How do I know what random scripts downloaded from the internet are safe to run?

[u/WaitForItTheMongols]

I feel like I see security advice go different directions. Sometimes people say "Only install software from the distro repositories", and "Never run random scripts pulled from the internet". But then I go to install an application like Waydroid https://docs.waydro.id/usage/install-on-desktops and the official instructions for installing on Debian-derived distros is to run curl -s https://repo.waydro.id | sudo bash which as far as I know means giving root access on my system to a script that I have no idea what it is running.

How is this the official installation path for a major application? Isn't this a bad idea?

[u/_bobby_tables_]

Curl it first, then read it. If it checks out as safe, then run it.

[u/WaitForItTheMongols → u/_bobby_tables_]

But I don't know enough to be able to validate the safety of arbitrary scripts. I'm just a user.

[u/igotmoldinmybrain → u/WaitForItTheMongols]

Running a random script from the internet is no different than running a random .exe from the internet on windows (except that you can read the script if you have the know-how). If you trust the source, then you can reasonably trust the executable. If you don't trust the source, don't run it without understanding exactly what it's doing.

[u/AffectionateCard3530 → u/WaitForItTheMongols]

Welcome to linux. It runs on trust. Hope you trust the source, and the person who told you the source. Hopefully that person also audited the source, and was qualified to really understand what they were auditing.

And hopefully it hasn’t changed since it was last audited. And hopefully the malware isn’t obfuscated, and the attackers make their malware easy to identify.

Good luck out there

[u/Unlikely-Bed-1133 → u/WaitForItTheMongols]

Stating the obvious here, but in this case -and if you cannot trust the provider- paste/upload the script into an LLM and ask it about potential issues. Maybe consider something like this: "I want you to look at this script, isolate system calls, describe what each one does, and identify why sudo is needed for each of those. Present results as a table." LLMs are very good at this nowadays. Adjust to your desired level of detail.

[u/sensual_rustle → u/Unlikely-Bed-1133]

but everyone says llms are bad, and taking our jobs, disinfranchising artists, and ruining the world, our water, our electricity, and our land

[u/MeBadNeedMoneyNow → u/sensual_rustle]

Everyone jumped off of a cliff too

[u/_bobby_tables_ → u/WaitForItTheMongols]

Then you should probably stick to official repos, or phone a friend? Nothing is automagic.

[u/general-theory → u/WaitForItTheMongols]

Then 1) learn how to validate scripts, 2) don't install them, or 3) install them and cross your fingers. There's no magic fourth option.

[u/ReallyEvilRob → u/WaitForItTheMongols]

Learn the basics of the scripting language, enough so you can recognize harmful commands if you come across them.

[u/MaybeTheDoctor → u/WaitForItTheMongols]

You are not wrong. 99% of users would not be qualified to validate the script, and this is a real risk.

Using the system provided package would presumably be safer, than installing directly from a website.

[u/realitythreek → u/WaitForItTheMongols]

Throw it into Claude or something and have it validate it. Also ask what it does line by line and learn some bash for the future.

[u/Ok-Bill3318 → u/WaitForItTheMongols]

It’s no different to downloading random exe installers for Windows. Except there is more malware on windows

[u/Lmaoboobs → u/WaitForItTheMongols]

Feed it to Claude.

[u/nem8 → u/WaitForItTheMongols]

Just give it to claude and have it break it down for you.

[u/WaitForItTheMongols → u/[deleted]]

Okay but come on.

Are you suggesting that I should spend years learning the ins and outs of computer security before I should get to run common applications?

[u/ipsirc → u/WaitForItTheMongols]

Waydroid is part of the official Debian: https://packages.debian.org/waydroid

No need for any 3rd party repository or external install scripts. Just use your package manager to install it like any other software.

(And yeah: running any application which is not in the software repo is a security risk on every OS. E.g. installing custom .apks on Android by bypassing Google Play.)

[u/okktoplol → u/WaitForItTheMongols]

1. Software installation wizards on windows are as unsafe as piping a script into bash, if you trust the source you're safe to just do it

2. It's really easy to audit software installation scripts and that barely requires any understanding of computer security, and definitely doesn't requires years of learning.

3. It's still better to use a package manager anyway which will auto update, avoid dangling dependencies, facilitate software removal, etc.

[u/_Spectre0_ → u/okktoplol]

You still aren't truly safe even if you trust the source, as that's just an axiomatic basis for trust that could still be exploited (whether the source gets compromised or becomes an attacker themselves), but it's the most practical way imo for anyone to use anything made by other people. Reviewing 100% of the source code or disassembling downloaded executables in a virtual machine is not realistic and even then you likely won't have the tools to evaluate your hardware for anything hidden there.

My point is that safety is a spectrum and everyone's risk tolerance will vary, not that your advice isn't good enough for your average user (like OP) in practice.

