3 ms·
Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
by doubled112 4y ago
Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
- rgoulter 4y agoTwo examples of malicious behaviour: (1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements. (2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements. The "don't curl into sh" is worried about the former. But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from. It seems weird to mention (1) without at least mentioning (2).
- pjerem 4y agoWhy is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.
- doubled112 4y agoI'm more answering the question than agreeing with the answer. Trust seems like such an arbitrary set of lines in the sand anyway. Adding a repo to your OS and installing the package? Fine. Same developer provides an install script? Absolutely not. You have to trust somebody eventually, whether it be your HW manufacturer, OS developers, packagers, developers, etc. There's a lot of it blindly going on, but a script running as your user? Just can't.