3 ms·

How to not sell your "enterprise" software to me. Have documentation that includes curl https://something.your.tld/install.bash https://something.your.tld/insta

How to not sell your "enterprise" software to me. Have documentation that includes curl https://something.your.tld/install.bash https://something.your.tld/install.bash |sudo bash. That's a hard no. If you think that's a good idea what other shortcuts have you taken in your software development lifecycle?

encryptluks2 4y ago
From experience, they've built a company on SaaS and your data will soon be everyone's data.
tsimionescu 4y ago
That's almost universal for non-package based installation instructions on Linux, to be fair. And it is safer than "add this trusted repo to your list of repositories", since at least it's one time, not something that will be accessed every time you run "$PACKAGE_MANAGER upgrade".
- GauntletWizard 4y ago
  There's no guarantee that their shell script doesn't also add their repo to your list of repositories, and in fact many do - I've written scripts just like that that do. I trust an application that wants me to add it's repos to it - It's pretty clear what it's doing, I can see and verify the package installation after it's done, and I can order my package manager to download the packages before installing them, inspect the package contents, and then install them afterwards. It's been demonstrated numerous times that it's easy to determine[1] whether a shell script is being downloaded via curl or executed via curl | bash ; That provides an opportunity for attackers to serve you different data if they think you're paying attention or not. But quite simply: Setting up a package repository is a professional operation and a professional concern. It's not hard hard, but it's not so simple. What it does is speak to a level of professionalism and integration - They company has decided that they will stick to your package manager's conventions, rather than invent it themselves. That's humility. That's what I want from a company that I buy from. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- dpkirchner 4y ago
  A lot of the time the script being sudo bash'd adds repos as part of its installation process.
  - tsimionescu 4y ago
    That's also true, but that's more of a problem with the script itself, not the way you run it.
- fbdjcicyc 4y ago
mekster 4y ago
So you don't bother to read the source before running when it's open? How is that any different from running npm which is even harder to audit with many dependencies? OS packages may have maintainers and some eyes before being packaged but for other ecosystems where people can just upload, it seems it's on the same level.
- deadbunny 4y ago
  There are known attacks that can detect if your curling into bash vs. just curling/downloading which can change the script being delivered[1]. So yeah read it all you want, just don't curl it and pipe it to bash. 1. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

encryptluks2 4y ago

From experience, they've built a company on SaaS and your data will soon be everyone's data.

tsimionescu 4y ago

That's almost universal for non-package based installation instructions on Linux, to be fair. And it is safer than "add this trusted repo to your list of repositories", since at least it's one time, not something that will be accessed every time you run "$PACKAGE_MANAGER upgrade".

GauntletWizard 4y ago
There's no guarantee that their shell script doesn't also add their repo to your list of repositories, and in fact many do - I've written scripts just like that that do. I trust an application that wants me to add it's repos to it - It's pretty clear what it's doing, I can see and verify the package installation after it's done, and I can order my package manager to download the packages before installing them, inspect the package contents, and then install them afterwards. It's been demonstrated numerous times that it's easy to determine[1] whether a shell script is being downloaded via curl or executed via curl | bash ; That provides an opportunity for attackers to serve you different data if they think you're paying attention or not. But quite simply: Setting up a package repository is a professional operation and a professional concern. It's not hard hard, but it's not so simple. What it does is speak to a level of professionalism and integration - They company has decided that they will stick to your package manager's conventions, rather than invent it themselves. That's humility. That's what I want from a company that I buy from. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
dpkirchner 4y ago
A lot of the time the script being sudo bash'd adds repos as part of its installation process.
- tsimionescu 4y ago
  That's also true, but that's more of a problem with the script itself, not the way you run it.
fbdjcicyc 4y ago

mekster 4y ago

So you don't bother to read the source before running when it's open? How is that any different from running npm which is even harder to audit with many dependencies? OS packages may have maintainers and some eyes before being packaged but for other ecosystems where people can just upload, it seems it's on the same level.

deadbunny 4y ago
There are known attacks that can detect if your curling into bash vs. just curling/downloading which can change the script being delivered[1]. So yeah read it all you want, just don't curl it and pipe it to bash. 1. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...