I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.

It’s nothing new or groundbreaking, but I figure it never hurts to have another reminder.

  • xylogx@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    6 months ago

    Signatures do not help if your distribution infra gets compromised. See Solarwinds and the more recent node.js incidents.

    • axx@slrpnk.net
      link
      fedilink
      English
      arrow-up
      1
      ·
      6 months ago

      Please tell me you are not seriously equating a highly sophisticated attack line the Solarwind compromise with piping curl to bash?