5 ms·

$ curl -L git.io/getnami | bash && exec -l $SHELL When will this crap end? I can't understand how can people still do that. Everyone knows it's dangerous to pi

by Hitton 7y ago

$ curl -L git.io/getnami | bash && exec -l $SHELL When will this crap end? I can't understand how can people still do that. Everyone knows it's dangerous to pipe random scripts to bash, especially from unsecured websites, and people still suggest it as recommended way to install software...

masukomi 7y ago
You're right. It's far safer to just download and run a binary you can't inspect than to execute a bash script you can inspect. Doubly so if there's a hash to guarantee the script/binary you downloaded is the one they intended. That means there aren't any nefarious things in it. ️ Alternately you could homebrew/apt-get some_package_ive_never_looked_at_the_source_of that'd be wicked safe. </sarcasm>
- Hitton 7y ago
  Very droll indeed. I don't use homebrew so I don't know how is it managed, but I have generally believe Debian maintainers to be more credible than random github user. When I see install instructions like these I always at least skim the instal script before running it. And of course Debian packages are signed unlike downloading script from unsecured website like in this case where you risk MitM attack.
  - ManWith2Plans 7y ago
    From the documentation: > Nami is a decentralized binary package manager, she allows software authors to publish their software anywhere, without having to request a merge from a software center for each update. If you're trying to install a decentralized binary package manager which doesn't require maintainers to merge anything, you're presumably planning on taking far greater risks than curling this installer.
  - txthinking 7y ago
    MitM? Why are you so ignorant? Just google git.io? Just google http 301?
    - Hitton 7y ago
      I didn't expect that I'll have to explain how does internet work, but ok. When you ask curl to download "git.io/getnami", first thing it does is to ask DNS server: "Hey, what IP does git.io refer to?" And DNS server will send you the IP address. MitM attack can happen at this point, and you will get fraudulent IP address. Usually you will get correct one. Then you connect to the IP address. MitM attack can happen here as well, you think you connected to server with the IP, but some node along the way is actually lying to you and you are in fact connecting somewhere else. At this point when using https, webserver to which you connected would prove to you that it is indeed "git.io" and your communication would become encrypted. Only after that would the webserver 301 redirected you somewhere else. But because you chose to not use https, user might have connected somewhere else and could have downloaded completely different, malicious file. Next time you accuse other people of being ignorant and rude, make sure it's not you who is in the wrong.
txthinking 7y ago
I have a question, what does this for? /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" https://raw.githubusercontent.com/Homebrew/install/master/in...
- Hitton 7y ago
  >I have a question, what does this for? >/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/in.. https://raw.githubusercontent.com/Homebrew/install/master/in.... Sorry, your first sentence still doesn't make much sense. If you are asking how is that better command than piping download into bash, it's pretty much same thing, but at least this one uses https.
  - txthinking 7y ago
    http status code 301
    - detaro 7y ago
      Is transmitted unencrypted and thus exactly vulnerable to MITM
txthinking 7y ago
What does git.io for? @Hitton Don't show your ignorance please.
- Hitton 7y ago
  >What does git.io for? >@Hitton Don't show your ignorance please. Sorry, your first sentence doesn't make any sense. And why don't you try to explain what exactly I'm ignorant of, you surely don't suffer from such defects yourself, so it should be easy for you.
  - txthinking 7y ago
    Sorry, you are really ignorant. I really don't want to discuss it with people who are rude and ignorant.
    - pipework 7y ago
      You need to be more civil here and not presume offense, nor that you're better or smarter than others. The original author of the comment did not understand your English, perhaps seek a native speaker's help to clarify in the future instead of escalating. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - dang 7y ago
      Whoa - this breaks the site guidelines badly. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here, regardless of how ignorant another commenter is or you feel they are.
dang 7y ago
Can you please not lead with a punch when posting like this? The other user shouldn't have overreacted, but your comment was nasty to begin with, especially since this is a well-known point of disagreement—not to mention well-trodden, therefore generic, therefore predictable, therefore tedious, and therefore mostly off-topic. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html See this in particular: https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html. It includes: Be respectful. Anyone sharing work is making a contribution, however modest. Ask questions out of curiosity. Don't cross-examine. Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more. When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.

