Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run unknown shell script with a line-by-line confirmation prompt

gist.github.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#31

Post by Waterluvian »

dumpsterdiver wrote: post #21

If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading them first, ever. That is so irresponsible. Validating shell scripts will make you a more competent and informed worker. Tools like this breed incompetence, and encourage carelessness.

I just don't see how this perspective lives in the real world.

It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in then you're not worthy enough."

How would you ever begin a career, let alone become a desirable team member?

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#32

Post by dumpsterdiver »

Waterluvian wrote: post #31
dumpsterdiver wrote: post #21

If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading them first, ever. That is so irresponsible. Validating shell scripts will make you a more competent and informed worker. Tools like this breed incompetence, and encourage carelessness.

I just don't see how this perspective lives in the real world. It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in then you're not worthy enough." How would you ever begin a career, let alone become a desirable team member?

I would probably start by reading a book.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#33

Post by Skunkleton »

Waterluvian wrote: post #31
dumpsterdiver wrote: post #21

If you are considering using this tool, then I would suggest that you seriously reevaluate your life choices. You should never run shell scripts without reading them first, ever. That is so irresponsible. Validating shell scripts will make you a more competent and informed worker. Tools like this breed incompetence, and encourage carelessness.

I just don't see how this perspective lives in the real world. It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in then you're not worthy enough." How would you ever begin a career, let alone become a desirable team member?

Yeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#34

Post by junon »

klyrs wrote: post #19
jjnoakes wrote: post #18

Earlier quoted context omitted.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

I distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?

Because that's an unrealistic threat model for most users.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#35

Post by dumpsterdiver »

Skunkleton wrote: post #33
Waterluvian wrote: post #31

Earlier quoted context omitted.

I just don't see how this perspective lives in the real world. It's basically, "get off the shoulders of giants. If you aren't expert enough to detect exploits in then you're not worthy enough." How would you ever begin a career, let alone become a desirable team member?

Yeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?

I am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#36

Post by Skunkleton »

protomyth wrote: post #12

It would be interesting to have a shell that allowed transactions like a database and could list what files have been affected while in the transaction.

You could snapshot your filesystem, then run the script and diff against the snapshot. Isolating executables (even shell scripts) is really outside the scope of what a shell normally provides.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#37

Post by Skunkleton »

dumpsterdiver wrote: post #35
Skunkleton wrote: post #33

Earlier quoted context omitted.

Yeah, this is an absurd argument. How do I know I can trust Linux unless I personally audit the whole kernel? How do I know if I can trust my processor without an x-ray machine?

I am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#38

Post by aufhebung »

cratermoon wrote: post #28
jdeaton wrote: post #6

Can I use it to run itself?

Would you trust it on itself? https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Reflections on trusting trust wouldn't really apply here. The script is not a compiler, is not even compiled, and can be easily understood by reading it. Unless you think there is some vulnerability specific to /bin/sh and this script the citation is just wrong.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#39

Post by [deleted] »

Skunkleton wrote: post #37
dumpsterdiver wrote: post #35

Earlier quoted context omitted.

I am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

[deleted]

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#40

Post by dumpsterdiver »

Skunkleton wrote: post #37
dumpsterdiver wrote: post #35

Earlier quoted context omitted.

I am a hacker by trade. My job is to literally exploit your weakness. If you can't be bothered to read a "shell script (!)" that you are running... good luck.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

If that were true, then why did this post reach the front page of Hacker News? As Larry Wall stated, the three virtues of a programmer are: Laziness, impatience, and hubris. Tools like this embody all three.
Post reply on HN