3 ms·

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to

by pjerem 4y ago

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?

ElectricalUnion 4y ago
Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly. It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.
- b3morales 4y ago
  > It also requires you to trust that the underlying http server/dns record server infrastructure did not change And what form of distribution do you propose that is secure against that? Note also that the URL is HTTPS.
doubled112 4y ago
Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
- rgoulter 4y ago
  Two examples of malicious behaviour: (1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements. (2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements. The "don't curl into sh" is worried about the former. But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from. It seems weird to mention (1) without at least mentioning (2).
- pjerem 4y ago
  Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.
  - doubled112 4y ago
    I'm more answering the question than agreeing with the answer. Trust seems like such an arbitrary set of lines in the sand anyway. Adding a repo to your OS and installing the package? Fine. Same developer provides an install script? Absolutely not. You have to trust somebody eventually, whether it be your HW manufacturer, OS developers, packagers, developers, etc. There's a lot of it blindly going on, but a script running as your user? Just can't.

by pjerem 4y ago

ElectricalUnion 4y ago

Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly. It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.

b3morales 4y ago
> It also requires you to trust that the underlying http server/dns record server infrastructure did not change And what form of distribution do you propose that is secure against that? Note also that the URL is HTTPS.

doubled112 4y ago

Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.

rgoulter 4y ago
Two examples of malicious behaviour: (1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements. (2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements. The "don't curl into sh" is worried about the former. But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from. It seems weird to mention (1) without at least mentioning (2).
pjerem 4y ago
Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.
- doubled112 4y ago
  I'm more answering the question than agreeing with the answer. Trust seems like such an arbitrary set of lines in the sand anyway. Adding a repo to your OS and installing the package? Fine. Same developer provides an install script? Absolutely not. You have to trust somebody eventually, whether it be your HW manufacturer, OS developers, packagers, developers, etc. There's a lot of it blindly going on, but a script running as your user? Just can't.