News for hackers. Stuff that matters.

A comment on Ask HN: So you moved off Heroku, where did you go?. Parent comment

Re:Ask HN: So you moved off Heroku, where did you go? by joshmanders on Tuesday October 04, 2022 @12:48PM (#33083058)
> No one should be running that without personally verifying each line.

Ok, if you feel so strongly about it, then before you paste the link into your terminal and hit enter to execute it, how about you uh... open the shell script it will execute in your browser and read the contents of it?

You use this idea that people are executing stuff they don't know and blaming the tools for it but don't think to read the script yourself?

[ Parent | on HN ]
Re:Ask HN: So you moved off Heroku, where did you go? by adamckay on Tuesday October 04, 2022 @04:11PM (#33086040)
> Ok, if you feel so strongly about it, then before you paste the link into your terminal and hit enter to execute it, how about you uh... open the shell script it will execute in your browser and read the contents of it?

As an FYI - unless the script is on a site like GitHub (which you can assume to be behaving truthfully), it's possible for a server to respond differently according to the user agent, allowing a malicious file to be served if it's downloaded via `curl` or `wget`.

https://www.onsecurity.io/blog/careless-with-curl-dont-be/

[ Parent | on HN ]
Re:Ask HN: So you moved off Heroku, where did you go? by joshmanders on Tuesday October 04, 2022 @05:01PM (#33086811)
As an FYI - The bash script downloads it and then runs bash on the file created on your local system, there's no way to determine if the user is downloading and piping directly into bash or if they're just downloading the file, so change the script before executing from

    wget -q https://get.coollabs.io/coolify/install.sh -O install.sh; sudo bash ./install.sh
to

    wget -q https://get.coollabs.io/coolify/install.sh -O install.sh; cat install.sh
Once the script is locally on your file system there is no way to change the contents.
[ Parent | on HN ]
Re:Ask HN: So you moved off Heroku, where did you go? by adamckay on Tuesday October 04, 2022 @05:59PM (#33087644)
Yep. My response was specific to your comment of reading in browser which is not a guarantee of what's downloaded.
[ Parent | on HN ]
Re:Ask HN: So you moved off Heroku, where did you go? by joshmanders on Tuesday October 04, 2022 @07:36PM (#33088707)
My apologizes, I interpreted it as a "yeah but they can change it so you can't trust it!!!1!" response.
[ Parent | on HN ]