Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by godelski on Sunday March 31, 2024 @12:22AM
(#39881419)
> yo dawg curl this shit and pipe it to sh so you can RCE while you bike shed someone’s unsafe block
Ahhh this takes me back to... a month ago...[0]
At least rust wraps function in main so you won't run a partial command, but still doesn't there aren't other dangers. I'm more surprised by how adamant people are about that there's no problem. You can see elsewhere in the thread that piping man still could (who knows!) pose a risk. Extra especially when you consider how trivial the fix is, especially when people are just copy pasting the command anyways...
It never ceases to amaze me how resistant people are to very easily solvable problems.
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by anonymous-panda on Sunday March 31, 2024 @12:57AM
(#39881565)
It’s worse than that. Build.rs is in no way sandboxed which means you can inject all sorts of badness into downstream dependencies not to mention do things like steal crypto keys from developers. It’s really a sore spot for the Rust community (to be fair they’re not uniquely worse but that’s a fact poor standard to shoot for).
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by sensanaty on Sunday March 31, 2024 @06:00AM
(#39882881)
I actually avoided installing Rust originally because I thought that install page was hijacked by an attacker or something.
Most languages don't have the prettiest install flows, but a random `curl | sh` is just lunacy if you're at all security conscious
Rust is arguably the programming language and/or community with the most secure set of defaults that are fairly impossible to get out of, but even at “you can’t play games with pointers” levels of security-first, the most common/endorsed path for installing it (that I do all the time because I’m a complete hypocrite) is:
https://www.rust-lang.org/tools/install
and that’s just one example, “yo dawg curl this shit and pipe it to sh so you can RCE while you bike shed someone’s unsafe block” is just muscle memory for way too many of us at this point.