Friday, March 11, 2011

Treating security loosely

I don't want to sound like a grumpy old man, but anyway sometimes I get really surprised how people treat security these days.

I was going to try gitflow (which seems to be quite interesting thing to adopt by the way) today and was reading documentation on the installation process. Believe it or not, the suggested installation way on linux system is:

$ wget --no-check-certificate -q -O - | sudo sh

Yes, you're right, it's like that: downloading a random script from the internet and executing it from 'root' without extra checks. Certainly, it's up to you if you trust the source and sure that it doesn't have any malicios code (generally, it's better not to trust). But anyway, such installation schema should be improved:

  • SSL verification shouldn't be disabled, so you're sure that you're actually downloading your file from github, not from some source identifying itself as github

  • Control checksums should be provided or the file should be signed with gpg to make sure you're downloading exactly the same thing as author uploaded

Without it executing such a command seems to be plain dangerous.

No comments:

Post a Comment