4 ms·

I agree that it's insecure but so is ./configure && make && make install Or what about places that give you a Yum repo to install cd /etc/yum.repos.d/ wget h

I agree that it's insecure but so is ./configure && make && make install Or what about places that give you a Yum repo to install cd /etc/yum.repos.d/ wget http://download.opensuse.org/repositories/isv:ownCloud:devel/RedHat_RHEL-6/isv:ownCloud:devel.repo http://download.opensuse.org/repositories/isv:ownCloud:devel... yum install owncloud-client It's all the same to me. A user is just saying "I trust you enough to run this thing or this system isn't that important to me so the risk is acceptable". I'd argue the Yum way is even more dangerous because if bad stuff isn't sent down now, an update could cause bad stuff to be installed in a month during a yum update. That's much harder to catch.

0x0 13y ago
Well, a yum repository would have to be maliciously modified to cause bad things to happen. Piping curl could end up with fatal consequences even by accident, if the shell script is cut off at the worst possible moment by accidental connection loss...
- migrantgeek 13y ago
  What if the repo was malicious from the start just waiting for you to install the first safe version only to give you the trojan later? The shell script prematurely terminating isn't really a security concern and could be fixed by downloading and running the script separately. I guess my argument is that if you don't trust the source, don't install the application without looking through the code or running through some analysis software. I would say that sites that tell users to install software in this fashion should warn them about the dangers so people can make informed decisions.
beachstartup 13y ago
the problem is there's absolutely zero trust built into the curl/pipe/shell. you could do a MITM attack on curl with a simple hosts file entry. that's literally all it takes. you could do it by ACCIDENT. a signed or checksummed package is a completely different matter entirely. no, it's not foolproof. yes, it takes knowledge to verify. but it's much better than just running executable code straight off the web.

0x0 13y ago

Well, a yum repository would have to be maliciously modified to cause bad things to happen. Piping curl could end up with fatal consequences even by accident, if the shell script is cut off at the worst possible moment by accidental connection loss...

migrantgeek 13y ago
What if the repo was malicious from the start just waiting for you to install the first safe version only to give you the trojan later? The shell script prematurely terminating isn't really a security concern and could be fixed by downloading and running the script separately. I guess my argument is that if you don't trust the source, don't install the application without looking through the code or running through some analysis software. I would say that sites that tell users to install software in this fashion should warn them about the dangers so people can make informed decisions.

beachstartup 13y ago

the problem is there's absolutely zero trust built into the curl/pipe/shell. you could do a MITM attack on curl with a simple hosts file entry. that's literally all it takes. you could do it by ACCIDENT. a signed or checksummed package is a completely different matter entirely. no, it's not foolproof. yes, it takes knowledge to verify. but it's much better than just running executable code straight off the web.