Show HN: "curl … | sh" is bad.
1–10 of 19 posts
Re: Show HN: "curl … | sh" is bad.
#2Go ahead and view the source. Try to spot the hack.
It's harmless to run.
Re: Show HN: "curl … | sh" is bad.
#3Go ahead and view the source. Try to spot the hack. It's harmless to run.
The "hack" is when someone roots their server and makes it return "rm -rf ~". Even if it's the most secure server ever, it's still a bad technique, IMO.
Re: Show HN: "curl … | sh" is bad.
#4I see what you did there. (though, doesn't work with wget)
Re: Show HN: "curl … | sh" is bad.
#5Hmm, I usually like to prove my point without engaging in copyright infringement.
Re: Show HN: "curl … | sh" is bad.
#6Go ahead and view the source. Try to spot the hack. It's harmless to run.
The "hack" is when someone roots their server and makes it return "rm -rf ~". Even if it's the most secure server ever, it's still a bad technique, IMO.
Even `sudo rm -Rf /` with the password prompt in terminal would probably catch a few people unaware.
Re: Show HN: "curl … | sh" is bad.
#7How is this the slightest bit different than faking a site and altering the binary/source package on the other end of a regular old Download link?
(edit: Oh. You're doing user-agent sniffing for curl. Fair enough, but this still isn't any less secure than downloading and executing a binary.)
Re: Show HN: "curl … | sh" is bad.
#8Do you inspect the source code of every program you download? Do you decompile and reverse engineer the closed source ones? At some point you have to trust the developer isn't doing anything nasty, and be careful about where you get your software from.
Re: Show HN: "curl … | sh" is bad.
#9Do you inspect the source code of every program you download? Do you decompile and reverse engineer the closed source ones? At some point you have to trust the developer isn't doing anything nasty, and be careful about where you get your software from.
This argument is not about trusting or not trusting code. It's about piping web output blindly into a shell, which is an insecure technique, no matter how much you trust the author or web site.
Re: Show HN: "curl … | sh" is bad.
#10How is this the slightest bit different than faking a site and altering the binary/source package on the other end of a regular old Download link? (edit: Oh. You're doing user-agent sniffing for curl. Fair enough, but this still isn't any less secure than downloading and executing a binary.)
This is why most packages are distributed with checksums, so you can be sure that what you're running is what the author intended.