4 ms·

I don't think security is the main problem tbh. Every time you trust a third party developer you're compromising your security a little. Add a third party deb r

by tasuki 2y ago

I don't think security is the main problem tbh. Every time you trust a third party developer you're compromising your security a little. Add a third party deb repo? Just as bad wrt security! But, these bash scripts are definitely terrible for maintenance. They do a bunch of changes to your system and you can't undo those changes easily.

wakawaka28 2y ago
Security is indeed a problem when running scripts straight from a download. The script may appear one way when viewed with a browser and a different way when downloaded again, based on a number of possible alterations that a malicious server is capable of. You are right about scripts doing a bunch of changes to your system. Certainly, if you don't even save the script, you won't even know where to start!
- tasuki 2y ago
  Well you could download the script, review it, and only then run it? Despite encountering your kind of attitude many times in the past, I don't get it at all. Maybe I'm missing something. If you do trust the author of said thing, what's the problem? If you don't trust the author, why would you even run their scripts? No offense, but even if you do inspect all of the code, I doubt you'd be able to find all the potential backdoors and issues. If you trust the author of Omakub, they have the ability to screw your security anyway, I don't think there's a way of preventing that.
  - wakawaka28 2y ago
    There are multiple levels of trust. Do I trust the author to not put exploits in my face? Do I trust them to administer their own server in a way that won't leave users open to hackers? Do I trust them to not put in some underhanded backdoor in a spot where they know I won't be looking? Generally, piping random scripts into a shell is awful, even if you vaguely trust the author of the thing you think you're getting. There are multiple ways you can end up with unexpected evil code on your system that way, with or without the project itself being involved.

by tasuki 2y ago

wakawaka28 2y ago

Security is indeed a problem when running scripts straight from a download. The script may appear one way when viewed with a browser and a different way when downloaded again, based on a number of possible alterations that a malicious server is capable of. You are right about scripts doing a bunch of changes to your system. Certainly, if you don't even save the script, you won't even know where to start!

tasuki 2y ago
Well you could download the script, review it, and only then run it? Despite encountering your kind of attitude many times in the past, I don't get it at all. Maybe I'm missing something. If you do trust the author of said thing, what's the problem? If you don't trust the author, why would you even run their scripts? No offense, but even if you do inspect all of the code, I doubt you'd be able to find all the potential backdoors and issues. If you trust the author of Omakub, they have the ability to screw your security anyway, I don't think there's a way of preventing that.
- wakawaka28 2y ago
  There are multiple levels of trust. Do I trust the author to not put exploits in my face? Do I trust them to administer their own server in a way that won't leave users open to hackers? Do I trust them to not put in some underhanded backdoor in a spot where they know I won't be looking? Generally, piping random scripts into a shell is awful, even if you vaguely trust the author of the thing you think you're getting. There are multiple ways you can end up with unexpected evil code on your system that way, with or without the project itself being involved.