Curl to shell isn't so bad
arp242.net
Curl to shell isn't so bad
1–10 of 201 posts
Re: Curl to shell isn't so bad
#2Agreed. If I don’t trust the server, or don’t have a secure connection to it, it is not likely wise to run any non trivial code downloaded from it.
Verifying a hash that comes from the same server also doesn’t make that much sense. Verifying a PGP signature would be a compelling reason to not pipe to shell, and that’s really about it.
Re: Curl to shell isn't so bad
#3> Not knowing what the script is going to do.
Yep, this is why i hate piping curl to sh. Much prefer how e.g. go does this:
Tells you to just run
tar -C /usr/local -xzf go1.13.4.linux-amd64.tar.gz
Re: Curl to shell isn't so bad
#4A small benefit of downloading the installer is that this lets you run a checksum on it.
Re: Curl to shell isn't so bad
#5The points raised in the article are correct, and I'm much more concerned with the willingness of people to run arbitrary software on their primary computers in general, than the specific case of piping to sh. I think piping to sh just emphasises how insecure the entire practice is, and arguing against that is analogous to close your eyes to protect yourself from the attacking tiger.
The only system I've worked with that helps you truly deal with this is Qubes OS. Perhaps Fedora Silverblue will achieve this as well, once it comes out of beta.
Re: Curl to shell isn't so bad
#6> Not knowing what the script is going to do. Yep, this is why i hate piping curl to sh. Much prefer how e.g. go does this: Tells you to just run tar -C /usr/local -xzf go1.13.4.linux-amd64.tar.gz It's not that I don't trust the installer script to not install malware. But I don't trust the installer script to not crap all over my system.
Try using Qubes OS. It will allow you to run such scripts without having to worry about your system being screwed up.
Note that Qubes have some drawbacks, the main one being that it doesn't support GPU's, so not everybody are in the position to use it.
Re: Curl to shell isn't so bad
#7I disagree with some of this, I.e paste jacking.
Plenty of software projects put more care and focus into their software and not in their website, if you're running a vulnerable version of Wordpress or whatever CMS it'd be easy for someone to insert something malicious without being noticed whereas something that modified your code would show up in git, code reviews etc
Re: Curl to shell isn't so bad
#8> Not knowing what the script is going to do. Yep, this is why i hate piping curl to sh. Much prefer how e.g. go does this: Tells you to just run tar -C /usr/local -xzf go1.13.4.linux-amd64.tar.gz It's not that I don't trust the installer script to not install malware. But I don't trust the installer script to not crap all over my system.
Try using Qubes OS. It will allow you to run such scripts without having to worry about your system being screwed up. Note that Qubes have some drawbacks, the main one being that it doesn't support GPU's, so not everybody are in the position to use it.
I really like Qubes and have been running it for a while. What I'd love is to have something like qubes but a bit more lightweight. Using containers instead of full blown VMs. Basically trading some isolation guarantees and security for more usability.
Re: Curl to shell isn't so bad
#9A small benefit of downloading the installer is that this lets you run a checksum on it.
Yes, if you can acquire or verify the checksum via some other means, e.g. PGP or phone.
To confirm unchangedness-in-transit I rely on TLS.
Re: Curl to shell isn't so bad
#10Earlier quoted context omitted.
Try using Qubes OS. It will allow you to run such scripts without having to worry about your system being screwed up. Note that Qubes have some drawbacks, the main one being that it doesn't support GPU's, so not everybody are in the position to use it.
I really like Qubes and have been running it for a while. What I'd love is to have something like qubes but a bit more lightweight. Using containers instead of full blown VMs. Basically trading some isolation guarantees and security for more usability.
I think Silverblue might be what you want. It's still in beta though, but if you're OK with that you might want to try it.