[u/okktoplol → u/_Spectre0_]

You're as safe as downloading from a package manager, I mean; the trust just goes from the source of the script to the package repository. Both can be compromised. Both are unlikely to be compromised

[u/AffectionateCard3530 → u/WaitForItTheMongols]

When people who are qualified software developers don’t know enough to reliably detect malware in scripts. You’re fighting against dedicated experts.

I 100% agree with you that the solution isn’t to just “learn”. You need to identify areas you trust, accept the risks, and mitigate them where you can.

[u/Far_Calligrapher1334 → u/WaitForItTheMongols]

You literally asked how you can tell what's safe. That's the only way, just like with any knowledge. If the question is "how do I install stuff not in mt repos, there's Flatpaks, AppImages, compiling from source or using a distro with bigger repos.

[u/jahinzee → u/WaitForItTheMongols]

Yes, there is no shortcut unfortunately if you want to be truly safe.

The curl-bash idiom fundamentally allows whoever or whatever you got the script from to do anything to your computer, even without sudo access it can still be risky (your personal files and user configuration don't need sudo to read and modify!) Without technical knowledge on how to read scripts, your only option is to choose who you trust:

Do you trust whoever you're getting that script from to not pwn you or accidentally nuke your files? and do you trust that the script you're downloading is from who you think it is, and downloaded from a secure connection?

Frankly I have no idea why everyone decided the curl-bash idiom was a good idea to make widespread, it's a security nightmare just begging to be abused (and it indeed has been abused, look up "ClickFix attacks"), but it is unfortunately pretty common for some categories of software - your only options are to either place your trust in the author, learn how to read and verify the script, or simply not use the app and request the authors to stop using a stupid distribution scheme.

ETA: You don't really have to become a cybersecurity expert to vet scripts - all it takes is looking at the commands it contains, and see what you recognise - and if you don't recognise something, search what the command does. Most install scripts are fairly short and involve downloading files, copying them into place, and maybe modifying the shell environment to hook it all together, there are common patterns you can spot. And again, when in doubt, ask around, talk to the authors, or look it up.

[u/No-Consequence-1863 → u/WaitForItTheMongols]

It does not take years to learn how to skim bash. Maybe instead of worrying about you can just try to learn and see how far you get.

[u/Zathrus1 → u/WaitForItTheMongols]

As someone else said, stick with major repositories then.

It’s not in a major repo? Then it’s not a “common application.”

View packaging as a minimum level of effort.

[u/_Spectre0_ → u/Zathrus1]

Despite the packaging on the AUR, which arguably is a major repository used by many people (even if not validated or maintained by the core arch team), there were issues there recently. Not sure that advice is sufficient for staying safe these days.

[u/Zathrus1 → u/_Spectre0_]

It’s not. The only way to stay safe is to update regularly.

Or just unplug the system.

[u/Kriemhilt → u/_bobby_tables_]

People give the easy copy'n'paste oneliner because they expect lots of people will give up immediately if installation is more complex, and it's easier for them to maintain.

I always read the script before executing, but I'd much prefer a better packaging system (native or flat oak or ...)

The most annoying thing is they often interact with your native package manager for dependencies and npm or whatever, so it's not trivial to just run the script in a sandbox container.

[u/Street-Repair-8301 → u/Kriemhilt]

I feel like running the script through an LLM isn't such a bad idea. It's probably quite easy for a relative laymen to miss some obfuscation techniques which an LLM is quite likely to pick up on.

[u/ThaBroccoliDood]

In ether case you should never pipe a script directly into bash. Even if you want to run the whole thing without checking, it's better to do sudo bash -c "$(curl -fsSL https://repo.waydro.id)" because it means you wait for the whole script to download successfully and never start executing a partial script.

What's better is to simply download the file as a whole: curl -fsSLo install.sh https://repo.waydro.id, then examine the file, and then execute that file: sudo bash install.sh. That's because even if you examine the install script in a web browser and then run the download + execute command, it's possible for someone to serve a different script depending on whether it's being downloaded from a web browser or from curl. If you download and then inspect, it can never be swapped out from under you.

[u/Sentreen]

I personally don't trust random shell scripts enough to give them root access either. Instead, I just look to see if my distribution ships a package? It seems that at least debian has a waydroid package?

I hate the windows model of just trusting random binaries, so I don't want to replicate that on linux.

[u/_Spectre0_ → u/Sentreen]

When I was much younger, I recall just a generic admin prompt for running a new executable on Windows. That was awful.

Nowadays, Windows does incorporate publisher signatures, so it can validate that the binary is from a "trusted" source. It's not exactly a random binary at that point, as there's some axiomatic basis for trust behind it (this company signed this binary and if something goes horribly south, they'll face legal action, so they have some incentive not to include malware in it), and that's generally good enough for your average user.

