4 ms·

I thought OpenBSD people were more security conscious than this madness: $ curl https://randomwebsite https://randomwebsite | sh but alas I was wrong. There i

I thought OpenBSD people were more security conscious than this madness: $ curl https://randomwebsite https://randomwebsite | sh but alas I was wrong. There is a certain security reality distortion field that accompanies running OpenBSD.

znyboy 2y ago
That seems to be the installer for Asahi Linux: https://asahilinux.org/ https://asahilinux.org/
- nottorp 2y ago
  Whatever it is, why do people scream about buffer overflows and insecure passwords and overcomplicate everything in the name of security... ... and after that they run externally sourced scripts without even making a local copy ... let alone give them a cursory look ...
  - nequo 2y ago
    I think this is right. We routinely check the integrity of the packages and installers that we download using cryptographic hashing. OpenBSD even has a dedicated tool for this purpose.[1] It would make sense to take the same approach with curled shell scripts. [1] http://www.openbsd.cl/papers/bsdcan-signify.html http://www.openbsd.cl/papers/bsdcan-signify.html
brynet 2y ago
The script is running on macOS and is what the Asahi project recommends when updating or installing m1n1/Linux: https://asahilinux.org/ https://asahilinux.org/ It's called out in the OpenBSD/arm64 installation notes, at least: https://cdn.openbsd.org/pub/OpenBSD/snapshots/arm64/INSTALL.arm64 https://cdn.openbsd.org/pub/OpenBSD/snapshots/arm64/INSTALL.... Search for "Install on Apple Silicon".