3 ms·
I thought about that, but like falcolas said, they are at least signed and have some attention paid to them. At one level, any build/install tool is executing
by hyperpape 7y ago
I thought about that, but like falcolas said, they are at least signed and have some attention paid to them.
At one level, any build/install tool is executing extremely complicated code on your machine, and could do lots of weird things. The advantage is that you can learn what it does, and have trust in its authors. So well behaved custom scripts created by a trusted party that has articulated standards about how things should work are much better than using shell scripts from an arbitrary project.
Still, I'd certainly prefer it if the distro didn't have custom scripts either. It would simplify the task of knowing "this is how the distro does things, and there are no exceptions".
- oblio 7y agoYou missed something, my main point: not all packages that are installed with the distro package managers come from the distro. There's plenty of applications that package their software as .deb/.rpm/... From a security point of view, those are the same as curl | bash, basically.
- hyperpape 7y agoAh yes. I did gloss over that. I certainly feel a little sketched out when I see a project that says "add this package repo".