2 ms·
Surely these are the same kinds of people who will carefully review all scripts before running them, right?
by Waterluvian 3y ago
Surely these are the same kinds of people who will carefully review all scripts before running them, right?
- serf 3y agopeople act weird around any kind of script, more-so than executables, i've never really understood it. I periodically get told that a published browser userscript of mine is malicious or suspicious in emails simply because of the cautions and wording around the userscript installers themselves (it's just a css tweak, a theme), meanwhile the executables I have in the wild have generated zero similar feedback. my theory is that since the script is more easily read that it attracts people to read it without any theory or knowledge of what they're even looking at .
- Waterluvian 3y agoThis feels like a thing but I can’t think of a name for it. Where something that can be verified gets more scrutiny than something that can’t. Maybe someone else knows.
- pornel 3y agoAbsolutely. And just to be sure, I also check file checksums, which I've downloaded from same server over the same connection.
- tzs 3y agoEven if you don't review it before running it, after $ curl https://whatever/foo.sh > foo.sh $ sh foo.sh if something goes terribly wrong you can examine foo.sh to try to figure out what happened and how to fix it. Even if foo.sh managed to delete itself you can just grab it again. After $ curl https://whatever/foo.sh | sh if something goes wrong and you then try $ curl https://whatever/foo.sh > foo.sh to get a copy of the script to examine a malicious server can tell that you aren't piping to a shell [1] and give a non-malicious script. Since it takes an insignificant amount of effort to defend against this why not get in the habit of doing it? [1] https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
- ddtaylor 3y agoActually they do. Not individually one by one themselves but they outsourced this to their distro maintainers which do a spectacular job. I'll take a properly curated package in flatpak Fedora repos over a random script downloaded and piped into a root shell any day