Skip to main content

Posts

Showing posts with the label security

The Curl Pipe

If anything deserves to be called an anti-pattern it is probably the common and worry-inducing practice of documenting your installation process by asking asking users to copy and paste a line into their shell that will snag some file off the internet and pipe its contents directly into your shell to execute. Sometimes this is even done as root. This is something known to be awful, but which remains a cornerstone via its use by some of the most important tools in our belts. Homebrew does it. NPM does it, too. And some projects look better, but are they? Pip asks you to download get-pip.py and run it to install, which isn’t practically any different than piping from curl, just less efficient. But worst of all, we might as well be doing this even more often, because our most depended about tooling is all just as guilty even without doing the curl pipe sh dance. What do you think happens when you pip install your favorite Python package, anyway? Pip downloads a file from the int...

Public Personal Data and the Balance We Walk

Of Auto-Authenticating URLs, Shortlinks, and Danger

The road to hell is paved with good intentions, they say. So, it was a good intention when someone (not me) decided to install a link shortener and send password reset links through it, before producing the printed newsletters that would be sent out to individual members. They would need to type the URLs in by hand, so a shorter URL was a good idea. At least, it must have seemed like it, at the time. Today I took a look at this system, which I was asked to clean up before it gets used again after several months of being ignored. I admit it didn't click in my mind immediately, but after producing some newsletter content in our staging system and verifying the shortlinks were being recorded properly, it suddenly jumped out of the screen and bit me on the nose: The shortener was producing sequential links for a bunch of password reset links. What this meant in practical terms is that two newsletters sent out with password reset links for two different users would send ...

How To Limit Application Trust

Why is it when I see an application in the Chome Web Store I see a little notice about what permissions the app will have, and I'll see a similar list of permissions before installing an Android application? Why is it that I don't see something more like this?