3 ms·
I mean really how is that different from downloading .exe installers and running them?
by ziftface 8y ago
I mean really how is that different from downloading .exe installers and running them?
- Karunamon 8y agoThe more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
- bigiain 8y agoI reckon the biggest problem is normalising the pattern. Piping (https) curl to shell from a site who you were going to trust and download software/run from if they had an alternative method anyway - is no less secure than downloading a tarball or .dmg from the same site. Getting into the habit of piping curl to shell is a bad idea though. It's gonna be easier when you're in a rush to not notice you're copy-pasting "curl -sSL https://install.pi-hole.ru https://install.pi-hole.ru | bash" from some "helpful" forum post...