6 ms·
> curl https://oya.sh/get https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your custome
by Tepix 7y ago
> curl https://oya.sh/get https://oya.sh/get | bash
You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers.
Why don't you use your github releases in the installation instructions?
- grenoire 7y agoIt's already on GitHub, the shell script is just a wrapper to handle automating the download and install of the latest release.
- philbarr 7y agoRunning random automated scripts from the web is not a good idea
- kowdermeister 7y agoLike 95% of websites with JavaScript? :)
- onion2k 7y agoNo, because JS runs in the browser sandbox and has no access to the rest of your machine. That's very different to running a bash script from curl.
- ocdtrekkie 7y agoIt's not meaningfully different than downloading software with an installer/install script and running it on your machine. Though obviously, you could just curl it, read it, and then bash it.
- deleted 7y ago[deleted]
- skrebbel 7y agoIf their GitHub account gets hacked, so do their customers. What's the fundamental difference?
- bildung 7y agoYou have the download at github and the checksum at you webserver. Same effort, but now attackers would have to have both services compromised to plant a malicious download.
- skrebbel 7y agoSo you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source? And the argument here is that if you don't do that, you're shit at security?
- bildung 7y agoNo, I've said "Same effort, but now attackers would have to have both services compromised to plant a malicious download"
- coltonv 7y agoSince it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website. If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it does, and modify it before running it. It's only 140 lines and it's fairly simple. Further to your point, the bash script also does checksums internally! Putting releases up on github isn't a bad idea, but their github account credentials could also be hacked, so it's no more secure than this really.
- aerovistae 7y agoI don't understand your first paragraph. Could you elaborate?
- athenot 7y agocurl will error out if the chain of trust is invalid, unless you override it with the -k option.
- jforberg 7y agoGuess what, all you need to prove in order to get a new "valid" cert is that you control the server. And, if you control the server then you already have access to the original certificates, so you probably don't even need new certs.
- onion2k 7y agoSince it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Serving the file over HTTPS is good because it means no one can do a man in the middle attack to change it, but it's not enough to be secure. If someone compromises the server itself the file could be altered at the source. The point of the checksum is to ensure that the file you're downloading is the file you're expecting. If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, so you can be much more confident the file is correct. HTTPS on it's own doesn't give you that.
- ocdtrekkie 7y agoA blog on this general attitude: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... The difference between a digital signature and HTTPS for identity verification is probably somewhat of a toss-up, and a checksum hosted on the same server as the download is mostly useless for anything but ensuring your download of the malicious version completed successfully.
- bilus 7y agoThanks, good read. :)
- dhuramas 7y agoI recall two other popular projects doing the curl xyz| bash approach Rust[0] Chef [1] And here is an old HN comment[2] going into why it doesn't really matter. Besides it's a Show HN- why be negative when we can raise the same issue more constructively as "Please add checksums and digital signatures. Also why not use regular GitHub releases in the installation instructions?" [0] https://doc.rust-lang.org/book/ch01-01-installation.html https://doc.rust-lang.org/book/ch01-01-installation.html [1] https://docs.chef.io/install_omnibus.html https://docs.chef.io/install_omnibus.html [2] https://news.ycombinator.com/item?id=12766049 https://news.ycombinator.com/item?id=12766049
- harikb 7y agoSecurity concerns aside, a misconfigured gateway in between (say, they use Cloudflare) can easily result in an “HTML” response being piped to my bash. The f-ing mess it could create in my home directory is unimaginable.
- _frkl 7y agoReally. I didnt know that was realistically possible. Do you have an example payload to create such a mess?
- sandGorgon 7y ago+1 A docker image would be much better than a random script.
- dlivingston 7y agoWhy? Then you have to run the whole thing in Docker. That's a wholly unnecessary extra dependency. Besides, this modality of installation already has precedent with Brew and Rust.
- sandGorgon 7y agoI'm talking about the cryptographically verified part. Either you are using a package manager to manage versions, roll back, lock versions,etc. Or you use docker. Not entirely sure if a standalone script with no versioning is the best way to do this in day and age.
- fwip 7y agoI really recommend pipethis [1] for these scenarios. It's based on public-key cryptography, so an attacker who gains control of the server can't just update the hash (hosted on the same server). [1] https://github.com/ellotheth/pipethis https://github.com/ellotheth/pipethis
- deleted 7y ago[deleted]