3 ms·
I will say, I find it a little annoying that going to https://alx.sh https://alx.sh directly in my browser redirects to asahilinux.org. What if I want to read t
by Wowfunhappy 5y ago
I will say, I find it a little annoying that going to https://alx.sh https://alx.sh directly in my browser redirects to asahilinux.org. What if I want to read the script before I run it?
I realize there are other ways to do that (e.g. curl), but why make it difficult?
- zamadatix 5y agoAs you note the browser can be sent something different than curl so reading what it does in a browser doesn't make much sense, especially since the script itself calls curl.
- CameronNemo 5y agoThis is indeed a good point. Malicious actors can show you one script in a browser, then serve a more malicious script with curl. I do not understand why Asahi decided they needed a tiny domain just to serve a download script. It means users have to trust more domains with weird characters (was that A L X . S H or A I X . S H ? Oops).
- zamadatix 5y agoIt would seem to be convenient if https://asahilinux.org/ https://asahilinux.org/ also worked the same way (serve the script if it's curl, show the page if it's a browser) for those that don't want to remember or use the short URL. If you pop that suggestion in the IRC/Matrix room they very well might make it so.
- deno 5y agoIt’s worse than that. You can verify `curl <url>` and still get pwned, because it’s possible to detect if you pipe it into anything[1]. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- marcan_42 5y agoalx.sh serves you this script: https://github.com/AsahiLinux/asahi-installer/blob/main/scripts/bootstrap-prod.sh https://github.com/AsahiLinux/asahi-installer/blob/main/scri... It's proxied to avoid requiring users to use curl -L, otherwise I'd just have made it redirect.