Hacker News Reader

You could use hashpipe (https://github.com/jbenet/hashpipe), from Juan Benet (the author of IPFS). It simply checks that the input to the command matches a given hash, so you can do `curl <url> | hashpipe <hash> | sh`, and if the output of the curl command is different than expected it won't be passed in to `sh`.

View on HN

Ironically the prebuilt binaries of hashpipe itself are provided without means of verification :I

So if you are going to use hashpipe, I think you should download it in source form, read it -- it's under 100 SLOC -- and then build it from source yourself. This way, you do that once and then in the future provided that you trust those sending you various scripts and binaries and the channel they used to provide the hash, all is well and no further manual verification is needed on your side of things ever again for any of those.

If an attacker can modify the output of the curl command (on the host or on the wire), cannot they also modify the value of the hash seen and copy-pasted by the end-user? I must be missing something...

Reply on news.ycombinator.com