Here is another curlpipesh: https://fixubuntu.com/
Except, that one shows the full source so you can copy, paste, review, and save it instead.
You can do that for all of these, just request the file directly and copy it out of the browser.
curl | sh
41–50 of 115 posts
Re: curl | sh
#42I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script. People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.
Exactly. This is little more than cargo culting.
Re: curl | sh
#43Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…
Trust is really the only solution, we as developers might be able to inspect some code before we run it but if it is sufficiently complex we could spend months auditing it. Even worse for the non-technical users that can't tell a hello world from a keylogger, there really is no solution other than some trust based system.
Re: curl | sh
#44I normally do a curl | less before doing a curl | sh and take a quick peek. Not perfect, but at least it's a step in the right way. Like someone says, it's a matter of trust (but verify).
As already mentioned, save to disk first to avoid network connection failures messing you up. To avoid an extra command use "tee" to output to file while viewing it (i.e. it's "less" and ">" functionality combined).
Re: curl | sh
#45Earlier quoted context omitted.
"superior security"? If I can hack the endpoint (or the server that handles the 301 redirect to github), game over.
That goes for every software you install. The only solution is to not install any software. And then hope that the preinstalled software on your device is OK:
OR
I could verify an asymmetric cryptographic signature based on a public key I already possess. As long as the private key is not stolen, an attacker who can breach the server cannot backdoor the software I'm downloading.
Re: curl | sh
#46Earlier quoted context omitted.
I get a little bit of heartburn over running arbitrary scripts downloaded from internet websites. The easiest alternative is to run "curl ", download the script, take a peek at the source, and only THEN follow up with the sh. I mean, you're probably going to see a bunch of "download and install" commands, so you don't get much reassurance if you're worried that one of THOSE might be compromised too. But that's a prob…
My preferred hypothetical installer Trojan method is to make it append a value to ~/.ssh/authorized_keys and then ping a C&C server with the current username and IP ;)
You would still have to hope that sshd is enabled and accepting connections (which by default it shouldn't, at least on end-user distros).
Re: curl | sh
#47Earlier quoted context omitted.
The proper alternative is some sort of lightweight virtualization like Docker, with a proper security policy in place. You can mostly do this today curl | docker run --rm -t -i ubuntu sh but the containerizing naturally locks down/virtualizes some stuff you might want the script to be doing, like installing stuff locally. I think cleaning this up and making it friendly enough is a solvable UX problem, but I haven't q…
I can't tell if you're trolling, but "put some Windex on it" (or in this case, containerization) is hardly a solution, only a bad workaround. The root cause of curl | sh being a broken paradigm to begin with is left unaddressed.
I'm not sure that curl | sh is a "broken paradigm" -- no more broken than than running JavaScript in a browser. The only difference between the two is in the sandboxing.
The solution I'm proposing isn't to add Windex, but to cleanly wrap whatever curlpipesh is doing. Make it equivalent to opening a browser tab: interact with it safely, keep what you like, and throw everything away if you don't like the way things look.
Curlpipesh can be just like loading a site. We have the technology to do it; we just need to figure out the UX.
Re: curl | sh
#48My thing with piping curl to a shell was always that a severed connection will run a partial script, which can have weird consequences. I wrote about it awhile back: http://blog.seancassidy.me/dont-pipe-to-your-shell.html
Would something like
curl http://google.com/keylogger.sh > temp.sh && sh temp.sh
Re: curl | sh
#49Earlier quoted context omitted.
If you're really paranoid, download the MD5 and PGP keys of the application release's source code tarball from the author's website using SSL. Then unpack the source (being careful to use a sandbox, because an exploit in gzip/tar/etc might be bad) and examine the source code for any unexplained or dangerous behavior. Then compile and install it using a non-root user. Personally, i'm totally comfortable with the idea…
""" Personally, i'm totally comfortable with the idea of someone owning my box. The files I care about are backed up offline, I don't have many secrets, and the only accounts that would affect my life in general have passphrases, pins and multiple-factor auth tied to them. The worst thing someone could maybe do is impersonate me and cause havoc using my accounts, but I really don't see anyone having cause to do that.…
Uh, it's not an argument, it's my personal feelings and my personal opinions. It's OK if you don't feel the same way.
Re: curl | sh
#50My thing with piping curl to a shell was always that a severed connection will run a partial script, which can have weird consequences. I wrote about it awhile back: http://blog.seancassidy.me/dont-pipe-to-your-shell.html
Would something like curl http://google.com/keylogger.sh > temp.sh && sh temp.sh work?
More like:
curl http://google.com/keylogger.sh > temp.sh
less temp.sh # actually read the fucking thing
sh temp.sh
rm temp.sh