[deleted]
Hashpipe – Pipe iff the hash matches
11–20 of 90 posts
Re: Hashpipe – Pipe iff the hash matches
#12A polarizing name, if perhaps less so amongst programmers
This is a fantastic name. It says exactly what it does and has an excellent Weezer song to back it up
Re: Hashpipe – Pipe iff the hash matches
#13Be warned that this reads everything until EOF into memory, doing something like: hashpipe QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8 will produce unexpected behaviour.
So too much in the pipe and things get wonky? Still a perfect name!
Re: Hashpipe – Pipe iff the hash matches
#14Be warned that this reads everything until EOF into memory, doing something like: hashpipe QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8 will produce unexpected behaviour.
yeah, hashes are decided by every single bit including the last one, and not a single bit should be output until the hash matches. It currently buffers everything in memory, but might do this: https://github.com/jbenet/hashpipe/issues/1 (some settings dont have disk though). hashpipe is intended for most executable use cases (usually under <50MB)
You should be able to detect if the stream is seekable (by checking the result of 'lseek(fd,0,SEEK_CUR)') and only buffer if it's not.
Of course, if you're really paranoid, the file could get changed out from under you. But honestly you're probably screwed either way with an attacker who can do that.
Re: Hashpipe – Pipe iff the hash matches
#15Re: Hashpipe – Pipe iff the hash matches
#16A polarizing name, if perhaps less so amongst programmers
The name perfectly described its behavior, and I didn't even think about other meanings. huh.
Re: Hashpipe – Pipe iff the hash matches
#17Great, thank you for this software! Any idea if there are trusted 3rd party hashes for popular install scripts?
If a website wants you to:
curl "http://sketchyurl.com/script.sh" | hashpipe PRECOMPUTEDHASH | sh
it might be even worse, giving you only the facade of additional security.
Re: Hashpipe – Pipe iff the hash matches
#18Keep in mind whatever script you run through this could download additional unverified code.
Re: Hashpipe – Pipe iff the hash matches
#19Keep in mind whatever script you run through this could download additional unverified code.
Great point!! -- \o read this everyone o/ --
Please please dont use hashpipe thinking you'll be super safe about everything. It only raises the bar a bit! It solves my biggest gripe with most `curl | sh` things, which is that any MITM can own my machines without compromising the origin http servers.
(of course, if the HTTP server + page you got the checksum from is owned too-- good luck!).
Re: Hashpipe – Pipe iff the hash matches
#20Since the main use case for this utility is verifying network shell scripts, it would be interesting to see a query param convention, so we could use a tool such as:
> hashcurl http://load.this/script?hash= QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8 | sh