4 ms·

Has there been a single recorded case of malware getting around this way?

godelski 3y ago
I'm sorry, your argument is... what exactly? That we shouldn't take simple or even trivial preventative measures that also reduce other potential problems because we... haven't seen anybody abuse such a thing before? Really? What a terrible argument. Not it's trivial to resolve. Why not just fix things that we know are problems or can lead to serious problems instead of waiting for it to become a problem where it'll then be FAR more work to clean it up? Seriously, you're a human, not a bug. You have the ability to solve things before they become problems. Use it. While I'm not sure of a specific example, I feel quite confident in saying that this has been done before.
- rezonant 3y ago
  There was no argument here, only a question. And it's a fair question to ask for the purposes of discussion. You're right, piping to sh is definitely a risk, and we should do better as a community, and not make users normalized to piping to sh.
  - godelski 3y ago
    It appeared as a rhetorical question used to rebut the claim. Maybe I misinterpreted it. Fair. But that is a possible interpretation. But as you can see elsewhere, we shouldn't pipe streams into anything. It's just not hard to avoid this. A few extra characters and you're good to go. Let's take rust for example. Users are copy pasting anyways They give curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh But why not curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /tmp/rust_install.sh && sh /tmp/rust_install.sh For user experience, it is till a one liner, but it is infinitely better. Still has some risks, but a lot less. (at least rust does wrap the install so you don't run the risk of partial line execution) And it gives the user a way to verify that the file was correct if they provide a checksum. There's just no good reason to not do this. We especially shouldn't be teaching noobies to pipe streams into any command. Let's be real, most people don't know linux well, even if they use linux.
    - rezonant 3y ago
      > But as you can see elsewhere, we shouldn't pipe streams into anything. Firstly, I'll assume you mean untrusted streams since if you didn't mean that, we might as well throw out UNIX entirely. Even given that caveat though, I disagree. Downloading an image and then converting that image into another format is not a case where there's a material improvement in security when making temporary files instead of using pipes. I'd argue in some cases it may have the opposite effect. It's indicative of the lack of rationale on this more general case that you selected an example where the piping is into sh here. I agree with all of your points about piping into sh, just not that we can turn that into a general principal. It's OK if we have different best practices between these two cases. This kind of advice taken by a laymen or junior dev can cause problems, because the second you put the file on disk there's a risk you won't clean up that content, which for an automated system will ultimately bring it down when the disk fills up. In addition, if the information downloaded is sensitive, you are creating a security problem if you are intentionally writing it on disk even if you do clean it up later, as filesystem data remains persistent after unlink.
- jimmaswell 3y ago
  If you're willing to run an executable installer from a website then piping into sh is no better.
  - godelski 3y ago
    Read elsewhere. Piping can be dangerous if there's a disconnect. You can also detect piping server side. Piping is strictly worse. Convenient, yes, but 99% of the commands can non-streams and no difference for the end user who is copy pasting it.
EE84M3i 3y ago
Yes. A particularly well known one was codecov. https://news.ycombinator.com/item?id=26819983 https://news.ycombinator.com/item?id=26819983

I'm sorry, your argument is... what exactly? That we shouldn't take simple or even trivial preventative measures that also reduce other potential problems because we... haven't seen anybody abuse such a thing before? Really? What a terrible argument. Not it's trivial to resolve. Why not just fix things that we know are problems or can lead to serious problems instead of waiting for it to become a problem where it'll then be FAR more work to clean it up? Seriously, you're a human, not a bug. You have the ability to solve things before they become problems. Use it. While I'm not sure of a specific example, I feel quite confident in saying that this has been done before.

rezonant 3y ago
There was no argument here, only a question. And it's a fair question to ask for the purposes of discussion. You're right, piping to sh is definitely a risk, and we should do better as a community, and not make users normalized to piping to sh.
- godelski 3y ago
  It appeared as a rhetorical question used to rebut the claim. Maybe I misinterpreted it. Fair. But that is a possible interpretation. But as you can see elsewhere, we shouldn't pipe streams into anything. It's just not hard to avoid this. A few extra characters and you're good to go. Let's take rust for example. Users are copy pasting anyways They give curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh But why not curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /tmp/rust_install.sh && sh /tmp/rust_install.sh For user experience, it is till a one liner, but it is infinitely better. Still has some risks, but a lot less. (at least rust does wrap the install so you don't run the risk of partial line execution) And it gives the user a way to verify that the file was correct if they provide a checksum. There's just no good reason to not do this. We especially shouldn't be teaching noobies to pipe streams into any command. Let's be real, most people don't know linux well, even if they use linux.
  - rezonant 3y ago
    > But as you can see elsewhere, we shouldn't pipe streams into anything. Firstly, I'll assume you mean untrusted streams since if you didn't mean that, we might as well throw out UNIX entirely. Even given that caveat though, I disagree. Downloading an image and then converting that image into another format is not a case where there's a material improvement in security when making temporary files instead of using pipes. I'd argue in some cases it may have the opposite effect. It's indicative of the lack of rationale on this more general case that you selected an example where the piping is into sh here. I agree with all of your points about piping into sh, just not that we can turn that into a general principal. It's OK if we have different best practices between these two cases. This kind of advice taken by a laymen or junior dev can cause problems, because the second you put the file on disk there's a risk you won't clean up that content, which for an automated system will ultimately bring it down when the disk fills up. In addition, if the information downloaded is sensitive, you are creating a security problem if you are intentionally writing it on disk even if you do clean it up later, as filesystem data remains persistent after unlink.
jimmaswell 3y ago
If you're willing to run an executable installer from a website then piping into sh is no better.
- godelski 3y ago
  Read elsewhere. Piping can be dangerous if there's a disconnect. You can also detect piping server side. Piping is strictly worse. Convenient, yes, but 99% of the commands can non-streams and no difference for the end user who is copy pasting it.

EE84M3i 3y ago

Yes. A particularly well known one was codecov. https://news.ycombinator.com/item?id=26819983 https://news.ycombinator.com/item?id=26819983