Hot take: If we added a "--install" option to #curl, we could optimize many a "| sh -" pipeline away.

[larsmb@mastodon.online]

@vyskocilm Snark aside, with "https" probably as (in)secure as getting the respective package from any community distribution.

[agowa338@chaos.social]

@larsmb But does it also leak to the server that you're using "--install" and not just try to download the file so that when you're trying to just download the malicious script the server can send you a version without the malware instead?

[totenlegionchris@metalhead.club]

@larsmb This should work fine with openclaw!! You are ahead of the time.

[benedikt_lauenburg@norden.social]

@henryk @larsmb misses an ai api call.

[heiglandreas@phpc.social]

@larsmb I was shortly thinking that that is a chicken/egg situation if you want to install cURL via the `--install` option...

[moritzboth@chaos.social]

@larsmb better naming: "--submit" or "--infect"

[l29ah@qoto.org]

@larsmb This is much longer to type than |sh -

[aspragg@ohai.social]

@larsmb Bonus, it would stop people getting confused from typing `sudo curl $URL | sh -` instead of `curl $URL | sudo sh -`

...nope, still nope!

[agateau@mastodon.xyz]

@larsmb What could possibly go wrong?

[ozzelot@mstdn.social]

@tux0r
doas users made a sad face. all five of us.
@larsmb

[amenonsen@mastodon.social]

@larsmb Or `curl --bash`

[tux0r@layer8.space]

@ozzelot @larsmb (sad pfexec noises)

[pianosaurus@c.im]

@larsmb @agowa338 Lets have curl add a "Variant: without_vulnerabilities" header when --install is specified.

[pianosaurus@c.im]

@larsmb @heiglandreas Let's just do a Microsoft, and ship every OS with something that isn't curl aliased as curl.

[fargate@tech.lgbt]

@larsmb This is a plan without a flaw nor any possibility of error!

[mrshark@mathstodon.xyz]

@pianosaurus @larsmb @agowa338

I think RFC 3514 "The Security Flag in the IPv4 Header" have place here.

https://www.rfc-editor.org/rfc/rfc3514

[busterb@infosec.exchange]

@larsmb @tux0r you don't have curl setuid root already?

[cos@sauna.social]

@larsmb it should default to sudo to make things easy.

[andrew@this.wplr.rocks]

@larsmb please make it check a malware filter before passing it to $shell

[tbortels@infosec.exchange]

@larsmb

Not sure how "| sh" is any less secure than what people do 99.9% of the time anyway, which is download an installer or executable and not bother or validate it.

If you really want to change the world, work out an actually secure mechanism (tall order!) and have --install implement it. Not sure what that would look like: https requirement, maybe a database of known/vetted installations, a means to report issues. Very tall order.