4 ms·
And furthermore, it's a matter of trust. If I don't trust the source that I'm running the software from, then curl|sh isn't the problem.
by geocrasher 7y ago
And furthermore, it's a matter of trust. If I don't trust the source that I'm running the software from, then curl|sh isn't the problem.
- falcolas 7y agoTrust, and what you download from a web server, are two distinct issues. There is no way to verify that the content you get from a web server is what the developer wrote (particularly when you get into chains of 301 redirects to a github repo. Packages, at least, provide a signature from the developers (or distro packagers) that you can verify independently.