3 ms·

installation: bash <(curl -fsSL https://get.hy2.sh/ https://get.hy2.sh/) nah.

sschueller 3y ago
That is one of many methods of installing and this bash crap has been popular for a while so although I don't like it it doesn't mean the project is bad.
deleted 3y ago
[deleted]
not_your_vase 3y ago
I just started to write a reply along the lines of > at least it doesn't start with "sudo bash", which is a very minor step into the right direction But then I looked into the script, and changed my mind. I love blindly running Chinese shell scripts with sudo.
- sschueller 3y ago
  Chinese or any other state doesn't mean it's bad. What is bad is piping stuff into bash even if the source 100 percent trusted.
  - theossuary 3y ago
    As apposed to downloading a binary, chmoding it, and running it as your user? I honestly don't see the difference unless you only want packages in auditable flatpaks or snaps.
greentea23 3y ago
bash <(curl -fsSL https://raw.githubusercontent.com/apernet/hysteria/7135f04fa2a0da691374e8ccc4832542767b91c3/scripts/install_server.sh https://raw.githubusercontent.com/apernet/hysteria/7135f04fa...) There I fixed it. If you go through github (trusted server url-integrity-wise) and use the commit hash, and you reviewed the code first, it's much safer to do this because it's deterministic/versioned.
JohnMakin 3y ago
I'm kind of flabbergasted people are downvoting this. You shouldn't pipe anything from a random curl'd link into bash, no matter how much you trust it. And if you actually bother to inspect this script, there are a lot of reasons to raise eyebrows. Or, you can just keep doing this and I'll keep making money from security consulting...
- 0xdeadbeefbabe 3y ago
  Is it safe to raise both eyebrows at once?
- chowells 3y ago
  What's the security difference between running a compiled application from a site vs running curl|bash with a script hosted on the same site?
  - fiddlerwoaroof 3y ago
    Yeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trust the maintainers of NPM, Pypi, etc.
    - robertlagrant 3y ago
      The maintainers of those are not checking packages. You have to inspect the source code to check what it's doing. Same as a script you curl.
      - fiddlerwoaroof 3y ago
        Package registry maintainers do often do some things that make it a bit safer than just using things from a random person online: e.g. preventing someone from deleting a popular package, which would enable various sorts of squatting attacks. But, you’re generally right.
  - JohnMakin 3y ago
itishappy 3y ago
Installation Like any proxy software, Hysteria consists of a server and a client. Our precompiled executables includes both modes on all platforms. You can download our latest releases using one of the following options: * Executable files * GitHub Releases * Deployment script for Linux servers * Arch Linux AUR * Docker images * Use 3rd-party apps * Build from source

That is one of many methods of installing and this bash crap has been popular for a while so although I don't like it it doesn't mean the project is bad.

deleted 3y ago

[deleted]

not_your_vase 3y ago

I just started to write a reply along the lines of > at least it doesn't start with "sudo bash", which is a very minor step into the right direction But then I looked into the script, and changed my mind. I love blindly running Chinese shell scripts with sudo.

sschueller 3y ago
Chinese or any other state doesn't mean it's bad. What is bad is piping stuff into bash even if the source 100 percent trusted.
- theossuary 3y ago
  As apposed to downloading a binary, chmoding it, and running it as your user? I honestly don't see the difference unless you only want packages in auditable flatpaks or snaps.

greentea23 3y ago

bash <(curl -fsSL https://raw.githubusercontent.com/apernet/hysteria/7135f04fa2a0da691374e8ccc4832542767b91c3/scripts/install_server.sh https://raw.githubusercontent.com/apernet/hysteria/7135f04fa...) There I fixed it. If you go through github (trusted server url-integrity-wise) and use the commit hash, and you reviewed the code first, it's much safer to do this because it's deterministic/versioned.

JohnMakin 3y ago

I'm kind of flabbergasted people are downvoting this. You shouldn't pipe anything from a random curl'd link into bash, no matter how much you trust it. And if you actually bother to inspect this script, there are a lot of reasons to raise eyebrows. Or, you can just keep doing this and I'll keep making money from security consulting...

0xdeadbeefbabe 3y ago
Is it safe to raise both eyebrows at once?
chowells 3y ago
What's the security difference between running a compiled application from a site vs running curl|bash with a script hosted on the same site?
- fiddlerwoaroof 3y ago
  Yeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trust the maintainers of NPM, Pypi, etc.
  - robertlagrant 3y ago
    The maintainers of those are not checking packages. You have to inspect the source code to check what it's doing. Same as a script you curl.
    - fiddlerwoaroof 3y ago
      Package registry maintainers do often do some things that make it a bit safer than just using things from a random person online: e.g. preventing someone from deleting a popular package, which would enable various sorts of squatting attacks. But, you’re generally right.
- JohnMakin 3y ago

itishappy 3y ago

Installation Like any proxy software, Hysteria consists of a server and a client. Our precompiled executables includes both modes on all platforms. You can download our latest releases using one of the following options: * Executable files * GitHub Releases * Deployment script for Linux servers * Arch Linux AUR * Docker images * Use 3rd-party apps * Build from source