3 ms·
I'm kind of flabbergasted people are downvoting this. You shouldn't pipe anything from a random curl'd link into bash, no matter how much you trust it. And if y
by JohnMakin 3y ago
I'm kind of flabbergasted people are downvoting this. You shouldn't pipe anything from a random curl'd link into bash, no matter how much you trust it. And if you actually bother to inspect this script, there are a lot of reasons to raise eyebrows.
Or, you can just keep doing this and I'll keep making money from security consulting...
- 0xdeadbeefbabe 3y agoIs it safe to raise both eyebrows at once?
- chowells 3y agoWhat's the security difference between running a compiled application from a site vs running curl|bash with a script hosted on the same site?
- fiddlerwoaroof 3y agoYeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trust the maintainers of NPM, Pypi, etc.
- robertlagrant 3y agoThe maintainers of those are not checking packages. You have to inspect the source code to check what it's doing. Same as a script you curl.
- fiddlerwoaroof 3y agoPackage registry maintainers do often do some things that make it a bit safer than just using things from a random person online: e.g. preventing someone from deleting a popular package, which would enable various sorts of squatting attacks. But, you’re generally right.
- JohnMakin 3y agoyou are at the mercy of whatever that link decides to resolve to, which makes it vulnerable to squatting, cache poisoning attacks, etc.
- gruez 3y agoAs opposed to other forms of download method?