3 ms·
Because the use of "piping to a shell" can be detected server-side, so if compromised, it can serve hostile code only in that case. And you don't have a record
by jjgreen 3y ago
Because the use of "piping to a shell" can be detected server-side, so if compromised, it can serve hostile code only in that case. And you don't have a record of that hostile code.
I'd like to know why curl | sh is so frowned upon on community forums.
That depends on the community, mentioning that Rust encourages the practice will typically earn downvotes on this list.
- Someone 3y ago> Because the use of "piping to a shell" can be detected server-side AFAIK, it’s not “piping to a shell” that can be detected, but the use of curl. That is trivial to do by looking at the user agent string. I don’t know whether it can also be done if that is spoofed using -A "user agent". Doing that makes that curl | sh command a lot less nice, though.
- jjgreen 3y agoIn fact one does not need the user-agent to detect curl | sh, details here https://web.archive.org/web/20230325190353/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20230325190353/https://www.idont... [original article has an expired cert]
- borplk 3y agoIt can be detected even without looking at the user agent (as another user mentioned). They typically rely on the fact that the downloaded source code is being executed as it is being downloaded so you can leave things like "sleep 5" and detect the delay in fetching from the client. The best thing to do is to download first and then execute. Also good installer scripts first define a function and then call the function at the very end of the script so that they don't half-execute some function in case the network connection is disrupted.
- dkga 3y agoSo curl specifically transmits to the server what its terminal call was (including post-curl steps via piping)?
- earthling8118 3y agoI am a major proponent of Rust and definitely push for it. However rustup's installation method is somewhat of a disgrace in my opinion. I don't use rustup at all and use nix instead (yes, I'm that guy).