6 ms·
Would it make sense to mitigate this by creating a (even smaller) bootstrap script that itself downloads the "real" script and checks e.g. the SHA256 hash of th
by cbhl 13y ago
Would it make sense to mitigate this by creating a (even smaller) bootstrap script that itself downloads the "real" script and checks e.g. the SHA256 hash of the downloaded file before executing?
- djjaxe 13y agoor possibly a self checking script that only executed if it was complete... ie: the script is escaped and must run unescape(escaped_script) to be lethal but by then you can confirm that the script is infact whole and as the creator intended to be...
- mikegirouard 13y agoYes, but I understand the problem to be that we simply have gotten too comfortable with this behavior.
- hrjet 13y agoEven simpler would be: function install_my_software() { ... } install_my_software() If the script is partially downloaded, it won't have any effect.
- mercurial 13y agoI realize that I tend to do that by default in my shell scripts. After a few years of Python, I always make a main() function which gets the command line parameters. Is this weird?
- eropple 13y agoNot really weird - it allows for more composability if you ever need to go that way.
- mercurial 13y agoI think I do that to avoid global variables as much as possible, as well. Declaring things as "local" tends to keep me honest, as opposed to having a bunch of junk cluttering the global namespace.
- pdpi 13y agoIf you're weird, I'm weird too. It just seems to me that the main should worry about interfacing with the outside world, and the rest of your code should really just be written as a library.
- mercurial 13y agoYes, my main usually does little more than argument handling.
- shawabawa3 13y agoI had an idea for solving this problem and MITMs.. I made a utility "shacat", which takes a sha1 checksum as an argument and then pipes input to output iff the sum of input matches the sum e.g. $ curl http://site.com/script | shacat 7ef39183 | sh You don't even need https! You copy the command from the site including the sha sum, so it can't have been tampered with Of course, getting people to use shacat is the hard part
- gbog 13y ago"so it can't have been tampered with" Why that? Have we never heard of defaced web pages? Granted, using shacat is much better than piping into sh. But basic learning from security breaches is that nothing is safe, you only can find ways to do thing in a less catastrophic manner than others.
- shawabawa3 13y ago> Why that? Have we never heard of defaced web pages? Well if you can't trust the website you're screwed anyway. If the website is compromised then absolutely any way they have of installing software is broken
- tokenrove 13y agoUnless you verify against a PGP signature with trusted keys.
- kolev 13y agoGood, but in some cases this won't work with latest versions (content will change), plus, you need to add instructions for installing shacat first, which defeats the point of having a single line install. It's always been convenience over security.