Hacker News new | ask | show | jobs
by dmbass 3378 days ago
from the article:

> Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.

3 comments

The compounds in this medicine are public knowledge, but taking them could be dangerous. For a safer experience, review all medical literature pertaining to these compounds before consuming.
Not really the same. One of the main issues with curl pipes is that the server (or MITM) can detect that the request goes into a pipe.

This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it.

So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.

How can you detect if the output is curl/piped?
https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.

I would hazard a guess that curl won't send the standard request headers that browsers would.
I actually do just that whenever I decide to self-medicate with a new drug. Were you being facetious?
Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276

That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash

I feel like they should state this first before giving the command. I had to scroll down the page to see this warning.

Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste