4 ms·

Why is "sudo" emphasized so heavily, anyway? Running as your ordinary user, that shell script can send someone your session cookies, authenticate with your SSH

Why is "sudo" emphasized so heavily, anyway? Running as your ordinary user, that shell script can send someone your session cookies, authenticate with your SSH agent, and really anything that you can do. Sure, maybe not running as root protects the integrity of the OS and prevents some persistent keylogging attacks, but honestly... you don't need a keylogger when you just grab the cookies, or install your own binaries farther up in the path (good old ~/.local/bin/firefox instead of /usr/bin/firefox). Frankly, being anything other than super paranoid is almost a little reckless. Also, shit-talking Home Assistant is a pretty weird take. I wouldn't write it in Python configured half in YAML and half in SQLite either, but ... not having to write it myself was the fun part.

bombcar 3y ago
This is basically https://xkcd.com/1200/ https://xkcd.com/1200/ Anyone who really complains about curl | sudo is just doing it for nerd points, because I guarantee you they happily install all sorts of other software without "vetting" it. And if someone caught someone doing trickery it'd be big news.
- tmpX7dMeXU 3y ago
  Yup. It’s very “fake nerd” energy.
  - nvy 3y ago
    Rachel isn't a fake nerd though
    - bombcar 3y ago
      Someone can be "real" and still have bugaboos that are just not really worth it.
- spiderxxxx 3y ago
  There are those of us who are security minded and will in fact download the script and check the sha1/sha256 and review the script before running it. Any time I see this curl sudo thing is when there's always another (manual) option. The shell scripts themselves aren't so complex that you can't figure out what they're doing, they're normally fairly straightforward, unless they were generated by some tool, or are in fact malware, so you can see if something looks funky before you run it. Sure, there can be a malware that makes it so you can't tell, but normally not.
  - bombcar 3y ago
    It's all a web of trust. If I don't trust the website to do curl | sudo bash then why do I trust the software that I would eventually install? Even the old argument of "middleware devices modified the script en-route" is mostly removed by HTTPS everywhere. And there are people like you who actually look at the script (and the compiled code, too!) to find things, because if they do find something in a script as big as HomeAssitant, they'll be famous.
noduerme 3y ago
I don't use any of this home automation junk, but this kind of begs the question - why would such an app need root access to your devices in the first place?
- bryancoxwell 3y ago
  To allow a web server to bind to port 80 is the only thing that really comes to mind.
  - noduerme 3y ago
    Yeah, that's a conceivable use case for a dedicated box, I guess. But why would that be necessary (or desirable?) Seems like opening port 80 would be the last thing you'd want a home appliance to do... lol
    - somehnguy 3y ago
      80 is desirable because it’s the default port of web browsers and means you can just visit the DNS or up address & not have to remember to tack on some arbitrary port number. Or use some sort of proxy if setup. And there’s nothing wrong with using port 80 security wise. Binding a port doesn’t mean you’re opening it on the firewall for the world to see. Plus if you’re opening some port on the firewall, what port you use doesn’t matter - it’ll be scanned by an automated scanner shortly regardless of port.
      - noduerme 3y ago
        The downsides of choosing port 80 for your all-important lightbulb dimmer switch telemetry are that: 1. browsers don't even attempt encryption, 2. the port could be open to the world, and 3. lots of people are already running more meaningful shit on port 80. Seriously, you want to sell me a lightbulb that needs root access and then opens an unencrypted port and then makes outbound calls...? Are you nuts? That's beyond lazy design. It's almost like an intentional insult. [edit] If you set up a home service on your local network, surely you can also bookmark the obscure port number next to the 128/ address in front of it. The only purpose served by turning your light bulbs into a beacon from hell on port 80 would be letting strangers totally penetrate your house. What happens if you start up a webserver? Do the lights go off? What kind of schmuck does this to his house??
majormajor 3y ago
Can a "regular" installer do all of that? Especially if it asks to escalate its privileges? "Running a software installer" in general seems just as insecure as "sudo | curl" whatever.

bombcar 3y ago

This is basically https://xkcd.com/1200/ https://xkcd.com/1200/ Anyone who really complains about curl | sudo is just doing it for nerd points, because I guarantee you they happily install all sorts of other software without "vetting" it. And if someone caught someone doing trickery it'd be big news.

tmpX7dMeXU 3y ago
Yup. It’s very “fake nerd” energy.
- nvy 3y ago
  Rachel isn't a fake nerd though
  - bombcar 3y ago
    Someone can be "real" and still have bugaboos that are just not really worth it.
spiderxxxx 3y ago
There are those of us who are security minded and will in fact download the script and check the sha1/sha256 and review the script before running it. Any time I see this curl sudo thing is when there's always another (manual) option. The shell scripts themselves aren't so complex that you can't figure out what they're doing, they're normally fairly straightforward, unless they were generated by some tool, or are in fact malware, so you can see if something looks funky before you run it. Sure, there can be a malware that makes it so you can't tell, but normally not.
- bombcar 3y ago
  It's all a web of trust. If I don't trust the website to do curl | sudo bash then why do I trust the software that I would eventually install? Even the old argument of "middleware devices modified the script en-route" is mostly removed by HTTPS everywhere. And there are people like you who actually look at the script (and the compiled code, too!) to find things, because if they do find something in a script as big as HomeAssitant, they'll be famous.

noduerme 3y ago

I don't use any of this home automation junk, but this kind of begs the question - why would such an app need root access to your devices in the first place?

bryancoxwell 3y ago
To allow a web server to bind to port 80 is the only thing that really comes to mind.
- noduerme 3y ago
  Yeah, that's a conceivable use case for a dedicated box, I guess. But why would that be necessary (or desirable?) Seems like opening port 80 would be the last thing you'd want a home appliance to do... lol
  - somehnguy 3y ago
    80 is desirable because it’s the default port of web browsers and means you can just visit the DNS or up address & not have to remember to tack on some arbitrary port number. Or use some sort of proxy if setup. And there’s nothing wrong with using port 80 security wise. Binding a port doesn’t mean you’re opening it on the firewall for the world to see. Plus if you’re opening some port on the firewall, what port you use doesn’t matter - it’ll be scanned by an automated scanner shortly regardless of port.
    - noduerme 3y ago
      The downsides of choosing port 80 for your all-important lightbulb dimmer switch telemetry are that: 1. browsers don't even attempt encryption, 2. the port could be open to the world, and 3. lots of people are already running more meaningful shit on port 80. Seriously, you want to sell me a lightbulb that needs root access and then opens an unencrypted port and then makes outbound calls...? Are you nuts? That's beyond lazy design. It's almost like an intentional insult. [edit] If you set up a home service on your local network, surely you can also bookmark the obscure port number next to the 128/ address in front of it. The only purpose served by turning your light bulbs into a beacon from hell on port 80 would be letting strangers totally penetrate your house. What happens if you start up a webserver? Do the lights go off? What kind of schmuck does this to his house??

majormajor 3y ago

Can a "regular" installer do all of that? Especially if it asks to escalate its privileges? "Running a software installer" in general seems just as insecure as "sudo | curl" whatever.