5 ms·

But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...

tokenizerrr 11y ago
You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.
- snowwrestler 11y ago
  Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.
  - tokenizerrr 11y ago
    I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.
    - snowwrestler 11y ago
      I think that once we're talking about installing server software at the command line, we're already beyond most of the masses. I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.
      - tokenizerrr 11y ago
        Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.
      - zokier 11y ago
        > And there are more secure options: the package managers. So sandstorms installation guide should in your opinion just say "wait a couple of years and maybe someone will have packaged it for your distro"? Yes, that sounds excellent way of getting users. And hey, the most secure way of installing software is not to!
        throwaway2048 11y ago
        you can host your own repos pretty easily, and still provide the bash script for oddball distros.
      - lmm 11y ago
        I don't think it's possible to make things secure for people who don't care, except by disallowing third-party software entirely. Deciding who you trust is fundamental.
  - zokier 11y ago
    curl|bash is just a shorthand way to say "here is an URL for install script you can run with bash" which happens to be also conveniently copy-pasteable. You can do whatever you want with that information.
- raesene4 11y ago
  Of course, but the article being discussed is about curl|bash so I felt that comment was relevant :)

tokenizerrr 11y ago

You do realize you don't have to use curl|bash, right? You can wget, verify with gpg and then bash it.

snowwrestler 11y ago
Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.
- tokenizerrr 11y ago
  I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.
  - snowwrestler 11y ago
    I think that once we're talking about installing server software at the command line, we're already beyond most of the masses. I'd also argue that secure defaults are most important for folks who don't care. And there are more secure options: the package managers.
    - tokenizerrr 11y ago
      Don't forget about workstations, but you're right. Though personally I install a lot of stuff on one-off VMs to try it out. I don't really care about security there because the VM is in an isolated network and will be erased an hour later anyway.
    - zokier 11y ago
      > And there are more secure options: the package managers. So sandstorms installation guide should in your opinion just say "wait a couple of years and maybe someone will have packaged it for your distro"? Yes, that sounds excellent way of getting users. And hey, the most secure way of installing software is not to!
      - throwaway2048 11y ago
        you can host your own repos pretty easily, and still provide the bash script for oddball distros.
    - lmm 11y ago
      I don't think it's possible to make things secure for people who don't care, except by disallowing third-party software entirely. Deciding who you trust is fundamental.
- zokier 11y ago
  curl|bash is just a shorthand way to say "here is an URL for install script you can run with bash" which happens to be also conveniently copy-pasteable. You can do whatever you want with that information.
raesene4 11y ago
Of course, but the article being discussed is about curl|bash so I felt that comment was relevant :)