5 ms·

This might be related to another article about OLE execution, to cast a shadow of doubt that it is not an isolated habit. Having outside stuff executed when not

This might be related to another article about OLE execution, to cast a shadow of doubt that it is not an isolated habit. Having outside stuff executed when not meaning to is always bad. I for one would be badly disappointed, if tar xvf unexpectedly run some code. Luckily, that is not the case. UNIX got battle-hardened during its college years, the cases of unexpected execution are few and far between. One of them is post-install, never run dpkg -i unless you trust the packager.

cbd1984 11y ago
> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. Yes, people actually made these. Yes, people actually ran these. Yes, they still exist on some old archive FTP servers and so on. It's amazing how clever you can be when you don't think you'll ever have to care about security or The Sufficiently Stupid User (because sufficiently advanced stupidity is indistinguishable from malice).
- huherto 11y ago
  I loved shars. It was a carefree time. Nothing to worry about.
  - schoen 11y ago
    Also there used to be services based on telnet somehost someport | sh (I remember an IRC client installer script hosted on sci.dixie.edu like that.) Unfortunately we still have curl http://somehost/somepath http://somehost/somepath | bash which is not very safe even if somehost is not malicious. But it was kind of awesome when the Internet was friendly!
- Blackthorn 11y ago
  I don't really understand how a shar is more dangerous than the still-incredibly-common "./configure; make".
  - nhaehnle 11y ago
    You really don't need the "./configure" there. make alone can obviously run arbitrary commands - but then again, so can the program whose source code you probably downloaded in order to run it. In general, all the hype about not executing stuff from the web has a point but is largely confused about where the risks are and aren't (e.g. the "don't pipe wget into the shell" meme).
  - juhanima 11y ago
    And even without any other source of trust, anyone who is willing to go through the automake/config hell, already scored some initial trust points. I rest my case.
- juhanima 11y ago
  Yes, that is one of the things that turned out to be a bad idea. That's why it was dropped. Look, it's all about trust management. If you trust everyone's good will, like in an academic community, it's fine. If not, you need to manage trust. There are three models for it AFAIK: initial trust, as in SSH; trust to the authorities, as in X.509; and the web of trust, as in PGP/GPG. They all have their use cases. I like the opportunity to choose.
- __david__ 11y ago
  It's been a while but I thought the real reason shars existed was because they were 7 bit clean, meaning they could be traded on usenet (or ftp in ascii mode) without needing any external program like uudecode… > …only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. > Yes, people actually made these. Yes, people actually ran these. Running something you downloaded is how every installer works. Self extracting zips are still a thing, too. At least with shars you could read the source. Oh yeah, even today people still do `curl http://example.com http://example.com | bash` (If someone were truly evil they'd make the first download from an IP clean and inject bad code into the second. That would catch all the people who `curl | less` first and then run it again piped to bash). :-)
  - bediger4000 11y ago
    All you needed to undo a shar (shell archive) was a fairly common Bourne shell. We had uuencode to make things 7-bit clean. Some programs to make shar files uuencoded the archived files, but some didn't. "shar" files existed because "tar" wasn't particularly standardized. As late as 1990, SGI Irix "tar" did bytes in reverse order from SunOS "tar". You had to convert bytes to untar a SunOS archive on Irix.
  - JadeNB 11y ago
    > That would catch all the people who `curl | less` first and then run it again piped to bash Are many people security-conscious enough to do the former but security-unconscious enough to do the latter? I would assume that one would do `curl http://example.com http://example.com > evilscript; vim evilscript` and then `bash evilscript` if necessary.

cbd1984 11y ago

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. Yes, people actually made these. Yes, people actually ran these. Yes, they still exist on some old archive FTP servers and so on. It's amazing how clever you can be when you don't think you'll ever have to care about security or The Sufficiently Stupid User (because sufficiently advanced stupidity is indistinguishable from malice).

huherto 11y ago
I loved shars. It was a carefree time. Nothing to worry about.
- schoen 11y ago
  Also there used to be services based on telnet somehost someport | sh (I remember an IRC client installer script hosted on sci.dixie.edu like that.) Unfortunately we still have curl http://somehost/somepath http://somehost/somepath | bash which is not very safe even if somehost is not malicious. But it was kind of awesome when the Internet was friendly!
Blackthorn 11y ago
I don't really understand how a shar is more dangerous than the still-incredibly-common "./configure; make".
- nhaehnle 11y ago
  You really don't need the "./configure" there. make alone can obviously run arbitrary commands - but then again, so can the program whose source code you probably downloaded in order to run it. In general, all the hype about not executing stuff from the web has a point but is largely confused about where the risks are and aren't (e.g. the "don't pipe wget into the shell" meme).
- juhanima 11y ago
  And even without any other source of trust, anyone who is willing to go through the automake/config hell, already scored some initial trust points. I rest my case.
juhanima 11y ago
Yes, that is one of the things that turned out to be a bad idea. That's why it was dropped. Look, it's all about trust management. If you trust everyone's good will, like in an academic community, it's fine. If not, you need to manage trust. There are three models for it AFAIK: initial trust, as in SSH; trust to the authorities, as in X.509; and the web of trust, as in PGP/GPG. They all have their use cases. I like the opportunity to choose.
__david__ 11y ago
It's been a while but I thought the real reason shars existed was because they were 7 bit clean, meaning they could be traded on usenet (or ftp in ascii mode) without needing any external program like uudecode… > …only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. > Yes, people actually made these. Yes, people actually ran these. Running something you downloaded is how every installer works. Self extracting zips are still a thing, too. At least with shars you could read the source. Oh yeah, even today people still do `curl http://example.com http://example.com | bash` (If someone were truly evil they'd make the first download from an IP clean and inject bad code into the second. That would catch all the people who `curl | less` first and then run it again piped to bash). :-)
- bediger4000 11y ago
  All you needed to undo a shar (shell archive) was a fairly common Bourne shell. We had uuencode to make things 7-bit clean. Some programs to make shar files uuencoded the archived files, but some didn't. "shar" files existed because "tar" wasn't particularly standardized. As late as 1990, SGI Irix "tar" did bytes in reverse order from SunOS "tar". You had to convert bytes to untar a SunOS archive on Irix.
- JadeNB 11y ago
  > That would catch all the people who `curl | less` first and then run it again piped to bash Are many people security-conscious enough to do the former but security-unconscious enough to do the latter? I would assume that one would do `curl http://example.com http://example.com > evilscript; vim evilscript` and then `bash evilscript` if necessary.