Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not that it would fix anything, but wouldn't it be possible to:

- Store the install script on www.xyz.com/install.sh

- Store the hash of the install script on www.abc.com/hash.dat

Then in the installation command:

- curl the install script from www.xyz.com/install.sh

- hash it

- curl the hash from www.abc.com/hash.dat

- compare the computed hash with the "curl'd hash"

- only if they match, pipe www.xyz.com/install.sh to bash

In that case, a malicious actor would need to hack at least two locations to be successful.



The malicious actor would simply edit the install script to comment out the checksum verification step, since they already own the script.


Ah yes...good thing I don’t work in IT security...


No worries, I've made the same mistake and everyone in software security probably makes that mistake at some point.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: