4 ms·

That's probably why you should: - download the bash script - inspect the script / add a 'set -x' for tracing - then run (the downloaded script) with log outp

That's probably why you should: - download the bash script - inspect the script / add a 'set -x' for tracing - then run (the downloaded script) with log output somewhere.

dastx 6y ago
set -x won't do much though. All it will tell you is what it did, but by the time you realise, the damage could already be done.
- adriancr 6y ago
  that's why you download and inspect the script first. and you run the downloaded script, never curl|bash
  - richardwhiuk 6y ago
    And then just leave it to install whatever binary it did.
mehrdadn 6y ago
If you want to enable tracing you can just bash -x
londons_explore 6y ago
The difference between a malicious and a legit bash script can be just a couple of characters. Eg. the script can have a deliberate injection vulnerability in a variable expansion... If people commonly inspected bash scripts they downloaded, attackers would just write the script more carefully to make sure 15 minutes reading the script wouldn't find anything bad going on.
- prepend 6y ago
  Fortunately it’s not common, so they don’t. If it became common and they did, I could inspect the script using automated tools that check for obfuscation, etc. I think it’s not about eliminating, but making a little better. With lots of this stuff, it’s just about being faster than the other guys that the bear is chasing. It’s kind of moot because all this is solved by “don’t download and run scripts from strangers.” Then you just have to worry about someone rooting homebrew. I don’t like this line of thought because it ultimately gets us to a Microsoft world where everything is signed and there’s still tons of crap getting through. I’d rather have it where scripts can be individually assessed and run without lots of expensive stuff in the middle. Even if that means some risk.
pornel 6y ago
1. Carefully inspect the 15 lines of the installer. 2. Run the million lines of code that it installed, without inspecting them.

That's probably why you should: - download the bash script - inspect the script / add a 'set -x' for tracing - then run (the downloaded script) with log output somewhere.

dastx 6y ago

set -x won't do much though. All it will tell you is what it did, but by the time you realise, the damage could already be done.

adriancr 6y ago
that's why you download and inspect the script first. and you run the downloaded script, never curl|bash
- richardwhiuk 6y ago
  And then just leave it to install whatever binary it did.

mehrdadn 6y ago

If you want to enable tracing you can just bash -x

londons_explore 6y ago

The difference between a malicious and a legit bash script can be just a couple of characters. Eg. the script can have a deliberate injection vulnerability in a variable expansion... If people commonly inspected bash scripts they downloaded, attackers would just write the script more carefully to make sure 15 minutes reading the script wouldn't find anything bad going on.

prepend 6y ago
Fortunately it’s not common, so they don’t. If it became common and they did, I could inspect the script using automated tools that check for obfuscation, etc. I think it’s not about eliminating, but making a little better. With lots of this stuff, it’s just about being faster than the other guys that the bear is chasing. It’s kind of moot because all this is solved by “don’t download and run scripts from strangers.” Then you just have to worry about someone rooting homebrew. I don’t like this line of thought because it ultimately gets us to a Microsoft world where everything is signed and there’s still tons of crap getting through. I’d rather have it where scripts can be individually assessed and run without lots of expensive stuff in the middle. Even if that means some risk.

pornel 6y ago

1. Carefully inspect the 15 lines of the installer. 2. Run the million lines of code that it installed, without inspecting them.