7 ms·

Can anyone explain the following trend to me? I've been seeing it alot lately: On the install page [0] the installation instructions tell people to run this com

Can anyone explain the following trend to me? I've been seeing it alot lately: On the install page [0] the installation instructions tell people to run this command: curl https://static.rust-lang.org/rustup.sh https://static.rust-lang.org/rustup.sh | sudo bash This seems to me to be an extremely bad idea. Why would I want to pipe arbitrary commands into my shell? Even worse, the shell has to run with root priveleges? Does anyone actually do this? Am I overthinking it? Of course, I can verify the contents of the script, but I still don't know that the script I've verified on their website is the script that's being run in my shell. Is it OK because the script is hosted over https, and therefore can't be modified on transmission? [0]https://crates.io/install https://crates.io/install

Touche 12y ago
Do you really think that's a trend because I've been seeing people complain about it on Hacker News for 3 or 4 years now.
- gramasaurous 12y ago
  Maybe so, but I've only just started seeing it within the last few weeks. I've been on HN for less than a year so maybe thats why.
steveklabnik 12y ago
This is purely because Rust and Cargo both are not yet stable, and so packaging them for distributions is inappropriate. Once there's a stable release, we will be telling people to use their packaging system and/or official installers rather than the script. There are various issues filed in the repository if you want to track when this changes.
apendleton 12y ago
It's bad, but no different than installing a package supplied by a third party, or using a third-party installer, in terms of what authority you're granting, both of which are fairly commonplace. Obviously the eventual goal is to get something vetted and blessed into a package management system, but that's probably not a reasonable expectation for a brand new project.
SwellJoe 12y ago
Any time you install a package (an RPM, deb, .exe, etc.), including from something like yum or apt-get, you are trusting somebody with root access to your system, including the ability to run arbitrary shell commands. This is something to take seriously; but not something to dismiss as entirely unacceptable. It is generally a manageable, and somewhat quantifiable, risk. This is no different than if the Rust developers provided an RPM or deb package for you to install; the same privileges are being granted to them. Though it is the same thing, it doesn't seem to generate the same concern as the "pipe this file into a shell" method of installation. In fact, one of the folks who responded to you explained that this problem will be gone once rust is packaged for distribution...but that merely means the commands are different, not that rust developers aren't being granted root access to your system. It is possibly even more suspect, in the case of binary packages, since in the case of the shell script, you could download it, look at it, and then run it. A binary package might have modifications that aren't included in the source distribution, and it would be difficult for a non-expert to spot those differences (and an expert would need to go looking for them, and might miss them). This is why signed packages are a big deal in the free OS world. At least you know who signed off on your package. In short, you're right: It's kind of crazy that people grant root access to arbitrary people every time they install software. But, it's the way things are done, for now, so we deal with it and only install stuff from people we perceive to be trustworthy. (i.e. be careful what apt and yum repositories you enable on your systems, and what scripts you pipe into a sudo shell.)
- ajross 12y ago
  All of that is true. But when I pull a package on Ubuntu or Fedora, it's checked against a key that came with the the system at install time as part of the whole package authentication infrastructure. The root of trust is rather stronger than running the output of some random unencrypted HTTP URL. And the distros recognize that and publish hash values for their install media in lots of obvious places. This is just a bad habit from the OS X world that needs to die. Really there should be some part of the step that allows a typical user to at least try to manually authenticate the root of trust, via a published hash on a bootstrap package maybe (that's what third party RPM/deb archives do, for example).
sschueller 12y ago
Does curl return a partial output if a connection dies? What if it dies and the last thing it got was "rm - fr /" but not the rest after the / ?
- vertex-four 12y ago
  Most shell scripts used like this are implemented by defining a function, then calling it - so if it fails downloading, all that happens is a syntax error as the code never actually gets run.
- aidanhs 12y ago
  Never thought about this, interesting question. You can try this equivalent, killing the server when it tells you to - https://gist.github.com/aidanhs/e40417381e9aecb87b35 https://gist.github.com/aidanhs/e40417381e9aecb87b35. It prints '/', i.e. would remove your root directory if it was an `rm` command. Won't be doing that again then.
  - steveklabnik 12y ago
    Remember that these days, with GNU rm, you have to pass in `--no-preserve-root` to actually `rm -rf /`. Attempting to remove something in the home directory and getting a `rm -rf /home/username/` would still be pretty bad.
- erickt 12y ago
  That's a good point. I filed https://github.com/rust-lang/rust/issues/19168 https://github.com/rust-lang/rust/issues/19168 to get it fixed.
- ema 12y ago
  The chance that the connection dies at exactly this moment is negligible compared to the chance that your hard drive dies. Worry about that.
whyever 12y ago
I used to be an http link some time ago... What alternative do you propose? You can check the script whether it does something malicious, but then it downloads and installs some binaries.
cpach 12y ago
Some good points from Nate Lawson: https://news.ycombinator.com/item?id=2427492 https://news.ycombinator.com/item?id=2427492
d0mine 12y ago
related discussion: https://news.ycombinator.com/item?id=8553625 https://news.ycombinator.com/item?id=8553625
antocv 12y ago
Not only that, but the script is useless. All it does is bullshit of 100 lines or so, but the main part of what it does is download a tarball, make some temporary directory, and run install.sh How difficult would those instructions be? Here take a tarball, and you know, unpack it and run install.sh I guess, too difficult for the audience that Rust developers are targeting with this curl this | sudo bash bullshit.
- ZoFreX 12y ago
  I don't disagree that that seems simple enough a process to follow, but bear in mind this command is supposed to be run daily. Convenience is definitely a boon.

