6 ms·

Always safer to first curl url > file, then read through file, then only if all looks good, run the file (under an appropriate user and with permissions as limi

Always safer to first curl url > file, then read through file, then only if all looks good, run the file (under an appropriate user and with permissions as limited as possible, etc.)

rgoulter 4y ago
Is there any meaningful/significant security benefit from doing this? Whatever executable such a script installs could itself later download + run arbitrary commands.
- leoh 4y ago
  Given that an attacker would likely obfuscate shenanigans, I don’t think there is much benefit to glancing over source unless you’re really ready to do a little research project for a few hours.
- sureglymop 4y ago
  The benefit for me is knowing what installs where so that i can later uninstall everything without having to rely on an uninstaller that leaves bits behind. Of course I'm talking about a different scenario where I'm already assuming the script and binaries it installs are safe.
  - radarsat1 4y ago
    I used to use checkinstall for this, makes a little uninstallable apt package for you.
  - midasuni 4y ago
    I’m old enough to remember when you had a makefile or even better an rpm or deb. It was so much better than the windows way of running a random program with little visibility, and so sad when so much software changed away from that method.
    - imperfect_blue 4y ago
      In theory yes, it's more secure. In practice personally auditing the installation script for every program you're going to use and the installation script for every update is grossly impractical, for the same reason nobody reads EULAs. In the end it still boils down to trust.
    - wolletd 4y ago
      To be fair, the package must be provided by your distribution, otherwise it's just another random download, only in a different format. Even if you are adding a third-party package repository, you just change the downloader. Although you usually get signature checking with that step for free. And therein lies the issue: It's not the job of the software developers to provide packages for your distribution, but the job of your distribution maintainers. So, if your distribution will probably not backport $newver of some tool to your release, you are only left with installing it via different means. If you find yourself always installing software like this because your package repositories don't contain what you want, it may be a good idea to just check out different distros.
      - tpoacher 4y ago
        There's a big difference there in that even if you do install the odd program from source, the distro likely has you covered in terms of all the libraries needed to run it in the first place. That's a very different scenario from having to download the dependencies as well.
        NavinF 4y ago
        Having to download dependencies is a very Linux desktop problem. On every other platform (Windows, macOS, iOS, Android) it is customary for installers to come with all dependencies. Most programs also statically link non-system libraries.
        tpoacher 4y ago
        Nothing stops you from bundling dependencies on linux. The reason it's a "very linux problem" is exactly because this is a sane thing to do in a pool of insane systems. There's absolutely no reason to ship your 1k executable with 1Gb of libraries, used by 10 other programs.
- jerf 4y ago
  Whether or not there's any security benefit, I've often benefited from pre-reading install scripts by deciding to install the thing somewhere else, or with a different setting, or noticing that the entire install script is basically just a lot of paranoid noise around simply downloading the binary and putting it in a binary directory, etc. Some are so elaborate it's hard to poke through what they're actually doing, but a lot of them aren't. Making an all-in-one install script that doesn't require any arguments involves making a lot of decisions for the user that you may not particularly like. Pre-reading gives a chance to decide whether or not you like those decisions.
IshKebab 4y ago
It's insignificantly safer. The only time it will help is if an attacker makes absolutely zero effort to hide their attack. If they're clever enough to hack the Rustup website or Brew or whatever then they're going to know not to put their exploit in plain sight in the installation script.
- _3u10 4y ago
  Exactly. Once you go down the security rabbit hole it quickly leads to paranoia
  - eyelidlessness 4y ago
    That’s an exceedingly odd way to put “the threat’s scope exceeds this particular vector”.
    - _3u10 4y ago
      That’s a really odd way to put “I like to emote orthogonally to idiomatic vernacular”
      - eyelidlessness 4y ago
        I wasn’t emoting lol, I was recognizing the orthogonality I found strange. Recognizing that partially securing a thing is incomplete isn’t paranoid, it’s just acknowledging the progress is limited.
- Ferret7446 4y ago
  Is it though? As the attacker would you: Spend minimal resources and compromise 80% of users. Spend an extraordinary amount of resources and compromise 99% of users. Of note is that those extra 19% of users are more security conscious and will likely detect and purge the exploit immediately.
  - IshKebab 4y ago

