4 ms·

why not though? how is 'git clone a huge repo and run an obfuscated makefile' safer?

• geofft 9y ago
  I do genuinely wonder if all the folks on the "let's make fun of curl | sh" train also steadfastly refuse to run ./configure on tarballs from SourceForge, and instead spend the time to audit every custom M4 macro in the project along with every Makefile.am (lest either of them shell out to something untoward) and run autoreconf themselves.
  • lstamour 9y ago
    Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routines didn't make it in. I'm assuming, of course, that any code you compile, you'd eventually want to /run/ somewhere. And if you're going to sandbox it or use permissions to restrict it, well, you could always do the same with the curl command. ;-)
• erikb 9y ago
  git check certificates to make sure the source is (more likely to be) legit. And as far as I know it doesn't randomly executes downloaded files without giving you the opportunity to review them.
  • icebraining 9y ago
    curl also checks the HTTPS certificate.