5 ms·

About the installation method ('hi! download this random shell script and execute it'), I agree this is really dangerous but mere installing stuff is a hairy th

About the installation method ('hi! download this random shell script and execute it'), I agree this is really dangerous but mere installing stuff is a hairy thing on linux distros. I mean what is the practical alternative? Distro package manager versions are almost always way behind. NixOS/guix are gonna solve this issue once and for all (famous last words)

IshKebab 4y ago
> this is really dangerous People repeat this a lot but really it just seems dangerous. Can you give an example of a scenario where offering a download via `curl | bash` is more dangerous than "download this installer with the hash 01234 and then execute it"?
- ben0x539 4y ago
  The site could detect that it's invoked as part of a `curl | bash` and sometimes serve a different script than you would get if you manually downloaded the script or the installer for manual inspection/auditing, making it harder to detect shenanigans. I think someone wrote this up as a PoC/blog post at some point.
  - IshKebab 4y ago
    A binary that you download could be obfuscated to make it hard to audit. A site could offer different binaries to different people, locations, times of day, user agents, etc. That's not really a realistic risk.
    - ben0x539 4y ago
      It's not so much script vs binary, but once everybody downloads a file they can compare them to make sure they're getting the same file.
      - IshKebab 4y ago
        You can download the script using curl and then inspect it and run it if you really want?
        ben0x539 4y ago
        And then we get to what I was trying to state in my original post. I don't have a strong opinion that it's good or bad practice, I just thought it was a clever thing to do about it. Edit: I think I was thinking of https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032 / https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b.... Wow, it's been a while.
- chlorion 4y ago
  You could mistype the url by a letter or two and hit enter before realizing the mistake. Creating malicious domains that are very close to popular ones is somewhat of a common thing for exactly this reason. If you downloaded and peeked into the script before running it, this would be a lot less likely to happen. There is really no downsides to downloading it, checking it out and then running it other than it not being able to be blindly copy pasted into a terminal.
  - IshKebab 4y ago
    > You could mistype the url by a letter or two and hit enter before realizing the mistake. People copy and paste these commands. They don't type them out. There's a big "copy to clipboard" button next to the rustup one.
mjw1007 4y ago
Here are some things that they could do better: - the domain in the curlbashware URL could be less shady than sh.rustup.rs - the "rustup is an official Rust project" claim on https://rustup.rs/ https://rustup.rs/ could be a link to a page somewhere on rust-lang.org that confirms that rustup.rs is the site to use
- __ryan__ 4y ago
  - the domain in the curlbashware URL could be less shady than sh.rustup.rs The domain is only as shady as it is unfamiliar. It's not shady to me since I recognize it as the canonical domain of the recommended installer for Rust, "rustup". - the "rustup is an official Rust project" claim on https://rustup.rs/ could be a link to a page somewhere on rust-lang.org that confirms that rustup.rs is the site to use It links to rust-lang.org, whose installation page then describes rustup as the recommended way to install [0]. I suppose it could link directly to the page, but what really does that gain? 0: https://www.rust-lang.org/tools/install#rustup https://www.rust-lang.org/tools/install#rustup
  - amalcon 4y ago
    It's shady because it's under the TLD for Serbia, while having no obvious connection to Serbia. I have nothing against Serbia, but the Rust project doesn't seem to have any special relationship to that country. In HN and similar places, it is pretty normal to see a cc-tld used purely because the abbreviation fits. Not everyone is used to that, though. If it were e.g. https://rustup.dev/ https://rustup.dev/, that would mitigate this concern.
    - __ryan__ 4y ago
      By that logic https://github.io https://github.io is shady. Also, a bad actor could just as well register https://rustup.dev https://rustup.dev. Rather than judging a URL in a vacuum based on the TLD, you should instead cross reference the official docs and confirm that the URL is correct.
      - 4y ago
maccard 4y ago
But it's not really dangerous, no more so than downloading an arbitrary binary and executing it at least. The script is delivered over https, so you're not going to be MITM'ed, and you're trusting rustup to provide you the valid install script. If you _are_ MITM'ed, it doesn't really matter what your delivery method is unless you do a verification from another device/network, and if you don't trust rustup then why are you downloading and executing their installer?
- ducktective 4y ago
  If they `shellcheck` their bash script, then sure. Aside from unquoted $vars, usually random shell scripts have a habit of polluting home and creating arbitrary dirs under god-knows-where and not respecting XDG. They are almost always irreversible too. Like you can't undo the steps the shell scripts have done.
  - __ryan__ 4y ago
    Any software you choose to run could not respect your desires and leave a mess. This is not a random shell script. It's the officially recommended way to install Rust [0], vetted and maintained by the community. You're free to audit the script before running it, or even check out the source [1]. If this doesn't satisfy you, check out the other installation methods [2]. Edit: I realize you're not speaking specifically about rustup, but what I said can and should apply to anything you choose to install this way. 0: https://www.rust-lang.org/tools/install#rustup https://www.rust-lang.org/tools/install#rustup 1: https://github.com/rust-lang/rustup https://github.com/rust-lang/rustup 2: https://forge.rust-lang.org/infra/other-installation-methods.html https://forge.rust-lang.org/infra/other-installation-methods...
    - marcosdumay 4y ago
      > Any software you choose to run could not respect your desires and leave a mess. On most languages, you must decide to do it to create a mess. Bash is almost alone on the place where you can do it by accident.
otterley 4y ago
> NixOS/guix are gonna solve this issue once and for all (famous last words) Should we take bets on whether this happens first, or whether nuclear fusion becomes mainstream first?

