News for hackers. Stuff that matters.

A comment on Show HN: tor_ssh.sh – One command to enable SSH access via Tor. Parent comment

Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by ithkuil on Tuesday March 05, 2019 @10:32AM (#19311141)
I wish curl (or a similar tool shipped by default on all distros) had a flag that accepts a hash and verifies that that downloaded file matches that flag before streaming it out

I played around with that idea in https://github.com/mkmik/runck but it obviously can used for installation instructions only if it's rather ubiquitous.

[ Parent | on HN ]
Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by swixmix on Tuesday March 05, 2019 @10:47AM (#19311258)
Integrity of the file after transfer isn't the problem.
[ Parent | on HN ]
Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by kej on Tuesday March 05, 2019 @11:15AM (#19311495)
One possible curl/bash attack is to serve a safe file to browsers but a malicious one to curl. In that case a step where you verify the integrity of the file curl downloads would be useful.

(I seem to recall there being a way for the server to reliably guess whether the file was being piped or saved to disc, as well, which would let you restrict the malicious version even more. Google is failing me at the moment, though.)

[ Parent | on HN ]
Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by badideaprojects on Tuesday March 05, 2019 @11:24AM (#19311583)
This post demonstrates detecting the difference between a user piping the output from curl to bash OR curl to stdout.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[ Parent | on HN ]