←back to thread

Microsoft Edit

(github.com)
486 points ethanpil | 5 comments | 25 Jun 25 00:07 UTC | HN request time: 2.716s | source
Show context
ocdtrekkie ◴[25 Jun 25 01:38 UTC] No.44372923[source]▶
It'd be nice if they didn't recommend winget for installation though. winget is an egregious security risk that Microsoft has just like pretended follows even minimal security practices, despite just launching four years ago with no protection from bad actors whatsoever and then never implementing any improvements since.
replies(2): >>44372958 #>>44373306 #
dale_huevo ◴[25 Jun 25 03:03 UTC] No.44373306[source]▶
winget is just Windows developers' version of curl | bash. Yet another example of Microsoft copying Linux features.
replies(2): >>44373331 #>>44376065 #
ocdtrekkie ◴[25 Jun 25 03:08 UTC] No.44373331[source]▶
Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion.

There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.

replies(3): >>44373345 #>>44373356 #>>44373443 #
1. tim-- ◴[25 Jun 25 03:15 UTC] No.44373356[source]▶
> in a reasonably secure fashion

It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/

There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into more/less is not enough to protect you.

replies(2): >>44373469 #>>44373685 #
2. ToValueFunfetti ◴[25 Jun 25 03:44 UTC] No.44373469[source]▶
The parent is talking about MITM, which is prevented with TLS and curl but not winget. They are saying curl is strictly better, not that it is impenetrable. If you trust the domain owner, you can trust curl | bash, but you can't trust winget
replies(1): >>44373557 #
3. tim-- ◴[25 Jun 25 04:11 UTC] No.44373557[source]▶
Why can't I trust winget?

It's not hard to run the `show` command to see what a winget install will do. https://learn.microsoft.com/en-us/windows/package-manager/wi...

It's easy enough to view the manifests (eg, https://github.com/microsoft/winget-pkgs/blob/2ecf2187ea0bf1...) and arguably, is better then the protection for MITM that you would get using naked cURL & Bash, simply because there are file hashes for all of the installer files provided by a third party.

> They are saying curl is strictly better, not that it is impenetrable

Right. But it arguably is not strictly better.

> You can't trust winget

Again, this is not backed up by anything. I have trust in winget. I can trust that the manifest has at least been vetted by a human, and that the application that will be installed should be the one that I requested. I can not trust that this will happen with curl | bash. If the application that is installed is not the one that I requested, there is tooling a process to sort out why that did not happen, and a way to flag it so that it doesn't happen to other users. I don't have this with curl | bash.

4. bee_rider ◴[25 Jun 25 04:46 UTC] No.44373685[source]▶
>> Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion.

> It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline.

I’m confused by this; it seems to be written in the tone of a correction but you both seem to be saying that you get whatever the server sends. (?)

replies(1): >>44373807 #
5. tim-- ◴[25 Jun 25 05:14 UTC] No.44373807[source]▶
> you both seem to be saying that you get whatever the server sends

Yes, but I am also saying that you can't verify that the script that is run on one machine with a pipe is the same script that runs on a second machine with a pipe.

The key part of the original statement is the server can choose to send different scripts based on different factors. A curl&bash script on machine 1 does not necessarily mean the same curl&bash script will be run on machine 2.

The tooling provided by a `curl | bash` pipeline provides no security at all.

With winget, there is at least tooling to be able to see that the same file (with the same hash) will be downloaded and installed.

There are ways to do this better, for example, check out https://hashbang.sh. It includes a GPG signature that is verified against the install script, before it is passed to curl.