alt Hacker NewsHave there been any notable incidents where mistrusting a curl | sh was the cause? I hear people say not to do it way more than I hear people talking about actual incidents it's caused.
Replies
throwaway375 • today at 7:45 AM
One coverage tracker used something like this for recommended CI setup, script was hijacked, users were advised to rotate all credentials available in CI.
cowlevel • today at 6:55 AM
None. It was always a kind of snobbery against packages too small to be in package managers.
There are reasons curl|sh is a bad way to install things but security isn't one. It's difficult to uninstall, for instance.
pcthrowaway • today at 6:42 AM
I mean you really don't wanna run this one
echo -e "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nrm /" | nc -l 8080 & curl localhost:8080 | sh
➕ show 1 reply
I've had a few. Not as security attacks.
More just very badly made install scripts, which (in good faith) destroy some part of my operating system.
Messing up repositories added to package manager, creating dependency conflicts, overwriting config files I used. Even removing full folders - "because it's MINE" syndrome. --dry-run modes that are destructive. A lot of install scripts treat my computer as disposable machine meant for their app only.