3 ms·

> In deployment scripts: > > wget -qO- https://raw.githubusercontent.com/xthezealot/npmprune/master/npmprune.sh https://raw.githubusercontent.com/xthezealot/n

> In deployment scripts: > > wget -qO- https://raw.githubusercontent.com/xthezealot/npmprune/master/npmprune.sh https://raw.githubusercontent.com/xthezealot/npmprune/master... | sh -- -p Serious question: Is this the norm now? Are people actually executing unversioned wget'd shell scripts from random github users as part of their deployment workflow?

petesergeant 3y ago
> now For about the last 15 years
- mobilio 3y ago
  also curl ... | sudo bash
- dunham 3y ago
  And before the web existed, people would distribute software packaged inside executable shell scripts (https://en.wikipedia.org/wiki/Shar https://en.wikipedia.org/wiki/Shar). It looks like that practice goes back at least 40 years.
nailer 3y ago
The threat model is exactly the same as executing untrusted, uninspected content you've downloaded locally. I could do some tricks where I sent different files based on user agent, but still... most people aren't inspecting the download anyway before running it.
- im3w1l 3y ago
  > I could do some tricks where I sent different files based on user agent Not from githubusercontent you couldn't. Which I'd say is where the majority of these scripts are hosted.
- bravetraveler 3y ago
  It's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load. Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked) Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late The phrasing you use is important for any hope at safety - review/run the same downloaded thing.

petesergeant 3y ago

> now For about the last 15 years

mobilio 3y ago
also curl ... | sudo bash
dunham 3y ago
And before the web existed, people would distribute software packaged inside executable shell scripts (https://en.wikipedia.org/wiki/Shar https://en.wikipedia.org/wiki/Shar). It looks like that practice goes back at least 40 years.

nailer 3y ago

The threat model is exactly the same as executing untrusted, uninspected content you've downloaded locally. I could do some tricks where I sent different files based on user agent, but still... most people aren't inspecting the download anyway before running it.

im3w1l 3y ago
> I could do some tricks where I sent different files based on user agent Not from githubusercontent you couldn't. Which I'd say is where the majority of these scripts are hosted.
bravetraveler 3y ago
It's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load. Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked) Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late The phrasing you use is important for any hope at safety - review/run the same downloaded thing.