4 ms·

Yeah, let's teach users to paste sudo commands into the terminal. That's great.

by marginalia_nu 4y ago

rosnd 4y ago
What alternative do you propose?
- marginalia_nu 4y ago
  What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
  - cyberphobe 4y ago
    Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain
hsbauauvhabzb 4y ago
Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.
ChuckNorris89 4y ago
>Yeah, let's teach users to paste sudo commands into the terminal. That's great. This is also one of my fears with pushing non tech savvy people away from Apple/Windows and onto Linux without the Snap, Flathub, or other such curated stores that ship with the distro, without which they would need to touch the terminal and run commands found on the internet. GNU/Geeks will keep shouting religiously how insecure Windows is because "grandma can download a dodgy .exe pretending to be a game and get viruses", but on Linux it's the same shit or worse, all you have to do is to convince a user new to Linux to paste and run a sudo command in the terminal as instructed by some scammy tutorial he found on Youtube when searching for "how to install Fortnite on Linux" and it's game over for him, since Youtube removed the downvote counter and the user had no idea he was running into a trap. After all, for most Average Joes, copying some text feels far less dangerous than downloading and opening a strange file. At least Windows Defender will most likely catch that malware you downloaded and warn you about it being harmful, but on Linux you have no such guardian nanny to save you. With sudo, it will do whatever self-destructive thing you tell it to do and not complain.
- marginalia_nu 4y ago
  I've seen this extremely sketchy variant a few times curl -sfL www.marginalia.nu/install.sh | sudo sh - Even without sudo, this is extremely sketchy.
  - rosnd 4y ago
    Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?
    - jdiff 4y ago
      Yeah, it's possible for a web server to detect and change the returned data maliciously. Even with user agent and all other factors changed to match, it's possible to detect even the difference between being piped into another command vs being redirected to a file.
      - rosnd 4y ago
        It's also possible for a web server to selectively serve you a backdoored .deb or git repo
        drran 4y ago
        So what? I can inspect downloaded code and find the backdoor, or a trojan, or an error. I did it few times already in last 30 years. If you cannot do that doesn't mean that nobody can. But I cannot do that with `curl | bash`.
        rosnd 4y ago
        If you can't save the output of curl into a file, you certainly aren't one of the few people capable of meaningfully inspecting anything you download.
        4y ago

Yeah, let's teach users to paste sudo commands into the terminal. That's great.

rosnd 4y ago

What alternative do you propose?

marginalia_nu 4y ago
What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
- cyberphobe 4y ago
  Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain

hsbauauvhabzb 4y ago

Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.

ChuckNorris89 4y ago

>Yeah, let's teach users to paste sudo commands into the terminal. That's great. This is also one of my fears with pushing non tech savvy people away from Apple/Windows and onto Linux without the Snap, Flathub, or other such curated stores that ship with the distro, without which they would need to touch the terminal and run commands found on the internet. GNU/Geeks will keep shouting religiously how insecure Windows is because "grandma can download a dodgy .exe pretending to be a game and get viruses", but on Linux it's the same shit or worse, all you have to do is to convince a user new to Linux to paste and run a sudo command in the terminal as instructed by some scammy tutorial he found on Youtube when searching for "how to install Fortnite on Linux" and it's game over for him, since Youtube removed the downvote counter and the user had no idea he was running into a trap. After all, for most Average Joes, copying some text feels far less dangerous than downloading and opening a strange file. At least Windows Defender will most likely catch that malware you downloaded and warn you about it being harmful, but on Linux you have no such guardian nanny to save you. With sudo, it will do whatever self-destructive thing you tell it to do and not complain.

marginalia_nu 4y ago
I've seen this extremely sketchy variant a few times curl -sfL www.marginalia.nu/install.sh | sudo sh - Even without sudo, this is extremely sketchy.
- rosnd 4y ago
  Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?
  - jdiff 4y ago
    Yeah, it's possible for a web server to detect and change the returned data maliciously. Even with user agent and all other factors changed to match, it's possible to detect even the difference between being piped into another command vs being redirected to a file.
    - rosnd 4y ago
      It's also possible for a web server to selectively serve you a backdoored .deb or git repo
      - drran 4y ago
        So what? I can inspect downloaded code and find the backdoor, or a trojan, or an error. I did it few times already in last 30 years. If you cannot do that doesn't mean that nobody can. But I cannot do that with `curl | bash`.
        rosnd 4y ago
        If you can't save the output of curl into a file, you certainly aren't one of the few people capable of meaningfully inspecting anything you download.
        4y ago