Always safer to first curl url > file, then read through file, then only if all looks good, run the file (under an appropriate user and with permissions as limited as possible, etc.)

rgoulter 4y ago

Is there any meaningful/significant security benefit from doing this? Whatever executable such a script installs could itself later download + run arbitrary commands.

leoh 4y ago
Given that an attacker would likely obfuscate shenanigans, I don’t think there is much benefit to glancing over source unless you’re really ready to do a little research project for a few hours.
sureglymop 4y ago
The benefit for me is knowing what installs where so that i can later uninstall everything without having to rely on an uninstaller that leaves bits behind. Of course I'm talking about a different scenario where I'm already assuming the script and binaries it installs are safe.
- radarsat1 4y ago
  I used to use checkinstall for this, makes a little uninstallable apt package for you.
- midasuni 4y ago
  I’m old enough to remember when you had a makefile or even better an rpm or deb. It was so much better than the windows way of running a random program with little visibility, and so sad when so much software changed away from that method.
  - imperfect_blue 4y ago
    In theory yes, it's more secure. In practice personally auditing the installation script for every program you're going to use and the installation script for every update is grossly impractical, for the same reason nobody reads EULAs. In the end it still boils down to trust.
  - wolletd 4y ago
    To be fair, the package must be provided by your distribution, otherwise it's just another random download, only in a different format. Even if you are adding a third-party package repository, you just change the downloader. Although you usually get signature checking with that step for free. And therein lies the issue: It's not the job of the software developers to provide packages for your distribution, but the job of your distribution maintainers. So, if your distribution will probably not backport $newver of some tool to your release, you are only left with installing it via different means. If you find yourself always installing software like this because your package repositories don't contain what you want, it may be a good idea to just check out different distros.
    - tpoacher 4y ago
      There's a big difference there in that even if you do install the odd program from source, the distro likely has you covered in terms of all the libraries needed to run it in the first place. That's a very different scenario from having to download the dependencies as well.
      - NavinF 4y ago
        Having to download dependencies is a very Linux desktop problem. On every other platform (Windows, macOS, iOS, Android) it is customary for installers to come with all dependencies. Most programs also statically link non-system libraries.
        tpoacher 4y ago
        Nothing stops you from bundling dependencies on linux. The reason it's a "very linux problem" is exactly because this is a sane thing to do in a pool of insane systems. There's absolutely no reason to ship your 1k executable with 1Gb of libraries, used by 10 other programs.
jerf 4y ago
Whether or not there's any security benefit, I've often benefited from pre-reading install scripts by deciding to install the thing somewhere else, or with a different setting, or noticing that the entire install script is basically just a lot of paranoid noise around simply downloading the binary and putting it in a binary directory, etc. Some are so elaborate it's hard to poke through what they're actually doing, but a lot of them aren't. Making an all-in-one install script that doesn't require any arguments involves making a lot of decisions for the user that you may not particularly like. Pre-reading gives a chance to decide whether or not you like those decisions.

IshKebab 4y ago

It's insignificantly safer. The only time it will help is if an attacker makes absolutely zero effort to hide their attack. If they're clever enough to hack the Rustup website or Brew or whatever then they're going to know not to put their exploit in plain sight in the installation script.

_3u10 4y ago
Exactly. Once you go down the security rabbit hole it quickly leads to paranoia
- eyelidlessness 4y ago
  That’s an exceedingly odd way to put “the threat’s scope exceeds this particular vector”.
  - _3u10 4y ago
    That’s a really odd way to put “I like to emote orthogonally to idiomatic vernacular”
    - eyelidlessness 4y ago
      I wasn’t emoting lol, I was recognizing the orthogonality I found strange. Recognizing that partially securing a thing is incomplete isn’t paranoid, it’s just acknowledging the progress is limited.
Ferret7446 4y ago
Is it though? As the attacker would you: Spend minimal resources and compromise 80% of users. Spend an extraordinary amount of resources and compromise 99% of users. Of note is that those extra 19% of users are more security conscious and will likely detect and purge the exploit immediately.
- IshKebab 4y ago