6 ms·

Going to be "that guy": On the installation page, it says to do this: curl -s http://repository.rainloop.net/installer.php | php wget -qO- http://repo

Going to be "that guy": On the installation page, it says to do this: curl -s http://repository.rainloop.net/installer.php | php wget -qO- http://repository.rainloop.net/installer.php | php This is incredibly dangerous. Because it's http, it can be Man-In-The-Middle'd, so you're basically executing arbitrary commands on your computer. (See: php function exec()). Also, even if it's non TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious.

gtCameron 12y ago
Couldn't you say the same thing about downloading and running any installer from the internet? There is nothing special about PHP that makes this insecure, the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it.
- thrownaway2424 12y ago
  The point is there's no SSL.
- jnbiche 12y ago
  >There is nothing special about PHP that makes this insecure He didn't say it was because of PHP, he said it was because of http (i.e., because it's not over SSL). > the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it Exactly, which is why people who are security conscious never simply execute a Windows installer downloaded from the browser (or wget, for that matter). At a minimum, one checks the file hashes. Ideally, one confirms that the executable has been properly signed and not tampered with (by right-clicking the file, clicking 'properties' and looking at the 'signature' tab, or else manually checking if it's been GPG signed).
thrownaway2424 12y ago
For a long time the officially documented way to install GNOME was to lynx -dump http://go.gnome.org http://go.gnome.org and pipe it to a root shell. Looks like the industry hasn't learned much in twenty years.
smtddr 12y ago
>>Also, even if it's non TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious. I'm assuming that "non" shouldn't be there, so... I don't know how I feel about the whole curl/wget [url] | [interpreter] trend. In theory, it shouldn't really be that different from the days of downloading "setup.exe" and running it. If for some reason you don't trust Rainloop then you shouldn't install anything of theirs no matter what the delivery method is.
est 12y ago
If your network is Man-In-The-Middle'd you are probably fucked in more than one way, and a backdoored php install script is the least thing you should worry about. It's no different to just download an installer and double click it. Providing verification methods in alternative channels is essential if you need make sure everything is clean.
- minaguib 12y ago
  There's a small difference. With a normal download, you're likely to wait until it's done before invoking it. With a pipe-to-interpreter, the interpreter (php/sh/etc..) is possibly interpreting code as it receives in batches of (line/chunk/etc.). A danger therein lies in the possibility of an unexpected pipe interruption (network, or software) feeding something that's technically runnable by the interpreter but logically broken. Imagine coming down the pipe is "rm -rf /tmp/installer-data" but curl uses too much memory and the linux OOM killer nukes it and sh receives only "rm -rf /"
  - est 12y ago
    You have a good point. It's good practice to download, verify checksum/cert, then run.
  - tenken 12y ago
    with "curl -s" at least, curl wont send anything onto the next process until it's done receiving (all) the data. _If_ the pipe breaks up the incoming data, I assume its on 1 of these boundaries of 64kb-ish: http://unix.stackexchange.com/questions/11946/how-big-is-the-pipe-buffer http://unix.stackexchange.com/questions/11946/how-big-is-the... http://stackoverflow.com/questions/4624071/pipe-buffer-size-is-4k-or-64k http://stackoverflow.com/questions/4624071/pipe-buffer-size-... In general, when I've seen this technique used in Ruby (RVM?, back in the day) and/or PHP (Composer recommends a similiar Curl install technique, but composer.phar is an digest-archive of sorts ....) the installer code tends to be about a paragraph worth of text. All in all I understand your point. But your contrived example of rm -rf seems a little too contrived. In this case we're were talking about PHP code ... the chunked-piped code would still need to be valid PHP of what "rm -rf /" is not as it's missing important tokens to denote valid php expression(s). It seems like it would be equally worrisome to worry about Brownian Motion flipping a bit in memory and catastrophically affecting my program execution -- possible but unlikely.
kentonv 12y ago
> Also, even if it's [on] TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious. It seems like no matter how you install the software, you likely have to put at least that level of trust in them. Unless you run it in its own VM or other sandbox, of course. The TLS point is totally valid, though.
- crdoconnor 12y ago
  I prefer to see these scripts on github, over https, with a commit hash specified. That's harder to hack.

