Selfhosted

I was looking at that very thing last night.

But then I realized, "why can't immich just create usable packages like we had before?" and moped back out.

But, for a moment, I was sure a little inspection and testing would make the Internet equivalent of NYC MTA coin-sucking magically safe. It looked so eeeeasy.

But those are two very different things, I can very easily give you a one liner using curl|bash that will compromise your system, to get the same level of compromise through a proper authenticated channel such as apt/pacman/etc you would need to compromise either their private keys and attack before they notice and change them or stick malicious code in an official package, either of those is orders of magnitude more difficult than writing a simple bash script.

Not completely correct. A lot of updaters work with signatures to verify that what was downloaded is signed by the correct key.

With bash curl there is no such check in place.

So strictly speeking it is not the same.

This is a bit like saying crossing the street blindfolded while juggling chainsaws and crossing the street on a pedestrian crossing while the light is red for cars both carry risk. Sure. One's a terrible idea though.

True, but this is specifically about scripts you think you know, and how curl bash might trick you into running a different script entirely.

No, it is different, as it adds an entire layer of indirection and unknown to the mix, increasing the risk in the process.

Is it different from running a bash script you downloaded without checking it? E.g. the installer that you get with GOG games?

Genuine question, I'm no expert.

And you better inspect and execute a downloaded copy, because a malicious actor can serve a different file for curl/wget than to your browser

Most developers I've looked at would happily just paste the curl|bash thing into the terminal.

I often would skim the script in the browser, but a. This post shows that's not fool proof and b. a sufficiently sophisticated malicious script would fool a casual read

And it's wild how much even that has been absolutely normalized by all these shitty lazy developers and platforms. Vibe coding it just going to make it worse. All these programs that look nice on the surface and are just slop on the inside. It's going to be a mess.

The post is specifically about how you can serve a totally different script than the one you inspect. If you use curl to fetch the script via terminal, the webserver can send a different script to a browser based on the UserAgent.

And whether or not you think someone would be mad to do it, it's still a widespread practice. The article mentions that piping curl straight to bash is already standard procedure for Proxmox helper scripts. But don't take anyone's word for it, check it out:

https://community-scripts.github.io/ProxmoxVE/

It's also the recommended method for PiHole:

https://docs.pi-hole.net/main/basic-install/

Oh the example in the article is the nice version if this attack.

Checking the script as downloaded by wget or curl and then piping curl to bash is still a terrible idea, as you have no guarantee you'll get the same script in both cases:

• Detecting the use of "curl | bash" server side
• Recent implementation of this attack

Yes, this is the correct approach from a security perspective.

Thanks! I like to keep things simple. The colors are based on Counter Strike 1.6. 😁

And if you're into the classic styling, my homepage is a direct homage to my old 2000s sites.