Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl to shell isn't so bad

arp242.net

Post reply on HN
Print view View original

101–110 of 201 posts

Re: Curl to shell isn't so bad

#101

Post by louiz »

minxomat wrote: post #88
coldtea wrote: post #85

Earlier quoted context omitted.

> Not so bad comparing to what? Compared to donwloading a binary and 10 other similar methods people use. > Yeah, comparing to downloading a tar file from the website and running ./configure, make etc - right, it's probably quite a similar risk. But who does that? Millions of people? And even more just download binaries off of websites...

Isn't there even a comment from Linus (could have been someone else) saying that he does exactly that and if that doesn't work gives up on the software?

But Linus is bad at everything except writing C code.

Re: Curl to shell isn't so bad

#102

Post by ben509 »

yoavm wrote: post #35

Not so bad comparing to what? Yeah, comparing to downloading a tar file from the website and running ./configure, make etc - right, it's probably quite a similar risk. But who does that? Every decent Linux distro has a package manager that covers 99% of the software you want to install, and comparing to an apt-get install, pacman -S, yum install and so on - running is a script off some website is way more risky. My p…

There's still an issue with the package managers requiring arbitrary shell commands to be run, often with sudo. From docker[1] there are steps like these:

    Install packages to allow apt to use a repository over HTTPS...
    Add Docker’s official GPG key...
    Use the following command to set up the stable repository...
Once you've done that, then it's just apt-get install.

> And we didn't even start to talk about updates - as if that isn't a security concern.

I think that's the worst part of it. Some software will nag you about updates, yarn and pipenv for example, but it's far more reliable to have one system that keeps everything up to date.

[1]: https://docs.docker.com/install/linux/docker-ce/ubuntu/

Re: Curl to shell isn't so bad

#103

Post by Fnoord »

HankB99 wrote: post #93
ivanstame wrote: post #80

Earlier quoted context omitted.

Well if this was true "Every decent Linux distro has a package manager that covers 99% of the software you want to install" we wouldn't have to install it thru sh.

For one of the examples provided, rustup.sh, there were not complete packages the last time I looked for them. There were some packages on Debian and Fedora but I ran into problems configuring the Rust plugin for VS-Code because it assumed that the rustup executable was present and it was not (at that time.) Going down this path, one then becomes dependent on using rustup to update the Rust installation. Now I need t…

Topgrade (written in Rust) [1] allows you to queue different package managers, including those you mentioned.

[1] https://github.com/r-darwish/topgrade

Re: Curl to shell isn't so bad

#104

Post by tuldia »

mirimir wrote: post #81
hannob wrote: post #36

Earlier quoted context omitted.

> Every decent Linux distro has a package manager that covers 99% of the software you want to install I wish this were true, but plenty of experience with Linux usage tells me that not having something packaged is a very common occurence. Though of course this can be improved: More people should actually help working on their favorite Linux distro, so more software gets packaged. And upstreams should try better to co…

Right. I love Debian, but its packages are often very stale. That's why many end up using Ubuntu. And yes, I get that package review takes time, and that Debian is arguably more secure. But that's little consolation when you're dead in the water because what's packaged is too old.

Ubuntu is nothing more than the Debian "unstable" branch with Canonical branding plus non-free packages.

Compare https://distrowatch.com/table.php?distribution=debian and https://distrowatch.com/table.php?distribution=ubuntu and you will realize that all the freshness of Ubuntu is build on top of what is available in Debian unstable.

I don't think this idea of "Debian packages are often very outdated" still applies nowadays. One can add "testing" or "backports" channels in your /etc/apt/sources.lists.d and get "upstream version" software. Even "stable" ships fresh enough software these days.

