1

I recently installed Homebrew on my Mac using the UNIX command from the Homebrew homepage

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

When the command downloads the Ruby script, does it secure the connection to the GitHub server using TLS or SSL? In other words, is there any chance that I could have downloaded a malicious script if someone intercepted my connection?

Also, can someone please explain each of the options, flags, switches, etc. included in the command above?

2

You can't know for sure, at least not based on the information you shared in the question:

  • It's a https connection so it should be secure
  • Nevertheless you could connect through a network which tricked/forced you to accept a new certificate and then performed a man-in-the-middle attack
  • Somebody could have tampered with the script on Github, resulting in an attack within the script you've downloaded
|improve this answer|||||
  • Does curl verify the connection by default if the URL contains https://? I was using a secure home Wi-Fi network, so does that mean that a MITM attack could not have occurred? – Ben Z. Feb 21 at 13:41
  • @BenZ. According to the man page you need to specify -k for "unsecure" SSL connections. As for your home Wi-Fi: in theory MITM can occur on any node in a connection. – nohillside Feb 21 at 14:49
1

In addition to the answer by @nohillside:

can someone please explain each of the options, flags, switches, etc. included in the command above?

Here's the install command-line:

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Here's the breakdown of the various options (from the respective man pages):

ruby flags:

  1. -e: Specifies script from command-line while telling Ruby not to search the rest of the arguments for a script file name.

curl flags:

  1. -f: (HTTP) Fail silently (no output at all) on server errors. This is mostly done to better enable scripts etc to better deal with failed attempts. In normal cases when an HTTP server fails to deliver a document, it returns an HTML document stating so (which often also describes why and more). This flag will prevent curl from outputting that and return error 22.

  2. -s: Silent or quiet mode. Don't show progress meter or error messages. Makes Curl mute. It will still output the data you ask for, potentially even to the terminal/stdout unless you redirect it.

  3. -S: When used with -s, --silent, it makes curl show an error message if it fails.

  4. -L: (HTTP) If the server reports that the requested page has moved to a different location (indicated with a Location: header and a 3XX response code), this option will make curl redo the request on the new place.

|improve this answer|||||
0

In my opinion with the details given you can't tell anything except:

If the connection used a secure line, it was for sure TLS:

raw.githubusercontent.com supports TLS only and more specific TLS 1.0-1.2 (Report) but no SSL (2|3) variant.


It's rather unclear (or I don't know it?) whether cURL falls back to unsecure HTTP (the brew install script is also available via HTTP) if you do not force an SSL/TLS connection (e.g. --tlsv1.0). This might also depend on your cURL and system version.

|improve this answer|||||
-1

Yes, the connection is made using https, which uses TLS. Nothing is 100% secure, but it's as secure as online banking sites, etc. The file is fetched using curl. Type man curl to see all the parameters. In this case:

  • -f : fail - do not show server errors
  • -s : silent - don't show progress meter etc.
  • -S : show-error - show an error on failure (other than server errors)
  • -L : allow redirect to another URL
|improve this answer|||||

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .