Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"So that a truncated partial download doesn't end up executing half a script"

tailscale.com

Post reply on HN
Print view View original

81–87 of 87 posts

Re: "So that a truncated partial download doesn't end up executing half a script"

#81

Post by kevincox »

kazinator wrote: post #69
bombcar wrote: post #4

I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).

The problem is, the wrong party is doing the check (from a security point of view, not integrity). When we download a script from a remote domain we don't trust, we have to validate its checksum against the known one; we can't leave that to the script, which we don't trust.

99% of the time you are downloading from a domain that you do trust. This check is to detect corruption, not malice.

But yes, if you were downloading from an untrusted mirror you would want to check the signature or trusted hash before running the script at all.

Re: "So that a truncated partial download doesn't end up executing half a script"

#82

Post by kevincox »

loeg wrote: post #77
wongarsu wrote: post #42

Earlier quoted context omitted.

A truncated download might happen for all sorts of reasons, like your internet connection dropping while you download the script. If you don't notice you might accidentally run an incomplete script and leave your system in some broken or at least confusing state. They wrapped everything in a main function to prevent that from happening

Browsers typically emit downloads to temporary files until they are complete, then rename them into the final location, to prevent this kind of issue.

Tools like wget or curl often do not. And the shell doesn't when doing something like `curl ... >myscript.sh`.

Re: "So that a truncated partial download doesn't end up executing half a script"

#83

Post by kevincox »

duped wrote: post #26
LeoPanthera wrote: post #12

Earlier quoted context omitted.

How is this different to Windows users downloading a .exe file and running it?

It's better because you almost never need to give root permissions to the installer, unlike on Windows

Yeah, usually it is just your user account: https://xkcd.com/1200/

Re: "So that a truncated partial download doesn't end up executing half a script"

#84

Post by loeg »

kevincox wrote: post #82
loeg wrote: post #77

Earlier quoted context omitted.

Browsers typically emit downloads to temporary files until they are complete, then rename them into the final location, to prevent this kind of issue.

Tools like wget or curl often do not. And the shell doesn't when doing something like `curl ... >myscript.sh`.

Sure. Just pointing out that there's a good reason browsers do this.

Re: "So that a truncated partial download doesn't end up executing half a script"

#85

Post by joshspankit »

kazinator wrote: post #69
bombcar wrote: post #4

I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).

The problem is, the wrong party is doing the check (from a security point of view, not integrity). When we download a script from a remote domain we don't trust, we have to validate its checksum against the known one; we can't leave that to the script, which we don't trust.

In this case we’re specifically talking about the possibility of a truncated script from a trusted source

Re: "So that a truncated partial download doesn't end up executing half a script"

#86

Post by yau8edq12i »

elzbardico wrote: post #30
yau8edq12i wrote: post #3

Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.

Well, you're going to run the thing the script downloaded with exactly the same user and privileges as the script you're running. Unless you're doing a full audit on all the code and not only a cursory look on the installation script, this looks to me more like security theatre.

Because if looking at the script you've downloaded for obvious errors or issues is not 100% effective, then it's only theater. Is that what you're saying?

Re: "So that a truncated partial download doesn't end up executing half a script"

#87

Post by fuzzfactor »

obi1kenobi wrote: post #62
arp242 wrote: post #51

Earlier quoted context omitted.

Most of these scripts have been doing that for years.

I'm sure of it. And yet based on this rapidly getting to the front page, it seems like many of us are part of today's lucky ten thousand: https://xkcd.com/1053/ Might be more than ten thousand, even, based on the reactions :)

I had to do stuff like this over com ports using systems made before PC's.
Post reply on HN