Hacker News Reader

Full thread

wannacboatmovie

I thought OpenBSD people were more security conscious than this madness:

$ curl https://randomwebsite | sh

but alas I was wrong. There is a certain security reality distortion field that accompanies running OpenBSD.

View on HN

The script is running on macOS and is what the Asahi project recommends when updating or installing m1n1/Linux:

https://asahilinux.org/

It's called out in the OpenBSD/arm64 installation notes, at least:

https://cdn.openbsd.org/pub/OpenBSD/snapshots/arm64/INSTALL....

Search for "Install on Apple Silicon".

That seems to be the installer for Asahi Linux: https://asahilinux.org/

Whatever it is, why do people scream about buffer overflows and insecure passwords and overcomplicate everything in the name of security...

... and after that they run externally sourced scripts without even making a local copy ... let alone give them a cursory look ...

I think this is right. We routinely check the integrity of the packages and installers that we download using cryptographic hashing. OpenBSD even has a dedicated tool for this purpose.[1] It would make sense to take the same approach with curled shell scripts.

[1] http://www.openbsd.cl/papers/bsdcan-signify.html

Reply on news.ycombinator.com