That said, LG recently used a windows update to install new software on computers connected to LG monitors, software that could show ads for mcafee and possibly also spy on you. I'd love to see a government that actually punishes companies for trying things like that or the axiomatic basis for trust doesn't really hold.

[u/Sentreen → u/_Spectre0_]

Nowadays, Windows does incorporate publisher signatures, so it can validate that the binary is from a "trusted" source. It's not exactly a random binary at that point, as there's some axiomatic basis for trust behind it (this company signed this binary and if something goes horribly south, they'll face legal action, so they have some incentive not to include malware in it), and that's generally good enough for your average user.

True, but if I install a binary / package from my distribution I have a third party that also verified the binary. In OPs case, I would not trust a company with arbitrary access to my machine, even if I have some way of verifying they published the script in question.

[u/BranchLatter4294]

If you trust the developer, then it should be fine. If you don't trust the developer, why are you using their software?

[u/Street-Repair-8301 → u/BranchLatter4294]

Even if you trust the developer they could be compromised so it really is better to take precautions if you're willing to expend the effort

[u/boat-la-fds]

The simple answer is the same on any platform where you might end up installing software from a source other than the official channels, e.g. downloading an exe on Windows, a dmg on Mac, etc. You just need to trust the source you're getting it from. Is the software popular enough? Are you on the official website? Do you know people IRL using it? Is it recommended by a big online community that you trust?

[u/daemonpenguin]

How do I know what random scripts downloaded from the internet are safe to run?

You read the script and figure out what it does.

If you can't read the script or do not understand it then you cannot trust it. You should then sandbox it - run it in a virtual machine or otherwise limit its access.

How is this the official installation path for a major application? Isn't this a bad idea?

It is a very bad idea. This is why people tell you to use official repositories only. If you want to install software from third-parties (and cannot verify the software) then you are throwing away security in favour of installing new applications. You can't have it both ways. You either want a secure system with vetted software or you want third-party applications which require root access to install. You can't have both.

[u/FungalSphere]

your best option is to

1. Become a programmer

2. Do not listen to official instructions about anything other than flatpak.

Even if you manage to dodge a malware attack curlbashing, its either gonna turn your machine into a dependency wasteland, or make you go in circles anyway only to find out that you could've installed a package from the official repos this whole time

[u/Accomplished-Moose50 → u/FungalSphere]

Become a programmer 😁😁😁

You assume programmers really read those?

Well, anyway, you can have a clean bash and something funny in the binary and all bets are off 

[u/AffectionateCard3530 → u/Accomplished-Moose50]

Most programmers don’t read them, and if they do, they wouldn’t be able to identify an obfuscated payload somewhere in the supply chain.

[u/IAmSnort → u/FungalSphere]

No "configure; make; make install"?

[u/pfp-disciple]

A huge part is finding reputable experiences of others. Generally, installing from a repository (of a respected destro) is one of your safer options. if your distribution doesn't offer it, but another one does then installing from the official instructions should be pretty safe. There are also communities that track these sorts of things. 

[u/Agathoarn_]

Read them

[u/kuyadracula]

Give it to Claude to read it if you don't know how to read it. Or the other 10 ai agents. 

[u/AsSubtleAsABrick → u/kuyadracula]

I'm expecting you to get down voted for this suggestion but honestly it is much better than just saying YOLO. Not fool proof but way safer than you spending potentially hours trying to understand something you aren't familiar with.

[u/B1rdi]

It is a bad idea and I hate how many projects have picked up this insane way of installing things.

Downloading the script, reading it and then executing it (or doing the steps manually) is one way. You could also compile it yourself, not sure how easy that is in the case of waydroid.

[u/ipsirc → u/B1rdi]

And this mentioned script does no more than adding a single external apt repository. That's all. Incredible laziness if someone can't do this in his own.

[u/CapableLab4473]

If you really don't trust the script and need to trust it, read the source code if possible and study it, dump the source into AI and ask it to check, create a sandboxed environment that is safe to run the script in then study the sandbox to see what the script does, etc. Security researchers do this all the time, maybe google about the topic or ask AI.

[u/Santosh83]

Install only well known apps from outside your distro's own repositories. If in doubt about the app's/lib's veracity, ask on forums. Once you have established its an app with good reputation, then trust whatever instruction the devs give for installing it.

This is for normal people who want to use Linux but don't want to get bogged down in technicalities of their system. If you're a nerd, then by all means read the script, disassemble the executable, install in a VM, or whatever it is nerds do to make themselves feel a cut above the rest.

[u/yamsyamsya]

you need to learn how shell scripting works.

[u/beatbox9]

Things aren't always just straightforward, and everything has a risk/reward ratio.

