4 ms·

malware

• acdha 8y ago
  Think about this more: what malware are you going to get by running that command that you wouldn't get by downloading the file and running it locally? You'll eventually realize that the answer is that this advice has no value. What could potentially have value is reviewing the code before running it, which can be done either way.
  • jdeca568 8y ago
    There is one difference still, by downloading it locally, you only have to check it once and not everytime you want to use the script. You definitely have to trust more parties by piping from the web, and these parties could be compromised at some point. This might be fine, it depends on your own security policy.
  • v_lisivka 8y ago
    Of course, I can get malware in both ways, so recommended way is to trust a third party, a maintainer, which will review code, and then will create signed package.
    • acdha 8y ago
      Right, so rather than talking about curl | bash it would really be better to talk about your review process since, for example, the same concerns apply if you do something like "npm install" without vetting every dependency.