4 ms·

Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloa

• flukus 8y ago
  > why would this be any more dangerous than downloading and installing from a a package manager? Normally the packager and developer are different people so there is a second set of eyes to at least give a cursory glance to the changes. It takes more than a single compromised account to publish malicious changes. There are of course a million exceptions and caveats to this and it's not perfect, but it's better than allowing developers to push code directly.
• adev_ 8y ago
  > Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager? Most package manager use an offline signature mechanism done at build time (rpm, dpkg, nix) and do not rely on HTTPS security for anything else than eyes-dropping reasons. Relying purely on HTTPS is insecure. Nothing guarantee you that your source / script / package did not get hacked / modified between the time you uploaded it and the time your user downloaded it. This is not hypothetical scenario, it already happened in the past with sites like sourceforge.