curl | sh • Hacker News Board

curl | sh

#1

Post by lelf » Mon, Nov 03, 2014, 12:48 PM UTC

curl | sh
curlpipesh.tumblr.com

Re: curl | sh

#2

Post by sveredov » Mon, Nov 03, 2014, 1:12 PM UTC

Here is another curlpipesh: https://fixubuntu.com/

Re: curl | sh

#3

Post by dozzie » Mon, Nov 03, 2014, 1:25 PM UTC

Yeah. Of course nobody bothers with providing an installation guide that could be used to build RPM/DEB packages. Because everybody runs `curl | sh` on production machines to install random software.

Re: curl | sh

#4

Post by TimWolla » Mon, Nov 03, 2014, 1:55 PM UTC

At least most of the examples are using https.

Re: curl | sh

#5

Post by TeeWEE » Mon, Nov 03, 2014, 1:59 PM UTC

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative?

I think the best alternatives are appstores such as found on ios and android, right?

However that doesnt really fit for open source. Is the way to install open source software, to download the source and compile it from scratch? Well, thats also risky, you should check the source code first...? But thats undoable.

All in all, it comes down to "trust". Do you trust the website? You dont care about security too much, well, imho then it makes sense to curl | sh.

Re: curl | sh

#6

Post by rakoo » Mon, Nov 03, 2014, 2:04 PM UTC

TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

It's interesting to note that we essentially do the same with javascript in the browser, except the user doesn't even know there's some code that is automatically run.

The big difference, of course, being that javascript code runs in a sandboxed environment. Maybe we should create some kind of sandboxed sh ? (I actually hardly believe it will ever take on, seeing that so many sites tell you to run not `sh` but `sudo sh`... yeah, sure, why have unprivileged users, we should do everything as root anyway)

Re: curl | sh

#7

Post by razzaj » Mon, Nov 03, 2014, 2:08 PM UTC

I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script.

People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.

Re: curl | sh

#8

Post by new299 » Mon, Nov 03, 2014, 2:29 PM UTC

It's obviously somewhat prone to failure, as the script can't possibly work in every environment. But other than that as long as it's over https is there a security issue?

Obviously, a better alternative is a package manager, pulling from a repository for which you have gpg keys installed (such as Debian provides). But that's not always an option.

Even checking out a git repository and building from source seems as bad a curl | sh to me.

Re: curl | sh

#9

Post by youngun » Mon, Nov 03, 2014, 2:42 PM UTC

TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

The proper alternative is some sort of lightweight virtualization like Docker, with a proper security policy in place. You can mostly do this today

    curl  | docker run --rm -t -i ubuntu sh

but the containerizing naturally locks down/virtualizes some stuff you might want the script to be doing, like installing stuff locally.

I think cleaning this up and making it friendly enough is a solvable UX problem, but I haven't quite solved it yet.

Re: curl | sh

#10

Post by cowabunga » Mon, Nov 03, 2014, 2:46 PM UTC

TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

No it's not because MSI packages and EXEs are signed so there is at least a chain of trust. SmartScreen kicks you in the face if it's not "known" by various metrics and it's hard to get around that these days (as someone who just had to get EV certs for their MSI). If you click through that, and you don't know what the source was then you're a muppet.

curl + bash is suck and blam the machine. Hope you didn't do a sudo in the last few seconds...

http://www.nastybastard.com/funky-super-installer.sh:

   #!/bin/bash
   echo "mwuhahahaha"
   sudo rm -rf /boot