4 ms·

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them. Every so often HN rolls their eyes at all these id

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them. Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective? Or, in short, why is "curl | sh" frowned upon and why are alternatives better?

thrower123 8y ago
An installer should be digitally signed, and Windows will flag unsigned installers and try to tell you it is questionable to run. You can also check that an installer isn't corrupted sfter downloading and before running, classically withe the md5 hash.
- amaccuish 8y ago
  That's Windows. There's no such thing on linux.
  - pjmlp 8y ago
    Yes there is, that is what package managers are for. And if one gets a random .rpm/.deb package, then it should be installed only if the digital signature is valid.
bobalob_wtf 8y ago
It all comes down to trust. If you trust that the code you're downloading is good then by all means curl | sh. A lot of things can go wrong with this though, if you pull a script from a github link and run it, the code could have been modified since you last looked at the repo and now you're directly running malicious code. When you download an msi in Windows and then double click to install, you're also putting your trust in the website, the software author and anyone else in the supply chain. I think the better option is downloading, manually reviewing the script you downloaded, and then running it. If you're devops-ing something then you should probably download the script/code and then do some kind of hash or signature check to make sure it's the known good version, then run it.

4 ms·

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them. Every so often HN rolls their eyes at all these id

by skrebbel 8y ago

thrower123 8y ago
An installer should be digitally signed, and Windows will flag unsigned installers and try to tell you it is questionable to run. You can also check that an installer isn't corrupted sfter downloading and before running, classically withe the md5 hash.
- amaccuish 8y ago
  That's Windows. There's no such thing on linux.
  - pjmlp 8y ago
    Yes there is, that is what package managers are for. And if one gets a random .rpm/.deb package, then it should be installed only if the digital signature is valid.
bobalob_wtf 8y ago
It all comes down to trust. If you trust that the code you're downloading is good then by all means curl | sh. A lot of things can go wrong with this though, if you pull a script from a github link and run it, the code could have been modified since you last looked at the repo and now you're directly running malicious code. When you download an msi in Windows and then double click to install, you're also putting your trust in the website, the software author and anyone else in the supply chain. I think the better option is downloading, manually reviewing the script you downloaded, and then running it. If you're devops-ing something then you should probably download the script/code and then do some kind of hash or signature check to make sure it's the known good version, then run it.