Re:Memory safe ‘curl’ for a more secure internet
by bagder on Friday October 09, 2020 @10:47AM
(#24730394)
"For some years" sure, but that's ancient history.
curl has verified the server certificates by default since version 7.10, shipped in October 2002.
Re:Memory safe ‘curl’ for a more secure internet
by tialaramex on Friday October 09, 2020 @11:45AM
(#24731031)
I'm actually just very old. But thanks for the effort put into Curl over all this time.
Re:Memory safe ‘curl’ for a more secure internet
by reificator on Friday October 09, 2020 @12:07PM
(#24731271)
> This is no worse than if you were to have totally-not-evil.example.com give you the bash script on a floppy disk or something.
In practice, perhaps. But detecting whether the file is being piped to bash (and not cat/less/grep/etc) is pretty straightforward.
https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
Re:Memory safe ‘curl’ for a more secure internet
by staticassertion on Friday October 09, 2020 @01:31PM
(#24732281)
Yeah, and it still doesn't matter. Because if you run that command you are already trusting that site with RCE on your machine, so if the premise of the attack is "the site is bad" you were owned anyways.
Re:Memory safe ‘curl’ for a more secure internet
by dllthomas on Sunday October 11, 2020 @03:02AM
(#24744212)
Moreover, the site could be legitimate and ship you something legitimate, but if it's truncated for any reason it could still be a "valid" bash script that now does incorrect things. Consider various prefixes of `rm -rf /tmp/thisscript.working/...`
Re:Memory safe ‘curl’ for a more secure internet
by afwe on Friday October 09, 2020 @10:14AM
(#24730094)
The website could detect whether you are using a regular browser or curl itself to download the .sh file and return something different. So inspecting the .sh using your browser before you run that line would not protect you.
Re:Memory safe ‘curl’ for a more secure internet
by ComputerGuru on Friday October 09, 2020 @11:14AM
(#24730653)
Inspect it by piping to less or vim instead?
Re:Memory safe ‘curl’ for a more secure internet
by reificator on Friday October 09, 2020 @12:09PM
(#24731303)
Still distinguishable: https://news.ycombinator.com/item?id=24731271
What this looks like it does, and indeed does today (modulo bugs some of which could be prevented using Rust) is:
Ask totally-not-evil.example.com for this install.sh resource and then run that as root as a Bash script. This is no worse than if you were to have totally-not-evil.example.com give you the bash script on a floppy disk or something. If you suspect they might actually be evil, or just incompetent, that's on you either way.
But for some years curl didn't make any effort to confirm it was getting this file from totally-not-evil.example.com. Connect over SSL, ignore all this security stuff, fetch the file. So then it's like you just accepted a floppy disk you got in the mail which says it's "from totally-not-evil.example.com" but might really be from anybody. That's definitely worse. Today you have to specify the --insecure flag to do this if you want to (Hint: You do not want to)