Hot take: If we added a "--install" option to #curl, we could optimize many a "| sh -" pipeline away.

[agateau@mastodon.xyz]

@larsmb What could possibly go wrong?

[ozzelot@mstdn.social]

@tux0r
doas users made a sad face. all five of us.
@larsmb

[amenonsen@mastodon.social]

@larsmb Or `curl --bash`

[tux0r@layer8.space]

@ozzelot @larsmb (sad pfexec noises)

[pianosaurus@c.im]

@larsmb @agowa338 Lets have curl add a "Variant: without_vulnerabilities" header when --install is specified.

[pianosaurus@c.im]

@larsmb @heiglandreas Let's just do a Microsoft, and ship every OS with something that isn't curl aliased as curl.

[fargate@tech.lgbt]

@larsmb This is a plan without a flaw nor any possibility of error!

[mrshark@mathstodon.xyz]

@pianosaurus @larsmb @agowa338

I think RFC 3514 "The Security Flag in the IPv4 Header" have place here.

https://www.rfc-editor.org/rfc/rfc3514

[busterb@infosec.exchange]

@larsmb @tux0r you don't have curl setuid root already?

[cos@sauna.social]

@larsmb it should default to sudo to make things easy.

[andrew@this.wplr.rocks]

@larsmb please make it check a malware filter before passing it to $shell

[tbortels@infosec.exchange]

@larsmb

Not sure how "| sh" is any less secure than what people do 99.9% of the time anyway, which is download an installer or executable and not bother or validate it.

If you really want to change the world, work out an actually secure mechanism (tall order!) and have --install implement it. Not sure what that would look like: https requirement, maybe a database of known/vetted installations, a means to report issues. Very tall order.

[christopherkunz@chaos.social]

@tbortels Well that's, like... a package manager? Let's call it cURL Universal Package System and abbreviate it CUPS... oh damn.

[tbortels@infosec.exchange]

@christopherkunz

Sadly I think I trust Badger and friends to get it right more than my package manager.

CUPS. Now that's a name I've not heard in a long time...

[brouhaha@mastodon.social]

@larsmb
"| sh" _IS_ the curl install option

[freddy@social.security.plumbing]

@larsmb pair it with some yet-to-be-specified `integrity` parameter to check the file and we're there.

[nilclass@infosec.exchange]

@tux0r @larsmb when curl is invoked with `sudo`, sites should be prohibited from refusing access

[nyansen@elbmatsch.de]

@larsmb maybe --execute will be a better option because its not always a Installation script.

[larsmb@mastodon.online]

@christopherkunz @tbortels Package managers are so awesome we have hundreds.

[larsmb@mastodon.online]

@nyansen Ohhh how about "--rootkit"