3 ms·
> There's nothing at all wrong with this. Sure, no server has ever been compromised and his binaries replaced... The good old pgp signatures, circle of trusts,
by riquito 10y ago
> There's nothing at all wrong with this.
Sure, no server has ever been compromised and his binaries replaced... The good old pgp signatures, circle of trusts, etc are not for show.
Eck, it's not even served from github.com but from a random proxy
- eridius 10y agoNothing you're describing applies to the scenario of "download, then execute" either, which is the alternative to "pipe to bash". Anyone who's willing to read the script first, or verify PGP keys, or whatnot, is perfectly capable of doing so even if the instructions tell you to pipe to bash. But the overwhelming majority of people don't do that.