Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

curl | sh

curlpipesh.tumblr.com

Post reply on HN
Print view View original

91–100 of 115 posts

Re: curl | sh

#91

Post by dllthomas »

razzaj wrote: post #7

I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script. People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.

The truncation issue is an interesting additional wrinkle, if unlikely.

I agree that, aside from that issue, the practice of many people is not materially worse than "curl | sh", but we should condemn that similarly.

Re: curl | sh

#92

Post by sarciszewski »

facepalm wrote: post #84
sarciszewski wrote: post #76

Earlier quoted context omitted.

Nope. Don't try to put words in my mouth, please. apt-get install php-composer is much better than curl https://getcomposer.org/installer | php

How do you get your app into the repository? Maybe for Linux you don't need to pay, but you still need to gain approval of the maintainers. Might be even more costly than simply paying up (as for Apple or Microsoft).

Or you can set up a PPA. :/

Re: curl | sh

#93

Post by mikeash »

michaelmior wrote: post #87
mikeash wrote: post #85

Earlier quoted context omitted.

That's the default buffer size for pipes, which won't matter here. When curl terminates, whatever's buffered in the pipe will be flushed. The only thing that could prevent downloaded data from being received by the shell would be internal buffering in curl, if it does any.

Good point. curl doesn't do any internal buffering. I was thinking that the pipeline should be aborted if the curl exits with a non-zero status, but of course this is not the case.

Yeah, it would be nice if there were a way for a part of the pipeline to signal that something bad happened and everything should stop. Ideally, some sort of transaction system so the script is guaranteed to run fully or not at all. But instead we have this crazy thing.

Re: curl | sh

#94

Post by tzs »

RKearney wrote: post #12
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

I think one of the larger issues with curl | sh is what could happen in the event of a network outage or early termination on the connection. For example, if you're downloading a script that has a line like this rm -rf ~/.tmp/foo/bar But the HTTP connection was lost before the entire file was downloaded and `rm -rf ~` was the end of one packet and `/.tmp/foo/bar` was the contents of the other (lost) packet, you're sc…

I had something like that happen once, but it worked out in my favor. I had misconfigured BIND, which I had intended to run just as a caching name server for my network, and it was listening for outside connections too. Some variant of the Lion worm found it and used a BIND bug to get onto my system.

It sent my password file to someone in China, started a scanner to look for other systems to infect, downloaded a .tar.gz file that contained a root kit to hide itself, unpacked the .tar.gz, and ran the install script contained therein to install the root kit.

Or rather, it tried to. I had ISDN at the time, and had noticed the modem lights heavily blinking even though I was not doing any internet activity. This confused me, and I pulled the plug on the modem. Turns out I pulled the plug while it was downloading the .tar.gz. It got most of the file, but not quite all of it. It lost the last file inside the archive--which happened to be the install script!

Without the install script, it could not install the root kit, and that made getting rid of the worm a heck of a lot easier.

Re: curl | sh

#95

Post by facepalm »

sarciszewski wrote: post #92
facepalm wrote: post #84

Earlier quoted context omitted.

How do you get your app into the repository? Maybe for Linux you don't need to pay, but you still need to gain approval of the maintainers. Might be even more costly than simply paying up (as for Apple or Microsoft).

Or you can set up a PPA. :/

But then you are back to square one - how do you establish the trustworthiness of the PPA?

Re: curl | sh

#96

Post by d0mine »

cowabunga wrote: post #10
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

No it's not because MSI packages and EXEs are signed so there is at least a chain of trust. SmartScreen kicks you in the face if it's not "known" by various metrics and it's hard to get around that these days (as someone who just had to get EV certs for their MSI). If you click through that, and you don't know what the source was then you're a muppet. curl + bash is suck and blam the machine. Hope you didn't do a sud…

> No it's not because MSI packages and EXEs are signed

Is it more difficult to provide your own fake exe installer than to middle-man https that curl examples use?

Re: curl | sh

#98

Post by d0mine »

earthrise wrote: post #14
TeeWEE wrote: post #5

Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative? I think the best alternatives are appstores such as found on ios and android, right? However that doesnt really fit for open source. Is the way to install open source software, to download the source and compil…

I've written down some general principles we should follow, but any reasonable implementation of them seems pretty far off: https://defuse.ca/triangle-of-secure-code-delivery.htm tl;dr: (1) Reproducible builds, (2) Make sure everyone is getting the same thing (to detect targeted attacks) and (3) Cryptographic signing. Package managers and appstores are the best we have right now, but they're missing (1) and (2). In t…

`curl | sh` is protected by a ssl certificate issued by CA that my system trusts.

"pgp-signed installer file" is protected by a key from a stranger.

Both are insecure.

Could you enumerate several points that show "pgp-signed installer file is __a lot better__ than curl | sh" ?

Re: curl | sh

#99

Post by dTal »

LeonidasXIV wrote: post #28
michaelmior wrote: post #26

Earlier quoted context omitted.

In at least some of those cases, I would expect curl to exit with an error and the pipeline to abort.

Some scripts also detect this and are written so that there is no code executed before the file is not complete. Of course, that's a minority.

To elaborate, this is quite easy: you wrap the entire contents of the script into a function definition, then call the function as the last line.

Re: curl | sh

#100

Post by kolev »

bqe wrote: post #35

My thing with piping curl to a shell was always that a severed connection will run a partial script, which can have weird consequences. I wrote about it awhile back: http://blog.seancassidy.me/dont-pipe-to-your-shell.html

I use something different:

    bash -c "$(curl -sfL git.io/wshare || echo "echo 'Installation failed'; exit 1")"
My script itself is the core file and the installer (I used the $BASH_EXECUTION_STRING to grab the source code), i.e. it doesn't download anything additionally. I'm also planning to add a build script that checks the hash of $BASH_EXECUTION_STRING to prevent tampering.
Post reply on HN