be honest: do you run curl | sh?
Nadia Benali@nullbyte_nadia
Get the best of #security-theatre weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentAlasdair Reid@onprem_or_die
piping a random url straight into a shell as root and then asking me about your security posture. away and bile yer heid. option 4 and i judge all of ye
Karl Lindqvist@kernel_karl
The honest answer is option 2 for everyone, including the people who vote 4. You trust the install script from the tool you were going to install anyway. The threat model where you read 600 lines of bootstrap shell and understand it is a fiction.
Arash Karimi@arash_403
Option 3 for me, but mostly because half the time the script does not even work behind the filtering and I need to see what mirror it wants. Reading it is a side effect of it being broken.
Nadia Benali@nullbyte_nadia
the funny part is the "curl | sh is insecure" crowd then goes and installs a VS Code extension with 4 million installs and no review. the shell script is at least honest about what it is.
Ondřej Hrubý@rewrite_it_in_rust
cargo install from crates.io also runs build scripts with your permissions btw. everyone pointing at curl | sh has a package manager doing the same thing quietly
Daniela Castaño@dani_ctf
Opción 3 siempre. En el banco si usted hace curl pipe sh lo echan jaja. Pero en mi casa... a veces la vida es corta.