2 ms·
There's nothing at all wrong with this. I'd say 99.999% of the time someone runs an installer script to install something, they don't read it first. And if you
by eridius 10y ago
There's nothing at all wrong with this.
I'd say 99.999% of the time someone runs an installer script to install something, they don't read it first. And if you're not reading the script first, then there's no benefit whatsoever to downloading it prior to executing, as opposed to just executing directly. The only reason to say "don't pipe into sh" is if you're saying "review the installer script 100% of the time before executing it", which, honestly, is advice nobody's going to follow.
- riquito 10y ago> There's nothing at all wrong with this. Sure, no server has ever been compromised and his binaries replaced... The good old pgp signatures, circle of trusts, etc are not for show. Eck, it's not even served from github.com but from a random proxy
- eridius 10y agoNothing you're describing applies to the scenario of "download, then execute" either, which is the alternative to "pipe to bash". Anyone who's willing to read the script first, or verify PGP keys, or whatnot, is perfectly capable of doing so even if the instructions tell you to pipe to bash. But the overwhelming majority of people don't do that.