3 ms·

Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every

by treve 4y ago

Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every time I run 'npm i' arbitrary commands can also run, and now it seems wild that I ever cared about curl | bash on websites that I trust

ziml77 4y ago
Coming from a Windows world, I've never worried about the `curl | bash` thing. If I would trust an opaque Windows executable from a site, why would I not trust an equally opaque `curl | bash`? I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.
- kX4A8o4mVmX8aW 4y ago
  Windows executables can be signed, and Homebrew formulae are theoretically reviewed and check a hash when they download binaries. With curl | bash, maybe the download fails partway through, or a hacker has replaced the executable on the server or the URL in the copy/paste instructions with a homograph spoof, or the site serves malware when it detects a curl agent.
gnubison 4y ago
Part of the reason is that your connection could be interrupted … and then now what? Hope you like sifting through the script’s entirety and manually checking how much it’s done so far.
- chii 4y ago
  i'd imagine the download would have to finish first, before the piping into bash finishes and then bash interprets the finished script. I find it hard to believe you could interpret a partial script on the fly as more comes in via stdin.
  - scbrg 4y ago
    No, that's exactly how it works. Why would you write such a thing when you're clearly just guessing? A shell script is interpreted one line at the time. Very simple proof: $ while true; do printf 'date\n' && sleep 5; done | sh Mon 16 May 2022 07:19:21 AM CEST Mon 16 May 2022 07:19:26 AM CEST Mon 16 May 2022 07:19:31 AM CEST In either case, if the network connection is interrupted, the download is finished. How would sh know it's not the whole script as the author intended it? Remember that in a pipeline the receiving end only sees the pipe, and won't know about the exit status of the process upstream (which may for all we know be zero anyway).

by treve 4y ago

ziml77 4y ago

Coming from a Windows world, I've never worried about the `curl | bash` thing. If I would trust an opaque Windows executable from a site, why would I not trust an equally opaque `curl | bash`? I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.

kX4A8o4mVmX8aW 4y ago
Windows executables can be signed, and Homebrew formulae are theoretically reviewed and check a hash when they download binaries. With curl | bash, maybe the download fails partway through, or a hacker has replaced the executable on the server or the URL in the copy/paste instructions with a homograph spoof, or the site serves malware when it detects a curl agent.

gnubison 4y ago

Part of the reason is that your connection could be interrupted … and then now what? Hope you like sifting through the script’s entirety and manually checking how much it’s done so far.

chii 4y ago
i'd imagine the download would have to finish first, before the piping into bash finishes and then bash interprets the finished script. I find it hard to believe you could interpret a partial script on the fly as more comes in via stdin.
- scbrg 4y ago
  No, that's exactly how it works. Why would you write such a thing when you're clearly just guessing? A shell script is interpreted one line at the time. Very simple proof: $ while true; do printf 'date\n' && sleep 5; done | sh Mon 16 May 2022 07:19:21 AM CEST Mon 16 May 2022 07:19:26 AM CEST Mon 16 May 2022 07:19:31 AM CEST In either case, if the network connection is interrupted, the download is finished. How would sh know it's not the whole script as the author intended it? Remember that in a pipeline the receiving end only sees the pipe, and won't know about the exit status of the process upstream (which may for all we know be zero anyway).