Curl to shell isn't so bad • Hacker News Board

Re: Curl to shell isn't so bad

#11

Post by Carpetsmoker » Sat, Nov 09, 2019, 9:21 AM UTC

LIV2 wrote: post #7

I disagree with some of this, I.e paste jacking. Plenty of software projects put more care and focus into their software and not in their website, if you're running a vulnerable version of Wordpress or whatever CMS it'd be easy for someone to insert something malicious without being noticed whereas something that modified your code would show up in git, code reviews etc

Pastejacking should be mitigated if you use zsh, as it will never run pasted commands automatically. From quick test it seems that recent(?) versions of bash also implemented this feature and have it enabled by default. I don't know about fish or other shells.

Re: Curl to shell isn't so bad

#12

Post by tannhaeuser » Sat, Nov 09, 2019, 9:25 AM UTC

Yeah I was asking this question on SO - How to responsibly publish a script - but got no response, a sarcastic "Tumbleweed" badge even. My concern was that the script could be easily hosted elsewhere and we'd have multiple versions with potential malicious mods flying around. In the absence of alternatives curl-bashing isn't so bad after all because it promotes a canonical download location from a domain/site you control, even if I hated it initially as a long-term Unix user.

Re: Curl to shell isn't so bad

#13

Post by Un1corn » Sat, Nov 09, 2019, 9:26 AM UTC

Carpetsmoker wrote: post #11

LIV2 wrote: post #7

I disagree with some of this, I.e paste jacking. Plenty of software projects put more care and focus into their software and not in their website, if you're running a vulnerable version of Wordpress or whatever CMS it'd be easy for someone to insert something malicious without being noticed whereas something that modified your code would show up in git, code reviews etc

Pastejacking should be mitigated if you use zsh, as it will never run pasted commands automatically. From quick test it seems that recent(?) versions of bash also implemented this feature and have it enabled by default. I don't know about fish or other shells.

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget.

Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example

Re: Curl to shell isn't so bad

#14

Post by Carpetsmoker » Sat, Nov 09, 2019, 9:28 AM UTC

lokedhs wrote: post #5

The points raised in the article are correct, and I'm much more concerned with the willingness of people to run arbitrary software on their primary computers in general, than the specific case of piping to sh. I think piping to sh just emphasises how insecure the entire practice is, and arguing against that is analogous to close your eyes to protect yourself from the attacking tiger. The only system I've worked with…

This article started life as a more general article about security and trust, but decided to post this particular part in its own article.

There is a lot to be said about trust in software, but in general I agree that mitigations against untrusted software could be improved. The problem with this is that it's often hard to do this without affecting usability and, more importantly, in practical terms for a lot of people the status quo seems to be "secure enough", even though there are areas for improvement we (as an industry) should work on.

Re: Curl to shell isn't so bad

#15

Post by paxy » Sat, Nov 09, 2019, 9:30 AM UTC

The average non-technical user is never going to open up the terminal and run commands. The well educated technical user is going to be vary of untrusted sites and various forms of attacks (which I'm assuming the author of this post falls under).

IMO this is good advice for those that fall in the middle of these two categories, i.e. slightly technical people who run into problems and copy-paste solutions from Stack Overflow hoping that something will work.

> you’re not running some random shell script from a random author

This is exactly what is happening in the vast majority of these cases. These users are going to be vary if linked to an executable or installer, but "hey just run this simple line of code" sounds like a very appealing solution.

Re: Curl to shell isn't so bad

#16

Post by mkup » Sat, Nov 09, 2019, 9:31 AM UTC

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

Re: Curl to shell isn't so bad

#17

Post by tonyedgecombe » Sat, Nov 09, 2019, 9:33 AM UTC

mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

Is that really much of a problem? I can't remember the last time I had a download fail part the way through and they are usually much bigger than a bootstrapping script.

Re: Curl to shell isn't so bad

#18

Post by scbrg » Sat, Nov 09, 2019, 9:34 AM UTC

mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

No. It's addressed in the second last bullet, Partial content

Re: Curl to shell isn't so bad

#19

Post by [deleted] » Sat, Nov 09, 2019, 9:34 AM UTC

mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

[deleted]

Re: Curl to shell isn't so bad

#20

Post by Carpetsmoker » Sat, Nov 09, 2019, 9:34 AM UTC

Un1corn wrote: post #13

Carpetsmoker wrote: post #11

Earlier quoted context omitted.

Pastejacking should be mitigated if you use zsh, as it will never run pasted commands automatically. From quick test it seems that recent(?) versions of bash also implemented this feature and have it enabled by default. I don't know about fish or other shells.

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget. Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example

If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.