gtCameron 12y ago

Couldn't you say the same thing about downloading and running any installer from the internet? There is nothing special about PHP that makes this insecure, the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it.

thrownaway2424 12y ago
The point is there's no SSL.
jnbiche 12y ago
>There is nothing special about PHP that makes this insecure He didn't say it was because of PHP, he said it was because of http (i.e., because it's not over SSL). > the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it Exactly, which is why people who are security conscious never simply execute a Windows installer downloaded from the browser (or wget, for that matter). At a minimum, one checks the file hashes. Ideally, one confirms that the executable has been properly signed and not tampered with (by right-clicking the file, clicking 'properties' and looking at the 'signature' tab, or else manually checking if it's been GPG signed).

thrownaway2424 12y ago

For a long time the officially documented way to install GNOME was to lynx -dump http://go.gnome.org http://go.gnome.org and pipe it to a root shell. Looks like the industry hasn't learned much in twenty years.

smtddr 12y ago

>>Also, even if it's non TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious. I'm assuming that "non" shouldn't be there, so... I don't know how I feel about the whole curl/wget [url] | [interpreter] trend. In theory, it shouldn't really be that different from the days of downloading "setup.exe" and running it. If for some reason you don't trust Rainloop then you shouldn't install anything of theirs no matter what the delivery method is.

est 12y ago

If your network is Man-In-The-Middle'd you are probably fucked in more than one way, and a backdoored php install script is the least thing you should worry about. It's no different to just download an installer and double click it. Providing verification methods in alternative channels is essential if you need make sure everything is clean.

minaguib 12y ago
There's a small difference. With a normal download, you're likely to wait until it's done before invoking it. With a pipe-to-interpreter, the interpreter (php/sh/etc..) is possibly interpreting code as it receives in batches of (line/chunk/etc.). A danger therein lies in the possibility of an unexpected pipe interruption (network, or software) feeding something that's technically runnable by the interpreter but logically broken. Imagine coming down the pipe is "rm -rf /tmp/installer-data" but curl uses too much memory and the linux OOM killer nukes it and sh receives only "rm -rf /"
- est 12y ago
  You have a good point. It's good practice to download, verify checksum/cert, then run.
- tenken 12y ago
  with "curl -s" at least, curl wont send anything onto the next process until it's done receiving (all) the data. _If_ the pipe breaks up the incoming data, I assume its on 1 of these boundaries of 64kb-ish: http://unix.stackexchange.com/questions/11946/how-big-is-the-pipe-buffer http://unix.stackexchange.com/questions/11946/how-big-is-the... http://stackoverflow.com/questions/4624071/pipe-buffer-size-is-4k-or-64k http://stackoverflow.com/questions/4624071/pipe-buffer-size-... In general, when I've seen this technique used in Ruby (RVM?, back in the day) and/or PHP (Composer recommends a similiar Curl install technique, but composer.phar is an digest-archive of sorts ....) the installer code tends to be about a paragraph worth of text. All in all I understand your point. But your contrived example of rm -rf seems a little too contrived. In this case we're were talking about PHP code ... the chunked-piped code would still need to be valid PHP of what "rm -rf /" is not as it's missing important tokens to denote valid php expression(s). It seems like it would be equally worrisome to worry about Brownian Motion flipping a bit in memory and catastrophically affecting my program execution -- possible but unlikely.

kentonv 12y ago

> Also, even if it's [on] TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious. It seems like no matter how you install the software, you likely have to put at least that level of trust in them. Unless you run it in its own VM or other sandbox, of course. The TLS point is totally valid, though.

crdoconnor 12y ago
I prefer to see these scripts on github, over https, with a commit hash specified. That's harder to hack.