4 ms·

It's on the website: wget -qO- https://omakub.org/install | bash

by snthpy 2y ago

wakawaka28 2y ago
This is awful for security.
- tasuki 2y ago
  I don't think security is the main problem tbh. Every time you trust a third party developer you're compromising your security a little. Add a third party deb repo? Just as bad wrt security! But, these bash scripts are definitely terrible for maintenance. They do a bunch of changes to your system and you can't undo those changes easily.
  - wakawaka28 2y ago
    Security is indeed a problem when running scripts straight from a download. The script may appear one way when viewed with a browser and a different way when downloaded again, based on a number of possible alterations that a malicious server is capable of. You are right about scripts doing a bunch of changes to your system. Certainly, if you don't even save the script, you won't even know where to start!
    - tasuki 2y ago
      Well you could download the script, review it, and only then run it? Despite encountering your kind of attitude many times in the past, I don't get it at all. Maybe I'm missing something. If you do trust the author of said thing, what's the problem? If you don't trust the author, why would you even run their scripts? No offense, but even if you do inspect all of the code, I doubt you'd be able to find all the potential backdoors and issues. If you trust the author of Omakub, they have the ability to screw your security anyway, I don't think there's a way of preventing that.
      - wakawaka28 2y ago
        There are multiple levels of trust. Do I trust the author to not put exploits in my face? Do I trust them to administer their own server in a way that won't leave users open to hackers? Do I trust them to not put in some underhanded backdoor in a spot where they know I won't be looking? Generally, piping random scripts into a shell is awful, even if you vaguely trust the author of the thing you think you're getting. There are multiple ways you can end up with unexpected evil code on your system that way, with or without the project itself being involved.
- Modified3019 2y ago
  Yes. But how is this materially different from most other installers or program extensions running unreviewed arbitrary code that could change at any time for any reason. I don’t really get why this is the straw that breaks the back for some people and suddenly puts them at high alert. Do you do a diff on the .xpi whenever a Firefox extension updates? Yeah we really should, but we don’t. At some point it’s too much overhead to deal with. If you truly wish to review what this does, here’s the github: https://github.com/basecamp/omakub https://github.com/basecamp/omakub
  - wakawaka28 2y ago
    Even if I reviewed the code, that would not be enough to be safe with that install procedure. The difference is that it is known that the server can detect the client being used and serve different content to different consumers. Nevermind trusting the author, or some previously reviewed code, you also have to trust the delivery system. There are also degrees of trust. I might trust someone's code that was laid in plain sight but I might not trust a binary or obfuscated thing allegedly containing the same code.
    - tasuki 2y ago
      What operating system do you use? How do you set it up without trusting many third parties? What delivery system would you recommend? Everyone can easily clone the Omakub repository to their own server, review it, and use it from there. Should that be the recommended installation method? How do you deal with updates?
      - wakawaka28 2y ago
        The recommended installation method should be to download the script, check the hash of the thing you downloaded against the hash of what you thought you were getting, and then run it. Obviously if you don't trust the author, you should do more research until you reach a conclusion. If you ask me, you should do vetting proportional to the amount of time you have and the risk involved in a compromise of your system. That may practically mean that you won't install much of anything except via the most well popular software channels. Even then, you may opt to compile the stuff. If you don't have enough skills or time to do this vetting, you should err on the side of caution.

It's on the website: wget -qO- https://omakub.org/install | bash

by snthpy 2y ago

It's on the website: wget -qO- https://omakub.org/install | bash

wakawaka28 2y ago

This is awful for security.

tasuki 2y ago
I don't think security is the main problem tbh. Every time you trust a third party developer you're compromising your security a little. Add a third party deb repo? Just as bad wrt security! But, these bash scripts are definitely terrible for maintenance. They do a bunch of changes to your system and you can't undo those changes easily.
- wakawaka28 2y ago
  Security is indeed a problem when running scripts straight from a download. The script may appear one way when viewed with a browser and a different way when downloaded again, based on a number of possible alterations that a malicious server is capable of. You are right about scripts doing a bunch of changes to your system. Certainly, if you don't even save the script, you won't even know where to start!
  - tasuki 2y ago
    Well you could download the script, review it, and only then run it? Despite encountering your kind of attitude many times in the past, I don't get it at all. Maybe I'm missing something. If you do trust the author of said thing, what's the problem? If you don't trust the author, why would you even run their scripts? No offense, but even if you do inspect all of the code, I doubt you'd be able to find all the potential backdoors and issues. If you trust the author of Omakub, they have the ability to screw your security anyway, I don't think there's a way of preventing that.
    - wakawaka28 2y ago
      There are multiple levels of trust. Do I trust the author to not put exploits in my face? Do I trust them to administer their own server in a way that won't leave users open to hackers? Do I trust them to not put in some underhanded backdoor in a spot where they know I won't be looking? Generally, piping random scripts into a shell is awful, even if you vaguely trust the author of the thing you think you're getting. There are multiple ways you can end up with unexpected evil code on your system that way, with or without the project itself being involved.
Modified3019 2y ago
Yes. But how is this materially different from most other installers or program extensions running unreviewed arbitrary code that could change at any time for any reason. I don’t really get why this is the straw that breaks the back for some people and suddenly puts them at high alert. Do you do a diff on the .xpi whenever a Firefox extension updates? Yeah we really should, but we don’t. At some point it’s too much overhead to deal with. If you truly wish to review what this does, here’s the github: https://github.com/basecamp/omakub https://github.com/basecamp/omakub
- wakawaka28 2y ago
  Even if I reviewed the code, that would not be enough to be safe with that install procedure. The difference is that it is known that the server can detect the client being used and serve different content to different consumers. Nevermind trusting the author, or some previously reviewed code, you also have to trust the delivery system. There are also degrees of trust. I might trust someone's code that was laid in plain sight but I might not trust a binary or obfuscated thing allegedly containing the same code.
  - tasuki 2y ago
    What operating system do you use? How do you set it up without trusting many third parties? What delivery system would you recommend? Everyone can easily clone the Omakub repository to their own server, review it, and use it from there. Should that be the recommended installation method? How do you deal with updates?
    - wakawaka28 2y ago
      The recommended installation method should be to download the script, check the hash of the thing you downloaded against the hash of what you thought you were getting, and then run it. Obviously if you don't trust the author, you should do more research until you reach a conclusion. If you ask me, you should do vetting proportional to the amount of time you have and the risk involved in a compromise of your system. That may practically mean that you won't install much of anything except via the most well popular software channels. Even then, you may opt to compile the stuff. If you don't have enough skills or time to do this vetting, you should err on the side of caution.