4 ms·
Not to take away from the content, but I do cringe whenever anything is installed by piping curl into bash. Yes, I understand that's exactly the provided way to
by Everlag 10y ago
Not to take away from the content, but I do cringe whenever anything is installed by piping curl into bash. Yes, I understand that's exactly the provided way to install GVM and that this is supposed to be on a throwaway VPS, but this is an article focusing on security :|
If you were referencing a specific commit, okay. Just installing from HEAD? You might as well email the maintainer your credentials.
- niij 10y agoThe credentials to the single-use case VPS you just setup?
- penagwin 10y agoI mean, most programs run an installer as the alternative, which is still code being executed on your machine (often as root), doesn't piping bash have the same permissions?
- deleted 10y ago[deleted]
- runeks 10y agoHow is piping a script to bash any different from downloading an executable and running that? You would only do it from trusted sources, of course, but I assume you don't build everything from source, but download binaries every once in a while.
- kristianp 10y agoI was shocked to learn of the existence of gvm, and also that the tutorial says to use go 1.4! I would have thought that most of the time just installing go from golang.org would be recommended. Gvm would of course have it's uses, where you need to keep an existing app on an old version of go until you've tested it on the latest go (or making use of gccgo perhaps), but this should be rarer than the uses of ruby's rvm.