4 ms·

I've also thought about this problem but ended up with curl | sh: curl https://clickhouse.com/ | sh The arguments are: - it's 'sh', not 'sudo sh', so it

• LinuxBender 4y ago
  it's 'sh', not 'sudo sh', so it's not that bad; Along the lines of "curl | bash" detection, one can add "sudo -n" to see if the person has passwordless sudo. In my own testing I have found that many people have passwordless sudo. Even without sudo it turns out that people have bad posix permissions throughout their filesystem and one can hijack many things including existing SSH tunnels because of control-master. Even without sudo one can hop around a persons production network riding existing SSH channels. Many devops people have SSH multiplexing and control-master enabled in their SSH client. Then it is just a matter of finding bad permissions in production environments which is also often the case. One rarely needs root to download or even modify database contents as the database credentials are often stored in an environment file that gets sourced by automation. The biggest problem here I see is that companies rarely let their penetration testers a.k.a. red-team into production. Corporate leaders would be taken aback at the findings.
• Kwpolska 4y ago
  > - you can remove '| sh' and read the script; But why can’t I copy the URL into my browser? Why discriminate on user agent? Why couldn’t it be https://clickhouse.com/install.sh https://clickhouse.com/install.sh - so that it would work with browsers and curl alike? > - the deb, rpm, tgz, and docker packages are also provided, but only as advanced usage; How are deb and rpm advanced? How do I uninstall something installed with your custom script? Also, why are the RPM packages [0] still using /etc/init.d and not systemd? [0] https://clickhouse.com/docs/en/install/#from-rpm-packages https://clickhouse.com/docs/en/install/#from-rpm-packages