Hacker News Reader

Comment by MaxLeiter | Hacker News Reader

Disappointed to see Marcan et al asking users to blindly copy and paste a curl command from the internet.

“Ready to give it a shot? Make sure to update your macOS to version 12.3 or later, then just pull up a Terminal in macOS and paste in this command:”

Other than that, fantastic work and I look forward to eventually having an M1 to run Asahi on

Edit: I just wish the wording would encourage you to verify the file. I don’t think there’s something inherently wrong with using shell scripts from the internet. But massive companies let domains expire, why won’t marcan?

View on HN

You’re about to take his code and run it as a bootloader and you have concerns with piping a command into a shell?

If a hacker has the skill to make an evil boot loader, I'm prepared to be impressed. In contrast, creating a shell script to do something evil is literally the definition of a script kiddie.

At the very least, instead of the one liner give me a two liner: one to download to a file, then a second line to execute it.

> If a hacker has the skill to make an evil boot loader, I'm prepared to be impressed.

Prepare to be impressed, the bootloader this installs to be able to boot Linux was first made for the capability of transparently running macOS under its hypervisor intercepting every hardware call transparently and streaming it to remote PCs to enable reverse engineering.

The point is not about running the code, it is about verifying you are running the code you intend to run. That is why I would prefer the instructions to be: download the code, compare against this checksum, then run it. The curl pipe thingy makes it too easy to inject entirely different code.

The site telling you the checksum before you download the script from the site gives you no additional security. If the site is compromised then the site is compromised.

Of course the check sum would need to be distributed on a different path. A different site or just via Twitter.

The site's instructions telling you where to find the checksum isn't any different than the site's instructions telling you the checksum.

If you're intentionally verifying what's on the site via a completely separate independent method (which is what you need to do to actually verify what's on the site is what should) then it doesn't really matter what the instructions on the site say in the first place as you just decided you're not relying on them for the verification.

What is still needed but not implemented yet is hashes inside the served script for content it pulls from the 3rd party CDN. That said there is a reason it's alpha.

checks off square on HN bingo card

We should crowdsource a good HN bingo card. It would probably be a great drinking game.

It's not quite what you're talking about, but this comment is a great HN parody that could provide a lot of ideas: https://news.ycombinator.com/item?id=23003595

I think I saw a 'let me explain to you why you're wrong above', so I think I'm doing well.

It's a curl command from a domain he controls, what's the difference between that and downloading a binary?

I would also encourage not distributing binaries without checksums available on multiple sources

The checksum only proves it came from where it says it did without modification. You still have to trust the original author to be honest about what the code really does.

And thanks to the nature of open-source it's possible to audit and verify that. (I'm not saying that's necessary in this case)

Right, but I would know it is code from the original author and not modified by anyone, who might gain access to the download server.

The problem is, this install is open for exploit for anyone, who manages to access content on that server. A single exploitable security hole in the web server or its setup, and you can easily compromise anyone installing Asahi Linux. As you are even running a shell script, it is sufficient to inject one line into the installation script, which also installs malware while installing Linux.

Yes I too worry about running a shell script from the person whose kernel modules I'm about the install.

I am not worried that Hector writes bad shell scripts, I am worried, someone might inject something malicious.

Let's say he instead did a traditional installer link. Would it be any different for most users? Nobody actually checks the checksum.

Somehow that feels way safer.

I guess it’s not, but it feels like it is.

Yeah - except if you owned the domain, you can also change the posted hash you are comparing against. Security theater mostly.

It's mostly for applications which hosts their binaries on third party servers

Or he posts the hash on another service

That's why you validate it against wayback machine, mailing list archives, multiple devices, and so on.

A traditional installer for mac would be signed, though. Which only really means someone paid $99 to Apple.

> Nobody actually checks the checksum.

This is incorrect. For hardened installations, it is an absolute must.

That being said, I don't see that as being reasonable to expect for this alpha distro.

Maybe Alpha means something else in your circles. Most places it means “extreme early preview”

For anyone who would be running curl, you can easily not pipe to shell and inspect the script yourself.

curl and perl

Reply on news.ycombinator.com