33 ms·
I was going to try out Rust, then I saw this on the download page curl https://sh.rustup.rs -sSf | sh Really?
by jjgreen 8y ago
I was going to try out Rust, then I saw this on the download page
curl https://sh.rustup.rs -sSf | sh
Really?
- steveklabnik 8y agoYes. The script is less than 400 lines, and is pretty easy to audit. We wrote it in such a way to prevent some issues like "if the download gets cut off only part of the script gets run." It's served over HTTPS. You can also probably get an install from whatever package manager you use, if you prefer that.
- tpxl 8y agoYou can detect whether the script is being piped into sh, so downloading the script via for example FF might produce different results than piping it to shell, making audits useless.
- steveklabnik 8y agoSure. If you're worried about that, it's easy enough to download it first, and then run it, without the pipe. If you're auditing it, you've already downloaded it, so it's unclear to me why you'd re-download and pipe rather than just running it.
- nimmer 8y agoYou still have zero guarantee that other people are getting the same code. Encouraging people to run code from some random URL on the Internet is always bad.
- _pmf_ 8y agoWould you like to download your script wrapped in a .deb post-install/pre-install section? Would that make you feel superior?
- ElBarto 8y agoI've been looking at Rust recently, and my conclusion is that it is not production-ready. It seems like an ever-changing work in progress at the moment, with idiosyncrasies such as this.