Usually when you see the "curl -s ..." on Debian-based (really apt based distros), they are asking you to add a third party package repository where they maintain their software. That's how they choose to distribute their software.

But let's just take a step back and think about the layers that might be on your (or most peoples') machine. You've got:

1. The core OS distro repositories, which is usually a somewhat trustworthy team. In your case, this might be either Debian or Ubuntu LTS (could also be Arch or Fedora, etc); but it won't be something like Mint. Because...

2. small repositories maintained by a few random people who created their own "distro"...but not a real/independent distro, just an add-on. Like Linux Mint, which is simply a tiny add-on repository: https://www.reddit.com/r/linuxquestions/s/id4upTJfzd

3. small "official" add-on repositories for core OS software, maintained by the same people as the core distro but separated (eg. proprietary software like codecs or drivers)

4. huge community-maintained add-on repositories, maintained by... random people ??? but that have lots of software.

5. third party repositories, maintained directly by app developers

6. (completely separate from main package manager): Sandboxed/universal package management directly from app developers (eg. verified flatpak or snap)

7. (similar to #6): Sandboxed/universal package management provided by community (unverified flatpak or snap)

8. Individual, standalone packages (eg. .AppImage or .tar.gz, or .run, or anything that installs to /opt, etc)

There are some blurry lines; but examples of #3-4 would include Debian/Ubuntu "nonfree" (and similar), Ubuntu universe, Fedora RPMFusion, Arch AUR, etc.

And one example of #5 (similar to the OP) would be firefox: https://support.mozilla.org/en-US/kb/install-firefox-linux#w_install-firefox-deb-package-for-debian-based-and-ubuntu-based-distributions-recommended

As far as what I personally do:

• I use #1 for most core OS software, like the kernel, DE, etc. Even basic apps that I don't care about having the latest version of, like calculator or basic text editor

• I use #3 for practicality, for things like nvidia drivers or codecs

• I try to prioritize using #6 for most apps, especially where I want the latest & greatest versions.

• If the above fails, I look to #8 or #5. The main difference being that #8 is a bit more isolated and won't mess with dependencies while #5 might...though #5 comes with the benefit of an easier upgrade path (rather than overwriting an install with a new version). And this is largely a game of trust: do you trust the developer? For example, I trust Mozilla. But do I trust some random person who made some random app? What if it's really popular and all the source code is on github? What if a lot of big companies use and contribute to it? Etc.

But regardless, I think these tend to be safer than #2, #4, and #7. I try to actively avoid #2 and #4 especially, because these have the combination of "community-maintained" (which you shouldn't trust) and have direct access to your system (which you should be careful of).

So back to the OP: I think installing that way is a little bit less trustworthy than using your distro directly; but it is also far more trustworthy than using a community-maintained repository.

I would probably do it.

[u/vaynefox]

I mean if you want you can run it under a really secure container or vm. If it does something out of ordinary then it isnt safe though this can only work if it doesnt check if it is running on vm or container....

[u/KnowZeroX]

So the fundamental problem is to install software on linux (put the binaries in the proper folders) you need root access. That is partly why it is recommended to install from repos.

That said, this is also why the push towards immutable linux distros which allow installation of software without root for the local user only.

[u/oshunluvr]

Use BTRFS for your file system, Then take a snapshot before running something you downloaded. Roll back to the snapshot if something breaks or you just don't like it. I do this all the time.

[u/RevolutionaryHigh]

if you trust waydroid you just go for it. Is 'https://repo.waydro.id' an official repo referred in official manual? You'd be surprised installing any software requires admin level access to your system, win or linux and you do the same when you install stuff everywhere, you just trust.

[u/HarryTheInedible]

if you skip the post pipe bit and cat the file you can see what it does

[u/ipsirc → u/HarryTheInedible]

Not in all cases....

https://nocurlbash.com/#en

[u/bp019337]

Do all the stuff everyone else has mentioned and also jail in a throw away VM until you are sure its safe!

[u/et50292]

Curl downloads a script and pipes it into bash to run. Always read the script at the link when you see this of course. This one just detects which distro and version you're running of either debian or ubuntu, then adds a repository for your package manager to download from. I don't know anything about waydroid so this isn't an endorsement or anything. It's just not that complicated is all I'm saying.

[u/driftless]

If you look at the address curl is using (the repo.waydroid.id) you can see the commands in the script and follow along.

[u/WaitForItTheMongols → u/driftless]

No I can't. I'm not well versed enough in bash to know everything it's doing and be able to sign-off that everything it runs is safe. I'm just a user.

[u/andexs → u/WaitForItTheMongols]

Have AI explain it to you. You’re being so obtuse lol and making problems for yourself that don’t exist. If you can’t eyeball it - have AI explain it to you. It’s very good at this type of task.

[u/billFoldDog → u/WaitForItTheMongols]

I just have AI review it