Touche 12y ago

Do you really think that's a trend because I've been seeing people complain about it on Hacker News for 3 or 4 years now.

gramasaurous 12y ago
Maybe so, but I've only just started seeing it within the last few weeks. I've been on HN for less than a year so maybe thats why.

steveklabnik 12y ago

This is purely because Rust and Cargo both are not yet stable, and so packaging them for distributions is inappropriate. Once there's a stable release, we will be telling people to use their packaging system and/or official installers rather than the script. There are various issues filed in the repository if you want to track when this changes.

apendleton 12y ago

It's bad, but no different than installing a package supplied by a third party, or using a third-party installer, in terms of what authority you're granting, both of which are fairly commonplace. Obviously the eventual goal is to get something vetted and blessed into a package management system, but that's probably not a reasonable expectation for a brand new project.

SwellJoe 12y ago

Any time you install a package (an RPM, deb, .exe, etc.), including from something like yum or apt-get, you are trusting somebody with root access to your system, including the ability to run arbitrary shell commands. This is something to take seriously; but not something to dismiss as entirely unacceptable. It is generally a manageable, and somewhat quantifiable, risk. This is no different than if the Rust developers provided an RPM or deb package for you to install; the same privileges are being granted to them. Though it is the same thing, it doesn't seem to generate the same concern as the "pipe this file into a shell" method of installation. In fact, one of the folks who responded to you explained that this problem will be gone once rust is packaged for distribution...but that merely means the commands are different, not that rust developers aren't being granted root access to your system. It is possibly even more suspect, in the case of binary packages, since in the case of the shell script, you could download it, look at it, and then run it. A binary package might have modifications that aren't included in the source distribution, and it would be difficult for a non-expert to spot those differences (and an expert would need to go looking for them, and might miss them). This is why signed packages are a big deal in the free OS world. At least you know who signed off on your package. In short, you're right: It's kind of crazy that people grant root access to arbitrary people every time they install software. But, it's the way things are done, for now, so we deal with it and only install stuff from people we perceive to be trustworthy. (i.e. be careful what apt and yum repositories you enable on your systems, and what scripts you pipe into a sudo shell.)

ajross 12y ago
All of that is true. But when I pull a package on Ubuntu or Fedora, it's checked against a key that came with the the system at install time as part of the whole package authentication infrastructure. The root of trust is rather stronger than running the output of some random unencrypted HTTP URL. And the distros recognize that and publish hash values for their install media in lots of obvious places. This is just a bad habit from the OS X world that needs to die. Really there should be some part of the step that allows a typical user to at least try to manually authenticate the root of trust, via a published hash on a bootstrap package maybe (that's what third party RPM/deb archives do, for example).

sschueller 12y ago

Does curl return a partial output if a connection dies? What if it dies and the last thing it got was "rm - fr /" but not the rest after the / ?

vertex-four 12y ago
Most shell scripts used like this are implemented by defining a function, then calling it - so if it fails downloading, all that happens is a syntax error as the code never actually gets run.
aidanhs 12y ago
Never thought about this, interesting question. You can try this equivalent, killing the server when it tells you to - https://gist.github.com/aidanhs/e40417381e9aecb87b35 https://gist.github.com/aidanhs/e40417381e9aecb87b35. It prints '/', i.e. would remove your root directory if it was an `rm` command. Won't be doing that again then.
- steveklabnik 12y ago
  Remember that these days, with GNU rm, you have to pass in `--no-preserve-root` to actually `rm -rf /`. Attempting to remove something in the home directory and getting a `rm -rf /home/username/` would still be pretty bad.
erickt 12y ago
That's a good point. I filed https://github.com/rust-lang/rust/issues/19168 https://github.com/rust-lang/rust/issues/19168 to get it fixed.
ema 12y ago
The chance that the connection dies at exactly this moment is negligible compared to the chance that your hard drive dies. Worry about that.

whyever 12y ago

I used to be an http link some time ago... What alternative do you propose? You can check the script whether it does something malicious, but then it downloads and installs some binaries.

cpach 12y ago

Some good points from Nate Lawson: https://news.ycombinator.com/item?id=2427492 https://news.ycombinator.com/item?id=2427492

d0mine 12y ago

related discussion: https://news.ycombinator.com/item?id=8553625 https://news.ycombinator.com/item?id=8553625

antocv 12y ago

Not only that, but the script is useless. All it does is bullshit of 100 lines or so, but the main part of what it does is download a tarball, make some temporary directory, and run install.sh How difficult would those instructions be? Here take a tarball, and you know, unpack it and run install.sh I guess, too difficult for the audience that Rust developers are targeting with this curl this | sudo bash bullshit.

ZoFreX 12y ago
I don't disagree that that seems simple enough a process to follow, but bear in mind this command is supposed to be run daily. Convenience is definitely a boon.