by Hitton 7y ago

masukomi 7y ago

You're right. It's far safer to just download and run a binary you can't inspect than to execute a bash script you can inspect. Doubly so if there's a hash to guarantee the script/binary you downloaded is the one they intended. That means there aren't any nefarious things in it. ️ Alternately you could homebrew/apt-get some_package_ive_never_looked_at_the_source_of that'd be wicked safe. </sarcasm>

Hitton 7y ago
Very droll indeed. I don't use homebrew so I don't know how is it managed, but I have generally believe Debian maintainers to be more credible than random github user. When I see install instructions like these I always at least skim the instal script before running it. And of course Debian packages are signed unlike downloading script from unsecured website like in this case where you risk MitM attack.
- ManWith2Plans 7y ago
  From the documentation: > Nami is a decentralized binary package manager, she allows software authors to publish their software anywhere, without having to request a merge from a software center for each update. If you're trying to install a decentralized binary package manager which doesn't require maintainers to merge anything, you're presumably planning on taking far greater risks than curling this installer.
- txthinking 7y ago
  MitM? Why are you so ignorant? Just google git.io? Just google http 301?
  - Hitton 7y ago
    I didn't expect that I'll have to explain how does internet work, but ok. When you ask curl to download "git.io/getnami", first thing it does is to ask DNS server: "Hey, what IP does git.io refer to?" And DNS server will send you the IP address. MitM attack can happen at this point, and you will get fraudulent IP address. Usually you will get correct one. Then you connect to the IP address. MitM attack can happen here as well, you think you connected to server with the IP, but some node along the way is actually lying to you and you are in fact connecting somewhere else. At this point when using https, webserver to which you connected would prove to you that it is indeed "git.io" and your communication would become encrypted. Only after that would the webserver 301 redirected you somewhere else. But because you chose to not use https, user might have connected somewhere else and could have downloaded completely different, malicious file. Next time you accuse other people of being ignorant and rude, make sure it's not you who is in the wrong.

txthinking 7y ago

I have a question, what does this for? /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" https://raw.githubusercontent.com/Homebrew/install/master/in...

Hitton 7y ago
>I have a question, what does this for? >/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/in.. https://raw.githubusercontent.com/Homebrew/install/master/in.... Sorry, your first sentence still doesn't make much sense. If you are asking how is that better command than piping download into bash, it's pretty much same thing, but at least this one uses https.
- txthinking 7y ago
  http status code 301
  - detaro 7y ago
    Is transmitted unencrypted and thus exactly vulnerable to MITM

txthinking 7y ago

What does git.io for? @Hitton Don't show your ignorance please.

Hitton 7y ago
>What does git.io for? >@Hitton Don't show your ignorance please. Sorry, your first sentence doesn't make any sense. And why don't you try to explain what exactly I'm ignorant of, you surely don't suffer from such defects yourself, so it should be easy for you.
- txthinking 7y ago
  Sorry, you are really ignorant. I really don't want to discuss it with people who are rude and ignorant.
  - pipework 7y ago
    You need to be more civil here and not presume offense, nor that you're better or smarter than others. The original author of the comment did not understand your English, perhaps seek a native speaker's help to clarify in the future instead of escalating. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - dang 7y ago
    Whoa - this breaks the site guidelines badly. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here, regardless of how ignorant another commenter is or you feel they are.

dang 7y ago

Can you please not lead with a punch when posting like this? The other user shouldn't have overreacted, but your comment was nasty to begin with, especially since this is a well-known point of disagreement—not to mention well-trodden, therefore generic, therefore predictable, therefore tedious, and therefore mostly off-topic. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html See this in particular: https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html. It includes: Be respectful. Anyone sharing work is making a contribution, however modest. Ask questions out of curiosity. Don't cross-examine. Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more. When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.