Hacker News Reader

Comment by charliesome | Hacker News Reader

Why not? There's plenty of things that are installable that way. For example:

RVM:

    bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer )

Homebrew:

    /usr/bin/ruby -e "$(curl -fsSL https://raw.github.com/gist/323731)"

View on HN

Because you are installing programs on your computer from a "shortened URL", which could point anywhere. Your examples use a URL that is the final destination so you can make an informed decision whether you are willing to trust that URL.

If you use the "append a +" bit.ly feature, you can check where it ends up, but not everybody knows to do that. https://bitly.com/psChocInstall+

A non-shortened URL can point anywhere as well. The only way to "make an informed decision" is to put the URL in your browser—that goes for shortened and non-shortened URLs.

If I were to attack someone with such a scheme, I would take care of serving clean files to a web browser (say, with the user-agent string) and the infected files to command-line invocations. :)

Yes, that's quite a security risk, but it also affects shortened and non-shortened URLs equally.

With a non-shortened URL you have one attack vector, hack the website. With a shortened URL you have two attack vectors, hack the website or hijack the shortened URL to point to your own server.

Would providing the full link be a better idea? For the installer experience, people wanted short and memorable.

1) Those links from github are served over https, lets ignore the fact that curl might ignore it though.

2) .com isn't as potentially susceptible as a Libyan tld.

3) They are relying on bit.ly to serve the correct file.

Perhaps the full url to the github file would reduce the cryptic url?

IIRC, a few months ago there was quite a large discussion here on HNs about the reason you shouldn't do either of those.

Can't find the discussion, but there is certainly a fairly large body of people who oppose those examples as well.

Reply on news.ycombinator.com