8 ms·

My reaction is that curl is just an aggravating factor. The real problem is shell, or really any custom scripts in any language. Acquiring or building software

My reaction is that curl is just an aggravating factor. The real problem is shell, or really any custom scripts in any language. Acquiring or building software should happen via well-understood reusable tools. Any time building executes bespoke code, you're reducing the maintainability of a system. Distro package managers are one good solution, but a properly developed language package manager would also ideally not rely on custom scripts. A contributing factor to the event-stream issue was that it was considered acceptable to distribute code minimized by _who_knows_what, rather than by any reproducible process.

oblio 7y ago
> Distro package managers are one good solution Distro package managers allow execution of custom scripts at every point of the installation. If you're getting packages from outside the distro repos, you're at risk. Sometimes you're at risk even when you get the packages from the distro repos :-)
- falcolas 7y ago
  A package is signed with a known key, so you can at least trust that the script being executed is from the developer.
  - barkingcat 7y ago
    What about the distros that modify the package before giving it to you? I'm thinking of Debian's modification of openssl for example. https://www.debian.org/security/2008/dsa-1571 https://www.debian.org/security/2008/dsa-1571 Just because it comes from a distro doesn't mean it's from the developer.
    - falcolas 7y ago
      It's still a trust issue. If I'm running a Debian based distribution, I trust Debian packages, and the content of those packages. It's a chain of trust that can't be provided by web servers and X509 certs.
- deleted 7y ago
  [deleted]
- hyperpape 7y ago
  I thought about that, but like falcolas said, they are at least signed and have some attention paid to them. At one level, any build/install tool is executing extremely complicated code on your machine, and could do lots of weird things. The advantage is that you can learn what it does, and have trust in its authors. So well behaved custom scripts created by a trusted party that has articulated standards about how things should work are much better than using shell scripts from an arbitrary project. Still, I'd certainly prefer it if the distro didn't have custom scripts either. It would simplify the task of knowing "this is how the distro does things, and there are no exceptions".
  - oblio 7y ago
    You missed something, my main point: not all packages that are installed with the distro package managers come from the distro. There's plenty of applications that package their software as .deb/.rpm/... From a security point of view, those are the same as curl | bash, basically.
    - hyperpape 7y ago
      Ah yes. I did gloss over that. I certainly feel a little sketched out when I see a project that says "add this package repo".

oblio 7y ago

> Distro package managers are one good solution Distro package managers allow execution of custom scripts at every point of the installation. If you're getting packages from outside the distro repos, you're at risk. Sometimes you're at risk even when you get the packages from the distro repos :-)

falcolas 7y ago
A package is signed with a known key, so you can at least trust that the script being executed is from the developer.
- barkingcat 7y ago
  What about the distros that modify the package before giving it to you? I'm thinking of Debian's modification of openssl for example. https://www.debian.org/security/2008/dsa-1571 https://www.debian.org/security/2008/dsa-1571 Just because it comes from a distro doesn't mean it's from the developer.
  - falcolas 7y ago
    It's still a trust issue. If I'm running a Debian based distribution, I trust Debian packages, and the content of those packages. It's a chain of trust that can't be provided by web servers and X509 certs.
deleted 7y ago
[deleted]
hyperpape 7y ago
I thought about that, but like falcolas said, they are at least signed and have some attention paid to them. At one level, any build/install tool is executing extremely complicated code on your machine, and could do lots of weird things. The advantage is that you can learn what it does, and have trust in its authors. So well behaved custom scripts created by a trusted party that has articulated standards about how things should work are much better than using shell scripts from an arbitrary project. Still, I'd certainly prefer it if the distro didn't have custom scripts either. It would simplify the task of knowing "this is how the distro does things, and there are no exceptions".
- oblio 7y ago
  You missed something, my main point: not all packages that are installed with the distro package managers come from the distro. There's plenty of applications that package their software as .deb/.rpm/... From a security point of view, those are the same as curl | bash, basically.
  - hyperpape 7y ago
    Ah yes. I did gloss over that. I certainly feel a little sketched out when I see a project that says "add this package repo".