Comment by MrDrMcCoy

2 months ago

Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability.

10 comments

MrDrMcCoy

Reply
gruez  2 months ago

Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways?

  • LelouBil  2 months ago

    Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.

    While in this case docker is not a random website, it's best to use the package manager when available

    • curt15  2 months ago

      > Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.

      Is installing docker from docker own APT repo actually safer than curling a binary from docker's website?

      1 reply →

    • KaiserPro  2 months ago

      To just hammer that home:

      each package is signed by the person who packages it. That means that if you are pulling from a random place, you can be reasonably sure its the same package because the keys verify.

      As pointed out piping curl to bash is problematic. Sure you can go to a browser and check the output, but one of the more fun hacks is detecting if curl pipeing to bash server side and dynamically re-writing the script during serving.

      tldr: So long as the package keys are verifiable, you can download a packge from a random mirror and be reasonably sure that it came from who it says it did.

      Curl you have no hope, and its possible to infer during execution that you are piping to bash.

      1 reply →

  • MrDrMcCoy  2 months ago

    Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch.

karel-3d  2 months ago

this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison