Hot take: If we added a "--install" option to #curl, we could optimize many a "| sh -" pipeline away.

[tbortels@infosec.exchange]

@larsmb

Not sure how "| sh" is any less secure than what people do 99.9% of the time anyway, which is download an installer or executable and not bother or validate it.

If you really want to change the world, work out an actually secure mechanism (tall order!) and have --install implement it. Not sure what that would look like: https requirement, maybe a database of known/vetted installations, a means to report issues. Very tall order.

[christopherkunz@chaos.social]

@tbortels Well that's, like... a package manager? Let's call it cURL Universal Package System and abbreviate it CUPS... oh damn.

[tbortels@infosec.exchange]

@christopherkunz

Sadly I think I trust Badger and friends to get it right more than my package manager.

CUPS. Now that's a name I've not heard in a long time...

[brouhaha@mastodon.social]

@larsmb
"| sh" _IS_ the curl install option

[freddy@social.security.plumbing]

@larsmb pair it with some yet-to-be-specified `integrity` parameter to check the file and we're there.

[nilclass@infosec.exchange]

@tux0r @larsmb when curl is invoked with `sudo`, sites should be prohibited from refusing access

[nyansen@elbmatsch.de]

@larsmb maybe --execute will be a better option because its not always a Installation script.

[larsmb@mastodon.online]

@christopherkunz @tbortels Package managers are so awesome we have hundreds.

[larsmb@mastodon.online]

@nyansen Ohhh how about "--rootkit"

[nyansen@elbmatsch.de]

@larsmb for a curl anti cheat system?