3 ms·
The article raises good points, and I agree. Seeing how piping curl to shell is a common practice to install something, I wonder what safer (and still simple)
by lioeters 8y ago
The article raises good points, and I agree.
Seeing how piping curl to shell is a common practice to install something, I wonder what safer (and still simple) alternatives there are? Recently I encountered this situation and I piped curl to a file, read through the script to ensure what it does, then chmod +x the file and ran it. Not sure if that will become a common practice though..
- atoav 8y agoIsn’t that what was more common a few years ago? I don’t really care as long as I get to see the script if I want to. Which is precisely what you can’t do with binary installers (at least not on a day to day basis)
- effie 8y agoIf you need to run some unvetted software, do so in a locked down virtual machine, or at least run it only with privileges of a very restricted unix user.
- dTal 8y agoI don't know about you, but I haven't "vetted" any of the software on my machine, in the sense of proving to myself in any strong sense that it's not malicious. I just rely on a loose web of trust and a hefty dose of contextual clues. Piping curl to bash feels dangerous, but it at least equivalent (and probably actually strictly safer) than running ./configure; make on some weird tarball.
- effie 8y agoWe all rely on the clues like is the distributor well known, is the software very interesting to attackers, etc. Piping curl of random url to shell and running configure and make of tarball from random url is dangerous, because you do not know what gets executed. I don't see a difference, it's the same problem. If you have to run those programs, the safest way is to do so on a dedicated "untrusted" computer that has as little access to your data as possible. On your main work machine, rely on vetted software from well known reliable sources, for example your OS distributor.