Skip to content

Comment on MaliciousCorgi: AI Extensions send your code to Chinaparent

Comments

How did that even get started? It’s not like downloading a zip or tar file is so terribly taxing.

Convenience, mostly.

  curl -L "foo.sh" -o foo.sh && bash foo.sh
Is just more characters. But you should do it simply because a poorly written bash script can accidentally mess you up when streaming.

Why sudo though?

I honestly think it's stupidity. Most people really don't know you can build programs to the user and don't need system privileges. I think everyone is just so used to installing from package managers and doing `sudo make install` that they forgot programs only need to be in $PATH and not /usr/bin

How is that any safer?

First off, I never used sudo...

Second off, you're not steaming into bash

Third, you gotta read between the lines a little. I used some convenience considering my audience is programmers. Don't use && or shove && `less foo.sh` in the middle. There's a million options here

Don't take the example overly literally. Saving to file means you can read it before executing it.

That aside, it protects you from this gaping hole of an exploit mechanism. https://news.ycombinator.com/item?id=17636792

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.