4 ms·

The installation instructions tell me to curl a script straight into bash. Isn't this rather dangerous?

• spraak 10y ago
  You can look at the script first to see what it does
  • sac2171 10y ago
    That doesn't always work, and is still quite dangerous in the (abstract), usually your other programmers are friendly, but you should definitely be careful about it. Proof of concept: https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
    • spraak 10y ago
      Ah interesting, thanks for sharing that
    • adrusi 10y ago
      The idea is that you download the script, read through the downloaded file, then run the downloaded file. Obviously if you download it two different times the server can serve you two different versions.
• beefsack 10y ago
  http://overtone.github.io/emacs-live/doc-installation.html http://overtone.github.io/emacs-live/doc-installation.html Preferred installation is just cloning it yourself.
• parfe 10y ago
  Dangerous compared to what? ./configure && make && sudo make install? apt install xxxxxx? Downloading and running an exe? pip install git+https://github.com/somerandorepo/package-name-seems-legit.git https://github.com/somerandorepo/package-name-seems-legit.gi... You download and run arbitrary code without reviewing it all the time. Why does this specific method seem more dangerous to you than any other?
  • jjnoakes 10y ago
    https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html For one.