4 ms·

There's not much difference doing a pipe or using and intermediary file and "excecuting" that straight away. There's no manual step in the documentation there t

by _joel 3y ago

There's not much difference doing a pipe or using and intermediary file and "excecuting" that straight away. There's no manual step in the documentation there to read the output before it's run.

godelski 3y ago
This is not accurate. If the download gets interrupted bash will execute the partial line. That means `rm -r /tmp/foo.ext` or `rm -r ${HOME}/.tmp_config` can execute as `rm -r /`. This can be mitigated by wrapping the script, but clearly no one is looking at the code so this isn't really verified anyways. And it's not like we see that all the time. Edit: But my main point is about habits. There's the concern mananaysiempre brings up[0], but either way, it is best to be in good habits. [0] https://news.ycombinator.com/item?id=39554895 https://news.ycombinator.com/item?id=39554895
- _joel 3y ago
  From the post curl -sL -H "Accept: text/roff" https://jamesg.blog/2024/02/28/programming-projects/ https://jamesg.blog/2024/02/28/programming-projects/ > post.page && man ./post.page If curl's process is interupted, it'll generate a non-0 exit code and the man command won't be exectued. That's how double ampersands work in shell.
  - godelski 3y ago
    I think you've missed the context of my comment. We're talking about `curl | man` not `curl && man`. You're right, `&&` doesn't have that risk. But `|` sure does.
- fragmede 3y ago
  thankfully rm -r / doesn't work on modern systems, though that doesn't invalidate your point.
  - godelski 3y ago
    On what system are you talking about? I mean it won't kill everything because sudo but everything you have permissions to are still in danger
    - prmoustache 3y ago
      Which usually include your most valuable data. Nobody cares about losing a system. This is the data it is hosting that is valuable and takes the most time to recover from a backup.
    - fragmede 3y ago
      On modern, sane systems (meaning those running GNU coreutils, which doesn't include os x iirc), rm -rf / will refuse to run unless --no-preserve-root is also specified. https://www.gnu.org/software/coreutils/manual/html_node/Treating-_002f-specially.html https://www.gnu.org/software/coreutils/manual/html_node/Trea...
jmb99 3y ago
There definitely is a difference. See [1] (or [2] since the original site has misconfigured TLS). Long story short, using some fairly trivial heuristics, a malicious server could change its response when it detects its output being piped to a shell rather than saved to a file. Thus, a security-minded person downloading the file (who could inspect it) would be given a clean copy, but someone less security-minded piping it straight to bash would be given the malicious copy. The security-minded person wouldn't be able to warn people not to pipe the script to a shell, since it appears safe. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [2] https://web.archive.org/web/20240228190305/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240228190305/https://www.idont...
- _joel 3y ago
  This is piping to man, not bash. Interesting vector if you're worried about people piping into man from curl, but there you go.
- rezonant 3y ago
  This is extremely specifically is about detecting that Bash is pulling on the stream, by using it's line by line interpretation to do a timing attack. It's not clear there's a timing difference between pushing the stream to disk versus pushing the stream to man, since it seems fairly likely that man would read the entire file into memory before operating on it (at least modern man)

by _joel 3y ago

There's not much difference doing a pipe or using and intermediary file and "excecuting" that straight away. There's no manual step in the documentation there to read the output before it's run.

godelski 3y ago

This is not accurate. If the download gets interrupted bash will execute the partial line. That means `rm -r /tmp/foo.ext` or `rm -r ${HOME}/.tmp_config` can execute as `rm -r /`. This can be mitigated by wrapping the script, but clearly no one is looking at the code so this isn't really verified anyways. And it's not like we see that all the time. Edit: But my main point is about habits. There's the concern mananaysiempre brings up[0], but either way, it is best to be in good habits. [0] https://news.ycombinator.com/item?id=39554895 https://news.ycombinator.com/item?id=39554895

_joel 3y ago
From the post curl -sL -H "Accept: text/roff" https://jamesg.blog/2024/02/28/programming-projects/ https://jamesg.blog/2024/02/28/programming-projects/ > post.page && man ./post.page If curl's process is interupted, it'll generate a non-0 exit code and the man command won't be exectued. That's how double ampersands work in shell.
- godelski 3y ago
  I think you've missed the context of my comment. We're talking about `curl | man` not `curl && man`. You're right, `&&` doesn't have that risk. But `|` sure does.
fragmede 3y ago
thankfully rm -r / doesn't work on modern systems, though that doesn't invalidate your point.
- godelski 3y ago
  On what system are you talking about? I mean it won't kill everything because sudo but everything you have permissions to are still in danger
  - prmoustache 3y ago
    Which usually include your most valuable data. Nobody cares about losing a system. This is the data it is hosting that is valuable and takes the most time to recover from a backup.
  - fragmede 3y ago
    On modern, sane systems (meaning those running GNU coreutils, which doesn't include os x iirc), rm -rf / will refuse to run unless --no-preserve-root is also specified. https://www.gnu.org/software/coreutils/manual/html_node/Treating-_002f-specially.html https://www.gnu.org/software/coreutils/manual/html_node/Trea...

jmb99 3y ago

There definitely is a difference. See [1] (or [2] since the original site has misconfigured TLS). Long story short, using some fairly trivial heuristics, a malicious server could change its response when it detects its output being piped to a shell rather than saved to a file. Thus, a security-minded person downloading the file (who could inspect it) would be given a clean copy, but someone less security-minded piping it straight to bash would be given the malicious copy. The security-minded person wouldn't be able to warn people not to pipe the script to a shell, since it appears safe. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [2] https://web.archive.org/web/20240228190305/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240228190305/https://www.idont...

_joel 3y ago
This is piping to man, not bash. Interesting vector if you're worried about people piping into man from curl, but there you go.
rezonant 3y ago
This is extremely specifically is about detecting that Bash is pulling on the stream, by using it's line by line interpretation to do a timing attack. It's not clear there's a timing difference between pushing the stream to disk versus pushing the stream to man, since it seems fairly likely that man would read the entire file into memory before operating on it (at least modern man)