4 ms·
Because a pypi package can be compared to a source. A piped bash script might change per-client or per-request.
by noja 8y ago
Because a pypi package can be compared to a source.
A piped bash script might change per-client or per-request.
- placebo 8y agoThis is the correct way to answer a question. Not sure why the parent question is being downvoted rather than simply being answered. All that does is promote ignorance.
- lemagedurage 8y agoThe average person doesn't compare the source, and the average person doesn't read the bash script, for them it's the same thing. For the person who wants to read the source, I'll argue that pressing backspace 6 time to delete "| bash" is _more_ straightforward than looking up the source for a PyPi package. There's only a subtle difference between a PyPi account and a server (script hosted on Github?) being pwned. Though yes, I do believe they shouldn't have used an URL shortener.