curl | sh

Post by [deleted] » Mon, Nov 03, 2014, 11:00 PM UTC

Slackwise wrote: post #15

brian_c wrote: post #11

`curl ... | sh` installations don't really bother me. The scripts tend to be short and commented, or at least readable. Sure beats running an opaque .pkg installer, which invariably asks for your password (presumably for no reason) and installs god-knows-what all over your hard drive.

Generally, yes, but some package managers have code-signing support, which means if you trust the authors, you can avoid potential hijacks. At the end of the day, though, you're always going to trust someone with something.

Post by sarciszewski » Tue, Nov 04, 2014, 12:18 AM UTC

facepalm wrote: post #95

sarciszewski wrote: post #92

Earlier quoted context omitted.

Or you can set up a PPA. :/

But then you are back to square one - how do you establish the trustworthiness of the PPA?

Post by pritambaral » Tue, Nov 04, 2014, 3:19 AM UTC

zimbatm wrote: post #13

new299 wrote: post #8

It's obviously somewhat prone to failure, as the script can't possibly work in every environment. But other than that as long as it's over https is there a security issue? Obviously, a better alternative is a package manager, pulling from a repository for which you have gpg keys installed (such as Debian provides). But that's not always an option. Even checking out a git repository and building from source seems as b…

Both curl|sh and git checkouts tend to end up in production deploys so it's interesting to compare them. Both introduce a point of failure if the remote host becomes unavailable and you need to deploy new machines. The curl|sh method is vulnerable to change from the maintainer or any attacker who gets access to the storage layer. git is also vulnerable but requires a collision attack on SHA-1.

Post by jboy55 » Tue, Nov 04, 2014, 4:34 AM UTC

d0mine wrote: post #96

cowabunga wrote: post #10

Earlier quoted context omitted.

No it's not because MSI packages and EXEs are signed so there is at least a chain of trust. SmartScreen kicks you in the face if it's not "known" by various metrics and it's hard to get around that these days (as someone who just had to get EV certs for their MSI). If you click through that, and you don't know what the source was then you're a muppet. curl + bash is suck and blam the machine. Hope you didn't do a sud…

> No it's not because MSI packages and EXEs are signed Is it more difficult to provide your own fake exe installer than to middle-man https that curl examples use?

Post by andrewchambers » Tue, Nov 04, 2014, 6:53 AM UTC

Gigablah wrote: post #42

razzaj wrote: post #7

I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script. People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.

Exactly. This is little more than cargo culting.