3 ms·

So many wrongs with this comment (bypassing the obvious cargo-cult of "curl | bash needs to die yugga yugga") So your assumption here is that you can take cont

So many wrongs with this comment (bypassing the obvious cargo-cult of "curl | bash needs to die yugga yugga") So your assumption here is that you can take control over the distribution channel that lives on get.volta.sh. Ok, what other distribution methods can you think of that A) allows easy distribution of binaries and B) when the distribution channel is taken over by Alice, doesn't allow Alice to send malicious binaries? If you were to use APT and you had control over the keys for publishing to APT, the same thing happens as if you were to do "curl | bash", just via APT instead. > if I can take over that server, I have a direct channel into all their customers Volta is open source and I seem to find nothing to suggest you can pay for anything, or even donate. Calling the "users" customers is really weird. And even with that, if you take over the server you don't get a "direction channel into all of their users", you get a channel to people who installing Volta. The first would be a huge deal, the second is a big deal. ----- I really wish this "curl | bash needs to die", would die. People are just echoing what they've heard others say, without really considering how hard the "if I can take over that server" part is, and how that applies to any distribution channel, not just "curl | bash" part. It might be a leftover since the http (without TLS) days, but it should hardly be a criminal offense.

choeger 6y ago
> If you were to use APT and you had control over the keys for publishing to APT Seriously? You compare signed packages from a reputable, well-known, publicly scrutinized source with running an unchecked shell script for "trying something"? You don't even seem to understand the difference between apt and debian and you want to explain something about security? If you have any issue with how debian manages repo keys, I suggest you take it to their mailing list. Kids that run/suggest curl | bash (bash | curl is perfectly fine, btw. ;) ) really should reconsider their actual knowledge about running systems. You do not execute unknown code from the internet. Period.
- atonse 6y ago
  The curl | bash smells weird to me but I still do it from reputable enough sources since someone that doesn’t like it must be reviewing it. That said, there’s ample evidence that the “enough eyeballs” stuff doesn’t work as well as we’d like in _any_ of these situations. If a sophisticated actor wanted to insert something malicious I’m not sure that one method is easier than the other.
- capableweb 6y ago
  No, you seem to have missed my point. I'm only comparing them as distribution channels, not the workflow. If APT is compromised, it's as bad as if any distribution channel is compromised. What's with the "You don't even seem to understand the difference between apt and debian"? I've used both for countless of years by now, pretty sure I have a solid understanding. If you have anything in particular that seems to be a misunderstanding, please point that out. (Edit: probably this is because I said "Publishing to APT", yeah? If so, yes, you would technically be correct, but I think most people understand what I mean) > If you have any issue with how debian manages repo keys I don't, and I don't think anything in my comment says so either. I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, not just if you use "curl | bash" method. Also, as a reminder from the site guidelines: > Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
  - choeger 6y ago
    > I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, not just if you use "curl | bash" method. And from that you conclude that all channels must be equal? That's a logical fallacy. There are trusted channels like the debian repos. Or maybe cargo, pypi, etc. And then there is this abomination. This is like comparing a vaccination at your doctor's office to a needle found in the park (the needle looks respectable, of course) and stating "well, theoretically, my doctor could inject me poison as well, so it's probably ok to take this one here".
    - Godel_unicode 6y ago
      I love me some pypi, but it's hardly a trusted channel. There's no approval process for uploading, and there's very limited code inspection (until last fall there was none). There have been repeated examples of typo squatting malware which has been resident on pypi, which is why there are tons of security products designed specifically to allow you to use pypi safely. https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/ https://www.zdnet.com/article/two-malicious-python-libraries...

choeger 6y ago

> If you were to use APT and you had control over the keys for publishing to APT Seriously? You compare signed packages from a reputable, well-known, publicly scrutinized source with running an unchecked shell script for "trying something"? You don't even seem to understand the difference between apt and debian and you want to explain something about security? If you have any issue with how debian manages repo keys, I suggest you take it to their mailing list. Kids that run/suggest curl | bash (bash | curl is perfectly fine, btw. ;) ) really should reconsider their actual knowledge about running systems. You do not execute unknown code from the internet. Period.

atonse 6y ago
The curl | bash smells weird to me but I still do it from reputable enough sources since someone that doesn’t like it must be reviewing it. That said, there’s ample evidence that the “enough eyeballs” stuff doesn’t work as well as we’d like in _any_ of these situations. If a sophisticated actor wanted to insert something malicious I’m not sure that one method is easier than the other.
capableweb 6y ago
No, you seem to have missed my point. I'm only comparing them as distribution channels, not the workflow. If APT is compromised, it's as bad as if any distribution channel is compromised. What's with the "You don't even seem to understand the difference between apt and debian"? I've used both for countless of years by now, pretty sure I have a solid understanding. If you have anything in particular that seems to be a misunderstanding, please point that out. (Edit: probably this is because I said "Publishing to APT", yeah? If so, yes, you would technically be correct, but I think most people understand what I mean) > If you have any issue with how debian manages repo keys I don't, and I don't think anything in my comment says so either. I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, not just if you use "curl | bash" method. Also, as a reminder from the site guidelines: > Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
- choeger 6y ago
  > I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, not just if you use "curl | bash" method. And from that you conclude that all channels must be equal? That's a logical fallacy. There are trusted channels like the debian repos. Or maybe cargo, pypi, etc. And then there is this abomination. This is like comparing a vaccination at your doctor's office to a needle found in the park (the needle looks respectable, of course) and stating "well, theoretically, my doctor could inject me poison as well, so it's probably ok to take this one here".
  - Godel_unicode 6y ago
    I love me some pypi, but it's hardly a trusted channel. There's no approval process for uploading, and there's very limited code inspection (until last fall there was none). There have been repeated examples of typo squatting malware which has been resident on pypi, which is why there are tons of security products designed specifically to allow you to use pypi safely. https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/ https://www.zdnet.com/article/two-malicious-python-libraries...