3 ms·

I'm in the same boat. Though I see the argument that I'm running code I haven't audited all the time, there's something about a bash script in particular that g

I'm in the same boat. Though I see the argument that I'm running code I haven't audited all the time, there's something about a bash script in particular that gives me worry. I don't know how rational this is, but I feel like the author could switch the code momentarily to something exploitive, wait for N downloads, then switch it back. I'm not sure how you could gather evidence that this even happened, since the nature of `curl -s URL | bash` is so transient. I'd rather take an extra few seconds to do: $ curl https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck > bashcheck.sh $ cat bashcheck.sh # nothing fishy $ chmod +x bashcheck.sh && ./bashcheck.sh

floatingatoll 12y ago
You're better off using any text editor - cat will display ANSI terminal codes unescaped in many situations, which can inhibit your ability to see code that might otherwise be hidden by # ^[[<wipe to beginning of line> or somesuch appended to a malicious bit.
- teddyh 12y ago
  “cat” will display all bytes unescaped – that’s its job. The correct command in this case would be “less” (or any other pager, or possibly editor).
  - treve 12y ago
    Well since you went for a technical argument... if you really want to get technical.. it doesn't display anything and just sends the raw bytes to a stream. It doesn't 'display' all bytes, because not all bytes are displayable. hexdump would do a better job there.
ClashTheBunny 12y ago
We could at least reference a known good version by hash. This is at least a little more secure. But considering that Github could have been compromised by this bug, I would probably not pipe much from them until I know more about them not being compromised. Isn't running a jailed git server over ssh one of the great exploits of this bug?
acdha 12y ago
When you're looking at the page on Github, type "y" and it'll change the URL to the appropriate commit so you have a reasonable expectation that what you reviewed is what you're running: https://raw.githubusercontent.com/hannob/bashcheck/9ee8db0bf8558117071a8ef01be5aa64e318cc31/bashcheck https://raw.githubusercontent.com/hannob/bashcheck/9ee8db0bf... (This assumes Github hasn't been rooted and you don't have a MITM with access to a trusted CA but … almost everyone is screwed at that point)

floatingatoll 12y ago

You're better off using any text editor - cat will display ANSI terminal codes unescaped in many situations, which can inhibit your ability to see code that might otherwise be hidden by # ^[[<wipe to beginning of line> or somesuch appended to a malicious bit.

teddyh 12y ago
“cat” will display all bytes unescaped – that’s its job. The correct command in this case would be “less” (or any other pager, or possibly editor).
- treve 12y ago
  Well since you went for a technical argument... if you really want to get technical.. it doesn't display anything and just sends the raw bytes to a stream. It doesn't 'display' all bytes, because not all bytes are displayable. hexdump would do a better job there.

ClashTheBunny 12y ago

We could at least reference a known good version by hash. This is at least a little more secure. But considering that Github could have been compromised by this bug, I would probably not pipe much from them until I know more about them not being compromised. Isn't running a jailed git server over ssh one of the great exploits of this bug?

acdha 12y ago

When you're looking at the page on Github, type "y" and it'll change the URL to the appropriate commit so you have a reasonable expectation that what you reviewed is what you're running: https://raw.githubusercontent.com/hannob/bashcheck/9ee8db0bf8558117071a8ef01be5aa64e318cc31/bashcheck https://raw.githubusercontent.com/hannob/bashcheck/9ee8db0bf... (This assumes Github hasn't been rooted and you don't have a MITM with access to a trusted CA but … almost everyone is screwed at that point)