3 ms·
> the Linux security best practices of curl | bash? You do realize that even this is the same as downloading and running an executable from a website, which is
by pxc 3y ago
> the Linux security best practices of curl | bash?
You do realize that even this is the same as downloading and running an executable from a website, which is still the norm on Windows, right?
- xigoi 3y agoIn fact, curl | bash is safer, because you can replace "| bash" with "| less" and inspect the script.
- xmodem 3y agoI would argue that Windows checking certificate signatures provides a lot more safety to the vast majority of users than manually inspecting a bash script.
- xmcqdpt2 3y agohttps://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
- pxc 3y agoYeah, you don't actually want to pipe to less and then rerun piped to bash because it's vulnerable to a TOCTOU problem. You want to save it the first time, then read it in your editor. When you distribute those scripts around your org, you also want to verify them with a sha256 hash or something like that. This is what I do for installers I use this way and other software downloaded over HTTPS at work. I also generally avoid installers that download other installers. If you've got a script that downloads platform-specific installers, you may prefer to write out specific instructions for each platform and download the platform-specific binaries directly. A shell installer like this running curl is a red flag imo.