4 ms·
Fair point on the future direction. SE says it better than me: https://security.stackexchange.com/questions/213401/is-curl-something-sudo-bash-a-reasonably-saf
by insomniacity 6y ago
Fair point on the future direction.
SE says it better than me: https://security.stackexchange.com/questions/213401/is-curl-something-sudo-bash-a-reasonably-safe-installation-method https://security.stackexchange.com/questions/213401/is-curl-...
Particularly the first link, which outlines how to return different things depending on whether it's being piped into bash or not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- Martinsos 6y agoThanks for sharing this! Reading this, there seem to be a lot of opposing opinions, but it seems to come down to curl being as safe as other methods, with the main problem being trusting the server from where the script is downloaded. In our case, server is github so that is allright, but script is on master, so that is tricky because we might update it at any moment, so you should check it once it is downloaded. That is a concern for sure, and there are ways to remove that concern. One thing that goes to our benefit though is that we are not requiring `sudo`. Thanks for pointing all this out, we will certainly be looking into better ways to install Wasp in the future!