Detecting the use of “curl – bash” server side

Re:Detecting the use of “curl – bash” server side by nailer on Wednesday April 20, 2016 @06:58AM (#11533493)

Binaries and some websites are signed with a verified legal entity.

This is what the Debian guys standing in a circle holding their passwords are doing at your Linux event. It's also why when you visit github it says 'GitHub, Inc [US]' in your browser's address bar. Heads up: I work on the latter.

[ Parent | on HN ]

Re:Detecting the use of “curl – bash” server side by raesene6 on Wednesday April 20, 2016 @08:13AM (#11533775)

Sure but SSL identification is a very small part of the process of having a "trusted source".

There is, I'm sure, malicious software hosted on github, so I can download things from that trusted source and still have trouble.

there is insecure software hosted on github, again there's no protection based on hosting company.

If a developer who hosts a repository on github has their credentials compromised, their software may become malicious.

Also as an end-user (particularly a non-paying one) I have no visibility of Githubs own security policies and practices, so assessing the level of trust placed there is tricky.

The debian model has more checks and balances (i.e. it's harder to get from one set of compromised creds to a malicious package in a production repo.) but still not perfect...

[ Parent | on HN ]

Re:Detecting the use of “curl – bash” server side by rmc on Wednesday April 20, 2016 @08:50AM (#11533958)

> This is what the Debian guys standing in a circle holding their passwords are doing at your Linux event.

Passports, surely? :P

[ Parent | on HN ]

Re:Detecting the use of “curl – bash” server side by nailer on Wednesday April 20, 2016 @03:52PM (#11537240)

Passports indeed. Sorry, autocorrect.

[ Parent | on HN ]