3 ms·

Secure... curl ... |sh. Closes tab

by lrvick 3y ago

Alifatisk 3y ago
Just read what it does https://raw.githubusercontent.com/nanovms/ops/master/install.sh https://raw.githubusercontent.com/nanovms/ops/master/install...
- lrvick 3y ago
  That is what it does at this moment. Will it do that 8 seconds from now? There is no signature checking. Distributing unsigned software, then asking users to blindly execute it, is simply irresponsible.
  - Alifatisk 3y ago
    > That is what it does at this moment. Will it do that 8 seconds from now? In that case, you can simply stick to the commit hash you read the source code from. https://raw.githubusercontent.com/nanovms/ops/0b7e8bb9e567672840294a900232a94ff9e91b09/install.sh https://raw.githubusercontent.com/nanovms/ops/0b7e8bb9e56767...
    - lrvick 3y ago
      Again. Who is to say that this will not change or be MITMed? Download first, review, then execute. Or even better, download, verify signatures from multiple reputable people, optionally review, then execute.
      - Alifatisk 3y ago
        > Who is to say that this will not change Isn't the commit and its hash immutable?
pipingdog 3y ago
Tangent: I have an earnest interest in learning about methods for installing software obtained from the internet which would be any more secure than this.
- lrvick 3y ago
  Signed reproducible builds are the bare minimum. See Arch Linux, Debian, Guix, Stagex
eyberg 3y ago
There are a ton of different download options https://ops.city/downloads https://ops.city/downloads (versus just compiling from source yourself if you're super paranoid), including signed/notarized/stapled builds from companies such as Apple.
- lrvick 3y ago
  1. You are using MD5 hashes which are trivial to create collisions of 2. None of your artifacts or build script are signed by you (third party signs by apple are pointless) 3. Builds have no evidence of being reproducible, or anyone having reproduced and counter signed them. Compare to say the Bitcoin or Monero processes that have multiple people build and sign every release so it is easy to trust there were no SPOFs.

Secure... curl ... |sh. Closes tab

by lrvick 3y ago

Secure... curl ... |sh. Closes tab

Just read what it does https://raw.githubusercontent.com/nanovms/ops/master/install.sh https://raw.githubusercontent.com/nanovms/ops/master/install...

lrvick 3y ago
That is what it does at this moment. Will it do that 8 seconds from now? There is no signature checking. Distributing unsigned software, then asking users to blindly execute it, is simply irresponsible.
- Alifatisk 3y ago
  > That is what it does at this moment. Will it do that 8 seconds from now? In that case, you can simply stick to the commit hash you read the source code from. https://raw.githubusercontent.com/nanovms/ops/0b7e8bb9e567672840294a900232a94ff9e91b09/install.sh https://raw.githubusercontent.com/nanovms/ops/0b7e8bb9e56767...
  - lrvick 3y ago
    Again. Who is to say that this will not change or be MITMed? Download first, review, then execute. Or even better, download, verify signatures from multiple reputable people, optionally review, then execute.
    - Alifatisk 3y ago
      > Who is to say that this will not change Isn't the commit and its hash immutable?

pipingdog 3y ago

Tangent: I have an earnest interest in learning about methods for installing software obtained from the internet which would be any more secure than this.

lrvick 3y ago
Signed reproducible builds are the bare minimum. See Arch Linux, Debian, Guix, Stagex

eyberg 3y ago

There are a ton of different download options https://ops.city/downloads https://ops.city/downloads (versus just compiling from source yourself if you're super paranoid), including signed/notarized/stapled builds from companies such as Apple.

lrvick 3y ago
1. You are using MD5 hashes which are trivial to create collisions of 2. None of your artifacts or build script are signed by you (third party signs by apple are pointless) 3. Builds have no evidence of being reproducible, or anyone having reproduced and counter signed them. Compare to say the Bitcoin or Monero processes that have multiple people build and sign every release so it is easy to trust there were no SPOFs.