logoalt Hacker News

mDyJzDPmBdG • today at 9:32 AM • 3 replies • view on HN

Let's be real, in most cases it is:

    curl -s script.random-guy.net | sh
It is such glaring security hole that there was an old submission about filling such install script with `sleep` commands and detecting it on server side, to send different versions for downloading (and reviewing) and for actual direct execution.

Replies

amiga386 • today at 11:43 AM

    wget https://raw.githubusercontent.com/timofurrer/russian-roulette/master/russian-roulette -O - | sudo bash
tosti • today at 10:10 AM

I use those scripts to improve the likelyhood it'll fail to do anything useful.

I even used uname as a fuzzing tool, and that broke builds spectacularly. There's now a more reasonable uname in the sandbox for builds.

redeeman • today at 10:13 AM

the method you describe is clearly only done by people that are irresponsible and most probably stupid.

and no, this is not how most software is installed

➕ show 1 reply