. It takes more than a single compromised account to publish malicious changes. There are of course a million exceptions and caveats to this and it's not perfect, but it's better than allowing developers to push code directly.
adev_ 8y ago
> Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager? Most package manager use an offline signature mechanism done at build time (rpm, dpkg, nix) and do not rely on HTTPS security for anything else than eyes-dropping reasons. Relying purely on HTTPS is insecure. Nothing guarantee you that your source / script / package did not get hacked / modified between the time you uploaded it and the time your user downloaded it. This is not hypothetical scenario, it already happened in the past with sites like sourceforge.

hollerith 8y ago

Unless you read and thoroughly understand the script first.

michaelkrupp 8y ago
Not even then. The Server can detect if you pipe to a shell or just download the script: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- Cyph0n 8y ago
  “Don’t ever” is a statement that depends on your threat model. The vast majority of users would trust Homebrew (for example) to not do something like that.
- hollerith 8y ago
  Thanks for that. (Now I hate bash slightly more than I hated it already.)

waruqi 8y ago

This is just one of the more convenient installation methods, like homebrew, of course, we can also compile and install directly.

deleted 8y ago

[deleted]