I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.

It's nothing new or groundbreaking, but I figure it never hurts to have another reminder.

you are viewing a single comment's thread
view the rest of the comments
[–] 16 points 8 months ago (3 children)

The post is specifically about how you can serve a totally different script than the one you inspect. If you use curl to fetch the script via terminal, the webserver can send a different script to a browser based on the UserAgent.

And whether or not you think someone would be mad to do it, it's still a widespread practice. The article mentions that piping curl straight to bash is already standard procedure for Proxmox helper scripts. But don't take anyone's word for it, check it out:

https://community-scripts.github.io/ProxmoxVE/

It's also the recommended method for PiHole:

https://docs.pi-hole.net/main/basic-install/

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 8 months ago (2 children)

    The reality is a lot of newcomers to Linux won't even understand the risks involved, it's run because that's what they're told or shown to do. That's what I did for pihole many years ago too, I'll admit

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 8 months ago

    Users are blameless, I find the fault with the developers.

    Asking users to pipe curl to bash because it's easier for the developer is just the developer being lazy, IMO.

    Developers wouldn't get a free pass for taking lazy, insecure shortcuts in programming, I don't know why they should get a free pass on this.

  • source
  • parent