7 ms·
The point is not about running the code, it is about verifying you are running the code you intend to run. That is why I would prefer the instructions to be: do
by _ph_ 5y ago
The point is not about running the code, it is about verifying you are running the code you intend to run. That is why I would prefer the instructions to be: download the code, compare against this checksum, then run it. The curl pipe thingy makes it too easy to inject entirely different code.
- zamadatix 5y agoThe site telling you the checksum before you download the script from the site gives you no additional security. If the site is compromised then the site is compromised.
- _ph_ 5y agoOf course the check sum would need to be distributed on a different path. A different site or just via Twitter.
- zamadatix 5y agoThe site's instructions telling you where to find the checksum isn't any different than the site's instructions telling you the checksum. If you're intentionally verifying what's on the site via a completely separate independent method (which is what you need to do to actually verify what's on the site is what should) then it doesn't really matter what the instructions on the site say in the first place as you just decided you're not relying on them for the verification. What is still needed but not implemented yet is hashes inside the served script for content it pulls from the 3rd party CDN. That said there is a reason it's alpha.