Sean Cassidy

I'm pretty sure the OP is intentionally not doing this because piping commands/things-from-the-internet into "bash" (or anything else) is generally considered bad practice. For me, I'm all for this. Anyone that is aware of the security implications is extremely likely aware of how to make the conversion like you've provided. In that case, no reason to tell people, because they already know. But it's not a great thing to tell noobies to do because they will get burned. So don't tell them. As they advance they'll naturally learn about this feature. And hopefully they have learned the implications by the time they learn how to do this. (not me): https://www.seancassidy.me/dont-pipe-to-your-shell.html

As others have said, blinding executing a ruby script directly out of a GH repo is risky (to put it mildly). Sure, you have to have some trust in the whole infrastructure at some point, but the number of times I've seen this type of thing blindly posted and followed boggles my mind. Here is a post talking about the issue and pointing out non-malicious issues: https://www.seancassidy.me/dont-pipe-to-your-shell.html

No, I'm sorry, I seriously don't understand how that applies in this case. How is "trusting the content you get from `apt-get`/`dpkg`/`pacman`" safer than curling-to-bash? In both cases, you are downloading and installing content from a trusted source (assuming you are curling via https to avoid MITMs). In the curl-to-bash case, you have the _ability_ to at least inspect the code first before you install it (though, realistically, how many folks would really have the dedication and the ability to do so?), whereas with package managers you're installing "blind". Doesn't that make curling-to-bash the _safer_ option? I clearly must be missing something, here, because everyone decries "curling-to-bash" as a bad security practice, but I haven't seen an explanation of _why_. I tried doing some research for myself - this page[1] suggests that package managers have built-in checksumming and signature verification, but then goes on to propose an attack vector where the load balancer is compromised, so (presumably?) those same checksums/signatures could also be intercepted and faked. This gist[2] has a lot of people speaking against it, but from following those links, the only downside I could see was here[3], pointing out that the shell will keep executing if a connection closes mid-stream - which, yes, is certainly a bad thing and a good argument to use package managers, but not what I would call a security concern (unless you don't trust the entity on the other end of the stream -…

Enpass user here since sheesh, probably 2016? It was whenever the 'LostPass' [1-2] security scandal broke and shortly after Logitech acquired LastPass, after which the usual 'corporate suck' had set in. I had used LastPass for a good seven or more years before switching to Enpass. Enpass has given me good cross platform support, especially like that I'm not a 2nd class citizen on loonix systems. My only gripe would be that it's not open source, but I think the company does a good job of allowing you to keep and sync your data locally, without constant pushes to whore it out to 'the cloud'. [1] https://www.seancassidy.me/lostpass.html [2] https://betanews.com/2016/01/16/lastpass-lostpass-passwords/

https://news.ycombinator.com/item?id=6650987 https://blog.dijit.sh//don-t-pipe-curl-to-bash https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://www.seancassidy.me/dont-pipe-to-your-shell.html

A package manager. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://news.ycombinator.com/item?id=12766049 Bonus points: serving a different script to people piping to bash, and those not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

The more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html

As long as the extension UI is rendered where the page can also render something, it will be vulnerable to phishing. E.g. https://www.seancassidy.me/lostpass.html

I write down what I learn sorta like Marcus Aurelius did in his Meditations. I find it useful to revisit them every so often, not just to remind myself what I learned, but to see what I thought was important. https://www.seancassidy.me/meditations-redux.html

https://www.seancassidy.me/dont-pipe-to-your-shell.html For one.

<a href="https://www.seancassidy.me/images/lastpass_login.png"><img src="/images/lostpass_login.png" I clicked on the thumbnail to examine it more closely, and was briefly confused, then amused that it pointed to the real one. I think this quite nicely shows why hiding the URL scheme is NOT a good idea; otherwise it would show this, which is far more obvious to indicate that the page is either from the extension or not: http://chrome-extension.pw/:/... chrome-extension://... Ironically, it wasn't that long ago when browser designers thought completely hiding the URL bar was a good idea.

