4 ms·

I'm speechless. I never expected running curl could lead to such a security disaster.

by mateo1 4y ago

daptaq 4y ago
The terminal (or rather terminal emulation) is a mistake, people should stop glorifying it. It has no inherent value, beyond being able to run historical software that was bound to a terminal. Most of all one should stop confusing the terminal and the shell, which remains an interesting concept.
- dredmorbius 4y ago
  Then where should the shell be run?
  - hprotagonist 4y ago
    on the DOM, of course /s
  - daptaq 4y ago
    Acme and Emacs give good examples of how a non-terminal shell session can look like. They also make clear how a good CLI application should behave like.
- tlamponi 4y ago
  Hard disagree, it has a lot of value and there's a reason it still exists and lots of tooling is still developed for running in terminals and shells, sometimes as exclusive target. Problems with untrusted, unknown input from any source affects *all* software that process it, internet browsers, document editors, archive extractors, even just opening a file can do lots of funky stuff depending on the file system.
  - daptaq 4y ago
    Yes, and I use terminal emulators too, but I look at it the same way I look at browsers. Sure, there is a lot of useful stuff being made with heavy Javascript dependencies, weird Web frameworks, etc., but this doesn't mean that the technology is good in itself.
    - behnamoh 4y ago
      a terminal is the bare minimum you get when installing an OS (think Arch). is what gives you the power and speed to shape your workflow exactly the way you want it. running shell inside Emacs is not a bad idea, but you don’t get emacs when you install a new OS. you get a terminal that then lets you install emacs. at that point, you might as will just use the terminal.
      - daptaq 4y ago
        I don't get what that has to do with my point. Arch leans into terminal enthusiasm, so it is natural that by default all they offer is a tty to install the distribution. But as most other distributions prove, this is not necessary.
- olalonde 4y ago
  I have no idea what that comment means.
  - daptaq 4y ago
    I am saying that terminal emulation is bad?
nickstinemates 4y ago
`sudo curl | sh` to deploy my awesome service that definitely isn't a bitcoin miner, promise.
- nirui 4y ago
  To be fair, `sudo curl | sh` is completely different than `sudo curl`. In one command you pipe the output to `sh` which will run whatever instruction it receives. In another command you just ask for an output from `curl`, doing so should not cause any side effect than the output action itself.
- deleted 4y ago
  [deleted]

I'm speechless. I never expected running curl could lead to such a security disaster.

by mateo1 4y ago

I'm speechless. I never expected running curl could lead to such a security disaster.

The terminal (or rather terminal emulation) is a mistake, people should stop glorifying it. It has no inherent value, beyond being able to run historical software that was bound to a terminal. Most of all one should stop confusing the terminal and the shell, which remains an interesting concept.

dredmorbius 4y ago
Then where should the shell be run?
- hprotagonist 4y ago
  on the DOM, of course /s
- daptaq 4y ago
  Acme and Emacs give good examples of how a non-terminal shell session can look like. They also make clear how a good CLI application should behave like.
tlamponi 4y ago
Hard disagree, it has a lot of value and there's a reason it still exists and lots of tooling is still developed for running in terminals and shells, sometimes as exclusive target. Problems with untrusted, unknown input from any source affects *all* software that process it, internet browsers, document editors, archive extractors, even just opening a file can do lots of funky stuff depending on the file system.
- daptaq 4y ago
  Yes, and I use terminal emulators too, but I look at it the same way I look at browsers. Sure, there is a lot of useful stuff being made with heavy Javascript dependencies, weird Web frameworks, etc., but this doesn't mean that the technology is good in itself.
  - behnamoh 4y ago
    a terminal is the bare minimum you get when installing an OS (think Arch). is what gives you the power and speed to shape your workflow exactly the way you want it. running shell inside Emacs is not a bad idea, but you don’t get emacs when you install a new OS. you get a terminal that then lets you install emacs. at that point, you might as will just use the terminal.
    - daptaq 4y ago
      I don't get what that has to do with my point. Arch leans into terminal enthusiasm, so it is natural that by default all they offer is a tty to install the distribution. But as most other distributions prove, this is not necessary.
olalonde 4y ago
I have no idea what that comment means.
- daptaq 4y ago
  I am saying that terminal emulation is bad?

nickstinemates 4y ago

`sudo curl | sh` to deploy my awesome service that definitely isn't a bitcoin miner, promise.

nirui 4y ago
To be fair, `sudo curl | sh` is completely different than `sudo curl`. In one command you pipe the output to `sh` which will run whatever instruction it receives. In another command you just ask for an output from `curl`, doing so should not cause any side effect than the output action itself.
deleted 4y ago
[deleted]