3 ms·
> Hey Everyone, here's a high severity vulnerability report, to check for it, run the folliowing: curl -shttps://raw.githubusercontent.com/noideawhatyourerunnin
by asguy 5y ago
> Hey Everyone, here's a high severity vulnerability report, to check for it, run the folliowing: curl -shttps://raw.githubusercontent.com/noideawhatyourerunning/install.sh https://raw.githubusercontent.com/noideawhatyourerunning/ins... |/bin/bash
.... oh man
- justinclift 5y agoDon't forget to add a "sudo" in there for extra goodness. :D
- deleted 5y ago[deleted]
- corobo 5y agoIt does that in the script for you :)
- capableweb 5y agoNot only that, they don't do any checksum checks either, and seem to not even publish checksums.
- lsandler 5y agoWhile I understand the concern with curl | bash, this method is used in many different open source product installations. The sh file is coming from github - pretty trustful source. You can always watch it in the browser (github will not trick you into different version) but you can also curl it or just download the source from the repository (just half a page above). You can also always review and rebuild the entire tool - another beauty of the open source. But most people just want to use the tool as fast and as simple as it can be. I guess there are options for any possible taste.
- hn_throwaway_99 5y agoHonestly, this kind of made my blood boil, and just points out how difficult security can be. Here is presumably a security company, in their own blog post outlining a high-severity vulnerability alert, advocating that you run untrusted code from some rando GitHub repo. It also outlines my fear about dealing with some "security consultants", because on the one hand they outline all of the things you need to "box check" for some security audit, but at the same time leave you less secure because they've just opened another giant gaping attack surface for your company - this is exactly what happened with the SolarWinds attack.
- deleted 5y ago[deleted]
- spockz 5y agoI thought that was entirely their point?
- hn_throwaway_99 5y agoEntirely whose point?
- deleted 5y ago[deleted]