3 ms·

No, installing a package using my package manager will a) ensure this exact binary/script is GPG signed by someone I ostensibly trust b) ensure it's not been

No, installing a package using my package manager will a) ensure this exact binary/script is GPG signed by someone I ostensibly trust b) ensure it's not been tampered with by a MitM between the hosting server and my computer This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone is MitM-ing me".

scrollaway 10y ago
That does not invalidate what I said.
- bigbugbag 10y ago
  It absolutely does. You trust the distro maintainer and have a security mechanism to ensure the scripts and binaries have not been tampered with. So virtually no risk of MitM and very little risk of malicious scripts and binaries. Reading script and decompiling binaries does not imply you understand every thing they do, but it does imply that you have an unlimited amount of time which is impractical at best.
  - scrollaway 10y ago
    No, it really doesn't. I was not comparing to distro packages (which are an excellent solution to the problem, like I said elsewhere) but to download links.
jpgvm 10y ago
Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees. Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do. The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball. It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.
- semi-extrinsic 10y ago
  > Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
  - jpgvm 10y ago
    Unfortunately the majority of package managers are bloated and awful. Pacman/PKGBUILD and emerge/ebuilds are notable exceptions, though there is also Nix and many super simple based tarball systems that are also very good. But all of that is irrelevant when 99% of the Linux world is running RPM/APT.

scrollaway 10y ago

That does not invalidate what I said.

bigbugbag 10y ago
It absolutely does. You trust the distro maintainer and have a security mechanism to ensure the scripts and binaries have not been tampered with. So virtually no risk of MitM and very little risk of malicious scripts and binaries. Reading script and decompiling binaries does not imply you understand every thing they do, but it does imply that you have an unlimited amount of time which is impractical at best.
- scrollaway 10y ago
  No, it really doesn't. I was not comparing to distro packages (which are an excellent solution to the problem, like I said elsewhere) but to download links.

jpgvm 10y ago

Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees. Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do. The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball. It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.

semi-extrinsic 10y ago
> Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
- jpgvm 10y ago
  Unfortunately the majority of package managers are bloated and awful. Pacman/PKGBUILD and emerge/ebuilds are notable exceptions, though there is also Nix and many super simple based tarball systems that are also very good. But all of that is irrelevant when 99% of the Linux world is running RPM/APT.