21–30 of 87 posts
Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
If only there was a way to transactionally run shell scripts such that if they don't complete fully, the changes are automatically reverted. Edit: cue the HN responses to use nix, and other solutions
Make curl | sh automatically upgrade the user's system to nix?
Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
Didn't the xz situation kinda prove that even reading the script is probably not gonna do you a lot of good if you're up against someone smart?
Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
Didn't the xz situation kinda prove that even reading the script is probably not gonna do you a lot of good if you're up against someone smart?
Maybe I'm too naïve.
Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
How is this different to Windows users downloading a .exe file and running it?
Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
How is this different to Windows users downloading a .exe file and running it?
Mostly it is the same though shrug. There thankfully don’t seem to be many hackers going after the niche of desktop Linux users.
Earlier quoted context omitted.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
How is this different to Windows users downloading a .exe file and running it?
Of course open source projects rarely sign their exes because those certificates are expensive ($300+/year).
Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.