4 ms·
I agree with the HTTPS part, but aside from that I can't really see how it's less safe than saying "here, install this .deb (which gets to run scripts as root)
by BHSPitMonkey 10y ago
I agree with the HTTPS part, but aside from that I can't really see how it's less safe than saying "here, install this .deb (which gets to run scripts as root) and then run the binary inside".
- viraptor 10y agodeb packages distributed to the public should be pgp signed and in a proper repository. It doesn't help people who will just force-install it anyway, but if they care it allows verification.
- flukus 10y agoBoth require trusting others, how is this any different?
- viraptor 10y agoOut of band verification. When you're doing curl pipe sh, you're trusting the host and that's it. With packages, you can verify the trust against external services like keybase, check website archive for changed key ids, check signatures on the public key if the author is into things like web of trust. It won't protect you against someone being directly malicious, but it will against MitM, website hacks, etc. It also establishes semi-permanent trust on first use.
- Dayshine 10y ago>Out of band verification. When you're doing curl pipe sh, you're trusting the host and that's it. With packages, you can verify the trust against external services like keybase, check website archive for changed key ids, check signatures on the public key if the author is into things like web of trust. Your grandma is pretty advanced.
- oblio 10y ago> Your grandma is pretty advanced. Grandma level: Grace Hopper.
- viraptor 10y agoWho said anything about grandmas. The topic was "what's better than curl pipe sh". The target crowd knows how to use the terminal. But if the software is already installed, trusted package author also allows secure updates.