5 ms·

Is this much worse than downloading some installer and running it? Those can be just as compromised. So can packages in package managers for that matter.

kim0 5y ago
Exactly! At least I can read the script but not the binary!!
- jen20 5y ago
  Perhaps… [1]. [1]: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- rbanffy 5y ago
  That's why the traditional Windows way of downloading a setup.exe and running it with admin privileges is a bit scary for people coming from other platforms. Installing an .msi is less bad, or so we are taught.
e12e 5y ago
Depends. On windows an installer might be signed. On Linux a package should be signed. You can't know that curl and your browser get the same data - but you can for example split it up: curl https://pyenv.run -o install.sh #examine install.sh bash install.sh Ed: or just "save as" like with an installer. Piping straight to bash can be especially bad if you've cached sudo credentials for the current session - some of these scripts call sudo "inside". Otoh - the connection is signed (it's https)-unfortunately it's often quite easy to compromise a web site. Obviously, listing gpg signatures on the same page doesn't add much unless it's possible to verify the gpg key some other way. Ed: another problem is that you really should check exactly what's in you clipboard before pasting to a terminal.
- maccard 5y ago
  The safety in your steps is reading the script, not in avoiding curl | bash. An installer being signed doesn't guarantee it's not malcious; if someone has overtaken a host and replaced the binaries, they'll just sign them themselves. Unless you're manually inspecting the signature matches your expected source, running a signed binary doesn't save you.
  - e12e 5y ago
    > The safety in your steps is reading the script, not in avoiding curl | bash Well, yes. The safety is in doing something between "acquire potentially malicious payload" and "running payload". I don't see how "safety [is] not in avoiding curl | bash" when, avoiding the direct pipe to bash is exactly what I suggest. If you look at the url, then curl and pipe that url, you have no idea if bash sees what you just reviewed.
    - maccard 5y ago
      But you have exactly the same problem with downloading a binary, or running pip install. You have no idea what that code does, so curl | bash doesnt hurt any more than any other normal methods of installation.
      - e12e 5y ago
        It's a little easier to read a 10 line bash script than a 35 mb binary installer?
        maccard 5y ago
        Do you read the source of every setup.py you run before running pip install? Also, if you are untrusting of the source enough to verify their install script is safe, why would you install their template to run on your machine without verifying all of that too? Finally, 10 line bash script might (as tbis example does) just call out to another curl | bash, or to a pip install/npm install.
rbanffy 5y ago
> Is this much worse than downloading some installer and running it? Yes. You should inspect what you download. Also, you should probably use the Python interpreters provided by your Linux distro, that stay in directories you usually can't write to and come in signed packages. On a Mac, the next best thing would be MacPorts.
- rovr138 5y ago
  Nothing here overrides there system wide Python version. The article specificially goes into why not to do it. > pyenv allows us to set up any version of Python as a global Python interpreter but we are not going to do that. There can be some scripts or other programs that rely on the default interpreter, so we don’t want to mess that up.
  - rbanffy 5y ago
    Using the Python interpreters in your system doesn't mean you can't make virtualenvs out of them - it's just that they are precompiled and well supported on your specific OS. I used custom Python interpreters a lot and it's nice to be able to rely on the system to provide a sensible environment instead of forcing myself to build my own.

kim0 5y ago

Exactly! At least I can read the script but not the binary!!

jen20 5y ago
Perhaps… [1]. [1]: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
rbanffy 5y ago
That's why the traditional Windows way of downloading a setup.exe and running it with admin privileges is a bit scary for people coming from other platforms. Installing an .msi is less bad, or so we are taught.

e12e 5y ago

Depends. On windows an installer might be signed. On Linux a package should be signed. You can't know that curl and your browser get the same data - but you can for example split it up: curl https://pyenv.run -o install.sh #examine install.sh bash install.sh Ed: or just "save as" like with an installer. Piping straight to bash can be especially bad if you've cached sudo credentials for the current session - some of these scripts call sudo "inside". Otoh - the connection is signed (it's https)-unfortunately it's often quite easy to compromise a web site. Obviously, listing gpg signatures on the same page doesn't add much unless it's possible to verify the gpg key some other way. Ed: another problem is that you really should check exactly what's in you clipboard before pasting to a terminal.

maccard 5y ago
The safety in your steps is reading the script, not in avoiding curl | bash. An installer being signed doesn't guarantee it's not malcious; if someone has overtaken a host and replaced the binaries, they'll just sign them themselves. Unless you're manually inspecting the signature matches your expected source, running a signed binary doesn't save you.
- e12e 5y ago
  > The safety in your steps is reading the script, not in avoiding curl | bash Well, yes. The safety is in doing something between "acquire potentially malicious payload" and "running payload". I don't see how "safety [is] not in avoiding curl | bash" when, avoiding the direct pipe to bash is exactly what I suggest. If you look at the url, then curl and pipe that url, you have no idea if bash sees what you just reviewed.
  - maccard 5y ago
    But you have exactly the same problem with downloading a binary, or running pip install. You have no idea what that code does, so curl | bash doesnt hurt any more than any other normal methods of installation.
    - e12e 5y ago
      It's a little easier to read a 10 line bash script than a 35 mb binary installer?
      - maccard 5y ago
        Do you read the source of every setup.py you run before running pip install? Also, if you are untrusting of the source enough to verify their install script is safe, why would you install their template to run on your machine without verifying all of that too? Finally, 10 line bash script might (as tbis example does) just call out to another curl | bash, or to a pip install/npm install.

rbanffy 5y ago

> Is this much worse than downloading some installer and running it? Yes. You should inspect what you download. Also, you should probably use the Python interpreters provided by your Linux distro, that stay in directories you usually can't write to and come in signed packages. On a Mac, the next best thing would be MacPorts.

rovr138 5y ago
Nothing here overrides there system wide Python version. The article specificially goes into why not to do it. > pyenv allows us to set up any version of Python as a global Python interpreter but we are not going to do that. There can be some scripts or other programs that rely on the default interpreter, so we don’t want to mess that up.
- rbanffy 5y ago
  Using the Python interpreters in your system doesn't mean you can't make virtualenvs out of them - it's just that they are precompiled and well supported on your specific OS. I used custom Python interpreters a lot and it's nice to be able to rely on the system to provide a sensible environment instead of forcing myself to build my own.