3 ms·
That's not security theater at all. It prevents unsafe redirects (--proto='https'), which I've found in the wild exactly because I pass that flag. And specifyin
by insanitybit 3y ago
That's not security theater at all. It prevents unsafe redirects (--proto='https'), which I've found in the wild exactly because I pass that flag. And specifying a min tls version seems like a good practice in general.
- whalesalad 3y agojust because you got the resource from GitHub successfully and securely doesn’t mean it’s a safe resource to execute.
- lelanthran 3y agoIf you don't trust the installation script to be non-maleware, why are you trusting the binary that the script installs? It's not as if the instructions would allow an attacker to pass you another binary, after all.
- deleted 3y ago[deleted]
- insanitybit 3y agoI didn't say it was. The poster was commenting on the arguments that enforce HTTPS and TLS1.2, and they were wrong - those arguments are not security theater at all. As for 'is curl | sh safe?' I am done arguing with people who don't understand that it's absolutely fine.
- whalesalad 3y agothe poster was not suggesting those things are not legitimate and secure maneuvers ... the poster is suggesting that you can have the most rock solid and authentic transport mechanism and - in spite of that - can still end up compromising your system by running the wrong thing. > As for 'is curl | sh safe?' I am done arguing with people who don't understand that it's absolutely fine. eep.