4 ms·

Can we please not normalize telling people to install things by curl piped into bash? I hate this trend. And particularly not for a very new, mostly untested by

Can we please not normalize telling people to install things by curl piped into bash? I hate this trend. And particularly not for a very new, mostly untested by a wider audience piece of software from a company that few have ever previously heard of. It even says, quoting from the website: "Headlong is alpha research software." Yeah that's totally something I want to curl thing.sh | bash , great idea.... Wow. I understand that people want to get people using their software as quickly as possible and with the absolute minimum of friction, but let's put some more thought into how this could be done in a less sketchy way. It's like we've regressed to the days when you would download a .exe file from tucows and blindly run/trust it on your windows 98SE PC.

aacid 2mo ago
You can always read the script file (orm ore realistically feed it to agent). If they distributed appimage or rpm would that be safer anyhow? Cannot it run malitious code same as the script would run?
- Systemerror7A69 2mo ago
  One of the big problems is that no one actually does read these scripts. You could say "Oh but it's their own fault, duh" but theres a very legitimate argument to be made users going the path of least resistance and that you shouldn't offload this responsibility on your users. Regarding appImage or rpm, attackers need to build and package these to inject these, while this curl | bash pipe opens up the possiblity of payloads simply by taking over the domain. And this isn't really that far fetched, just think about the Notepad++ update payload recently. The regular package was unaffected while the domain used for the update was taken over. Then theres also the argument about normalization. Just like he said, this isn't just something he said, this is a very real argument. You don't want to teach users bad habits. Even if / you / inspect the code you get, not everyone will. And ultimately, we should strive to make the Internet a safer place, if only to get less botnets.
  - indstinctdialog 2mo ago
    This is the same as terms of service agreements. There's a crowd mentality around it where only one person with enough of a voice needs to read it and scream. It's brittle because if everyone thinks that then nobody checks it but the probability scales with the attention it gets. Totally agree we should make the internet safer, this is just a clarification that we don't necessarily need everyone to check it. One person who always checks everything and sends this to their LLM and posts a viral post can be a deterrent. The installer is one threat. You're then running this on your machine which is the next threat.
  - walrus01 2mo ago
    > You don't want to teach users bad habits. Take a look at the screenshots here for one example of getting non-technical users to paste things into the equivalent of bash: https://www.tilburguniversity.edu/about/conduct-and-integrity/privacy-and-security/fake-captchas https://www.tilburguniversity.edu/about/conduct-and-integrit...
  - b5n 2mo ago
    > no one actually does read these scripts I do.
deleted 2mo ago
[deleted]

aacid 2mo ago

You can always read the script file (orm ore realistically feed it to agent). If they distributed appimage or rpm would that be safer anyhow? Cannot it run malitious code same as the script would run?

Systemerror7A69 2mo ago
One of the big problems is that no one actually does read these scripts. You could say "Oh but it's their own fault, duh" but theres a very legitimate argument to be made users going the path of least resistance and that you shouldn't offload this responsibility on your users. Regarding appImage or rpm, attackers need to build and package these to inject these, while this curl | bash pipe opens up the possiblity of payloads simply by taking over the domain. And this isn't really that far fetched, just think about the Notepad++ update payload recently. The regular package was unaffected while the domain used for the update was taken over. Then theres also the argument about normalization. Just like he said, this isn't just something he said, this is a very real argument. You don't want to teach users bad habits. Even if / you / inspect the code you get, not everyone will. And ultimately, we should strive to make the Internet a safer place, if only to get less botnets.
- indstinctdialog 2mo ago
  This is the same as terms of service agreements. There's a crowd mentality around it where only one person with enough of a voice needs to read it and scream. It's brittle because if everyone thinks that then nobody checks it but the probability scales with the attention it gets. Totally agree we should make the internet safer, this is just a clarification that we don't necessarily need everyone to check it. One person who always checks everything and sends this to their LLM and posts a viral post can be a deterrent. The installer is one threat. You're then running this on your machine which is the next threat.
- walrus01 2mo ago
  > You don't want to teach users bad habits. Take a look at the screenshots here for one example of getting non-technical users to paste things into the equivalent of bash: https://www.tilburguniversity.edu/about/conduct-and-integrity/privacy-and-security/fake-captchas https://www.tilburguniversity.edu/about/conduct-and-integrit...
- b5n 2mo ago
  > no one actually does read these scripts I do.

deleted 2mo ago

[deleted]