3 ms·

Suggesting bash/curl'ing to get a 12 lines JSON file is just... Not great. We've seen a shitload of developers account getting compromised (with all the supply

Suggesting bash/curl'ing to get a 12 lines JSON file is just... Not great. We've seen a shitload of developers account getting compromised (with all the supply chain attacks) and developers account turning evil. Also there's absolutely zero need to be sudo to put a JSON config file for Firefox on Linux. You're basically bash/curl'ing the kitchen sink, with all the security risks that entails, executing a shell script as root (which may or may not be malicious now or at some point in the future), just to... Put a 12 lines JSON file in a user's Firefox config folder. Way to go my "fremen" brothers [1]. [1] the "fremen" in Dune as those who adore the Shai-Hulud

corbindavenport 9mo ago
Administrator access or sudo is required because the configuration paths (C:\Program Files\Mozilla Firefox on Windows, /etc/firefox/policies/ on Linux) are protected. The browser guides explain the manual install and uninstall process for anyone who doesn't trust the script.
- 6031769 9mo ago
  I have firefox installed on Linux. There is no /etc/firefox/policies/ dir, nor indeed even an /etc/firefox/ dir. Therefore, no need for sudo.
  - corbindavenport 9mo ago
    The /etc directory and everything under it is protected.
    - 6031769 9mo ago
      Of course it is. But there's no point trying to put policies into a directory in a tree which doesn't exist and by extension which Firefox won't be reading. In Linux (and in any sane system) there is no need for elevated privileges just to alter your browser settings.
      - listeria 9mo ago
        Firefox will read it if it exists[1]. You could use the /usr/lib/firefox/distribution directory (or whatever the installation directory may be), but that may be overwritten by an update. There doesn't seem to be any way to set per-user group policies, so unless you're installing firefox in a user-controlled directory, it will require elevated privileges. [1]: https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
WorldMaker 9mo ago
I feel this way even more about this approach to PowerShell scripts. At the very least you could code sign [1] your script. Most PowerShell devs run with the execution policy RemoteSigned for multiple reasons. Instead of pulling your script down from the web and dangerously converting it to a string to call (with &) you can download it as a real file and Invoke-Command (icm) it. Dangerous eval versus correctly running a script. Sure, Authenticode signing certificates aren't always cheap, and signing your script doesn't protect the script from compromise without other good security practices, but it would still show some attention to detail on PowerShell and some attempt to avoid malware compromising your script. [1] https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/module/microsof...
- WorldMaker 9mo ago
  There's even talk in the PowerShell world about Invoke-Command directly accepting HTTPS URLs to scripts, but in addition to some security questions, it is caught in a catch-22 that not enough of these scripts are Signed so there's not enough demand for it, but if more tools like this were doing code signing there's a world where the code golfed instructions are just `icm https://yourdomain.com/some/script.ps1 https://yourdomain.com/some/script.ps1`, and it is more secure than these examples with (`&` or `iex`) and `iwr`.

corbindavenport 9mo ago

Administrator access or sudo is required because the configuration paths (C:\Program Files\Mozilla Firefox on Windows, /etc/firefox/policies/ on Linux) are protected. The browser guides explain the manual install and uninstall process for anyone who doesn't trust the script.

6031769 9mo ago
I have firefox installed on Linux. There is no /etc/firefox/policies/ dir, nor indeed even an /etc/firefox/ dir. Therefore, no need for sudo.
- corbindavenport 9mo ago
  The /etc directory and everything under it is protected.
  - 6031769 9mo ago
    Of course it is. But there's no point trying to put policies into a directory in a tree which doesn't exist and by extension which Firefox won't be reading. In Linux (and in any sane system) there is no need for elevated privileges just to alter your browser settings.
    - listeria 9mo ago
      Firefox will read it if it exists[1]. You could use the /usr/lib/firefox/distribution directory (or whatever the installation directory may be), but that may be overwritten by an update. There doesn't seem to be any way to set per-user group policies, so unless you're installing firefox in a user-controlled directory, it will require elevated privileges. [1]: https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

WorldMaker 9mo ago

I feel this way even more about this approach to PowerShell scripts. At the very least you could code sign [1] your script. Most PowerShell devs run with the execution policy RemoteSigned for multiple reasons. Instead of pulling your script down from the web and dangerously converting it to a string to call (with &) you can download it as a real file and Invoke-Command (icm) it. Dangerous eval versus correctly running a script. Sure, Authenticode signing certificates aren't always cheap, and signing your script doesn't protect the script from compromise without other good security practices, but it would still show some attention to detail on PowerShell and some attempt to avoid malware compromising your script. [1] https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/module/microsof...

WorldMaker 9mo ago
There's even talk in the PowerShell world about Invoke-Command directly accepting HTTPS URLs to scripts, but in addition to some security questions, it is caught in a catch-22 that not enough of these scripts are Signed so there's not enough demand for it, but if more tools like this were doing code signing there's a world where the code golfed instructions are just `icm https://yourdomain.com/some/script.ps1 https://yourdomain.com/some/script.ps1`, and it is more secure than these examples with (`&` or `iex`) and `iwr`.