4 ms·
Not any worse than installing an RPM/deb (which includes an embedded preinstall script) Or the normal "./configure / make / make install" pattern which gives a
by bodyfour 12y ago
Not any worse than installing an RPM/deb (which includes an embedded preinstall script) Or the normal "./configure / make / make install" pattern which gives a malicious distributor lots of boilerplate to hide in.
If anything it's probably safer since it's explicit and more likely to be audited.
- ars 12y agoIf you install deb's normally they are signed, and it does check the signature. Perhaps the one-liner should be amended to check the hash of the file first, and only run if it matches.
- legulere 12y agoOr just use https with certificate check. One could argue that signed packages are still harder to check because publicly facing web servers are easier to hack, but you need to get the signature somewhere which is usually included in you distribution you downloaded through an insecure http or ftp connection.
- xnyhps 12y agoThat doesn't protect you from truncation attacks: almost no server out there sends a close_notify before closing the TLS connection, so few tools will throw an error when you receive an incomplete file. It may be hard to exploit, but executing a script before you have completely downloaded it is simply a really bad idea.
- grhmc 12y agoYes you download the signatures, but you need to trust the key which created the signatures. Distributions come with that key pre-trusted.