Hacker News Reader

Comment by zokier | Hacker News Reader

Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...

View on HN

But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...

You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.

Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.

I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.

I think that once we're talking about installing server software at the command line, we're already beyond most of the masses.

I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.

Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.

> And there are more secure options: the package managers.

So sandstorms installation guide should in your opinion just say "wait a couple of years and maybe someone will have packaged it for your distro"? Yes, that sounds excellent way of getting users. And hey, the most secure way of installing software is not to!

you can host your own repos pretty easily, and still provide the bash script for oddball distros.

I don't think it's possible to make things secure for people who don't care, except by disallowing third-party software entirely. Deciding who you trust is fundamental.

curl|bash is just a shorthand way to say "here is an URL for install script you can run with bash" which happens to be also conveniently copy-pasteable. You can do whatever you want with that information.

Of course, but the article being discussed is about curl|bash so I felt that comment was relevant :)

Reply on news.ycombinator.com