[HN Gopher] Looking into an apparently scammy looking zsh plugin...
___________________________________________________________________
Looking into an apparently scammy looking zsh plugin manager called
"zi"
Author : effdee
Score : 105 points
Date : 2024-04-08 20:25 UTC (2 hours ago)
(HTM) web link (recurse.social)
(TXT) w3m dump (recurse.social)
| greggsy wrote:
| .social site seems down or slow
| lutoma wrote:
| Seems to load fine for me right now
| dylnuge wrote:
| It's a pretty small Mastadon instance and I didn't expect that
| this would get the attention it has. effdee shared an archive
| link (https://archive.is/hmvEh) which will work if the server
| isn't responding well, though our server admin has done some
| work to try and fix it.
| effdee wrote:
| https://archive.is/hmvEh
| mcpar-land wrote:
| Piping curl into sh is bad enough. Piping curl into sh _in your
| rc file_ is nightmarish. Even with the "verified" version they
| seem to provide, I can't think of a benevolent explanation for
| that.
| nebulous1 wrote:
| It's just auto-updating. Would be better if it was using the
| github url directly. Should also be using a method less prone
| to corruption
| kamray23 wrote:
| It sort of isn't though. You put it there and you don't take
| it away. You don't put anything else in there to load it. It
| stops loading entirely if you take out the ethernet cable.
| That kind of seems like it's loading from the internet every
| single time. The setup function doesn't add anything to load
| it without the init script running. That's kind of weird, to
| me at least.
| nebulous1 wrote:
| Oh, I didn't mean to imply it was a good way of doing
| things, just that the intent was to auto-update. Regardless
| of how the auto-update works, if a program like this is
| auto-updating then you're giving arbitrary execution
| permission to the project.
| codedokode wrote:
| In Linux there is a package manager for auto-updating.
| codedokode wrote:
| They suggest to verify a hash of downloaded script which
| means that after update the script will not be executed. So
| it just doesn't make sense.
|
| Probably it is an experiment to see how many people will fall
| for this.
| pandemic_region wrote:
| Don't we all do this in our vimrc though with direct links to
| GitHub plugin repos. PlugUpdate?
| fredoliveira wrote:
| This is one of the reasons why I like Lazyvim's plugin spec.
| It allows you to lock plugins down to the commit/tag/etc.
| loeg wrote:
| No?
| DDiggler wrote:
| The "verification" downloads the file twice... seems like one
| could easily make a custom HTTP server to change the second
| consecutive response to a malicious one.
| inopinatus wrote:
| this kind of nonsense, coupled to some very lax coding
| standards, is why I refuse to use oh-my-zsh despite zsh itself
| being a language I've recently enjoyed working in.
| cfreksen wrote:
| I am a bit fascinated[1] by the "verified" version, as it
| fetches from the same URL twice. First I found it inefficient,
| but since they are doing these request for every zsh startup an
| extraneous request is probably not seen as a performance
| problem. Then I realised that the data they verify the hash of
| is not the same copy of the data that they load: An attacker
| controlling the server at the curl'ed URL could serve a
| different file on the second request, which in turn reminded me
| of a blog post describing how to detect `curl | bash` server
| side[2][3].
|
| I think the lesson of this small aspect of the "zi" tale is
| that one should strive to have a single source of truth (a
| single copy of the data served at the URL), and that in
| security contexts one needs to be very precise with exactly
| which guarantees have been established for which data at which
| point in time: it is surprisingly easy to implicitely add an
| assumption like "GET requests returning 200 OK behave like pure
| functions".
|
| [1]: Though this might just be me piling on the mockery of
| their project, for my own amusement and schadenfreude.
|
| [2]: https://www.idontplaydarts.com/2016/04/detecting-curl-
| pipe-b..., alternatively https://web.archive.org/web/2024040613
| 2938/https://www.idont..., discussed here e.g.
| https://news.ycombinator.com/item?id=11532599 (122 comments)
|
| [3]: I am not sure if zsh behaves like bash in this case, as
| in: Does zsh only read part its input before it starts
| executing commands?
| zaphirplane wrote:
| I get what this post is about, but isn't it hyperbole to say
| you can't think of a benevolent reason when the reason given is
| auto update/install
| hughesjj wrote:
| https://github.com/z-shell/zi?tab=readme-ov-file#%E2%84%B9%E...
|
| Well, it appears they do acknowledge it's a fork at least, but
| agreed I wouldn't want this on my computer. The toctou issue is
| ... Bleh.
| segasaturn wrote:
| >But Salvydas isn't lying about one thing. He's good at "SEO".
|
| >By which I mean, his project is beating zsh.org itself in my
| search for "zshell"
|
| Ouch! This is probably the most damning thing in this whole
| article. If I worked at Google I would hang my head in shame at
| how lousy Search results have gotten, but I think the staff at
| Google have been too busy playing in the company ball-pit to care
| ajross wrote:
| Not to ruin your villain buzz, but a quick check shows that the
| same thing (zshell.dev ranks above zsh.org) is true of Bing and
| DDG also. It's probably closer to a root cause to say that
| zsh.org appears to be pretty pessimal from a search
| perspective, like it's being penalized for some reason.
| ohmyz.sh and the wikipedia page routinely rank at the top.
