But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that you run without sudo? I know that I don't.
Not sure if you're alluding to this trick: http://thejh.net/misc/website-terminal-copy-paste
This particular exploit could be rather nasty when used in conjunction with the above.
curl -L http://www.example.com/some/cool/thing/install.sh | bash
- The default user created at setup of OSX is in the admin group.
- Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!)
- Do you habitually read every line of source code your computer would execute before you run that code?
The main homebrew page says, 'run this ruby script'.
The ruby script is available at: https://raw.github.com/mxcl/homebrew/go
The script includes a sudo command.
To be fair, I hadn't read the script in detail when I wrote my post, just far enough to see there was a definition of a sudo function. On review, it looks like they either call it to chmod/chgrp HOMEBREW_PREFIX (sometimes), or run sudo to create the directories.
And yes, I very seldom run scripts copied from somebody else so when I do, I make sure I know what is being run. Granted, I'm a Linux and Windows user so the OSX philosophy might be different.