mirror of
https://github.com/007revad/Synology_enable_M2_volume.git
synced 2026-04-25 13:05:54 +03:00
[GH-ISSUE #129] offline version of the script #455
Labels
No labels
enhancement
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/Synology_enable_M2_volume#455
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ageev on GitHub (Nov 16, 2023).
Original GitHub issue: https://github.com/007revad/Synology_enable_M2_volume/issues/129
Hi,
I don't like the idea that your script downloads and executes .sh file with root privileges on my NAS every time it shutdowns.
If one day this repo will be compromised – thousands of devices may be destroyed.
Is it possible to create an "offline" version of this script?
Regards,
Artyom
@007revad commented on GitHub (Nov 16, 2023):
Thanks for your concern and feedback Artyom.
The script only downloads a new version of the script if both the following are true:
If you don't run it with the --autoupdate option it only ask if you want to download the new version. If you don't answer yes within 10 seconds the script skips downloading the newer version and runs as normal.
Synology_enable_M2_volume only needs to be run after a DSM update.
The few instances of GitHub hacking that I'm aware of are where hackers:
To avoid scenario 1 I will never change my GitHub username.
Scenario 2 can't affect the script updating itself because it uses the real repository name to download any updates.
Of course there could be some new hack in future, so your concern is valid, if the --auto update option is used.
@ageev commented on GitHub (Nov 16, 2023):
Thank you for the detailed answer
This part of the script tries to download the binary even without autoupdate option, if I read it correctly
if ! which bc >/dev/null ; then # Download bc echo -e "\nDownloading bc" curl -kL "https://raw.githubusercontent.com/${repo}/main/bin/bc" -o /tmp/bcCan you please make sure that any binary download event will happen only if user directly requested it (for example, via an argument)?
There is also 3rd hacking option missing: your account was hacked and used to spread the malware.
@007revad commented on GitHub (Nov 16, 2023):
I just created a pre-release version v1.1.11-RC that:
If you want to compare the changes see:
github.com/007revad/Synology_enable_M2_volume@03bdf0b2d1@007revad commented on GitHub (Nov 16, 2023):
I previously googled for "github repository hacked". Searching just now for "github account hacked" found lots of results! Looks like I've got some reading to do.
I use 2-factor authentication on my GitHub account and I am the only person with access, and the authority to approve pull requests. My access token is limited to downloading only, so if someone got into computer and found the access token they couldn't push any updates to my repos.
@ageev commented on GitHub (Nov 17, 2023):
Thank you for prompt response on this issue. The changes you did cover the issue described.
A lot of companies (for example, Dropbox) were hacked due to Github-themed phishing recently. I may advise you to use Yubikey (or similar) FIDO token as a 2nd auth factor. Way more reliable than OTP/SMS. Google's phishing test is a good starting point to test yourself.
@007revad commented on GitHub (Nov 21, 2023):
@ageev
I've just released v1.1.13 which includes checking the md5 hash of the downloaded file.