This article sums it up better than i can do. http://www.seancassidy.me/dont-pipe-to-your-shell.html

Would you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful? http://www.seancassidy.me/dont-pipe-to-your-shell.html

You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-agent, and so you're not getting the code you think you're getting... ... even aside from these issues, curl-and-pipe-to-sh is dangerous because of its failure modes. https://www.seancassidy.me/dont-pipe-to-your-shell.html

This article completely neglects to mention the other dangers of this pattern, namely what happens when the connection drops mid download[1] or the server responds differently based on user-agent or IP[2]. [1] http://www.seancassidy.me/dont-pipe-to-your-shell.html [2] http://www.djm.org.uk/protect-yourself-from-non-obvious-dangers-curl-u…

> Aren’t abstractions supposed to make things easier to learn? Not always. Some abstractions are designed to make it easier to solve hard problems correctly (than without the abstraction). For example, consider Rust's memory model. Many people criticize that model as difficult to learn. By comparison, you might argue that C's memory model is simpler to learn. Yet, the C approach to allocating, using, and freeing memory is highly error-prone. C programs historically have frequently had mistakes such as use-after-free errors, or buffer under/overflow/reuse errors. The high-profile OpenSSL Heartbleed vulnerability was an example of a weakness in C's memory model and memory handling abstractions [1]. Rust's memory model may be more difficult to learn than C's, but once learned, they are abstractions that provide an advantage in building correct software, by ruling out certain classes of mistakes. (GC in languages like C# and Java and Go can also prevent these mistakes, but comes with a runtime cost. Rust aims to provide zero-cost abstractions.) Building correct async IO programs using kernel abstractions is difficult for similar reasons as it's difficult to write correct programs with C's memory model. It's especially difficult if you want the async IO program to be portable across multiple OS/kernels. I have not used Tokio, but I would guess that its Rust-powered abstractions will make it difficult or impossible to leak memory or sockets, or to fail to handle error cases…

> No true blogger would wilfully misunderstand a buffer overrun vulnerability in order to score some cheap pageviews. You may want to read up on Ted, and realise that when he writes > if we don’t actually understand what vulnerabilities like Heartbleed are he's probably talking about you. > Basically, he's explicitly re-using a buffer, no buffer was overrun. Which is essentially what happened in heartbleed. Heartbleed was not a buffer overrun at any point. Here's the tl;dr: during heartbeat, OpenSSL would malloc both input and output buffers at the caller-specified size (65536 bytes), copy a caller-provided input (1 byte) to the input buffer then copy the whole input buffer to the output buffer. Anything beside the overwritten byte would likely be previously written data since neither malloc nor free zero out their stuff by default[0], essentially leaking 65k of random data every time. This was compounded by OpenSSL doing its own memory management via freelists, making it even more likely interesting data would be present in the input "garbage" and precluding OS mitigations (such as BSD's malloc.conf framework[1]), not to mention the unmitigated (no freelist) codepath had bitrotted and didn't actually work even if you knew how to enable it[2]. Note that [1] and [2] are by TFAA, and that he's an OpenBSD and LibreSSL core contributor. [0] http://www.seancassidy.me/diagnosis-of-the-openssl-heartbleed-bug.html [1]…

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-curl1-to-sh1 and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-install-sh… . There was also a blog out there collecting instances of this, but I couldn't find it again after a couple searches. I had to hold my nose and paste some commands like this in order to reinstall Composer [1] and Drupal Console [2] earlier this week. Ugh, it feels so dirty, but it's often the first and/or the easiest, if not the only, way that software like this documents how it's to be installed. 1. https://getcomposer.org/doc/00-intro.md#globally 2. http://drupalconsole.com

>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords. 4. The bug in (3) wasn't fixed properly, which lead to this [5] Other bugs, but not as terrible as the ones I listed above Jul 27 2016 [6] Mar 25 2017 [7] Jun 17, 2015 [8] Nov 17, 2015 [9] You are also forgetting a whole another class of attacks - Phishing [10] [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 [2]: https://news.ycombinator.com/item?id=13924737 [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 [4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-… [5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&des… [6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=884 [7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&des… [8]: http://www.businessinsider.com/security-expert-describes-lastpass-vuln… [9]:…