zlacker

[return to "The browser catches homograph attacks, the terminal doesn't"]
1. accoun+2Z3[view] [source] 2026-02-04 13:54:38
>>MrBudd+(OP)
> curl -sSL https://install.example-cli.dev | bash # safe

This is not and has never been safe.

◧◩
2. digita+VZ3[view] [source] 2026-02-04 14:00:16
>>accoun+2Z3
It's about as safe as trusting all the add-ons in your IDE, and all the packages your node app pulls from random package repos.

It's just the plausible blame that shifts.

If you read the script before you pipe it into your shell, it's safe.

And if that's not safe, then it's just as dangerous to trust that an unopened bottle of ketchup is safe.

Nothing is safe. Everything is a judgement. Being culpable is a professional service. Lucky people out-earn unlucky people. The world is a scary place.

◧◩◪
3. polite+Aba[view] [source] 2026-02-06 06:07:14
>>digita+VZ3
No, not really. This reads like ornate hand waving to distract from different threat models and situations.

A lot of safety is down to accountability. A distribution through an attributable marketplace or being verifiably signed.

Safety isn't a performative action, so reading a script may still confuse you or you may miss subtleties. But opting for a safer install mechanism makes a huge difference, which is we always ought to prefer apt, dnf, over the likes of curlbash, brew, npm.

◧◩◪◨
4. mayhem+reb[view] [source] 2026-02-06 15:03:58
>>polite+Aba
I'm Not sure that I agree that it is automatically safer to prefer apt or dnf, and I'm definitely sure that it is not safer to prefer npm.

Safety is about managing risk. One element of managing risk is evaluating trust. I'm thinking that there are much fewer people I have to trust by copying the curl | bash install method from homebrew's secure website.

But at any rate, I completely agree that piping a curl'd script directly to the shell should be considered unsafe, even if it's from a trusted source. It's quite easy to do additional checks to reduce your risk significantly for this type of attack. You could read the contents of your clipboard with a hex editor and check for non-ascii characters. But wait? How do I install the hex editor? Don't I need a hex editor to check the install method of the hex editor? AAAAH! It's turtles all the way down!!!!

[go to top]