4 ms·

Please don't recommend people pipe curl output to a shell. Yikes.

by bink 4y ago

efficax 4y ago
eh it's fine. sure, technically speaking you're giving your machine over to whoever wrote that script. they could do anything! but actually, the script is usually useful and safe. Like this one.
- lxgr 4y ago
  You know that, I know that, but the thousands of people getting desensitized and trained to run random terminal commands like this to "fix their wi-fi" usually don't. The problem isn't even pasting curl output into sh – it's instructing non-technical users to run any terminal commands, in my opinion.
  - more_corn 4y ago
    I’d be happy to point them to the UI for disabling awdl0. Let me know when you find it.
- saagarjha 4y ago
  I took a peek at the script and I don’t think I want anyone who writes code like that coming anywhere near my machine if I can help it.
  - more_corn 4y ago
    Heh, yeah.
datalopers 4y ago
Wait until you find out nearly every modern package manager installs stuff directly from github repos.
- johnklos 4y ago
  Nope. See pkgsrc.
- RulerOf 4y ago
  I see this a lot and it really rubs me the wrong way, but it makes a lot of sense from a usability standpoint. I started pointing directly at the full commit SHA of the version I want to use when pointing dependencies at Github repos, as I have some naïve belief that it'll offer me a reasonable level of protection from the malicious takeover of a repo.
- sneak 4y ago
  Docker tags (imagename:tag) aren't cryptographically secure and can be replaced by the server at any time if you aren't using imagename@sha256:<hash> format.
rrauenza 4y ago
How did piping shell scripts from web sites become acceptable? > bash <(curl -sL https://www.meter.com/awdl.sh https://www.meter.com/awdl.sh) Eek!
- secabeen 4y ago
  It's really common in the Mac world, homebrew does it too: https://brew.sh/ https://brew.sh/
btgeekboy 4y ago
What could someone do with a curl pipe that they couldn’t do with a signed, obfuscated executable?

Please don't recommend people pipe curl output to a shell. Yikes.

by bink 4y ago

Please don't recommend people pipe curl output to a shell. Yikes.

eh it's fine. sure, technically speaking you're giving your machine over to whoever wrote that script. they could do anything! but actually, the script is usually useful and safe. Like this one.

lxgr 4y ago
You know that, I know that, but the thousands of people getting desensitized and trained to run random terminal commands like this to "fix their wi-fi" usually don't. The problem isn't even pasting curl output into sh – it's instructing non-technical users to run any terminal commands, in my opinion.
- more_corn 4y ago
  I’d be happy to point them to the UI for disabling awdl0. Let me know when you find it.
saagarjha 4y ago
I took a peek at the script and I don’t think I want anyone who writes code like that coming anywhere near my machine if I can help it.
- more_corn 4y ago
  Heh, yeah.

datalopers 4y ago

Wait until you find out nearly every modern package manager installs stuff directly from github repos.

johnklos 4y ago
Nope. See pkgsrc.
RulerOf 4y ago
I see this a lot and it really rubs me the wrong way, but it makes a lot of sense from a usability standpoint. I started pointing directly at the full commit SHA of the version I want to use when pointing dependencies at Github repos, as I have some naïve belief that it'll offer me a reasonable level of protection from the malicious takeover of a repo.
sneak 4y ago
Docker tags (imagename:tag) aren't cryptographically secure and can be replaced by the server at any time if you aren't using imagename@sha256:<hash> format.

rrauenza 4y ago

How did piping shell scripts from web sites become acceptable? > bash <(curl -sL https://www.meter.com/awdl.sh https://www.meter.com/awdl.sh) Eek!

secabeen 4y ago
It's really common in the Mac world, homebrew does it too: https://brew.sh/ https://brew.sh/

btgeekboy 4y ago

What could someone do with a curl pipe that they couldn’t do with a signed, obfuscated executable?