Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by bink | Hacker News Reader

Full thread

bink·

Please don't recommend people pipe curl output to a shell. Yikes.

View on HN

How did piping shell scripts from web sites become acceptable?

> bash <(curl -sL https://www.meter.com/awdl.sh)

Eek!

It's really common in the Mac world, homebrew does it too: https://brew.sh/

What could someone do with a curl pipe that they couldn’t do with a signed, obfuscated executable?

Wait until you find out nearly every modern package manager installs stuff directly from github repos.

Nope. See pkgsrc.

I see this a lot and it really rubs me the wrong way, but it makes a lot of sense from a usability standpoint.

I started pointing directly at the full commit SHA of the version I want to use when pointing dependencies at Github repos, as I have some naïve belief that it'll offer me a reasonable level of protection from the malicious takeover of a repo.

Docker tags (imagename:tag) aren't cryptographically secure and can be replaced by the server at any time if you aren't using imagename@sha256:<hash> format.

eh it's fine. sure, technically speaking you're giving your machine over to whoever wrote that script. they could do anything! but actually, the script is usually useful and safe. Like this one.

You know that, I know that, but the thousands of people getting desensitized and trained to run random terminal commands like this to "fix their wi-fi" usually don't.

The problem isn't even pasting curl output into sh – it's instructing non-technical users to run any terminal commands, in my opinion.

I’d be happy to point them to the UI for disabling awdl0. Let me know when you find it.

I took a peek at the script and I don’t think I want anyone who writes code like that coming anywhere near my machine if I can help it.

Heh, yeah.

Reply on news.ycombinator.com