4 ms·

Well... Is curl|bash insecure? YES Is curl|bash more insecure than most of the ways people install software they just download from the Internet? NO So it's

by davidu 11y ago

Well... Is curl|bash insecure? YES Is curl|bash more insecure than most of the ways people install software they just download from the Internet? NO So it's not ideal, but most people don't do anything else that's much better, and it's convenient, so you can expect it to continue.

4ad 11y ago
But they do. They use a package manager such as apt-get, that cryptographically checks everything. Installing software outside the package manager is the exception here, not the norm.
- federico3 11y ago
  And there is more: many people in security would agree that education is critical. We educate users to download software from distributions rather than trusting random sources (that might be very safe or not).
  - CuttlefishXXX 11y ago
    >trusting random sources A recent example to add to this, for those who think "nobody who's not a complete beginner would never do that": https://www.reddit.com/r/netsec/comments/3lefc6/chinese_ios_devs_download_xcode_from_3rdparty/ https://www.reddit.com/r/netsec/comments/3lefc6/chinese_ios_...
- fleitz 11y ago
  And yet their browser probably has unpatched vulnerabilities... Essentially, if someone wants to hack your system they will, whether it's patching your routers firmware, etc. If Iran can't keep stuxnet out of airgapped systems, you're not going to keep any serious actors out of your systems connected to the internet.