News for hackers. Stuff that matters.
Re:Don't Pipe to your Shell by codezero on Friday November 01, 2013 @12:08AM (#6651710)
Counterpoint to the author: have you ever heard of anyone ever having anything catastrophic happen because of this, ever? Have you ever heard of anyone even having it fail with garbage?

I haven't.

Re:Don't Pipe to your Shell by mikegirouard on Friday November 01, 2013 @01:22AM (#6651942)
Catastrophic? I can't claim that. But I can tell you that I had a server drop out on me when installing software this way. Here's a quick quote of the bug report I sent to Linode when I was installing Longview.

    > Bug: Update the nginx (?) error pages to be bash friendly
    > 
    > root@marius ~]# curl -s https://lv.linode.com/nGiB | sudo bash
    > bash: line 1: html: No such file or directory
    > bash: line 2: syntax error near unexpected token `<'
    > 'ash: line 2: `<head><title>502 Bad Gateway</title></head>
    > 
    > This could be done by just dumping out echo statements since its already
    > being parsed by the shell. Additional meta about the request (headers,     etc)
    > could be dumped into comments too…
    > 
    > # 502 Bad Gateway
    > echo 
    > echo "Uh oh: Something went sideways during the install!"
    > echo "("
    > echo "Re-running the installer should clear things up."
    > echo 
    > echo " sudo !!"
    > echo
Re:Don't Pipe to your Shell by codezero on Friday November 01, 2013 @01:25AM (#6651957)
Yep, I agree this is generally bad practice and is prone to error conditions, but I am mainly addressing the article since it is claiming that this should never be done because of the possible catastrophic consequences, and I just don't think that scenario is likely enough to mount a campaign to abolish this practice :)
Re:Don't Pipe to your Shell by hrjet on Friday November 01, 2013 @03:45AM (#6652387)
How many would talk about a catastrophic failure that was caused because of their stupidity.

Many wouldn't.

Re:Don't Pipe to your Shell by mikeash on Friday November 01, 2013 @09:45AM (#6653637)
You're right, let's ignore completely realistic failure modes just because nobody's had it happen yet.