Comments on Is it a bad idea to pipe a script from curl to your shell?
Parent
Is it a bad idea to pipe a script from curl to your shell?
Online, I often see someone tell people to run a command like /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" (example from https://brew.sh/).
The general pattern is that you download some shell script from an online location and send it straight to your shell.
Isn't this a bad idea? Why do so many developers put it in their instructions? I thought that perhaps the command is not meant literally, but you're supposed to read the more succinct command and compose your own alternative approach. But this seems more common with projects that try to be "user-friendly", ones where you'd suspect their audience is neither aware of the implications of doing this, nor able to analyze what the command does, nor able to construct an alternative approach.
Post
Yes, it's a sloppy practice often joked upon but the security concerns are overblown: Piping unknown code into bash feels scary (and it should), but running make can be just as dangerous. Some install scripts make unwanted changes to .bashrc or to the filesystem so I still prefer to download the script and inspect it before running it (don't re-download the script as it might have changed).
Also, keep in mind that it's notoriously difficult to write a robust shell script. It could wipe your hard drive, even though it was written with good intentions.
Copy-pasting commands from the README isn't secure either. Try copy-pasting the line below:
echo pwned;echo "triple-click and copy me!";echo pwnedAs a developer, you should tell users to prefer packages from their Linux distro, if available. Packages are easier to uninstall, provide integrity via checksums, and are vetted by package maintainers. You should work together with downstream package maintainers and follow common practices to make it easy to package your software.
However, being able to install unpackaged software by running a single command can be convenient if you are inside a throw-away machine like a VM or Docker container.
0 comment threads