Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hashpipe – Pipe iff the hash matches

jbenet.github.io

Post reply on HN
Print view View original

21–30 of 90 posts

Re: Hashpipe – Pipe iff the hash matches

#21

Post by _prometheus »

wyc wrote: post #17

Great, thank you for this software! Any idea if there are trusted 3rd party hashes for popular install scripts? If a website wants you to: curl " http://sketchyurl.com/script.sh" | hashpipe PRECOMPUTEDHASH | sh it might be even worse, giving you only the facade of additional security.

That's a bigger problem, because we essentially need full PKI. My preferred solution is via http://ipfs.io -- but i may be a bit biased :)

I think we can get halfway there with a "signed hash" construction, but yeah-- PKI...

Re: Hashpipe – Pipe iff the hash matches

#22

Post by _prometheus »

chralieboy wrote: post #12
jrlocke wrote: post #2

A polarizing name, if perhaps less so amongst programmers

This is a fantastic name. It says exactly what it does and has an excellent Weezer song to back it up

https://www.youtube.com/watch?v=qguED5Aouv4

UPDATED: whoops wrong link. I meant: https://www.youtube.com/watch?v=_9BGLtqqkVI

(the first one's better though...)

Re: Hashpipe – Pipe iff the hash matches

#23

Post by latchkey »

I love this idea, as it has bothered me for a while now that homebrew initial install just points to a script on github.

That said, now we just need someone to hack gobuilder.me and replace the binary distribution of hashpipe with something that always returns the input.

Re: Hashpipe – Pipe iff the hash matches

#24

Post by throwaway_99837 »

unsoundInput wrote: post #8
doomrobo wrote: post #7

Earlier quoted context omitted.

Loading everything into memory at once shouldn't be necessary to produce a hash of the entire input. All of the hash functions currently supported allow for incremental hashing. That means you can hash in blocks instead of all at once.

The input still needs to be cached for eventual output in case the hash matches I assume.

Or, you know, do two passes.

Re: Hashpipe – Pipe iff the hash matches

#25

Post by vortico »

Deployment one-liners with hashpipe will only work if hashpipe is installed, which would be equally difficult for users to install properly than the software itself. Then you'd need something like this:

> Simply install using `curl hashpi.pe | bash`

Re: Hashpipe – Pipe iff the hash matches

#26

Post by [deleted] »

_prometheus wrote: post #19
tlrobinson wrote: post #18

Keep in mind whatever script you run through this could download additional unverified code.

Great point!! -- \o read this everyone o/ -- Please please dont use hashpipe thinking you'll be super safe about everything. It only raises the bar a bit! It solves my biggest gripe with most `curl | sh` things, which is that any MITM can own my machines without compromising the origin http servers. (of course, if the HTTP server + page you got the checksum from is owned too-- good luck!).

[deleted]

Re: Hashpipe – Pipe iff the hash matches

#28

Post by jamiesonbecker »

tlrobinson wrote: post #18

Keep in mind whatever script you run through this could download additional unverified code.

Good point - of course, this would mean that the additional code was vetted (or at least consciously included!) by someone who cared enough to use hashpipe in the first place.

Re: Hashpipe – Pipe iff the hash matches

#29

Post by gojomo »

quicksnap wrote: post #20

Since the main use case for this utility is verifying network shell scripts, it would be interesting to see a query param convention, so we could use a tool such as: > hashcurl http://load.this/script?hash= QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8 | sh

When the just-over-the-next-hilltop promised-land nirvana of content-centric networking arrives, the hash will be enough to locate & download the content – so you shouldn't even need an URL:

  $ hashcurl QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8 | sh
Maybe it's even a special filesystem path, that contains (but does not list) everything-that's-nameable-and-findable:

  $ sh /everything/QmUJPTFZnR2CPGAzmfdYPghgrFtYFB6pf1BqMvqfiPDam8
(BTW, personally not a fan of the opaque 'multihash' format, which obscures the algorithm-in-use to save a few characters.)
Post reply on HN