6 ms·

from the article: > Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.

by dmbass 10y ago

strictnein 10y ago
The compounds in this medicine are public knowledge, but taking them could be dangerous. For a safer experience, review all medical literature pertaining to these compounds before consuming.
- slau 10y ago
  Not really the same. One of the main issues with curl pipes is that the server (or MITM) can detect that the request goes into a pipe. This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it. So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.
  - deleted 10y ago
    [deleted]
  - tpxl 10y ago
    How can you detect if the output is curl/piped?
    - Achshar 10y ago
      I would hazard a guess that curl won't send the standard request headers that browsers would.
    - nemo1618 10y ago
      Like so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... To combat this sort of thing, @jbenet made hashpipe: https://jbenet.github.io/hashpipe https://jbenet.github.io/hashpipe
    - scbrg 10y ago
      https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.
- antisthenes 10y ago
  I actually do just that whenever I decide to self-medicate with a new drug. Were you being facetious?
jamescostian 10y ago
Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276 http://unix.stackexchange.com/a/339276 That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash
mwambua 10y ago
I feel like they should state this first before giving the command. I had to scroll down the page to see this warning. Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste

from the article: > Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.

by dmbass 10y ago

from the article: > Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.

strictnein 10y ago

The compounds in this medicine are public knowledge, but taking them could be dangerous. For a safer experience, review all medical literature pertaining to these compounds before consuming.

slau 10y ago
Not really the same. One of the main issues with curl pipes is that the server (or MITM) can detect that the request goes into a pipe. This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it. So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.
- deleted 10y ago
  [deleted]
- tpxl 10y ago
  How can you detect if the output is curl/piped?
  - Achshar 10y ago
    I would hazard a guess that curl won't send the standard request headers that browsers would.
  - nemo1618 10y ago
    Like so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... To combat this sort of thing, @jbenet made hashpipe: https://jbenet.github.io/hashpipe https://jbenet.github.io/hashpipe
  - scbrg 10y ago
    https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.
antisthenes 10y ago
I actually do just that whenever I decide to self-medicate with a new drug. Were you being facetious?

jamescostian 10y ago

Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276 http://unix.stackexchange.com/a/339276 That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash

mwambua 10y ago

I feel like they should state this first before giving the command. I had to scroll down the page to see this warning. Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste