Hacker News Reader

Comment by raesene4 | Hacker News Reader

I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed.

curl|bash ing a script does not provide this protection.

View on HN

Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.

You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.

Also, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model.

Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.

Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...

But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...

You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.

Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.

I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.

I think that once we're talking about installing server software at the command line, we're already beyond most of the masses.

I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.

Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.

> And there are more secure options: the package managers.

So sandstorms installation guide should in your opinion just say "wait a couple of years and maybe someone will have packaged it for your distro"? Yes, that sounds excellent way of getting users. And hey, the most secure way of installing software is not to!

you can host your own repos pretty easily, and still provide the bash script for oddball distros.

I don't think it's possible to make things secure for people who don't care, except by disallowing third-party software entirely. Deciding who you trust is fundamental.

curl|bash is just a shorthand way to say "here is an URL for install script you can run with bash" which happens to be also conveniently copy-pasteable. You can do whatever you want with that information.

Of course, but the article being discussed is about curl|bash so I felt that comment was relevant :)

Reply on news.ycombinator.com