3 ms·
> There is no fundamental difference between curl .. | sh versus cloning a repo and building it from source I would say it depends. If the commits are signed b
by forty 7y ago
> There is no fundamental difference between curl .. | sh versus cloning a repo and building it from source
I would say it depends. If the commits are signed by a key you know it's probably better. Even if it's not the case, cloning with SSH if you know the host key is also slightly better than downloading through HTTPS where any (compromised) trusted CA can MITM your connection :) (you can argue that those to use cases are rare in practice, and I would agree with you ;))
- BadBadJellyBean 7y agoI don't think SSH is more secure. You have to verify the server key to make it secure. How do you do that? I have googled a bit and didn't find an obvious page for the github server keys. And even if I did I would be back to HTTPS MITM by compromised CA.