Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

curl | sh

curlpipesh.tumblr.com

Post reply on HN
Print view View original

31–40 of 115 posts

Re: curl | sh

#31

Post by mikeash »

michaelmior wrote: post #26
RKearney wrote: post #12

Earlier quoted context omitted.

I think one of the larger issues with curl | sh is what could happen in the event of a network outage or early termination on the connection. For example, if you're downloading a script that has a line like this rm -rf ~/.tmp/foo/bar But the HTTP connection was lost before the entire file was downloaded and `rm -rf ~` was the end of one packet and `/.tmp/foo/bar` was the contents of the other (lost) packet, you're sc…

In at least some of those cases, I would expect curl to exit with an error and the pipeline to abort.

All bash sees are bytes coming in on stdin, and eventually an EOF. It neither knows nor cares what caused the EOF.

Re: curl | sh

#33

Post by paulmd »

rakoo wrote: post #6
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

It's interesting to note that we essentially do the same with javascript in the browser, except the user doesn't even know there's some code that is automatically run. The big difference, of course, being that javascript code runs in a sandboxed environment. Maybe we should create some kind of sandboxed sh ? (I actually hardly believe it will ever take on, seeing that so many sites tell you to run not `sh` but `sudo…

Well, the Unix approach to this is a sandbox application and a shell application, not a sandboxed shell application. Docker attempts many of those tasks.

On windows there's Sandboxie, which does more or less what you want as well. It creates a sandbox whose filesystem and internals can be modified by sandboxed applications without affecting the state of the REAL filesystem. Very nice utility for mitigating bad programming - I often use it to run multiple copies of applications that crash or refuse to launch multiple instances.

Re: curl | sh

#34

Post by facepalm »

sarciszewski wrote: post #27
tomp wrote: post #25

Most of these are downloading stuff over https, and sometimes from GitHub, so it really offers superior security to most AppStores and (signed) installers (as you can even look at the source, if you want to).

"superior security"? If I can hack the endpoint (or the server that handles the 301 redirect to github), game over.

That goes for every software you install. The only solution is to not install any software. And then hope that the preinstalled software on your device is OK:

Re: curl | sh

#36

Post by jordanpg »

I sense that the reason these kinds of things are growing in popularity is that there is a command-line renaissance occurring among certains kinds of developers. I'm guessing that about half of these pages are used principally by Ruby/Rails crowds, for example.

This is a natural outgrowth of Rails itself which expects even the novice dev to do everything from the CLI. I also notice a certain amount of machismo surrounding this sort of thing, which means that the novices are that much more likely to blindly install things, in spite of the more senior devs blandly insisting that they should "read and understand the script before running it." This is ironic because of course they are novices and learning how to do a security audit on a random bash script is a non-trivial affair, to put it most charitably. It's also ironic because Rails is supposed to be all about easy and convention, not auditing everything for oneself.

The designers of OSs did not have in mind non-experts using the CLI with su turned on (or even off) all the time. In fact, user-friendly OSs are designed to prevent non-experts from doing any damage, anywhere. In all, it seems like this sort of thing is circumventing basic protections provided by experts for non-experts, and that is probably not something to encourage.

Re: curl | sh

#37

Post by phaer »

peterwwillis wrote: post #17
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

If you're really paranoid, download the MD5 and PGP keys of the application release's source code tarball from the author's website using SSL. Then unpack the source (being careful to use a sandbox, because an exploit in gzip/tar/etc might be bad) and examine the source code for any unexplained or dangerous behavior. Then compile and install it using a non-root user. Personally, i'm totally comfortable with the idea…

Who do you enter your passphrases, pins, etc if you box is controlled by someone else? How do you know there's no keylogger running? How do you use PGP if you don't care about the security of your private key?

Re: curl | sh

#38

Post by mping »

I normally do a curl | less before doing a curl | sh and take a quick peek. Not perfect, but at least it's a step in the right way. Like someone says, it's a matter of trust (but verify).

Re: curl | sh

#39

Post by sarciszewski »

mping wrote: post #38

I normally do a curl | less before doing a curl | sh and take a quick peek. Not perfect, but at least it's a step in the right way. Like someone says, it's a matter of trust (but verify).

Race condition. :)

Save it to disk, examine, then run.

Re: curl | sh

#40

Post by maccard »

cowabunga wrote: post #10
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

No it's not because MSI packages and EXEs are signed so there is at least a chain of trust. SmartScreen kicks you in the face if it's not "known" by various metrics and it's hard to get around that these days (as someone who just had to get EV certs for their MSI). If you click through that, and you don't know what the source was then you're a muppet. curl + bash is suck and blam the machine. Hope you didn't do a sud…

> No it's not because MSI packages and EXEs are signed

Sure, some are. But most software packages that a user is going to download aren't signed.

Post reply on HN