3 ms·
I had an idea for solving this problem and MITMs.. I made a utility "shacat", which takes a sha1 checksum as an argument and then pipes input to output iff the
by shawabawa3 13y ago
I had an idea for solving this problem and MITMs..
I made a utility "shacat", which takes a sha1 checksum as an argument and then pipes input to output iff the sum of input matches the sum
e.g.
$ curl http://site.com/script | shacat 7ef39183 | sh
You don't even need https! You copy the command from the site including the sha sum, so it can't have been tampered with
Of course, getting people to use shacat is the hard part
- gbog 13y ago"so it can't have been tampered with" Why that? Have we never heard of defaced web pages? Granted, using shacat is much better than piping into sh. But basic learning from security breaches is that nothing is safe, you only can find ways to do thing in a less catastrophic manner than others.
- shawabawa3 13y ago> Why that? Have we never heard of defaced web pages? Well if you can't trust the website you're screwed anyway. If the website is compromised then absolutely any way they have of installing software is broken
- tokenrove 13y agoUnless you verify against a PGP signature with trusted keys.
- kolev 13y agoGood, but in some cases this won't work with latest versions (content will change), plus, you need to add instructions for installing shacat first, which defeats the point of having a single line install. It's always been convenience over security.