Tectonic – A modern, complete, self-contained Tex engine with Unicode support • Hacker News Board

Re: Tectonic – A modern, complete, self-contained Tex engine with Unicode support

#31

Post by davidatbu » Sun, Apr 02, 2023, 5:06 PM UTC

remram wrote: post #30

davidatbu wrote: post #29

Earlier quoted context omitted.

Mind explaining why? I just tried it, and it works fine.

When we say "|sh can be detected on the server", this is not it. What you wrote is no different from `curl -o /tmp/file`.

In other words, you are saying that an HTTP server can detect distinguish between when the client is doing `curl $url | sh`, and when the client is doing `curl $url | sh -c 'cat > /tmp/file'`.

I'd love to hear the mechanism that the server would use to do that, if you have the time!

Re: Tectonic – A modern, complete, self-contained Tex engine with Unicode support

#32

Post by remram » Sat, Apr 08, 2023, 4:05 PM UTC

davidatbu wrote: post #31

remram wrote: post #30

Earlier quoted context omitted.

When we say "|sh can be detected on the server", this is not it. What you wrote is no different from `curl -o /tmp/file`.

In other words, you are saying that an HTTP server can detect distinguish between when the client is doing `curl $url | sh`, and when the client is doing `curl $url | sh -c 'cat > /tmp/file'`. I'd love to hear the mechanism that the server would use to do that, if you have the time!

I'm sorry I just saw this, but the idea is that sh will read as it executes so you can detect it passively. If you make it `sleep 1` you can detect on the server side that your call to send() hangs until sh proceeds, for the same duration as the sleep. You need to put enough content to make the TCP buffers fill up, but that can be done with all those function definitions that you tend to see in those scripts anyway.

Or the script could also signal through an active mechanism, a different innocuous-looking HTTP request that makes the server switch the content to a malicious payload if it happens at the same time.

Re: Tectonic – A modern, complete, self-contained Tex engine with Unicode support

#33

Post by cstrahan » Tue, Apr 11, 2023, 6:32 PM UTC

jjgreen wrote: post #20

cstrahan wrote: post #19

Earlier quoted context omitted.

Let’s say, for example, that I invite a friend over and offer them a glass of water. Would you be similarly upset to find that I don’t recommend that they first send a sample of the water to be tested for purity before consuming said glass of water? I mean, don’t get me wrong, I would be fine with my friend being cautious and wanting to get the water tested (though I doubt that would ever happen in practice)… but if…

Anyone that wants to inspect the shell script can amend that line to first save and view the script. They can, but they may well not get the same output since, as is well-known, curl | sh can be detected on the server.

I’m well aware of that. I didn’t make it explicit (as I thought it logically followed) that one would execute the local copy after review. Even putting aside the security aspect, downloading something twice makes little sense, so I thought the fact you would execute the saved file (again, after review) was pretty obvious.