Earlier quoted context omitted.
As opposed to downloading a binary install file?
Having a distribution maintainer provide official packages is the best way.
Thats who pushed XZ out as far as it went.
Everyone is asleep at the wheel.
"So that a truncated partial download doesn't end up executing half a script"
11–20 of 87 posts
Re: "So that a truncated partial download doesn't end up executing half a script"
#12Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
How is this different to Windows users downloading a .exe file and running it?
Re: "So that a truncated partial download doesn't end up executing half a script"
#13If only there was a way to transactionally run shell scripts such that if they don't complete fully, the changes are automatically reverted.
Edit: cue the HN responses to use nix, and other solutions
Re: "So that a truncated partial download doesn't end up executing half a script"
#14Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
Didn't the xz situation kinda prove that even reading the script is probably not gonna do you a lot of good if you're up against someone smart?
> given the xz situation a well crafted shell script can seem harmless while being very dangerous
That’s exactly what they are saying.
Re: "So that a truncated partial download doesn't end up executing half a script"
#15If only there was a way to transactionally run shell scripts such that if they don't complete fully, the changes are automatically reverted. Edit: cue the HN responses to use nix, and other solutions
Potentially sounds like a job for a BTRFS snapshot?
Re: "So that a truncated partial download doesn't end up executing half a script"
#16If only there was a way to transactionally run shell scripts such that if they don't complete fully, the changes are automatically reverted. Edit: cue the HN responses to use nix, and other solutions
Make curl | sh automatically upgrade the user's system to nix?
Re: "So that a truncated partial download doesn't end up executing half a script"
#17Earlier quoted context omitted.
Having a distribution maintainer provide official packages is the best way.
Thats who pushed XZ out as far as it went. Everyone is asleep at the wheel.
Distribution maintainers are also the people that pushed out a fix as quickly as the compromised version was released.
It's unrealistic to expect software to never have security holes, bugs, or vulnerabilities. How they're handled matters more than the fact that they were introduced to begin with.
Re: "So that a truncated partial download doesn't end up executing half a script"
#18I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).
Incorporating an MD5 quine into a shellscript would be funny.
Re: "So that a truncated partial download doesn't end up executing half a script"
#19Re: "So that a truncated partial download doesn't end up executing half a script"
#20Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
While I agree, how does this mesh with standard operating procedure on Windows/Mac being to download binary executables and run them? Is the analogous advice "inspect any exe files with Ghidra and fully understand them before running"? Or "only run executables from official distribution channels of open source projects the code of which you've read and understand"? Where, generally, should we place our trust in terms of what code we run on our computers?