3 ms·
Trick’s on me, someone finally got me to look up what the heck some cryptocurrency thing is because this article made no sense otherwise.
by eyelidlessness 5y ago
Trick’s on me, someone finally got me to look up what the heck some cryptocurrency thing is because this article made no sense otherwise.
- eyelidlessness 5y agoAlso this is much less sophisticated than fooling curl | sh, but people continue to insist that’s perfectly fine.
- dpwm 5y agoI don’t think I’ve seen anybody insist curl | sh is fine from untrusted sources. In many contexts, curl | sh is an alternative to adding some kind of additional repository to install a third party package — and in most package managers this is done as root anyway, with arbitrary pre-install and post-install scripts. I’m not really sold on how curl | sh (with https) is any less secure than blindly following steps to add a repo. I used to strongly dislike curl | sh, and if there’s some looming security risk beyond accidentally trusting bad actors who couldn’t be bothered to go to all the effort of setting up a repo then I’d genuinely like to know.
- eyelidlessness 5y agoYou can detect curl | sh server-side and respond with different content than the inspectable source. The link I typically cite isn’t loading for me but you should be able to find more info if you’re curious.
- Sophira 5y agoI have seen plenty of curl | sh invocations that pass the "-k" flag to curl, meaning that curl will allow insecure connections even if there are invalid SSL/TLS certificates.