Hacker News Reader

Comment by simula67 | Hacker News Reader

Will this be enabled by default ?

The ability to do 'curl some-site.com | bash' or ssh <hostname> 'curl some-site.com | bash' without having to worry about platform compatibility would be amazing.

View on HN

I doubt it, and part of me hopes not. This seems like a new possible vector for malware.

Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net.

OTOH, yes, being able to assume bash on a user's installation would be amazing of course...

> Microsoft went to great lengths to disallow these kind of one-liners in PowerShell (you need to explicitly add -executionpolicy bypass to even run a script), so apparently they are concerned about users executing random scripts off the net.

Yes and I fucking hate it, way to cut of useful functionality at the knees.

A lot of my PowerShell scripts are accompanied by shortcuts or batch files that do:

    powershell.exe -ExecutionPolicy RemoteSigned -File whatever.ps1

Why would you ever want to do 'curl please-pwn-my-computer-so-hard | bash'?

maybe he's actually curling https://please-pwn-my-computer-so-hard.own-domain.com/script... ?

Same reason you want to `brew please-pwn-my-computer-so-hard` or `apt-get please-pwn-my-computer-so-hard` or `please-pwn-my-computer-so-hard.exe`.

There's little practical distinction between piping a shell script from a random site or downloading a binary from it.

> or `apt-get please-pwn-my-computer-so-hard`

Installing a package manually vetted by distribution maintainers, signed and verified with GPG, is the same as blindly running a random script off the internet?

I don't think you appreciate how much effort Linux distributions invested into creating safe ways of distributing software.

The difference being that distro packages are distributed in a safe matter (signing and verification) whereas a website could be hijacked and the script replaced or you could get MITM'd if you access it over HTTP.

http://brew.sh/

`/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/in...

https://rvm.io/rvm/install

`\curl -sSL https://get.rvm.io | bash`

https://www.npmjs.com/package/nodejs-oneline/tutorial

`curl -sL https://deb.nodesource.com/setup | sudo -E bash -z`

It is a trend. I can find more examples, the above is just places I remember seeing this behaviour.

Of course these fucking devops #yolo #hashtag hipsters have no clue of how to safely distribute software.

Reply on news.ycombinator.com