IshKebab 4y ago

> this is really dangerous People repeat this a lot but really it just seems dangerous. Can you give an example of a scenario where offering a download via `curl | bash` is more dangerous than "download this installer with the hash 01234 and then execute it"?

ben0x539 4y ago
The site could detect that it's invoked as part of a `curl | bash` and sometimes serve a different script than you would get if you manually downloaded the script or the installer for manual inspection/auditing, making it harder to detect shenanigans. I think someone wrote this up as a PoC/blog post at some point.
- IshKebab 4y ago
  A binary that you download could be obfuscated to make it hard to audit. A site could offer different binaries to different people, locations, times of day, user agents, etc. That's not really a realistic risk.
  - ben0x539 4y ago
    It's not so much script vs binary, but once everybody downloads a file they can compare them to make sure they're getting the same file.
    - IshKebab 4y ago
      You can download the script using curl and then inspect it and run it if you really want?
      - ben0x539 4y ago
        And then we get to what I was trying to state in my original post. I don't have a strong opinion that it's good or bad practice, I just thought it was a clever thing to do about it. Edit: I think I was thinking of https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032 / https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b.... Wow, it's been a while.
chlorion 4y ago
You could mistype the url by a letter or two and hit enter before realizing the mistake. Creating malicious domains that are very close to popular ones is somewhat of a common thing for exactly this reason. If you downloaded and peeked into the script before running it, this would be a lot less likely to happen. There is really no downsides to downloading it, checking it out and then running it other than it not being able to be blindly copy pasted into a terminal.
- IshKebab 4y ago
  > You could mistype the url by a letter or two and hit enter before realizing the mistake. People copy and paste these commands. They don't type them out. There's a big "copy to clipboard" button next to the rustup one.

mjw1007 4y ago

Here are some things that they could do better: - the domain in the curlbashware URL could be less shady than sh.rustup.rs - the "rustup is an official Rust project" claim on https://rustup.rs/ https://rustup.rs/ could be a link to a page somewhere on rust-lang.org that confirms that rustup.rs is the site to use

__ryan__ 4y ago
- the domain in the curlbashware URL could be less shady than sh.rustup.rs The domain is only as shady as it is unfamiliar. It's not shady to me since I recognize it as the canonical domain of the recommended installer for Rust, "rustup". - the "rustup is an official Rust project" claim on https://rustup.rs/ could be a link to a page somewhere on rust-lang.org that confirms that rustup.rs is the site to use It links to rust-lang.org, whose installation page then describes rustup as the recommended way to install [0]. I suppose it could link directly to the page, but what really does that gain? 0: https://www.rust-lang.org/tools/install#rustup https://www.rust-lang.org/tools/install#rustup
- amalcon 4y ago
  It's shady because it's under the TLD for Serbia, while having no obvious connection to Serbia. I have nothing against Serbia, but the Rust project doesn't seem to have any special relationship to that country. In HN and similar places, it is pretty normal to see a cc-tld used purely because the abbreviation fits. Not everyone is used to that, though. If it were e.g. https://rustup.dev/ https://rustup.dev/, that would mitigate this concern.
  - __ryan__ 4y ago
    By that logic https://github.io https://github.io is shady. Also, a bad actor could just as well register https://rustup.dev https://rustup.dev. Rather than judging a URL in a vacuum based on the TLD, you should instead cross reference the official docs and confirm that the URL is correct.
    - 4y ago

maccard 4y ago

But it's not really dangerous, no more so than downloading an arbitrary binary and executing it at least. The script is delivered over https, so you're not going to be MITM'ed, and you're trusting rustup to provide you the valid install script. If you _are_ MITM'ed, it doesn't really matter what your delivery method is unless you do a verification from another device/network, and if you don't trust rustup then why are you downloading and executing their installer?

ducktective 4y ago
If they `shellcheck` their bash script, then sure. Aside from unquoted $vars, usually random shell scripts have a habit of polluting home and creating arbitrary dirs under god-knows-where and not respecting XDG. They are almost always irreversible too. Like you can't undo the steps the shell scripts have done.
- __ryan__ 4y ago
  Any software you choose to run could not respect your desires and leave a mess. This is not a random shell script. It's the officially recommended way to install Rust [0], vetted and maintained by the community. You're free to audit the script before running it, or even check out the source [1]. If this doesn't satisfy you, check out the other installation methods [2]. Edit: I realize you're not speaking specifically about rustup, but what I said can and should apply to anything you choose to install this way. 0: https://www.rust-lang.org/tools/install#rustup https://www.rust-lang.org/tools/install#rustup 1: https://github.com/rust-lang/rustup https://github.com/rust-lang/rustup 2: https://forge.rust-lang.org/infra/other-installation-methods.html https://forge.rust-lang.org/infra/other-installation-methods...
  - marcosdumay 4y ago
    > Any software you choose to run could not respect your desires and leave a mess. On most languages, you must decide to do it to create a mess. Bash is almost alone on the place where you can do it by accident.

otterley 4y ago

> NixOS/guix are gonna solve this issue once and for all (famous last words) Should we take bets on whether this happens first, or whether nuclear fusion becomes mainstream first?