3 ms·

`curl | bash` gets a bad wrap. From a security perspective (assuming you trust web pki), it's 100% no different than a) downloading and running a script, b) dow

by dcow 6y ago

`curl | bash` gets a bad wrap. From a security perspective (assuming you trust web pki), it's 100% no different than a) downloading and running a script, b) downloading a package and and installing it, c) downloading a binary blob and executing it, etc. I actually find that piping an install script to an interpreter is the easiest to audit of all the options because I can see exactly the changes that will be made to my system. I don't know where the whole "zomg pipe to bash is so insecure" vibe came from, but it's effectively developer urban myth. The only improvement is if you somehow directly exchange keys with the vendor out of band with no web pki intermediate step and then verify the signature on the software you're installing... yeah.

lmm 6y ago
> The only improvement is if you somehow directly exchange keys with the vendor out of band with no web pki intermediate step and then verify the signature on the software you're installing... yeah. Which is what Apt has done for 20+ years - packages are gpg-signed, developers sign with their individual keys (and have to have their identity verified by at least one other developer) and even someone who controls a root CA (which is most national governments and many large corporations, let's be fair) would have to mount a dedicated attack to subvert that process.
- shock 6y ago
  > Which is what Apt has done for 20+ years - packages are gpg-signed, developers sign with their individual keys AFAICT,debian packages themselves are not signed, just the repository release files are gpg-signed.
sergeykish 6y ago
You fail to see how piping to bash worse than other awful choices? It is not. It is bashed by those who value reproduction and discoverability: * every person receives same script, confirmed by signature * multiple mirrors, no single point of failure, no pull out by author (left-pad) * no silent update (browser addons) * tested to work on your system * clean remove of installed files * search in packages not in web (anti fishing) * hosted in secure environment * watched by many eyes
deleted 6y ago
[deleted]

by dcow 6y ago

lmm 6y ago

> The only improvement is if you somehow directly exchange keys with the vendor out of band with no web pki intermediate step and then verify the signature on the software you're installing... yeah. Which is what Apt has done for 20+ years - packages are gpg-signed, developers sign with their individual keys (and have to have their identity verified by at least one other developer) and even someone who controls a root CA (which is most national governments and many large corporations, let's be fair) would have to mount a dedicated attack to subvert that process.

shock 6y ago
> Which is what Apt has done for 20+ years - packages are gpg-signed, developers sign with their individual keys AFAICT,debian packages themselves are not signed, just the repository release files are gpg-signed.

sergeykish 6y ago

You fail to see how piping to bash worse than other awful choices? It is not. It is bashed by those who value reproduction and discoverability: * every person receives same script, confirmed by signature * multiple mirrors, no single point of failure, no pull out by author (left-pad) * no silent update (browser addons) * tested to work on your system * clean remove of installed files * search in packages not in web (anti fishing) * hosted in secure environment * watched by many eyes

deleted 6y ago

[deleted]