They just made a list of things to check for. Use more than one checklist to get the best coverage.

It's not a list, I won't be executing a shell script from a organization that cares about having zero day exploits.

The linked repo isn't from the NSA, it's from armosec. Who, afaict, don't have zero days in their possession.

Sorry misread ... You are right. Still, I will not execute a shell script from a github repository to find security issues ...

I actually came into the comments to make a joke about that very thing :-)

Even if you read the file first, you have no guarantees that the file bash gets from curl, should you copy/paste the commands in the readme, is the same thing. Yeah it’s way outside what anyone would ever consider “reasonable” to be that paranoid, the mere mention of certain 3-letter agencies trigger any informed person’s built in “paranoid mode”, and rightly so.

(This is in answer to the below question from another user. I’m too lazy to do two threaded responses on mobile. Maybe if mobile wasn’t such a shit platform with tiny ass screens and software keyboards that didn’t duck up everything you typed-ahh help there it goes again I swear to god Steve when I die I’m coming down there to kick your ass you son of a…)

If you are slightly more paranoid, keep in mind that the file you downloaded for manual inspection may not be the file you download automatically for bash-piping. This article from 2016 was making the rounds on HN about three years ago: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Of course for a properly, professionally paranoid person, you would download every component manually and store the received artifacts locally (for caching, reproducibility, TOFU principle and general BCP needs). Then build from those only. In fact, in high-trust environments it's common for CI systems to not be able to hit internet at all.

Well, this is exactly why it's the open source. You can build everything yourself, check the scripts etc. At the end of the day all these tools are intended to help people find issues as early as possible.

why will you not if you can read the script?

the script downloads a binary blob and copies it into your bin folder. no hash check ... If somebody can replace the binary blob, there's no security check before I would execute it.

do you know that you get the right binary blob?

If you use that to increase your security, ...

The NSA is much like the FBI, it has multiple divisions with different purposes. The NSA has one group that is specifically focused on the security of US public and private entities. They help to find standards that the rest of the US bureaucracy follows to keep their systems secure. On the other hand, the NSA does have hacking hand that is supposed to go after foreign adversaries, and this is the group that will use zero day hack.

> specifically focused on the security of US public and private entities

> this is the group that will use zero day hack

So, the initial comment was right. NSA does keep zero days to themselves so obviously other things are more important than the security of US public/private entities. Otherwise they'd want those patches, but other missions are more important.

For me you have justified precisely why I agree with the parent comment.