Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl to shell isn't so bad

arp242.net

Post reply on HN
Print view View original

61–70 of 201 posts

Re: Curl to shell isn't so bad

#61

Post by eavotan »

dmitriid wrote: post #51
kijin wrote: post #40

I hate install scripts, period. They feel so Windows-ish. Just distribute a .deb, .rpm, .snap, homebrew package, npm package, or whatever is the most appropriate for your software. All the scripting you need to do should be done inside of the regular package installation process, and even that should be kept to a minimum. The only software that has any right to rely on an ad-hoc install script on a Unix-like system i…

What’s the difference between a curl you blindly pipe into sh and a blind brew install/npm install command?

The lack of information. Most install docs tell about installation requirements. One-liners don't.

Re: Curl to shell isn't so bad

#62

Post by [deleted] »

Carpetsmoker wrote: post #57
LIV2 wrote: post #52

Earlier quoted context omitted.

Possibly related to how the author of the article is downvoting everything

The only two posts I've downvoted are your two "partial content" posts because they only repeat a point that is addressed in the article without adding any form of rebuttal or even recognition that it's even mentioned in the article. I have no idea what the point of posting that link is shrug , so I downvoted that too

[deleted]

Re: Curl to shell isn't so bad

#64

Post by wibble10 »

Arnt wrote: post #34
sjy wrote: post #30

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuable at this point.

Not as far as I know, but I have heard about people pasting the Wrong Thing into a root shell. In a way it's a casting error. A type safety violation. You paste text into a privileged shell and coerce it to be sh, and when it goes wrong the sh input is rich in characters. Friends of mine have mentioned at least a) people accidentally pasting much more than the intended line into sh because they selected more than int…

Once I worked at a place where ooh support accidentally pasted an entire maint guide into putty (right click paste is not a good idea) on a prod oracle server, it was fine until the lines in the doc which read:

Dbfile1 -> /path/to/dbfile1 ... Etc

Which needless to say hosed the entire box... over Christmas...

And this is why they don’t use putty anymore ;)

Re: Curl to shell isn't so bad

#65

Post by eavotan »

Boulth wrote: post #50
kijin wrote: post #40

I hate install scripts, period. They feel so Windows-ish. Just distribute a .deb, .rpm, .snap, homebrew package, npm package, or whatever is the most appropriate for your software. All the scripting you need to do should be done inside of the regular package installation process, and even that should be kept to a minimum. The only software that has any right to rely on an ad-hoc install script on a Unix-like system i…

The problem with deb, rpm, etc is that you need to add instructions to all supported systems one by one. Check out this site for reference: https://www.sublimemerge.com/docs/linux_repositories and compare with curl URL|sh that can detect target system and delegate to appropriate system. Much simpler. The root cause of this is no universal packaging format for Linux in my opinion.

If you want to support multiple platforms this is the way to go. I don't see a problem with it.

We have the freedom to use different package managers. It comes, likes everything else, with it's own drawbacks.

Re: Curl to shell isn't so bad

#66

Post by bauerd »

I remember someone curling a Heroku CLI install script and upon inspection, it would have tried to install a specific version of Ruby too instead of just the client. Since then I always glance through the script first

Re: Curl to shell isn't so bad

#67

Post by slim »

the problem is mainly that the script is executed without leaving a trace. if you downloaded the script then executed it, you would have something to inspect in case something goes wrong.

it's too easy, and people with very scarce knowledge could develop a habit of doing this without asking questions and not even leaving any trace for a senior to inspect in case of a problem happening

Re: Curl to shell isn't so bad

#68

Post by eadmund »

> There is no fundamental difference between curl .. | sh versus cloning a repo and building it from source.

Not true: when you clone a repo with signed commits, you have forensic evidence that the repo signer provided the code you ran, while when you use curl you have … just the code itself.

That's not a lot, but it's not nothing.

Re: Curl to shell isn't so bad

#69

Post by cameronbrown »

mehrdadn wrote: post #58
LIV2 wrote: post #7

I disagree with some of this, I.e paste jacking. Plenty of software projects put more care and focus into their software and not in their website, if you're running a vulnerable version of Wordpress or whatever CMS it'd be easy for someone to insert something malicious without being noticed whereas something that modified your code would show up in git, code reviews etc

How is this any different from just downloading a binary from their website and running it? Which people have been doing for ages?

Plenty of installation scripts ask for root.

Re: Curl to shell isn't so bad

#70

Post by tommos0 »

bonoboTP wrote: post #48
yoavm wrote: post #35

Not so bad comparing to what? Yeah, comparing to downloading a tar file from the website and running ./configure, make etc - right, it's probably quite a similar risk. But who does that? Every decent Linux distro has a package manager that covers 99% of the software you want to install, and comparing to an apt-get install, pacman -S, yum install and so on - running is a script off some website is way more risky. My p…

The package manager is only an option if you have root rights. Otherwise you either download binaries or compile it yourself, from the source downloaded from their website.

There are user space package managers, e.g. conda, flatpack and homebrew come to mind.
Post reply on HN