11 ms·
Sometimes I wonder why we don't just treat an installation script like curl https://alx.sh https://alx.sh | sh as a universal option for distributing applicatio
by JanisErdmanis 4mo ago
Sometimes I wonder why we don't just treat an installation script like curl https://alx.sh https://alx.sh | sh as a universal option for distributing applications. The provenance is there via the HTTPS certificate, and if you're already about to trust an application that can compromise your system, why not trust the installation script as well?
- layer8 4mo agoThe most important argument is phishing. People aren’t good at recognizing when a web site is legitimate. One reason that app certification is a shitshow is that recognizing bad players while minimizing false negatives and false positives is a difficult problem. Domain names fundamentally don’t solve that problem.
- realusername 4mo ago> Domain names fundamentally don’t solve that problem. App certification doesn't solve that problem either.
- pjmlp 4mo agoBecause even with HTTPS that script might not do what you expect and then is too late, xz style attack.