43 ms·

If you don’t actually read or verify the script this doesn’t matter. If you cant trust the server you probably shouldn’t run any code from it.

• hoophoop 7y ago
  But you can trust the large userbase of a popular Linux distribuiton, especially when big companies use it.
  • jchw 7y ago
    Distro package managers have other advantages than trust. Typically they at least verify cryptographic hashes but many of them also verify public key signatures as well. This is why its safe to download packages from mirrors. With that having been said, Debian takes an extra step into the absurd by using plain HTTP with no TLS for downloading packages. There’s no obvious security issue with that, but it does feel like a bad decision, since anyone in your request path can see what software you’re installing, and if there ever were a vulnerability it would be much easier to exploit due to the lack of security at the transport layer.
• falcolas 7y ago
  How does one trust a server? What assurances can any server provide that they are who they say they are? x509 certificates certainly don't provide those assurances.
  • jchw 7y ago
    No no no, human trust, not machine/cryptographic trust. The same way you have human trust (or distrust) over many things running on your computer. You didn’t get to verify any of the code in the firmware either. There’s differing levels of paranoia. I don’t pipe curl to shell at work. I do it at home sometimes, usually via Github.