4 ms·

What is the problem with this? (Really asking to get an answer)

cweagans 4y ago
You're trusting somebody to run random stuff on your machine and you're trusting them to not do something like this: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- deleted 4y ago
  [deleted]
knewter 4y ago
Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user
- solarkraft 4y ago
  How does it differ from running any proprietary software other than that you can read the script before running it?
  - jackling 4y ago
    You can usually checksum anything you download to ensure it's legit. A script that you curl is unlikely to have such a thing I guess.
- jnwatson 4y ago
  You can always read it first. It isn’t much different than pip or apt.
  - sergiomattei 4y ago
    Easy to change the content depending on user agent.
    - chrsstrm 4y ago
      So curl it but don’t pipe it into shell.
- pgwhalen 4y ago
  Isn’t that just the nature of installing software period? I suppose perhaps you could read all code you use before installing it, but I expect the number of people who do that rounds down to zero.
  - ipaddr 4y ago
    If it's open source and in a certain language I always peek. Not necessarily for security but to see how they structured things.
ath3nd 4y ago
It basically blindly trusts (and runs) whatever the website gives you. If the website is taken over or somebody messes with the dns, you'd end up executing the malicious payload. If this was a standard package, like the ones you get from apt, brew, npm, maven, pypy, or even a versioned binary, you have the option of verifying the checksum, pinning the version, analyze the package with a SAST thing like snyk, or whatever you are using, etc. Esp considering today's popularity of such attacks, more and more companies/teams are becoming more security-minded. Thus increases the desire for an installation process to be something more than just running a sh with full privileges.

You're trusting somebody to run random stuff on your machine and you're trusting them to not do something like this: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

deleted 4y ago
[deleted]

knewter 4y ago

Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user

solarkraft 4y ago
How does it differ from running any proprietary software other than that you can read the script before running it?
- jackling 4y ago
  You can usually checksum anything you download to ensure it's legit. A script that you curl is unlikely to have such a thing I guess.
jnwatson 4y ago
You can always read it first. It isn’t much different than pip or apt.
- sergiomattei 4y ago
  Easy to change the content depending on user agent.
  - chrsstrm 4y ago
    So curl it but don’t pipe it into shell.
pgwhalen 4y ago
Isn’t that just the nature of installing software period? I suppose perhaps you could read all code you use before installing it, but I expect the number of people who do that rounds down to zero.
- ipaddr 4y ago
  If it's open source and in a certain language I always peek. Not necessarily for security but to see how they structured things.

ath3nd 4y ago

It basically blindly trusts (and runs) whatever the website gives you. If the website is taken over or somebody messes with the dns, you'd end up executing the malicious payload. If this was a standard package, like the ones you get from apt, brew, npm, maven, pypy, or even a versioned binary, you have the option of verifying the checksum, pinning the version, analyze the package with a SAST thing like snyk, or whatever you are using, etc. Esp considering today's popularity of such attacks, more and more companies/teams are becoming more security-minded. Thus increases the desire for an installation process to be something more than just running a sh with full privileges.