3 ms·
"curl | bash" is the exact same threat vector as "download this compiled installer". I wonder why that doesn't result in the same hyperbolic responses.
by chowells 2y ago
"curl | bash" is the exact same threat vector as "download this compiled installer". I wonder why that doesn't result in the same hyperbolic responses.
- josephcsible 2y agoThe difference is that "curl | bash" doesn't save the output and can be distinguished server-side from commands that do <https://news.ycombinator.com/item?id=34145799 https://news.ycombinator.com/item?id=34145799>, so it's an especially easy way for a malicious server to undetectably have you run something different from what you've looked over.
- chowells 2y agoSo you're saying it's exactly the same as binary installers, which frequently download additional components during installation?
- josephcsible 2y agoWhen binary installers download additional components, they usually do so in a way indistinguishable server-side from downloading a file to analyze.
- chowells 2y agoHonest ones, sure. Why would a malicious one leave behind evidence of its malicious behavior? The threat model is identical.
- josephcsible 2y agoBut that behavior would be noticeable in the original download, which would be evidence itself.