4 ms·
This is a great trick, but no one should ever run someone else's script that does this unless they have verified the script line by line beforehand.
by norir 3y ago
This is a great trick, but no one should ever run someone else's script that does this unless they have verified the script line by line beforehand.
- ygjb 3y agoSure, but that's turtles all the way down... any time you run untrusted code, you are making a risk based decision, usually based on the provenance of the code.
- michaelcampbell 3y agoMaybe? People run all manner of binaries/installers without checking them; I'm not sure why these sorts of things require any EXTRA scrutiny.
- fargle 3y agoEXACTLY! I can't stand the overblown security posturing with regards to things like bash and git, even python. When everyone in the world INCLUDING cyber-security professionals seems to think that it's perfectly OK to download setup.exe or install.msi from sketchy driver mfgs. and run them. But SHARs and curl | sh is too scary! It's not that any of these are a good idea, it's the blind-spot to traditional binary installers that's annoying. How do you audit them? Why are they OK (because they have to be)
- oefrha 3y agocurl | sh is actually bad because a completely innocuous script can become dangerous with a network hiccup, e.g. rm -rf /path/to/directory becomes rm -rf /path if the connection accidentally drops half way. Or something less dramatic, but still leaving you in a broken state. Some people took the “don’t curl | sh” advice as “you have to inspect every line of a shell script installer you download”, which is of course absurd.
- fargle 3y agothat's a very interesting point and example. TCP is normally lossless and byte-for-byte before data is forwarded to the application. I think your example may illustrate a loophole - truncation. It'd only work if, like your example, it was the truncation that caused the flub. You can't have random corruption. Does curl in a pipeline really behave that way - if the connection is interrupted (TCP RESET), does it just end the pipe? It probably actually does, from what I see. It's an interesting edge case. Personally I use, which would seem more immune: curl -o /tmp/a vi /tmp/a {get bored easily, fuckit} sh /tmp/a
- ElectricalUnion 3y agoIdeally, scripts that are in any danger of being truncated are supposed to be wrapped in immediately invoked functions exactly because of this gotcha, and most (but not all) of those that I inspect before running often are.
- reactormonk 3y agoOr a malicious server trying to detect if you're using `curl | sh` https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
- michaelcampbell 3y agoCould be confirmation bias/rage on my part of course, but I never took... > Some people took the “don’t curl | sh” advice as “you have to inspect every line of a shell script installer you download”, which is of course absurd. ... to ever mean anything BUT "inspect every line". Which is, as you say, completely absurd.
- mook 3y agoI don't think I've ever read through the Nvidia binary drivers that way. (They're named *.run but are basically shar files)