Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The installation shortcut given is

  curl -sSL https://install.pi-hole.net | bash
and one is expected to execute this as root.

Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.



from the article:

> Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.


The compounds in this medicine are public knowledge, but taking them could be dangerous. For a safer experience, review all medical literature pertaining to these compounds before consuming.


Not really the same. One of the main issues with curl pipes is that the server (or MITM) can detect that the request goes into a pipe.

This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it.

So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.


How can you detect if the output is curl/piped?



https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.


I would hazard a guess that curl won't send the standard request headers that browsers would.


I actually do just that whenever I decide to self-medicate with a new drug. Were you being facetious?


Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276

That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash


I feel like they should state this first before giving the command. I had to scroll down the page to see this warning.

Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste


Unless you've audited the source, a manual install isn't any better.


No. With a curl install, you cannot audit the source. You cannot know if you have been served the same content as someone else.

You cannot look at version history, check a signed package, etc. etc.

If someone wants to root just a few select machines, you would want people to do a curl install.


If you're going to manually audit the source, you can curl into a file then run bash on it. If you're not going to read the code anyway, there's no harm in curl|bash.


Yes there is, there's a lot of harm, see my comment above.


Hence why I merely opposed actively encouraging this pattern.

I can't stop people from doing potentially dangerous things, but I don't have to promote those things, either.


I don't think the other way is inherently any safer, because people don't tend to actually audit their sources to begin with.



If you care to you can easily view the contents before executing them.

`curl -sSL https://install.pi-hole.net`

It's only 1400 lines of code.

At least it has TLS to prevent a MITM


ಠ_ಠ Looking at brew.sh.


Correction: they corrected it.


You acknowledge the prioritization of ease-of-use/adoption vs. security so I think we're on the same page.

I doubt step-by-step instructions including a review of the script's content would improve the average user's security, in much the same way that click-through ToS dialogs always garner such much scrutiny.

Edit: another comment quoted the warning on the page, at this point it feels like complaining is tilting at windmills.


I do not really see the problem. You have to trust them anyway to run code as root on your computer and the connection is encrypted.


> but I wish people wouldn't actively encourage this pattern

Why do you care so much about what people do or don't do?

Edit: We're talking about blocking ads, right? If people encouraged everyone to block ads what would happen to the economy?


The discussion is about the installation method. Piping to bash can be dangerous.


This superhero attitude, I think, is more dangerous.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: