3 ms·

I can't believe curl | sh is still the recommended way to install oh-my-zsh

arresin 2y ago
I like it because you can replace sh with whatever you want to go over the script
Dylan16807 2y ago
Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication by a hundred times because this is on github servers. The "what if the file is truncated" issue is the only realistic one, and competent installers like this one define functions and don't run them until the last line.
- tzs 2y ago
  > Getting it out of a repository wouldn't make any more vetting appear as if by magic. But it makes it way easier to figure out what happened if you do get attacked. With "curl | sh" if a compromised site only sends the attack code randomly and I get unlucky I won't have a copy of the attack code afterwards. If I go to the site to grab a copy I'll probably get a copy without the attack code. With "curl > /tmp/foo.$$; sh < /tmp/foo.$$" if I am unlucky and get the attack code I can at least look at /tmp/foo.$$ to see what happened, and download the code again and see if it is the same. If you insist on piping, at least do "curl | tee /tmp/foo.$$ | sh".
  - vladxyz 2y ago
    You can also throw in a `-x` at the end there.
- Repulsion9513 2y ago
  > sophisticated enough to send different contents to a browser and to curl Checking the Accept header (or User-Agent or a bunch of other things) is very difficult :)
  - soraminazuki 2y ago
    GP likely meant differentiating `curl` and `curl | bash`. https://web.archive.org/web/20240520142212/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240520142212/https://www.idont...
    - Repulsion9513 2y ago
      Did they? IDK, just differentiating browser from curl is incredibly likely to be "good enough" as an attacker.
      - Dylan16807 2y ago
        I did have that attack in mind, yes. But honestly it doesn't take a lot of sophistication to hide an exploit somewhere in an entire piece of software. The average person is very vulnerable to a malicious dev and the way they download is very unlikely to matter as long as it's not http:// http://

I like it because you can replace sh with whatever you want to go over the script

Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication by a hundred times because this is on github servers. The "what if the file is truncated" issue is the only realistic one, and competent installers like this one define functions and don't run them until the last line.

tzs 2y ago
> Getting it out of a repository wouldn't make any more vetting appear as if by magic. But it makes it way easier to figure out what happened if you do get attacked. With "curl | sh" if a compromised site only sends the attack code randomly and I get unlucky I won't have a copy of the attack code afterwards. If I go to the site to grab a copy I'll probably get a copy without the attack code. With "curl > /tmp/foo.$$; sh < /tmp/foo.$$" if I am unlucky and get the attack code I can at least look at /tmp/foo.$$ to see what happened, and download the code again and see if it is the same. If you insist on piping, at least do "curl | tee /tmp/foo.$$ | sh".
- vladxyz 2y ago
  You can also throw in a `-x` at the end there.
Repulsion9513 2y ago
> sophisticated enough to send different contents to a browser and to curl Checking the Accept header (or User-Agent or a bunch of other things) is very difficult :)
- soraminazuki 2y ago
  GP likely meant differentiating `curl` and `curl | bash`. https://web.archive.org/web/20240520142212/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240520142212/https://www.idont...
  - Repulsion9513 2y ago
    Did they? IDK, just differentiating browser from curl is incredibly likely to be "good enough" as an attacker.
    - Dylan16807 2y ago
      I did have that attack in mind, yes. But honestly it doesn't take a lot of sophistication to hide an exploit somewhere in an entire piece of software. The average person is very vulnerable to a malicious dev and the way they download is very unlikely to matter as long as it's not http:// http://