But this USB drive I found in the parking lot is shaped like a Super Star Destroyer from Star Wars! It's even officially licensed by Disney. It can't be bad. I'll just plug it in once.
I used to have an extra computer we called the virus because it was used exclusively to test dubious devices and software. It was an older system so if it died it died. Got Back Orfice on it once and decided to play with it. Was kinda of neat.
Real professionals know more about their job than they let on because they know if they gave 100% all the time, they'd never get promoted as they'd be considered "too valuable"
There once was a techie named Drew,
Whose system got wrecked out of view.
He ran scripts with sudo,
Got malware in lieu —
Now Sudocrem's his skin layer anew!
I never understood this concern. People download and execute code from the internet constantly, with admin permissions. Why is it worse if you use the terminal to do it?
Code you download and execute from the internet can (and probably should) be signed. Certainly, all my repositories deliver signed packages. When you run a bash script directly from a server, you're relying on it not being compromised, every single time. There's no code signing there.
Sure, for the average Joe that's true. But the kind of people running curl in the Terminal are the same kinds of people that generally understand the dangers of granting admin permissions to software, and it doesn't seem to bother them when it's an installer they downloaded off the internet.
Or, they're blindly following instructions on some website. I understand what I'm doing and there's no chance I'd ever pipe curl or telnet into a shell, privileged or not, despite having seen installation instructions to do both of those things.
This ultimately comes down to trust. A shell script piped from a shady website has the same bottom level of trust as an installer downloaded from the same shady site, or picked up from an email attachment, or pulled from a random flash drive one found in a cafeteria.
When we talk about packages from a Linux repo distro, yes they usually do pre installs and post installs that can be real shell scripts after all. Ultimately, you trust that the pkg maintainers have sanitized what is there, but clearly this can never be 100% safe, just safer than doing curl | bash.
Comments
I didn’t need coffee coming out my nose though.
This one opened her eyes to make sure I wasn’t dying and promptly went back to her early morning nap.
You are welcome 🤗
Whose system got wrecked out of view.
He ran scripts with sudo,
Got malware in lieu —
Now Sudocrem's his skin layer anew!
Why are the CPU fans running full speed now?
/s