"so it can't have been tampered with"
Why that? Have we never heard of defaced web pages?
Granted, using shacat is much better than piping into sh. But basic learning from security breaches is that nothing is safe, you only can find ways to do thing in a less catastrophic manner than others.
Re:Don't Pipe to your Shell
by shawabawa3 on Friday November 01, 2013 @09:22AM
(#6653466)
> Why that? Have we never heard of defaced web pages?
Well if you can't trust the website you're screwed anyway. If the website is compromised then absolutely any way they have of installing software is broken
Unless you verify against a PGP signature with trusted keys.
Good, but in some cases this won't work with latest versions (content will change), plus, you need to add instructions for installing shacat first, which defeats the point of having a single line install. It's always been convenience over security.
I made a utility "shacat", which takes a sha1 checksum as an argument and then pipes input to output iff the sum of input matches the sum
e.g.
You don't even need https! You copy the command from the site including the sha sum, so it can't have been tampered withOf course, getting people to use shacat is the hard part