3 ms·
> Piping a url into bash is not more or less risky than downloading a windows binary, installing a snap, installing a npm/composer/whatever package with post-in
by choeger 6y ago
> Piping a url into bash is not more or less risky than downloading a windows binary, installing a snap, installing a npm/composer/whatever package with post-install hooks, downloading a binary for your Mac.
Wrong. Even windows binaries are signed nowadays. When you use a package manager, you cannot be targeted (assuming the package manager uses https) so you get at least some safety from sheer numbers. A URL, otoh, can easily be personalized. I could easily serve you a specific malware whereas everyone else and GitHub just sees the benign code.
- dividedbyzero 6y ago> I could easily serve you a specific malware whereas everyone else and GitHub just sees the benign code. Could you, though? For a GitHub URL?
- SifJar 6y agoAs far as I can tell, the URLs don't have to be GitHub URLs, you can provide any URL for people to "import"
- dividedbyzero 6y agoThat's true, but I read parent as specifically talking about Github. In general, if it's on a server I control, it's more doable. Still not easy, I guess – how do you tell me apart from everyone else who fetches that same dependency? But it may be doable.
- choeger 6y agoI could obviously not change the content of a GitHub url. Well, at least not for a reasonable cost and effort. But I can easily create a "curl this and execute it" line in a README.md and have it serve malicious code just to you.