| arp242 wrote:
| I have rarely (if ever) seen anyone write "z shell" or
| "zshell". Maybe in spoken language some people say "z shell",
| but Google can't search that. Everyone just writes it as
| "zsh". It's not surprising that another site which uses
| exactly that word ranks higher - zsh.org barely mentions the
| word "zshell".
|
| And no one is searching for zshell either: https://trends.goo
| gle.com/trends/explore?q=zshell,zsh,ksh,cs...
|
| In short, the example is invalid.
|
| That said, my ranking on Google for "zshell" is Oh My Zsh,
| the Wikipedia article (which is titled "Z shell"),
| zsh.sourceforge.org, and zshell.dev, in that order. DDG is
| similar, except the spam site https://zshwiki.org is ranked
| just before zshell.org ("The Zsh framework can be used to
| develop LGBT inclusion initiatives [..] One of the first
| steps in promoting LGBT inclusion is increasing awareness of
| the issue among porno gay employees").
| dylnuge wrote:
| Yeah, the example was artificial to illustrate that it does
| come up in search results. I think I noted this later in
| the thread, but I originally stumbled onto this while
| specifically searching for some stuff on zprof. I don't
| recall the exact query I used, since I got pretty deeply
| sidetracked once I landed here.
| p9fus wrote:
| My only question is... why?, I understand pretending to be
| something official when you're really not at all so you can
| profit off the confusion, that trick is a dime a dozen on the
| internet... but zsh? Really? Surely there are more profitable
| ventures wearing the skin of a free shell for Unix operating
| system?
| anthk wrote:
| mksh/oksh and simple setup for life.
|
| For instance: alias ls='ls -F'
| jdorfman wrote:
| I will get ahead of this since my name is in this Mastodon
| thread.
|
| - I volunteered to help make the Bash and ZSH logos
|
| - I have nothing to do with "zi", I never heard of that project
| or the people involved.
|
| Thank you.
| jimrandomh wrote:
| The project tells people to put a line in their zshrc which
| fetches and runs a script. To spell out why that's worse than a
| normal auto-updater would be: it enables the server operators to
| distinguish users who have installed it in a way where they can
| serve malware, from users who are downloading it once for
| inspection purposes. For example, they could serve malware only
| to IP addresses that have fetched the script every day for a
| month. Random curious developers and security researchers are
| very unlikely to do that, but someone who actually put this line
| in their zshrc would.
|
| This would also explain why it's pointed at the developer's
| server, rather than a GitHub URL: if it were a GitHub URL, it
| would be impossible to do malicious substitutions like this.
| Sylamore wrote:
| Nevermind that it's possible to detect server-side if the
| content is being simply downloaded, or piped into a shell for
| processing so that you can change the content based on the way
| it's accessed.
|
| http://web.archive.org/web/20240406132938/https://www.idontp...
| (archive because HSTS and the cert is expired).
| tronicdude wrote:
| FWIW, I've used zshell for years now and had a great experience.
| When vetting it against the other zinit fork, it seemed better
| documented and more active (new features still being added) while
| the other fork was simply archival. The dev has been extremely
| responsive whenever I've had issues or questions.
|
| This is all that is in my zshrc: # Install Zi if
| not already installed if [[ ! -f $HOME/.zi/bin/zi.zsh ]];
| then print -P "%F{33} %F{160}Installing
| (%F{33}z-shell/zi%F{160})...%f" command mkdir -p
| "$HOME/.zi" && command chmod go-rwX "$HOME/.zi" command
| git clone -q --depth=1 --branch "main"
| https://github.com/z-shell/zi "$HOME/.zi/bin" && \
| print -P "%F{33} %F{34}Installation successful.%f%b" || \
| print -P "%F{160} The clone has failed.%f%b" fi
|
| This seems like a bit of an overreaction to someone contributing
| open source software. Every component of zshell is open
| (including the website) under the github organization. If they
| fucked up the checksum version of the download (didn't exist when
| I started using zshell), submit a PR maybe? As far as the
| accusation that they're trying to look like official Zsh: the
| description for the website and repo is literally "A Swiss Army
| Knife for Zsh - Unix Shell." You cannot miss it.
|
| I don't have a dog in this but this is clearly an overreaction.
| ss-o has put a lot of time into this and made the _best_ zsh
| plugin manager imo. Calling it "scammy looking" and "boo hoo he
| works in marketing" is a cheap blow.
| dylnuge wrote:
| I'll say it's entirely possible this is an overreaction. I was
| writing up a fun weekend investigation of a weird looking
| project as I dug into it. There's a reason it's a series of
| posts on Mastadon and not anything more formal than that.
|
| To clarify one thing, I'm not concerned that they "work in
| marketing". I am concerned that that the marketing page is
| fake: it's a bunch of AI generated faces and fake LinkedIn
| profiles. This does not lead me to the conclusion that they
| work in marketing at all.
|
| As for your version of the script, it still strikes me as a
| _little_ weird (why put a self-install inside the .zshrc that
| is only expected to run once per system you have it on), but
| clearly far less concerning than the version they have in the
| current docs.
|
| All code execution involves some degree of trust. There's
| enough here to make me personally not trust the developer, but
| if the information here doesn't give someone else the same
| qualms, that's entirely fine.
___________________________________________________________________
(page generated 2024-04-08 23:01 UTC)