In the last case you can always get the source, update it and send a nmu back to Debian. Lets not forget that that is how open source works :)

Re: Curl to shell isn't so bad

#105

Post by pm7 »

ben509 wrote: post #102
yoavm wrote: post #35

Not so bad comparing to what? Yeah, comparing to downloading a tar file from the website and running ./configure, make etc - right, it's probably quite a similar risk. But who does that? Every decent Linux distro has a package manager that covers 99% of the software you want to install, and comparing to an apt-get install, pacman -S, yum install and so on - running is a script off some website is way more risky. My p…

There's still an issue with the package managers requiring arbitrary shell commands to be run, often with sudo. From docker[1] there are steps like these: Install packages to allow apt to use a repository over HTTPS... Add Docker’s official GPG key... Use the following command to set up the stable repository... Once you've done that, then it's just apt-get install. > And we didn't even start to talk about updates - a…

Or just apt install docker.io

https://packages.debian.org/search?keywords=docker.io

Re: Curl to shell isn't so bad

#106

Post by pm7 »

samueloph wrote: post #96
mirimir wrote: post #81

Earlier quoted context omitted.

Right. I love Debian, but its packages are often very stale. That's why many end up using Ubuntu. And yes, I get that package review takes time, and that Debian is arguably more secure. But that's little consolation when you're dead in the water because what's packaged is too old.

Well, in this case people should have been using Debian Testing instead of Stable. But yeah it's often that people don't understand what's Debian stable and its trade offs compared to Testing and end up unhappy with it or switching to Ubuntu (which is ~very~ similar to Debian Testing).

Unfortunately, Debian testing doesn't get security updates.

Re: Curl to shell isn't so bad

#107

Post by rollerrrr »

samueloph wrote: post #96
mirimir wrote: post #81

Earlier quoted context omitted.

Right. I love Debian, but its packages are often very stale. That's why many end up using Ubuntu. And yes, I get that package review takes time, and that Debian is arguably more secure. But that's little consolation when you're dead in the water because what's packaged is too old.

Well, in this case people should have been using Debian Testing instead of Stable. But yeah it's often that people don't understand what's Debian stable and its trade offs compared to Testing and end up unhappy with it or switching to Ubuntu (which is ~very~ similar to Debian Testing).

Agreed, but that's actually an (UX) problem that Debian should fix. "Testing" is an awful name for "stable enough for normal use". When I first installed Debian I made the same error of installing stable on desktop and then fighting with it to install packages from testing... Just renaming testing to "regular" would prevent lots of wasted time all around.

Re: Curl to shell isn't so bad

#108

Post by shakna »

sjy wrote: post #30

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuable at this point.

Not intentionally malware.

But the OPAM install [0] deleted my $PATH, and it took me a while how to fix that one. They've since fixed what allowed the problem to happen [1], well it was a combination of that (normal shell problems) and a power-outage that killed the installer just before completion (in which case the script may just think it's complete).

But I'm sure similar catastrophic side-effects can occur in other install scripts out there.

[0] https://opam.ocaml.org/doc/Install.html

[1] https://github.com/ocaml/opam/issues/2165

Re: Curl to shell isn't so bad

#109

Post by rollerrrr »

pm7 wrote: post #106
samueloph wrote: post #96

Earlier quoted context omitted.

Well, in this case people should have been using Debian Testing instead of Stable. But yeah it's often that people don't understand what's Debian stable and its trade offs compared to Testing and end up unhappy with it or switching to Ubuntu (which is ~very~ similar to Debian Testing).

Unfortunately, Debian testing doesn't get security updates.

To the best of my knowledge, this is not true. Have a link?

Re: Curl to shell isn't so bad

#110

Post by hollerith »

pm7 wrote: post #106
samueloph wrote: post #96

Earlier quoted context omitted.

Well, in this case people should have been using Debian Testing instead of Stable. But yeah it's often that people don't understand what's Debian stable and its trade offs compared to Testing and end up unhappy with it or switching to Ubuntu (which is ~very~ similar to Debian Testing).

Unfortunately, Debian testing doesn't get security updates.

Good to know. From https://wiki.debian.org/Status/Testing, here is some more detail:

>there is security support for testing, but in general it cannot be expected to be of the same quality as for stable:

>Updates for testing-security usually get less testing than updates for stable-security.

>Updates for embargoed issues take longer because the testing security team does not have access to embargoed information.

>Testing is changing all the time which increases the likelyhood of problems with the build infrastructure. Such problems can delay security updates in testing.

Post reply on HN