3 ms·

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bi

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bit.ly into the chain of trust is quite a bold step, but is it really that different to, say, the rubygems server? Or your wireless router? EDIT: also, LOL at "mundanes."

TylerE 14y ago
Imagine Bit.ly gets backdoored, and that shortlink is repointed at a script that just contains rm -rf /
- JonnieCache 14y ago
  Imagine your wifi box gets backdoored. Imagine your ISP's router gets backdoored. Imagine if the server you got your bash from gets backdoored. Imagine if the rails repo gets backdoored. Imagine if the plant where apple images the macbook HDDs gets backdoored. Imagine all the people, living for today... (But yeah, personally, I'd forgo the bit.ly part as its unnecessary.)
  - pavel_lishin 14y ago
    I could also imagine that someone wired up my car to explode, but there's a reasonable level of paranoia. Link shorteners are fairly frequently used to hide the true destination of a link. Although, I wonder how hard it would be to set up some text with CSS that looks like one string, but is actually another. e.g. the user would see https://raw.github.com/mxcl/homebrew/master/Library/Contributions/install_homebrew.rb but when copied-and-pasted is revealed to actually be something like https://raw.github.com/mxel/homebrew/master/Library/Contributions/install_homebrew.rb
- rmc 14y ago
  Or even better, the Lybian goverment siezes it.
- WiseWeasel 14y ago
  Libya has traditionally been known as an incredibly corrupt regime, but since Ghaddafi is gone, who knows how things are run these days. My guess is, like it was before they gave him the boot, if you slip the right guy some cash, you can change that link all you want. Might be a different guy though, probably closer to the source, and the price is likely to be a lot lower now that there are less beaks to wet.
- kaonashi 14y ago
  You can open it up in web browser and view the code. Goes right here: https://raw.github.com/mxcl/homebrew/master/Library/Contributions/install_homebrew.rb https://raw.github.com/mxcl/homebrew/master/Library/Contribu.... I'm not sure how it could be more transparent.
rmc 14y ago
You can check checksums. You can use a package manager which has been gpg signed and reviewed by people smarter than you. You could download it over https. You're downloading and running in one go. If someone puts a badfile up for 1 minute, then restore it to normal, and you get hosed, it's pretty hard to check that, because the download link looks fine now. You cannot try to figure out what happened or who did it to try to track down the culprit.
- JonnieCache 14y ago
  Checksums are only for transmission errors. If someone can change the code, they can change the checksum. Indeed, using signed code is massively preferable, and it is increasingly common. I was about to write that you can't operate running only signed code, but if you consider git hashes a form of signing then I suppose you largely can these days. However, running unsigned code is still so common that I don't think you can really single out people who pipe curl into sh.

TylerE 14y ago

Imagine Bit.ly gets backdoored, and that shortlink is repointed at a script that just contains rm -rf /

JonnieCache 14y ago
Imagine your wifi box gets backdoored. Imagine your ISP's router gets backdoored. Imagine if the server you got your bash from gets backdoored. Imagine if the rails repo gets backdoored. Imagine if the plant where apple images the macbook HDDs gets backdoored. Imagine all the people, living for today... (But yeah, personally, I'd forgo the bit.ly part as its unnecessary.)
- pavel_lishin 14y ago
  I could also imagine that someone wired up my car to explode, but there's a reasonable level of paranoia. Link shorteners are fairly frequently used to hide the true destination of a link. Although, I wonder how hard it would be to set up some text with CSS that looks like one string, but is actually another. e.g. the user would see https://raw.github.com/mxcl/homebrew/master/Library/Contributions/install_homebrew.rb but when copied-and-pasted is revealed to actually be something like https://raw.github.com/mxel/homebrew/master/Library/Contributions/install_homebrew.rb
rmc 14y ago
Or even better, the Lybian goverment siezes it.
WiseWeasel 14y ago
Libya has traditionally been known as an incredibly corrupt regime, but since Ghaddafi is gone, who knows how things are run these days. My guess is, like it was before they gave him the boot, if you slip the right guy some cash, you can change that link all you want. Might be a different guy though, probably closer to the source, and the price is likely to be a lot lower now that there are less beaks to wet.
kaonashi 14y ago
You can open it up in web browser and view the code. Goes right here: https://raw.github.com/mxcl/homebrew/master/Library/Contributions/install_homebrew.rb https://raw.github.com/mxcl/homebrew/master/Library/Contribu.... I'm not sure how it could be more transparent.

rmc 14y ago

You can check checksums. You can use a package manager which has been gpg signed and reviewed by people smarter than you. You could download it over https. You're downloading and running in one go. If someone puts a badfile up for 1 minute, then restore it to normal, and you get hosed, it's pretty hard to check that, because the download link looks fine now. You cannot try to figure out what happened or who did it to try to track down the culprit.

JonnieCache 14y ago
Checksums are only for transmission errors. If someone can change the code, they can change the checksum. Indeed, using signed code is massively preferable, and it is increasingly common. I was about to write that you can't operate running only signed code, but if you consider git hashes a form of signing then I suppose you largely can these days. However, running unsigned code is still so common that I don't think you can really single out people who pipe curl into sh.