6 ms·

> Manage your dotfiles across multiple diverse machines, securely. > $ sh -c "$(curl -fsLS https://chezmoi.io/get https://chezmoi.io/get)" -- init --apply $GIT

> Manage your dotfiles across multiple diverse machines, securely. > $ sh -c "$(curl -fsLS https://chezmoi.io/get https://chezmoi.io/get)" -- init --apply $GITHUB_USERNAME That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.

mustache_kimono 4y ago
> That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading. I don't know. I always think this line smacks of paternalism. For instance, plenty of projects suggest for installation something like: git clone https://github.com/twpayne/chezmoi/; cd chezmoi; make; sudo make install Of course, "curl | bash" is not always preferable. Re: security, "curl | bash" may be preferable here given the superuser privileges, or the privileges required by dpkg upon install of a stray deb package. But is the implication one reads the makefile and the source code before installing when one git clones a repo, but doesn't when the instructions say pipe to bash? I also think many are afraid to admit FOSS packaging security is mostly smoke and mirrors. Sure, it's nice re: trusting a mirror. It's nice for keeping track of packages and dependencies. But its technical security story vs "curl | bash" would seem only marginally better/worse depending on the circumstances. Because trust is the great problem. "curl | bash" may have a smell, but it's mostly the smell of the sewer we live in. Another question one might/should ask is -- what is the cross platform alternative? If it's "Build 10 packages for everyone," I'm not sure how happy that will make anyone. Just specifically re: this tool, imagine wanting to use it everywhere, however, you have a Mac dev laptop and your servers are a mix of Linux/FreeBSD. How much easier is it just to say "I trust chezmoi (because I would have had to trust it anyway) and 'curl | bash' is secure enough?"
shepherdjerred 4y ago
Do you disassemble and inspect every binary you run on your computer?
pjerem 4y ago
I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?
- ElectricalUnion 4y ago
  Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly. It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.
  - b3morales 4y ago
    > It also requires you to trust that the underlying http server/dns record server infrastructure did not change And what form of distribution do you propose that is secure against that? Note also that the URL is HTTPS.
- doubled112 4y ago
  Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
  - rgoulter 4y ago
    Two examples of malicious behaviour: (1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements. (2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements. The "don't curl into sh" is worried about the former. But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from. It seems weird to mention (1) without at least mentioning (2).
  - pjerem 4y ago
    Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.

mustache_kimono 4y ago

> That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading. I don't know. I always think this line smacks of paternalism. For instance, plenty of projects suggest for installation something like: git clone https://github.com/twpayne/chezmoi/; cd chezmoi; make; sudo make install Of course, "curl | bash" is not always preferable. Re: security, "curl | bash" may be preferable here given the superuser privileges, or the privileges required by dpkg upon install of a stray deb package. But is the implication one reads the makefile and the source code before installing when one git clones a repo, but doesn't when the instructions say pipe to bash? I also think many are afraid to admit FOSS packaging security is mostly smoke and mirrors. Sure, it's nice re: trusting a mirror. It's nice for keeping track of packages and dependencies. But its technical security story vs "curl | bash" would seem only marginally better/worse depending on the circumstances. Because trust is the great problem. "curl | bash" may have a smell, but it's mostly the smell of the sewer we live in. Another question one might/should ask is -- what is the cross platform alternative? If it's "Build 10 packages for everyone," I'm not sure how happy that will make anyone. Just specifically re: this tool, imagine wanting to use it everywhere, however, you have a Mac dev laptop and your servers are a mix of Linux/FreeBSD. How much easier is it just to say "I trust chezmoi (because I would have had to trust it anyway) and 'curl | bash' is secure enough?"

shepherdjerred 4y ago

Do you disassemble and inspect every binary you run on your computer?

pjerem 4y ago

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?

ElectricalUnion 4y ago
Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly. It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.
- b3morales 4y ago
  > It also requires you to trust that the underlying http server/dns record server infrastructure did not change And what form of distribution do you propose that is secure against that? Note also that the URL is HTTPS.
doubled112 4y ago
Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
- rgoulter 4y ago
  Two examples of malicious behaviour: (1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements. (2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements. The "don't curl into sh" is worried about the former. But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from. It seems weird to mention (1) without at least mentioning (2).
- pjerem 4y ago
  Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.