4 ms·

> curl https://bun.sh/install https://bun.sh/install | bash This type of thing needs to stop

by bogwog 4y ago

metadaemon 4y ago
Yeah, people should be using fish! /s
0des 4y ago
someone demonstrated a while back how based on user agent you could serve innocuous code for a browser checking the code first, and then a different malicious payload for curl. thanks to dementiapatien below for the link https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
asadlionpk 4y ago
I disagree. This reduces friction for users. Users should be aware of what/who they are trusting.
capableweb 4y ago
Ok, let's say I have a experimental tool I want to distribute to people with a easy install. What way would you prefer to install it? Going through package registries/repositories is a slow process, so obviously want something faster. Just GitHub releases? Would you be fine if the URL instead pointed to GitHub in that case?
- forrestthewoods 4y ago
  All I want is a download link to a single .exe. Or a zip if it has runtime content/dependencies. GitHub release is fine.
  - capableweb 4y ago
    So then Bun is doing fine here? They have GitHub Release activated and are using it for releases.
    - forrestthewoods 4y ago
      Looks like it! I answered your question as stated. Which was a general question and not specific to Bun.
vore 4y ago
Why? If it's over TLS you can trust it's being served by the owner of the website. You're having to trust the person who wrote the script anyway. And before anyone says "I'm going to inspect the shell script before I run it", do also note that its purpose is to download and run binaries that you are never going to inspect.
- TimTheTinker 4y ago
  True, the only real counterpoint is someone who clones the repo, inspects it, and builds from source.
  - phist_mcgee 4y ago
    Do you really own your own operating system if you haven't compiled the kernel yourself?
    - TimTheTinker 4y ago
      Even if you do compile the kernel yourself, do you really own your OS if you haven't compiled the compiler yourself? Did you use a pre-built compiler binary to compile the compiler? Now we're getting to the real questions in life. :) (Incidentally, this is probably the most fundamental software supply chain attack vector - manipulate the compiler binary used to compile the compiler used to compile the kernel and userspace. The attack payload would never appear in any sources, but would always be present in binaries.)
      - phist_mcgee 4y ago
        A little late but an obligatory read: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
- SahAssar 4y ago
  IMO the main problem is that it isn't clear how updates will work. Some of the curl-to-bash scripts don't do anything in regards to updates at all, some add a PPA/similar on ubuntu/debian/fedora/etc. It'd be nice to know what and how I should manage updates.
vanviegen 4y ago
And we need to ban binary downloads from vendor sites as well, as those pose the exact same risks? Good luck with that!
- dementiapatien 4y ago
  Techniques like this could make curl|bash more prone to malicious activity: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
  - vore 4y ago
    You're running untrusted binaries anyway in the end, so I don't think this is anything more than a neat party trick.
    - dementiapatien 4y ago
      But this technique lets you serve malicious code to a small number of people using curl|bash, rather than hosting obviously-bad binaries that anyone can inspect and call you out on. It also lets you target the attack to specific users or IP blocks. The previous HN discussion said it better than I can: https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
  - efreak 4y ago
    Moreutils has two programs that would trivially defeat this: `sponge` reads the full input before passing it on `vipe` inserts your editor inline, so you can view/modify the input before passing it on to bash (change an install directory, etc)
deleted 4y ago
[deleted]
dang 4y ago
"Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

> curl https://bun.sh/install https://bun.sh/install | bash This type of thing needs to stop

by bogwog 4y ago

> curl https://bun.sh/install https://bun.sh/install | bash This type of thing needs to stop

metadaemon 4y ago

Yeah, people should be using fish! /s

0des 4y ago

someone demonstrated a while back how based on user agent you could serve innocuous code for a browser checking the code first, and then a different malicious payload for curl. thanks to dementiapatien below for the link https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

asadlionpk 4y ago

I disagree. This reduces friction for users. Users should be aware of what/who they are trusting.

capableweb 4y ago

Ok, let's say I have a experimental tool I want to distribute to people with a easy install. What way would you prefer to install it? Going through package registries/repositories is a slow process, so obviously want something faster. Just GitHub releases? Would you be fine if the URL instead pointed to GitHub in that case?

forrestthewoods 4y ago
All I want is a download link to a single .exe. Or a zip if it has runtime content/dependencies. GitHub release is fine.
- capableweb 4y ago
  So then Bun is doing fine here? They have GitHub Release activated and are using it for releases.
  - forrestthewoods 4y ago
    Looks like it! I answered your question as stated. Which was a general question and not specific to Bun.

vore 4y ago

Why? If it's over TLS you can trust it's being served by the owner of the website. You're having to trust the person who wrote the script anyway. And before anyone says "I'm going to inspect the shell script before I run it", do also note that its purpose is to download and run binaries that you are never going to inspect.

TimTheTinker 4y ago
True, the only real counterpoint is someone who clones the repo, inspects it, and builds from source.
- phist_mcgee 4y ago
  Do you really own your own operating system if you haven't compiled the kernel yourself?
  - TimTheTinker 4y ago
    Even if you do compile the kernel yourself, do you really own your OS if you haven't compiled the compiler yourself? Did you use a pre-built compiler binary to compile the compiler? Now we're getting to the real questions in life. :) (Incidentally, this is probably the most fundamental software supply chain attack vector - manipulate the compiler binary used to compile the compiler used to compile the kernel and userspace. The attack payload would never appear in any sources, but would always be present in binaries.)
    - phist_mcgee 4y ago
      A little late but an obligatory read: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
SahAssar 4y ago
IMO the main problem is that it isn't clear how updates will work. Some of the curl-to-bash scripts don't do anything in regards to updates at all, some add a PPA/similar on ubuntu/debian/fedora/etc. It'd be nice to know what and how I should manage updates.

vanviegen 4y ago

And we need to ban binary downloads from vendor sites as well, as those pose the exact same risks? Good luck with that!

dementiapatien 4y ago
Techniques like this could make curl|bash more prone to malicious activity: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- vore 4y ago
  You're running untrusted binaries anyway in the end, so I don't think this is anything more than a neat party trick.
  - dementiapatien 4y ago
    But this technique lets you serve malicious code to a small number of people using curl|bash, rather than hosting obviously-bad binaries that anyone can inspect and call you out on. It also lets you target the attack to specific users or IP blocks. The previous HN discussion said it better than I can: https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
- efreak 4y ago
  Moreutils has two programs that would trivially defeat this: `sponge` reads the full input before passing it on `vipe` inserts your editor inline, so you can view/modify the input before passing it on to bash (change an install directory, etc)

deleted 4y ago

[deleted]

dang 4y ago

"Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html