4 ms·

$ bash <(curl ... Seeing this in a README immediately indicates that the author has no idea what they're doing security-wise, and that I probably shouldn't tru

$ bash <(curl ... Seeing this in a README immediately indicates that the author has no idea what they're doing security-wise, and that I probably shouldn't trust their project.

lwb 7y ago
Not necessarily ... there are many high profile projects that recommend installation this way. NodeJS and HomeBrew come to mind. Unfortunately it's sort of becoming a standard practice these days.
jdminhbg 7y ago
I've never understood why people think this is somehow less secure than downloading a binary blob you can't inspect and running that instead.
- parliament32 7y ago
  I don't think I've ever downloaded and executed a binary blob. Either use a package manager or compile from source, it's really not that hard.
  - jdminhbg 7y ago
    How is compiling and executing source you didn't examine any more secure than executing a bash script? It's not like package managers are immune either: https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/ https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_st...
truculent 7y ago
Pretty sure even like homebrew does the same thing, chief
polityagent 7y ago
whats the issue here? (genuine question) besides having to trust the author? and what installation methods do you recommend for cli tools?
- parliament32 7y ago
  A package manager. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://news.ycombinator.com/item?id=12766049 https://news.ycombinator.com/item?id=12766049 Bonus points: serving a different script to people piping to bash, and those not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
  - polityagent 7y ago
    looks like the author also provides package manager installation on further reading of the readme. I'm still not quite seeing the issue with the curl to bash, I'm trusting the author by running their tool, regardless of the installation method. And I could always download the script first to check it right?
    - polityagent 7y ago
      ah I see, the greater risk of mitm attack due the script not being hosted by a package manager, fair enough.

$ bash <(curl ... Seeing this in a README immediately indicates that the author has no idea what they're doing security-wise, and that I probably shouldn't trust their project.

lwb 7y ago

Not necessarily ... there are many high profile projects that recommend installation this way. NodeJS and HomeBrew come to mind. Unfortunately it's sort of becoming a standard practice these days.

jdminhbg 7y ago

I've never understood why people think this is somehow less secure than downloading a binary blob you can't inspect and running that instead.

parliament32 7y ago
I don't think I've ever downloaded and executed a binary blob. Either use a package manager or compile from source, it's really not that hard.
- jdminhbg 7y ago
  How is compiling and executing source you didn't examine any more secure than executing a bash script? It's not like package managers are immune either: https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/ https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_st...

truculent 7y ago

Pretty sure even like homebrew does the same thing, chief

polityagent 7y ago

whats the issue here? (genuine question) besides having to trust the author? and what installation methods do you recommend for cli tools?

parliament32 7y ago
A package manager. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://news.ycombinator.com/item?id=12766049 https://news.ycombinator.com/item?id=12766049 Bonus points: serving a different script to people piping to bash, and those not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- polityagent 7y ago
  looks like the author also provides package manager installation on further reading of the readme. I'm still not quite seeing the issue with the curl to bash, I'm trusting the author by running their tool, regardless of the installation method. And I could always download the script first to check it right?
  - polityagent 7y ago
    ah I see, the greater risk of mitm attack due the script not being hosted by a package manager, fair enough.