3 ms·

The truth is, nobody personally vets the source of all the software they use. Even people who compile everything themselves aren't reading the source code that

The truth is, nobody personally vets the source of all the software they use. Even people who compile everything themselves aren't reading the source code that came over the wire. It baffles me when people fret over "don't blindly run that curl|bash installation script because security!" when nobody would bat an eye at a .deb downloaded from the same web site.

blub 11y ago
There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.
- BHSPitMonkey 11y ago
  What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.
  - dragonne 11y ago
    While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!
    - BHSPitMonkey 11y ago
      While that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.
  - blub 11y ago
    The point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine. At the minimum I want to know what it does and where it puts stuff. This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies. By the way, it's poor form to downvote someone just for disagreeing with them.

blub 11y ago

There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.

BHSPitMonkey 11y ago
What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.
- dragonne 11y ago
  While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!
  - BHSPitMonkey 11y ago
    While that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.
- blub 11y ago
  The point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine. At the minimum I want to know what it does and where it puts stuff. This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies. By the way, it's poor form to downvote someone just for disagreeing with them.