4 ms·
Disappointed to see Marcan et al asking users to blindly copy and paste a curl command from the internet. “Ready to give it a shot? Make sure to update your ma
by MaxLeiter 5y ago
Disappointed to see Marcan et al asking users to blindly copy and paste a curl command from the internet.
“Ready to give it a shot? Make sure to update your macOS to version 12.3 or later, then just pull up a Terminal in macOS and paste in this command:”
Other than that, fantastic work and I look forward to eventually having an M1 to run Asahi on
Edit: I just wish the wording would encourage you to verify the file. I don’t think there’s something inherently wrong with using shell scripts from the internet. But massive companies let domains expire, why won’t marcan?
- kyleee 5y agocurl and perl
- deleted 5y ago[deleted]
- emodendroket 5y agoLet's say he instead did a traditional installer link. Would it be any different for most users? Nobody actually checks the checksum.
- MBCook 5y agoSomehow that feels way safer. I guess it’s not, but it feels like it is.
- gjsman-1000 5y agoYeah - except if you owned the domain, you can also change the posted hash you are comparing against. Security theater mostly.
- glandium 5y agoA traditional installer for mac would be signed, though. Which only really means someone paid $99 to Apple.
- celdon25 5y ago> Nobody actually checks the checksum. This is incorrect. For hardened installations, it is an absolute must. That being said, I don't see that as being reasonable to expect for this alpha distro.
- HL33tibCe7 5y agochecks off square on HN bingo card
- dm319 5y agoI think I saw a 'let me explain to you why you're wrong above', so I think I'm doing well.
- jpgvm 5y agoWe should crowdsource a good HN bingo card. It would probably be a great drinking game.
- deleted 5y ago[deleted]
- zwegner 5y agoIt's not quite what you're talking about, but this comment is a great HN parody that could provide a lot of ideas: https://news.ycombinator.com/item?id=23003595 https://news.ycombinator.com/item?id=23003595
- saagarjha 5y agoYou’re about to take his code and run it as a bootloader and you have concerns with piping a command into a shell?
- cjensen 5y agoIf a hacker has the skill to make an evil boot loader, I'm prepared to be impressed. In contrast, creating a shell script to do something evil is literally the definition of a script kiddie. At the very least, instead of the one liner give me a two liner: one to download to a file, then a second line to execute it.
- zamadatix 5y ago> If a hacker has the skill to make an evil boot loader, I'm prepared to be impressed. Prepare to be impressed, the bootloader this installs to be able to boot Linux was first made for the capability of transparently running macOS under its hypervisor intercepting every hardware call transparently and streaming it to remote PCs to enable reverse engineering.
- _ph_ 5y agoThe point is not about running the code, it is about verifying you are running the code you intend to run. That is why I would prefer the instructions to be: download the code, compare against this checksum, then run it. The curl pipe thingy makes it too easy to inject entirely different code.
- zamadatix 5y agoThe site telling you the checksum before you download the script from the site gives you no additional security. If the site is compromised then the site is compromised.
- _ph_ 5y agoOf course the check sum would need to be distributed on a different path. A different site or just via Twitter.
- jazzyjackson 5y agoIt's a curl command from a domain he controls, what's the difference between that and downloading a binary?
- MaxLeiter 5y agoI would also encourage not distributing binaries without checksums available on multiple sources
- fragmede 5y agoThe checksum only proves it came from where it says it did without modification. You still have to trust the original author to be honest about what the code really does.
- _ph_ 5y agoThe problem is, this install is open for exploit for anyone, who manages to access content on that server. A single exploitable security hole in the web server or its setup, and you can easily compromise anyone installing Asahi Linux. As you are even running a shell script, it is sufficient to inject one line into the installation script, which also installs malware while installing Linux.
- rowanG077 5y agoYes I too worry about running a shell script from the person whose kernel modules I'm about the install.
- _ph_ 5y agoI am not worried that Hector writes bad shell scripts, I am worried, someone might inject something malicious.
- imwillofficial 5y agoMaybe Alpha means something else in your circles. Most places it means “extreme early preview” For anyone who would be running curl, you can easily not pipe to shell and inspect the script yourself.