6 ms·
> Installing software by piping from curl to bash is obviously a bad idea and a knowledgable user will most likely check the content first While this is true,
by educar 10y ago
> Installing software by piping from curl to bash is obviously a bad idea and a knowledgable user will most likely check the content first
While this is true, how is this any different from installing using apt-get/dpkg/rpm ? I have never looked into any package I install. In fact, those things are worse because they require root unlike curl | bash.
At the end of the day it's about trust. If you trust the author(s), you would install it. I trust my distribution/browser/OS and I install things they want me to install it. So, if a project suggests "curl | bash", I would do it when I trust the project.
- rlpb 10y agoIt's not just about trusting that project. It's about trusting that project to understand relevant interactions with the rest of your system, which may include components or configurations that project's authors have never heard of. Developers can screw up even with the best of intentions. I trust distributions more because interactions between components is pretty much all they deal with. That's their specialty. I'm a distribution developer. I know first hand how often upstream projects screw up due to naivety, because it's my day job to fix their bugs.
- educar 10y agoDon't get me wrong, I definitely don't think that curl|bash can replace package managers. curl|bash can be used for getting software which doesn't need the sophisticatedness (and effort) of creating packages.