Hacker News Reader

Hacker News

Comment by akerro | Hacker News Reader

Parent Full thread

akerro

Run:

sh | wget http://www...something.com/install.sh

to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

View on HN

I think it's the other way and you need the -qO- flags.

The problem with this is that the bootloader downloads and runs the code without giving any chance to inspect it.

If you download the code manually, how are you to know that the server sent you the exact same code? They could be checking HTTP headers for a bootloader device, or might only be infecting 1 in 100 downloads. You'd never spot it.

You can always examine the code right? https://github.com/antonym/netboot.xyz/blob/master/src/coreo... Uses official images as far as I can see

Sure, you could compile it yourself, then host it yourself. Relying on the remote server is the problematic part.

I see. Correct.

Don't forget that many require you to use sudo.

zsh: command not found: sudo

No worse than "./configure && make && sudo make install"

It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc.

In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.

What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often).

What about `cd /usr/ports/www/firefox && make clean install`?

Sure, autoconf is generated, but often develops have to add custom rules.. and do it with arcane m4 macros to boot. I think they're similarly prone to mistakes.

For nefarious purposes I actually think it's worse than the much-maligned "curl|sh" scenario. I bet a reasonable number of people will end up trying to download the script, out of curiosity if nothing else. If it's doing anything not straightforward, it would get attention. In contrast, who would notice a line added to the middle of a 8000 line auto-generated configure script?

That wasn't my point. configure doesn't prevent malicious behaviour, but it would prevent silly mistakes at install time. (unless you actively break out of macro environment)

The point is, technically there isn't anything different between `curl | sh` and installing a system from either a downloaded .iso or a mailed DVD. Both run code from untrusted sources on your computer. But in practice they're very different because of user behaviour and ability to validate data before running. There's a whole spectrum in between and configure&make is somewhere on it.

If that's being run for code you've downloaded from an untrusted location, then I'd agree with you. However, almost every project that has those instructions starts with "download it from this trusted location, verify its integrity using this GPG key...".

Of course, you have to start trusting at some point. But with HTTP, you have to also trust the wifi AP, its owner, all of the routers between you and the server, DNS... At least https takes a lot of those (but not all) out of the equation, while GPG goes even further.

docker?

curlpipesh.tumblr.com/

Reply on news.ycombinator.com