Repository navigation
Who's behind https://dotnet-install.sh ? #419
Description
It seems to download a version of the script that appears to be outdated compared to the official one. Is this possibly a preparation for a bait-and-switch tactic, or could it just be a well-intentioned effort to provide a convenient shortcut for the community?
Metadata
Metadata
Assignees
Labels
No labels
Activity
MichalPavlik commentedon Nov 23, 2023
This looks fishy. Please, download scripts only from Microsoft domains. We now support GPG detached signing so you can check integrity of the file before you execute it.
mairaw commentedon Nov 23, 2023
Where did you find that link?
The only valid alias for that file is https://dot.net/v1/dotnet-install.sh. Now that we only have one version, we could even just shorten the alias.
nodakai commentedon Nov 24, 2023
I attempted to revisit the official reference documentation for the script I had read before. I typed
dotnet-install.shinto Firefox's address bar, expecting it to either bring up the relevant page from my browsing history or default to a Google search if the phrase wasn't found. Firefox recognized it as a domain name and, to my surprise, displayed a scriptkubilayeldemir commentedon Nov 24, 2023
The same thing happened to me, I was trying to search for information about dotnet-install.sh, and in my case, Chrome recognized it as a file and downloaded it.
It is easy to fall in to this trap, I was trying to search for information and downloaded an unknown .sh file from the internet.
mairaw commentedon Nov 28, 2023
Gotcha. Thanks for the additional context! Was just trying to understand if there were any sites promoting this other domain.
YuliiaKovalova commentedon Apr 10, 2024
Do we have any updates on this ticket?
ArwynFr commentedon Aug 15, 2024
FYI:
.sh | country-code | Government of St. Helena
The registrar is NAMECHEAP
The NS is hosted by CLOUDFLARE
A[AAA] records resolve to IPs in AS13335 CLOUDFLARENET
Source: https://www.nslookup.io/domains/dotnet-install.sh/dns-records/