3 ms·
What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the int
by BHSPitMonkey 11y ago
What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.
- dragonne 11y agoWhile I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!
- BHSPitMonkey 11y agoWhile that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.
- blub 11y agoThe point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine. At the minimum I want to know what it does and where it puts stuff. This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies. By the way, it's poor form to downvote someone just for disagreeing with them.