4 ms·
Everyone has been trained for years to do this: curl http://obscure.url?random-string http://obscure.url?random-string | sh
by fijiaarone 2y ago
Everyone has been trained for years to do this:
curl http://obscure.url?random-string http://obscure.url?random-string | sh
- fijiaarone 2y agoor even this: git clone http://github.com/unknown/repo.git http://github.com/unknown/repo.git && cd repo && npm install
- darkwater 2y agoEven worse: $ svn checkout $ ./configure $ make # make install
- dullcrisp 2y agoIf there were a legitimate looking GitHub how-to page that asked me to do that, I can see myself doing it. Fortunately, I ignore all security issues on my repositories.
- ToValueFunfetti 2y agoSecurity by lack thereof
- kurisufag 2y agopeople make a lot of noise about piping into shell, but even if the instructions were wget random.club/rc-12-release.sh chmod +x ./rc-12-release.sh ./rc-12-release.sh almost nobody would actually read the script before running it
- dullcrisp 2y agoWell yeah, if your intention is to install software from random.club on your system, what would be the point of checking the installer script? The worst thing it can do is the same thing you want it to do.
- School-Cotton 2y agoYes, which is why complaining about curl | sh is silly.
- dullcrisp 2y agoI’m not disagreeing.
- School-Cotton 2y agoNo they haven’t, they’ve been trained to do curl https://url-of-well-known-project | sh I may not trust the owners of a random domain, but I certainly trust the owners of rustup.rs not to do anything intentionally malicious.
- micw 2y agoAnother red flag. I cannot take any project serious that has this on its documentation.
- kadoban 2y agoYou prefer that they wrap it in an .msi file and put it on that same website? What do you think the advantages of that are?
- d0mine 2y agowhat is the more secure way in you opinion? What is the weak link here? TLS transport? possibly compromised hosting/codebase? trust in app authors? not reading the shell script? checking a signature of some file?
- micw 2y agoMy issue is the bypassing of the systems package manager. Doing so will result on files spread somewhere over the system. How do you uninstall such thing properly? How do you update (or even know) it's dependencies? Will it break because I uninstall or update one of it's dependencies? Linux has a very good package management for many years. I see absolute no reason to break this by creating shell installers.
- School-Cotton 2y agoI guess you don’t think the Rust programming language is a serious project, then?
- guappa 2y agoI mean they even named the website cargo, after cargo culting! (jk)