4 ms·
`curl | bash` downloads an installation script and runs it as it's being downloaded, with no opportunity to read the script and ensure it does nothing malicious
by beojan 6y ago
`curl | bash` downloads an installation script and runs it as it's being downloaded, with no opportunity to read the script and ensure it does nothing malicious, and has no inadvertent bugs that could cause damage.
- taejo 6y agoJust like if I'd done `curl > install.sh; bash install.sh` without reading install.sh or installed a binary package, both of which are done every day by people with work to do and without the time, skill and inclination to audit millions of lines of source code.
- ciceryadam 6y agoor curl --output instead of using stdout
- willeh 6y agoAs opposed to downloading a binary and running it? We don't verify what the binaries we download contain, why do it for a bash script?
- dastx 6y agoI suppose the difference is iff people do very script before they run, this could bypass it. But I think, those people would definitely download it, inspect it, then run the downloaded script.
- VBprogrammer 6y agoI think it would take next to no effort to hide something in a bash script in such a way that it passed casual inspection even by an expert. See code obfuscation competitions for examples.
- OskarS 6y agoBinaries we download and run (as well as packages from package managers) are generally cryptographically signed by people you trust. Shell scripts you curl into bash are not. It is generally MUCH easier to compromise a website and insert your own malicious script than it is to compromise a developer's secret key, which is usually stored much more securely. Put it like this: if an attacker compromised Rust's website and put in their own malicious Rust installer, macOS and Windows would both show a very scary warning that's like "This is unsigned! Don't run this!" (macOS would even refuse to run it unless you did the right-click to open trick). A Linux package manager would refuse to install such a package outright, unless you --forced it. Not so with curl-to-bash, it would just silently compromise your computer. Basically, if you believe that code signing is a good thing for security (and I think we all do), curl-to-bash is awful security practice, and you should manually review the script.
- aesyondu 6y agoPardon my ignorance, but couldn't we just cryptographically sign bash scripts as well? Perhaps modify the installation script, something like `curl | some-verification-tool | bash`
- OskarS 6y agoNot easily, and probably not in a way that would work on all different systems (different distros/os's trust different keys).
- Arnavion 6y agoYou can. PowerShell already has a 15-year precedent of signed scripts - you generate a signature and embed it in the script in a specific way, and the shell can be configured to only run scripts if their signature is valid. (PowerShell script signing is based on standard Windows codesigning certificates, but of course this hypothetical bash script signature verifier can use GPG keys instead.)
- iso1631 6y agoThose who do not understand package managers are doomed to rewrite them. Badly.
- tzs 6y agoThe biggest issue is not bash script vs. binary. It is that “curl | bash” does not save the script locally. If something goes wrong, you can’t examine the script afterwards to help figure out what happened and how to recover.
- hvdijk 6y agoThe whole point of the installation script is that it downloads and installs binaries obtained from a remote server though. You already need to trust the server if you're going to do that, don't you?