I\u2019ve been having fun writing about my adventures in PowerShell. I would like to thank everyone for their encouragement and feedback. Something that I haven\u2019t explicitly stated \u2013 which should go without saying as this is a blog \u2013 is that I am not a PowerShell expert. This is one man\u2019s journey learning about PowerShell. I consider myself an expert on C#, .NET, and many other things, but as for PowerShell, I am a hacker. I learn enough to get the job done.<\/p>\n
Yes, I wrote psake<\/a>, which is a cool little PowerShell-based build tool, if I do say so myself. I wrote it in part to learn more about PowerShell and what was possible. (I surprised myself that I was able to write a task-based build system in a few hours with about 100 lines of PowerShell, ignoring comments.)<\/p>\n If you\u2019re looking for PowerShell gospel, I would recommend checking out the Windows PowerShell Blog<\/a> (the blog of Jeffrey Snover and the rest of the PowerShell team), Windows PowerShell in Action<\/em><\/a> by Bruce Payette, the PowerScripting Podcast, or any of the myriad PowerShell MVP blogs. They are the experts. I\u2019m just a hacker having fun.<\/p>\n With that disclaimer, I hope that by documenting my PowerShell learnings in public, I will help other developers learn PowerShell. I know that I am learning great things about PowerShell from my readers. In Getting Started with PowerShell – Developer Edition<\/a>, I lamented the lack of grep. My friend, Chris Tavares<\/a> \u2013 known for his work on Unity and ASP.NET MVC – pointed out that Select-String can perform similar functions. Awesome! Then in PowerShell, Processes, and Piping<\/a>, Jeffrey Snover himself pointed out that PowerShell supports KB, MB, and GB \u2013 with TB and PB in v2 \u2013 so that you can write:<\/p>\n get-process | where { $_.PrivateMemorySize \u2013gt 200MB }<\/p>\n rather than having to translate 200MB into 200*1024*1024 as I originally did. Fantastic!<\/p>\n In Writing Re-usable Scripts with PowerShell<\/a>, wekempf<\/a>, Peter<\/a>, and Josh<\/a> discussed the merits of setting your execution policy to Unrestricted. I corrected the post to use RemoteSigned, which means that downloaded PowerShell scripts have to be unblocked before running, but local scripts can run without requiring signing\/re-signing. Thanks, guys. I agree that RemoteSigned is a better option.<\/p>\n Let\u2019s talk security for a second. I am careful about security. I run as a normal user on Vista and have a separate admin account. When setting up teamcity.codebetter.com<\/a>, the build agent runs under a least privilege account, which is why we can\u2019t run NCover on the build server yet. (NCover currently requires admin privs, though Gnoso is working on fixing that in short order.) (Imagine if we did run builds as an Administrator or Local System. Someone could write a unit test that added a new user with admin privs to the box, log in remotely and start installing bots, malware, and other evil.) So I tend to be careful about security.<\/p>\n Now for my real question\u2026 What is the threat model for PowerShell that requires script signing? Maybe I\u2019m being really dense here, but I don\u2019t get it. Let\u2019s say I want to do something really evil like formatting your hard drive. I create a PowerShell script with \u201cformat c:\u201d in it, exploit a security vulnerability to drop it onto your box, and exploit another security vulnerability to launch PowerShell to execute the script. (Or I name it the same as a common script, but earlier in your search path, and wait for you to execute it.) But you\u2019ve been anal-retentive about security and only allow signed scripts. So the script won\u2019t execute. Damn! Foiled again! But wait! Let me just rename it from foo.ps1 to foo.cmd or foo.bat and execute it from cmd.exe. If I can execute code on your computer, there are easier ways for me to do bad things than writing PowerShell scripts. Given that we can\u2019t require signing for *.cmd and *.bat files as this would horribly break legacy compatibility, what is the advantage of requiring PowerShell scripts to be signed by default? Dear readers, please enlighten me!<\/p>\n UPDATE:<\/strong> Joel \u201cJaykul\u201d Bennett<\/a> provided a good explanation in the comments. I would recommend reading:<\/p>\n