News for hackers. Stuff that matters.

A comment on Show HN: Patchwork – Real-time notifications for OSS vulnerabilities. Parent comment

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by whorleater on Wednesday January 13, 2016 @03:49PM (#10897379)
Meaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.
[ Parent | on HN ]
Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by jacobscott on Wednesday January 13, 2016 @03:55PM (#10897421)
The software has to be distributed somehow, right? Probably over https? What makes curl more susceptible to MITM than apt-get/pip/gem/etc?

I don't particularly like curl | sh either, but without sudo, I'm not sure how much it /really/ differs, security wise, from other options.

Edit: real package managers have improved features compared to curl, as outlined in another branch of the comments.

[ Parent | on HN ]
Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dchanm on Wednesday January 13, 2016 @03:59PM (#10897453)
If you want to be extra cautious you can verify that the script hasn't changed with our release key

https://patchworksecurity.com/releases.txt

The latest release (2.0.0) has been signed by my key 0x85C64E20

[ Parent | on HN ]