3 ms·
Tell me how this is different for downloading a binary instead. Unless you get something like a GPG through a completely different channel.
by aequitas 7y ago
Tell me how this is different for downloading a binary instead. Unless you get something like a GPG through a completely different channel.
- eeZah7Ux 7y agoFirst, distribution do exactly that. The GPG chain of trust is preinstalled. Second, there are at least 3-4 more attacks possible during curl-bash. You can simply read the links on HN.