Re:“Curl Bash piping” wall of shame
by falcolas on Saturday October 22, 2016 @10:56AM
(#12768907)
> if you're using an https url then you should be ok
You're trusting the server in this case, not the contents being provided by the server. There's no way to verify that the contents attributed to eridius on github are the same contents that eridius actually put up there.
Github in particular has been shown to have problems with spoofed users.
Let's go one step further. I have a `curl | sh` script for you to execute to install Docker. Just run:
curl -fsSL https://get.docker.com/ | sh
Oops. That was actually get.rekcod.com, with a RTL unicode character embedded. Or a unicode C which doesn't map to the ascii 'c'. Or I am able to mitm and strip the TLS. Or...
The vulnerabilities go on and on. Using only HTTPS, you have no way to prove that the code you got from get.docker.com is the code that the docker engineers intended for you to use.
You're trusting the server in this case, not the contents being provided by the server. There's no way to verify that the contents attributed to eridius on github are the same contents that eridius actually put up there.
Github in particular has been shown to have problems with spoofed users.
Let's go one step further. I have a `curl | sh` script for you to execute to install Docker. Just run:
Oops. That was actually get.rekcod.com, with a RTL unicode character embedded. Or a unicode C which doesn't map to the ascii 'c'. Or I am able to mitm and strip the TLS. Or...The vulnerabilities go on and on. Using only HTTPS, you have no way to prove that the code you got from get.docker.com is the code that the docker engineers intended for you to use.