Hacker News Reader

Comment by zeptonix | Hacker News Reader

Always safer to first curl url > file, then read through file, then only if all looks good, run the file (under an appropriate user and with permissions as limited as possible, etc.)

View on HN

Is there any meaningful/significant security benefit from doing this?

Whatever executable such a script installs could itself later download + run arbitrary commands.

Given that an attacker would likely obfuscate shenanigans, I don’t think there is much benefit to glancing over source unless you’re really ready to do a little research project for a few hours.

The benefit for me is knowing what installs where so that i can later uninstall everything without having to rely on an uninstaller that leaves bits behind. Of course I'm talking about a different scenario where I'm already assuming the script and binaries it installs are safe.

I used to use checkinstall for this, makes a little uninstallable apt package for you.

I’m old enough to remember when you had a makefile or even better an rpm or deb.

It was so much better than the windows way of running a random program with little visibility, and so sad when so much software changed away from that method.

In theory yes, it's more secure.

In practice personally auditing the installation script for every program you're going to use and the installation script for every update is grossly impractical, for the same reason nobody reads EULAs. In the end it still boils down to trust.

To be fair, the package must be provided by your distribution, otherwise it's just another random download, only in a different format.

Even if you are adding a third-party package repository, you just change the downloader. Although you usually get signature checking with that step for free.

And therein lies the issue: It's not the job of the software developers to provide packages for your distribution, but the job of your distribution maintainers.

So, if your distribution will probably not backport $newver of some tool to your release, you are only left with installing it via different means.

If you find yourself always installing software like this because your package repositories don't contain what you want, it may be a good idea to just check out different distros.

There's a big difference there in that even if you do install the odd program from source, the distro likely has you covered in terms of all the libraries needed to run it in the first place.

That's a very different scenario from having to download the dependencies as well.

Having to download dependencies is a very Linux desktop problem. On every other platform (Windows, macOS, iOS, Android) it is customary for installers to come with all dependencies. Most programs also statically link non-system libraries.

Nothing stops you from bundling dependencies on linux.

The reason it's a "very linux problem" is exactly because this is a sane thing to do in a pool of insane systems.

There's absolutely no reason to ship your 1k executable with 1Gb of libraries, used by 10 other programs.

If your 1k executable uses 1Gb of libraries, that's on you.

An unsigned deb is better than an unsigned script as it keeps track of what files are deployed and you have a version number in a central list from dpkg -l

Sure something bad can still do things, but it tends not to splat files everywhere with no trace.

Whether or not there's any security benefit, I've often benefited from pre-reading install scripts by deciding to install the thing somewhere else, or with a different setting, or noticing that the entire install script is basically just a lot of paranoid noise around simply downloading the binary and putting it in a binary directory, etc.

Some are so elaborate it's hard to poke through what they're actually doing, but a lot of them aren't.

Making an all-in-one install script that doesn't require any arguments involves making a lot of decisions for the user that you may not particularly like. Pre-reading gives a chance to decide whether or not you like those decisions.

It's insignificantly safer. The only time it will help is if an attacker makes absolutely zero effort to hide their attack. If they're clever enough to hack the Rustup website or Brew or whatever then they're going to know not to put their exploit in plain sight in the installation script.

Exactly. Once you go down the security rabbit hole it quickly leads to paranoia

That’s an exceedingly odd way to put “the threat’s scope exceeds this particular vector”.

That’s a really odd way to put “I like to emote orthogonally to idiomatic vernacular”

I wasn’t emoting lol, I was recognizing the orthogonality I found strange. Recognizing that partially securing a thing is incomplete isn’t paranoid, it’s just acknowledging the progress is limited.

Is it though? As the attacker would you:

Spend minimal resources and compromise 80% of users.

Spend an extraordinary amount of resources and compromise 99% of users. Of note is that those extra 19% of users are more security conscious and will likely detect and purge the exploit immediately.

You massively underestimate the effort required to hide malware from people doing a cursory review of a bash script.

Most of these bash scripts install open source software so I would simply recompile that software with my malware included.

Also people talk to each other. I would want to hide my malware very well so that nobody noticed and raised the alarm for as long as possible.

Reply on news.ycombinator.com