4 ms·

Do you think clicking "yes" on an installer is any more secure?

by __jem 6y ago

seba_dos1 6y ago
Yes. For starters, it's much harder to suffer disastrous consequences from running truncated command due to terminated network connection when running an installer.
- __jem 6y ago
  This is easily rectified by script authors by adding a main function invoked at the end. At a certain point, the argument simply becomes "executing arbitrary code is potentially dangerous", which is trivially true, and also not a helpful security posture for anyone who wants to use their computer pragmatically.
  - theamk 6y ago
    Theoretically yes, it is all turing complete at the nd. Practically no, it is the matter of established conventions. For example, most interactive installers I have seen prompt for install location, and write minimal amount of files outside of it. The chance that they break your system is pretty low. At the same time, many |bash scrips like to install system-wide packages, or use pip as root, or other potentially breaking things. And they do not ask you before installing this, and often auto-confirm, too.
  - seba_dos1 6y ago
    Why? I pragmatically use my computer with packages my distro offers me. When I download something from untrusted sources, I do take a quick look at what it is before executing it. It still is dangerous since I'm not able to spend time on verifying every single line of it, but it's up to me to decide whether that's an acceptable risk or not. All perfectly pragmatic. I'm not a kind of person who's on a crusade against curling into bash, but I never do that myself because it feels dirty. It gives me no advantages and makes me unable to even take a quick look to reassure myself that things at least look like what I'd expect them to be.
    - __jem 6y ago
      I also read scripts from the user repositories on my distro. It’s perfectly pragmatic for us because we understand shell scripts and system administration. It makes me feel better too. But I would never tell someone to avoid installing developer tooling simply because it pipes curl to bash. It’s not pragmatic to tell a new developer they need to learn to be a sysadmin before installing homebrew.
      - seba_dos1 6y ago
        That's a strawman though. Nobody wants to tell that to new developers. This is all about conventions and normalizing bad behaviors. New developers should avoid piping curl to bash and explicitly download files instead because when they eventually will become experienced enough to inspect those files they will start doing it naturally. Good practices are rarely black and white, they're often there to influence how you think about stuff and what habits you develop.

Do you think clicking "yes" on an installer is any more secure?

by __jem 6y ago

Do you think clicking "yes" on an installer is any more secure?

Yes. For starters, it's much harder to suffer disastrous consequences from running truncated command due to terminated network connection when running an installer.

__jem 6y ago
This is easily rectified by script authors by adding a main function invoked at the end. At a certain point, the argument simply becomes "executing arbitrary code is potentially dangerous", which is trivially true, and also not a helpful security posture for anyone who wants to use their computer pragmatically.
- theamk 6y ago
  Theoretically yes, it is all turing complete at the nd. Practically no, it is the matter of established conventions. For example, most interactive installers I have seen prompt for install location, and write minimal amount of files outside of it. The chance that they break your system is pretty low. At the same time, many |bash scrips like to install system-wide packages, or use pip as root, or other potentially breaking things. And they do not ask you before installing this, and often auto-confirm, too.
- seba_dos1 6y ago
  Why? I pragmatically use my computer with packages my distro offers me. When I download something from untrusted sources, I do take a quick look at what it is before executing it. It still is dangerous since I'm not able to spend time on verifying every single line of it, but it's up to me to decide whether that's an acceptable risk or not. All perfectly pragmatic. I'm not a kind of person who's on a crusade against curling into bash, but I never do that myself because it feels dirty. It gives me no advantages and makes me unable to even take a quick look to reassure myself that things at least look like what I'd expect them to be.
  - __jem 6y ago
    I also read scripts from the user repositories on my distro. It’s perfectly pragmatic for us because we understand shell scripts and system administration. It makes me feel better too. But I would never tell someone to avoid installing developer tooling simply because it pipes curl to bash. It’s not pragmatic to tell a new developer they need to learn to be a sysadmin before installing homebrew.
    - seba_dos1 6y ago
      That's a strawman though. Nobody wants to tell that to new developers. This is all about conventions and normalizing bad behaviors. New developers should avoid piping curl to bash and explicitly download files instead because when they eventually will become experienced enough to inspect those files they will start doing it naturally. Good practices are rarely black and white, they're often there to influence how you think about stuff and what habits you develop.