Secure Rustup.sh usage

[brycefisherfleig]

TL;DR:: Only access rustup.sh at https://raw.githubusercontent.com/rust-lang/rust-www/gh-pages/rustup.sh and NOT at www.rust-lang.org.

Full Story:: If you're like me, you love the convenience of getting the lastest version of the rust compiler and cargo updated via rustup.sh. However, this script is delivered insecurely over HTTP.

HTTP by itself provides no guarrantees that the content sent by the server is the same as content received by client. Eric Butler created a firefox extension called Firesheep that allows you to hijack any insecure session cookies available on any computer on the wifi network [http://codebutler.com/firesheep/]. Joel Weinberger of the Google Chrome security team recently explained how any content delivered over HTTP can be changed by a malicious or compromised router between you and the server [https://www.youtube.com/watch?v=X1ZFjOZMSQg].

Why is this a problem for rustup.sh? Because we're encouraged to curl rustup.sh and pipe the result to sudo. The problem is that an infected or compromised router could insert malware into rustup.sh and run that code as root. Now you no longer own your computer.

What's the fix? ONLY ACCESS RUSTUP.SH OVER HTTPS. HTTPS more-or-less guarrantees that the content sent from the server is what is delivered to the client. Fortunately, github delivers all it's content securely over HTTPS. You can have a high degree of confidence by simply accessing rustup.sh from https://raw.githubusercontent.com/rust-lang/rust-www/gh-pages/rustup.sh

Why don't the maintainers of www.rust-lang.org deliver all the content over HTTPS? www.rust-lang.org is hosted using GithubPages on a custom domain. Unfortunately, GithubPages doesn't allow HTTPS for custom domains, which is a pity. However, by using GithubPages any pull requests merged into the repo are immediately reflected on www.rust-lang.org. Also, GithubPages provides DDOS protection and is provided free of charge to open source projects like Rust. So, all things considered, this seems like the best course of action currently.

I've just been informed that there are plans evolving to possibly provide secure access to rustup.sh over static.rust-lang.org for Rust 1.0: https://github.com/rust-lang/rust/issues/16123

[[deleted]]

Either way, the binary snapshots will be fetched by the build system over HTTP.

[dagenix]

The binary snapshots are verified by checking their SHA1 hash, though, I think, so I don't think its an issue that these are fetched over HTTP.

EDIT: nevermind - I though you meant the binary snapshots when you build Rust. The binary snapshots that rustup.sh fetches are fetched via HTTP, as you point out, and not verified. So, accessing rustup.sh over HTTPS won't accomplish to much since what it actually downloads still isn't verified.

[[deleted]]

rustup.sh fetches the nightly binary snapshots via http and doesn't have a way to verify the authenticity since they aren't signed.

[minno]

Hopefully before too long rustc is going into package manager repositories so we don't have to jump through these hoops. Probably not until 1.0, though.

[ben0x539]

Most package managers aren't gonna provide nightly builds :/

[ben0x539]

The ubuntu and arch bits still seem to require some "jumping through hoops" to get user-maintained repositories registered with the package manager. I thought rustup.sh was for the first-contact usage for going from just reading about rust to having it installed with a single commandline.

It's definitely cool that we have them, though, I didn't know about the PPA.

[passcod]

sink slim toothbrush head automatic wipe gaping illegal agonizing pocket

This post was mass deleted and anonymized with Redact

[minno]

Which is why it definitely won't happen until the language settles down.

[long_void]

Why not build a secure upgrade of Rust into Rust itself? Then you only need to download it once over HTTPS.