3 ms·

Wonder if the whole curl + sudo shell script installer thing is going to come to an end any time soon? aka the whole "just run 'curl https://somesite/install.s

Wonder if the whole curl + sudo shell script installer thing is going to come to an end any time soon? aka the whole "just run 'curl https://somesite/install.sh https://somesite/install.sh' | sudo sh" to install our software Seems like it'd go very hand in hand with this infected stuff mentioned in the article.

mgii 3y ago
I can approve this from our findings (author of this research): our system lists around 100 instances of the pattern you've mentioned every week, and around %3 are malicious. It would be great seeing it coming to an end.
- justinclift 3y ago
  Yeah. Security aware people have complained about this pattern forever, but then places like macOS Homebrew (brew.sh) just knowingly do it anyway. :(
yencabulator 3y ago
Unfortunately `npm i` has the same power. `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or reusable when I last looked.
- remram 3y ago
  What's the point? You're going to ship that code to your users, or run it against your production database. If you think it might be malicious, protecting the dev laptop shouldn't be the priority.
  - yencabulator 3y ago
    I run production services that don't even talk to a database, or that have minimal read-only access. And even for the ones with a lot of write access, having the database stolen/nuked (to be restored from backup) is quite different from handing over all of my browser cookies, or my gcloud/aws/k8s ambient authority credentials that are just sitting in a file (seriously, why is big cloud client security worse than SSH).
    - remram 3y ago
      Fair enough, some organizations might have devs with limited access, but you're right I can see a lot of situations where the dev laptop has strictly larger blast area.
- richbell 3y ago
  > `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. Maven is the same way, AFAIK.
vundercind 3y ago
It’s 0% worse than “add and trust our repository for your distro”, or “download this .deb/.rpm/installer”, or (worst of all) “do one of the above, but trusting a 3rd party who packaged this program for you, rather than the publisher”, which are the realistic alternatives.
ivanjermakov 3y ago
Pro tip: use example.com for such examples, because it's reserved specifically for that: https://www.rfc-editor.org/rfc/rfc2606.html#section-3 https://www.rfc-editor.org/rfc/rfc2606.html#section-3.
- justinclift 3y ago
  Good point, I just totally forgot. :)

mgii 3y ago

I can approve this from our findings (author of this research): our system lists around 100 instances of the pattern you've mentioned every week, and around %3 are malicious. It would be great seeing it coming to an end.

justinclift 3y ago
Yeah. Security aware people have complained about this pattern forever, but then places like macOS Homebrew (brew.sh) just knowingly do it anyway. :(

yencabulator 3y ago

Unfortunately `npm i` has the same power. `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or reusable when I last looked.

remram 3y ago
What's the point? You're going to ship that code to your users, or run it against your production database. If you think it might be malicious, protecting the dev laptop shouldn't be the priority.
- yencabulator 3y ago
  I run production services that don't even talk to a database, or that have minimal read-only access. And even for the ones with a lot of write access, having the database stolen/nuked (to be restored from backup) is quite different from handing over all of my browser cookies, or my gcloud/aws/k8s ambient authority credentials that are just sitting in a file (seriously, why is big cloud client security worse than SSH).
  - remram 3y ago
    Fair enough, some organizations might have devs with limited access, but you're right I can see a lot of situations where the dev laptop has strictly larger blast area.
richbell 3y ago
> `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. Maven is the same way, AFAIK.

vundercind 3y ago

It’s 0% worse than “add and trust our repository for your distro”, or “download this .deb/.rpm/installer”, or (worst of all) “do one of the above, but trusting a 3rd party who packaged this program for you, rather than the publisher”, which are the realistic alternatives.

ivanjermakov 3y ago

Pro tip: use example.com for such examples, because it's reserved specifically for that: https://www.rfc-editor.org/rfc/rfc2606.html#section-3 https://www.rfc-editor.org/rfc/rfc2606.html#section-3.

justinclift 3y ago
Good point, I just totally forgot. :)